经验首页 前端设计 程序设计 Java相关 移动开发 数据库/运维 软件/图像 大数据/云计算 其他经验
当前位置：技术经验 » 数据库/运维 » Linux/Shell » 查看文章
Ubuntu2204部署容器引擎Containerd - Linux-1874
来源：cnblogs　　作者：Linux-1874　　时间：2023/4/10 8:46:56　　对本文有异议

　　为什么使用containerd？

　　使用containerd的原因主要有两点吧，第一个是docker在k8s1.24以后不再支持，如果需要在k8s中继续使用docker作为容器引擎，我们需要额外部署cri-dockerd；其次即便我们部署cri-dockerd，docker最后也是调用containerd；所以为了减少调用提高性能，我们直接使用containerd是最优选择；

　　提示：containerd1.0作为k8s容器引擎时它需要额外的一个cri-containerd的插件来实现kubelet和containerd交互，工作逻辑和dockers类似，但比docker要少调用一层；使用docker作为容器引擎，kubelet和containerd交互需要先和dockershim交互，然后对应dockershim再将对应消息传递给docker，然后由docker和containerd交互；很显然使用docker作为容器引擎，调用复杂且性能不高；

　　提示：containerd1.1以后，对应cri-containerd插件直接内置在containerd中，并默认处于启用状态；与cri-containerd不同，cri插件通过直接函数调用与containerd交互。这种方式使得kubelet和containerd交互更加稳定和高效，中间不再需要专门的cri-containerd插件来传递消息；

　　安装containerd的方式通常有两种，一种是apt/yum安装，一种是二进制安装

　　apt安装containerd

　　验证仓库版本

  1. root@k8s-node02:~# apt-cache madison containerd
  2. containerd | 1.6.12-0ubuntu1~22.04.1 | http://mirrors.aliyun.com/ubuntu jammy-updates/main amd64 Packages
  3. containerd | 1.5.9-0ubuntu3.1 | http://mirrors.aliyun.com/ubuntu jammy-security/main amd64 Packages
  4. containerd | 1.5.9-0ubuntu3 | http://mirrors.aliyun.com/ubuntu jammy/main amd64 Packages
  5. containerd | 1.5.9-0ubuntu3 | http://mirrors.aliyun.com/ubuntu jammy/main Sources
  6. containerd | 1.5.9-0ubuntu3.1 | http://mirrors.aliyun.com/ubuntu jammy-security/main Sources
  7. containerd | 1.6.12-0ubuntu1~22.04.1 | http://mirrors.aliyun.com/ubuntu jammy-updates/main Sources
  8. root@k8s-node02:~#

　　安装containerd

  1. root@k8s-node02:~# apt install containerd=1.6.12-0ubuntu1~22.04.1
  2. Reading package lists... Done
  3. Building dependency tree... Done
  4. Reading state information... Done
  5. The following additional packages will be installed:
  6.   runc
  7. The following NEW packages will be installed:
  8.   containerd runc
  9. 0 upgraded, 2 newly installed, 0 to remove and 51 not upgraded.
  10. Need to get 38.6 MB of archives.
  11. After this operation, 145 MB of additional disk space will be used.
  12. Do you want to continue? [Y/n] y

　　查看service?件

  1. root@k8s-node02:~# cat /usr/lib/systemd/system/containerd.service 
  2. # Copyright The containerd Authors.
  3. #
  4. # Licensed under the Apache License, Version 2.0 (the "License");
  5. # you may not use this file except in compliance with the License.
  6. # You may obtain a copy of the License at
  7. #
  8. #     http://www.apache.org/licenses/LICENSE-2.0
  9. #
  10. # Unless required by applicable law or agreed to in writing, software
  11. # distributed under the License is distributed on an "AS IS" BASIS,
  12. # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13. # See the License for the specific language governing permissions and
  14. # limitations under the License.
  15.  
  16. [Unit]
  17. Description=containerd container runtime
  18. Documentation=https://containerd.io
  19. After=network.target local-fs.target
  20.  
  21. [Service]
  22. ExecStartPre=-/sbin/modprobe overlay
  23. ExecStart=/usr/bin/containerd
  24.  
  25. Type=notify
  26. Delegate=yes
  27. KillMode=process
  28. Restart=always
  29. RestartSec=5
  30. # Having non-zero Limit*s causes performance problems due to accounting overhead
  31. # in the kernel. We recommend using cgroups to do container-local accounting.
  32. LimitNPROC=infinity
  33. LimitCORE=infinity
  34. LimitNOFILE=infinity
  35. # Comment TasksMax if your systemd version does not supports it.
  36. # Only systemd 226 and above support this version.
  37. TasksMax=infinity
  38. OOMScoreAdjust=-999
  39.  
  40. [Install]
  41. WantedBy=multi-user.target
  42. root@k8s-node02:~#

　　验证runc和containerd环境

  1. root@k8s-node02:~# runc -v
  2. runc version 1.1.4-0ubuntu1~22.04.1
  3. spec: 1.0.2-dev
  4. go: go1.18.1
  5. libseccomp: 2.5.3
  6. root@k8s-node02:~# containerd -v
  7. containerd github.com/containerd/containerd 1.6.12-0ubuntu1~22.04.1 
  8. root@k8s-node02:~#

　　生成containerd配置?件

  1. root@k8s-node02:~# containerd --help |grep config
  2. by using this command. If none of the *config*, *publish*, or *help* commands
  3. A default configuration is used if no TOML configuration is specified or located
  4. at the default file location. The *containerd config* command can be used to
  5. generate the default configuration for containerd. The output of that command
  6. can be used and modified as necessary as a custom configuration.
  7.    config    information on the containerd config
  8.    --config value, -c value     path to the configuration file (default: "/etc/containerd/config.toml")
  9. root@k8s-node02:~# mkdir -p /etc/containerd/
  10. root@k8s-node02:~# containerd config default > /etc/containerd/config.toml
  11. root@k8s-node02:~# ll /etc/containerd/config.toml
  12. -rw-r--r-- 1 root root 6994 Apr  9 13:36 /etc/containerd/config.toml
  13. root@k8s-node02:~#

　　启动containerd

  1. root@k8s-node02:~# systemctl start containerd
  2. root@k8s-node02:~# systemctl status containerd
  3. ● containerd.service - containerd container runtime
  4.      Loaded: loaded (/lib/systemd/system/containerd.service; enabled; vendor preset: enabled)
  5.      Active: active (running) since Sun 2023-04-09 13:32:10 UTC; 5min ago
  6.        Docs: https://containerd.io
  7.     Process: 1073 ExecStartPre=/sbin/modprobe overlay (code=exited, status=0/SUCCESS)
  8.    Main PID: 1075 (containerd)
  9.       Tasks: 10
  10.      Memory: 13.7M
  11.         CPU: 2.766s
  12.      CGroup: /system.slice/containerd.service
  13.              └─1075 /usr/bin/containerd
  14.  
  15. Apr 09 13:32:10 k8s-node02.ik8s.cc containerd[1075]: time="2023-04-09T13:32:10.638730092Z" level=info msg=serving... address=/run/containerd/containerd.sock.ttrpc
  16. Apr 09 13:32:10 k8s-node02.ik8s.cc containerd[1075]: time="2023-04-09T13:32:10.638832460Z" level=info msg=serving... address=/run/containerd/containerd.sock
  17. Apr 09 13:32:10 k8s-node02.ik8s.cc containerd[1075]: time="2023-04-09T13:32:10.638982310Z" level=info msg="containerd successfully booted in 0.020303s"
  18. Apr 09 13:32:10 k8s-node02.ik8s.cc systemd[1]: Started containerd container runtime.
  19. Apr 09 13:32:10 k8s-node02.ik8s.cc containerd[1075]: time="2023-04-09T13:32:10.639510934Z" level=info msg="Start subscribing containerd event"
  20. Apr 09 13:32:10 k8s-node02.ik8s.cc containerd[1075]: time="2023-04-09T13:32:10.639631535Z" level=info msg="Start recovering state"
  21. Apr 09 13:32:10 k8s-node02.ik8s.cc containerd[1075]: time="2023-04-09T13:32:10.639738452Z" level=info msg="Start event monitor"
  22. Apr 09 13:32:10 k8s-node02.ik8s.cc containerd[1075]: time="2023-04-09T13:32:10.639821525Z" level=info msg="Start snapshots syncer"
  23. Apr 09 13:32:10 k8s-node02.ik8s.cc containerd[1075]: time="2023-04-09T13:32:10.639936969Z" level=info msg="Start cni network conf syncer for default"
  24. Apr 09 13:32:10 k8s-node02.ik8s.cc containerd[1075]: time="2023-04-09T13:32:10.640051290Z" level=info msg="Start streaming server"
  25. root@k8s-node02:~#

　　通过命令行测试下载镜像

　　containerd的命令?客户端有ctr、crictl、nerdctl等，containerd相?docker多了?个命名空间的逻辑概念，?身的命令?客户端ctr命令默认是在default命名空间?、nerdctl也是在default，当使?crictl命令的时候，是在k8s.io这个命名空间，?k8s的创建的pod也是在k8s.io命名空间，因此在使?nerdctl管理kubernetes环境的pod的时候要指定命名空间为k8s.io，否则看不到kubernetes环境中的pod；

　　验证镜像

  1. root@k8s-node02:~# ctr images ls
  2. REF                             TYPE                                                      DIGEST                                                                  SIZE    PLATFORMS                                                                                LABELS 
  3. docker.io/library/alpine:latest application/vnd.docker.distribution.manifest.list.v2+json sha256:124c7d2707904eea7431fffe91522a01e5a861a624ee31d03372cc1d138a3126 3.2 MiB linux/386,linux/amd64,linux/arm/v6,linux/arm/v7,linux/arm64/v8,linux/ppc64le,linux/s390x -      
  4. root@k8s-node02:~#

　　ctr客户端创建测试容器

  1. root@k8s-node02:~# ctr run -t --net-host docker.io/library/alpine:latest testcontainer sh
  2. / # ifconfig
  3. ens33     Link encap:Ethernet  HWaddr 00:0C:29:73:67:C2  
  4.           inet addr:192.168.0.75  Bcast:192.168.0.255  Mask:255.255.255.0
  5.           inet6 addr: fe80::20c:29ff:fe73:67c2/64 Scope:Link
  6.           UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
  7.           RX packets:33342 errors:0 dropped:48 overruns:0 frame:0
  8.           TX packets:22887 errors:0 dropped:0 overruns:0 carrier:0
  9.           collisions:0 txqueuelen:1000 
  10.           RX bytes:44009320 (41.9 MiB)  TX bytes:1665243 (1.5 MiB)
  11.  
  12. lo        Link encap:Local Loopback  
  13.           inet addr:127.0.0.1  Mask:255.0.0.0
  14.           inet6 addr: ::1/128 Scope:Host
  15.           UP LOOPBACK RUNNING  MTU:65536  Metric:1
  16.           RX packets:42 errors:0 dropped:0 overruns:0 frame:0
  17.           TX packets:42 errors:0 dropped:0 overruns:0 carrier:0
  18.           collisions:0 txqueuelen:1000 
  19.           RX bytes:4562 (4.4 KiB)  TX bytes:4562 (4.4 KiB)
  20.  
  21. / # ^C
  22. / # exit
  23. root@k8s-node02:~# ctr containers ls
  24. CONTAINER        IMAGE                              RUNTIME                  
  25. testcontainer    docker.io/library/alpine:latest    io.containerd.runc.v2    
  26. root@k8s-node02:~#

　　?进制安装containerd

　　下载二进制包

  1. root@k8s-node03:~# wget https://github.com/containerd/containerd/releases/download/v1.6.20/containerd-1.6.20-linux-amd64.tar.gz

　　解压二进制包

  1. root@k8s-node03:~# ls
  2. containerd-1.6.20-linux-amd64.tar.gz
  3. root@k8s-node03:~# tar xf containerd-1.6.20-linux-amd64.tar.gz 
  4. root@k8s-node03:~# ls
  5. bin  containerd-1.6.20-linux-amd64.tar.gz
  6. root@k8s-node03:~#

　　复制二进制文件至用户环境变量目录

  1. root@k8s-node03:~# ls
  2. bin  containerd-1.6.20-linux-amd64.tar.gz
  3. root@k8s-node03:~# ls bin
  4. containerd       containerd-shim-runc-v1  containerd-stress
  5. containerd-shim  containerd-shim-runc-v2  ctr
  6. root@k8s-node03:~# cp bin/* /usr/local/bin/
  7. root@k8s-node03:~#

　　验证containerd版本信息

  1. root@k8s-node03:~# containerd -v
  2. containerd github.com/containerd/containerd v1.6.20 2806fc1057397dbaeefbea0e4e17bddfbd388f38
  3. root@k8s-node03:~#

　　准备service文件

  1. root@k8s-node03:~# cat /usr/lib/systemd/system/containerd.service
  2. [Unit]
  3. Description=containerd container runtime
  4. Documentation=https://containerd.io
  5. After=network.target local-fs.target
  6.  
  7. [Service]
  8. ExecStartPre=-/sbin/modprobe overlay
  9. ExecStart=/usr/local/bin/containerd
  10.  
  11. Type=notify
  12. Delegate=yes
  13. KillMode=process
  14. Restart=always
  15. RestartSec=5
  16. # Having non-zero Limit*s causes performance problems due to accounting overhead
  17. # in the kernel. We recommend using cgroups to do container-local accounting.
  18. LimitNPROC=infinity
  19. LimitCORE=infinity
  20. LimitNOFILE=infinity
  21. # Comment TasksMax if your systemd version does not supports it.
  22. # Only systemd 226 and above support this version.
  23. TasksMax=infinity
  24. OOMScoreAdjust=-999
  25.  
  26. [Install]
  27. WantedBy=multi-user.target
  28. root@k8s-node03:~#

　　提示：注意containerd的目录；

　　生成配置文件

  1. root@k8s-node03:~# mkdir -p /etc/containerd/
  2. root@k8s-node03:~# containerd config default > /etc/containerd/config.toml
  3. root@k8s-node03:~# ll /etc/containerd/config.toml
  4. -rw-r--r-- 1 root root 6994 Apr  9 14:08 /etc/containerd/config.toml
  5. root@k8s-node03:~#

　　提示：containerd的配置文件默认是/etc/containerd/config.toml；我们可以通过containerd --help|grep config命令得到该信息；

　　编辑配置文件配置底层pause镜像地址

　　提示：默认pause镜像地址是registry.k8s.io/pause:3.6，该仓库在google，一般需要借助科学上问工具才能正常访问，所以这里我们换成国内的镜像地址；

　　配置镜像加速器

　　启动containerd并设置为开机启动

  1. root@k8s-node03:~# systemctl start containerd && systemctl enable containerd
  2. Created symlink /etc/systemd/system/multi-user.target.wants/containerd.service → /lib/systemd/system/containerd.service.
  3. root@k8s-node03:~# systemctl status containerd
  4. ● containerd.service - containerd container runtime
  5.      Loaded: loaded (/lib/systemd/system/containerd.service; enabled; vendor preset: enabled)
  6.      Active: active (running) since Sun 2023-04-09 14:27:39 UTC; 58s ago
  7.        Docs: https://containerd.io
  8.    Main PID: 34424 (containerd)
  9.       Tasks: 10
  10.      Memory: 13.1M
  11.         CPU: 551ms
  12.      CGroup: /system.slice/containerd.service
  13.              └─34424 /usr/local/bin/containerd
  14.  
  15. Apr 09 14:27:39 k8s-node03.ik8s.cc containerd[34424]: time="2023-04-09T14:27:39.401494614Z" level=info msg="Start subscribing containerd event"
  16. Apr 09 14:27:39 k8s-node03.ik8s.cc containerd[34424]: time="2023-04-09T14:27:39.401622138Z" level=info msg="Start recovering state"
  17. Apr 09 14:27:39 k8s-node03.ik8s.cc containerd[34424]: time="2023-04-09T14:27:39.401749630Z" level=info msg="Start event monitor"
  18. Apr 09 14:27:39 k8s-node03.ik8s.cc containerd[34424]: time="2023-04-09T14:27:39.401832242Z" level=info msg="Start snapshots syncer"
  19. Apr 09 14:27:39 k8s-node03.ik8s.cc containerd[34424]: time="2023-04-09T14:27:39.401909113Z" level=info msg="Start cni network conf syncer for default"
  20. Apr 09 14:27:39 k8s-node03.ik8s.cc containerd[34424]: time="2023-04-09T14:27:39.401984359Z" level=info msg="Start streaming server"
  21. Apr 09 14:27:39 k8s-node03.ik8s.cc containerd[34424]: time="2023-04-09T14:27:39.402288194Z" level=info msg=serving... address=/run/containerd/containerd.sock.ttrpc
  22. Apr 09 14:27:39 k8s-node03.ik8s.cc containerd[34424]: time="2023-04-09T14:27:39.402424377Z" level=info msg=serving... address=/run/containerd/containerd.sock
  23. Apr 09 14:27:39 k8s-node03.ik8s.cc systemd[1]: Started containerd container runtime.
  24. Apr 09 14:27:39 k8s-node03.ik8s.cc containerd[34424]: time="2023-04-09T14:27:39.403282275Z" level=info msg="containerd successfully booted in 0.032541s"
  25. root@k8s-node03:~#

　　部署runc

  1. root@k8s-node03:~# wget https://github.com/opencontainers/runc/releases/download/v1.1.5/runc.amd64

　　给二进制文件添加执行权限，并将其移动至/usr/bin/目录并改名为runc

  1. root@k8s-node03:~# ll
  2. total 52332
  3. drwx------  5 root root     4096 Apr  9 14:35 ./
  4. drwxr-xr-x 19 root root     4096 Apr  9 03:29 ../
  5. -rw-------  1 root root     1363 Apr  9 06:09 .bash_history
  6. -rw-r--r--  1 root root     3106 Oct 15  2021 .bashrc
  7. drwx------  3 root root     4096 Apr  9 03:38 .cache/
  8. -rw-r--r--  1 root root      161 Jul  9  2019 .profile
  9. drwx------  2 root root     4096 Apr  9 05:46 .ssh/
  10. -rw-------  1 root root    12827 Apr  9 14:27 .viminfo
  11. drwxr-xr-x  2 root root     4096 Mar 30 20:51 bin/
  12. -rw-r--r--  1 root root 44102774 Apr  9 13:58 containerd-1.6.20-linux-amd64.tar.gz
  13. -rw-r--r--  1 root root  9431456 Apr  9 12:29 runc.amd64
  14. root@k8s-node03:~# chmod a+x runc.amd64 
  15. root@k8s-node03:~# mv runc.amd64 /usr/bin/runc
  16. root@k8s-node03:~#

　　下载测试镜像并验证

  1. root@k8s-node03:~# ctr images pull docker.io/library/alpine:latest
  2. docker.io/library/alpine:latest:                                                  resolved       |++++++++++++++++++++++++++++++++++++++| 
  3. index-sha256:124c7d2707904eea7431fffe91522a01e5a861a624ee31d03372cc1d138a3126:    done           |++++++++++++++++++++++++++++++++++++++| 
  4. manifest-sha256:b6ca290b6b4cdcca5b3db3ffa338ee0285c11744b4a6abaa9627746ee3291d8d: done           |++++++++++++++++++++++++++++++++++++++| 
  5. layer-sha256:f56be85fc22e46face30e2c3de3f7fe7c15f8fd7c4e5add29d7f64b87abdaa09:    done           |++++++++++++++++++++++++++++++++++++++| 
  6. config-sha256:9ed4aefc74f6792b5a804d1d146fe4b4a2299147b0f50eaf2b08435d7b38c27e:   done           |++++++++++++++++++++++++++++++++++++++| 
  7. elapsed: 11.3s                                                                    total:  2.0 Mi (181.5 KiB/s)                                     
  8. unpacking linux/amd64 sha256:124c7d2707904eea7431fffe91522a01e5a861a624ee31d03372cc1d138a3126...
  9. done: 121.740597ms
  10. root@k8s-node03:~# ctr images ls
  11. REF                             TYPE                                                      DIGEST                                                                  SIZE    PLATFORMS                                                                                LABELS 
  12. docker.io/library/alpine:latest application/vnd.docker.distribution.manifest.list.v2+json sha256:124c7d2707904eea7431fffe91522a01e5a861a624ee31d03372cc1d138a3126 3.2 MiB linux/386,linux/amd64,linux/arm/v6,linux/arm/v7,linux/arm64/v8,linux/ppc64le,linux/s390x -      
  13. root@k8s-node03:~#

　　ctr客户端创建测试容器

  1. root@k8s-node03:~# ctr run -t --net-host docker.io/library/alpine:latest test sh
  2. / # ifconfig
  3. ens33     Link encap:Ethernet  HWaddr 00:0C:29:EB:68:C7  
  4.           inet addr:192.168.0.76  Bcast:192.168.0.255  Mask:255.255.255.0
  5.           inet6 addr: fe80::20c:29ff:feeb:68c7/64 Scope:Link
  6.           UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
  7.           RX packets:150682 errors:0 dropped:98 overruns:0 frame:0
  8.           TX packets:47714 errors:0 dropped:0 overruns:0 carrier:0
  9.           collisions:0 txqueuelen:1000 
  10.           RX bytes:204871097 (195.3 MiB)  TX bytes:3518180 (3.3 MiB)
  11.  
  12. lo        Link encap:Local Loopback  
  13.           inet addr:127.0.0.1  Mask:255.0.0.0
  14.           inet6 addr: ::1/128 Scope:Host
  15.           UP LOOPBACK RUNNING  MTU:65536  Metric:1
  16.           RX packets:233 errors:0 dropped:0 overruns:0 frame:0
  17.           TX packets:233 errors:0 dropped:0 overruns:0 carrier:0
  18.           collisions:0 txqueuelen:1000 
  19.           RX bytes:20170 (19.6 KiB)  TX bytes:20170 (19.6 KiB)
  20.  
  21. / # exit
  22. root@k8s-node03:~# ctr containers ls
  23. CONTAINER    IMAGE                              RUNTIME                  
  24. test         docker.io/library/alpine:latest    io.containerd.runc.v2    
  25. root@k8s-node03:~#

　　提示：默认我们不指定名称空间对应容器都运行在default名称空间下；我们可以使用-n选项来指定对应名称空间信息；

　　containerd客户端?具扩展

　　crictl客户端工具部署
  1. root@k8s-node03:~# wget https://github.com/kubernetes-sigs/cri-tools/releases/download/v1.26.1/crictl-v1.26.1-linux-amd64.tar.gz

　　解压压缩包并将其移动至用户环境变量目录中去

  1. root@k8s-node03:~# ls
  2. bin  containerd-1.6.20-linux-amd64.tar.gz  crictl-v1.26.1-linux-amd64.tar.gz
  3. root@k8s-node03:~# tar xf crictl-v1.26.1-linux-amd64.tar.gz 
  4. root@k8s-node03:~# ls
  5. bin  containerd-1.6.20-linux-amd64.tar.gz  crictl  crictl-v1.26.1-linux-amd64.tar.gz
  6. root@k8s-node03:~# mv crictl /usr/local/bin/
  7. root@k8s-node03:~# ls /usr/local/bin/
  8. containerd  containerd-shim  containerd-shim-runc-v1  containerd-shim-runc-v2  containerd-stress  crictl  ctr
  9. root@k8s-node03:~#

　　验证crictl是否可正常运行？

  1. root@k8s-node03:~# crictl -v
  2. crictl version v1.26.1
  3. root@k8s-node03:~#

　　查看crictl默认配置文件路径

  1. root@k8s-node03:~# crictl --help |grep config
  2.    config              Get and set crictl client configuration options
  3.    --config value, -c value            Location of the client config file. If not specified and the default does not exist, the program's directory is searched as well (default: "/etc/crictl.yaml") [$CRI_CONFIG_FILE]
  4. root@k8s-node03:~#

　　查看containerd sock文件路径

  1. root@k8s-node03:~# cat /etc/containerd/config.toml |grep sock
  2.   address = "/run/containerd/containerd.sock"
  3. root@k8s-node03:~#

　　配置crictl运?时环境

  1. root@k8s-node03:~# cat /etc/crictl.yaml
  2. runtime-endpoint: "unix:///run/containerd/containerd.sock"
  3. image-endpoint: "unix:///run/containerd/containerd.sock"
  4. timeout: 10
  5. debug: false
  6. root@k8s-node03:~#

　　测试：下载并验证镜像

  1. root@k8s-node03:~# crictl pull nginx:1.20.2
  2. Image is up to date for sha256:50fe74b50e0d0258922495297efbb9ebc3cbd5742103df1ca54dc21c07d24575
  3. root@k8s-node03:~# crictl images
  4. IMAGE                     TAG                 IMAGE ID            SIZE
  5. docker.io/library/nginx   1.20.2              50fe74b50e0d0       56.7MB
  6. root@k8s-node03:~#

　　提示：该工具不是特别好用，用的人相对较少，也不推荐使用；

　　nerdctl客户端工具安装
  1. root@k8s-node03:~# wget https://github.com/containerd/nerdctl/releases/download/v1.3.0/nerdctl-1.3.0-linux-amd64.tar.gz

　　解压包至/usr/local/bin/

  1. root@k8s-node03:~# ls
  2. bin                                   crictl-v1.26.1-linux-amd64.tar.gz
  3. containerd-1.6.20-linux-amd64.tar.gz  nerdctl-1.3.0-linux-amd64.tar.gz
  4. root@k8s-node03:~# tar xf nerdctl-1.3.0-linux-amd64.tar.gz -C /usr/local/bin/
  5. root@k8s-node03:~# ll /usr/local/bin/nerdctl 
  6. -rwxr-xr-x 1 root root 24920064 Apr  5 12:22 /usr/local/bin/nerdctl*
  7. root@k8s-node03:~#

　　验证nerdctl是否可以正常执行？

  1. root@k8s-node03:~# nerdctl version 
  2. WARN[0000] unable to determine buildctl version: exec: "buildctl": executable file not found in $PATH 
  3. Client:
  4.  Version:       v1.3.0
  5.  OS/Arch:       linux/amd64
  6.  Git commit:    c6ddd63dea9aa438fdb0587c0d3d9ae61a60523e
  7.  buildctl:
  8.   Version:
  9.  
  10. Server:
  11.  containerd:
  12.   Version:      v1.6.20
  13.   GitCommit:    2806fc1057397dbaeefbea0e4e17bddfbd388f38
  14.  runc:
  15.   Version:      1.1.5
  16.   GitCommit:    v1.1.5-0-gf19387a6
  17. root@k8s-node03:~#

　　提示：nerdctl工具和crictl一样，默认不指定名称空间就是default名称空间；

　　为nerdctl提供一个配置文件来指定默认名称空间

  1. root@k8s-node03:~# cat /etc/nerdctl/nerdctl.toml
  2. namespace = "k8s.io"
  3. debug = false
  4. debug_full = false
  5. insecure_registry = true
  6. root@k8s-node03:~#

　　测试：不指定名称空间，看看对应配置是否生效？

  1. root@k8s-node03:~# nerdctl images
  2. REPOSITORY    TAG       IMAGE ID        CREATED           PLATFORM       SIZE         BLOB SIZE
  3. nginx         1.20.2    03f3cb0afb7b    12 minutes ago    linux/amd64    149.1 MiB    54.1 MiB
  4. nginx         <none>    03f3cb0afb7b    12 minutes ago    linux/amd64    149.1 MiB    54.1 MiB
  5. <none>        <none>    03f3cb0afb7b    12 minutes ago    linux/amd64    149.1 MiB    54.1 MiB
  6. root@k8s-node03:~#

　　提示：可以看到现在我们不指定名称空间，对应就是显示k8s.io名称空间下镜像；说明我们给的配置生效了；

　　查看containerd cni插件目录和nerdctl cni插件位置

　　安装CNI（Container networking interface）

  1. root@k8s-node03:~# wget https://github.com/containernetworking/plugins/releases/download/v1.2.0/cni-plugins-linux-amd64-v1.2.0.tgz

　　确认cni插件路径是否存在

  1. root@k8s-node03:~# ll /opt/cni/bin
  2. ls: cannot access '/opt/cni/bin': No such file or directory
  3. root@k8s-node03:~# mkdir -p /opt/cni/bin
  4. root@k8s-node03:~# ll /opt/cni/bin
  5. total 8
  6. drwxr-xr-x 2 root root 4096 Apr  9 15:16 ./
  7. drwxr-xr-x 3 root root 4096 Apr  9 15:16 ../
  8. root@k8s-node03:~#

　　解压二进制包至/opt/cni/bin/目录下

  1. root@k8s-node03:~# tar xf cni-plugins-linux-amd64-v1.2.0.tgz -C /opt/cni/bin/
  2. root@k8s-node03:~# ll /opt/cni/bin/
  3. total 68944
  4. drwxrwxr-x 2 root root     4096 Jan 16 21:42 ./
  5. drwxr-xr-x 3 root root     4096 Apr  9 15:16 ../
  6. -rwxr-xr-x 1 root root  3859475 Jan 16 21:42 bandwidth*
  7. -rwxr-xr-x 1 root root  4299004 Jan 16 21:42 bridge*
  8. -rwxr-xr-x 1 root root 10167415 Jan 16 21:42 dhcp*
  9. -rwxr-xr-x 1 root root  3986082 Jan 16 21:42 dummy*
  10. -rwxr-xr-x 1 root root  4385098 Jan 16 21:42 firewall*
  11. -rwxr-xr-x 1 root root  3870731 Jan 16 21:42 host-device*
  12. -rwxr-xr-x 1 root root  3287319 Jan 16 21:42 host-local*
  13. -rwxr-xr-x 1 root root  3999593 Jan 16 21:42 ipvlan*
  14. -rwxr-xr-x 1 root root  3353028 Jan 16 21:42 loopback*
  15. -rwxr-xr-x 1 root root  4029261 Jan 16 21:42 macvlan*
  16. -rwxr-xr-x 1 root root  3746163 Jan 16 21:42 portmap*
  17. -rwxr-xr-x 1 root root  4161070 Jan 16 21:42 ptp*
  18. -rwxr-xr-x 1 root root  3550152 Jan 16 21:42 sbr*
  19. -rwxr-xr-x 1 root root  2845685 Jan 16 21:42 static*
  20. -rwxr-xr-x 1 root root  3437180 Jan 16 21:42 tuning*
  21. -rwxr-xr-x 1 root root  3993252 Jan 16 21:42 vlan*
  22. -rwxr-xr-x 1 root root  3586502 Jan 16 21:42 vrf*
  23. root@k8s-node03:~#

　　提示：nerdctl在创建容器时，它依赖cni插件来给容器创建网络；

　　测试：创建Nginx测试容器并指定端口

  1. root@k8s-node03:~# nerdctl images
  2. REPOSITORY    TAG       IMAGE ID        CREATED              PLATFORM       SIZE         BLOB SIZE
  3. nginx         1.20.2    03f3cb0afb7b    About an hour ago    linux/amd64    149.1 MiB    54.1 MiB
  4. nginx         latest    2ab30d6ac535    50 minutes ago       linux/amd64    149.7 MiB    54.4 MiB
  5. nginx         <none>    03f3cb0afb7b    About an hour ago    linux/amd64    149.1 MiB    54.1 MiB
  6. <none>        <none>    2ab30d6ac535    50 minutes ago       linux/amd64    149.7 MiB    54.4 MiB
  7. <none>        <none>    03f3cb0afb7b    About an hour ago    linux/amd64    149.1 MiB    54.1 MiB
  8. root@k8s-node03:~# nerdctl run -d -p 80:80 nginx 
  9. FATA[0000] failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: error during container init: error running hook #0: error running hook: exit status 1, stdout: , stderr: time="2023-04-09T16:11:40Z" level=fatal msg="failed to call cni.Setup: plugin type=\"bridge\" failed (add): failed to locate iptables: exec: \"iptables\": executable file not found in $PATH"
  10. Failed to write to log, write /var/lib/nerdctl/1935db59/containers/k8s.io/bf9d980bbed0d28778a3e0f21ad380df1b712841b6887792ce1fa0f483bf9a7d/oci-hook.createRuntime.log: file already closed: unknown 
  11. root@k8s-node03:~# nerdctl ps -a
  12. CONTAINER ID    IMAGE                             COMMAND                   CREATED          STATUS     PORTS                 NAMES
  13. bf9d980bbed0    docker.io/library/nginx:latest    "/docker-entrypoint.…"    6 seconds ago    Created    0.0.0.0:80->80/tcp    nginx-bf9d9
  14. root@k8s-node03:~#

　　提示：这里容器虽然创建了没有运行，给我们报了一个错，意思就是在path环境变量中没有找到iptables，无法执行iptables命令；解决办法就是安装iptables工具（我这里是最小化安装的ubuntu2204的版本，好多命令都没有）；

　　安装iptables工具

  1. root@k8s-node03:~# apt-get install iptables -y

　　再次运行容器，看看对应容器是否能够正常运行？

  1. root@k8s-node03:~# nerdctl run -d -p 80:80 nginx 
  2. f3c40d58c1b98e90ef37da97b7fa6f5b8e9f44e7e40ba973678d53fef79b723f
  3. root@k8s-node03:~# nerdctl ps -a                 
  4. CONTAINER ID    IMAGE                             COMMAND                   CREATED           STATUS     PORTS                 NAMES
  5. bf9d980bbed0    docker.io/library/nginx:latest    "/docker-entrypoint.…"    57 seconds ago    Created    0.0.0.0:80->80/tcp    nginx-bf9d9
  6. f3c40d58c1b9    docker.io/library/nginx:latest    "/docker-entrypoint.…"    3 seconds ago     Up         0.0.0.0:80->80/tcp    nginx-f3c40
  7. root@k8s-node03:~#

　　提示：安装了iptables工具以后，再次运行容器，对应容器就跑起来了；

　　验证：访问对应niginx是否可以正常访问？

　　提示：可以看到nginx可以正常暴露给容器外部网络访问；

　　ok，基于ubuntu2204部署containerd和客户端工具的测试就到此为止；推荐使用nerdctl客户端工具，这个工具的命令和docker非常相似，熟悉docker命令的使用，nerdctl也就不难使用了；

原文链接：https://www.cnblogs.com/qiuhom-1874/p/17301455.html

 友情链接：直通硅谷 　点职佳 　北美留学生论坛

Linux/Shell热门文章

  • vdbench 数据校验测试方法
  • CentOS7一键脚本安装WireGuard
  • VMware Ubuntu 20.04 LTS 使用Qemu虚拟机u-boot启动或者配合busybox模拟ARM开发板
  • Activation of org.freedesktop.systemd1 timed out
  • vmWare 虚机文件不能启动的事故处理
  • windows远程连接centos及闪退异常解决记录
  • CentOS7防火墙放行或限制指定IP和端口（firewall）
  • jvm：jmap无法dump文件的解决办法
  • C# 控制 GPIO
  • linux中文件权限的字母含义

    • Linux/Shell推荐文章

  • 旧物利用 - 将机顶盒改造为一台Linux开发机！
  • condition字符串匹配问题
  • proxmox ve 部署双节点HA集群及glusterfs分布式文件系统
  • 入门到精通rsync和inotify
  • 解决 CentOS 7 官方 yum 仓库无法使用的最佳实践
  • Linux 提权-NFS 共享
  • 将虚拟机跑在ceph之中
  • saltStack自动化工具
  • SeaweedFS + TiKV 部署保姆级教程
  • GlusterFs分布式文件系统

    • 本站QQ群：前端 618073944 | Java 606181507 | Python 626812652 | C/C++ 612253063 | 微信 634508462 | 苹果 692586424 | C#/.net 182808419 | PHP 305140648 | 运维 608723728

    W3xue 的所有内容仅供测试，对任何法律问题及风险不承担任何责任。通过使用本站内容随之而来的风险与本站无关。
    关于我们  |  意见建议  |  捐助我们  |  报错有奖  |  广告合作、友情链接（目前9元/月）请联系QQ：27243702 沸活量
    皖ICP备17017327号-2　皖公网安备34020702000426号