diff --git a/docs/upgrades.md b/docs/upgrades.md
index ad0983b1a19fdeb72385b5ddd2e1dc4f1edf133a..f5fe3804906650a18dacb2dc421146b9b3688ca9 100644
--- a/docs/upgrades.md
+++ b/docs/upgrades.md
@@ -7,7 +7,8 @@ You can also individually control versions of components by explicitly defining
 versions. Here are all version vars for each component:
 
 * docker_version
-* containerd_version
+* docker_containerd_version (relevant when `container_manager` == `docker`)
+* containerd_version (relevant when `container_manager` == `containerd`)
 * kube_version
 * etcd_version
 * calico_version
diff --git a/docs/vars.md b/docs/vars.md
index be812042abd8205418aa811802a4729543699390..f0d7747d213a104c3194541d625426230b605754 100644
--- a/docs/vars.md
+++ b/docs/vars.md
@@ -18,7 +18,8 @@ Some variables of note include:
 * *docker_version* - Specify version of Docker to used (should be quoted
   string). Must match one of the keys defined for *docker_versioned_pkg*
   in `roles/container-engine/docker/vars/*.yml`.
-* *containerd_version* - Specify version of Containerd to use
+* *containerd_version* - Specify version of containerd to use when setting `container_manager` to `containerd`
+* *docker_containerd_version* - Specify which version of containerd to use when setting `container_manager` to `docker`
 * *etcd_version* - Specify version of ETCD to use
 * *ipip* - Enables Calico ipip encapsulation by default
 * *kube_network_plugin* - Sets k8s network plugin (default Calico)
diff --git a/roles/container-engine/docker/vars/debian-stretch.yml b/roles/container-engine/docker/vars/debian-stretch.yml
index 3616c64e00e58cf91c4774140fa481d1d319280a..f26f60b1c10a081a04954255afa52ccfda4cdbdb 100644
--- a/roles/container-engine/docker/vars/debian-stretch.yml
+++ b/roles/container-engine/docker/vars/debian-stretch.yml
@@ -28,7 +28,7 @@ docker_cli_versioned_pkg:
 
 docker_package_info:
   pkgs:
-    - "{{ containerd_versioned_pkg[containerd_version | string] }}"
+    - "{{ containerd_versioned_pkg[docker_containerd_version | string] }}"
     - "{{ docker_cli_versioned_pkg[docker_cli_version | string] }}"
     - "{{ docker_versioned_pkg[docker_version | string] }}"
 
diff --git a/roles/container-engine/docker/vars/debian.yml b/roles/container-engine/docker/vars/debian.yml
index 3b0c784bbdd32f46944f5d2e59d3978052367f64..36b22c2d7d054b44c4f92c907f3c569c971221ca 100644
--- a/roles/container-engine/docker/vars/debian.yml
+++ b/roles/container-engine/docker/vars/debian.yml
@@ -30,7 +30,7 @@ docker_cli_versioned_pkg:
 
 docker_package_info:
   pkgs:
-    - "{{ containerd_versioned_pkg[containerd_version | string] }}"
+    - "{{ containerd_versioned_pkg[docker_containerd_version | string] }}"
     - "{{ docker_cli_versioned_pkg[docker_cli_version | string] }}"
     - "{{ docker_versioned_pkg[docker_version | string] }}"
 
diff --git a/roles/container-engine/docker/vars/fedora.yml b/roles/container-engine/docker/vars/fedora.yml
index df5d3597da68bc15261816199ca0648fe840be2d..278dfe0fe73389730845b4f8e0a1e99af05bfebf 100644
--- a/roles/container-engine/docker/vars/fedora.yml
+++ b/roles/container-engine/docker/vars/fedora.yml
@@ -30,6 +30,6 @@ docker_cli_versioned_pkg:
 docker_package_info:
   enablerepo: "docker-ce"
   pkgs:
-    - "{{ containerd_versioned_pkg[containerd_version | string] }}"
+    - "{{ containerd_versioned_pkg[docker_containerd_version | string] }}"
     - "{{ docker_cli_versioned_pkg[docker_cli_version | string] }}"
     - "{{ docker_versioned_pkg[docker_version | string] }}"
diff --git a/roles/container-engine/docker/vars/redhat.yml b/roles/container-engine/docker/vars/redhat.yml
index 8cc897cda794a348f5c29c97ac9530be344a4709..5cc83529e809e126b19fc2a4ac79a26d0e116b99 100644
--- a/roles/container-engine/docker/vars/redhat.yml
+++ b/roles/container-engine/docker/vars/redhat.yml
@@ -33,6 +33,6 @@ docker_cli_versioned_pkg:
 docker_package_info:
   enablerepo: "docker-ce"
   pkgs:
-    - "{{ containerd_versioned_pkg[containerd_version | string] }}"
+    - "{{ containerd_versioned_pkg[docker_containerd_version | string] }}"
     - "{{ docker_cli_versioned_pkg[docker_cli_version | string] }}"
     - "{{ docker_versioned_pkg[docker_version | string] }}"
diff --git a/roles/container-engine/docker/vars/ubuntu-16.yml b/roles/container-engine/docker/vars/ubuntu-16.yml
index 54046cbe23d4def929d382caf2b58ae3552b45b5..78a6ceae412b32732f17886b85b8cb533216ba20 100644
--- a/roles/container-engine/docker/vars/ubuntu-16.yml
+++ b/roles/container-engine/docker/vars/ubuntu-16.yml
@@ -29,7 +29,7 @@ docker_cli_versioned_pkg:
 
 docker_package_info:
   pkgs:
-    - "{{ containerd_versioned_pkg[containerd_version | string] }}"
+    - "{{ containerd_versioned_pkg[docker_containerd_version | string] }}"
     - "{{ docker_cli_versioned_pkg[docker_cli_version | string] }}"
     - "{{ docker_versioned_pkg[docker_version | string] }}"
 
diff --git a/roles/container-engine/docker/vars/ubuntu.yml b/roles/container-engine/docker/vars/ubuntu.yml
index 0fdc778e31fabbe0f3c03c2de70e0f22a719201b..fb85f24066b3e48ee563912b2bf6c91cbc29e34c 100644
--- a/roles/container-engine/docker/vars/ubuntu.yml
+++ b/roles/container-engine/docker/vars/ubuntu.yml
@@ -30,7 +30,7 @@ docker_cli_versioned_pkg:
 
 docker_package_info:
   pkgs:
-    - "{{ containerd_versioned_pkg[containerd_version | string] }}"
+    - "{{ containerd_versioned_pkg[docker_containerd_version | string] }}"
     - "{{ docker_cli_versioned_pkg[docker_cli_version | string] }}"
     - "{{ docker_versioned_pkg[docker_version | string] }}"
 
diff --git a/roles/download/defaults/main.yml b/roles/download/defaults/main.yml
index 662cad54c60feeab0bce514f7ce2795357595984..b1f6cfaf66071441d553b664149ab89bd76835e9 100644
--- a/roles/download/defaults/main.yml
+++ b/roles/download/defaults/main.yml
@@ -497,18 +497,14 @@ nerdctl_archive_checksums:
   amd64:
     0.12.1: 868dc5997c3edb0bd06f75012e71c2b15ee0885b83bad191fbe2a1d6d5f4f2ac
 
-# TODO(cristicalin): remove compatibility entries once debian9 and ubuntu16 jobs are dropped or docker is dropped
 containerd_archive_checksums:
   arm:
-    latest: 0  # this is needed to make debian9 and ubuntu16 CI jobs happy
     1.4.9: 0
     1.5.5: 0
   arm64:
-    latest: 0  # this is needed to make debian9 and ubuntu16 CI jobs happy
     1.4.9: 0
     1.5.5: 0
   amd64:
-    latest: 0  # this is needed to make debian9 and ubuntu16 CI jobs happy
     1.4.9: 346f88ad5b973960ff81b5539d4177af5941ec2e4703b479ca9a6081ff1d023b
     1.5.5: 8efc527ffb772a82021800f0151374a3113ed2439922497ff08f2596a70f10f1
 
diff --git a/roles/kubespray-defaults/defaults/main.yaml b/roles/kubespray-defaults/defaults/main.yaml
index 99ee494d76a23cdfb25f07e76eb980234879a5da..24345b5a2bcf2ee75a3ee4aa61d4797271534175 100644
--- a/roles/kubespray-defaults/defaults/main.yaml
+++ b/roles/kubespray-defaults/defaults/main.yaml
@@ -330,10 +330,13 @@ docker_plugins: []
 # Experimental kubeadm etcd deployment mode. Available only for new deployment
 etcd_kubeadm_enabled: false
 
-# Containerd options
+# Containerd options - thse are relevant when container_manager == 'containerd'
 containerd_version: 1.4.9
 containerd_use_systemd_cgroup: true
 
+# Docker options - this is relevant when container_manager == 'docker'
+docker_containerd_version: 1.4.9
+
 # Settings for containerized control plane (etcd/kubelet/secrets)
 # deployment type for legacy etcd mode
 etcd_deployment_type: docker
diff --git a/tests/files/packet_debian9-calico-upgrade-once.yml b/tests/files/packet_debian9-calico-upgrade-once.yml
index 9e4fa1b553c526dec79a6ab5319603e98e91d337..dcf4186c795db2499fe2d78cc1560d6cd3cba7c5 100644
--- a/tests/files/packet_debian9-calico-upgrade-once.yml
+++ b/tests/files/packet_debian9-calico-upgrade-once.yml
@@ -10,4 +10,4 @@ dns_min_replicas: 1
 download_run_once: true
 
 # Make docker happy
-containerd_version: latest
+docker_containerd_version: latest
diff --git a/tests/files/packet_debian9-calico-upgrade.yml b/tests/files/packet_debian9-calico-upgrade.yml
index dd02770246f8caba55f68a45a0ee8a90c3530acb..bc6837a11fb4830299ebc4992baafe07b5e5bf34 100644
--- a/tests/files/packet_debian9-calico-upgrade.yml
+++ b/tests/files/packet_debian9-calico-upgrade.yml
@@ -9,4 +9,4 @@ deploy_netchecker: true
 dns_min_replicas: 1
 
 # Make docker happy
-containerd_version: latest
+docker_containerd_version: latest
diff --git a/tests/files/packet_debian9-macvlan.yml b/tests/files/packet_debian9-macvlan.yml
index 9a481b2b9390abdfae25980f9ac068ef15725f80..accf275df12bc73447e9a96f3a30aa9b45813ff4 100644
--- a/tests/files/packet_debian9-macvlan.yml
+++ b/tests/files/packet_debian9-macvlan.yml
@@ -14,4 +14,4 @@ macvlan_interface: "eth0"
 auto_renew_certificates: true
 
 # Make docker happy
-containerd_version: latest
+docker_containerd_version: latest
diff --git a/tests/files/packet_ubuntu16-canal-kubeadm-ha.yml b/tests/files/packet_ubuntu16-canal-kubeadm-ha.yml
index 9861b350210dfb0abc2a2274753a5e46d88305b8..ac64817aa6e54627577c02c12aacd66175ab1b8a 100644
--- a/tests/files/packet_ubuntu16-canal-kubeadm-ha.yml
+++ b/tests/files/packet_ubuntu16-canal-kubeadm-ha.yml
@@ -10,4 +10,4 @@ deploy_netchecker: true
 dns_min_replicas: 1
 
 # Make docker jobs happy
-containerd_version: latest
+docker_containerd_version: latest
diff --git a/tests/files/packet_ubuntu16-canal-sep.yml b/tests/files/packet_ubuntu16-canal-sep.yml
index 44df4f948cc9c766f520ac87e384498ebf1eba0c..01fcaff881294cbcb260110991937b2fbbc17be2 100644
--- a/tests/files/packet_ubuntu16-canal-sep.yml
+++ b/tests/files/packet_ubuntu16-canal-sep.yml
@@ -10,4 +10,4 @@ deploy_netchecker: true
 dns_min_replicas: 1
 
 # Make docker jobs happy
-containerd_version: latest
+docker_containerd_version: latest
diff --git a/tests/files/packet_ubuntu16-flannel-ha.yml b/tests/files/packet_ubuntu16-flannel-ha.yml
index 5f3b19d9becbf75acd95444a1ddb6192b5cff78e..c4af804a153526f23f8f66c04d42a0afdd9a155d 100644
--- a/tests/files/packet_ubuntu16-flannel-ha.yml
+++ b/tests/files/packet_ubuntu16-flannel-ha.yml
@@ -12,4 +12,4 @@ deploy_netchecker: true
 dns_min_replicas: 1
 
 # Make docker jobs happy
-containerd_version: latest
+docker_containerd_version: latest
diff --git a/tests/files/packet_ubuntu16-kube-router-sep.yml b/tests/files/packet_ubuntu16-kube-router-sep.yml
index e923834aa4e1f5f4bdf91ae2dbbf78b987ed613a..91aa6cbe1ca079cb97120ba829c359bde98cbf2d 100644
--- a/tests/files/packet_ubuntu16-kube-router-sep.yml
+++ b/tests/files/packet_ubuntu16-kube-router-sep.yml
@@ -10,4 +10,4 @@ deploy_netchecker: true
 dns_min_replicas: 1
 
 # Make docker jobs happy
-containerd_version: latest
+docker_containerd_version: latest
diff --git a/tests/files/packet_ubuntu16-kube-router-svc-proxy.yml b/tests/files/packet_ubuntu16-kube-router-svc-proxy.yml
index 043639ad9e16e16df078e6df3b12cf4373f0ad56..433557b9832dbd856b8614fdfc757a3784b9f106 100644
--- a/tests/files/packet_ubuntu16-kube-router-svc-proxy.yml
+++ b/tests/files/packet_ubuntu16-kube-router-svc-proxy.yml
@@ -12,4 +12,4 @@ dns_min_replicas: 1
 kube_router_run_service_proxy: true
 
 # Make docker jobs happy
-containerd_version: latest
+docker_containerd_version: latest
diff --git a/tests/files/packet_ubuntu16-weave-sep.yml b/tests/files/packet_ubuntu16-weave-sep.yml
index e424a6cc847a9c0148f8d3f65486f7096dc4da1d..22cfe0e516cf40ab6b1d1489a6825888d6d53e06 100644
--- a/tests/files/packet_ubuntu16-weave-sep.yml
+++ b/tests/files/packet_ubuntu16-weave-sep.yml
@@ -11,4 +11,4 @@ dns_min_replicas: 1
 auto_renew_certificates: true
 
 # Make docker jobs happy
-containerd_version: latest
+docker_containerd_version: latest