containerd配置镜像加速（含新旧版本）

镜像加速使用文档

关于镜像加速的使用可以查看以下两个链接
镜像服务提供商-道客
镜像服务提供商-dockerproxy.net

containerd配置说明文档

https://github.com/containerd/containerd/blob/main/docs/cri/registry.md

必做步骤(是后面host.toml的前提 )

vim /etc/containerd/config.toml

[plugins."io.containerd.cri.v1.images".registry]
   config_path = "/etc/containerd/certs.d"

systemctl restart containerd.service

host.toml配置步骤（containerd2.x新版功能，与config.toml解耦，无需重启containerd）

k8s中还会涉及到其他镜像仓库，以下仅以docker.io和registry.k8s.io为例子，其他配置类似，具体镜像的加速地址请看此文档https://github.com/DaoCloud/public-image-mirror

k8s中涉及到的仓库有如下

docker.elastic.co
docker.io
gcr.io
ghcr.io
k8s.gcr.io
registry.k8s.io
mcr.microsoft.com
nvcr.io
quay.io

1. 创建目录

mkdir -p /etc/containerd/certs.d/docker.io
mkdir -p /etc/containerd/certs.d/registry.k8s.io

2. 创建配置文件

touch /etc/containerd/certs.d/docker.io/hosts.toml
touch /etc/containerd/certs.d/registry.k8s.io/hosts.toml

cat>/etc/containerd/certs.d/docker.io/hosts.toml<<EOF
server = "https://docker.io"

[host."https://docker.m.daocloud.io"]
  capabilities = ["pull", "resolve"]
[host."https://dockerproxy.com/"]
  capabilities = ["pull", "resolve"]
EOF

cat>/etc/containerd/certs.d/registry.k8s.io/hosts.toml<<EOF
server = "registry.k8s.io"

[host."k8s.m.daocloud.io"]
  capabilities = ["pull", "resolve"]
EOF

3. 重启containerd

systemctl restart containerd.service

4. 测试

crictl pull busybox

传统配置（需要重启containerd）

编辑 containerd 配置（默认位置位于 /etc/containerd/config.toml）以添加 JSON 密钥，用于 gcr.io 域镜像拉取请求：

• 在 containerd 2.x 中（io.containerd.cri.v1.images）

version = 3

[plugins."io.containerd.cri.v1.images".registry]
  [plugins."io.containerd.cri.v1.images".registry.mirrors]
    [plugins."io.containerd.cri.v1.images".registry.mirrors."docker.io"]
      endpoint = ["https://registry-1.docker.io"]
    [plugins."io.containerd.cri.v1.images".registry.mirrors."gcr.io"]
      endpoint = ["https://gcr.io"]
    [plugins."io.containerd.cri.v1.images".registry.mirrors."仓库域名"]
      endpoint = ["加速地址"]
  [plugins."io.containerd.cri.v1.images".registry.configs]
    [plugins."io.containerd.cri.v1.images".registry.configs."gcr.io".auth]
      username = "_json_key"
      password = 'paste output from jq'
  [plugins."io.containerd.cri.v1.images".registry.configs]
    [plugins."io.containerd.cri.v1.images".registry.configs."仓库域名".auth]
      username = "用户名"
      password = '用户密码'

• 在 containerd 1.x 中（io.containerd.grpc.v1.cri）

version = 2

[plugins."io.containerd.grpc.v1.cri".registry]
  [plugins."io.containerd.grpc.v1.cri".registry.mirrors]
    [plugins."io.containerd.grpc.v1.cri".registry.mirrors."docker.io"]
      endpoint = ["https://registry-1.docker.io"]
    [plugins."io.containerd.grpc.v1.cri".registry.mirrors."gcr.io"]
      endpoint = ["https://gcr.io"]
  [plugins."io.containerd.grpc.v1.cri".registry.configs]
    [plugins."io.containerd.grpc.v1.cri".registry.configs."gcr.io".auth]
      username = "_json_key"
      password = 'paste output from jq'

• 重新启动 containerd：

service containerd restart

• 测试

crictl pull busybox
#看到Image is up to date就代表成功了
Image is up to date for sha256:78096d0a54788961ca68393e5f8038704b97d8af374249dc5c8faec1b8045e42