经验首页 前端设计 程序设计 Java相关 移动开发 数据库/运维 软件/图像 大数据/云计算 其他经验
当前位置：技术经验 » 数据库/运维 » Linux/Shell » 查看文章
基于nerdctl+buildkitd+containerd实现镜像构建 - Linux-1874
来源：cnblogs　　作者：Linux-1874　　时间：2023/6/2 10:52:04　　对本文有异议

1、容器技术简介

容器技术除了的docker之外，还有coreOS的rkt、google的gvisor、以及docker开源的containerd、redhat的podman、阿?的pouch等，为了保证容器?态的标准性和健康可持续发展，包括Linux 基?会、Docker、微软、红帽、?歌和IBM等公司在2015年6?共同成?了?个叫open container（OCI）的组织，其?的就是制定开放的标准的容器规范，?前OCI?共发布了两个规范，分别是runtime spec和image format spec，有了这两个规范，不同的容器公司开发的容器只要兼容这两个规范，就可以保证容器的可移植性和相互可操作性。
containerd官网：https://containerd.io/
gvisor官网：https://gvisor.dev/
podman官网：https://podman.io
pouch项目地址：https://github.com/alibaba/pouch
buildkit: 从Docker公司的开源出来的?个镜像构建?具包，?持OCI标准的镜像构建,项目地址https://github.com/moby/buildkit

2、buildkitd组成部分

buildkitd(服务端)，?前?持runc和containerd作为镜像构建环境，默认是runc，可以更换为containerd。
buildctl(客户端)，负责解析Dockerfile?件，并向服务端buildkitd发出构建请求。

3、部署buildkitd

3.1、下载二进制包

  1. wget https://github.com/moby/buildkit/releases/download/v0.11.6/buildkit-v0.11.6.linux-amd64.tar.gz

解压压缩包，将二进制文件软连接至path环境变量

  1. root@k8s-master01:/usr/local/src# ls
  2. buildkit-v0.11.6.linux-amd64.tar.gz
  3. root@k8s-master01:/usr/local/src# tar xf buildkit-v0.11.6.linux-amd64.tar.gz 
  4. root@k8s-master01:/usr/local/src# ls
  5. bin  buildkit-v0.11.6.linux-amd64.tar.gz
  6. root@k8s-master01:/usr/local/src# cd bin
  7. root@k8s-master01:/usr/local/src/bin# ls
  8. buildctl               buildkit-qemu-arm   buildkit-qemu-mips64    buildkit-qemu-ppc64le  buildkit-qemu-s390x  buildkitd
  9. buildkit-qemu-aarch64  buildkit-qemu-i386  buildkit-qemu-mips64el  buildkit-qemu-riscv64  buildkit-runc
  10. root@k8s-master01:/usr/local/src/bin# ln -s /usr/local/src/bin/* /usr/local/bin/
  11. root@k8s-master01:/usr/local/src/bin# buildctl --help
  12. NAME:
  13.    buildctl - build utility
  15. USAGE:
  16.    buildctl [global options] command [command options] [arguments...]
  18. VERSION:
  19.    v0.11.6
  21. COMMANDS:
  22.    du        disk usage
  23.    prune     clean up build cache
  24.    build, b  build
  25.    debug     debug utilities
  26.    help, h   Shows a list of commands or help for one command
  28. GLOBAL OPTIONS:
  29.    --debug                enable debug output in logs
  30.    --addr value           buildkitd address (default: "unix:///run/buildkit/buildkitd.sock")
  31.    --tlsservername value  buildkitd server name for certificate validation
  32.    --tlscacert value      CA certificate for validation
  33.    --tlscert value        client certificate
  34.    --tlskey value         client key
  35.    --tlsdir value         directory containing CA certificate, client certificate, and client key
  36.    --timeout value        timeout backend connection after value seconds (default: 5)
  37.    --help, -h             show help
  38.    --version, -v          print the version
  39. root@k8s-master01:/usr/local/src/bin#

能够正常在bash中执行buildkit --help ，表示对应命令已经正常软连接至path环境中。

3.2、提供buildkit.socket文件

  1. root@k8s-master01:/usr/local/src/bin# cat /lib/systemd/system/buildkit.socket
  2. [Unit]
  3. Description=BuildKit
  4. Documentation=https://github.com/moby/buildkit
  5. [Socket]
  6. ListenStream=%t/buildkit/buildkitd.sock
  7. [Install]
  8. WantedBy=sockets.target
  9. root@k8s-master01:/usr/local/src/bin#

3.3、提供buildkit.service文件

  1. root@k8s-master01:/usr/local/src/bin# cat /lib/systemd/system/buildkitd.service
  2. [Unit]
  3. Description=BuildKit
  4. Requires=buildkit.socket
  5. After=buildkit.socketDocumentation=https://github.com/moby/buildkit
  6. [Service]
  7. ExecStart=/usr/local/bin/buildkitd --oci-worker=false --containerd-worker=true
  8. [Install]
  9. WantedBy=multi-user.target
  10. root@k8s-master01:/usr/local/src/bin#

3.4、启动buildiktd服务

  1. root@k8s-master01:/usr/local/src/bin# systemctl daemon-reload
  2. root@k8s-master01:/usr/local/src/bin# systemctl enable buildkitd
  3. Created symlink /etc/systemd/system/multi-user.target.wants/buildkitd.service → /lib/systemd/system/buildkitd.service.
  4. root@k8s-master01:/usr/local/src/bin# systemctl restart buildkitd
  5. root@k8s-master01:/usr/local/src/bin# systemctl status buildkitd
  6. ● buildkitd.service - BuildKit
  7.      Loaded: loaded (/lib/systemd/system/buildkitd.service; enabled; vendor preset: enabled)
  8.      Active: active (running) since Wed 2023-05-31 13:32:38 UTC; 4s ago
  9.    Main PID: 12191 (buildkitd)
  10.       Tasks: 9 (limit: 4571)
  11.      Memory: 7.8M
  12.         CPU: 125ms
  13.      CGroup: /system.slice/buildkitd.service
  14.              └─12191 /usr/local/bin/buildkitd --oci-worker=false --containerd-worker=true
  16. May 31 13:32:38 k8s-master01.ik8s.cc systemd[1]: Started BuildKit.
  17. May 31 13:32:38 k8s-master01.ik8s.cc buildkitd[12191]: time="2023-05-31T13:32:38Z" level=warning msg="using host network as the default"
  18. May 31 13:32:38 k8s-master01.ik8s.cc buildkitd[12191]: time="2023-05-31T13:32:38Z" level=warning msg="git source cannot be enabled: failed to find git 
  19. binary: exec: \"git\": executable file not found in $PATH"
  20. May 31 13:32:38 k8s-master01.ik8s.cc buildkitd[12191]: time="2023-05-31T13:32:38Z" level=info msg="found worker \"kffvitvra0b27yi956wa4xcal\", labels=m
  21. ap[org.mobyproject.buildkit.worker.containerd.namespace:buildkit org.mobyproject.buildkit.worker.containerd.uuid:f27e8d21-8b1d-44ac-9233-f55b9b028fc0 o
  22. rg.mobyproject.buildkit.worker.executor:containerd org.mobyproject.buildkit.worker.hostname:k8s-master01.ik8s.cc org.mobyproject.buildkit.worker.networ
  23. k:host org.mobyproject.buildkit.worker.selinux.enabled:false org.mobyproject.buildkit.worker.snapshotter:overlayfs], platforms=[linux/amd64 linux/amd64
  24. /v2 linux/386]"
  25. May 31 13:32:38 k8s-master01.ik8s.cc buildkitd[12191]: time="2023-05-31T13:32:38Z" level=info msg="found 1 workers, default=\"kffvitvra0b27yi956wa4xcal
  26. \""
  27. May 31 13:32:38 k8s-master01.ik8s.cc buildkitd[12191]: time="2023-05-31T13:32:38Z" level=warning msg="currently, only the default worker can be used."
  28. May 31 13:32:38 k8s-master01.ik8s.cc buildkitd[12191]: time="2023-05-31T13:32:38Z" level=info msg="running server on /run/buildkit/buildkitd.sock"
  29. root@k8s-master01:/usr/local/src/bin#

4、基于nginx代理?签名证书harbor并实现https

4.1、将harbor修改为http协议

停止harbor服务

  1. root@harbor:/app/harbor# docker-compose down
  2. [+] Running 13/13
  3.  ? Container notary-server       Removed                                                                                                          0.8s 
  4.  ? Container nginx               Removed                                                                                                          1.7s 
  5.  ? Container harbor-jobservice   Removed                                                                                                          0.7s 
  6.  ? Container trivy-adapter       Removed                                                                                                          0.6s 
  7.  ? Container notary-signer       Removed                                                                                                          0.5s 
  8.  ? Container harbor-portal       Removed                                                                                                          0.3s 
  9.  ? Container harbor-core         Removed                                                                                                          3.5s 
  10.  ? Container harbor-db           Removed                                                                                                          0.7s 
  11.  ? Container registry            Removed                                                                                                          0.5s 
  12.  ? Container redis               Removed                                                                                                          0.5s 
  13.  ? Network harbor_notary-sig     Removed                                                                                                          0.8s 
  14.  ? Network harbor_harbor         Removed                                                                                                          0.2s 
  15.  ? Network harbor_harbor-notary  Removed                                                                                                          0.5s 
  16. root@harbor:/app/harbor#

修改harbor配置文件，注释https和证书的配置

重新prepare

  1. root@harbor:/app/harbor# ls
  2. LICENSE  common  common.sh  docker-compose.yml  harbor.v2.8.0.tar.gz  harbor.yml  harbor.yml.tmpl  install.sh  prepare
  3. root@harbor:/app/harbor# ./prepare 
  4. prepare base dir is set to /app/harbor
  5. WARNING:root:WARNING: HTTP protocol is insecure. Harbor will deprecate http protocol in the future. Please make sure to upgrade to https
  6. Clearing the configuration file: /config/db/env
  7. Clearing the configuration file: /config/registry/passwd
  8. Clearing the configuration file: /config/registry/config.yml
  9. Clearing the configuration file: /config/registry/root.crt
  10. Clearing the configuration file: /config/notary/notary-signer-ca.crt
  11. Clearing the configuration file: /config/notary/notary-signer.key
  12. Clearing the configuration file: /config/notary/server-config.postgres.json
  13. Clearing the configuration file: /config/notary/server_env
  14. Clearing the configuration file: /config/notary/notary-signer.crt
  15. Clearing the configuration file: /config/notary/signer_env
  16. Clearing the configuration file: /config/notary/signer-config.postgres.json
  17. Clearing the configuration file: /config/notary/root.crt
  18. Clearing the configuration file: /config/trivy-adapter/env
  19. Clearing the configuration file: /config/core/env
  20. Clearing the configuration file: /config/core/app.conf
  21. Clearing the configuration file: /config/jobservice/env
  22. Clearing the configuration file: /config/jobservice/config.yml
  23. Clearing the configuration file: /config/registryctl/env
  24. Clearing the configuration file: /config/registryctl/config.yml
  25. Clearing the configuration file: /config/nginx/conf.d/notary.upstream.conf
  26. Clearing the configuration file: /config/nginx/conf.d/notary.server.conf
  27. Clearing the configuration file: /config/nginx/nginx.conf
  28. Clearing the configuration file: /config/log/rsyslog_docker.conf
  29. Clearing the configuration file: /config/log/logrotate.conf
  30. Clearing the configuration file: /config/portal/nginx.conf
  31. Generated configuration file: /config/portal/nginx.conf
  32. Generated configuration file: /config/log/logrotate.conf
  33. Generated configuration file: /config/log/rsyslog_docker.conf
  34. Generated configuration file: /config/nginx/nginx.conf
  35. Generated configuration file: /config/core/env
  36. Generated configuration file: /config/core/app.conf
  37. Generated configuration file: /config/registry/config.yml
  38. Generated configuration file: /config/registryctl/env
  39. Generated configuration file: /config/registryctl/config.yml
  40. Generated configuration file: /config/db/env
  41. Generated configuration file: /config/jobservice/env
  42. Generated configuration file: /config/jobservice/config.yml
  43. loaded secret from file: /data/secret/keys/secretkey
  44. Generated configuration file: /compose_location/docker-compose.yml
  45. Clean up the input dir
  46. root@harbor:/app/harbor#

启动harbor

  1. root@harbor:/app/harbor# docker-compose up -d
  2. [+] Running 10/10
  3.  ? Network harbor_harbor        Created                                                                                                           0.2s 
  4.  ? Container harbor-log         Started                                                                                                           1.2s 
  5.  ? Container registry           Started                                                                                                           2.5s 
  6.  ? Container harbor-portal      Started                                                                                                           2.7s 
  7.  ? Container registryctl        Started                                                                                                           2.7s 
  8.  ? Container harbor-db          Started                                                                                                           2.7s 
  9.  ? Container redis              Started                                                                                                           2.6s 
  10.  ? Container harbor-core        Started                                                                                                           3.2s 
  11.  ? Container harbor-jobservice  Started                                                                                                           4.2s 
  12.  ? Container nginx              Started                                                                                                           4.3s 
  13. root@harbor:/app/harbor#

如果你给harbor添加的有service文件，也可以使用systemctl stop/start harbor来停止/启动harbor

验证harbor是否可以正常登录？

4.2、nginx实现harbor的反向代理

4.2.1、nginx安装及配置

  1. root@k8s-deploy:~# cd /usr/local/src/
  2. root@k8s-deploy:/usr/local/src# wget https://nginx.org/download/nginx-1.22.0.tar.gz
  3. --2023-05-31 13:59:55--  https://nginx.org/download/nginx-1.22.0.tar.gz
  4. Resolving nginx.org (nginx.org)... 52.58.199.22, 3.125.197.172, 2a05:d014:edb:5704::6, ...
  5. Connecting to nginx.org (nginx.org)|52.58.199.22|:443... connected.
  6. HTTP request sent, awaiting response... 200 OK
  7. Length: 1073322 (1.0M) [application/octet-stream]
  8. Saving to: ‘nginx-1.22.0.tar.gz’
  10. nginx-1.22.0.tar.gz                        100%[=======================================================================================>]   1.02M  37.8KB/s    in 27s     
  12. 2023-05-31 14:00:23 (38.9 KB/s) - ‘nginx-1.22.0.tar.gz’ saved [1073322/1073322]
  14. root@k8s-deploy:/usr/local/src# tar xf nginx-1.22.0.tar.gz 
  15. root@k8s-deploy:/usr/local/src# cd nginx-1.22.0
  16. root@k8s-deploy:/usr/local/src/nginx-1.22.0# ./configure --prefix=/apps/nginx > --with-http_ssl_module > --with-http_v2_module > --with-http_realip_module > --with-http_stub_status_module > --with-http_gzip_static_module > --with-pcre > --with-stream > --with-stream_ssl_module > --with-stream_realip_module

上述报错没有找到http模块依赖的PCRE库

解决办法：安装libpcre3 libpcre3-dev

  1. root@k8s-deploy:/usr/local/src/nginx-1.22.0# apt install libpcre3 libpcre3-dev -y

安装上述依赖后，重新configure

上述报错没有找到ssl模块依赖的openssl库

解决办法：安装openssl libssl-dev

  1. root@k8s-deploy:/usr/local/src/nginx-1.22.0# apt install openssl libssl-dev -y

执行上述./configure 没有报错，并且能够看到上述截图，表示编译环境通过检查，可以进行下一步编译和安装

编译安装nginx

  1. root@k8s-deploy:/usr/local/src/nginx-1.22.0# make && make install

创建证书?录，并生成私钥，证书

4.2.1.1、创建证书?录,并生成ca私钥

  1. root@k8s-deploy:/apps/nginx/sbin# mkdir /apps/nginx/certs
  2. root@k8s-deploy:/apps/nginx/sbin# cd /apps/nginx/certs
  3. root@k8s-deploy:/apps/nginx/certs# openssl genrsa -out ca.key 4096

4.2.1.2、用ca私钥生成ca自签名证书

  1. root@k8s-deploy:/apps/nginx/certs# openssl req -x509 -new -nodes -sha512 -days 3650 >  -subj "/C=CN/ST=Beijing/L=Beijing/O=Personal-CA/OU=Personal/CN=CA.com" >  -key ca.key >  -out ca.crt
  2. root@k8s-deploy:/apps/nginx/certs# ls
  3. ca.crt  ca.key
  4. root@k8s-deploy:/apps/nginx/certs#

4.2.1.3、生成harbor服务器私钥

  1. root@k8s-deploy:/apps/nginx/certs# openssl genrsa -out magedu.net.key 4096
  2. root@k8s-deploy:/apps/nginx/certs# ls
  3. ca.crt  ca.key  magedu.net.key
  4. root@k8s-deploy:/apps/nginx/certs#

4.2.1.4、用harbor服务器私钥生成生成证书签名请求csr文件

  1. root@k8s-deploy:/apps/nginx/certs# openssl req -sha512 -new >     -subj "/C=CN/ST=Beijing/L=Beijing/O=test/OU=Personal/CN=magedu.net" >     -key magedu.net.key >     -out magedu.net.csr
  2. root@k8s-deploy:/apps/nginx/certs# ls
  3. ca.crt  ca.key  magedu.net.csr  magedu.net.key
  4. root@k8s-deploy:/apps/nginx/certs#

4.2.1.5、使用ca证书和私钥为harbor服务器签发证书

  1. root@k8s-deploy:/apps/nginx/certs# openssl x509 -req -sha512 -days 3650 >     -CA ca.crt -CAkey ca.key -CAcreateserial >     -in magedu.net.csr >     -out magedu.net.crt
  2. Certificate request self-signature ok
  3. subject=C = CN, ST = Beijing, L = Beijing, O = test, OU = Personal, CN = magedu.net
  4. root@k8s-deploy:/apps/nginx/certs# ls
  5. ca.crt  ca.key  magedu.net.crt  magedu.net.csr  magedu.net.key
  6. root@k8s-deploy:/apps/nginx/certs#

编辑nginx配置文件，配置证书和反向代理harbor

  1. root@k8s-deploy:/apps/nginx/certs# cat /apps/nginx/conf/nginx.conf
  2. worker_processes  1;
  3. events {
  4.     worker_connections  1024;
  5. }
  6. http {
  7.     client_max_body_size 1000m;
  8.     server {
  9.         listen       80;
  10.         listen       443 ssl;
  11.         ssl_certificate /apps/nginx/certs/magedu.net.crt;
  12.         ssl_certificate_key /apps/nginx/certs/magedu.net.key;
  13.         ssl_session_cache shared:sslcache:20m;
  14.         ssl_session_timeout 10m;
  15.         location / {
  16.                 if ($scheme = http ){
  17.                         rewrite / https://harbor.magedu.net permanent;
  18.                 }
  20.                 proxy_pass http://192.168.0.42;
  21.         }
  22.     }
  23. }
  24. root@k8s-deploy:/apps/nginx/certs#

检查nginx配置文件语法

  1. root@k8s-deploy:/apps/nginx/certs# cd ..
  2. root@k8s-deploy:/apps/nginx# /apps/nginx/sbin/nginx -t
  3. nginx: the configuration file /apps/nginx/conf/nginx.conf syntax is ok
  4. nginx: configuration file /apps/nginx/conf/nginx.conf test is successful
  5. root@k8s-deploy:/apps/nginx#

启动nginx

  1. root@k8s-deploy:/apps/nginx# /apps/nginx/sbin/nginx
  2. root@k8s-deploy:/apps/nginx# ss -tnl
  3. State            Recv-Q            Send-Q                       Local Address:Port                       Peer Address:Port           Process           
  4. LISTEN           0                 511                                0.0.0.0:80                              0.0.0.0:*                                
  5. LISTEN           0                 4096                         127.0.0.53%lo:53                              0.0.0.0:*                                
  6. LISTEN           0                 128                                0.0.0.0:22                              0.0.0.0:*                                
  7. LISTEN           0                 511                                0.0.0.0:443                             0.0.0.0:*                                
  8. root@k8s-deploy:/apps/nginx#

4.2.2、浏览器访问测试nginx 看看是否反向代理给harbor？是否为https？

查看证书信息

4.2.3、buildkitd配置?件

  1. root@k8s-master01:/usr/local/src/bin# cat /etc/buildkit/buildkitd.toml
  2. [registry."harbor.magedu.net"]
  3.   http = true
  4.   insecure = true
  5. root@k8s-master01:

4.2.4、nerdctl配置?件

  1. root@k8s-master01:/usr/local/src/bin# cat /etc/nerdctl/nerdctl.toml 
  2. namespace = "k8s.io"
  3. debug = false
  4. debug_full = false
  5. insecure_registry = true
  6. root@k8s-master01:/usr/local/src/bin#

5、测试镜像构建

5.1、nerdctl常?命令

5.1.1 给nerdctl添加命令补全

  1. root@k8s-master01:~# echo "source <(nerdctl completion bash)" >> /etc/profile
  2. root@k8s-master01:~# cat /etc/profile
  3. # /etc/profile: system-wide .profile file for the Bourne shell (sh(1))
  4. # and Bourne compatible shells (bash(1), ksh(1), ash(1), ...).
  6. if [ "${PS1-}" ]; then
  7.   if [ "${BASH-}" ] && [ "$BASH" != "/bin/sh" ]; then
  8.     # The file bash.bashrc already sets the default PS1.
  9.     # PS1='\h:\w\$ '
  10.     if [ -f /etc/bash.bashrc ]; then
  11.       . /etc/bash.bashrc
  12.     fi
  13.   else
  14.     if [ "$(id -u)" -eq 0 ]; then
  15.       PS1='# '
  16.     else
  17.       PS1='$ '
  18.     fi
  19.   fi
  20. fi
  22. if [ -d /etc/profile.d ]; then
  23.   for i in /etc/profile.d/*.sh; do
  24.     if [ -r $i ]; then
  25.       . $i
  26.     fi
  27.   done
  28.   unset i
  29. fi
  30. source <(nerdctl completion bash)
  31. root@k8s-master01:~# source /etc/profile

5.1.2、登录harbor仓库

  1. root@k8s-master01:~# nerdctl login harbor.magedu.net                             
  2. Enter Username: admin
  3. Enter Password: 
  4. WARN[0005] skipping verifying HTTPS certs for "harbor.magedu.net" 
  5. WARNING: Your password will be stored unencrypted in /root/.docker/config.json.
  6. Configure a credential helper to remove this warning. See
  7. https://docs.docker.com/engine/reference/commandline/login/#credentials-store
  9. Login Succeeded
  10. root@k8s-master01:~# nerdctl login --insecure-registry https://harbor.magedu.net 
  11. WARN[0000] skipping verifying HTTPS certs for "harbor.magedu.net" 
  12. WARNING: Your password will be stored unencrypted in /root/.docker/config.json.
  13. Configure a credential helper to remove this warning. See
  14. https://docs.docker.com/engine/reference/commandline/login/#credentials-store
  16. Login Succeeded
  17. root@k8s-master01:~#

自签名证书一般通过--insecure-registry 选项来指定该仓库是一个不安全的仓库

5.2、自签名harbor证书分发

5.2.1、创建证书?录

  1. root@k8s-master01:~# mkdir -pv /etc/containerd/certs.d/harbor.magedu.net
  2. mkdir: created directory '/etc/containerd/certs.d'
  3. mkdir: created directory '/etc/containerd/certs.d/harbor.magedu.net'
  4. root@k8s-master01:~#

5.2.2、证书格式转换

  1. root@k8s-deploy:~# cd /apps/nginx/certs/
  2. root@k8s-deploy:/apps/nginx/certs# openssl x509 -inform PEM -in magedu.net.crt -out magedu.net.cert
  3. root@k8s-deploy:/apps/nginx/certs#

5.2.3、开始分发证书至镜像构建服务器

  1. root@k8s-deploy:/apps/nginx/certs# scp ca.crt magedu.net.cert magedu.net.key 192.168.0.31:/etc/containerd/certs.d/harbor.magedu.net/
  2. ca.crt                                                                                                               100% 2041     1.5MB/s   00:00    
  3. magedu.net.cert                                                                                                      100% 1915     1.6MB/s   00:00    
  4. magedu.net.key                                                                                                       100% 3272     2.9MB/s   00:00    
  5. root@k8s-deploy:/apps/nginx/certs#

5.2.4、镜像构建服务器上验证证书

  1. root@k8s-master01:~# cd /etc/containerd/certs.d/harbor.magedu.net
  2. root@k8s-master01:/etc/containerd/certs.d/harbor.magedu.net# ll
  3. total 20
  4. drwxr-xr-x 2 root root 4096 May 31 17:49 ./
  5. drwxr-xr-x 3 root root 4096 May 31 17:44 ../
  6. -rw-r--r-- 1 root root 2041 May 31 17:49 ca.crt
  7. -rw-r--r-- 1 root root 1915 May 31 17:49 magedu.net.cert
  8. -rw------- 1 root root 3272 May 31 17:49 magedu.net.key
  9. root@k8s-master01:/etc/containerd/certs.d/harbor.magedu.net#

5.2.5、删除原有登录信息，重新登录harbor

  1. root@k8s-master01:~# rm -rf .docker/config.json 
  2. root@k8s-master01:~# nerdctl login harbor.magedu.net
  3. Enter Username: admin
  4. Enter Password: 
  5. WARN[0005] skipping verifying HTTPS certs for "harbor.magedu.net" 
  6. WARNING: Your password will be stored unencrypted in /root/.docker/config.json.
  7. Configure a credential helper to remove this warning. See
  8. https://docs.docker.com/engine/reference/commandline/login/#credentials-store
  10. Login Succeeded
  11. root@k8s-master01:~#

5.3、镜像构建

  1. root@k8s-master01:~/ubuntu# ll
  2. total 1120
  3. drwxr-xr-x  3 root root    4096 May 31 18:40 ./
  4. drwx------ 11 root root    4096 May 31 18:40 ../
  5. -rw-r--r--  1 root root     846 May 31 18:39 Dockerfile
  6. -rw-r--r--  1 root root     266 May 31 18:40 build-command.sh
  7. -rw-r--r--  1 root root   38751 Aug  5  2022 frontend.tar.gz
  8. drwxr-xr-x  3 root root    4096 May 31 18:37 html/
  9. -rw-r--r--  1 root root 1073322 May 24  2022 nginx-1.22.0.tar.gz
  10. -rw-r--r--  1 root root    2812 Oct  3  2020 nginx.conf
  11. -rw-r--r--  1 root root    1139 Aug  5  2022 sources.list
  12. root@k8s-master01:~/ubuntu# cat Dockerfile 
  13. FROM ubuntu:22.04
  14. ADD sources.list /etc/apt/sources.list
  16. RUN apt update && apt  install -y iproute2  ntpdate  tcpdump telnet traceroute nfs-kernel-server nfs-common  lrzsz tree  openssl libssl-dev libpcre3 libpcre3-dev zlib1g-dev ntpdate tcpdump telnet traceroute  gcc openssh-server lrzsz tree  openssl libssl-dev libpcre3 libpcre3-dev zlib1g-dev ntpdate tcpdump telnet traceroute iotop unzip zip make
  19. ADD nginx-1.22.0.tar.gz /usr/local/src/
  20. RUN cd /usr/local/src/nginx-1.22.0 && ./configure --prefix=/apps/nginx && make && make install  && ln -sv /apps/nginx/sbin/nginx /usr/bin
  21. RUN groupadd  -g 2088 nginx && useradd  -g nginx -s /usr/sbin/nologin -u 2088 nginx && chown -R nginx.nginx /apps/nginx
  22. ADD nginx.conf /apps/nginx/conf/
  23. ADD frontend.tar.gz /apps/nginx/html/
  26. EXPOSE 80 443
  27. #ENTRYPOINT ["nginx"]
  28. CMD ["nginx","-g","daemon off;"]
  29. root@k8s-master01:~/ubuntu# cat build-command.sh 
  30. #!/bin/bash
  31. #docker build -t harbor.magedu.net/myserver/nginx:v1 .
  32. #docker push harbor.magedu.net/myserver/nginx:v1
  34. /usr/local/bin/nerdctl build -t harbor.magedu.net/magedu/nginx-base:1.22.0 .
  36. /usr/local/bin/nerdctl push harbor.magedu.net/magedu/nginx-base:1.22.0
  37. root@k8s-master01:~/ubuntu#

5.4、通过脚本?动构建并把镜像上传到镜像仓库

  1. root@k8s-master01:~/ubuntu# bash build-command.sh

5.5、验证镜像是否上传到harbor仓库？


6、基于?定义镜像创建测试容器

6.1、nerdctl命令

  1. root@k8s-node01:~# nerdctl run -d -p 80:80 harbor.magedu.net/magedu/nginx-base:1.22.0
  2. WARN[0000] skipping verifying HTTPS certs for "harbor.magedu.net" 
  3. harbor.magedu.net/magedu/nginx-base:1.22.0:                                       resolved       |++++++++++++++++++++++++++++++++++++++| 
  4. manifest-sha256:61c8355a7eabb8d24f31c8a48edb230d7709b455128a580e180a1a2f4188571c: done           |++++++++++++++++++++++++++++++++++++++| 
  5. config-sha256:6c030d3d7f76a61e2bc706d98cdfa55b80f7a6d8491b85ede84d0dbb2c706a74:   done           |++++++++++++++++++++++++++++++++++++++| 
  6. layer-sha256:4da3a93ac27213414b4de065a2603d7acbec5bd63d6198a62ad732fa7ac6afa0:    done           |++++++++++++++++++++++++++++++++++++++| 
  7. layer-sha256:26039d49560ee304c7a41e00617e216bedb7e9c6b74263db5afe68a23425f286:    done           |++++++++++++++++++++++++++++++++++++++| 
  8. layer-sha256:61967fbfff474bb397fbc7752b2097a1211fd9e22c85ce679d2b80c29477ca8d:    done           |++++++++++++++++++++++++++++++++++++++| 
  9. layer-sha256:4179b69841babb645626f43f9f4eb8bf4fc9be92ef9819ea8d9335408178a497:    done           |++++++++++++++++++++++++++++++++++++++| 
  10. layer-sha256:9e0da806173e5c7f5188ed9222e6caf214b43f6e0ed1f961ed8261cb4fbf9429:    done           |++++++++++++++++++++++++++++++++++++++| 
  11. layer-sha256:1739bcae88003d009cb72941ca5085074a0d1257c971a3838e0d6402f010b38e:    done           |++++++++++++++++++++++++++++++++++++++| 
  12. layer-sha256:f8a2ffd8882321b57192cce8fcaebab3657bb30e073e4f21eee91b3f44488809:    done           |++++++++++++++++++++++++++++++++++++++| 
  13. elapsed: 18.6s                                                                    total:  149.3  (8.0 MiB/s)                                       
  14. af08bef4d635f3f888c87120cc830b37e3f53121012ad59500a30c20ac065319
  15. root@k8s-node01:~#

访问容器

原文链接：https://www.cnblogs.com/qiuhom-1874/p/17439283.html

 友情链接：直通硅谷 　点职佳 　北美留学生论坛

Linux/Shell热门文章

  • vdbench 数据校验测试方法
  • CentOS7一键脚本安装WireGuard
  • VMware Ubuntu 20.04 LTS 使用Qemu虚拟机u-boot启动或者配合busybox模拟ARM开发板
  • Activation of org.freedesktop.systemd1 timed out
  • vmWare 虚机文件不能启动的事故处理
  • windows远程连接centos及闪退异常解决记录
  • CentOS7防火墙放行或限制指定IP和端口（firewall）
  • jvm：jmap无法dump文件的解决办法
  • C# 控制 GPIO
  • linux中文件权限的字母含义

    • Linux/Shell推荐文章

  • 旧物利用 - 将机顶盒改造为一台Linux开发机！
  • condition字符串匹配问题
  • proxmox ve 部署双节点HA集群及glusterfs分布式文件系统
  • 入门到精通rsync和inotify
  • 解决 CentOS 7 官方 yum 仓库无法使用的最佳实践
  • Linux 提权-NFS 共享
  • 将虚拟机跑在ceph之中
  • saltStack自动化工具
  • SeaweedFS + TiKV 部署保姆级教程
  • GlusterFs分布式文件系统

    • 本站QQ群：前端 618073944 | Java 606181507 | Python 626812652 | C/C++ 612253063 | 微信 634508462 | 苹果 692586424 | C#/.net 182808419 | PHP 305140648 | 运维 608723728

    W3xue 的所有内容仅供测试，对任何法律问题及风险不承担任何责任。通过使用本站内容随之而来的风险与本站无关。
    关于我们  |  意见建议  |  捐助我们  |  报错有奖  |  广告合作、友情链接（目前9元/月）请联系QQ：27243702 沸活量
    皖ICP备17017327号-2　皖公网安备34020702000426号