All Products
Search

This Product

    Container Service for Kubernetes:Customize containerd parameters for a node pool

    Document Center

    Container Service for Kubernetes:Customize containerd parameters for a node pool

    Last Updated:Oct 21, 2026

    When default containerd settings cannot meet your workload needs, customize containerd parameters at the node pool level. For example, configure multiple mirror registries for one image repository or skip TLS certificate verification for a specific registry.

    Limitations

    This feature requires containerd 1.6.20 or later. If your node pool uses an earlier version, upgrade it.

    Usage notes

    • Custom settings apply in batches — immediately on existing nodes, automatically on new nodes.

    • Do not modify customizable containerd parameters from the command line. ACK blocks such changes and requires you to revert them.

    • Non-standard syntax is automatically corrected during application.

    Customizable containerd parameters

    Custom container runtime configuration

    Parameter

    Note

    Type

    Value

    max_concurrent_downloads

    Maximum concurrent image layer downloads. Higher values speed up multi-layer pulls but increase network and I/O load.

    Int

    • Valid range: 1–20

    • Default: Depends on containerd version.

      • containerd 2.x+: 3.

      • containerd 1.x: Determined by the runtime's internal logic.

    ignore_image_defined_volumes

    Whether to ignore anonymous volumes defined by the VOLUME instruction. Set to true to prevent automatic anonymous volume creation.

    Bool

    Default: true

    limitCore

    Maximum core dump file size in bytes.

    Key values:

    • 0: Disables core dumps.

    • infinity: Unlimited.

    Int

    • Valid range: Non-negative integer

    • Default: infinity

    limitNoFile

    Maximum open file descriptors per container.

    Int

    • Valid range: ≥ 1024

    • Default: 1048576

    limitMemLock

    Maximum lockable memory in bytes per container process.

    Int

    • Valid range: ≥ 65536

    • Default: 65536 (consistent with host OS).

      For Lingjun nodes or nodes with RDMA/EDMA devices detected at initialization, the default is infinity. Devices attached after node readiness do not trigger this.

    Registry Mirror Configuration

    Description

    Recommendation

    Configure alternative registries as mirrors to accelerate image pulls.

    Each mirror supports custom path mapping via override_path.

    This change does not require restarting containers.

    • Use a local registry to accelerate pulls.

    • Configure multiple mirrors for high availability.

    Image Registries Skipping Certificate Authentication (Insecure Registries)

    Description

    Recommendation

    Skip certificate validation for specified registries during image pulls. Intended for test environments with self-signed certificates.

    This change does not require restarting containers.

    • Skipping certificate validation poses security risks. Use only in development and testing environments.

    • Use only for private registries with self-signed or unobtainable certificates.

    Procedure

    Changes do not affect running containers. Perform this operation during off-peak hours.

    1. Log on to the ACK console. In the left navigation pane, click Clusters.

    2. On the Clusters page, click the name of your cluster. In the left navigation pane, click Nodes > Node Pools.

    3. On the Node Pools page, find the desired node pool, and in its Actions column, choose image > Containerd Configuration.

    4. Add parameters, specify target nodes, set the batch policy, and click Submit.

      See Configuration examples.

      • Removing a custom runtime parameter reverts it to the default value.

      • Settings apply to nodes in batches. Monitor progress in the Event Records area, where you can pause, resume, or cancel the update. If a node update fails, troubleshoot and click Continue to retry.

        Pausing lets you validate changes on updated nodes. In-progress nodes finish, but new updates wait until you resume. Complete the task promptly — paused tasks are auto-canceled after seven days, deleting all records and logs.

    Configuration examples

    Mirror for docker.io

    Insecure private registry

    HTTP private registry

    In Registry mirrors, set Image registry to docker.io, Registry mirror to the mirror address (e.g., https://example.com), and override_path to false.

    In Insecure registries, enter the registry address in Image registry (format: IP address:Port, e.g., 192.xxx.xxx.xxx:443) and set skip_verify to true.

    In Registry mirrors, set Image registry to the private registry address (e.g., 192.xxx.1), Registry mirror to its HTTP address (e.g., http://192.xxx.1), and override_path to false. Click + Add for more mappings.

    FAQ

    Do custom containerd settings affect running services?

    No. Changes apply only to Pods created after the update, not running ones. Perform this operation during off-peak hours.

    To apply new settings to existing Pods, recreate them manually.

    Error with not match XXX or must be between XXX errors

    Common causes:

    • must be between XXX: Invalid value. Verify the format and allowed range.

    • not match XXX: Unsupported modification method. ACK blocks command-line changes to the configuration file. Revert the parameter to its original value.

    References