三、Containerd容器镜像管理

3.1.帮助命令

docker使用docker images命令管理镜像单机containerd使用ctr images命令管理镜像,containerd本身的CLIk8s中containerd使用crictl images命令管理镜像,Kubernetes社区的专用CLI工具

#命令帮助
[root@localhost ~]# ctr --help
NAME:
ctr -
__
_____/ /______
/ ___/ __/ ___/
/ /__/ /_/ /
\___/\__/_/
containerd CLI
USAGE:
ctr [global options] command [command options] [arguments...]
VERSION:
v1.6.32
DESCRIPTION:
ctr is an unsupported debug and administrative client for interacting
with the containerd daemon. Because it is unsupported, the commands,
options, and operations are not guaranteed to be backward compatible or
stable from release to release of the containerd project.
COMMANDS:
plugins, plugin            provides information about containerd plugins
version                    print the client and server versions
containers, c, container   manage containers
content                    manage content
events, event              display containerd events
images, image, i           manage images
leases                     manage leases
namespaces, namespace, ns  manage namespaces
pprof                      provide golang pprof outputs for containerd
run                        run a container
snapshots, snapshot        manage snapshots
tasks, t, task             manage tasks
install                    install a new package
oci                        OCI tools
deprecations
shim                       interact with a shim directly
help, h                    Shows a list of commands or help for one command
GLOBAL OPTIONS:
--debug                      enable debug output in logs
--address value, -a value    address for containerd's GRPC server (default:
"/run/containerd/containerd.sock") [$CONTAINERD_ADDRESS]
--timeout value              total timeout for ctr commands (default: 0s)
--connect-timeout value      timeout for connecting to containerd (default:
0s)
--namespace value, -n value  namespace to use with commands (default:
"default") [$CONTAINERD_NAMESPACE]
--help, -h                   show help
--version, -v                print the version

# 子命令帮助
[root@localhost ~]# ctr images --help
NAME:
ctr images - manage images
USAGE:
ctr images command [command options] [arguments...]
COMMANDS:
check                    check existing images to ensure all content is
available locally
export                   export images
import                   import images
list, ls                 list images known to containerd
mount                    mount an image to a target path
unmount                  unmount the image from the target
pull                     pull an image from a remote
push                     push an image to a remote
delete, del, remove, rm  remove one or more images by reference
tag                      tag an image
label                    set and clear labels for an image
convert                  convert an image
OPTIONS:
--help, -h  show help

3.2.查看镜像

[root@docker ~]# ctr images list
REF TYPE DIGEST SIZE PLATFORMS LABELS
[root@docker ~]# ctr images ls
REF TYPE DIGEST SIZE PLATFORMS LABELS
[root@docker ~]# ctr image list
REF TYPE DIGEST SIZE PLATFORMS LABELS
[root@docker ~]# ctr image ls
REF TYPE DIGEST SIZE PLATFORMS LABELS
[root@docker ~]# ctr i list
REF TYPE DIGEST SIZE PLATFORMS LABELS
[root@docker ~]# ctr i ls
REF TYPE DIGEST SIZE PLATFORMS LABELS

3.3.下载镜像

containerd支持oci标准的镜像，所以可以直接使用docker官方或dockerfile构建的镜像

# 这里ctr命令pull镜像时，不能直接把镜像名字写成nginx:alpine
[root@localhost ~]# ctr images pull 054b8ac70e8010d90f2ac00ef29e6580.mirror.swr.myhuaweicloud.com/library/nginx:latest
# 验证现象
[root@localhost ~]# ctr image ls 
REF TYPE                                    DIGEST SIZE     PLATFORMS LABELS
054b8ac70e8010d90f2ac00ef29e6580.mirror.swr.myhuaweicloud.com/library/nginx:lates
t application/vnd.oci.image.index.v1+json
sha256:84ec966e61a8c7846f509da7eb081c55c1d56817448728924a87ab32f12a72fb 68.9 MiB
linux/386,linux/amd64,linux/arm/v5,linux/arm/v7,linux/arm64/v8,linux/mips64le,lin
ux/ppc64le,linux/s390x,unknown/unknown -

3.4.镜像挂载

方便查看镜像中包含的内容

# 挂载
[root@localhost ~]# ctr images mount 054b8ac70e8010d90f2ac00ef29e6580.mirror.swr.myhuaweicloud.com/library/nginx:latest /mnt
sha256:3c1159cd77f83ede793fc21502ae30b39b04378b6b1b625451d701d555cc1cb9/mnt
# 查看挂载
[root@localhost ~]# ls /mnt
bin  boot  dev  docker-entrypoint.d  docker-entrypoint.sh  etc  home  lib  lib64
media  mnt  opt  proc  root  run  sbin  srv  sys  tmp  usr  var
# 卸载
[root@localhost ~]# umount /mnt

3.5.镜像导出

#--platform linux/amd64,导出指定平台镜像
[root@localhost ~]# ctr i export --platform linux/amd64 nginx.tar 054b8ac70e8010d90f2ac00ef29e6580.mirror.swr.myhuaweicloud.com/library/nginx:latest
# 列出目录
[root@localhost ~]# ls
nginx.tar

3.6.镜像删除

# ctr image rm帮助
[root@localhost ~]# ctr image rm --help
NAME:
ctr images delete - remove one or more images by reference
USAGE:
ctr images delete [command options] [flags] <ref> [<ref>, ...]
DESCRIPTION:
remove one or more images by reference
OPTIONS:
--sync  Synchronously remove image and all associated resources

# 删除指定镜像
[root@localhost ~]# ctr image rm 054b8ac70e8010d90f2ac00ef29e6580.mirror.swr.myhuaweicloud.com/library/nginx:latest
054b8ac70e8010d90f2ac00ef29e6580.mirror.swr.myhuaweicloud.com/library/nginx:latest
# 验证现象
[root@localhost ~]# ctr image ls
REF TYPE DIGEST SIZE PLATFORMS LABELS

3.7.镜像导入

# 导入镜像
[root@localhost ~]# ctr images import --platform linux/amd64 nginx.tar 
unpacking 
054b8ac70e8010d90f2ac00ef29e6580.mirror.swr.myhuaweicloud.com/library/nginx:latest
(sha256:84ec966e61a8c7846f509da7eb081c55c1d56817448728924a87ab32f12a72fb)...done
# 验证现象
[root@localhost ~]# ctr image ls 
REF TYPE                                    DIGEST SIZE     PLATFORMS LABELS
054b8ac70e8010d90f2ac00ef29e6580.mirror.swr.myhuaweicloud.com/library/nginx:lates
t application/vnd.oci.image.index.v1+json
sha256:84ec966e61a8c7846f509da7eb081c55c1d56817448728924a87ab32f12a72fb 68.9 MiB
linux/386,linux/amd64,linux/arm/v5,linux/arm/v7,linux/arm64/v8,linux/mips64le,lin
ux/ppc64le,linux/s390x,unknown/unknown -

3.8.修改镜像tag

# 把054b8ac70e8010d90f2ac00ef29e6580.mirror.swr.myhuaweicloud.com/library/nginx:latest 修改为 nginx:latest
[root@localhost ~]# ctr images tag 054b8ac70e8010d90f2ac00ef29e6580.mirror.swr.myhuaweicloud.com/library/nginx:latest nginx:latest
nginx:latest

# 验证现象
[root@localhost ~]# ctr image ls REF TYPE                                    DIGEST SIZE     PLATFORMS LABELS
054b8ac70e8010d90f2ac00ef29e6580.mirror.swr.myhuaweicloud.com/library/nginx:lates
t application/vnd.oci.image.index.v1+json
sha256:84ec966e61a8c7846f509da7eb081c55c1d56817448728924a87ab32f12a72fb 68.9 MiB
linux/386,linux/amd64,linux/arm/v5,linux/arm/v7,linux/arm64/v8,linux/mips64le,lin
ux/ppc64le,linux/s390x,unknown/unknown -
nginx:latest
application/vnd.oci.image.index.v1+json
sha256:84ec966e61a8c7846f509da7eb081c55c1d56817448728924a87ab32f12a72fb 68.9 MiB
linux/386,linux/amd64,linux/arm/v5,linux/arm/v7,linux/arm64/v8,linux/mips64le,lin
ux/ppc64le,linux/s390x,unknown/unknown -

四、Containerd容器管理

1.获取命令帮助
[root@localhost ~]# ctr --help                  #ctr命令帮助
NAME:
ctr -
__
_____/ /______
/ ___/ __/ ___/
/ /__/ /_/ /
\___/\__/_/
containerd CLI
USAGE:
ctr [global options] command [command options] [arguments...]
VERSION:
v1.6.32
DESCRIPTION:
ctr is an unsupported debug and administrative client for interacting
with the containerd daemon. Because it is unsupported, the commands,
options, and operations are not guaranteed to be backward compatible or
stable from release to release of the containerd project.
COMMANDS:
plugins, plugin            provides information about containerd plugins
version                    print the client and server versions
containers, c, container   manage containers
content                    manage content
events, event              display containerd events
images, image, i           manage images
leases                     manage leases
namespaces, namespace, ns  manage namespaces
pprof                      provide golang pprof outputs for containerd
run                        run a container
snapshots, snapshot        manage snapshots
tasks, t, task             manage tasks
install                    install a new package
oci                        OCI tools
deprecations
shim                       interact with a shim directly
help, h                    Shows a list of commands or help for one command
GLOBAL OPTIONS:
--debug                      enable debug output in logs
--address value, -a value    address for containerd's GRPC server (default:
"/run/containerd/containerd.sock") [$CONTAINERD_ADDRESS]
--timeout value              total timeout for ctr commands (default: 0s)
--connect-timeout value      timeout for connecting to containerd (default:
0s)
--namespace value, -n value  namespace to use with commands (default:
"default") [$CONTAINERD_NAMESPACE]
--help, -h                   show help
--version, -v                print the version

# containerd命令行工具
[root@localhost ~]# ctr container --help     #获取创建静态容器命令帮助   使用`ctr container create `命令创建容器后，容器并没有处于运行状态，只是一个静态的容器。这个container 对象只是包含了运行一个容器所需的资源及配置的数据结构，例如： namespaces、rootfs 和容器的配置都已经初始化成功了，只是用户进程(本案例为nginx)还没有启动。需要使用`ctr tasks`命令才能获取一个动态容器。
NAME:
ctr containers - manage containers
USAGE:
ctr containers command [command options] [arguments...]
COMMANDS:
create                   create container
delete, del, remove, rm  delete one or more existing containers
info                     get info about a container
list, ls                 list containers
label                    set and clear labels for a container
checkpoint               checkpoint a container
restore                  restore a container from checkpoint
OPTIONS:
--help, -h  show help

[root@localhost ~]# ctr run --help             # 使用ctr run命令可以创建一个静态容器并使其运行。一步到位运行容器。
NAME:
ctr run - run a container
USAGE:
ctr run [command options] [flags] Image|RootFS ID [COMMAND] [ARG...]
OPTIONS:
--rm                                    remove the container after running,
cannot be used with --detach
--null-io                               send all IO to /dev/null
--log-uri value                         log uri
--detach, -d                            detach from the task after it has
started execution, cannot be used with --rm
--fifo-dir value                        directory used for storing IO FIFOs
--cgroup value                          cgroup path (To disable use of cgroup,
set to "" explicitly)
--platform value                        run image for specific platform
--cni                                   enable cni networking for the
container
--runc-binary value                     specify runc-compatible binary
--runc-root value                       specify runc-compatible root
--runc-systemd-cgroup                   start runc with systemd cgroup manager
--uidmap container-uid:host-uid:length  run inside a user namespace with the
specified UID mapping range; specified with the format container-uid:host-
uid:length
--gidmap container-gid:host-gid:length  run inside a user namespace with the
specified GID mapping range; specified with the format container-gid:host-
gid:length
--remap-labels                          provide the user namespace ID
remapping to the snapshotter via label options; requires snapshotter support
--cpus value                            set the CFS cpu quota (default: 0)
--cpu-shares value                      set the cpu shares (default: 1024)
--snapshotter value                     snapshotter name. Empty value stands
for the default value. [$CONTAINERD_SNAPSHOTTER]
--snapshotter-label value               labels added to the new snapshot for
this container.
--config value, -c value                path to the runtime-specific spec
config file
--cwd value                             specify the working directory of the
process
--env value                             specify additional container
environment variables (e.g. FOO=bar)
--env-file value                        specify additional container
environment variables in a file(e.g. FOO=bar, one per line)
--label value                           specify additional labels (e.g.
foo=bar)
--annotation value                      specify additional OCI annotations
(e.g. foo=bar)
--mount value                           specify additional container mount
(e.g. type=bind,src=/tmp,dst=/host,options=rbind:ro)
--net-host                              enable host networking for the
container
--privileged                            run privileged container
--read-only                             set the containers filesystem as
readonly
--runtime value                         runtime name (default:
"io.containerd.runc.v2")
--runtime-config-path value             optional runtime config path
--tty, -t                               allocate a TTY for the container
--with-ns value                         specify existing Linux namespaces to
join at container runtime (format '<nstype>:<path>')
--pid-file value                        file path to write the task's pid
--gpus value                            add gpus to the container
--allow-new-privs                       turn off OCI spec's NoNewPrivileges
feature flag
--memory-limit value                    memory limit (in bytes) for the
container (default: 0)
--device value                          file path to a device to add to the
container; or a path to a directory tree of devices to add to the container
--cap-add value                         add Linux capabilities (Set
capabilities with 'CAP_' prefix)
--cap-drop value                        drop Linux capabilities (Set
capabilities with 'CAP_' prefix)
--seccomp                               enable the default seccomp profile
--seccomp-profile value                 file path to custom seccomp profile.
seccomp must be set to true, before using seccomp-profile
--apparmor-default-profile value        enable AppArmor with the default
profile with the specified name, e.g. "cri-containerd.apparmor.d"
--apparmor-profile value                enable AppArmor with an existing
custom profile
--rdt-class value                       name of the RDT class to associate the
container with. Specifies a Class of Service (CLOS) for cache and memory
bandwidth management.
--rootfs                                use custom rootfs that is not managed
by containerd snapshotter
--no-pivot                              disable use of pivot-root (linux only)
--cpu-quota value                       Limit CPU CFS quota (default: -1)
--cpu-period value                      Limit CPU CFS period (default: 0)
--rootfs-propagation value              set the propagation of the container
rootfs

2.查看容器(container表示静态容器，可用c缩写代表container)
[root@localhost ~]# ctr container ls     # 可以简写为 ctr c ls
CONTAINER    IMAGE    RUNTIME

3.查看任务(task表示容器里跑的进程, 可用t缩写代表task)
[root@localhost ~]# ctr task ls       # 可以简写为 ctr t ls
TASK    PID    STATUS

4.创建静态容器
[root@localhost ~]# ctr container create nginx:latest nginx1
[root@localhost ~]# ctr container ls
CONTAINER    IMAGE           RUNTIME
nginx1       nginx:latest    io.containerd.runc.v2
[root@localhost ~]# ctr container info nginx1

5.静态容器启动为动态容器
[root@localhost ~]# ctr task ls
TASK    PID    STATUS
[root@localhost ~]# ctr task start -d nginx1       #启动task，即表示在容器中运行了进程，即为动态容器 -d 后台
[root@localhost ~]# ctr task ls     #容器是以宿主机进程的方式存在的
TASK      PID      STATUS
nginx1    22614    RUNNING
[root@localhost ~]# ps aux | grep 22614
root       22614  0.0  0.0  11468  7196 ?        Ss   15:40   0:00 nginx: master
process nginx -g daemon off;
root       22969  0.0  0.0  12216  1104 pts/0    S+   15:41   0:00 grep --
color=auto 22614

6.进入容器操作
[root@localhost ~]# ctr task exec --exec-id $RANDOM -t nginx1 /bin/sh   #为exec进程设定一个id，可以随意输入，只要保证唯一即可，也可使用$RANDOM变量

7.直接运行一个动态容器
[root@localhost ~]# ctr run -d --net-host nginx:latest nginx2     # --net-host 代表容器的IP就是宿主机的IP(相当于docker里的host类型网络)

8.暂停容器
[root@localhost ~]# ctr tasks pause nginx2
[root@localhost ~]# ctr task ls
TASK      PID      STATUS
nginx1    22614    RUNNING
nginx2    25569    PAUSED            #状态为PAUSED，表示暂停

9.恢复容器
[root@localhost ~]# ctr tasks resume nginx2
[root@localhost ~]# ctr task ls
TASK      PID      STATUS
nginx1    22614    RUNNING
nginx2    25569    RUNNING        #恢复RUNNING

10.停止容器
[root@localhost ~]# ctr tasks kill nginx2
[root@localhost ~]# ctr tasks ls
TASK      PID      STATUS
nginx1    22614    RUNNING
nginx2    25569    STOPPED      #容器停止后STATUS为STOPPED

11.删除容器
[root@localhost ~]# ctr tasks delete nginx2     #必须先停止tasks或先删除task，再删除容器
[root@localhost ~]# ctr tasks ls
TASK      PID      STATUS
nginx1    22614    RUNNING
[root@localhost ~]# ctr container ls              # 查看静态容器，确认其还存在于系统中
CONTAINER    IMAGE           RUNTIME
nginx1       nginx:latest    io.containerd.runc.v2
nginx2       nginx:latest    io.containerd.runc.v2

[root@localhost ~]# ctr container delete nginx2
[root@localhost ~]# ctr container ls
CONTAINER    IMAGE           RUNTIME
nginx1       nginx:latest    io.containerd.runc.v2

五、Containerd使用私有容器镜像仓库

Harbor

# 手动在containerd宿主机上添加此配置信息,如果域名解析已存在忽略
[root@localhost ~]# vim /etc/hosts
192.168.108.30 my.harbor.com

# harbor仓库需要提前在192.168.108.30上部署(参考docker教案)，镜像需要提前传到harbor上，如果有使用https可以使用--plain-http 指定http协议
[root@localhost ~]# ctr image pull --plain-http 192.168.108.30/cloud/nginx:latest

# 上传镜像到Harbor
[root@localhost ~]# ctr images tag nginx:latest my.harbor.com/cloud/nginx:latest
[root@localhost ~]# ctr image push --platform linux/amd64 --plain-http --user "images_admin:Cloud12#$" my.harbor.com/cloud/nginx:latest
manifest-sha256:6533ddd664582430971e93e69cf343e3bfffceadeaaa97d4379c4d7a29f21d47:
done           |++++++++++++++++++++++++++++++++++++++|
config-sha256:2cd1d97f893f70cee86a38b7160c30e5750f3ed6ad86c598884ca9c6a563a501:
done           |++++++++++++++++++++++++++++++++++++++|
elapsed: 0.1 s

六、Containerd NameSpace管理

containerd中namespace的作用为隔离运行的容器，可以实现运行多个容器

1.列出已有namespace
[root@localhost ~]# ctr namespace ls
NAME    LABELS
default                 #containerd默认工作在default命名空间
[root@docker ~]# ctr namespace ls    #在docker环境中打
NAME LABELS
moby                        #docker默认工作在moby空间

2.创建namespace
[root@localhost ~]# ctr namespace create myns
[root@localhost ~]# ctr namespace create testns
[root@localhost ~]# ctr namespace ls
NAME    LABELS
default
myns
testns

3.删除namespace

[root@localhost ~]# ctr namespace rm testns testns
[root@localhost ~]# ctr namespace ls
NAME    LABELS
default
myns

4.查看指定namespace中镜像
[root@localhost ~]# ctr -n myns images ls
REF TYPE DIGEST SIZE PLATFORMS LABELS

5.查看指定namespace中是否有用户进程在运行
[root@localhost ~]# ctr -n myns tasks ls
TASK    PID    STATUS
6.在指定namespace中下载容器镜像
[root@localhost ~]# ctr -n myns images pull 054b8ac70e8010d90f2ac00ef29e6580.mirror.swr.myhuaweicloud.com/library/nginx:latest
[root@localhost ~]# ctr -n myns images ls 
REF TYPE                                    DIGEST SIZE     PLATFORMS LABELS

054b8ac70e8010d90f2ac00ef29e6580.mirror.swr.myhuaweicloud.com/library/nginx:lates
t application/vnd.oci.image.index.v1+json
sha256:84ec966e61a8c7846f509da7eb081c55c1d56817448728924a87ab32f12a72fb 68.9 MiB
linux/386,linux/amd64,linux/arm/v5,linux/arm/v7,linux/arm64/v8,linux/mips64le,lin
ux/ppc64le,linux/s390x,unknown/unknown -

7.在指定namespace中创建静态容器
[root@localhost ~]# ctr -n myns container create 054b8ac70e8010d90f2ac00ef29e6580.mirror.swr.myhuaweicloud.com/library/nginx:latest mynginx

8.查看在指定namespace中创建的容器
[root@localhost ~]# ctr -n myns container ls
CONTAINER    IMAGE
RUNTIME
mynginx
054b8ac70e8010d90f2ac00ef29e6580.mirror.swr.myhuaweicloud.com/library/nginx:lates
t    io.containerd.runc.v2
[root@localhost ~]# ctr -n myns task start -d mynginx
[root@localhost ~]# ctr -n myns tasks ls

TASK       PID     STATUS
mynginx    5873    RUNNING