{"record":{"id":"1a3a5e604701106d","repo":"k3s-io/k3s","slug":"cri-dockerd-disabled-at-build-time","errorCode":null,"errorMessage":"cri-dockerd disabled at build time","messagePattern":"cri-dockerd disabled at build time","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/agent/cridockerd/nocridockerd.go","lineNumber":13,"sourceCode":"//go:build no_cri_dockerd\n\npackage cridockerd\n\nimport (\n\t\"context\"\n\t\"errors\"\n\n\t\"github.com/k3s-io/k3s/pkg/daemons/config\"\n)\n\nfunc Run(ctx context.Context, cfg *config.Node) error {\n\treturn errors.New(\"cri-dockerd disabled at build time\")\n}\n","sourceCodeStart":1,"sourceCodeEnd":15,"githubUrl":"https://github.com/k3s-io/k3s/blob/6ba341e396edc16b8dcae978a7c5e3ac7ee5606e/pkg/agent/cridockerd/nocridockerd.go#L1-L15","documentation":"Returned by cridockerd.Run() in builds compiled with the no_cri_dockerd build tag. That tag replaces the cri-dockerd shim with a stub so k3s binaries can ship without the Docker CRI bridge; any attempt to exercise the cri-dockerd code path (e.g. --docker) immediately returns this error. It is a build-capability error, not a runtime failure of Docker itself.","triggerScenarios":"Running a k3s build produced with -tags no_cri_dockerd (as done by some distros/minimal builds) while passing --docker or otherwise invoking the cri-dockerd daemon path.","commonSituations":"Distro-packaged or custom-built k3s binaries stripped of cri-dockerd; users following default k3s docs (which allow --docker) against a stripped binary; CI images built with the no_cri_dockerd tag.","solutions":["Use the official k3s release binary, which includes cri-dockerd, if you need --docker","Rebuild from source without the no_cri_dockerd build tag","Switch the node to the default embedded containerd (remove --docker) if the Docker runtime is not strictly required"],"exampleFix":"# before (binary built with -tags no_cri_dockerd)\nk3s agent --docker  # -> cri-dockerd disabled at build time\n\n# after\ncurl -sfL https://get.k3s.io | sh -  # official binary includes cri-dockerd\nk3s agent --docker","handlingStrategy":"validation","validationCode":"// Before allowing --docker, verify the build ships cri-dockerd:\nif cfg.Docker {\n    if err := cridockerd.Run(ctx, nil); err != nil && err.Error() == \"cri-dockerd disabled at build time\" {\n        return errors.New(\"this k3s build does not include cri-dockerd; use embedded containerd or the official binary\")\n    }\n}","typeGuard":null,"tryCatchPattern":"if err := cridockerd.Run(ctx, cfg); err != nil {\n    if err.Error() == \"cri-dockerd disabled at build time\" {\n        // surface actionable message: binary stripped of cri-dockerd; refuse --docker\n    }\n}","preventionTips":["Document build tags of custom k3s binaries so operators know cri-dockerd is absent","Pin deployments to official release binaries when --docker is required","Reject --docker at flag-parsing time in wrappers when running stripped builds"],"tags":["build-tags","cri-dockerd","docker","runtime","distribution"],"backgroundTag":null,"analyzedSha":"6ba341e396edc16b8dcae978a7c5e3ac7ee5606e","analyzedAt":"2026-08-15T16:27:54.286Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}