文章目录
- Containerd容器管理
- [Containerd使用私有容器镜像仓库 Harbor](#Containerd使用私有容器镜像仓库 Harbor)
- [Containerd NameSpace管理](#Containerd NameSpace管理)
Containerd容器管理
bash
1.获取命令帮助
# 查看ctr命令帮助信息，了解可用的子命令和全局选项
[root@localhost ~]# ctr --help #ctr命令帮助
NAME:
ctr -
__
_____/ /______
/ ___/ __/ ___/
/ /__/ /_/ /
\___/\__/_/
containerd CLI
USAGE:
ctr [global options] command [command options] [arguments...]
VERSION:
v1.6.32
DESCRIPTION:
ctr is an unsupported debug and administrative client for interacting
with the containerd daemon. Because it is unsupported, the commands,
options, and operations are not guaranteed to be backward compatible or
stable from release to release of the containerd project.
COMMANDS:
plugins, plugin provides information about containerd plugins
version print the client and server versions
containers, c, container manage containers
content manage content
events, event display containerd events
images, image, i manage images
leases manage leases
namespaces, namespace, ns manage namespaces
pprof provide golang pprof outputs for containerd
run run a container
snapshots, snapshot manage snapshots
tasks, t, task manage tasks
install install a new package
oci OCI tools
deprecations
shim interact with a shim directly
help, h Shows a list of commands or help for one command
GLOBAL OPTIONS:
--debug enable debug output in logs
--address value, -a value address for containerd's GRPC server (default:
"/run/containerd/containerd.sock") [$CONTAINERD_ADDRESS]
--timeout value total timeout for ctr commands (default: 0s)
--connect-timeout value timeout for connecting to containerd (default:
0s)
--namespace value, -n value namespace to use with commands (default:
"default") [$CONTAINERD_NAMESPACE]
--help, -h show help
--version, -v print the version
# 查看ctr container容器管理子命令的帮助，了解创建静态容器的命令
[root@localhost ~]# ctr container --help #获取创建静态容器命令帮助 使用`ctr
container create `命令创建容器后，容器并没有处于运行状态，其只是一个静态的容器。这个container 对象只是包含了运行一个容器所需的资源及配置的数据结构，例如： namespaces、rootfs 和容器的配置都已经初始化成功了，只是用户进程(本案例为nginx)还没有启动。需要使用`ctr tasks`命令才能获取一个动态容器。
NAME:
ctr containers - manage containers
USAGE:
ctr containers command [command options] [arguments...]
COMMANDS:
create create container
delete, del, remove, rm delete one or more existing containers
info get info about a container
list, ls list containers
label set and clear labels for a container
checkpoint checkpoint a container
restore restore a container from checkpoint
OPTIONS:
--help, -h show help
# 查看ctr run命令帮助，该命令可一步创建并运行容器
[root@localhost ~]# ctr run --help # 使用ctr run命令可以创建一个静态容器并使其运行。一步到位运行容器。
NAME:
ctr run - run a container
USAGE:
ctr run [command options] [flags] Image|RootFS ID [COMMAND] [ARG...]
OPTIONS:
--rm remove the container after running,
cannot be used with --detach
--null-io send all IO to /dev/null
--log-uri value log uri
--detach, -d detach from the task after it has
started execution, cannot be used with --rm
--fifo-dir value directory used for storing IO FIFOs
--cgroup value cgroup path (To disable use of cgroup,
set to "" explicitly)
--platform value run image for specific platform
--cni enable cni networking for the
container
--runc-binary value specify runc-compatible binary
--runc-root value specify runc-compatible root
--runc-systemd-cgroup start runc with systemd cgroup manager
--uidmap container-uid:host-uid:length run inside a user namespace with the
specified UID mapping range; specified with the format container-uid:host-
uid:length
--gidmap container-gid:host-gid:length run inside a user namespace with the
specified GID mapping range; specified with the format container-gid:host-
gid:length
--remap-labels provide the user namespace ID
remapping to the snapshotter via label options; requires snapshotter support
--cpus value set the CFS cpu quota (default: 0)
--cpu-shares value set the cpu shares (default: 1024)
--snapshotter value snapshotter name. Empty value stands
for the default value. [$CONTAINERD_SNAPSHOTTER]
--snapshotter-label value labels added to the new snapshot for
this container.
--config value, -c value path to the runtime-specific spec
config file
--cwd value specify the working directory of the
process
--env value specify additional container
environment variables (e.g. FOO=bar)
--env-file value specify additional container
environment variables in a file(e.g. FOO=bar, one per line)
--label value specify additional labels (e.g.
foo=bar)
--annotation value specify additional OCI annotations
(e.g. foo=bar)
--mount value specify additional container mount
(e.g. type=bind,src=/tmp,dst=/host,options=rbind:ro)
--net-host enable host networking for the
container
--privileged run privileged container
--read-only set the containers filesystem as
readonly
--runtime value runtime name (default:
"io.containerd.runc.v2")
--runtime-config-path value optional runtime config path
--tty, -t allocate a TTY for the container
--with-ns value specify existing Linux namespaces to
join at container runtime (format '<nstype>:<path>')
--pid-file value file path to write the task's pid
--gpus value add gpus to the container
--allow-new-privs turn off OCI spec's NoNewPrivileges
feature flag
--memory-limit value memory limit (in bytes) for the
container (default: 0)
--device value file path to a device to add to the
container; or a path to a directory tree of devices to add to the container
--cap-add value add Linux capabilities (Set
capabilities with 'CAP_' prefix)
--cap-drop value drop Linux capabilities (Set
capabilities with 'CAP_' prefix)
--seccomp enable the default seccomp profile
--seccomp-profile value file path to custom seccomp profile.
seccomp must be set to true, before using seccomp-profile
--apparmor-default-profile value enable AppArmor with the default
profile with the specified name, e.g. "cri-containerd.apparmor.d"
--apparmor-profile value enable AppArmor with an existing
custom profile
--rdt-class value name of the RDT class to associate the
container with. Specifies a Class of Service (CLOS) for cache and memory
bandwidth management.
--rootfs use custom rootfs that is not managed
by containerd snapshotter
--no-pivot disable use of pivot-root (linux only)
--cpu-quota value Limit CPU CFS quota (default: -1)
--cpu-period value Limit CPU CFS period (default: 0)
--rootfs-propagation value set the propagation of the container
rootfs
2.查看容器(container表示静态容器，可用c缩写代表container)
# 查看静态容器列表(container可简写为c)
[root@localhost ~]# ctr container ls # 可以简写为 ctr c ls
CONTAINER IMAGE RUNTIME
3.查看任务(task表示容器里跑的进程, 可用t缩写代表task)
# 查看任务列表，task表示容器中运行的进程(可简写为t)
[root@localhost ~]# ctr task ls # 可以简写为 ctr t ls
TASK PID STATUS
4.创建静态容器
# 使用nginx:latest镜像创建名为nginx1的静态容器(此时容器未运行)
[root@localhost ~]# ctr container create nginx:latest nginx1
# 查看静态容器列表(container可简写为c)
[root@localhost ~]# ctr container ls
CONTAINER IMAGE RUNTIME
nginx1 nginx:latest io.containerd.runc.v2
# 查看nginx1容器的详细信息
[root@localhost ~]# ctr container info nginx1
5.静态容器启动为动态容器
# 查看任务列表，task表示容器中运行的进程(可简写为t)
[root@localhost ~]# ctr task ls
TASK PID STATUS
# 启动nginx1容器的task，-d后台运行，使静态容器变为动态容器
[root@localhost ~]# ctr task start -d nginx1 #启动task，即表示在容器中运行了进程，即为动态容器 -d 后台
# 查看任务列表，task表示容器中运行的进程(可简写为t)
[root@localhost ~]# ctr task ls #容器是以宿主机进程的方式存在的
TASK PID STATUS
nginx1 22614 RUNNING
# 查看系统中所有进程，grep过滤PID 22614，确认容器以宿主机进程方式运行
[root@localhost ~]# ps aux | grep 22614
root 22614 0.0 0.0 11468 7196 ? Ss 15:40 0:00 nginx: master
process nginx -g daemon off;
root 22969 0.0 0.0 12216 1104 pts/0 S+ 15:41 0:00 grep --
color=auto 22614
6.进入容器操作
# 进入nginx1容器执行shell，--exec-id为exec进程指定唯一ID(可用$RANDOM)，-t分配终端
[root@localhost ~]# ctr task exec --exec-id $RANDOM -t nginx1 /bin/sh #为exec进程设定一个id，可以随意输入，只要保证唯一即可，也可使用$RANDOM变量
7.直接运行一个动态容器
# 直接运行nginx2动态容器，-d后台运行，--net-host容器IP即宿主机IP(host网络类型)
[root@localhost ~]# ctr run -d --net-host nginx:latest nginx2 # --net-host 代表容器的IP就是宿主机的IP(相当于docker里的host类型网络)
8.暂停容器
# 暂停nginx2容器的task
[root@localhost ~]# ctr tasks pause nginx2
# 查看任务列表，task表示容器中运行的进程(可简写为t)
[root@localhost ~]# ctr task ls
TASK PID STATUS
nginx1 22614 RUNNING
nginx2 25569 PAUSED #状态为PAUSED，表示暂停
bash
9.恢复容器
# 恢复nginx2容器task运行
[root@localhost ~]# ctr tasks resume nginx2
# 查看任务列表，task表示容器中运行的进程(可简写为t)
[root@localhost ~]# ctr task ls
TASK PID STATUS
nginx1 22614 RUNNING
nginx2 25569 RUNNING #恢复RUNNING
10.停止容器
# 停止(杀死)nginx2容器的task
[root@localhost ~]# ctr tasks kill nginx2
# 查看任务列表(tasks可简写为t)
[root@localhost ~]# ctr tasks ls
TASK PID STATUS
nginx1 22614 RUNNING
nginx2 25569 STOPPED #容器停止后STATUS为STOPPED
bash
11.删除容器
# 删除nginx2容器的task(必须先停止task再删除)
[root@localhost ~]# ctr tasks delete nginx2 #必须先停止tasks或先删除task，再删除容器
# 查看任务列表(tasks可简写为t)
[root@localhost ~]# ctr tasks ls
TASK PID STATUS
nginx1 22614 RUNNING
# 查看静态容器列表(container可简写为c)
[root@localhost ~]# ctr container ls # 查看静态容器，确认其还存在于系统中
CONTAINER IMAGE RUNTIME
nginx1 nginx:latest io.containerd.runc.v2
nginx2 nginx:latest io.containerd.runc.v2
# 删除nginx2静态容器
[root@localhost ~]# ctr container delete nginx2
# 查看静态容器列表(container可简写为c)
[root@localhost ~]# ctr container ls
CONTAINER IMAGE RUNTIME
nginx1 nginx:latest io.containerd.runc.v2Containerd使用私有容器镜像仓库 Harbor
bash
# 编辑/etc/hosts主机映射文件，添加Harbor仓库域名解析(已存在可忽略)
[root@localhost ~]# vim /etc/hosts
192.168.108.30 my.harbor.com
# harbor仓库需要提前在192.168.108.30上部署(参考docker教案)，镜像需要提前传到harbor上，如果没有使用https可以使用--plain-http 指定http协议
# 从Harbor私有仓库拉取nginx镜像，--plain-http指定使用http协议
[root@localhost ~]# ctr image pull --plain-http 192.168.108.30/cloud/nginx:latest
# 为nginx镜像打上Harbor仓库标签，准备上传
[root@localhost ~]# ctr images tag nginx:latest my.harbor.com/cloud/nginx:latest
# 上传镜像到Harbor仓库，--platform指定平台，--plain-http使用http协议，--user指定仓库用户名和密码
[root@localhost ~]# ctr image push --platform linux/amd64 --plain-http --user "images_admin:Cloud12#$" my.harbor.com/cloud/nginx:latest
manifest-sha256:6533ddd664582430971e93e69cf343e3bfffceadeaaa97d4379c4d7a29f21d47: done |++++++++++++++++++++++++++++++++++++++|
config-sha256:2cd1d97f893f70cee86a38b7160c30e5750f3ed6ad86c598884ca9c6a563a501: done |++++++++++++++++++++++++++++++++++++++|
elapsed: 0.1 sContainerd NameSpace管理
containerd中namespace的作用为隔离运行的容器，可以实现运行多个容器
bash
1.列出已有namespace
# 查看已有namespace(命名空间)列表
[root@localhost ~]# ctr namespace ls
NAME LABELS
default #containerd默认工作在default命名空间
# 查看已有namespace(命名空间)列表
[root@docker ~]# ctr namespace ls #在docker环境中打
NAME LABELS
moby #docker默认工作在moby空间
2.创建namespace
# 创建名为myns的namespace
[root@localhost ~]# ctr namespace create myns
# 创建名为testns的namespace
[root@localhost ~]# ctr namespace create testns
# 查看已有namespace(命名空间)列表
[root@localhost ~]# ctr namespace ls
NAME LABELS
default
myns
testns
3.删除namespace
# 删除名为testns的namespace
[root@localhost ~]# ctr namespace rm testns
testns
# 查看已有namespace(命名空间)列表
[root@localhost ~]# ctr namespace ls
NAME LABELS
default
myns
4.查看指定namespace中镜像
# 查看myns命名空间中的镜像列表，-n指定namespace
[root@localhost ~]# ctr -n myns images ls
REF TYPE DIGEST SIZE PLATFORMS LABELS
5.查看指定namespace中是否有用户进程在运行
# 查看myns命名空间中是否有用户进程在运行
[root@localhost ~]# ctr -n myns tasks ls
TASK PID STATUS
6.在指定namespace中下载容器镜像
# 在myns命名空间中拉取nginx镜像
[root@localhost ~]# ctr -n myns images pull 054b8ac70e8010d90f2ac00ef29e6580.mirror.swr.myhuaweicloud.com/library/nginx:latest
# 查看myns命名空间中的镜像列表，-n指定namespace
[root@localhost ~]# ctr -n myns images ls
REF
TYPE DIGEST
SIZE PLATFORMS
LABELS
054b8ac70e8010d90f2ac00ef29e6580.mirror.swr.myhuaweicloud.com/library/nginx:latest application/vnd.oci.image.index.v1+json
sha256:84ec966e61a8c7846f509da7eb081c55c1d56817448728924a87ab32f12a72fb 68.9 MiB
linux/386,linux/amd64,linux/arm/v5,linux/arm/v7,linux/arm64/v8,linux/mips64le,linux/ppc64le,linux/s390x,unknown/unknown -
7.在指定namespace中创建静态容器
# 在myns命名空间中基于nginx镜像创建名为mynginx的静态容器
[root@localhost ~]# ctr -n myns container create 054b8ac70e8010d90f2ac00ef29e6580.mirror.swr.myhuaweicloud.com/library/nginx:latest mynginx
8.查看在指定namespace中创建的容器
# 查看myns命名空间中的容器列表，确认mynginx已创建
[root@localhost ~]# ctr -n myns container ls
CONTAINER IMAGE
RUNTIME
mynginx
054b8ac70e8010d90f2ac00ef29e6580.mirror.swr.myhuaweicloud.com/library/nginx:latest io.containerd.runc.v2
# 启动mynginx容器的task，-d后台运行
[root@localhost ~]# ctr -n myns task start -d mynginx
# 查看myns命名空间中是否有用户进程在运行
[root@localhost ~]# ctr -n myns tasks ls
TASK PID STATUS
mynginx 5873 RUNNING