diff --git a/cmd/cri-containerd/cri_containerd.go b/cmd/cri-containerd/cri_containerd.go
index ed31effec..646500fe3 100644
--- a/cmd/cri-containerd/cri_containerd.go
+++ b/cmd/cri-containerd/cri_containerd.go
@@ -42,9 +42,13 @@ func main() {
 	if err != nil {
 		glog.Exitf("Failed to connect containerd endpoint %q: %v", o.ContainerdEndpoint, err)
 	}
-
 	glog.V(2).Infof("Run cri-containerd grpc server on socket %q", o.SocketPath)
-	service := server.NewCRIContainerdService(conn, o.RootDir)
+
+	service, err := server.NewCRIContainerdService(conn, o.RootDir, o.NetworkPluginBinDir, o.NetworkPluginConfDir)
+	if err != nil {
+		glog.Exitf("Failed to create CRI containerd service %+v: %v", o, err)
+	}
+
 	s := server.NewCRIContainerdServer(o.SocketPath, service, service)
 	if err := s.Run(); err != nil {
 		glog.Exitf("Failed to run cri-containerd grpc server: %v", err)
diff --git a/cmd/cri-containerd/options/options.go b/cmd/cri-containerd/options/options.go
index 9304169d5..097c704f0 100644
--- a/cmd/cri-containerd/options/options.go
+++ b/cmd/cri-containerd/options/options.go
@@ -36,6 +36,10 @@ type CRIContainerdOptions struct {
 	ContainerdEndpoint string
 	// ContainerdConnectionTimeout is the connection timeout for containerd client.
 	ContainerdConnectionTimeout time.Duration
+	// NetworkPluginBinDir is the directory in which the binaries for the plugin is kept.
+	NetworkPluginBinDir string
+	// NetworkPluginConfDir is the directory in which the admin places a CNI conf.
+	NetworkPluginConfDir string
 }
 
 // NewCRIContainerdOptions returns a reference to CRIContainerdOptions
@@ -55,6 +59,10 @@ func (c *CRIContainerdOptions) AddFlags(fs *pflag.FlagSet) {
 		2*time.Minute, "Connection timeout for containerd client.")
 	fs.BoolVar(&c.PrintVersion, "version",
 		false, "Print cri-containerd version information and quit.")
+	fs.StringVar(&c.NetworkPluginBinDir, "network-bin-dir",
+		"/etc/cni/net.d", "The directory for putting network binaries.")
+	fs.StringVar(&c.NetworkPluginConfDir, "network-conf-dir",
+		"/opt/cni/bin", "The directory for putting network plugin configuration files.")
 }
 
 // InitFlags must be called after adding all cli options flags are defined and
diff --git a/pkg/server/service.go b/pkg/server/service.go
index d05011c39..d9b28baca 100644
--- a/pkg/server/service.go
+++ b/pkg/server/service.go
@@ -17,6 +17,8 @@ limitations under the License.
 package server
 
 import (
+	"fmt"
+
 	"github.com/docker/docker/pkg/truncindex"
 	"google.golang.org/grpc"
 
@@ -31,6 +33,8 @@ import (
 	imagesservice "github.com/containerd/containerd/services/images"
 	rootfsservice "github.com/containerd/containerd/services/rootfs"
 
+	"github.com/kubernetes-incubator/cri-o/pkg/ocicni"
+
 	"github.com/kubernetes-incubator/cri-containerd/pkg/metadata"
 	"github.com/kubernetes-incubator/cri-containerd/pkg/metadata/store"
 	osinterface "github.com/kubernetes-incubator/cri-containerd/pkg/os"
@@ -94,13 +98,15 @@ type criContainerdService struct {
 	// imageStoreService is the containerd service to store and track
 	// image metadata.
 	imageStoreService images.Store
+	// netPlugin is used to setup and teardown network when run/stop pod sandbox.
+	netPlugin ocicni.CNIPlugin
 }
 
 // NewCRIContainerdService returns a new instance of CRIContainerdService
-func NewCRIContainerdService(conn *grpc.ClientConn, rootDir string) CRIContainerdService {
+func NewCRIContainerdService(conn *grpc.ClientConn, rootDir, networkPluginBinDir, networkPluginConfDir string) (CRIContainerdService, error) {
 	// TODO: Initialize different containerd clients.
 	// TODO(random-liu): [P2] Recover from runtime state and metadata store.
-	return &criContainerdService{
+	c := &criContainerdService{
 		os:                 osinterface.RealOS{},
 		rootDir:            rootDir,
 		sandboxStore:       metadata.NewSandboxStore(store.NewMetadataStore()),
@@ -118,6 +124,14 @@ func NewCRIContainerdService(conn *grpc.ClientConn, rootDir string) CRIContainer
 		contentProvider:    contentservice.NewProviderFromClient(contentapi.NewContentClient(conn)),
 		rootfsUnpacker:     rootfsservice.NewUnpackerFromClient(rootfsapi.NewRootFSClient(conn)),
 	}
+
+	netPlugin, err := ocicni.InitCNI(networkPluginBinDir, networkPluginConfDir)
+	if err != nil {
+		return nil, fmt.Errorf("failed to initialize cni plugin: %v", err)
+	}
+	c.netPlugin = netPlugin
+
+	return c, nil
 }
 
 func (c *criContainerdService) Start() error {