Description
Our Kubernetes cluster is a newly installed version 1.34.1. We've discovered that we cannot pull images because our network cannot connect to docker.io. Therefore, we need to configure an image acceleration address.

1. Failure with crictl / ctr

crictl pull nginx E1022 15:15:57.827582 61107 remote_image.go:180] "PullImage from image service failed" err="rpc error: code = DeadlineExceeded desc = failed to pull and unpack image \"docker.io/library/nginx:latest\": failed to resolve image: failed to do request: Head \"https://registry-1.docker.io/v2/library/nginx/manifests/latest\": dial tcp 156.233.67.243:443: i/o timeout" image="nginx" FATA[0030] pulling image: rpc error: code = DeadlineExceeded desc = failed to pull and unpack image "docker.io/library/nginx:latest": failed to resolve image: failed to do request: Head "https://registry-1.docker.io/v2/library/nginx/manifests/latest": dial tcp 156.233.67.243:443: i/o timeout

In fact, using the ctr command will also fail.

ctr --debug images pull docker.io/nginx:latest ctr: failed to resolve image: failed to do request: Head "https://registry-1.docker.io/v2/nginx/manifests/latest": dial tcp 104.244.43.248:443: i/o timeout: context deadline exceeded

nerdctl will succeed.
[root@dev-m containerd]# nerdctl --debug pull nginx DEBU[0000] verifying process skipped DEBU[0000] The image will be unpacked for platform {"amd64" "linux" "" [] ""}, snapshotter "overlayfs". DEBU[0000] fetching image="docker.io/library/nginx:latest" DEBU[0000] loading host directory dir=/etc/containerd/certs.d/docker.io DEBU[0000] resolving host=docker.m.daocloud.io DEBU[0000] do request host=docker.m.daocloud.io request.header.accept="application/vnd.docker.distribution.manifest.v2+json, application/vnd.docker.distribution.manifest.list.v2+json, application/vnd.oci.image.manifest.v1+json, application/vnd.oci.image.index.v1+json, */*" request.header.user-agent=containerd/2.1.4+unknown request.method=HEAD url="https://docker.m.daocloud.io/v2/library/nginx/manifests/latest?ns=docker.io" DEBU[0000] fetch response received host=docker.m.daocloud.io response.header.connection=keep-alive response.header.content-length=73 response.header.content-type="application/json; charset=utf-8" response.header.date="Wed, 22 Oct 2025 07:18:11 GMT" response.header.docker-distribution-api-version=registry/2.0 response.header.server=nginx response.header.www-authenticate="Bearer realm=\"https://auth.m.daocloud.io/auth/token\",service=\"docker.m.daocloud.io\",scope=\"repository:library/nginx:pull\"" response.status="401 Unauthorized" url="https://docker.m.daocloud.io/v2/library/nginx/manifests/latest?ns=docker.io" DEBU[0000] Unauthorized header="Bearer realm=\"https://auth.m.daocloud.io/auth/token\",service=\"docker.m.daocloud.io\",scope=\"repository:library/nginx:pull\"" host=docker.m.daocloud.io DEBU[0000] do request host=docker.m.daocloud.io request.header.accept="application/vnd.docker.distribution.manifest.v2+json, application/vnd.docker.distribution.manifest.list.v2+json, application/vnd.oci.image.manifest.v1+json, application/vnd.oci.image.index.v1+json, */*" request.header.user-agent=containerd/2.1.4+unknown request.method=HEAD url="https://docker.m.daocloud.io/v2/library/nginx/manifests/latest?ns=docker.io" DEBU[0000] fetch response received host=docker.m.daocloud.io response.header.connection=keep-alive response.header.content-length=10229 response.header.content-type=application/vnd.oci.image.index.v1+json response.header.date="Wed, 22 Oct 2025 07:18:11 GMT" response.header.docker-content-digest="sha256:029d4461bd98f124e531380505ceea2072418fdf28752aa73b7b273ba3048903" response.header.docker-distribution-api-version=registry/2.0 response.header.server=nginx response.status="200 OK" url="https://docker.m.daocloud.io/v2/library/nginx/manifests/latest?ns=docker.io" docker.io/library/nginx:latest: resolving |--------------------------------------| elapsed: 0.1 s total: 0.0 B (0.0 B/s) DEBU[0000] resolved desc.digest="sha256:029d4461bd98f124e531380505ceea2072418fdf28752aa73b7b273ba3048903" host=docker.m.daocloud.io DEBU[0000] loading host directory dir=/etc/containerd/certs.d/docker.io DEBU[0000] fetch digest="sha256:029d4461bd98f124e531380505ceea2072418fdf28752aa73b7b273ba3048903" mediatype=application/vnd.oci.image.index.v1+json size=10229 DEBU[0000] fetch digest="sha256:7e034cabf67d95246a996a3b92ad1c49c20d81526c9d7ba982aead057a0606e8" mediatype=application/vnd.oci.image.manifest.v1+json size=2290 DEBU[0000] fetch digest="sha256:657fdcd1c3659cf57cfaa13f40842e0a26b49ec9654d48fdefee9fc8259b4aab" mediatype=application/vnd.oci.image.config.v1+json size=8578 DEBU[0000] fetch digest="sha256:c50c84d0ed4d284980bee74762596dfb9dd18d84df2a9f35e67d801122be4d2b" mediatype=application/vnd.oci.image.layer.v1.tar+gzip size=1398 DEBU[0000] fetch digest="sha256:1498b1cfda15feb35e3ed793c4f4899908866a07f6a906c2850a05ef311c47bf" mediatype=application/vnd.oci.image.layer.v1.tar+gzip size=1209 DEBU[0000] fetch digest="sha256:38513bd7256313495cdd83b3b0915a633cfa475dc2a07072ab2c8d191020ca5d" mediatype=application/vnd.oci.image.layer.v1.tar+gzip size=29777924 DEBU[0000] fetch digest="sha256:3818929ac19fe9d79fe930c50f8b805dd21e66c81fad2827ef0449767a44792e" mediatype=application/vnd.oci.image.layer.v1.tar+gzip size=406 DEBU[0000] fetch digest="sha256:10d18f46ee87c8aeccaa2f2dd30b13e785851aea01b60141dfa4696d4a80c05e" mediatype=application/vnd.oci.image.layer.v1.tar+gzip size=29956994 DEBU[0000] fetch digest="sha256:a131bc1d4bd5679e3fb45bc4f3fec5c899584a74104a7ecb735907fb0c1fa038" mediatype=application/vnd.oci.image.layer.v1.tar+gzip size=956 DEBU[0000] fetch digest="sha256:a8d825a0683a9ab1305f4d4449745a156f4f8347f8aad942c3fd69af8d1348e5" mediatype=application/vnd.oci.image.layer.v1.tar+gzip size=627 DEBU[0000] fetching layer chunk_size=0 digest="sha256:38513bd7256313495cdd83b3b0915a633cfa475dc2a07072ab2c8d191020ca5d" initial_parallelism=0 mediatype=application/vnd.oci.image.layer.v1.tar+gzip offset=6291456 parallelism=1 size=29777924 DEBU[0000] do request digest="sha256:38513bd7256313495cdd83b3b0915a633cfa475dc2a07072ab2c8d191020ca5d" mediatype=application/vnd.oci.image.layer.v1.tar+gzip request.header.accept="application/vnd.oci.image.layer.v1.tar+gzip, */*" request.header.accept-encoding="zstd;q=1.0, gzip;q=0.8, deflate;q=0.5" request.header.range="bytes=6291456-" request.header.user-agent=containerd/2.1.4+unknown request.method=GET size=29777924 url="https://docker.m.daocloud.io/v2/library/nginx/blobs/sha256:38513bd7256313495cdd83b3b0915a633cfa475dc2a07072ab2c8d191020ca5d?ns=docker.io" DEBU[0000] fetching layer chunk_size=0 digest="sha256:10d18f46ee87c8aeccaa2f2dd30b13e785851aea01b60141dfa4696d4a80c05e" initial_parallelism=0 mediatype=application/vnd.oci.image.layer.v1.tar+gzip offset=6291456 parallelism=1 size=29956994 DEBU[0000] do request digest="sha256:10d18f46ee87c8aeccaa2f2dd30b13e785851aea01b60141dfa4696d4a80c05e" mediatype=application/vnd.oci.image.layer.v1.tar+gzip request.header.accept="application/vnd.oci.image.layer.v1.tar+gzip, */*" request.header.accept-encoding="zstd;q=1.0, gzip;q=0.8, deflate;q=0.5" request.header.range="bytes=6291456-" request.header.u docker.io/library/nginx:latest: resolving |--------------------------------------| index-sha256:029d4461bd98f124e531380505ceea2072418fdf28752aa73b7b273ba3048903: exists |++++++++++++++++++++++++++++++++++++++| elapsed: 0.2 s total: 0.0 B (0.0 B/s) DEBU[0000] fetch response received digest="sha256:38513bd7256313495cdd83b3b0915a633cfa475dc2a07072ab2c8d191020ca5d" mediatype=application/vnd.oci.image.layer.v1.tar+gzip response.header.connection=keep-alive response.header.content-length=73 response.header.content-type="application/json; charset=utf-8" response.header.date="Wed, 22 Oct 2025 07:18:11 GMT" response.header.docker-distribution-api-version=registry/2.0 response.header.server=nginx response.header.www-authenticate="Bearer realm=\"https://auth.m.daocloud.io/auth/token\",service=\"docker.m.daocloud.io\",scope=\"repository:library/nginx:pull\"" response.status="401 Unauthorized" size=29777924 url="https://docker.m.daocloud.io/v2/library/nginx/blobs/sha256:38513bd7256313495cdd83b3b0915a633cfa475dc2a07072ab2c8d191020ca5d?ns=docker.io" DEBU[0000] Unauthorized digest="sha256:38513bd7256313495cdd83b3b0915a633cfa475dc2a07072ab2c8d191020ca5d" header="Bearer realm=\"https://auth.m.daocloud.io/auth/token\",service=\"docker.m.daocloud.io\",scope=\"repository:library/nginx:pull\"" mediatype=application/vnd.oci.image.layer.v1.tar+gzip size=29777924 DEBU[0000] do request digest="sha256:38513bd7256313495cdd83b3b0915a633cfa475dc2a07072ab2c8d191020ca5d" mediatype=application/vnd.oci.image.layer.v1.tar+gzip request.header.accept="application/vnd.oci.image.layer.v1.tar+gzip, */*" request.header.accept-encoding="zstd;q=1.0, gzip;q=0.8, deflate;q=0.5" request.header.range="bytes=6291456-" request.header.user-agent=containerd/2.1.4+unknown request.method=GET size=29777924 url="https://docker.m.daocloud.io/v2/library/nginx/blobs/sha256:38513bd7256313495cdd83b3b0915a633cfa475dc2a07072ab2c8d191020ca5d?ns=docker.io" DEBU[0000] fetch response received digest="sha256:10d18f46ee87c8aeccaa2f2dd30b13e785851aea01b60141dfa4696d4a80c05e" mediatype=application/vnd.oci.image.layer.v1.tar+gzip response.header.connection=keep-alive response.header.content-length=73 response.header.content-type="application/json; charset=utf-8" response.header.date="Wed, 22 Oct 2025 07:18:11 GMT" response.header.docker-distribution-api-version=registry/2.0 response.header.server=nginx response.header.www-authenticate="Bearer realm=\"https://auth.m.daocloud.io/auth/token\",service=\"docker.m.daocloud.io\",scope=\"repository:library/nginx:pull\"" response.status="401 Unauthorized" size=29956994 url="https://docker.m.daocloud.io/v2/library/nginx/blobs/sha256:10d18f46ee87c8aeccaa2f2dd30b13e785851aea01b60141dfa4696d4a80c05e?ns=docker.io" DEBU[0000] Unauthorized digest="sha256:10d18f46ee87c8aeccaa2f2dd30b13e785851aea01b60141dfa4696d4a80c05e" header="Bearer realm=\"https://auth.m.daocloud.io/auth/token\",service=\"docker.m.daocloud.io\",scope=\"repository:library docker.io/library/nginx:latest: resolved |++++++++++++++++++++++++++++++++++++++| index-sha256:029d4461bd98f124e531380505ceea2072418fdf28752aa73b7b273ba3048903: exists |++++++++++++++++++++++++++++++++++++++| manifest-sha256:7e034cabf67d95246a996a3b92ad1c49c20d81526c9d7ba982aead057a0606e8: exists |++++++++++++++++++++++++++++++++++++++| config-sha256:657fdcd1c3659cf57cfaa13f40842e0a26b49ec9654d48fdefee9fc8259b4aab: exists |++++++++++++++++++++++++++++++++++++++| layer-sha256:38513bd7256313495cdd83b3b0915a633cfa475dc2a07072ab2c8d191020ca5d: downloading |++++++++------------------------------| 6.0 MiB/28.4 MiB layer-sha256:10d18f46ee87c8aeccaa2f2dd30b13e785851aea01b60141dfa4696d4a80c05e: downloading |+++++++-------------------------------| 6.0 MiB/28.6 MiB docker.io/library/nginx:latest: resolved |++++++++++++++++++++++++++++++++++++++| docker.io/library/nginx:latest: resolved |++++++++++++++++++++++++++++++++++++++| docker.io/library/nginx:latest: resolved |++++++++++++++++++++++++++++++++++++++| index-sha256:029d4461bd98f124e531380505ceea2072418fdf28752aa73b7b273ba3048903: exists |++++++++++++++++++++++++++++++++++++++| manifest-sha256:7e034cabf67d95246a996a3b92ad1c49c20d81526c9d7ba982aead057a0606e8: exists |++++++++++++++++++++++++++++++++++++++| config-sha256:657fdcd1c3659cf57cfaa13f40842e0a26b49ec9654d48fdefee9fc8259b4aab: exists |++++++++++++++++++++++++++++++++++++++| layer-sha256:38513bd7256313495cdd83b3b0915a633cfa475dc2a07072ab2c8d191020ca5d: done |++++++++++++++++++++++++++++++++++++++| layer-sha256:10d18f46ee87c8aeccaa2f2dd30b13e785851aea01b60141dfa4696d4a80c05e: done |++++++++++++++++++++++++++++++++++++++| docker.io/library/nginx:latest: resolved |++++++++++++++++++++++++++++++++++++++| index-sha256:029d4461bd98f124e531380505ceea2072418fdf28752aa73b7b273ba3048903: exists |++++++++++++++++++++++++++++++++++++++| manifest-sha256:7e034cabf67d95246a996a3b92ad1c49c20d81526c9d7ba982aead057a0606e8: exists |++++++++++++++++++++++++++++++++++++++| config-sha256:657fdcd1c3659cf57cfaa13f40842e0a26b49ec9654d48fdefee9fc8259b4aab: exists |++++++++++++++++++++++++++++++++++++++| layer-sha256:38513bd7256313495cdd83b3b0915a633cfa475dc2a07072ab2c8d191020ca5d: done |++++++++++++++++++++++++++++++++++++++| layer-sha256:10d18f46ee87c8aeccaa2f2dd30b13e785851aea01b60141dfa4696d4a80c05e: done |++++++++++++++++++++++++++++++++++++++| layer-sha256:c50c84d0ed4d284980bee74762596dfb9dd18d84df2a9f35e67d801122be4d2b: exists |++++++++++++++++++++++++++++++++++++++| layer-sha256:3818929ac19fe9d79fe930c50f8b805dd21e66c81fad2827ef0449767a44792e: exists |++++++++++++++++++++++++++++++++++++++| layer-sha256:a131bc1d4bd5679e3fb45bc4f3fec5c899584a74104a7ecb735907fb0c1fa038: exists |++++++++++++++++++++++++++++++++++++++| layer-sha256:1498b1cfda15feb35e3ed793c4f4899908866a07f6a906c2850a05ef311c47bf: exists |++++++++++++++++++++++++++++++++++++++| layer-sha256:a8d825a0683a9ab1305f4d4449745a156f4f8347f8aad942c3fd69af8d1348e5: exists |++++++++++++++++++++++++++++++++++++++| elapsed: 40.6s total: 57.0 M (1.4 MiB/s)

Question
No matter how I configure the mirror address, it always pulls from the default registry-1.docker.io. Strangely enough, I can successfully read the contents of certs.d using the nerdctl tool. How can I pull an image using crictl?

Environment
[root@dev-m containerd]# containerd --version
containerd github.com/containerd/containerd/v2 v2.1.4 75cb2b7

[root@dev-m containerd]# crictl --version
crictl version v1.30.0

[root@dev-m containerd]# containerd -v
containerd github.com/containerd/containerd/v2 v2.1.4 75cb2b7

Configuration Files
/etc/containerd/config.toml
`version = 3
root = '/var/lib/containerd'
state = '/run/containerd'
temp = ''
disabled_plugins = []
required_plugins = []
oom_score = 0
imports = []

[grpc]
address = '/run/containerd/containerd.sock'
tcp_address = ''
tcp_tls_ca = ''
tcp_tls_cert = ''
tcp_tls_key = ''
uid = 0
gid = 0
max_recv_message_size = 16777216
max_send_message_size = 16777216

[ttrpc]
address = ''
uid = 0
gid = 0

[debug]
address = ''
uid = 0
gid = 0
level = ''
format = ''

[metrics]
address = ''
grpc_histogram = false

[plugins]
[plugins.'io.containerd.cri.v1.images']
snapshotter = 'overlayfs'
disable_snapshot_annotations = true
discard_unpacked_layers = false
max_concurrent_downloads = 3
concurrent_layer_fetch_buffer = 0
image_pull_progress_timeout = '5m0s'
image_pull_with_sync_fs = false
stats_collect_period = 10
use_local_image_pull = false

[plugins.'io.containerd.cri.v1.images'.pinned_images]
  sandbox = 'registry.aliyuncs.com/google_containers/pause:3.10.1'

[plugins."io.containerd.grpc.v1.cri".registry]
  config_path = '/etc/containerd/certs.d'

[plugins.'io.containerd.cri.v1.images'.image_decryption]
  key_model = 'node'

[plugins.'io.containerd.cri.v1.runtime']
enable_selinux = false
selinux_category_range = 1024
max_container_log_line_size = 16384
disable_apparmor = false
restrict_oom_score_adj = false
disable_proc_mount = false
unset_seccomp_profile = ''
tolerate_missing_hugetlb_controller = true
disable_hugetlb_controller = true
device_ownership_from_security_context = false
ignore_image_defined_volumes = false
netns_mounts_under_state_dir = false
enable_unprivileged_ports = true
enable_unprivileged_icmp = true
enable_cdi = true
cdi_spec_dirs = ['/etc/cdi', '/var/run/cdi']
drain_exec_sync_io_timeout = '0s'
ignore_deprecation_warnings = []

[plugins.'io.containerd.cri.v1.runtime'.containerd]
  default_runtime_name = 'runc'
  ignore_blockio_not_enabled_errors = false
  ignore_rdt_not_enabled_errors = false

  [plugins.'io.containerd.cri.v1.runtime'.containerd.runtimes]
    [plugins.'io.containerd.cri.v1.runtime'.containerd.runtimes.runc]
      runtime_type = 'io.containerd.runc.v2'
      runtime_path = ''
      pod_annotations = []
      container_annotations = []
      privileged_without_host_devices = false
      privileged_without_host_devices_all_devices_allowed = false
      cgroup_writable = false
      base_runtime_spec = ''
      cni_conf_dir = ''
      cni_max_conf_num = 0
      snapshotter = ''
      sandboxer = 'podsandbox'
      io_type = ''

      [plugins.'io.containerd.cri.v1.runtime'.containerd.runtimes.runc.options]
        SystemdCgroup = true
        BinaryName = ''
        CriuImagePath = ''
        CriuWorkPath = ''
        IoGid = 0
        IoUid = 0
        NoNewKeyring = false
        Root = ''
        ShimCgroup = ''

[plugins.'io.containerd.cri.v1.runtime'.cni]
  bin_dir = ''
  bin_dirs = ['/opt/cni/bin']
  conf_dir = '/etc/cni/net.d'
  max_conf_num = 1
  setup_serially = false
  conf_template = ''
  ip_pref = ''
  use_internal_loopback = false

[plugins.'io.containerd.differ.v1.erofs']
mkfs_options = []

[plugins.'io.containerd.gc.v1.scheduler']
pause_threshold = 0.02
deletion_threshold = 0
mutation_threshold = 100
schedule_delay = '0s'
startup_delay = '100ms'

[plugins.'io.containerd.grpc.v1.cri']
disable_tcp_service = true
stream_server_address = '127.0.0.1'
stream_server_port = '0'
stream_idle_timeout = '4h0m0s'
enable_tls_streaming = false

[plugins.'io.containerd.grpc.v1.cri'.x509_key_pair_streaming]
  tls_cert_file = ''
  tls_key_file = ''

[plugins.'io.containerd.image-verifier.v1.bindir']
bin_dir = '/opt/containerd/image-verifier/bin'
max_verifiers = 10
per_verifier_timeout = '10s'

[plugins.'io.containerd.internal.v1.opt']
path = '/opt/containerd'

[plugins.'io.containerd.internal.v1.tracing']

[plugins.'io.containerd.metadata.v1.bolt']
content_sharing_policy = 'shared'
no_sync = false

[plugins.'io.containerd.monitor.container.v1.restart']
interval = '10s'

[plugins.'io.containerd.monitor.task.v1.cgroups']
no_prometheus = false

[plugins.'io.containerd.nri.v1.nri']
disable = false
socket_path = '/var/run/nri/nri.sock'
plugin_path = '/opt/nri/plugins'
plugin_config_path = '/etc/nri/conf.d'
plugin_registration_timeout = '5s'
plugin_request_timeout = '2s'
disable_connections = false

[plugins.'io.containerd.runtime.v2.task']
platforms = ['linux/amd64']

[plugins.'io.containerd.service.v1.diff-service']
default = ['walking']
sync_fs = false

[plugins.'io.containerd.service.v1.tasks-service']
blockio_config_file = ''
rdt_config_file = ''

[plugins.'io.containerd.shim.v1.manager']
env = []

[plugins.'io.containerd.snapshotter.v1.blockfile']
root_path = ''
scratch_file = ''
fs_type = ''
mount_options = []
recreate_scratch = false

[plugins.'io.containerd.snapshotter.v1.btrfs']
root_path = ''

[plugins.'io.containerd.snapshotter.v1.devmapper']
root_path = ''
pool_name = ''
base_image_size = ''
async_remove = false
discard_blocks = false
fs_type = ''
fs_options = ''

[plugins.'io.containerd.snapshotter.v1.erofs']
root_path = ''
ovl_mount_options = []
enable_fsverity = false
set_immutable = false

[plugins.'io.containerd.snapshotter.v1.native']
root_path = ''

[plugins.'io.containerd.snapshotter.v1.overlayfs']
root_path = ''
upperdir_label = false
sync_remove = false
slow_chown = false
mount_options = []

[plugins.'io.containerd.snapshotter.v1.zfs']
root_path = ''

[plugins.'io.containerd.tracing.processor.v1.otlp']

[plugins.'io.containerd.transfer.v1.local']
max_concurrent_downloads = 3
concurrent_layer_fetch_buffer = 0
max_concurrent_uploaded_layers = 3
check_platform_supported = false
config_path = ''

[cgroup]
path = ''

[timeouts]
'io.containerd.timeout.bolt.open' = '0s'
'io.containerd.timeout.cri.defercleanup' = '1m0s'
'io.containerd.timeout.metrics.shimstats' = '2s'
'io.containerd.timeout.shim.cleanup' = '5s'
'io.containerd.timeout.shim.load' = '5s'
'io.containerd.timeout.shim.shutdown' = '3s'
'io.containerd.timeout.task.state' = '2s'

[stream_processors]
[stream_processors.'io.containerd.ocicrypt.decoder.v1.tar']
accepts = ['application/vnd.oci.image.layer.v1.tar+encrypted']
returns = 'application/vnd.oci.image.layer.v1.tar'
path = 'ctd-decoder'
args = ['--decryption-keys-path', '/etc/containerd/ocicrypt/keys']
env = ['OCICRYPT_KEYPROVIDER_CONFIG=/etc/containerd/ocicrypt/ocicrypt_keyprovider.conf']

[stream_processors.'io.containerd.ocicrypt.decoder.v1.tar.gzip']
accepts = ['application/vnd.oci.image.layer.v1.tar+gzip+encrypted']
returns = 'application/vnd.oci.image.layer.v1.tar+gzip'
path = 'ctd-decoder'
args = ['--decryption-keys-path', '/etc/containerd/ocicrypt/keys']
env = ['OCICRYPT_KEYPROVIDER_CONFIG=/etc/containerd/ocicrypt/ocicrypt_keyprovider.conf']`

[root@dev-m containerd]# cat /etc/containerd/certs.d/docker.io/hosts.toml
server = "https://docker.io"
[host."https://docker.m.daocloud.io"]
capabilities = ["pull", "resolve", "push"]
skip_verify = true