八、crictl 实践
文章目录
- [八、crictl 实践](#八、crictl 实践)
crictl 命令介绍
crictl 命令是遵循 CRI 接口规范的一个命令行工具，通常用它来检查和管理kubelet 节点上的容器运行时和镜像。
在kubernetes集群环境中，当我们执行kubectl 命令式，kubelet 代理会自动调用crictl命令管理镜像和容器。
手动执行 crictl 命令时，一般用于查看镜像和容器。
crictl 命令安装
配置kubernetes源：
bash
[root@localhost ~]# vim /etc/yum.repos.d/kubernetes.repo
[kubernetes]
name=Kubernetes
baseurl=https://mirrors.aliyun.com/kubernetes-new/core/stable/v1.30/rpm/
enabled=1
gpgcheck=1
gpgkey=https://mirrors.aliyun.com/kubernetes-
new/core/stable/v1.30/rpm/repodata/repomd.xml.key安装CRI命令
bash
[root@localhost ~]# yum install -y cri-toolscrictl 命令配置
使用crictl 命令之前，需要先配置/etc/crictl.yaml 。
示例：配置crictl后端运行时使用containerd。
bash
[root@localhost ~]# vim /etc/crictl.yaml
runtime-endpoint: unix:///run/containerd/containerd.sock
image-endpoint: unix:///run/containerd/containerd.sock
timeout: 5
debug: false也可以通过命令进行设置：
bash
[root@localhost ~]# crictl config runtime-endpoint unix:///run/containerd/containerd.sock
[root@localhost ~]# crictl config image-endpoint unix:///run/containerd/containerd.sock更多命令操作，可以直接在命令行输入命令查看帮助。
bash
[root@localhost ~]# crictl config --help
NAME:
crictl config - Get and set crictl client configuration options
USAGE:
crictl config [command options] [<crictl options>]
EXAMPLE:
crictl config --set debug=true
CRICTL OPTIONS:
runtime-endpoint: Container runtime endpoint
image-endpoint: Image endpoint
timeout: Timeout of connecting to server (default: 2s)
debug: Enable debug output (default: false)
pull-image-on-create: Enable pulling image on create requests (default:
false)
disable-pull-on-run: Disable pulling image on run requests (default: false)
OPTIONS:
--get value show the option value
--list show all option value (default: false)
--set value [ --set value ] set option (can specify multiple or separate
values with commas: opt1=val1,opt2=val2)
--help, -h show helpcrictl 命令实践
帮助信息
bash
[root@localhost ~]# crictl
NAME:
crictl - client for CRI
USAGE:
crictl [global options] command [command options]
VERSION:
v1.30.1
COMMANDS:
attach Attach to a running container
create Create a new container
exec Run a command in a running container
version Display runtime version information
images, image, img List images
inspect Display the status of one or more containers
inspecti Return the status of one or more images
imagefsinfo Return image filesystem info
inspectp Display the status of one or more pods
logs Fetch the logs of a container
port-forward Forward local port to a pod
ps List containers
pull Pull an image from a registry
run Run a new container inside a sandbox
runp Run a new pod
rm Remove one or more containers
rmi Remove one or more images
rmp Remove one or more pods
pods List pods
start Start one or more created containers
info Display information of the container runtime
stop Stop one or more running containers
stopp Stop one or more running pods
update Update one or more running containers
config Get and set crictl client configuration options
stats List container(s) resource usage statistics
statsp List pod statistics. Stats represent a structured API that
will fulfill the Kubelet's /stats/summary endpoint.
metricsp List pod metrics. Metrics are unstructured key/value pairs
gathered by CRI meant to replace cAdvisor's /metrics/cadvisor endpoint.
completion Output shell completion code
checkpoint Checkpoint one or more running containers
runtime-config Retrieve the container runtime configuration
events, event Stream the events of containers
help, h Shows a list of commands or help for one command
GLOBAL OPTIONS:
--config value, -c value Location of the client config file.
If not specified and the default does not exist, the program's directory is
searched as well (default: "/etc/crictl.yaml") [$CRI_CONFIG_FILE]
--debug, -D Enable debug mode (default: false)
--enable-tracing Enable OpenTelemetry tracing.
(default: false)
--image-endpoint value, -i value Endpoint of CRI image manager
service (default: uses 'runtime-endpoint' setting) [$IMAGE_SERVICE_ENDPOINT]
--runtime-endpoint value, -r value Endpoint of CRI container runtime
service (default: uses in order the first successful one of
[unix:///run/containerd/containerd.sock unix:///run/crio/crio.sock
unix:///var/run/cri-dockerd.sock]). Default is now deprecated and the endpoint
should be set instead. [$CONTAINER_RUNTIME_ENDPOINT]
--timeout value, -t value Timeout of connecting to the server
in seconds (e.g. 2s, 20s.). 0 or less is set to default (default: 2s)
--tracing-endpoint value Address to which the gRPC tracing
collector will send spans to. (default: "127.0.0.1:4317")
--tracing-sampling-rate-per-million value Number of samples to collect per
million OpenTelemetry spans. Set to 1000000 or -1 to always sample. (default: -1)
--help, -h show help
--version, -v print the version案列
bash
[root@localhost ~]# crictl pull 054b8ac70e8010d90f2ac00ef29e6580.mirror.swr.myhuaweicloud.com/library/nginx:latest
Image is up to date for
sha256:9f33606b36859ee2db3b761a893fb7c2fc8a13c0fe5f24e304b129f3caf499ad
[root@localhost ~]# crictl images
IMAGE TAG IMAGE ID SIZE
docker.io/library/httpd latest 65005131d37e9 45.2MB镜像命令
- images, image, img List images
- pull Pull an image from a registry
- inspecti Return the status of one or more images
- imagefsinfo Return image filesystem info
- rmi Remove one or more images
容器命令
- ps List containers
- create Create a new container
- run Run a new container inside a sandbox
- inspect Display the status of one or more containers
- info Display information of the container runtime
- attach Attach to a running container
- exec Run a command in a running container
- logs Fetch the logs of a container
- update Update one or more running containers
- stats List container(s) resource usage statistics
- checkpoint Checkpoint one or more running containers
- start Start one or more created containers
- stop Stop one or more running containers
- rm Remove one or more containers
pod命令
- pods List pods
- runp Run a new pod
- inspectp Display the status of one or more pods
- statsp List pod resource usage statistics
- port-forward Forward local port to a pod
- stopp Stop one or more running pods
- rmp Remove one or more pods
其他命令
- version Display runtime version information
- config Get and set crictl client configuration options
- completion Output shell completion code
- help, h Shows a list of commands or help for one command
命令行对照表
| 命令功能 | docker | podman | nerdctl | ctr | crictl |
|---|---|---|---|---|---|
| 查看容器状态 | docker ps | podman ps | nerdctl ps | ctr task ls/ctr container ls | crictl ps |
| 查看镜像 | docker images | podman images | nerdctl images | ctr image ls | crictl images |
| 查看容器日志 | docker logs | podman logs | nerdctl logs | 无 | crictl logs |
| 查看容器信息 | docker inspect | podman inspect | nerdctl inspect | ctr container info | crictl inspect |
| 查看容器资源 | docker stats | podman stats | nerdctl stats | 无 | crictl stats |
| 运行新容器 | docker run | podman run | nerdctl run | ctr run | 无 |
| 修改镜像标签 | docker tag | podman tag | nerdctl tag | ctr image tag | 无 |
| 创建新容器 | docker create | podman create | nerdctl create | ctr container create | crictl create |
| 导入镜像 | docker load | podman load | nerdctl load | ctr image import | 无 |
| 导出镜像 | docker save | podman save | nerdctl save | ctr image export | 无 |
| 删除容器 | docker rm | podman rm | nerdctl rm | ctr container rm | crictl rm |
| 删除镜像 | docker rmi | podman rmi | nerdctl rmi | ctr image rm | crictl rmi |
| 拉取镜像 | docker pull | podman pull | nerdctl pull | ctr image pull | crictl pull |
| 推送镜像 | docker push | podman push | nerdctl push | ctr image push | 无 |
| 在容器内部执行命令 | docker exec | podman exec | nerdctl exec | 无 | crictl exec |
如果您还对Docker比较怀旧的话，执行"alias docker=nerdctl"这样的命令后，您依然可以体验到与Docker相似的感觉。
nerdctl 和crictl 都是用于管理和操作容器的命令行工具，但是它们在开发者、设计目的和功能上有所不同。
-
- nerdctl：
开发者：由Docker的创始人之一，也是containerd项目的主要贡献者Akihiro Suda开发。
- nerdctl：
设计目的：nerdctl是一个兼容Docker CLI的containerd CLI，意味着大部分Docker命令可以在nerdctl中运行。
功能：它可以管理容器的生命周期，如创建、运行、停止和删除容器。此外，它还支持镜像管理，网络管理，卷管理等。
-
- crictl：
开发者：由Kubernetes项目社区开发。
设计目的：crictl是一个命令行接口，用于与任何实现了Kubernetes容器运行时接口(CRI)的容器运行时进行交互，例如containerd，CRI-O等。
功能：它主要用于调试，可以从Kubernetes API Server的角度检查和理解容器运行时的行为。它允许用户直接与容器运行时进行交互，实现容器生命周期管理，镜像管理等。
总的来说，二者主要区别在于他们的使用场景和目标用户并不完全相同。nerdctl更适合需要Docker CLI兼容性的用户，而crictl则更适合需要调试和理解Kubernetes CRI容器运行时行为的用户。