144 lines
3.5 KiB
Markdown
144 lines
3.5 KiB
Markdown
# containerd
|
|
|
|
## 安装 containerd & runc
|
|
|
|
### 更新系统并安装依赖
|
|
|
|
```bash
|
|
# 更新系统并安装依赖
|
|
sudo apt update && sudo apt upgrade -y
|
|
sudo apt install -y apt-transport-https ca-certificates curl gnupg
|
|
|
|
# 临时关闭
|
|
sudo swapoff -a
|
|
|
|
# 永久禁用：编辑 /etc/fstab 文件，注释掉 swap 相关的行
|
|
# 找到类似下面这行，在行首加上 #
|
|
# /swap.img none swap sw 0 0
|
|
sudo sed -i 's/\/swap.img/#\/swap.img/g' /etc/fstab
|
|
sudo cat /etc/fstab
|
|
|
|
# 关闭防火墙（生产环境建议配置规则）
|
|
sudo ufw status
|
|
sudo ufw disable
|
|
|
|
# 禁用 SELinux（如已安装）
|
|
sudo setenforce 0
|
|
sudo sed -i 's/^SELINUX=enforcing$/SELINUX=permissive/' /etc/selinux/config
|
|
|
|
# 配置主机名和 hosts 文件 (可选，但强烈推荐)
|
|
sudo hostnamectl set-hostname agent
|
|
|
|
# 配置系统参数
|
|
cat <<EOF | sudo tee /etc/modules-load.d/containerd.conf
|
|
overlay
|
|
br_netfilter
|
|
EOF
|
|
|
|
sudo modprobe overlay
|
|
sudo modprobe br_netfilter
|
|
|
|
# 设置网络参数
|
|
cat <<EOF | sudo tee /etc/sysctl.d/containerd.conf
|
|
net.bridge.bridge-nf-call-iptables = 1
|
|
net.bridge.bridge-nf-call-ip6tables = 1
|
|
net.ipv4.ip_forward = 1
|
|
EOF
|
|
sudo sysctl --system
|
|
```
|
|
|
|
### 安装 containerd
|
|
|
|
- 安装 containerd
|
|
|
|
```bash
|
|
cd
|
|
wget https://github.com/containerd/containerd/releases/download/v2.1.4/containerd-2.1.4-linux-amd64.tar.gz
|
|
sudo tar Cxzvf /usr/local containerd-2.1.4-linux-amd64.tar.gz
|
|
wget https://raw.githubusercontent.com/containerd/containerd/main/containerd.service
|
|
sudo cp containerd.service /etc/systemd/system/
|
|
sudo systemctl daemon-reload
|
|
sudo systemctl enable --now containerd
|
|
sudo systemctl status containerd
|
|
ctr --version
|
|
```
|
|
|
|
- 安装 runc
|
|
|
|
```bash
|
|
wget https://github.com/opencontainers/runc/releases/download/v1.3.0/runc.amd64
|
|
sudo install -m 755 runc.amd64 /usr/local/bin/runc
|
|
runc --version
|
|
```
|
|
|
|
- 测试
|
|
|
|
```bash
|
|
# 拉取镜像
|
|
sudo ctr image pull docker.io/library/alpine:latest
|
|
# 运行容器，进入
|
|
sudo ctr run --rm -t docker.io/library/alpine:latest alpine sh
|
|
# 查看运行中容器
|
|
sudo ctr task ls
|
|
# 查看镜像
|
|
sudo ctr image ls
|
|
# 查看容器
|
|
sudo ctr container ls
|
|
|
|
sudo ctr image pull docker.io/library/nginx:latest
|
|
sudo ctr run \
|
|
-d \
|
|
--net-host \
|
|
docker.io/library/nginx:latest \
|
|
nginx
|
|
curl localhost
|
|
sudo ctr task kill nginx
|
|
sudo ctr container rm nginx
|
|
```
|
|
|
|
### 安装 nginx
|
|
|
|
```bash
|
|
sudo mkdir -p /data/nginx/{cert,conf.d,html}
|
|
sudo cat > /data/nginx/html/index.html << 'EOF'
|
|
hello world !
|
|
EOF
|
|
sudo cat > /data/nginx/nginx.conf << 'EOF'
|
|
user www-data;
|
|
worker_processes auto;
|
|
pid /run/nginx.pid;
|
|
error_log /var/log/nginx/error.log;
|
|
include /etc/nginx/modules-enabled/*.conf;
|
|
|
|
events {
|
|
worker_connections 768;
|
|
}
|
|
|
|
http {
|
|
sendfile on;
|
|
tcp_nopush on;
|
|
types_hash_max_size 2048;
|
|
resolver 8.8.8.8 8.8.4.4 valid=300s ipv6=off;
|
|
include /etc/nginx/mime.types;
|
|
default_type application/octet-stream;
|
|
ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; # Dropping SSLv3, ref: POODLE
|
|
ssl_prefer_server_ciphers on;
|
|
access_log /var/log/nginx/access.log;
|
|
gzip on;
|
|
include /etc/nginx/conf.d/*.conf;
|
|
include /etc/nginx/sites-enabled/*;
|
|
}
|
|
EOF
|
|
sudo ctr run \
|
|
-d \
|
|
--net-host \
|
|
--mount type=bind,src=/data/nginx/cert,dst=/etc/nginx/cert,options=rbind \
|
|
--mount type=bind,src=/data/nginx/conf.d,dst=/etc/nginx/conf.d,options=rbind \
|
|
--mount type=bind,src=/data/nginx/nginx.conf,dst=/etc/nginx/nginx.conf,options=rbind \
|
|
--mount type=bind,src=/data/nginx/html,dst=/usr/share/nginx/html,options=rbind \
|
|
docker.io/library/nginx:latest \
|
|
nginx
|
|
curl localhost
|
|
sudo ctr t exec --exec-id my1 nginx bash
|
|
```
|