[Service]
# Pull the pause container image before starting `kubelet` so `containerd/cri` wouldn't have to
ExecStartPre=/usr/bin/host-ctr \
    --containerd-socket=/run/containerd/containerd.sock \
    --namespace=k8s.io \
    pull-image \
    --source=${POD_INFRA_CONTAINER_IMAGE} \
    --registry-config=/etc/host-containers/host-ctr.toml \
    --skip-if-image-exists=true