specification: API Commons Rate Limits
specificationVersion: '0.1'
schema: https://raw.githubusercontent.com/api-evangelist/interface-research/main/schema/api-commons.yml#/$defs/RateLimits
provider: CRI-O
providerId: cri-o
created: '2026-05-04'
# Provenance stamped 2026-08-11: this artifact was written by the API Evangelist
# bulk sweep dated 2026-05-04, not harvested from the provider. See roadmap#35.
method: generated
modified: '2026-05-05'
reconciled: false
tags:
  - CNCF
  - Container Runtime
  - Containers
  - CRI
  - Kubernetes
  - OCI
  - Open Source
  - Rate Limiting
description: CRI-O's APIs are local-host interfaces (CRI gRPC over a Unix socket, Status HTTP API,
  Prometheus /metrics) consumed by the kubelet and operators. CRI-O does not enforce per-second request
  rate limits on its own APIs; effective throughput is bounded by the host's CPU and the kubelet's
  own pacing. CRI-O does, however, support image-pull rate limiting via the pause_image_auth_file and
  the registries.conf rate-limiting controls (delegated to containers/image), and operator-side controls
  (--pids-limit, container-cpu-quota) bound runtime resource consumption per container.
sources:
  - https://github.com/cri-o/cri-o/blob/main/docs/crio.conf.5.md
  - https://github.com/cri-o/cri-o/blob/main/docs/metrics.md
limits:
  - name: CRI gRPC API
    scope: host
    metric: requests_per_second
    limit: not enforced upstream
    notes: Served on /var/run/crio/crio.sock. Kubelet is the only documented consumer; CRI-O does not
      apply its own throttle.
  - name: Status HTTP API
    scope: host
    metric: requests_per_second
    limit: not enforced upstream
    notes: Documented as not stable for production use; intended for operator inspection.
  - name: Metrics endpoint
    scope: host
    metric: requests_per_second
    limit: not enforced upstream
    notes: Prometheus scrape target on the configured port (default 9090).
  - name: Image-pull rate
    scope: host
    metric: pulls_per_second
    limit: registry-bound
    notes: Bounded by the upstream registry rate limits (e.g. Docker Hub) and any retry / backoff
      configured in containers/image. CRI-O respects 429 / Retry-After when surfaced by the registry.
policies:
  - name: Local-host APIs
    description: CRI-O APIs run on the node, not as a hosted service. There is no provider-imposed
      per-second limit; throughput is bounded by node CPU and the kubelet's own request pacing.
  - name: Image-pull backoff
    description: When image registries return 429 (Docker Hub anonymous-pull limits, etc.), CRI-O surfaces
      the error to the kubelet, which honors its image-pull backoff policy.
  - name: Resource constraints
    description: Operator-configured runtime constraints (--pids-limit, --cpu-quota, --memory-limit)
      bound per-container resource consumption rather than per-request rate.
notes: CRI-O is open-source and node-local, so there are no provider-imposed rate limits on its APIs.
  Reconciled is false because there is no provider rate-limit document to reconcile against; this
  artifact captures the published behavior around image-pull throttling and operator-configured constraints.
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com