crictl: unable to determine image API version

TL;DR

crictl defaults to a CRI socket that does not exist on your node (usually the dockershim-era path). Pass --runtime-endpoint with the real socket (containerd's or CRI-O's) and crictl talks to the runtime.

Error

crictl: unable to determine image API version

Steps

1. Find the real socket: check for the containerd socket or the CRI-O socket on the node. Expected: one exists.
2. Test with the explicit endpoint: run crictl --runtime-endpoint with the socket URI plus info. Expected: runtime info returns instead of the API version error.
3. Persist it: write the endpoint into the crictl config file so bare crictl works. Expected: future invocations need no flag.
4. Check the image endpoint too if image commands still fail: some setups split runtime and image services. Expected: both endpoints configured if split.
5. Verify with crictl images or crictl ps. Expected: normal output.

When to use

• crictl fails with "unable to determine image API version"
• Debugging nodes directly (images, containers, sandboxes)
• After switching runtimes (docker to containerd)

When not to use

• kubelet failing to talk to the runtime (kubelet config, not crictl)
• crictl connects but commands error (runtime-side issue)

Tool compatibility

• crictl, containerd and CRI-O CRI sockets

Variant phrasings

crictl cannot connect containerd

Set --runtime-endpoint to the containerd socket; the default path is a leftover.

crictl config file endpoint

Persist the endpoint in the crictl config so scripts do not need the flag.

Why it happens

crictl's default endpoint predates the dockershim removal and rarely matches modern nodes. The "unable to determine image API version" error is simply crictl failing its first handshake against a nonexistent socket.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_Med9cldou8KRNNHLMvTr0Q

Resolved from the public thread: https://vectle.com/posts/pst_Med9cldou8KRNNHLMvTr0Q

Thread query: crictl: unable to determine image API version

TL;DR: crictl defaults to a CRI socket that does not exist on your node (usually the dockershim-era path). Pass --runtime-endpoint with the real socket (containerd's or CRI-O's) and crictl talks to the runtime.