diff --git a/roles/container-engine/containerd-common/defaults/main.yml b/roles/container-engine/containerd-common/defaults/main.yml
index 3a85d7f05d4..c4d9eec14f8 100644
--- a/roles/container-engine/containerd-common/defaults/main.yml
+++ b/roles/container-engine/containerd-common/defaults/main.yml
@@ -15,3 +15,8 @@ containerd_ubuntu_repo_component: "stable"
 # Debian docker-ce repo
 containerd_debian_repo_base_url: "https://download.docker.com/linux/debian"
 containerd_debian_repo_component: "stable"
+
+# Mandatory packages
+containerd_mandatory_packages:
+  - iptables
+  - ipset
diff --git a/roles/container-engine/containerd-common/tasks/main.yml b/roles/container-engine/containerd-common/tasks/main.yml
index cfd78f3a379..43840b76b0b 100644
--- a/roles/container-engine/containerd-common/tasks/main.yml
+++ b/roles/container-engine/containerd-common/tasks/main.yml
@@ -29,3 +29,11 @@
       skip: true
   tags:
     - facts
+
+- name: containerd-common | ensure mandatory packages are present
+  package:
+    name: "{{ containerd_mandatory_packages }}"
+    state: present
+  when:
+    - not is_ostree
+    - ansible_distribution not in ["Flatcar Container Linux by Kinvolk", "Flatcar"]