Create /etc/crictl.yaml or ~/.config/crictl.yaml:
# For containerd
runtime-endpoint: "unix:///run/containerd/containerd.sock"
image-endpoint: "unix:///run/containerd/containerd.sock"
timeout: 10
debug: false
# For CRI-O
runtime-endpoint: "unix:///run/crio/crio.sock"
Test config: crictl ps -a
docker run -it --privileged --rm alpine:edge sh -c "apk add criu crifs; crifs --help"
Note: The --privileged flag is required for filesystem and FUSE operations.
If you find orphaned overlay mounts (findmnt | grep overlay shows many old pods):
# List container mounts still in kernel but not in CRI state crictl ps -aq | xargs crictl inspect | jq '.info.pid' | xargs -I{} ls -l /proc/{}/mountinfoIf you are on Debian/Ubuntu or CentOS/RHEL, the easiest method is via the standard repositories or the Kubernetes SIG repositories. cri file system tools install
For Debian/Ubuntu:
sudo apt-get update sudo apt-get install -y cri-toolsFor CentOS/RHEL/Fedora:
sudo yum install -y cri-tools # or sudo dnf install -y cri-tools
curl -LO https://github.com/containerd/nerdctl/releases/download/v1.7.6/nerdctl-1.7.6-linux-amd64.tar.gz sudo tar Cxzvvf /usr/local/bin nerdctl-1.7.6-linux-amd64.tar.gz
Filesystem-specific commands after install:
nerdctl images
nerdctl inspect <image>
nerdctl run --rm -it alpine ls /
crictl inspect 3e8f2a1b9c0d | jq .info.runtimeSpec.mounts
Look for type: "overlay". You'll see lowerdir, upperdir, workdir.
Example output snippet:
"lowerdir": "/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/12/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/11/fs",
"upperdir": "/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/23/fs",
"workdir": "/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/23/work"
Although crictl is not a dedicated filesystem tool, it helps inspect container root filesystems: Create /etc/crictl
| Command | Description |
|---------|-------------|
| crictl ps -a | List all containers |
| crictl inspect <container_id> | Show container details (incl. rootfs path) |
| crictl exec <id> ls -la | List files in container |
| crictl exec <id> cat /etc/os-release | Read a file inside container |
| crictl logs <id> | View container logs (writes to stdout/stderr) |
Example – find container rootfs path:
crictl inspect <container_id> | grep -i "rootfs"
This guide assumes you want common CRI filesystem tools used for inspecting and managing container images and runtimes on Linux (cri-o, containerd, crictl, runc, nerdctl, skopeo, umoci). It provides installation steps, basic usage examples, and troubleshooting notes.