diff --git a/cmd/kubeadm/app/cmd/reset.go b/cmd/kubeadm/app/cmd/reset.go
index feaa945add9..6b43088895c 100644
--- a/cmd/kubeadm/app/cmd/reset.go
+++ b/cmd/kubeadm/app/cmd/reset.go
@@ -184,7 +184,7 @@ func resetWithCrictl(execer utilsexec.Interface, dockerCheck preflight.Checker,
 	if criSocketPath != "" {
 		fmt.Printf("[reset] Cleaning up running containers using crictl with socket %s\n", criSocketPath)
 		listcmd := fmt.Sprintf(crictlSandboxesParamsFormat, crictlPath, criSocketPath)
-		output, err := execer.Command("sh", "-c", listcmd).CombinedOutput()
+		output, err := execer.Command(listcmd).CombinedOutput()
 		if err != nil {
 			fmt.Println("[reset] Failed to list running pods using crictl. Trying using docker instead.")
 			resetWithDocker(execer, dockerCheck)
@@ -193,13 +193,13 @@ func resetWithCrictl(execer utilsexec.Interface, dockerCheck preflight.Checker,
 		sandboxes := strings.Split(string(output), " ")
 		for _, s := range sandboxes {
 			stopcmd := fmt.Sprintf(crictlStopParamsFormat, crictlPath, criSocketPath, s)
-			if err := execer.Command("sh", "-c", stopcmd).Run(); err != nil {
+			if err := execer.Command(stopcmd).Run(); err != nil {
 				fmt.Println("[reset] Failed to stop the running containers using crictl. Trying using docker instead.")
 				resetWithDocker(execer, dockerCheck)
 				return
 			}
 			removecmd := fmt.Sprintf(crictlRemoveParamsFormat, crictlPath, criSocketPath, s)
-			if err := execer.Command("sh", "-c", removecmd).Run(); err != nil {
+			if err := execer.Command(removecmd).Run(); err != nil {
 				fmt.Println("[reset] Failed to remove the running containers using crictl. Trying using docker instead.")
 				resetWithDocker(execer, dockerCheck)
 				return
diff --git a/cmd/kubeadm/app/cmd/reset_test.go b/cmd/kubeadm/app/cmd/reset_test.go
index 59780e0a5a6..8159d70aaa6 100644
--- a/cmd/kubeadm/app/cmd/reset_test.go
+++ b/cmd/kubeadm/app/cmd/reset_test.go
@@ -278,10 +278,10 @@ func TestResetWithCrictl(t *testing.T) {
 	if fcmd.RunCalls != 3 {
 		t.Errorf("expected 3 calls to Run, got %d", fcmd.RunCalls)
 	}
-	if !strings.Contains(fcmd.RunLog[1][2], "crictl") {
+	if !strings.Contains(fcmd.RunLog[1][0], "crictl") {
 		t.Errorf("expected a call to crictl, got %v", fcmd.RunLog[0])
 	}
-	if !strings.Contains(fcmd.RunLog[2][2], "crictl") {
+	if !strings.Contains(fcmd.RunLog[2][0], "crictl") {
 		t.Errorf("expected a call to crictl, got %v", fcmd.RunLog[0])
 	}
 
@@ -330,7 +330,7 @@ func TestReset(t *testing.T) {
 	if fcmd.RunCalls != 2 {
 		t.Errorf("expected 2 call to Run, got %d", fcmd.RunCalls)
 	}
-	if !strings.Contains(fcmd.RunLog[0][2], "crictl") {
+	if !strings.Contains(fcmd.RunLog[0][0], "crictl") {
 		t.Errorf("expected a call to crictl, got %v", fcmd.RunLog[0])
 	}
 
diff --git a/cmd/kubeadm/app/preflight/checks.go b/cmd/kubeadm/app/preflight/checks.go
index 0059ac5d168..5dd5d2dfbda 100644
--- a/cmd/kubeadm/app/preflight/checks.go
+++ b/cmd/kubeadm/app/preflight/checks.go
@@ -99,7 +99,12 @@ func (CRICheck) Name() string {
 
 // Check validates the container runtime through the CRI.
 func (criCheck CRICheck) Check() (warnings, errors []error) {
-	if err := criCheck.exec.Command("sh", "-c", fmt.Sprintf("crictl -r %s info", criCheck.socket)).Run(); err != nil {
+	crictlPath, err := criCheck.exec.LookPath("crictl")
+	if err != nil {
+		errors = append(errors, fmt.Errorf("unable to find command crictl: %s", err))
+		return warnings, errors
+	}
+	if err := criCheck.exec.Command(fmt.Sprintf("%s -r %s info", crictlPath, criCheck.socket)).Run(); err != nil {
 		errors = append(errors, fmt.Errorf("unable to check if the container runtime at %q is running: %s", criCheck.socket, err))
 		return warnings, errors
 	}
@@ -859,8 +864,6 @@ func RunInitMasterChecks(execer utilsexec.Interface, cfg *kubeadmapi.MasterConfi
 		exec:       execer,
 		suggestion: fmt.Sprintf("go get %v", kubeadmconstants.CRICtlPackage),
 	}
-	warns, _ := criCtlChecker.Check()
-	useCRI := len(warns) == 0
 
 	manifestsDir := filepath.Join(kubeadmconstants.KubernetesDir, kubeadmconstants.ManifestsSubDirName)
 
@@ -871,6 +874,7 @@ func RunInitMasterChecks(execer utilsexec.Interface, cfg *kubeadmapi.MasterConfi
 		HostnameCheck{nodeName: cfg.NodeName},
 		KubeletVersionCheck{KubernetesVersion: cfg.KubernetesVersion},
 		ServiceCheck{Service: "kubelet", CheckIfActive: false},
+		ServiceCheck{Service: "docker", CheckIfActive: true}, // assume docker
 		FirewalldCheck{ports: []int{int(cfg.API.BindPort), 10250}},
 		PortOpenCheck{port: int(cfg.API.BindPort)},
 		PortOpenCheck{port: 10250},
@@ -902,13 +906,6 @@ func RunInitMasterChecks(execer utilsexec.Interface, cfg *kubeadmapi.MasterConfi
 		HTTPProxyCIDRCheck{Proto: "https", CIDR: cfg.Networking.PodSubnet},
 	}
 
-	if useCRI {
-		checks = append(checks, CRICheck{socket: criSocket, exec: execer})
-	} else {
-		// assume docker
-		checks = append(checks, ServiceCheck{Service: "docker", CheckIfActive: true})
-	}
-
 	if len(cfg.Etcd.Endpoints) == 0 {
 		// Only do etcd related checks when no external endpoints were specified
 		checks = append(checks,