diff --git a/config/samples/ccruntime/base/ccruntime.yaml b/config/samples/ccruntime/base/ccruntime.yaml
index deec149a..12e757eb 100644
--- a/config/samples/ccruntime/base/ccruntime.yaml
+++ b/config/samples/ccruntime/base/ccruntime.yaml
@@ -82,27 +82,6 @@ spec:
             path: /var/lib/containerd-nydus/
             type: ""
           name: containerd-nydus
-      environmentVariables:
-        # If set to true, this will install the CoCo fork of the containerd,
-        # the one allowing images to be pulled inside the guest and has patches
-        # for handling GPU / VFIO, on the node
-        # default: true
-        - name: "INSTALL_COCO_CONTAINERD"
-          value: "false"
-        # If set to true, this will install the v1.7.0 release of containerd on the node.
-        # default: false
-        - name: "INSTALL_OFFICIAL_CONTAINERD"
-          value: "true"
-        # If set to true, this will install the CoCo fork of the containerd,
-        # the one that has patches for handling GPU / VFIO, on the node
-        # default: false
-        - name: "INSTALL_VFIO_GPU_CONTAINERD"
-          value: "false"
-        # If set to true, this will install nydus-snapshotter and nydus-image
-        # on the node
-        # default: false
-        - name: "INSTALL_NYDUS_SNAPSHOTTER"
-          value: "true"
     preInstall:
       image: quay.io/confidential-containers/reqs-payload
       volumeMounts:
@@ -137,26 +116,6 @@ spec:
             path: /var/lib/containerd-nydus/
             type: ""
           name: containerd-nydus
-      environmentVariables:
-        # If set to true, this will install the CoCo fork of the containerd,
-        # the one allowing images to be pulled inside the guest and has patches
-        # for handling GPU / VFIO, on the node
-        - name: "INSTALL_COCO_CONTAINERD"
-          value: "false"
-        # If set to true, this will install the v1.7.0 release of containerd on the node.
-        # default: false
-        - name: "INSTALL_OFFICIAL_CONTAINERD"
-          value: "true"
-        # If set to true, this will install the CoCo fork of the containerd,
-        # the one that has patches for handling GPU / VFIO, on the node
-        # default: false
-        - name: "INSTALL_VFIO_GPU_CONTAINERD"
-          value: "false"
-        # If set to true, this will install nydus-snapshotter and nydus-image
-        # on the node
-        # default: false
-        - name: "INSTALL_NYDUS_SNAPSHOTTER"
-          value: "true"
     environmentVariables:
       - name: NODE_NAME
         valueFrom:
@@ -167,3 +126,24 @@ spec:
         value: "yes"
       - name: "DEBUG"
         value: "false"
+      # If set to true, this will install the CoCo fork of the containerd,
+      # the one allowing images to be pulled inside the guest and has patches
+      # for handling GPU / VFIO, on the node
+      # default: true
+      - name: "INSTALL_COCO_CONTAINERD"
+        value: "false"
+      # If set to true, this will install the v1.7.0 release of containerd on the node.
+      # default: false
+      - name: "INSTALL_OFFICIAL_CONTAINERD"
+        value: "true"
+      # If set to true, this will install the CoCo fork of the containerd,
+      # the one that has patches for handling GPU / VFIO, on the node
+      # default: false
+      - name: "INSTALL_VFIO_GPU_CONTAINERD"
+        value: "false"
+      # If set to true, this will install nydus-snapshotter and nydus-image
+      # on the node
+      # default: false
+      - name: "INSTALL_NYDUS_SNAPSHOTTER"
+        value: "true"
+