{"record":{"id":"7dd6cdb5e97432cf","repo":"kubernetes/kubernetes","slug":"no-sandboximage-field-in-cri-info-config","errorCode":null,"errorMessage":"no 'sandboxImage' field in CRI info config","messagePattern":"no 'sandboxImage' field in CRI info config","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/kubeadm/app/util/runtime/runtime.go","lineNumber":315,"sourceCode":"\t\treturn \"\", errors.Wrap(err, \"failed to get runtime status\")\n\t}\n\n\tinfoConfig, ok := status.GetInfo()[\"config\"]\n\tif !ok {\n\t\treturn \"\", errors.Errorf(\"no 'config' field in CRI info: %+v\", status)\n\t}\n\n\ttype config struct {\n\t\tSandboxImage string `json:\"sandboxImage,omitempty\"`\n\t}\n\tc := config{}\n\n\tif err := json.Unmarshal([]byte(infoConfig), &c); err != nil {\n\t\treturn \"\", errors.Wrap(err, \"failed to unmarshal CRI info config\")\n\t}\n\n\tif c.SandboxImage == \"\" {\n\t\treturn \"\", errors.New(\"no 'sandboxImage' field in CRI info config\")\n\t}\n\n\treturn c.SandboxImage, nil\n}\n\n// IsRuntimeConfigImplemented checks if the container runtime supports the RuntimeConfig gRPC method\nfunc (runtime *CRIRuntime) IsRuntimeConfigImplemented() (bool, error) {\n\tctx, cancel := defaultContext()\n\tdefer cancel()\n\t_, err := runtime.impl.RuntimeConfig(ctx, runtime.runtimeService)\n\tif err != nil {\n\t\ts, ok := status.FromError(err)\n\t\tif !ok || s.Code() != codes.Unimplemented {\n\t\t\treturn false, errors.Wrap(err, \"failed to call RuntimeConfig gRPC method\")\n\t\t}\n\t\treturn false, nil\n\t}\n\treturn true, nil","sourceCodeStart":297,"sourceCodeEnd":333,"githubUrl":"https://github.com/kubernetes/kubernetes/blob/b882c60b4023bdf09264c2d5d30a2cadebc240fb/cmd/kubeadm/app/util/runtime/runtime.go#L297-L333","documentation":"CRIRuntime.SandboxImage() queries the container runtime via CRI Status, extracts the JSON under status.Info[\"config\"], and unmarshals a struct with a single SandboxImage field. If that field is empty after unmarshalling (i.e. the runtime did not report a sandbox image), this error is returned. It blocks kubeadm from determining the pause/sandbox image to validate image-pull preflight checks.","triggerScenarios":"Calling CRIRuntime.SandboxImage() against a CRI implementation that omits `sandboxImage` from its info config JSON — older containerd/CRI-O versions, or a runtime whose config struct shape differs. Also possible if the runtime reports a `config` key but its payload lacks sandboxImage.","commonSituations":"Upgrading the container runtime to a version with a changed info schema; running a minimal/old containerd that does not populate sandboxImage; kubeadm preflight checks failing on an edge-case runtime build.","solutions":["Upgrade containerd (or CRI-O) to a version that reports `sandboxImage` in the CRI info config, and ensure the sandbox_image (pause image) is explicitly set in its config.","In containerd, set `sandbox_image = \"registry.k8s.io/pause:3.x\"` under [plugins.\"io.containerd.grpc.v1.cri\"] and restart containerd.","Verify the runtime reports the field: `crictl info | jq .config.sandboxImage`."],"exampleFix":"# before — containerd config.toml omits sandbox_image\n[plugins.\"io.containerd.grpc.v1.cri\"]\n\n# after\n[plugins.\"io.containerd.grpc.v1.cri\"]\n  sandbox_image = \"registry.k8s.io/pause:3.9\"","handlingStrategy":"validation","validationCode":"// before calling SandboxImage, confirm the runtime reports it via crictl/CRI\nimport \"google.golang.org/grpc\"\n// pseudo: query CRI Status, parse info.config.sandboxImage\nif sandboxImage == \"\" {\n    return errors.New(\"runtime does not report sandboxImage; upgrade containerd/CRI-O and set sandbox_image\")\n}","typeGuard":null,"tryCatchPattern":"if _, err := runtime.SandboxImage(); err != nil {\n    if strings.Contains(err.Error(), \"no 'sandboxImage' field\") {\n        // guide user to set sandbox_image in containerd config\n    }\n    return err\n}","preventionTips":["Pin a sandbox_image explicitly in containerd/CRI-O config rather than relying on a default.","Keep containerd/CRI-O versions in the supported range for your Kubernetes version.","Use `crictl info` in preflight checks to confirm the sandbox image is reported."],"tags":["kubeadm","cri","containerd","runtime","config"],"analyzedSha":"b882c60b4023bdf09264c2d5d30a2cadebc240fb","analyzedAt":"2026-08-07T04:07:48.144Z","schemaVersion":2},"datasetVersion":"2026-08-07T07:17:06.508Z"}