containerd/containerd · critical

cni config not initialized

Error message

cni config not initialized

What it means

setupPodNetwork resolves the CNI network plugin for the sandbox's RuntimeHandler via getNetworkPlugin. If no plugin is configured (netPlugin == nil), the pod network cannot be set up and this error is returned. This indicates the CNI configuration was never initialized (no cni config dir/conf files) or the runtime handler has no matching plugin entry.

Source

Thrown at internal/cri/server/sandbox_run.go:485

	var (
		id        = sandbox.ID
		config    = sandbox.Config
		path      = sandbox.NetNSPath
		netPlugin = c.getNetworkPlugin(sandbox.RuntimeHandler)
		err       error
		result    *cni.Result
	)

	// Add tracing attributes
	span.SetAttributes(
		tracing.Attribute("sandbox.id", id),
		tracing.Attribute("netns.path", path),
		tracing.Attribute("runtime.handler", sandbox.RuntimeHandler),
	)

	if netPlugin == nil {
		return errors.New("cni config not initialized")
	}
	if c.config.UseInternalLoopback {
		err := c.bringUpLoopback(path)
		if err != nil {
			return fmt.Errorf("unable to set lo to up: %w", err)
		}
	}
	opts, err := cniNamespaceOpts(id, config)
	if err != nil {
		return fmt.Errorf("get cni namespace options: %w", err)
	}
	log.G(ctx).WithField("podsandboxid", id).Debugf("begin cni setup")
	netStart := time.Now()

	span.AddEvent("cni.setup.start")
	if c.config.CniConfig.NetworkPluginSetupSerially {
		result, err = netPlugin.SetupSerially(ctx, id, path, opts...)
	} else {

View on GitHub (pinned to 4246446a2b)

Solutions

1. Install/deploy the CNI plugin configuration (e.g., ensure /etc/cni/net.d contains valid *.conflist files).
2. Check containerd's config.toml: the [plugins."io.containerd.grpc.v1.cri".cni] section and conf_dir/bin_dir paths exist.
3. If using custom runtime handlers, verify each has a valid network plugin mapping or disable pod network setup for it.
4. Ensure the CNI binaries exist in bin_dir (e.g., bridge, loopback, portmap).

Example fix

// containerd config.toml
// before
[plugins."io.containerd.grpc.v1.cri"]
  # no cni section
// after
[plugins."io.containerd.grpc.v1.cri".cni]
  bin_dir = "/opt/cni/bin"
  conf_dir = "/etc/cni/net.d"

if _, err := os.Stat("/etc/cni/net.d"); err != nil || len(cniConfFiles("/etc/cni/net.d")) == 0 {
  return errors.New("no CNI configuration installed; pods requiring networking will fail")
}

if err := runPodSandbox(...); err != nil {
  if strings.Contains(err.Error(), "cni config not initialized") {
    return fmt.Errorf("node CNI misconfiguration: install CNI plugin configs in /etc/cni/net.d")
  }
  return err
}

When it happens

Trigger: RunPodSandbox reaching network setup (internal/cri/server/sandbox_run.go:485) with a containerd config lacking a [plugins.cri.cni] section, an empty conf_dir, or a runtime handler mapped to a netns pool/plugin that doesn't exist.

Common situations: containerd started without any /etc/cni/net.d/*.conf/list files installed (CNI plugins not deployed); Kubernetes node where the CNI daemonset failed to install; custom runtime_handler configured in containerd.toml without a corresponding network plugin; standalone containerd usage without CNI.

Related errors

• cni config not initialized
• get cni namespace options: %w
• failed to query sandbox platform: %w
• failed to find network info for sandbox %q
• failed to get sandbox ip: %w

AI-assisted analysis of containerd/containerd@4246446a2b (2026-09-02). Data as JSON: /api/errors/fad13650c5233b00. Report an issue: GitHub.