containerd
一、理论
Containerd是容器底层运行时，c/s架构。
docker运行需要containerd作为容器底层运行时。
kubernetes1.24版本之前（不包含1.24版本）支持docker、containerd等容器底层运行时，1.24版本之后（包含1.24版本）默认容器底层运行时就是containerd。
containerd由storage、metadata、runtimes三大组件组成
storage：存储
metadata：元数据
runtimes：运行时
storage中包含“content”、“snapshot”、“diff”三个服务
1、content（内容）：存储了容器镜像的实际数据。这包括文件系统层和元数据，用于创建和管理容器的基础文件系统。
2、snapshot（快照）：存储容器的快照数据。每个容器都可以有一个或多个快照，允许它们共享相同的文件系统层，提高效率。
3、diff（差异）：存储容器文件系统层之间的差异，当容器运行时需要修改文件系统时，会在已有的文件系统层上创建一个差异层，以保存变更。
metadata中包含“images”、“containers”两个服务
1、images（镜像）：images存储容器镜像的元数据，包括镜像的标签、大小、创建实践等信息。metadata中的images组件允许容器对镜像进行管理和操作。
2、containers（容器）：存储容器的元数据，包括容器的状态、配置信息、网络设置等。这部分元数据使得容器能够有效地管理容器的生命周期。
runtimes中包含“tasks”、“events”两个服务
1、tasks（任务）：tasks包含容器内的进程组。每个容器运行时都有关联的task，它负责管理容器内的所有进程。tasks与shim一起工作，维护容器的状态。
2、events（事件）：events组件记录了容器的各种事件，如容器的创建、启动、停止等。这些事件可以用于监控和日志记录，帮助用户了解容器系统的运行状况。
containerd支持扩展功能，常见插件包括shim，snapshotter，task等等
containerd利用linux命名空间（pid、network、mount、uts、ipc、user）实现了容器隔离，较docker而言，隔离力度更强。
二、实践
1、初始化配置containerd
[root@localhost ~]# curl -o /etc/yum.repos.d/docker-ce.repo https://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 2081 100 2081 0 0 7322 0 --:--:-- --:--:-- --:--:-- 7353
[root@localhost ~]# sed -i 's/$releasever/8/g' /etc/yum.repos.d/docker-ce.repo
[root@localhost ~]# sed -i 's/$basearch/x86_64/g' /etc/yum.repos.d/docker-ce.repo
列出可用版本
[root@localhost ~]# yum list containerd.io --showduplicates
Docker CE Stable - x86_64 9.2 kB/s | 3.5 kB 00:00
Installed Packages
containerd.io.x86_64 1.6.32-3.1.el8 @docker-ce-stable
Available Packages
containerd.io.x86_64 1.3.7-3.1.el8 docker-ce-stable
containerd.io.x86_64 1.3.9-3.1.el8 docker-ce-stable
containerd.io.x86_64 1.4.3-3.1.el8 docker-ce-stable
containerd.io.x86_64 1.4.3-3.2.el8 docker-ce-stable
containerd.io.x86_64 1.4.4-3.1.el8 docker-ce-stable
containerd.io.x86_64 1.4.6-3.1.el8 docker-ce-stable
containerd.io.x86_64 1.4.8-3.1.el8 docker-ce-stable
containerd.io.x86_64 1.4.9-3.1.el8 docker-ce-stable
containerd.io.x86_64 1.4.10-3.1.el8 docker-ce-stable
containerd.io.x86_64 1.4.11-3.1.el8 docker-ce-stable
containerd.io.x86_64 1.4.12-3.1.el8 docker-ce-stable
containerd.io.x86_64 1.4.13-3.1.el8 docker-ce-stable
containerd.io.x86_64 1.5.10-3.1.el8 docker-ce-stable
containerd.io.x86_64 1.5.11-3.1.el8 docker-ce-stable
containerd.io.x86_64 1.6.4-3.1.el8 docker-ce-stable
containerd.io.x86_64 1.6.6-3.1.el8 docker-ce-stable
containerd.io.x86_64 1.6.7-3.1.el8 docker-ce-stable
containerd.io.x86_64 1.6.8-3.1.el8 docker-ce-stable
containerd.io.x86_64 1.6.9-3.1.el8 docker-ce-stable
containerd.io.x86_64 1.6.10-3.1.el8 docker-ce-stable
containerd.io.x86_64 1.6.11-3.1.el8 docker-ce-stable
containerd.io.x86_64 1.6.12-3.1.el8 docker-ce-stable
containerd.io.x86_64 1.6.13-3.1.el8 docker-ce-stable
containerd.io.x86_64 1.6.14-3.1.el8 docker-ce-stable
containerd.io.x86_64 1.6.15-3.1.el8 docker-ce-stable
containerd.io.x86_64 1.6.16-3.1.el8 docker-ce-stable
containerd.io.x86_64 1.6.18-3.1.el8 docker-ce-stable
containerd.io.x86_64 1.6.19-3.1.el8 docker-ce-stable
containerd.io.x86_64 1.6.20-3.1.el8 docker-ce-stable
containerd.io.x86_64 1.6.21-3.1.el8 docker-ce-stable
containerd.io.x86_64 1.6.22-3.1.el8 docker-ce-stable
containerd.io.x86_64 1.6.24-3.1.el8 docker-ce-stable
containerd.io.x86_64 1.6.25-3.1.el8 docker-ce-stable
containerd.io.x86_64 1.6.26-3.1.el8 docker-ce-stable
containerd.io.x86_64 1.6.27-3.1.el8 docker-ce-stable
containerd.io.x86_64 1.6.28-3.1.el8 docker-ce-stable
containerd.io.x86_64 1.6.28-3.2.el8 docker-ce-stable
containerd.io.x86_64 1.6.31-3.1.el8 docker-ce-stable
containerd.io.x86_64 1.6.32-3.1.el8 docker-ce-stable
[root@localhost ~]# yum -y install containerd.io
安装完成后，再列出可用版本，已安装的版本会显示为绿色。
[root@localhost ~]# yum list containerd.io --showduplicates
创建目录（我这里默认已安装，默认就有）
[root@localhost ~]# mkdir -p /etc/containerd
生成配置信息传递到配置文件中。
[root@localhost ~]# containerd config default | tee /etc/containerd/config.toml
[root@localhost ~]# vim /etc/containerd/config.toml
sandbox_image = "registry.aliyuncs.com/google_containers/pause:3.9" 63row
SystemdCgroup = true 127row 启用systemd作为容器控制组，与k8s兼容。
config_path = "/etc/containerd/certs.d" 147row
[root@localhost ~]# cd /etc/containerd/
[root@localhost containerd]# ls
config.toml
[root@localhost containerd]# mkdir certs.d/docker.io
[root@localhost containerd]# mkdir certs.d/registry.k8s.io
[root@localhost containerd]# touch certs.d/docker.io/hosts.toml
[root@localhost containerd]# touch certs.d/registry.k8s.io/hosts.toml
[root@localhost containerd]# ls
certs.d config.toml
[root@localhost containerd]# ls certs.d/
docker.io registry.k8s.io
[root@localhost containerd]# ls certs.d/docker.io/
hosts.toml
[root@localhost containerd]# ls certs.d/registry.k8s.io/
hosts.toml
[root@localhost certs.d]# vim docker.io/hosts.toml
server = "docker.io"
[host."https://docker.m.daocloud.io"]
capabilities = ["pull","resolve"]
capabilities 译为能力、功能，这里意为给予containerd，pull（拉） resolve（解析）的功能
[root@localhost certs.d]# vim registry.k8s.io/hosts.toml
server = "registry.k8s.io"
[host."https://registry.aliyuncs.com/google_containers"]
capabilities = ["pull","resolve"]
override_path = true # 使其优先使用国内的aliyun镜像站。
[root@localhost containerd]# systemctl restart containerd
[root@localhost containerd]# systemctl status containerd
Active: active (running)
[root@localhost ~]# ctr version
Client:
Version: 1.6.32
Revision: 8b3b7ca2e5ce38e8f31a34f35b2b68ceb8470d89
Go version: go1.21.10
Server:
Version: 1.6.32
Revision: 8b3b7ca2e5ce38e8f31a34f35b2b68ceb8470d89
UUID: dfff142f-85e2-4147-9dd2-932bc7f7b27e
2、镜像类操作
拉取
指定平台为linux amd64架构的
[root@localhost ~]# ctr images pull docker.io/library/nginx:latest --platform linux/amd64 --hosts-dir=/etc/containerd/certs.d/
docker.io/library/nginx:latest: resolved |++++++++++++++++++++++++++++++++++++++|
index-sha256:dc53c8f25a10f9109190ed5b59bda2d707a3bde0e45857ce9e1efaa32ff9cbc1: done |++++++++++++++++++++++++++++++++++++++|
manifest-sha256:29cf9892ca1103e0b8c97db86f819fac1d9457b176bc77dd4f18ed2da4dd159f: done |++++++++++++++++++++++++++++++++++++++|
layer-sha256:f05e870393313d21a5e3e06bbc4c3d934bbe6c73443959ca653f6394895dde87: done |++++++++++++++++++++++++++++++++++++++|
layer-sha256:397cc88dcd41f46e6d20c478796aef73525ea6e30086727d1716a27d0ce4b3d1: done |++++++++++++++++++++++++++++++++++++++|
layer-sha256:021db26e13de22f63471bd0c76a601fe3fbf691a9f7fd157bb79f35b1216cdc9: done |++++++++++++++++++++++++++++++++++++++|
layer-sha256:5f4a88bd8474bae2745ccd9541b8e83466e9ce661efb345676eed0834dce6494: done |++++++++++++++++++++++++++++++++++++++|
layer-sha256:66467f8275465bcd2eb0ebdea7449b993fae35d16b8d57566c94aee34908a6ac: done |++++++++++++++++++++++++++++++++++++++|
layer-sha256:dad67da3f26bce15939543965e09c4059533b025f707aad72ed3d3f3a09c66f8: done |++++++++++++++++++++++++++++++++++++++|
layer-sha256:4eb3a9835b30d43f28a1fcd1d85c9503ef59f655bbbe8b050ff0a3bd9a6d56c2: done |++++++++++++++++++++++++++++++++++++++|
config-sha256:9a9a9fd723f1d2ba52b914ece050f298eec04ef490a9065c52805e46779c4c43: done |++++++++++++++++++++++++++++++++++++++|
elapsed: 17.9s total: 68.9 M (3.8 MiB/s)
unpacking linux/amd64 sha256:dc53c8f25a10f9109190ed5b59bda2d707a3bde0e45857ce9e1efaa32ff9cbc1...
done: 10.954580899s
查看
[root@localhost ~]# ctr images ls
REF TYPE DIGEST SIZE PLATFORMS LABELS
docker.io/library/nginx:latest application/vnd.oci.image.index.v1+json sha256:dc53c8f25a10f9109190ed5b59bda2d707a3bde0e45857ce9e1efaa32ff9cbc1 68.9 MiB linux/386,linux/amd64,linux/arm/v5,linux/arm/v7,linux/arm64/v8,linux/mips64le,linux/ppc64le,linux/s390x,unknown/unknown -
检测，有complete表示镜像是完整可用的状态。
[root@localhost ~]# ctr images check
REF TYPE DIGEST STATUS SIZE UNPACKED
docker.io/library/nginx:latest application/vnd.oci.image.index.v1+json sha256:dc53c8f25a10f9109190ed5b59bda2d707a3bde0e45857ce9e1efaa32ff9cbc1 complete (8/8) 68.9 MiB/68.9 MiB true
重命名
[root@localhost ~]# ctr images tag docker.io/library/nginx:latest nginx:v1
nginx:v1
[root@localhost ~]# ctr images ls
REF TYPE DIGEST SIZE PLATFORMS LABELS
docker.io/library/nginx:latest application/vnd.oci.image.index.v1+json sha256:dc53c8f25a10f9109190ed5b59bda2d707a3bde0e45857ce9e1efaa32ff9cbc1 68.9 MiB linux/386,linux/amd64,linux/arm/v5,linux/arm/v7,linux/arm64/v8,linux/mips64le,linux/ppc64le,linux/s390x,unknown/unknown -
nginx:v1 application/vnd.oci.image.index.v1+json sha256:dc53c8f25a10f9109190ed5b59bda2d707a3bde0e45857ce9e1efaa32ff9cbc1 68.9 MiB linux/386,linux/amd64,linux/arm/v5,linux/arm/v7,linux/arm64/v8,linux/mips64le,linux/ppc64le,linux/s390x,unknown/unknown -
挂载及设备忙的情况下取消挂载
[root@localhost ~]# ctr images mount nginx:v1 /mnt
sha256:aaf04d5578cafbc01630c4306d4fbdab214997b9ae3d164cb99da9525f3dcd19
/mnt
[root@localhost ~]# df -h
/dev/nvme0n1p2 974M 174M 733M 20% /boot
overlay 191G 3.1G 179G 2% /mnt
[root@localhost ~]# ctr images unmount /mnt/
ctr: failed to unmount target /mnt/: device or resource busy
[root@localhost ~]# lsof /mnt
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
sftp-serv 3253 root 9r DIR 0,49 4096 268232 /mnt
[root@localhost ~]# kill -9 3253
[root@localhost ~]# ctr images unmount /mnt/
/mnt/
[root@localhost ~]# df -h
查看不到/mnt
3、容器类操作（containerd本身不支持端口映射功能，端口映射通常是由容器运行时（比如docker、cri-o）负责的，而不是容器的底层运行时（containerd）.
创建
[root@localhost ~]# ctr containers create nginx:v1 nginx
列出
[root@localhost ~]# ctr containers ls
CONTAINER IMAGE RUNTIME
nginx nginx:v1 io.containerd.runc.v2
4、任务类操作
启动容器
[root@localhost ~]# ctr task start -d nginx
查看容器
[root@localhost ~]# ctr task ls
TASK PID STATUS
nginx 3567 RUNNING
进入容器
[root@localhost ~]# ctr task exec --exec-id 0 -t nginx sh
# ls
bin docker-entrypoint.d home media proc sbin tmp
boot docker-entrypoint.sh lib mnt root srv usr
dev etc lib64 opt run sys var
暂停容器
[root@localhost ~]# ctr task ls
TASK PID STATUS
nginx 3567 RUNNING
[root@localhost ~]# ctr task pause nginx
[root@localhost ~]# ctr task ls
TASK PID STATUS
nginx 3567 PAUSED
恢复容器
[root@localhost ~]# ctr task ls
TASK PID STATUS
nginx 3567 PAUSED
[root@localhost ~]# ctr task resume nginx
[root@localhost ~]# ctr task ls
TASK PID STATUS
nginx 3567 RUNNING
杀死容器及删除任务
[root@localhost ~]# ctr task kill nginx
[root@localhost ~]# ctr task ls
TASK PID STATUS
nginx 3567 STOPPED
[root@localhost ~]# ctr task rm nginx
5、命名空间相关
查看
[root@localhost ~]# ctr ns ls
NAME LABELS
default
创建
[root@localhost ~]# ctr ns create ooos
[root@localhost ~]# ctr ns ls
NAME LABELS
default
ooos
用ooos命名空间
拉取
[root@localhost ~]# ctr -n ooos images pull docker.io/library/nginx:latest --platform linux/amd64 --hosts-dir=/etc/containerd/certs.d/
重命名
[root@localhost ~]# ctr -n ooos images tag docker.io/library/nginx:latest nginx:v1nginx:v1
创建容器
[root@localhost ~]# ctr -n ooos containers create nginx:v1 nginx01
查看容器
[root@localhost ~]# ctr -n ooos containers ls
CONTAINER IMAGE RUNTIME
nginx01 nginx:v1 io.containerd.runc.v2
开启任务
[root@localhost ~]# ctr -n ooos task start -d nginx01
查看任务
[root@localhost ~]# ctr -n ooos task ls
TASK PID STATUS
nginx01 3840 RUNNING