Containerd 安装：二进制方式

一、环境准备

1.1 服务器硬件配置

1.2 版本说明

1.3 下载

Containerd有两种安装包：

• 第一种是containerd-xxx,这种包用于单机测试没问题，不包含runC，需要提前安装。
• 第二种是cri-containerd-cni-xxxx，包含runC和K8S里的所需要的相关文件。K8S集群里需要用到此包。虽然包含runC，但是依赖系统中的seccomp（安全计算模式，是一种限制容器调用系统资源的模式。）

下载安装包：

[root@localhost]# wget https://github.com/containerd/containerd/releases/download/v1.7.11/cri-containerd-cni-1.7.11-linux-amd64.tar.gz

二、安装Containerd

2.1 解压

[root@localhost]# tar xf cri-containerd-cni-1.7.11-linux-amd64.tar.gz

2.2 查看文件

# 查看解压后目录
[root@localhost]# ls
etc opt  usr


#查看etc目录，主要为containerd服务管理配置文件及cni虚拟网卡配置文件
[root@localhost]# ls etc
cni  crictl.yaml  systemd

[root@localhost]# ls etc/systemd/
system

[root@localhost]# ls etc/systemd/system/
containerd.service

#查看opt目录，主要为gce环境中使用containerd配置文件及cni插件
[root@localhost]# ls opt
cni  containerd

[root@localhost]# ls opt/containerd/
cluster

[root@localhost]# ls opt/containerd/cluster/
gce  version

[root@localhost]# ls opt/containerd/cluster/gce
cloud-init  cni.template  configure.sh  env

# 查看usr目录，主要为containerd运行时文件，包含runc
[root@localhost]# ls usr
local

[root@localhost]# ls usr/local/
bin  sbin

[root@localhost]# ls usr/local/bin
containerd  containerd-shim  containerd-shim-runc-v1  containerd-shim-runc-v2  containerd-stress  crictl  critest  ctd-decoder  ctr

[root@localhost]# ls usr/local/sbin
runc

2.3 查看containerd安装位置

# 查看containerd.service文件，了解containerd文件安装位置
[root@localhost]# cat etc/systemd/system/containerd.service

# Copyright The containerd Authors.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

[Unit]
Description=containerd container runtime
Documentation=https://containerd.io
After=network.target local-fs.target

[Service]
ExecStartPre=-/sbin/modprobe overlay
ExecStart=/usr/local/bin/containerd #查看此位置,把containerd二进制文件放置于此处即可完成安装。

Type=notify
Delegate=yes
KillMode=process
Restart=always
RestartSec=5
# Having non-zero Limit*s causes performance problems due to accounting overhead
# in the kernel. We recommend using cgroups to do container-local accounting.
LimitNPROC=infinity
LimitCORE=infinity
LimitNOFILE=infinity
# Comment TasksMax if your systemd version does not supports it.
# Only systemd 226 and above support this version.
TasksMax=infinity
OOMScoreAdjust=-999

[Install]
WantedBy=multi-user.target

2.4 复制containerd运行时文件至系统

# 查看宿主机/usr/local/bin目录，里面没有任何内容。
[root@localhost]# ls /usr/local/bin/

# 查看解压后usr/local/bin目录，里面包含containerd运行时文件
[root@localhost]# ls usr/
local

[root@localhost]# ls usr/local/
bin  sbin

[root@localhost]# ls usr/local/bin/
containerd  containerd-shim  containerd-shim-runc-v1  containerd-shim-runc-v2  containerd-stress  crictl  critest  ctd-decoder  ctr

# 复制containerd文件至/usr/local/bin目录中，本次可仅复制containerd一个文件也可复制全部文件。
[root@localhost]# cp usr/local/bin/containerd /usr/local/bin/

[root@localhost]# ls /usr/local/bin/
containerd

2.5 添加containerd.service文件至系统

# 查看解压后的etc/system目录
[root@localhost]# ls etc
cni  crictl.yaml  systemd

[root@localhost]# ls etc/systemd/
system

[root@localhost]# ls etc/systemd/system/
containerd.service

# 复制containerd服务管理配置文件至/usr/lib/systemd/system/目录中
[root@localhost]# cp etc/systemd/system/containerd.service /usr/lib/systemd/system/containerd.service

# 查看复制后结果
[root@localhost]# ls /usr/lib/systemd/system/containerd.service
/usr/lib/systemd/system/containerd.service

2.6 查看使用帮助

[root@localhost]# containerd --help

2.7 生成配置文件

新建配置文件目录

[root@localhost]# mkdir /etc/containerd

生成默认配置文件

[root@localhost]# containerd config default > /etc/containerd/config.toml

查看配置文件

[root@centos]# cat /etc/containerd/config.toml

配置文件内容如下：

root = "/var/lib/containerd"
state = "/run/containerd"
oom_score = -999
 
[grpc]
  address = "/run/containerd/containerd.sock"
  uid = 0
  gid = 0
  max_recv_message_size = 16777216
  max_send_message_size = 16777216
 
[debug]
  address = ""
  uid = 0
  gid = 0
  level = ""
 
[metrics]
  address = ""
  grpc_histogram = false
 
[cgroup]
  path = ""
 
[plugins]
  [plugins.cgroups]
    no_prometheus = false
  [plugins.cri]
    stream_server_address = "127.0.0.1"
    stream_server_port = "0"
    enable_selinux = false
    sandbox_image = "easzlab/pause-amd64:3.2"
    stats_collect_period = 10
    systemd_cgroup = false
    enable_tls_streaming = false
    max_container_log_line_size = 16384
    [plugins.cri.containerd]
      snapshotter = "overlayfs"
      no_pivot = false
      [plugins.cri.containerd.default_runtime]
        runtime_type = "io.containerd.runtime.v1.linux"
        runtime_engine = ""
        runtime_root = ""
      [plugins.cri.containerd.untrusted_workload_runtime]
        runtime_type = ""
        runtime_engine = ""
        runtime_root = ""
    [plugins.cri.cni]
      bin_dir = "/opt/kube/bin"
      conf_dir = "/etc/cni/net.d"
      conf_template = "/etc/cni/net.d/10-default.conf"
    [plugins.cri.registry]
      [plugins.cri.registry.mirrors]
        [plugins.cri.registry.mirrors."docker.io"]
          endpoint = [
            "https://docker.mirrors.ustc.edu.cn",
            "http://hub-mirror.c.163.com"
          ]
        [plugins.cri.registry.mirrors."gcr.io"]
          endpoint = [
            "https://gcr.mirrors.ustc.edu.cn"
          ]
        [plugins.cri.registry.mirrors."k8s.gcr.io"]
          endpoint = [
            "https://gcr.mirrors.ustc.edu.cn/google-containers/"
          ]
        [plugins.cri.registry.mirrors."quay.io"]
          endpoint = [
            "https://quay.mirrors.ustc.edu.cn"
          ]
        [plugins.cri.registry.mirrors."harbor.example.com"] # 此处添加了本地容器镜像仓库 Harbor,做为本地容器镜像仓库。
          endpoint = [
            "http://harbor.example.com"
          ]
    [plugins.cri.x509_key_pair_streaming]
      tls_cert_file = ""
      tls_key_file = ""
  [plugins.diff-service]
    default = ["walking"]
  [plugins.linux]
    shim = "containerd-shim"
    runtime = "runc"
    runtime_root = ""
    no_shim = false
    shim_debug = false
  [plugins.opt]
    path = "/opt/containerd"
  [plugins.restart]
    interval = "10s"
  [plugins.scheduler]
    pause_threshold = 0.02
    deletion_threshold = 0
    mutation_threshold = 100
    schedule_delay = "0s"
    startup_delay = "100ms"

2.8 复制ctr命令至系统

[root@localhost]# ls usr/local/bin/
containerd  containerd-shim  containerd-shim-runc-v1  containerd-shim-runc-v2  containerd-stress  crictl  critest  ctd-decoder  ctr

[root@localhost]# cp usr/local/bin/ctr /usr/bin/

2.9 配置开机自启并启动

配置开机自启

[root@localhost]# systemctl enable containerd

启动

[root@localhost]# systemctl start containerd

三、安装 runC

由于二进制包中提供的runC默认需要系统中安装seccomp支持，需要单独安装，且不同版本runC对seccomp版本要求一致，所以建议单独下载runC二进制包进行安装，里面包含了seccomp模块支持。

3.1 下载

[root@localhost]# wget https://github.com/opencontainers/runc/releases/download/v1.1.11/runc.amd64

3.2 安装验证

[root@localhost]# mv runc.amd64 /usr/sbin/runc

# 为runC添加可执行权限
[root@localhost]# chmod +x /usr/sbin/runc

# 使用runc命令验证是否安装成功
[root@localhost]# runc -v

runc version 1.1.11
commit: v1.1.11-0-g4bccb38c
spec: 1.0.2-dev
go: go1.20.12
libseccomp: 2.5.4