containerd安装

cgroup driver的说明

Linux使用cgroup进行资源的隔离控制

Centos启动时使用systemd(即我们使用的systemctl，Centos7之前是使用/etc/rc.d/init.d)进行初始化系统，会生成一个cgroup manager去管理cgroupfs。如果让Containerd直接去管理cgroupfs，又会生成一个cgroup manager。一个系统有两个cgroup manager很不稳定。所以我们需要配置Containerd直接使用systemd去管理cgroupfs

部署

• 下载并解压

[root@k8s-master ~]# wget https://github.com/containerd/containerd/releases/download/v1.4.12/cri-containerd-cni-1.4.12-linux-amd64.tar.gz
[root@k8s-master ~]# mkdir cri-containerd-cni
[root@k8s-master ~]# tar -zxvf cri-containerd-cni-1.4.12-linux-amd64.tar.gz -C cri-containerd-cni

• 将解压的文件，复制到系统的配置目录和执行目录

[root@k8s-master ~]# cp -a cri-containerd-cni/etc/systemd/system/containerd.service /etc/systemd/system
[root@k8s-master ~]# cp -a cri-containerd-cni/etc/crictl.yaml /etc
[root@k8s-master ~]# cp -a cri-containerd-cni/etc/cni /etc
[root@k8s-master ~]# cp -a cri-containerd-cni/usr/local/sbin/runc /usr/local/sbin
[root@k8s-master ~]# cp -a cri-containerd-cni/usr/local/bin/* /usr/local/bin
[root@k8s-master ~]# cp -a cri-containerd-cni/opt/* /opt

• 启动containerd

[root@k8s-master ~]# systemctl daemon-reload
[root@k8s-master ~]# systemctl enable containerd --now
Created symlink from /etc/systemd/system/multi-user.target.wants/containerd.service to /etc/systemd/system/containerd.service.
[root@k8s-master ~]#

配置containerd

• 获取默认配置文件

[root@k8s-master ~]# mkdir /etc/containerd
[root@k8s-master ~]# containerd config default | tee /etc/containerd/config.toml

• 修改config.toml配置文件，修改说明如下

[root@k8s-master ~]# cat /etc/containerd/config.toml 
......省略部分......
    enable_selinux = false
    selinux_category_range = 1024
    #sandbox_image = "k8s.gcr.io/pause:3.2"
    # 注释上面那行，添加下面这行
    sandbox_image = "registry.cn-hangzhou.aliyuncs.com/google_containers/pause:3.2"
    stats_collect_period = 10
    systemd_cgroup = false
......省略部分......
          privileged_without_host_devices = false
          base_runtime_spec = ""
          [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc.options]
            # 添加下面这行
            SystemdCgroup = true
    [plugins."io.containerd.grpc.v1.cri".cni]
      bin_dir = "/opt/cni/bin"
......省略部分......
	 [plugins."io.containerd.grpc.v1.cri".registry.mirrors]
        [plugins."io.containerd.grpc.v1.cri".registry.mirrors."docker.io"]
          #endpoint = ["https://registry-1.docker.io"]
          # 注释上面那行，添加下面三行
          endpoint = ["https://docker.mirrors.ustc.edu.cn"]
        [plugins."io.containerd.grpc.v1.cri".registry.mirrors."k8s.gcr.io"]
          endpoint = ["https://registry.cn-hangzhou.aliyuncs.com/google_containers"]
    [plugins."io.containerd.grpc.v1.cri".image_decryption]
      key_model = ""
......省略部分......
[root@k8s-master ~]#

• 然后重启containerd

[root@k8s-master ~]# systemctl daemon-reload
[root@k8s-master ~]# systemctl restart containerd

安装nerdctl

nerdctl是containerd原生的命令行管理工具。和Docker的命令行兼容

nerdctl管理的容器、镜像与Kubernetes的容器、镜像是完全隔离的，不能互通。目前只能通过crictl命令行工具来查看、拉取Kubernetes的容器、镜像

nerdctl和containerd的版本对应关系，参考：https://github.com/containerd/nerdctl/blob/v0.6.1/go.mod

下载解压，然后复制到执行目录下，即可使用

[root@k8s-master ~]# wget https://github.com/containerd/nerdctl/releases/download/v0.6.1/nerdctl-0.6.1-linux-amd64.tar.gz
[root@k8s-master ~]#
[root@k8s-master ~]# mkdir nerdctl
[root@k8s-master ~]#
[root@k8s-master ~]# tar -zxvf nerdctl-0.6.1-linux-amd64.tar.gz -C nerdctl
nerdctl
containerd-rootless-setuptool.sh
containerd-rootless.sh
[root@k8s-master ~]#
[root@k8s-master ~]# cp -a nerdctl/nerdctl /usr/bin
[root@k8s-master ~]#
[root@k8s-master ~]# nerdctl images
REPOSITORY    TAG    IMAGE ID    CREATED    SIZE
[root@k8s-master ~]#

注意： nerdctl run -p containerPort:hostPort的端口映射无效，只能通过nerdctl run -net host来实现

安装crictl

crictl是Kubernetes用于管理Containerd上的镜像和容器的一个命令行工具，主要用于Debug

• 下载解压

[root@k8s-master ~]# wget https://github.com/kubernetes-sigs/cri-tools/releases/download/v1.24.0/crictl-v1.24.0-linux-amd64.tar.gz
[root@k8s-master ~]# tar -zxvf crictl-v1.24.0-linux-amd64.tar.gz -C /usr/local/bin
crictl
[root@k8s-master ~]#

• 创建crictl的配置文件

[root@k8s-master ~]# cat > /etc/crictl.yaml <<EOF
runtime-endpoint: unix:///var/run/containerd/containerd.sock
image-endpoint: unix:///var/run/containerd/containerd.sock
timeout: 10
debug: false
pull-image-on-create: false
EOF
[root@k8s-master ~]#
[root@k8s-master ~]# systemctl daemon-reload

• 使用crictl

[root@k8s-master ~]# crictl images
IMAGE               TAG                 IMAGE ID            SIZE
[root@k8s-master ~]#