containerd

https://github.com/containerd/containerd

1）apt/yum安装

验证仓库版本：

~# apt-cache madison containerd
containerd | 1.7.24-0ubuntu1~22.04.2 | https://mirrors.aliyun.com/ubuntu jammy-security/main amd64 Packages
containerd | 1.7.24-0ubuntu1~22.04.2 | https://mirrors.aliyun.com/ubuntu jammy-updates/main amd64 Packages
containerd | 1.5.9-0ubuntu3 | https://mirrors.aliyun.com/ubuntu jammy/main amd64 Packages
containerd | 1.5.9-0ubuntu3 | https://mirrors.aliyun.com/ubuntu jammy/main Sources
containerd | 1.6.12-0ubuntu1~22.04.8 | https://mirrors.aliyun.com/ubuntu jammy-security/main Sources
containerd-app | 1.7.24-0ubuntu1~22.04.2 | https://mirrors.aliyun.com/ubuntu jammy-security/universe Sources
containerd | 1.6.12-0ubuntu1~22.04.8 | https://mirrors.aliyun.com/ubuntu jammy-updates/main Sources
containerd-app | 1.7.24-0ubuntu1~22.04.2 | https://mirrors.aliyun.com/ubuntu jammy-updates/universe Sources

安装containerd

~# apt install containerd=1.7.24-0ubuntu1~22.04.2

查看service⽂件

~# cat /lib/systemd/system/containerd.service
# Copyright The containerd Authors.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

[Unit]
Description=containerd container runtime
Documentation=https://containerd.io
After=network.target local-fs.target dbus.service

[Service]
#uncomment to enable the experimental sbservice (sandboxed) version of containerd/cri integration
#Environment="ENABLE_CRI_SANDBOXES=sandboxed"
ExecStartPre=-/sbin/modprobe overlay
ExecStart=/usr/bin/containerd

Type=notify
Delegate=yes
KillMode=process
Restart=always
RestartSec=5
# Having non-zero Limit*s causes performance problems due to accounting overhead
# in the kernel. We recommend using cgroups to do container-local accounting.
LimitNPROC=infinity
LimitCORE=infinity
LimitNOFILE=infinity
# Comment TasksMax if your systemd version does not supports it.
# Only systemd 226 and above support this version.
TasksMax=infinity
OOMScoreAdjust=-999

[Install]
WantedBy=multi-user.target

验证runc环境

~#  whereis runc
runc: /usr/bin/runc /usr/sbin/runc /usr/share/man/man8/runc.8.gz

~# whereis containerd
containerd: /usr/bin/containerd /usr/share/man/man8/containerd.8.gz

~# runc -v
runc version 1.1.12-0ubuntu2~22.04.1
spec: 1.0.2-dev
go: go1.21.1
libseccomp: 2.5.3

containerd配置⽂件

~# containerd config default #查看默认配置
~# mkdir /etc/containerd/
~# containerd config default > /etc/containerd/config.toml

通过命令⾏测试下载镜像

containerd的命令⾏客户端有ctr、crictl、nerdctl等，containerd相⽐docker多了⼀个命名空间的逻辑概念，⾃身的命令⾏客户端ctr命令默认是在default命名空间⾥、nerdctl也是在default，当使⽤crictl命令的时候，是在k8s.io这个命名空间，⽽k8s的创建的pod也是在k8s.io命名空间，因此在使⽤nerdctl管理kubernetes环境的pod的时候要指定命名空间为k8s.io，否则看不到kubernetes环境中的pod。

# ctr images pull registry.cn-zhangjiakou.aliyuncs.com/tanghao429/tanghao:demoapp.v1.0

验证镜像

~# ctr images ls

ctr客户端创建测试容器

~# ctr run -t --net-host registry.cn-zhangjiakou.aliyuncs.com/tanghao429/tanghao:demoapp.v1.0 test-container sh
[root@pg-4 /]# ls
bin    dev    etc    home   lib    media  mnt    opt    proc   root   run    sbin   srv    sys    tmp    usr    var

2）⼆进制安装containerd:

下载containerd⼆进制并创建service⽂件

## 下载
/usr/local/src# wget https://github.com/containerd/containerd/releases/download/v1.7.26/containerd-1.7.26-linux-amd64.tar.gz
/usr/local/src# tar xf containerd-1.7.26-linux-amd64.tar.gz 
/usr/local/src# cp bin/* /usr/local/bin/
/usr/local/src# containerd -v
containerd github.com/containerd/containerd v1.7.26 753481ec61c7c8955a23d6ff7bc8e4daed455734
## 创建service⽂件
~# cat /lib/systemd/system/containerd.service
[Unit]
Description=containerd container runtime
Documentation=https://containerd.io
After=network.target local-fs.target dbus.service

[Service]
#uncomment to enable the experimental sbservice (sandboxed) version of containerd/cri integration
#Environment="ENABLE_CRI_SANDBOXES=sandboxed"
ExecStartPre=-/sbin/modprobe overlay
ExecStart=/usr/local/bin/containerd

Type=notify
Delegate=yes
KillMode=process
Restart=always
RestartSec=5
# Having non-zero Limit*s causes performance problems due to accounting overhead
# in the kernel. We recommend using cgroups to do container-local accounting.
LimitNPROC=infinity
LimitCORE=infinity
LimitNOFILE=infinity
# Comment TasksMax if your systemd version does not supports it.
# Only systemd 226 and above support this version.
TasksMax=infinity
OOMScoreAdjust=-999

[Install]
WantedBy=multi-user.target

编辑配置⽂件、

containerd 2.1 以下版本

~# mkdir /etc/containerd
~# containerd config default > /etc/containerd/config.toml
## 配置加速
~# vim /etc/containerd/config.toml 
...
    sandbox_image = "registry.aliyuncs.com/google_containers/pause:3.9" # 67
...
      [plugins."io.containerd.grpc.v1.cri".registry.mirrors] # 170
        [plugins."io.containerd.grpc.v1.cri".registry.mirrors."docker.io"] # 171
          endpoint = ["https://b73cdez5.mirror.aliyuncs.com"]  # 172

## 启动服务
# systemctl enable --now containerd.service
# systemctl is-active containerd.service 
active
# ll /run/containerd/containerd.sock
srw-rw---- 1 root root 0 May  3 21:12 /run/containerd/containerd.sock=

注意高版本会报警告

WARN[0000] DEPRECATION: The `mirrors` property of `[plugins."io.containerd.grpc.v1.cri".registry]` is deprecated since containerd v1.5 and will be removed in containerd v2.1. Use `config_path` instead.

containerd 2.1 以上版本

## 配置加速
~# vim /etc/containerd/config.toml 
...
    sandbox_image = "registry.aliyuncs.com/google_containers/pause:3.9" # 67
...
    [plugins."io.containerd.grpc.v1.cri".registry] #161
      config_path = "/etc/containerd/certs.d"      #162

~# mkdir -p /etc/containerd/certs.d/docker.io/
cat>/etc/containerd/certs.d/docker.io/hosts.toml<<EOF
server = "https://docker.io"

[host."https://docker.m.daocloud.io"]
  capabilities = ["pull", "resolve"]
[host."https://dockerproxy.com/"]
  capabilities = ["pull", "resolve"]
[host."https://b73cdez5.mirror.aliyuncs.com"]
  capabilities = ["pull", "resolve"]
EOF

## 重启
~# systemctl restart containerd.service
~# systemctl is-active containerd.service 
active

部署runc

~/usr/local/src# wget https://github.com/opencontainers/runc/releases/download/v1.2.6/runc.amd64
~/usr/local/src# chmod a+x runc.amd64 
~/usr/local/src# mv runc.amd64 /usr/bin/runc

下载测试镜像并验证

~# ctr images pull registry.cn-zhangjiakou.aliyuncs.com/tanghao429/tanghao:demoapp.v1.0
~# ctr run -t --net-host registry.cn-zhangjiakou.aliyuncs.com/tanghao429/tanghao:demoapp.v1.0 test-container sh
[root@pg-4 /]# ls
bin    dev    etc    home   lib    media  mnt    opt    proc   root   run    sbin   srv    sys    tmp    usr    var

3）nerdctl 推荐使用管理 containerd

前提条件：已经安装好了 containerd

安装nerdctl

nerdctl仓库：https://github.com/containerd/nerdctl

~# wget https://github.com/containerd/nerdctl/releases/download/v2.0.5/nerdctl-2.0.5-linux-amd64.tar.gz
~# tar xf nerdctl-2.0.5-linux-amd64.tar.gz -C /usr/local/bin/
~# nerdctl version
# 后面解决这个告警
WARN[0000] unable to determine buildctl version          error="exec: \"buildctl\": executable file not found in $PATH"
Client:
 Version:	v2.0.5
 OS/Arch:	linux/amd64
 Git commit:	fb3b8c1b15ea92c588d5afe549361914703a6504
 buildctl:
  Version:	

Server:
 containerd:
  Version:	v1.7.26
  GitCommit:	753481ec61c7c8955a23d6ff7bc8e4daed455734
 runc:
  Version:	1.2.6
  GitCommit:	v1.2.6-0-ge89a2992

nerdctl bash自动补全

~ # apt install bash-completion
~ # nerdctl completion bash > /etc/bash_completion.d/nerdctl
~ # source /etc/bash_completion.d/nerdctl
# 写入.bashrc文件
~ # echo "source /etc/bash_completion.d/nerdctl" >> ~/.bashrc
~ # echo "source /usr/share/bash-completion/bash_completion" >> ~/.bashrc

nerdctl配置⽂件

~# mkdir /etc/nerdctl/
~# vim /etc/nerdctl/nerdctl.toml
namespace = "k8s.io"
debug = false
debug_full = false
insecure_registry = true

安装CNI

CNI仓库： https://github.com/containernetworking/plugins

~# wget https://github.com/containernetworking/plugins/releases/download/v1.7.1/cni-plugins-linux-amd64-v1.7.1.tgz
~# mkdir /opt/cni/bin -p #保存cni插件的路径
~# tar xvf cni-plugins-linux-amd64-v1.7.1.tgz -C /opt/cni/bin/

创建测试容器并指定端⼝

~# nerdctl run -d -p 80:80 --name=test-web --restart=always registry.cn-zhangjiakou.aliyuncs.com/tanghao429/tanghao:demoapp.v1.0
# nerdctl ps
CONTAINER ID    IMAGE                                                                   COMMAND                   CREATED           STATUS    PORTS                 NAMES
f2daf40f6773    registry.cn-zhangjiakou.aliyuncs.com/tanghao429/tanghao:demoapp.v1.0    "/bin/sh -c python3 …"    10 seconds ago    Up        0.0.0.0:80->80/tcp    test-web
                                                         COMMAND                   CREATED           STATUS    PORTS                   NAMES
## 验证
~# curl 127.0.1
iKubernetes demoapp v1.0 !! ClientIP: 10.4.0.1, ServerName: f2daf40f6773, ServerIP: 10.4.0.3!

镜像构建 (解决上面 nerdctl version 告警)

buildkit仓库：https://github.com/moby/buildkit

~# wget https://github.com/moby/buildkit/releases/download/v0.21.1/buildkit-v0.21.1.linux-amd64.tar.gz
~# mkdir /usr/local/buildkit && tar -zxvf buildkit-v0.21.1.linux-amd64.tar.gz -C /usr/local/buildkit/
~# ln -s /usr/local/buildkit/bin/buildctl /usr/local/bin/
~# ln -s /usr/local/buildkit/bin/buildkitd /usr/local/bin/
## 用Systemd来管理buildkitd
~# cat >> /etc/systemd/system/buildkit.service <<EOF
[Unit]
Description=BuildKit
Documentation=https://github.com/moby/buildkit

[Service]
ExecStart=/usr/local/bin/buildkitd --oci-worker=false --containerd-worker=true

[Install]
WantedBy=multi-user.target
EOF
~# systemctl daemon-reload
~# systemctl enable --now buildkit.service 
~# systemctl is-active buildkit.service 
active
## 验证 是否解决的 告警
~#  nerdctl version
Client:
 Version:	v2.0.5
 OS/Arch:	linux/amd64
 Git commit:	fb3b8c1b15ea92c588d5afe549361914703a6504
 buildctl:
  Version:	v0.21.1
  GitCommit:	66735c67040bc80e6ed104f451683e094030a4e1

Server:
 containerd:
  Version:	v1.7.26
  GitCommit:	753481ec61c7c8955a23d6ff7bc8e4daed455734
 runc:
  Version:	1.2.6
  GitCommit:	v1.2.6-0-ge89a2992

从Dockerfile构建镜像

~# mkdir test-build
~# cd test-build/
~/test-build# cat > Dockerfile <<EOF
FROM registry.cn-zhangjiakou.aliyuncs.com/public-th/nginx:latest
RUN echo -e "Hello Nerdctl From Containerd" > /usr/share/nginx/html/index.html
EOF
## 打镜像
~/test-build# nerdctl build -t nginx:nerdctl .
~/test-build# nerdctl run -d -p 10080:80 --name=nginx --restart=always nginx:nerdctl

~/test-build# curl 127.1:10080
-e Hello Nerdctl From Containerd

兼容 docker compose

~# cat docker-compose.yml
version: "3.7"
services:
  nginx-test:
    container_name: "nginx-test"
    image: nginx:nerdctl
    restart: always
    networks:
    - test_net
    ports:
    - 20080:80

networks:
  test_net:
    name: test_net
    driver: bridge
    ipam:
      config:
      - subnet: "172.100.0.0/16"
~# nerdctl compose up -d
# curl 127.1:20080
-e Hello Nerdctl From Containerd