apiVersion: v1alpha1
kind: CRICustomizationConfig
name: containerd
content: |
  [plugins."io.containerd.cri.v1.images"]
    discard_unpacked_layers = false
  [plugins."io.containerd.cri.v1.runtime"]
    device_ownership_from_security_context = true