crictl

crictl is the Kubernetes CRI CLI for talking directly to a container runtime on a node without going through the Kubernetes API. It is mainly a debugging and runtime-operations tool for containerd, CRI-O, and other CRI-compatible runtimes.

• List and inspect pod sandboxes, containers, images, logs, runtime info, filesystem info, stats, metrics, and event streams directly from the CRI socket.
• Create, start, stop, update, checkpoint, and remove pod sandboxes or containers, pull and prune images, and adjust runtime settings during node-level debugging.
• Exec into containers, attach, and port-forward when troubleshooting workloads from the runtime side rather than the Kubernetes API side.

• Many read paths are machine-readable: info, inspect, inspectp, inspecti, ps, pods, images, stats, statsp, metricsp, metricdescs, and events support JSON or YAML output, with go-template support on several inspect and status commands.
• Commands are direct shell verbs with filters, flags, and stable exit behavior, so they fit inspect, change, and verify loops for node diagnostics and runtime-focused automation.
• Fit is narrower than cluster-facing tooling because it requires direct access to the CRI endpoint on a node, and some useful flows like exec, attach, logs -f, events, and port-forward are streaming or interactive rather than batch-friendly.

• It is only useful where you can reach the CRI socket on a node; this is not a remote Kubernetes API client.
• Upstream docs warn that pods or containers created directly with crictl may be removed by kubelet if they do not exist in the Kubernetes API.