kubernetes/kubernetes · error

no 'sandboxImage' field in CRI info config

Error message

no 'sandboxImage' field in CRI info config

What it means

CRIRuntime.SandboxImage() queries the container runtime via CRI Status, extracts the JSON under status.Info["config"], and unmarshals a struct with a single SandboxImage field. If that field is empty after unmarshalling (i.e. the runtime did not report a sandbox image), this error is returned. It blocks kubeadm from determining the pause/sandbox image to validate image-pull preflight checks.

Source

Thrown at cmd/kubeadm/app/util/runtime/runtime.go:315

		return "", errors.Wrap(err, "failed to get runtime status")
	}

	infoConfig, ok := status.GetInfo()["config"]
	if !ok {
		return "", errors.Errorf("no 'config' field in CRI info: %+v", status)
	}

	type config struct {
		SandboxImage string `json:"sandboxImage,omitempty"`
	}
	c := config{}

	if err := json.Unmarshal([]byte(infoConfig), &c); err != nil {
		return "", errors.Wrap(err, "failed to unmarshal CRI info config")
	}

	if c.SandboxImage == "" {
		return "", errors.New("no 'sandboxImage' field in CRI info config")
	}

	return c.SandboxImage, nil
}

// IsRuntimeConfigImplemented checks if the container runtime supports the RuntimeConfig gRPC method
func (runtime *CRIRuntime) IsRuntimeConfigImplemented() (bool, error) {
	ctx, cancel := defaultContext()
	defer cancel()
	_, err := runtime.impl.RuntimeConfig(ctx, runtime.runtimeService)
	if err != nil {
		s, ok := status.FromError(err)
		if !ok || s.Code() != codes.Unimplemented {
			return false, errors.Wrap(err, "failed to call RuntimeConfig gRPC method")
		}
		return false, nil
	}
	return true, nil

View on GitHub (pinned to b882c60b40)

Solutions

1. Upgrade containerd (or CRI-O) to a version that reports `sandboxImage` in the CRI info config, and ensure the sandbox_image (pause image) is explicitly set in its config.
2. In containerd, set `sandbox_image = "registry.k8s.io/pause:3.x"` under [plugins."io.containerd.grpc.v1.cri"] and restart containerd.
3. Verify the runtime reports the field: `crictl info | jq .config.sandboxImage`.

Example fix

# before — containerd config.toml omits sandbox_image
[plugins."io.containerd.grpc.v1.cri"]

# after
[plugins."io.containerd.grpc.v1.cri"]
  sandbox_image = "registry.k8s.io/pause:3.9"

// before calling SandboxImage, confirm the runtime reports it via crictl/CRI
import "google.golang.org/grpc"
// pseudo: query CRI Status, parse info.config.sandboxImage
if sandboxImage == "" {
    return errors.New("runtime does not report sandboxImage; upgrade containerd/CRI-O and set sandbox_image")
}

if _, err := runtime.SandboxImage(); err != nil {
    if strings.Contains(err.Error(), "no 'sandboxImage' field") {
        // guide user to set sandbox_image in containerd config
    }
    return err
}

When it happens

Trigger: Calling CRIRuntime.SandboxImage() against a CRI implementation that omits `sandboxImage` from its info config JSON — older containerd/CRI-O versions, or a runtime whose config struct shape differs. Also possible if the runtime reports a `config` key but its payload lacks sandboxImage.

Common situations: Upgrading the container runtime to a version with a changed info schema; running a minimal/old containerd that does not populate sandboxImage; kubeadm preflight checks failing on an edge-case runtime build.

Related errors

• the --old-config flag is mandatory
• no kubelet component config found in the active component co
• You must update your container runtime to a version that sup
• the argument should start with '--'
• the argument should have a '=' between the flag and the valu

AI-assisted analysis of kubernetes/kubernetes@b882c60b40 (2026-08-07). Data as JSON: /api/errors/7dd6cdb5e97432cf. Report an issue: GitHub.