一、帮助命令
我们知道 Docker CLI 工具提供了需要增强用户体验的功能,containerd 同样也提供一个对应的 CLI 工具:ctr,不过 ctr 的功能没有 docker 完善,但是关于镜像和容器的基本功能都是有的。接下来我们就先简单介绍下 ctr 的使用。
直接输入 ctr 命令即可获得所有相关的操作命令使用方式:
bash
[root@containerd ~]#ctr
NAME:
ctr -
__
_____/ /______
/ ___/ __/ ___/
/ /__/ /_/ /
\___/\__/_/
containerd CLI
USAGE:
ctr [global options] command [command options] [arguments...] #注意这个用法!
VERSION:
v1.5.5
DESCRIPTION:
ctr is an unsupported debug and administrative client for interacting
with the containerd daemon. Because it is unsupported, the commands,
options, and operations are not guaranteed to be backward compatible or
stable from release to release of the containerd project.
COMMANDS:
plugins, plugin provides information about containerd plugins
version print the client and server versions
containers, c, container manage containers
content manage content
events, event display containerd events
images, image, i manage images
leases manage leases
namespaces, namespace, ns manage namespaces
pprof provide golang pprof outputs for containerd
run run a container
snapshots, snapshot manage snapshots
tasks, t, task manage tasks
install install a new package
oci OCI tools
shim interact with a shim directly
help, h Shows a list of commands or help for one command
GLOBAL OPTIONS:
--debug enable debug output in logs
--address value, -a value address for containerd's GRPC server (default: "/run/containerd/containerd.sock") [$CONTAINERD_ADDRESS]
--timeout value total timeout for ctr commands (default: 0s)
--connect-timeout value timeout for connecting to containerd (default: 0s)
--namespace value, -n value namespace to use with commands (default: "default") [$CONTAINERD_NAMESPACE]
--help, -h show help
--version, -v print the version
[root@containerd ~]#
二、镜像操作
1.拉取镜像
拉取镜像可以使用 ctr image pull 来完成,比如拉取 Docker Hub 官方镜像 nginx:alpine,需要注意的是镜像地址需要加上 docker.io Host 地址:(这个需要注意下)
bash
ctr i pull docker.io/library/nginx:alpine
ctr i pull --all-platforms docker.io/library/nginx:alpine #建议使用这个命令,否则后面import会报错
bash
[root@containerd ~]#ctr i pull docker.io/library/nginx:alpine
docker.io/library/nginx:alpine: resolved |++++++++++++++++++++++++++++++++++++++|
index-sha256:686aac2769fd6e7bab67663fd38750c135b72d993d0bb0a942ab02ef647fc9c3: done |++++++++++++++++++++++++++++++++++++++|
manifest-sha256:af466e4f12e3abe41fcfb59ca0573a3a5c640573b389d5287207a49d1324abd8: done |++++++++++++++++++++++++++++++++++++++|
layer-sha256:61074acc7dd227cfbeaf719f9b5cdfb64711bc6b60b3865c7b886b7099c15d15: done |++++++++++++++++++++++++++++++++++++++|
config-sha256:513f9a9d8748b25cdb0ec6f16b4523af7bba216a6bf0f43f70af75b4cf7cb780: done |++++++++++++++++++++++++++++++++++++++|
layer-sha256:a0d0a0d46f8b52473982a3c466318f479767577551a53ffc9074c9fa7035982e: done |++++++++++++++++++++++++++++++++++++++|
layer-sha256:4dd4efe90939ab5711aaf5fcd9fd8feb34307bab48ba93030e8b845f8312ed8e: done |++++++++++++++++++++++++++++++++++++++|
layer-sha256:c1368e94e1ec563b31c3fb1fea02c9fbdc4c79a95e9ad0cac6df29c228ee2df3: done |++++++++++++++++++++++++++++++++++++++|
layer-sha256:3e72c40d0ff43c52c5cc37713b75053e8cb5baea8e137a784d480123814982a2: done |++++++++++++++++++++++++++++++++++++++|
layer-sha256:969825a5ca61c8320c63ff9ce0e8b24b83442503d79c5940ba4e2f0bd9e34df8: done |++++++++++++++++++++++++++++++++++++++|
elapsed: 13.9s total: 8.7 Mi (640.7 KiB/s)
unpacking linux/amd64 sha256:686aac2769fd6e7bab67663fd38750c135b72d993d0bb0a942ab02ef647fc9c3...
done: 839.71453ms
#查看拉取到的镜像
[root@containerd ~]#ctr i ls
REF TYPE DIGEST SIZE PLATFORMS LABELS
docker.io/library/nginx:alpine application/vnd.docker.distribution.manifest.list.v2+json sha256:686aac2769fd6e7bab67663fd38750c135b72d993d0bb0a942ab02ef647fc9c3 9.5 MiB linux/386,linux/amd64,linux/arm/v6,linux/arm/v7,linux/arm64/v8,linux/ppc64le,linux/s390x -
[root@containerd ~]#ctr i ls -q
docker.io/library/nginx:alpine
[root@containerd ~]#
也可以使用 --platform 选项指定对应平台的镜像。当然对应的也有推送镜像的命令 ctr image push,如果是私有镜像则在推送的时候可以通过 --user 来自定义仓库的用户名和密码。
2.列出本地镜像
bash
#查看拉取到的镜像
[root@containerd ~]#ctr i ls
REF TYPE DIGEST SIZE PLATFORMS LABELS
docker.io/library/nginx:alpine application/vnd.docker.distribution.manifest.list.v2+json sha256:686aac2769fd6e7bab67663fd38750c135b72d993d0bb0a942ab02ef647fc9c3 9.5 MiB linux/386,linux/amd64,linux/arm/v6,linux/arm/v7,linux/arm64/v8,linux/ppc64le,linux/s390x -
#使用 `-q(--quiet)` 选项可以只打印镜像名称。
[root@containerd ~]#ctr i ls -q
docker.io/library/nginx:alpine
[root@containerd ~]#
3.检测本地镜像
bash
[root@containerd ~]#ctr i check #主要查看其中的 `STATUS`,`complete` 表示镜像是完整可用的状态。
REF TYPE DIGEST STATUS SIZE UNPACKED
docker.io/library/nginx:alpine application/vnd.docker.distribution.manifest.list.v2+json sha256:686aac2769fd6e7bab67663fd38750c135b72d993d0bb0a942ab02ef647fc9c3 complete (7/7) 9.5 MiB/9.5 MiB true
[root@containerd ~]#ctr i check -q
docker.io/library/nginx:alpine
[root@containerd ~]#
4.重新打标签
同样的我们也可以重新给指定的镜像打一个 Tag:
bash
[root@containerd ~]#ctr i tag docker.io/library/nginx:alpine harbor.k8s.local/course/nginx:alpine
harbor.k8s.local/course/nginx:alpine
[root@containerd ~]#ctr i ls -q
docker.io/library/nginx:alpine
harbor.k8s.local/course/nginx:alpine
[root@containerd ~]#
5.删除镜像
不需要使用的镜像也可以使用 ctr image rm 进行删除:
bash
[root@containerd ~]#ctr i ls -q
docker.io/library/nginx:alpine
harbor.k8s.local/course/nginx:alpine
[root@containerd ~]#ctr i rm harbor.k8s.local/course/nginx:alpine
harbor.k8s.local/course/nginx:alpine
[root@containerd ~]#ctr i ls -q
docker.io/library/nginx:alpine
[root@containerd ~]#
6.将镜像挂载到主机目录
bash
[root@containerd ~]#ctr i mount docker.io/library/nginx:alpine /mnt
sha256:5da2ba1075ada2783aada4fa30ec8cdd56a072759ea7c283de1c505b56ed0e70
/mnt
[root@containerd ~]#tree -L 1 /mnt/
/mnt/
├── bin
├── dev
├── docker-entrypoint.d
├── docker-entrypoint.sh
├── etc
├── home
├── lib
├── media
├── mnt
├── opt
├── proc
├── root
├── run
├── sbin
├── srv
├── sys
├── tmp
├── usr
└── var
18 directories, 1 file
[root@containerd ~]#
bash
#### 7.将镜像从主机目录上卸载
```shell
[root@containerd ~]#ctr i unmount /mnt
/mnt
[root@containerd ~]#
```
#### 8.将镜像导出为压缩包
```shell
ctr image export --all-platforms nginx.tar.gz
或者
ctr image export --platform=linux/amd64 nginx.tar.gz #添加什么参数区别于当时在拉取的时候添加的是什么参数;
```
要注意:在使用export命令是需要添加--platform参数,否则会报错
如下测试过程:
```shell
#查看export命令参数
[root@containerd ~]#ctr i export -h
NAME:
ctr images export - export images
USAGE:
ctr images export [command options] [flags] <out> <image> ...
DESCRIPTION:
Export images to an OCI tar archive.
Tar output is formatted as an OCI archive, a Docker manifest is provided for the platform.
Use '--skip-manifest-json' to avoid including the Docker manifest.json file.
Use '--platform' to define the output platform.
When '--all-platforms' is given all images in a manifest list must be available.
OPTIONS:
--skip-manifest-json do not add Docker compatible manifest.json to archive
--skip-non-distributable do not add non-distributable blobs such as Windows layers to archive
--platform value Pull content from a specific platform
--all-platforms exports content from all platforms
[root@containerd ~]#
[root@containerd ~]#ctr i ls -q
docker.io/library/nginx:alpine
[root@containerd ~]#ctr i export nginx.tar.gz docker.io/library/nginx:alpine #注意这里一定要加上--platform字段才可以,否则会报错
ctr: content digest sha256:c8ca916e00dd0c56c91a81100ca79b668196642492153498e5d77619ccb55f9a: not found
[root@containerd ~]#ctr image export --all-platforms nginx.tar.gz docker.io/library/nginx:alpine #加上--all-platforms参数也会报错的
ctr: content digest sha256:826624c15f5e49e591d80f3e0c696f92a2d5967b989017572fe241edac294a2a: not found
[root@containerd ~]#ctr image export --platform=linux/amd64 nginx.tar.gz #加上--platform=linux/amd64就没有报错了......
docker.io/library/nginx:alpine
[root@containerd ~]#ll -h
total 131M
-rw-r--r-- 1 root root 122M Jul 30 01:16 cri-containerd-cni-1.5.5-linux-amd64.tar.gz
-rw-r--r-- 1 root root 9.6M Oct 24 11:29 nginx.tar.gz
[root@containerd ~]#
```
bash
#查看export命令参数
[root@containerd ~]#ctr i export -h
NAME:
ctr images export - export images
USAGE:
ctr images export [command options] [flags] <out> <image> ...
DESCRIPTION:
Export images to an OCI tar archive.
Tar output is formatted as an OCI archive, a Docker manifest is provided for the platform.
Use '--skip-manifest-json' to avoid including the Docker manifest.json file.
Use '--platform' to define the output platform.
When '--all-platforms' is given all images in a manifest list must be available.
OPTIONS:
--skip-manifest-json do not add Docker compatible manifest.json to archive
--skip-non-distributable do not add non-distributable blobs such as Windows layers to archive
--platform value Pull content from a specific platform
--all-platforms exports content from all platforms
[root@containerd ~]#
[root@containerd ~]#ctr i ls -q
docker.io/library/nginx:alpine
[root@containerd ~]#ctr i export nginx.tar.gz docker.io/library/nginx:alpine #注意这里一定要加上--platform字段才可以,否则会报错
ctr: content digest sha256:c8ca916e00dd0c56c91a81100ca79b668196642492153498e5d77619ccb55f9a: not found
[root@containerd ~]#ctr image export --all-platforms nginx.tar.gz docker.io/library/nginx:alpine #加上--all-platforms参数也会报错的
ctr: content digest sha256:826624c15f5e49e591d80f3e0c696f92a2d5967b989017572fe241edac294a2a: not found
[root@containerd ~]#ctr image export --platform=linux/amd64 nginx.tar.gz #加上--platform=linux/amd64就没有报错了......
docker.io/library/nginx:alpine
[root@containerd ~]#ll -h
total 131M
-rw-r--r-- 1 root root 122M Jul 30 01:16 cri-containerd-cni-1.5.5-linux-amd64.tar.gz
-rw-r--r-- 1 root root 9.6M Oct 24 11:29 nginx.tar.gz
[root@containerd ~]#
bash
#### 9.从压缩包导入镜像
```shell
[root@containerd ~]#ctr i import nginx.tar.gz
ctr: content digest sha256:c8ca916e00dd0c56c91a81100ca79b668196642492153498e5d77619ccb55f9a: not found
[root@containerd ~]#
```
某些时候直接导入可能会出现类似于 `ctr: content digest sha256:xxxxxx not found` 的错误,要解决这个办法需要 pull 所有平台镜像:
解决办法如下:
```shell
➜ ~ ctr i pull --all-platforms docker.io/library/nginx:alpine
➜ ~ ctr i export --all-platforms nginx.tar.gz docker.io/library/nginx:alpine
➜ ~ ctr i rm docker.io/library/nginx:alpine
➜ ~ ctr i import nginx.tar.gz
```
###
bash
### 三、容器操作
容器相关操作可以通过 `ctr container` 获取。
#### 1.创建容器
```shell
[root@containerd ~]#ctr c create docker.io/library/nginx:alpine nginx
```
#### 2.列出容器
```shell
[root@containerd ~]#ctr c ls
CONTAINER IMAGE RUNTIME
nginx docker.io/library/nginx:alpine io.containerd.runc.v2
[root@containerd ~]#ctr c ls -q #同样可以加上 `-q` 选项精简列表内容:
nginx
[root@containerd ~]#
```
#### 3.查看容器详细配置
类似于 `docker inspect` 功能。
bash
### 三、容器操作
容器相关操作可以通过 `ctr container` 获取。
#### 1.创建容器
```shell
[root@containerd ~]#ctr c create docker.io/library/nginx:alpine nginx
```
#### 2.列出容器
```shell
[root@containerd ~]#ctr c ls
CONTAINER IMAGE RUNTIME
nginx docker.io/library/nginx:alpine io.containerd.runc.v2
[root@containerd ~]#ctr c ls -q #同样可以加上 `-q` 选项精简列表内容:
nginx
[root@containerd ~]#
```
#### 3.查看容器详细配置
类似于 `docker inspect` 功能。
bash
#### 4.删除容器
```shell
[root@containerd ~]#ctr c ls
CONTAINER IMAGE RUNTIME
nginx docker.io/library/nginx:alpine io.containerd.runc.v2
[root@containerd ~]#ctr c rm nginx
[root@containerd ~]#ctr c ls
CONTAINER IMAGE RUNTIME
[root@containerd ~]#
```
除了使用 `rm` 子命令之外也可以使用 `delete` 或者 `del` 删除容器。
bash
[root@containerd ~]#ctr c
NAME:
ctr containers - manage containers
USAGE:
ctr containers command [command options] [arguments...]
COMMANDS:
create create container
delete, del, rm delete one or more existing containers #注意
info get info about a container
list, ls list containers
label set and clear labels for a container
checkpoint checkpoint a container
restore restore a container from checkpoint
OPTIONS:
--help, -h show help
[root@containerd ~]
bash
## 四、任务
上面我们通过 `container create` 命令创建的容器,并没有处于运行状态,只是一个静态的容器(仅仅只是一个创建容器的声明)。一个 container 对象只是包含了运行一个容器所需的资源及相关配置数据,表示 namespaces、rootfs 和容器的配置都已经初始化成功了,只是用户进程还没有启动。
一个容器真正运行起来是由 Task 任务实现的,Task 可以为容器设置网卡,还可以配置工具来对容器进行监控等。
#### 1.启动一个容器
Task 相关操作可以通过 `ctr task` 获取,如下我们通过 Task 来启动容器:
```shell
[root@containerd ~]#ctr task start -d nginx
/docker-entrypoint.sh: /docker-entrypoint.d/ is not empty, will attempt to perform configuration
/docker-entrypoint.sh: Looking for shell scripts in /docker-entrypoint.d/
/docker-entrypoint.sh: Launching /docker-entrypoint.d/10-listen-on-ipv6-by-default.sh
[root@containerd ~]#
```
#### 2.查看正在运行的容器
启动容器后可以通过 `task ls` 查看正在运行的容器:
bash
[root@containerd ~]#ctr task ls
TASK PID STATUS
nginx 24458 RUNNING
[root@containerd ~]#ctr task ls -q
nginx
[root@containerd ~]#
bash
#### 3.进入到容器里面
同样也可以使用 `exec` 命令进入容器进行操作:
```shell
[root@containerd ~]#ctr task exec --exec-id 0 -t nginx sh
/ # ls
bin media srv
dev mnt sys
docker-entrypoint.d opt tmp
docker-entrypoint.sh proc usr
etc root var
home run
lib sbin
/ # ps
PID USER TIME COMMAND
1 root 0:00 nginx: master process nginx -g daemon off;
32 nginx 0:00 nginx: worker process
33 nginx 0:00 nginx: worker process
34 root 0:00 sh
41 root 0:00 ps
/ #
```
不过这里需要注意必须要指定 `--exec-id` 参数,这个 id 可以随便写,只要唯一就行。
bash
#### 4.暂停容器
暂停容器,和 `docker pause` 类似的功能:
```shell
[root@containerd ~]#ctr task pause nginx
```
暂停后容器状态变成了 `PAUSED`:
```shell
[root@containerd ~]#ctr task ls
TASK PID STATUS
nginx 24458 PAUSED
[root@containerd ~]#
```
#### 5.恢复容器
同样也可以使用 `resume` 命令来恢复容器:
```shell
[root@containerd ~]#ctr t resume nginx #resume 继续,重新开始
[root@containerd ~]#ctr task ls
TASK PID STATUS
nginx 24458 RUNNING
[root@containerd ~]#
```
#### 6.杀死容器
不过需要注意 ctr 没有 stop 容器的功能,只能暂停或者杀死容器。**杀死容器可以使用 `task kill` 命令:
bash
[root@containerd ~]#ctr t kill nginx
[root@containerd ~]#ctr task ls
TASK PID STATUS
nginx 24458 STOPPED
[root@containerd ~]#
bash
#### 7.删除task
杀掉容器后可以看到容器的状态变成了 `STOPPED`。同样也可以通过 `task rm` 命令删除 Task:
```shell
[root@containerd ~]#ctr t rm nginx
[root@containerd ~]#ctr task ls
TASK PID STATUS
[root@containerd ~]#
```
删除正在运行的task:
bash
[root@containerd ~]#ctr c ls
CONTAINER IMAGE RUNTIME
nginx docker.io/library/nginx:alpine io.containerd.runc.v2
[root@containerd ~]#ctr t start -d nginx
[root@containerd ~]#ctr t ls
TASK PID STATUS
nginx 24713 RUNNING
[root@containerd ~]#ctr t rm nginx
ERRO[0000] unable to delete nginx error="task must be stopped before deletion: running: failed precondition"
ctr: task must be stopped before deletion: running: failed precondition
[root@containerd ~]#
[root@containerd ~]## 由以上测试可以知道,要想删除一个正在运行的Task,必须先kill掉这个task,然后才能删除task,否则会报错;
[root@containerd ~]#ctr t kill nginx
[root@containerd ~]#ctr t rm nginx
[root@containerd ~]#ctr t ls
TASK PID STATUS
[root@containerd ~]#
bash
#### 8.显示容器的内存、CPU 和 PID 的限额与使用量
除此之外我们还可以获取容器的 cgroup 相关信息,可以使用 `task metrics` 命令用来获取容器的内存、CPU 和 PID 的限额与使用量。
```shell
[root@containerd ~]#ctr t metrics nginx
ID TIMESTAMP
nginx 2021-10-24 05:54:38.74392351 +0000 UTC
METRIC VALUE
memory.usage_in_bytes 1986560
memory.limit_in_bytes 9223372036854771712
memory.stat.cache 16384
cpuacct.usage 63033641
cpuacct.usage_percpu [17342796 45690845]
pids.current 3
pids.limit 0
[root@containerd ~]#
```
#### 9.查看容器中所有进程在宿主机中的 PID:
还可以使用 `task ps` 命令查看容器中所有进程在宿主机中的 PID:
bash
[root@containerd ~]#ctr t ls
TASK PID STATUS
nginx 24841 RUNNING
[root@containerd ~]#ctr t ps nginx
PID INFO
24841 -
24873 -
24874 -
[root@containerd ~]#ps -ef|grep nginx
root 24822 1 0 13:54 ? 00:00:00 /usr/local/bin/containerd-shim-runc-v2 -namespace default -id nginx -address /run/containerd/containerd.sock
root 24841 24822 0 13:54 ? 00:00:00 nginx: master process nginx -g daemon off;
101 24873 24841 0 13:54 ? 00:00:00 nginx: worker process
101 24874 24841 0 13:54 ? 00:00:00 nginx: worker process
root 24917 24303 0 13:56 pts/0 00:00:00 grep --color=auto nginx
[root@containerd ~]#
bash
### 5、命名空间
#### 1.查看命名空间
另外 Containerd 中也支持命名空间的概念,比如查看命名空间:
```shell
[root@containerd ~]#ctr ns ls
NAME LABELS
default
[root@containerd ~]#
```
#### 2.创建命名空间
如果不指定,ctr 默认使用的是 `default` 空间。同样也可以使用 `ns create` 命令创建一个命名空间:
```shell
[root@containerd ~]#ctr ns create test
[root@containerd ~]#ctr ns ls
NAME LABELS
default
test
[root@containerd ~]#
```
#### 3.删除命名空间
使用 `remove` 或者 `rm` 可以删除 namespace:
bash
[root@containerd ~]#ctr ns ls
NAME LABELS
default
test
[root@containerd ~]#ctr ns rm test #删除命名空间
test
[root@containerd ~]#ctr ns ls
NAME LABELS
default
[root@containerd ~]#
bash
#### 4.指定命名空间选项
有了命名空间后就可以在操作资源的时候指定 namespace,比如查看 test 命名空间的镜像,可以在操作命令后面加上 `-n test` 选项:
```shell
[root@containerd ~]#ctr i ls -q
docker.io/library/nginx:alpine
[root@containerd ~]#ctr -n test i ls -q
[root@containerd ~]#
```
注意:
我们知道 Docker 其实也是默认调用的 containerd,事实上 Docker 使用的 containerd 下面的命名空间默认是 moby,而不是 default,所以假如我们有用 docker 启动容器,那么我们也可以通过 ctr -n moby 来定位下面的容器:
```shell
[root@containerd ~]#ctr -n moby c ls
CONTAINER IMAGE RUNTIME
[root@containerd ~]#
```
同样 Kubernetes 下使用的 containerd 默认命名空间是 `k8s.io`,所以我们可以使用 `ctr -n k8s.io` 来查看 Kubernetes 下面创建的容器。
```shell
[root@containerd ~]#ctr -n k8s.io c ls
CONTAINER IMAGE RUNTIME
[root@containerd ~]#
```