tech/知识/containerd.md

containerd

安装 containerd & runc

更新系统并安装依赖

# 更新系统并安装依赖
sudo apt update && sudo apt upgrade -y
sudo apt install -y apt-transport-https ca-certificates curl gnupg

# 临时关闭
sudo swapoff -a

# 永久禁用：编辑 /etc/fstab 文件，注释掉 swap 相关的行
# 找到类似下面这行，在行首加上 #
# /swap.img      none    swap    sw      0       0
sudo sed -i 's/\/swap.img/#\/swap.img/g' /etc/fstab
sudo cat /etc/fstab

# 关闭防火墙（生产环境建议配置规则）
sudo ufw status
sudo ufw disable

# 禁用 SELinux（如已安装）
sudo setenforce 0
sudo sed -i 's/^SELINUX=enforcing$/SELINUX=permissive/' /etc/selinux/config

# 配置主机名和 hosts 文件 (可选，但强烈推荐)
sudo hostnamectl set-hostname agent

# 配置系统参数
cat <<EOF | sudo tee /etc/modules-load.d/containerd.conf
overlay
br_netfilter
EOF

sudo modprobe overlay
sudo modprobe br_netfilter

# 设置网络参数
cat <<EOF | sudo tee /etc/sysctl.d/containerd.conf
net.bridge.bridge-nf-call-iptables  = 1
net.bridge.bridge-nf-call-ip6tables = 1
net.ipv4.ip_forward                 = 1
EOF
sudo sysctl --system

安装 containerd

• 安装 containerd

cd
wget https://github.com/containerd/containerd/releases/download/v2.1.4/containerd-2.1.4-linux-amd64.tar.gz
sudo tar Cxzvf /usr/local containerd-2.1.4-linux-amd64.tar.gz
wget https://raw.githubusercontent.com/containerd/containerd/main/containerd.service
sudo cp containerd.service /etc/systemd/system/
sudo systemctl daemon-reload
sudo systemctl enable --now containerd
sudo systemctl status containerd
ctr --version

• 安装 runc

wget https://github.com/opencontainers/runc/releases/download/v1.3.0/runc.amd64
sudo install -m 755 runc.amd64 /usr/local/bin/runc
runc --version

• 测试

# 拉取镜像
sudo ctr image pull docker.io/library/alpine:latest
# 运行容器，进入
sudo ctr run --rm -t docker.io/library/alpine:latest alpine sh
# 查看运行中容器
sudo ctr task ls
# 查看镜像
sudo ctr image ls
# 查看容器
sudo ctr container ls

sudo ctr image pull docker.io/library/nginx:latest
sudo ctr run \
    -d \
    --net-host \
    docker.io/library/nginx:latest \
    nginx
curl localhost
sudo ctr task kill nginx
sudo ctr container rm nginx

安装 nginx

sudo mkdir -p /data/nginx/{cert,conf.d,html}
sudo cat > /data/nginx/html/index.html << 'EOF'
hello world !
EOF
sudo cat > /data/nginx/nginx.conf << 'EOF'
user www-data;
worker_processes auto;
pid /run/nginx.pid;
error_log /var/log/nginx/error.log;
include /etc/nginx/modules-enabled/*.conf;

events {
    worker_connections 768;
}

http {
    sendfile on;
    tcp_nopush on;
    types_hash_max_size 2048;
    resolver 8.8.8.8 8.8.4.4 valid=300s ipv6=off;
    include /etc/nginx/mime.types;
    default_type application/octet-stream;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; # Dropping SSLv3, ref: POODLE
    ssl_prefer_server_ciphers on;
    access_log /var/log/nginx/access.log;
    gzip on;
    include /etc/nginx/conf.d/*.conf;
    include /etc/nginx/sites-enabled/*;
}
EOF
sudo ctr run \
    -d \
    --net-host \
    --mount type=bind,src=/data/nginx/cert,dst=/etc/nginx/cert,options=rbind \
    --mount type=bind,src=/data/nginx/conf.d,dst=/etc/nginx/conf.d,options=rbind \
    --mount type=bind,src=/data/nginx/nginx.conf,dst=/etc/nginx/nginx.conf,options=rbind \
    --mount type=bind,src=/data/nginx/html,dst=/usr/share/nginx/html,options=rbind \
    docker.io/library/nginx:latest \
    nginx
curl localhost
sudo ctr t exec --exec-id my1 nginx bash