containerd使用了解
containerd使用了解
yum安装
[root@vm ~]# curl -o /etc/yum.repos.d/docker.repo http://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo
[root@vm ~]# yum list | grep containerd
containerd.io.x86_64 1.6.28-3.1.el7 docker-ce-stable
[root@vm ~]# yum -y install containerd.io.x86_64
[root@vm ~]# systemctl enable containerd --now
Created symlink from /etc/systemd/system/multi-user.target.wants/containerd.service to /usr/lib/systemd/system/containerd.service.
[root@vm ~]# systemctl status containerd
[root@vm ~]# ctr version
Client:Version: 1.6.28Revision: ae07eda36dd25f8a1b98dfbf587313b99c0190bbGo version: go1.20.13Server:Version: 1.6.28Revision: ae07eda36dd25f8a1b98dfbf587313b99c0190bbUUID: 852c205c-ca6d-475a-823b-b2069a2b183f
[root@vm ~]# ctr container ls
CONTAINER IMAGE RUNTIME
二进制方式安装
[root@vm ~]# wget https://github.com/containerd/containerd/releases/download/v1.6.0/cri-containerd-cni-1.6.0-linux-amd64.tar.gz# 查看etc目录，主要为containerd服务管理配置文件及cni虚拟网卡配置文件
# 查看opt目录，主要为gce环境中使用containerd配置文件及cni插件
# 查看usr目录，bin主要为containerd运行时文件，sbin包含runc[root@vm ~]# cat etc/systemd/system/containerd.service
# 将containerd放到对的目录里，将service放到对应的目录 使用system管理
创建配置文件目录
[root@vm ~]# containerd --help
[root@vm ~]# mkdir /etc/containerd #创建配置文件目录
[root@vm ~]# containerd config default > /etc/containerd/config.toml #生成配置文件
...
disabled_plugins = []
imports = []
oom_score = 0
plugin_dir = ""
required_plugins = []
root = "/var/lib/containerd"
state = "/run/containerd"
temp = ""
...
[plugins][plugins."io.containerd.gc.v1.scheduler"]deletion_threshold = 0mutation_threshold = 100pause_threshold = 0.02schedule_delay = "0s"startup_delay = "100ms"[plugins."io.containerd.grpc.v1.cri"]device_ownership_from_security_context = falsedisable_apparmor = falsesandbox_image = "registry.k8s.io/pause:3.6" # 配置可拉取到的[plugins."io.containerd.grpc.v1.cri".registry][plugins."io.containerd.grpc.v1.cri".registry.mirrors][plugins."io.containerd.grpc.v1.cri".registry.mirrors."docker.io"]endpoint = ["https://docker.mirrors.ustc.edu.cn","http://hub-mirror.c.163.com"][plugins."io.containerd.grpc.v1.cri".registry.mirrors."k8s.gcr.io"]endpoint = ["https://gcr.mirrors.ustc.edu.cn"] [plugins.cri.registry.mirrors."harbor.docker.com"] #此处添加了本地容器镜像仓库 Harbor，做为本地容器镜像仓库endpoint =["http://harbor.docker.com"]
[root@vm ~]# cp usr/local/bin/ctr /usr/bin/
[root@vm ~]# ctr version
containerd+runc 但是依赖系统中的seccomp
[root@vm ~]# # wget https://github.com/opencontainers/runc/releases/download/v1.1.0/runc.amd64
[root@vm ~]# chmod+x runc
[root@vm ~]# runc -v
docker&ctr&crictl区别
docker 使用 docker images 命令管理镜像
单机containerd 使用 ctr images 命令管理镜像(containerd本身的CLI工具)
k8s中containerd 使用 crictl images 命令管理镜像(Kubernetes社区的专用CLI工具)
[root@vm ~]# ctr --hepUSAGE:ctr [global options] command [command options] [arguments...]COMMANDSplugins, plugin provides information about containerd pluginsversion print the client and server versionscontainers, c, container manage containerscontent manage contentevents, event display containerd eventsimages, image, i manage imagesleases manage leasesnamespaces, namespace, ns manage namespacespprof provide golang pprof outputs for containerdrun run a containersnapshots, snapshot manage snapshotstasks, t, task manage tasksinstall install a new packageoci OCI toolsdeprecationsshim interact with a shim directlyhelp, h Shows a list of commands or help for one command
镜像操作
[root@vm ~]# ctr images --help
NAME:ctr images - manage imagesUSAGE:ctr images command [command options] [arguments...]COMMANDS:check check existing images to ensure all content is avail able locallyexport export imagesimport import imageslist, ls list images known to containerdmount mount an image to a target pathunmount unmount the image from the targetpull pull an image from a remotepush push an image to a remotedelete, del, remove, rm remove one or more images by referencetag tag an imagelabel set and clear labels for an imageconvert convert an image[root@vm ~]# ctr images pull docker.io/library/nginx:latest #根据平台统架构 自动下载符合的 uname -a
[root@vm ~]# ctr images pull --platform linux/amd64 docker.io/library/nginx:alpine # 指定架构的
[root@vm ~]# ctr images pull --all-platforms docker.io/library/nginx:alpine # 下所有的[root@vm ~]# ctr images mount docker.io/library/nginx:alpine /mnt
[root@vm ~]# ls /mnt
[root@vm ~]# umount /mnt[root@vm ~]# ctr i export nginx.img docker.io/library/nginx:alpine
[root@vm ~]# ls nginx.img
[root@vm ~]# ctr i export --al1-platforms nginx.img docker.io/library/nginx:alpine
[root@vm ~]# ctr i import
[root@vm ~]# ctr i rm [root@vm ~]# ctr i check # 显示镜像大小分层
[root@vm ~]# cri i tag docker.io/library/nginx:alpine docker.io/library/nginx:alpine-v1 #名字要完整，这种nginx:alpine-v1会不可用
容器操作.
ctr container --help
ctr c --help
[root@vm ~]# ctr container --help
NAME:ctr containers - manage containersUSAGE:ctr containers command [command options] [arguments...]COMMANDS:create create containerdelete, del, remove, rm delete one or more existing containersinfo get info about a containerlist, ls list containerslabel set and clear labels for a containercheckpoint checkpoint a containerrestore restore a container from checkpoint使用“ctr container create 命今创建容器后，容器并没有处于运行状态，其只是一个静态的容器。
这个 container 对象只是包含了运行一个容器所需的资源及配黑的数据结构。
例如: Tlamespaces、rootfs 和容器的配黑都已经初始化成功了，只是用户进程(本案为nginx)还没有启动。
需要使用ctr tasks~命令才能获取一个动态容器。# ctr container 需两步完成容器启动，所以使用不多。采用ctr run[root@vm ~]# ctr c ls 查看容器
[root@vm ~]# ctr task ls 查看任务，动态的[root@vm ~]# ctr container create docker.io/library/nginx:alpine my-nginx # 先镜像，后容器名。 镜像不存在时，创建失败
[root@vm ~]# ctr c ls
[root@vm ~]# ctr c info my-nginx
[root@vm ~]# ctr task ls #暂时没有动态的容器
[root@vm ~]# ctr task start -d my-nginx # runc,复制containerd连接runC垫片工具containerd-shim-runc-v2至/usr/bin
[root@vm ~]# ctr task ls # 显示容器所在宿主机进程，pid
[root@vm ~]# ctr task ps my-nginx #查看容器的进程(都是物理机的进程 master worker)
# 进入容器
[root@vm ~]# ctr task exec --exec-id 1 my-nginx /bin/bash # 1 随机写
curl localhost# 使用ctr run
[root@vm ~]# ctr run -d --net-host docker.io/library/nginx:latest nginx2
[root@vm ~]# ctr task exec --exec-id $RANDOM -t nginx2 /bin/bash
exit#暂停容器
[root@vm ~]# ctr task pause nginx2
[root@vm ~]# ctr task ls #再次查看容器状态，看到其状态为PAUSED，表示停止
[root@vm ~]# ctr task resume nginx2
[root@vm ~]# ctr task kill nginx2 # stop状态
[root@vm ~]# ctr task rm nginx2 #删除进程，容器还在不用再次 ctr create
[root@vm ~]# ctr task start -d nginx2#删除容器[root@vm ~]# ctr task delet nginx2
[root@vm ~]# ctr container delete nginx2