From ed731c4ad65ac508b253dc644568ca937214968d Mon Sep 17 00:00:00 2001 From: offends Date: Fri, 6 Nov 2026 17:54:47 +0800 Subject: [PATCH] =?UTF-8?q?=E6=B7=BB=E5=8A=A0=E6=96=87=E6=A1=A3?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- Containerd/Docs/二进制安装Containerd.md | 226 ++++++++++++++++++------ Containerd/Files/crictl.yaml | 23 ++- 2 files changed, 196 insertions(+), 53 deletions(-) diff --git a/Containerd/Docs/二进制安装Containerd.md b/Containerd/Docs/二进制安装Containerd.md index 02c4dea..33d7400 100644 --- a/Containerd/Docs/二进制安装Containerd.md +++ b/Containerd/Docs/二进制安装Containerd.md @@ -1,87 +1,209 @@ > 本文作者：丁辉 +> +> 更新时间：2026-11-05 # 二进制安装Containerd +[官方文档](https://containerd.io/docs/main/getting-started/) [Github文档](https://github.com/containerd/containerd/blob/main/docs/getting-started.md) + ## 安装 Containerd -[containerd软件包](https://github.com/containerd/containerd/releases) - -[cni插件包](https://github.com/containernetworking/plugins/releases) - 1. 下载二进制文件 + [Containerd](https://github.com/containerd/containerd/releases) [Containerd.Service](https://raw.githubusercontent.com/containerd/containerd/main/containerd.service) + ```bash - wget https://github.com/containerd/containerd/releases/download/v1.6.33/cri-containerd-cni-1.6.33-linux-amd64.tar.gz + wget https://github.com/containerd/containerd/releases/download/v2.4.2/containerd-2.4.2-linux-amd64.tar.gz + + wget https://raw.githubusercontent.com/containerd/containerd/main/containerd.service ``` 2. 解压 ```bash - mkdir containerd - tar -zxvf cri-containerd-cni-*-linux-amd64.tar.gz -C containerd - cd containerd + tar Cxzvf /usr/local containerd-*-linux-amd64.tar.gz ``` -3. 移动文件至安装目录 +3. 配置 Systemd ```bash - \cp usr/local/bin/* /usr/local/bin/ - \cp etc/systemd/system/containerd.service /usr/lib/systemd/system/containerd.service - mkdir /opt/cni/bin -p - \cp /root/containerd/opt/cni/bin/* /opt/cni/bin/ + cp containerd.service /usr/lib/systemd/system/containerd.service ``` -4. 备份配置文件 +4. 启动 Containerd ```bash - mkdir /etc/containerd - containerd config default > /etc/containerd/config.toml + systemctl daemon-reload + systemctl enable --now containerd ``` -5. 修改驱动和镜像地址 +## 安装 Runc - ```bash - vi /etc/containerd/config.toml - ``` - - 内容如下 - - ```toml - [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc] - ... - [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc.options] - SystemdCgroup = true #修改这里 - - [plugins."io.containerd.grpc.v1.cri"] - sandbox_image = "registry.aliyuncs.com/google_containers/pause:3.9" - ``` - -6. 配置 crictl 配置文件 - - ```bash - curl -so /etc/crictl.yaml https://gitee.com/offends/Kubernetes/raw/main/Containerd/Files/crictl.yaml - ``` - -7. 启动 - - ```bash - systemctl enable containerd - systemctl start containerd - systemctl status containerd - ``` - -## 安装 RunC - -[Github软件包下载](https://github.com/opencontainers/runc/releases) +[Runc](https://github.com/opencontainers/runc/releases) 1. 下载 ```bash - wget https://github.com/opencontainers/runc/releases/download/v1.1.12/runc.amd64 + wget https://github.com/opencontainers/runc/releases/download/v1.5.2/runc.amd64 ``` 2. 安装 ```bash - install -m 755 runc.amd64 /usr/local/bin/runc + install -m 755 runc.amd64 /usr/local/sbin/runc ``` + +## 安装 CNI 插件 + +[Cni-Plugins](https://github.com/containernetworking/plugins/releases) + +1. 下载 + + ```bash + wget https://github.com/containernetworking/plugins/releases/download/v1.9.1/cni-plugins-linux-amd64-v1.9.1.tgz + ``` + +2. 解压 + + ```bash + mkdir -p /opt/cni/bin && + tar Cxzvf /opt/cni/bin cni-plugins-linux-amd64-v*.tgz + ``` + +## 安装 CLI + +### Nerdctl + +[Nerdctl](https://github.com/containerd/nerdctl/releases) + +1. 下载 + + ```bash + wget https://github.com/containerd/nerdctl/releases/download/v2.4.2/nerdctl-2.4.2-linux-amd64.tar.gz + ``` + +2. 解压 + + ```bash + tar zxvf nerdctl-*-linux-amd64.tar.gz + ``` + +3. 安装 + + ```bash + install -m 755 nerdctl /usr/local/bin/nerdctl + ``` + +### Crictl + +[Crictl](https://github.com/kubernetes-sigs/cri-tools/releases) + +1. 下载 + + ```bash + wget https://github.com/kubernetes-sigs/cri-tools/releases/download/v1.37.0/crictl-v1.37.0-linux-amd64.tar.gz + ``` + +2. 解压 + + ```bash + tar zxvf crictl-v*-linux-amd64.tar.gz + ``` + +3. 安装 + + ```bash + install -m 755 crictl /usr/local/bin/crictl + ``` + +4. 添加配置文件 + + ```bash + curl -so /etc/crictl.yaml https://raw.giteeusercontent.com/offends/Kubernetes/raw/main/Containerd/Files/crictl.yaml + ``` + +## 配置 Containerd + +[官方文档](https://kubernetes.io/zh-cn/docs/setup/production-environment/container-runtimes/#containerd-systemd) + +1. 创建配置文件 + + ```bash + mkdir /etc/containerd && + containerd config default > /etc/containerd/config.toml + ``` + + **参数解释** + + - **`containerd config default`**：用于**全新安装**，生成一份干净的、当前版本的默认配置。 + - **`containerd config migrate`**：用于**从旧版本升级**，它会读取你现有的旧配置文件，并将其转换为新格式，同时保留你的自定义设置。 + +2. 修改驱动和镜像地址 + + ```bash + sed -i "/SystemdCgroup/s/=.*/= true/" /etc/containerd/config.toml && + + sed -i "/^[[:space:]]*\[plugins\.'io\.containerd\.cri\.v1\.images'\.pinned_images\][[:space:]]*$/,/^[[:space:]]*\[/ s|^\([[:space:]]*sandbox[[:space:]]*=[[:space:]]*\).*|\1'registry.aliyuncs.com/google_containers/pause:3.10.2'|" /etc/containerd/config.toml && + + sed -i "/^[[:space:]]*\[plugins\.'io\.containerd\.cri\.v1\.images'\.registry\][[:space:]]*$/,/^[[:space:]]*\[/ s|config_path = ''|config_path = \'/etc/containerd/certs.d\'|" /etc/containerd/config.toml + ``` + + **参数解释** + + | 参数 | 值 | 说明 | 适用版本 | + | --------------- | ------------------------------------------------------ | ------------------------------- | -------------- | + | `SystemdCgroup` | `true` | 启用 systemd cgroup 驱动 | containerd 2.x | + | `sandbox` | `registry.aliyuncs.com/google_containers/pause:3.10.2` | 指定 pause 沙箱镜像为阿里云地址 | containerd 2.x | + | `config_path` | `/etc/containerd/certs.d` | 指定 registry 证书配置目录 | containerd 2.x | + +3. 重新启动并查看状态 + + ```bash + systemctl restart containerd && + systemctl status containerd + ``` + +4. 查看已加载的配置文件是否有错误 + + ```bash + containerd config dump | grep WARN + ``` + +## 配置镜像加速 + +1. 创建目录 + + ```bash + mkdir -p /etc/containerd/certs.d/docker.io + ``` + +2. 写入加速器地址 + + ```bash + cat > /etc/containerd/certs.d/docker.io/hosts.toml << EOF + server = "https://docker.io" + + [host."https://docker.m.daocloud.io"] + capabilities = ["pull", "resolve"] + EOF + ``` + +3. 重启 containerd 使配置生效 + + ```bash + systemctl restart containerd + ``` + +## 配置允许不安全的仓库 + +```bash +cat > /etc/containerd/certs.d/docker.io/hosts.toml << EOF +[host."https://docker.io"] + capabilities = ["pull", "resolve","push"] + skip_verify = true + [host."https://docker.io".auth] + username = "username" + password = "password" +EOF +``` + diff --git a/Containerd/Files/crictl.yaml b/Containerd/Files/crictl.yaml index d75410f..a8d5597 100644 --- a/Containerd/Files/crictl.yaml +++ b/Containerd/Files/crictl.yaml @@ -1,6 +1,27 @@ +# runtime-endpoint：crictl 连接的运行时服务地址 +# unix:///run/containerd/containerd.sock 表示通过本机 socket 连接 containerd 的 CRI 服务 runtime-endpoint: unix:///run/containerd/containerd.sock + +# image-endpoint：crictl 连接的镜像服务地址 +# 通常与 runtime-endpoint 相同，因为 containerd 的 CRI 服务同时提供运行时和镜像服务 image-endpoint: unix:///run/containerd/containerd.sock + +# timeout：crictl 请求超时时间，单位是秒 +# 10 表示最多等 10 秒，超时就报错；不是布尔值，按需改数字 timeout: 10 + +# debug：是否输出调试日志 +# debug: true = 输出更多调试信息，适合排错 +# debug: false = 正常输出，不打印调试日志 debug: false -pull-image-on-create: false + +# pull-image-on-create：crictl create 创建容器时，本地缺镜像是否自动拉取 +# pull-image-on-create: true = 缺镜像时自动拉取，再创建容器 +# pull-image-on-create: false = 缺镜像时不自动拉取，直接报错 +pull-image-on-create: true + +# disable-pull-on-run：crictl run 运行容器时，是否禁止自动拉取缺失镜像 +# 注意这个参数名字是“禁止拉取”，方向与上面相反 +# disable-pull-on-run: true = 禁止自动拉取，缺镜像直接报错 +# disable-pull-on-run: false = 不禁止自动拉取，缺镜像时允许自动拉取 disable-pull-on-run: false \ No newline at end of file