Containerd 容器安装

# 下载
wget https://github.com/containerd/containerd/releases/download/v1.7.22/containerd-1.7.22-linux-amd64.tar.gz
# 解压
tar -zxvf containerd-1.7.22-linux-amd64.tar.gz
# 移动
mv bin/* /usr/local/bin/

-> # ctr version
Client:
  Version:  v1.7.22
  Revision: 7f7fdf5fed64eb6a7caf99b3e12efcf9d60e311c
  Go version: go1.22.7

wget https://github.com/opencontainers/runc/releases/download/v1.1.14/runc.amd64

# 移动
mv runc.amd64 /usr/local/bin/runc

wget https://github.com/kubernetes-sigs/cri-tools/releases/download/v1.31.1/crictl-v1.31.1-linux-amd64.tar.gz
# 解压
tar -zxvf crictl-v1.31.1-linux-amd64.tar.gz
# 移动
mv crictl /usr/local/bin/

-> # crictl version
crictl info 

# 查看 sock文件
cat /etc/containerd/config.toml | grep sock

# 验证
crictl --runtime-endpoint=unix:///run/containerd/containerd.sock  version

# 方法一：创建文件
cat > /etc/crictl.yaml <<EOF
runtime-endpoint: unix:///run/containerd/containerd.sock
image-endpoint: unix:///run/containerd/containerd.sock
timeout: 0
debug: false
pull-image-on-create: false
EOF

# 方法二：环境变量
export CONTAINER_RUNTIME_ENDPOINT=unix:///run/containerd/containerd.sock
export IMAGE_SERVICE_ENDPOINT=unix:///run/containerd/containerd.sock

# 生成配置文件
mkdir -p /etc/containerd
containerd config default > /etc/containerd/config.toml

vim /etc/containerd/config.toml

# root
sed -i 's/\/var\/lib\/containerd/\/data01\/containerd/'  /etc/containerd/config.toml

# systemd
sed -i 's/SystemdCgroup = false/SystemdCgroup = true/'  /etc/containerd/config.toml

#  sandbox_image
sed -i 's/sandbox_image.*/sandbox_image = "registry.aliyuncs.com\/google_containers\/pause:3.8"/' /etc/containerd/config.toml

#  registry.mirrors
sed -i 's|^config_path[[:space:]]*=.*|config_path = "/etc/containerd/certs.d"|' /etc/containerd/config.toml

# 检查
cat /etc/containerd/config.toml |grep -E "root|SystemdCgroup|sandbox_image|config_path"|grep -v root_path|grep -v runtime_root

# root = "/data01/containerd"
#     sandbox_image = "registry.aliyuncs.com/google_containers/pause:3.8"
#             SystemdCgroup = true

# docker hub镜像加速
mkdir -p /etc/containerd/certs.d

mkdir -p /etc/containerd/certs.d/docker.io

cat > /etc/containerd/certs.d/docker.io/hosts.toml << EOF
server = "https://docker.io"
[host."https://dockerproxy.com"]
  capabilities = ["pull", "resolve"]

[host."https://docker.m.daocloud.io"]
  capabilities = ["pull", "resolve"]

[host."https://reg-mirror.qiniu.com"]
  capabilities = ["pull", "resolve"]

[host."https://registry.docker-cn.com"]
  capabilities = ["pull", "resolve"]

[host."http://hub-mirror.c.163.com"]
  capabilities = ["pull", "resolve"]
EOF

# 配置 config.toml
# 编辑 /etc/containerd/config.toml 文件，设置 config_path 指向你创建的证书目录
[plugins."io.containerd.grpc.v1.cri".registry]
config_path = "/etc/containerd/certs.d"

# 设置存储目录
root="/var/lib/containerd"

# 设置 cgroup = systemd
[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc.options]
  SystemdCgroup = true

# 设置镜像仓库
[plugins."io.containerd.grpc.v1.cri"]
  # sandbox_image = "registry.k8s.io/pause:3.8"
  sandbox_image = "registry.aliyuncs.com/google_containers/pause:3.9"

# 设置镜像仓库地址
[plugins."io.containerd.grpc.v1.cri".registry.mirrors]
  [plugins."io.containerd.grpc.v1.cri".registry.mirrors."docker.io"]
    endpoint = ["https://registry-1.docker.io"]
  [plugins."io.containerd.grpc.v1.cri".registry.mirrors."gcr.io"]
    endpoint = ["https://gcr.azk8s.cn/google-containers"]
  [plugins."io.containerd.grpc.v1.cri".registry.mirrors."k8s.gcr.io"]

cat > /etc/systemd/system/containerd.service <<EOF
[Unit]
Description=containerd container runtime
Documentation=https://containerd.io
After=network.target local-fs.target

[Service]
ExecStartPre=-/sbin/modprobe overlay
ExecStart=/usr/local/bin/containerd

Type=notify
Delegate=yes
KillMode=process
Restart=always
RestartSec=5

# Having non-zero Limit*s causes performance problems due to accounting overhead
# in the kernel. We recommend using cgroups to do container-local accounting.
LimitNPROC=infinity
LimitCORE=infinity

# Comment TasksMax if your systemd version does not supports it.
# Only systemd 226 and above support this version.
TasksMax=infinity
OOMScoreAdjust=-999

[Install]
WantedBy=multi-user.target
EOF

# 启动
systemctl daemon-reload
systemctl enable containerd --now