specification: API Commons Rate Limits
specificationVersion: '0.1'
schema: https://raw.githubusercontent.com/api-evangelist/interface-research/main/schema/api-commons.yml#/$defs/RateLimits
provider: Containerd
providerId: containerd
created: '2026-05-04'
# Provenance stamped 2026-08-11: this artifact was written by the API Evangelist
# bulk sweep dated 2026-05-04, not harvested from the provider. See roadmap#35.
method: generated
modified: '2026-05-05'
reconciled: true
tags:
  - Cloud Native
  - Container Runtime
  - gRPC
  - Kubernetes
  - Rate Limiting
description: Containerd's gRPC API is exposed locally over a Unix domain socket and (optionally) TCP
  by the containerd daemon. There is no built-in per-RPC rate limiting on the API surface itself; backpressure
  comes from gRPC concurrency settings, the runtime's resource ceilings, and the kubelet's CRI flow-control.
  Operators bound throughput through host resources (CPU, IO, fd / connection limits), the gRPC server's
  max-concurrent-streams setting, and registry-side image-pull rate limits.
sources:
  - https://github.com/containerd/containerd/blob/main/docs/man/containerd-config.toml.5.md
  - https://kubernetes.io/docs/concepts/architecture/cri/
responseCodes:
  resourceExhausted: 'gRPC RESOURCE_EXHAUSTED'
  unavailable: 'gRPC UNAVAILABLE'
limits:
  - name: gRPC Concurrency Bound
    scope: daemon
    metric: concurrent_streams
    limit: 'configured via containerd config grpc.max_recv_message_size / max_send_message_size and host
      resource ceilings'
    notes: Containerd does not impose per-RPC token-bucket limits; concurrency is governed by gRPC server
      settings and OS-level fd / cgroup limits.
  - name: CRI Image-Pull Concurrency
    scope: daemon
    metric: concurrent_image_pulls
    limit: 'configured via plugins."io.containerd.grpc.v1.cri".registry and max_concurrent_downloads'
    notes: CRI image pulls are flow-controlled; tune `max_concurrent_downloads` and per-registry mirrors.
  - name: Registry-Side Limits
    scope: external
    metric: varies
    limit: 'inherits from each container registry (Docker Hub / GHCR / ECR)'
    notes: Image pulls inherit the upstream registry's rate limiting (e.g. Docker Hub's anonymous /
      authenticated pull limits).
policies:
  - name: Operator-Owned Limits
    description: Containerd does not impose API rate limits; operators tune gRPC server settings, host
      resource ceilings, and the kubelet's CRI flow-control.
  - name: Backoff Strategy
    description: Clients should respect gRPC RESOURCE_EXHAUSTED / UNAVAILABLE with exponential backoff
      and jitter — the kubelet does this natively for image pulls and runtime calls.
  - name: Authentication & Socket Permissions
    description: Access to the containerd socket is governed by file-system permissions and (optionally)
      mTLS for TCP exposure; there is no per-token quota.
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com