❯ cat /etc/crio/crio.conf
[crio]

# Path to the "root directory". CRI-O stores all of its data, including
# containers images, in this directory.
root = "/foo/bar"

[crio.runtime.workloads.openshift-builder]
activation_annotation = "io.openshift.builder"
allowed_annotations = [
"io.kubernetes.cri-o.userns-mode",
"io.kubernetes.cri-o.umask",
"io.kubernetes.cri-o.Devices"
]

❯ bin/crio config | grep allowed_annotations -A3
INFO[2025-09-16T10:09:29.238892956Z] Updating config from single file: /etc/crio/crio.conf
INFO[2025-09-16T10:09:29.23892279Z] Updating config from drop-in file: /etc/crio/crio.conf
INFO[2025-09-16T10:09:29.239149659Z] Updating config from path: /etc/crio/crio.conf.d
INFO Using default capabilities: CAP_CHOWN, CAP_DAC_OVERRIDE, CAP_FSETID, CAP_FOWNER, CAP_SETGID, CAP_SETUID, CAP_SETPCAP, CAP_NET_BIND_SERVICE, CAP_KILL
# allowed_annotations = []
# platform_runtime_paths = { "os/arch" = "/path/to/binary" }
# no_sync_log = false
# default_annotations = {}
--
# - allowed_annotations (optional, array of strings): an option for specifying
#   a list of experimental annotations that this runtime handler is allowed to process.
#   The currently recognized values are:
#   "io.kubernetes.cri-o.userns-mode" for configuring a user namespace for the pod.
--
# "io.kubernetes.cri-o.seccompNotifierAction" in the allowed_annotations array.
#
# It also requires at least runc 1.1.0 or crun 0.19 which support the notifier
# feature.
--
# allowed_annotations = [
# 	"io.containers.trace-syscall",
# 	"io.kubernetes.cri-o.Devices",
# ]

❯ bin/crio config | grep root
INFO[2025-09-16T10:09:53.616707819Z] Updating config from single file: /etc/crio/crio.conf
INFO[2025-09-16T10:09:53.616737488Z] Updating config from drop-in file: /etc/crio/crio.conf
INFO[2025-09-16T10:09:53.61691715Z] Updating config from path: /etc/crio/crio.conf.d
INFO Using default capabilities: CAP_CHOWN, CAP_DAC_OVERRIDE, CAP_FSETID, CAP_FOWNER, CAP_SETGID, CAP_SETUID, CAP_SETPCAP, CAP_NET_BIND_SERVICE, CAP_KILL
# Path to the "root directory". CRI-O stores all of its data, including
root = "/foo/bar"
# runroot = "/run/user/1004/containers"
# If true, the runtime will not use pivot_root, but instead use MS_MOVE.
# If capabilities are expected to work for non-root users, this option should be set.
# runtime_root = "/path/to/the/root"
# - runtime_root (optional, string): Root directory for storage of containers
#   runtime_type, runtime_root and runtime_config_path will be replaced by
# runtime_root = "/run/crun"