diff --git a/kubernetes/_common.sls b/kubernetes/_common.sls
index 2b7f54e..5d304df 100644
--- a/kubernetes/_common.sls
+++ b/kubernetes/_common.sls
@@ -45,14 +45,15 @@
 
 containerd_pkg:
   pkg.installed:
-  - name: {{ common.containerd.get('package', 'containerd.io') }}
-
-runc_pkg:
-  pkg.installed:
-  - name: {{ common.containerd.get('runc_package', 'runc') }}
+  - name: {{ common.get('containerd', {}).get('package', 'containerd.io') }}
 
 /etc/containerd/config.toml:
-  file.absent
+  file.managed:
+  - source: salt://kubernetes/files/containerd/config.toml
+  - template: jinja
+  - user: root
+  - group: root
+  - mode: 644
 
 containerd_service:
   service.running:
@@ -62,11 +63,38 @@
     - file: /etc/containerd/config.toml
   - require:
     - containerd_pkg
-    - runc_pkg
   {%- if grains.get('noservices') %}
   - onlyif: /bin/false
   {%- endif %}
 
+extract_crictl:
+  archive.extracted:
+    - name: /tmp/crictl
+    - source: {{ common.containerd.crictl.source }}
+    - source_hash: {{ common.containerd.crictl.hash }}
+    - enforce_toplevel: false
+    - options: xzf
+    - archive_format: tar
+    - keep: true
+    {%- if grains.get('noservices') %}
+    - onlyif: /bin/false
+    {%- endif %}
+
+/usr/local/bin/crictl:
+  file.managed:
+  - source: /tmp/crictl/crictl
+  - mode: 755
+  - owner: root
+  - group: root
+  - require:
+    - archive: extract_crictl
+
+/etc/crictl.yaml:
+  file.managed:
+  - user: root
+  - group: root
+  - mode: 644
+  - contents: 'runtime-endpoint: unix:///run/containerd/containerd.sock'
 {%- endif %}
 
 {%- if common.addons.get('virtlet', {}).get('enabled') and not pillar.kubernetes.master is defined %}
diff --git a/kubernetes/files/containerd/config.toml b/kubernetes/files/containerd/config.toml
new file mode 100644
index 0000000..5296733
--- /dev/null
+++ b/kubernetes/files/containerd/config.toml
@@ -0,0 +1,4 @@
+{%- from "kubernetes/map.jinja" import common with context -%}
+[plugins]
+  [plugins.cri]
+    sandbox_image = "{{ common.hyperkube.pause_image }}"
diff --git a/kubernetes/files/systemd/criproxy.service b/kubernetes/files/systemd/criproxy.service
index b5f9d18..9980501 100644
--- a/kubernetes/files/systemd/criproxy.service
+++ b/kubernetes/files/systemd/criproxy.service
@@ -5,8 +5,13 @@
 
 [Unit]
 Description=CRI Proxy
+{%- if common.get('containerd', {}).get('enabled') %}
+After=containerd.service
+Requires=containerd.service
+{%- else %}
 After=dockershim.service
 Requires=dockershim.service
+{%- endif %}
 
 [Service]
 SyslogIdentifier=criproxy
diff --git a/kubernetes/files/systemd/kubelet.service b/kubernetes/files/systemd/kubelet.service
index c353ece..8e75895 100644
--- a/kubernetes/files/systemd/kubelet.service
+++ b/kubernetes/files/systemd/kubelet.service
@@ -1,10 +1,16 @@
+{%- from "kubernetes/map.jinja" import common with context -%}
 [Unit]
 Description=Kubernetes Kubelet Server
 Documentation=https://github.com/kubernetes/kubernetes
 Documentation=man:kubelet
 After=network.target
+{%- if common.get('containerd', {}).get('enabled') %}
+After=containerd.service
+Requires=containerd.service
+{%- else %}
 After=docker.service
 Requires=docker.service
+{%- endif %}
 Conflicts=cadvisor.service
 
 [Service]
diff --git a/metadata/service/common.yml b/metadata/service/common.yml
index 3d01377..3b37c17 100644
--- a/metadata/service/common.yml
+++ b/metadata/service/common.yml
@@ -64,6 +64,11 @@
         plugins:
           source: https://github.com/containernetworking/plugins/releases/download/v0.7.1/cni-plugins-amd64-v0.7.1.tgz
           hash: e7e5751d43456f69ea1ed043647e0377
+      containerd:
+        enabled: false
+        crictl:
+          source: https://github.com/kubernetes-sigs/cri-tools/releases/download/v1.12.0/crictl-v1.12.0-linux-amd64.tar.gz
+          hash: md5=ff60b9ddfa5617f7ed14b3f3b6a60056
       cloudprovider:
         enabled: False
         provider: openstack