> 本文作者：丁辉
>
> 更新时间：2026-11-05

# 二进制安装Containerd

[官方文档](https://containerd.io/docs/main/getting-started/)	[Github文档](https://github.com/containerd/containerd/blob/main/docs/getting-started.md)

## 安装 Containerd

1. 下载二进制文件

   [Containerd](https://github.com/containerd/containerd/releases)	[Containerd.Service](https://raw.githubusercontent.com/containerd/containerd/main/containerd.service)

   ```bash
   wget https://github.com/containerd/containerd/releases/download/v2.4.2/containerd-2.4.2-linux-amd64.tar.gz
   
   wget https://raw.githubusercontent.com/containerd/containerd/main/containerd.service
   ```

2. 解压

   ```bash
   tar Cxzvf /usr/local containerd-*-linux-amd64.tar.gz
   ```

3. 配置 Systemd

   ```bash
   cp containerd.service /usr/lib/systemd/system/containerd.service
   ```

4. 启动 Containerd

   ```bash
   systemctl daemon-reload
   systemctl enable --now containerd
   ```

## 安装 Runc

[Runc](https://github.com/opencontainers/runc/releases)

1. 下载

   ```bash
   wget https://github.com/opencontainers/runc/releases/download/v1.5.2/runc.amd64
   ```

2. 安装

   ```bash
   install -m 755 runc.amd64 /usr/local/sbin/runc
   ```

## 安装 CNI 插件

[Cni-Plugins](https://github.com/containernetworking/plugins/releases)

1. 下载

   ```bash
   wget https://github.com/containernetworking/plugins/releases/download/v1.9.1/cni-plugins-linux-amd64-v1.9.1.tgz
   ```

2. 解压

   ```bash
   mkdir -p /opt/cni/bin &&
   tar Cxzvf /opt/cni/bin cni-plugins-linux-amd64-v*.tgz
   ```

## 安装 CLI

### Nerdctl

[Nerdctl](https://github.com/containerd/nerdctl/releases)

1. 下载

   ```bash
   wget https://github.com/containerd/nerdctl/releases/download/v2.4.2/nerdctl-2.4.2-linux-amd64.tar.gz
   ```

2. 解压

   ```bash
   tar zxvf nerdctl-*-linux-amd64.tar.gz
   ```

3. 安装

   ```bash
   install -m 755 nerdctl /usr/local/bin/nerdctl
   ```

### Crictl

[Crictl](https://github.com/kubernetes-sigs/cri-tools/releases)

1. 下载

   ```bash
   wget https://github.com/kubernetes-sigs/cri-tools/releases/download/v1.37.0/crictl-v1.37.0-linux-amd64.tar.gz
   ```

2. 解压

   ```bash
   tar zxvf crictl-v*-linux-amd64.tar.gz
   ```

3. 安装

   ```bash
   install -m 755 crictl /usr/local/bin/crictl
   ```

4. 添加配置文件

   ```bash
   curl -so /etc/crictl.yaml https://raw.giteeusercontent.com/offends/Kubernetes/raw/main/Containerd/Files/crictl.yaml
   ```

## 配置 Containerd

[官方文档](https://kubernetes.io/zh-cn/docs/setup/production-environment/container-runtimes/#containerd-systemd)

1. 创建配置文件

   ```bash
   mkdir /etc/containerd &&
   containerd config default > /etc/containerd/config.toml
   ```

   **参数解释**

   - **`containerd config default`**：用于**全新安装**，生成一份干净的、当前版本的默认配置。
   - **`containerd config migrate`**：用于**从旧版本升级**，它会读取你现有的旧配置文件，并将其转换为新格式，同时保留你的自定义设置。

2. 修改驱动和镜像地址

   ```bash
   sed -i "/SystemdCgroup/s/=.*/= true/" /etc/containerd/config.toml &&
   
   sed -i "/^[[:space:]]*\[plugins\.'io\.containerd\.cri\.v1\.images'\.pinned_images\][[:space:]]*$/,/^[[:space:]]*\[/ s|^\([[:space:]]*sandbox[[:space:]]*=[[:space:]]*\).*|\1'registry.aliyuncs.com/google_containers/pause:3.10.2'|" /etc/containerd/config.toml &&
   
   sed -i "/^[[:space:]]*\[plugins\.'io\.containerd\.cri\.v1\.images'\.registry\][[:space:]]*$/,/^[[:space:]]*\[/ s|config_path = ''|config_path = \'/etc/containerd/certs.d\'|" /etc/containerd/config.toml
   ```

   **参数解释**

   | 参数            | 值                                                     | 说明                            | 适用版本       |
   | --------------- | ------------------------------------------------------ | ------------------------------- | -------------- |
   | `SystemdCgroup` | `true`                                                 | 启用 systemd cgroup 驱动        | containerd 2.x |
   | `sandbox`       | `registry.aliyuncs.com/google_containers/pause:3.10.2` | 指定 pause 沙箱镜像为阿里云地址 | containerd 2.x |
   | `config_path`   | `/etc/containerd/certs.d`                              | 指定 registry 证书配置目录      | containerd 2.x |

3. 重新启动并查看状态

   ```bash
   systemctl restart containerd &&
   systemctl status containerd
   ```

4. 查看已加载的配置文件是否有错误

   ```bash
   containerd config dump | grep WARN
   ```

## 配置镜像加速

1. 创建目录

   ```bash
   mkdir -p /etc/containerd/certs.d/docker.io
   ```

2. 写入加速器地址

   ```bash
   cat > /etc/containerd/certs.d/docker.io/hosts.toml << EOF
   server = "https://docker.io"
   
   [host."https://docker.m.daocloud.io"]
     capabilities = ["pull", "resolve"]
   EOF
   ```

3. 重启 containerd 使配置生效

   ```bash
   systemctl restart containerd
   ```

## 配置允许不安全的仓库

```bash
cat > /etc/containerd/certs.d/docker.io/hosts.toml << EOF
[host."https://docker.io"]
  capabilities = ["pull", "resolve","push"]
  skip_verify = true
  [host."https://docker.io".auth]
    username = "username"
    password = "password"
EOF
```