nerdctl实战：Docker风格的Containerd操作利器

小马同学-2026-09-20 15:34

七、nerdctl 实践

文章目录

  • [七、nerdctl 实践](#七、nerdctl 实践)
    • [nerdctl 安装](#nerdctl 安装)
    • [nerdctl 管理镜像](#nerdctl 管理镜像)
    • [nerdctl 管理容器](#nerdctl 管理容器)
    • [nerdctl 管理网络](#nerdctl 管理网络)
    • [nerdctl 管理存储](#nerdctl 管理存储)
    • [nerdctl 管理命名空间](#nerdctl 管理命名空间)

nerdctl 安装

我们推荐使用 nerdctl 管理containerd，命令语法与 docker 一致。

截止 2023-05-24 最新版本是 v 1.4.0github项目地址：https://github.com/containerd/nerdctl/releasescni插件项目地址：https://github.com/containernetworking/plugins/releases

bash 复制代码 
# 下载并安装
[root@localhost ~]# wget https://github.com/containerd/nerdctl/releases/download/v1.4.0/nerdctl-1.4.0- linux-amd64.tar.gz
# 解压文件
[root@localhost ~]# tar -xf nerdctl-1.4.0-linux-amd64.tar.gz -C /usr/bin/

# 配置nerdctl命令自动补全
[root@localhost ~]# nerdctl completion bash > /etc/bash_completion.d/nerdctl
[root@localhost ~]# source /etc/bash_completion.d/nerdctl

# 下载nerdctl所需要的cni插件
[root@localhost ~]# wget https://github.com/containernetworking/plugins/releases/download/v1.3.0/cni- plugins-linux-amd64-v1.3.0.tgz
[root@localhost ~]# mkdir -p /opt/cni/bin
[root@localhost ~]# tar -xf cni-plugins-linux-amd64-v1.3.0.tgz -C /opt/cni/bin

如果nerdctl补全是报错信息如下：

bash 复制代码 
_get_comp_words_by_ref: command not found

解决方法：安装 bash-completion
[root@localhost ~]# yum install -y bash-completion

配置镜像加速

bash 复制代码 
#编辑containerd的配置文件config.toml，如果不存在，需要手动生成，方法 containerd config default > /etc/containerd/config.toml，在配置文件中搜索关键字"config_path"，在其下面添加镜像加速参数
# 生成containerd配置
[root@docker ~]# containerd config default > /etc/containerd/config.toml
[root@control ~]# vim /etc/containerd/config.toml
146    [plugins."io.containerd.grpc.v1.cri".registry]
147      config_path = "/etc/containerd/certs.d"              #配置这里
[root@control ~]# mkdir -p /etc/containerd/certs.d/docker.io
[root@localhost ~]# vim /etc/containerd/certs.d/docker.io/hosts.toml
server = "https://054b8ac70e8010d90f2ac00ef29e6580.mirror.swr.myhuaweicloud.com"
[host."https://054b8ac70e8010d90f2ac00ef29e6580.mirror.swr.myhuaweicloud.com"]
capabilities = ["pull", "resolve"]

#重启containerd服务生效
[root@control ~]# systemctl restart containerd

nerdctl 管理镜像

bash 复制代码 
[root@localhost ~]# nerdctl image <按tab键><按tab键>
build    (Build an image from a Dockerfile. Needs buildkitd to be running.)
convert  (convert an image)
decrypt  (decrypt an image)
encrypt  (encrypt image layers)
history  (Show the history of an image)
inspect  (Display detailed information on one or more images.)
load     (Load an image from a tar archive or STDIN)
ls       (List images)
prune    (Remove unused images)
pull     (Pull an image from a registry. Optionally specify "ipfs://" or
"ipns://" scheme to pull image from IPFS.)
push     (Push an image or a repository to a registry. Optionally specify
"ipfs://" or "ipns://" scheme to push image to IPFS.)
rm       (Remove one or more images)
save     (Save one or more images to a tar archive (streamed to STDOUT by
default))
tag      (Create a tag TARGET_IMAGE that refers to SOURCE_IMAGE)

ls

作用：查看本地镜像清单。

示例：

bash 复制代码 
[root@localhost ~]# nerdctl image ls
REPOSITORY    TAG    IMAGE ID    CREATED    PLATFORM    SIZE    BLOB SIZE

# 可简写如下
[root@localhost ~]# nerdctl images

pull

作用：从网络上下载镜像。

示例：

bash 复制代码 
#下载镜像busybox
[root@localhost ~]# nerdctl image pull busybox

# 可简写如下下载httpd
[root@localhost ~]# nerdctl pull httpd
[root@localhost ~]# nerdctl image ls
REPOSITORY    TAG       IMAGE ID        CREATED           PLATFORM       SIZE
BLOB SIZE
busybox       latest    f9a104fddb33    19 minutes ago    linux/amd64    4.1 MiB
2.1 MiB
httpd         latest    fbc12199ccad    44 seconds ago    linux/amd64    152.4
MiB    55.8 MiB

rm

作用：删除本地不用的镜像。

示例：

bash 复制代码 
[root@localhost ~]# nerdctl image rm httpd
[root@localhost ~]# nerdctl rmi busybox

[root@localhost ~]# nerdctl images
REPOSITORY    TAG       IMAGE ID        CREATED           PLATFORM       SIZE
BLOB SIZE
busybox       latest    f9a104fddb33    19 minutes ago    linux/amd64    4.1 MiB
2.1 MiB

tag

作用：给镜像打标签。

示例：

bash 复制代码 
[root@localhost ~]# nerdctl tag busybox busybox_containerd

[root@localhost ~]# nerdctl images
REPOSITORY            TAG       IMAGE ID        CREATED           PLATFORM
SIZE       BLOB SIZE
busybox               latest    f9a104fddb33    34 minutes ago    linux/amd64
4.1 MiB    2.1 MiB
busybox_containerd    latest    f9a104fddb33    3 seconds ago     linux/amd64
4.1 MiB    2.1 MiB

save

作用：将本地镜像导出为文件。

示例：

bash 复制代码 
[root@localhost ~]# nerdctl image save busybox -o busybox.tar
# 可简写为
[root@localhost ~]# nerdctl save busybox -o busybox.tar

# 删除镜像
[root@localhost ~]# nerdctl image rm busybox

[root@localhost ~]# nerdctl images
REPOSITORY            TAG       IMAGE ID        CREATED           PLATFORM
SIZE       BLOB SIZE
busybox_containerd    latest    f9a104fddb33    57 seconds ago    linux/amd64
4.1 MiB    2.1 MiB

load

作用：导入tar文件中镜像。

示例：

bash 复制代码 
[root@localhost ~]# nerdctl image load -i busybox.tar

# 可简写为
[root@localhost ~]# nerdctl load -i busybox.tar

[root@localhost ~]# nerdctl images
REPOSITORY            TAG       IMAGE ID        CREATED               PLATFORM
SIZE       BLOB SIZE
busybox               latest    f9a104fddb33    7 seconds ago         linux/amd64
4.1 MiB    2.1 MiB
busybox_containerd    latest    f9a104fddb33    About a minute ago    linux/amd64
4.1 MiB    2.1 MiB

history

作用：查看镜像构建时的历史命令层次结构。

示例：

bash 复制代码 
[root@localhost ~]# nerdctl image history busybox SNAPSHOT
CREATED          CREATED BY                           SIZE       COMMENT
sha256:65014c70e84b6817fac42bb201ec5c1ea460a8da246cac0e481f5c9a9491eac0    10
months ago    BusyBox 1.37.0 (glibc), Debian 12    4.1 MiB

inspect

作用：查看镜像详细信息。

示例：

bash 复制代码 
[root@localhost ~]# nerdctl image inspect busybox
[
	{
		"Id":
"sha256:6d3e4188a38af91b0c1577b9e88c53368926b2fe0e1fb985d6e8a70040520c4d",
		"RepoTags": [
			"busybox:latest"
		],
		"RepoDigests": [
		
"busybox@sha256:f9a104fddb33220ec80fc45a4e606c74aadf1ef7a3832eb0b05be9e90cd61f5f
"
		],
		"Comment": "",
		"Created": "2024-09-26T21:31:42Z",
		"Author": "",
		"Config": {
			"AttachStdin": false,
			"Env": [
		
"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
			],
			"Cmd": [
				"sh"
			]
		},
		"Architecture": "amd64",
		"Os": "linux",
		"Size": 4337664,
		"RootFS": {
			"Type": "layers",
			"Layers": [
"sha256:65014c70e84b6817fac42bb201ec5c1ea460a8da246cac0e481f5c9a9491eac0"
			]
		},
		"Metadata": {
				"LastTagTime": "0001-01-01T00:00:00Z"
		}
	}
]

prune

作用：删除所有未使用的镜像。

示例：

bash 复制代码 
[root@localhost ~]# nerdctl image prune --all --force

[root@localhost ~]# nerdctl image ls
REPOSITORY    TAG    IMAGE ID    CREATED    PLATFORM    SIZE    BLOB SIZE
[root@localhost ~]#

nerdctl 管理容器

帮助信息

bash 复制代码 
[root@localhost ~]# nerdctl container --help Manage containers
Usage: nerdctl container [flags]
Commands:
commit   Create a new image from a container's changes
cp       Copy files/folders between a running container and the local
filesystem.
create   Create a new container. Optionally specify "ipfs://" or "ipns://"
scheme to pull image from IPFS.
exec     Run a command in a running container
inspect  Display detailed information on one or more containers.
kill     Kill one or more running containers
logs     Fetch the logs of a container. Expected to be used with 'nerdctl run -
d'.
ls       List containers
pause    Pause all processes within one or more containers
port     List port mappings or a specific mapping for the container
prune    Remove all stopped containers
rename   rename a container
restart  Restart one or more running containers
rm       Remove one or more containers
run      Run a command in a new container. Optionally specify "ipfs://" or
"ipns://" scheme to pull image from IPFS.
start    Start one or more running containers
stop     Stop one or more running containers
unpause  Unpause all processes within one or more containers
update   Update one or more running containers
wait     Block until one or more containers stop, then print their exit codes.
Flags:
-h, --help   help for container
See also 'nerdctl --help' for the global flags such as '--namespace', '--
snapshotter', and '--cgroup-manager'.

ls

作用：查看容器清单。

示例：

bash 复制代码 
[root@localhost ~]# nerdctl container ls
CONTAINER ID    IMAGE    COMMAND    CREATED    STATUS    PORTS    NAMES
# 可简写为
[root@localhost ~]# nerdctl ps
CONTAINER ID    IMAGE    COMMAND    CREATED    STATUS    PORTS    NAMES

# 使用-a选项查看所有容器，包括未运行的
[root@localhost ~]# nerdctl container ls -a
CONTAINER ID    IMAGE    COMMAND    CREATED    STATUS    PORTS    NAMES

常用选项：

-a, --all Show all containers (default shows just running)

-f, --filter strings Filter matches containers based on given conditions

--format string Format the output using the given Go template, e.g, '{{json .}}', 'wide'

run

作用：创建并运行容器

示例：

bash 复制代码 
# 语法：
[root@localhost ~]# nerdctl run --help 
Run a command in a new container. Optionally specify "ipfs://" or "ipns://" scheme to pull image from IPFS.

Usage: nerdctl run [flags] IMAGE [COMMAND] [ARG...]

[root@localhost ~]# nerdctl container run -it ubuntu
root@0da9aad32119:/# exit
exit
# 可简写为
[root@localhost ~]# nerdctl run -it ubuntu

# 容器状态为Exited
[root@localhost ~]# nerdctl container ls
CONTAINER ID    IMAGE    COMMAND    CREATED    STATUS    PORTS    NAMES

[root@localhost ~]# nerdctl container ls -a
CONTAINER ID    IMAGE                              COMMAND        CREATED
STATUS                         PORTS    NAMES
0da9aad32119    docker.io/library/ubuntu:latest    "/bin/bash"    3 minutes ago
Exited (130) 2 minutes ago              ubuntu-0da9a

常用选项：

--cpu-shares uint CPU shares (relative weight)

--cpus float Number of CPUs

-d, --detach Run container in background and print container ID

--dns strings Set custom DNS servers

-e, --env stringArray Set environment variables

-h, --hostname string Container host name

-i, --interactive Keep STDIN open even if not attached

--ip string Pv4 address to assign to the container

--mac-address string MAC address to assign to the container

-m, --memory string Memory limit

--name string Assign a name to the container

--net strings Connect a container to a network ("bridge"|"host"|"none"|) (default bridge)

--network strings Connect a container to a network ("bridge"|"host"|"none"|"container:"|)

(default bridge)

--privileged Give extended privileges to this container

--pull string Pull image before running ("always"|"missing"|"never") (default "missing")

--restart string Restart policy to apply when a container exits (implemented values:

"no"|"always|on-failure:n|unless-stopped") (default "no")

--rm Automatically remove the container when it exits

--runtime string Runtime to use for this container, e.g.

--stop-signal string Signal to stop a container (default "SIGTERM")

--stop-timeout Timeout (in seconds) to stop a container

-t, --tty Allocate a pseudo-TTY

-v, --volume Bind mount a volume

rm

作用：删除容器

示例：

bash 复制代码 
[root@localhost ~]# nerdctl container rm 0da9aad32119
0da9aad32119

[root@localhost ~]# nerdctl container ls -a
CONTAINER ID    IMAGE    COMMAND    CREATED    STATUS    PORTS    NAMES

prune

作用：删除所有未运行的容器。

示例：

bash 复制代码 
[root@localhost ~]# nerdctl container run ubuntu

[root@localhost ~]# nerdctl container run ubuntu

[root@localhost ~]# nerdctl container ls -a
CONTAINER ID    IMAGE                              COMMAND        CREATED
STATUS                       PORTS    NAMES
3778651cfacb    docker.io/library/ubuntu:latest    "/bin/bash"    5 seconds ago
Exited (0) 5 seconds ago              ubuntu-37786
3e8221845ab4    docker.io/library/ubuntu:latest    "/bin/bash"    11 seconds ago
Exited (0) 11 seconds ago             ubuntu-3e822

[root@localhost ~]# nerdctl container prune --force 
Deleted Containers:
3778651cfacba1cd489b065ff7017b272b9edddc71211e2a6e567d9d0ec8ac54
3e8221845ab479f18a091c04443d26632946c9ced264c21a490f6b3052bde0b2

rename

作用：重命名容器。

示例：

bash 复制代码 
[root@localhost ~]# nerdctl container run --name ubuntu-1 ubuntu

[root@localhost ~]# nerdctl container ls -a
CONTAINER ID    IMAGE                              COMMAND        CREATED
STATUS                       PORTS    NAMES
61384145427a    docker.io/library/ubuntu:latest    "/bin/bash"    13 seconds ago
Exited (0) 13 seconds ago             ubuntu-1

[root@localhost ~]# nerdctl container rename ubuntu-1 ubuntu
[root@localhost ~]# nerdctl container ls -a
CONTAINER ID    IMAGE                              COMMAND        CREATED
STATUS                       PORTS    NAMES
61384145427a    docker.io/library/ubuntu:latest    "/bin/bash"    26 seconds ago
Exited (0) 26 seconds ago             ubuntu

[root@localhost ~]# nerdctl container rm ubuntu 
ubuntu

stop 和 start

作用：停止和启动容器。

示例：

bash 复制代码 
[root@localhost ~]# nerdctl container run -d --name nginx1 nginx
[root@localhost ~]# nerdctl container ls --format "{{.Names}} {{.Status}}" 
nginx1 Up

[root@localhost ~]# nerdctl container stop nginx1 
nginx1
[root@localhost ~]# nerdctl container ls --format "{{.Names}} {{.Status}}" -a
nginx1 Exited (0) 13 seconds ago

[root@localhost ~]# nerdctl container start nginx1 
nginx1
[root@localhost ~]# nerdctl container ls --format "{{.Names}} {{.Status}}" 
nginx1 Up

restart

作用：重启容器。

示例：

bash 复制代码 
[root@localhost ~]# nerdctl container restart nginx1 
nginx1

pause 和 unpause

作用：暂停和取消挂起容器。

示例：

bash 复制代码 
[root@localhost ~]# nerdctl container pause nginx1 
nginx1
[root@localhost ~]# nerdctl container ls --format "{{.Names}} {{.Status}}" -a 
nginx1 Paused

[root@localhost ~]# nerdctl container unpause nginx1 
nginx1
[root@localhost ~]# nerdctl container ls --format "{{.Names}} {{.Status}}" -a 
nginx1 Up

kill

作用：给容器发信号，默认发KILL信号。

示例：

bash 复制代码 
[root@localhost ~]# nerdctl container kill nginx1
945c89b61aafc3475317e8801ad8526fdf337b038bfa315472e4c723bf5406f1
[root@localhost ~]# nerdctl container ls -a --format "{{.Names}} {{.Status}}" 
nginx1 Exited (137) 8 seconds ago

exec

作用：在运行的容器内部执行命令。

示例：

bash 复制代码 
[root@localhost ~]# nerdctl container start nginx1 
nginx1

[root@localhost ~]# nerdctl container exec -it nginx1 bash
root@945c89b61aaf:/# exit
exit

cp

作用：将宿主机文件复制给容器。

示例：

bash 复制代码 
[root@localhost ~]# nerdctl container cp /etc/hostname nginx1:
[root@localhost ~]# nerdctl container exec nginx1 ls hostname 
hostname

思考：如果容器中的文件拷贝给宿主机该如何操作inspect作用：查看容器详细信息。

inspect

作用：查看容器详细信息。

示例：

bash 复制代码 
[root@localhost ~]# nerdctl container inspect nginx1
[
{
"Id": "945c89b61aafc3475317e8801ad8526fdf337b038bfa315472e4c723bf5406f1",
"Created": "2025-08-02T14:07:36.213384887Z",
"Path": "/docker-entrypoint.sh",
"Args": [
"nginx",
"-g",
"daemon off;"
],
"State": {
"Status": "running",
"Running": true,
"Paused": false,
"Restarting": false,
"Pid": 49359,
"ExitCode": 0,
"Error": "",
"FinishedAt": "0001-01-01T00:00:00Z"
},
"Image": "docker.io/library/nginx:latest",
"ResolvConfPath":
"/var/lib/nerdctl/1935db59/containers/default/945c89b61aafc3475317e8801ad8526fdf3
37b038bfa315472e4c723bf5406f1/resolv.conf",
"HostnamePath":
"/var/lib/nerdctl/1935db59/containers/default/945c89b61aafc3475317e8801ad8526fdf3
37b038bfa315472e4c723bf5406f1/hostname",
"LogPath":
"/var/lib/nerdctl/1935db59/containers/default/945c89b61aafc3475317e8801ad8526fdf3
37b038bfa315472e4c723bf5406f1/945c89b61aafc3475317e8801ad8526fdf337b038bfa315472e
4c723bf5406f1-json.log",
"Name": "nginx1",
"RestartCount": 0,
"Driver": "overlayfs",
"Platform": "linux",
"AppArmorProfile": "",
"Mounts": null,
"Config": {
"Hostname": "945c89b61aaf",
"AttachStdin": false,
"Labels": {
"containerd.io/restart.explicitly-stopped": "false",
"io.containerd.image.config.stop-signal": "SIGQUIT",
"nerdctl/extraHosts": "null",
"nerdctl/hostname": "945c89b61aaf",
"nerdctl/log-uri": "binary:///usr/bin/nerdctl?
_NERDCTL_INTERNAL_LOGGING=%2Fvar%2Flib%2Fnerdctl%2F1935db59",
"nerdctl/name": "nginx1",
"nerdctl/namespace": "default",
"nerdctl/networks": "[\"bridge\"]",
"nerdctl/platform": "linux/amd64",
"nerdctl/state-dir":
"/var/lib/nerdctl/1935db59/containers/default/945c89b61aafc3475317e8801ad8526fdf3
37b038bfa315472e4c723bf5406f1"
}
},
"NetworkSettings": {
"GlobalIPv6Address": "",
"GlobalIPv6PrefixLen": 0,
"IPAddress": "10.4.0.15",
"IPPrefixLen": 24,
"MacAddress": "32:81:21:fb:b4:72",
"Networks": {
"unknown-eth0": {
"IPAddress": "10.4.0.15",
"IPPrefixLen": 24,
"GlobalIPv6Address": "",
"GlobalIPv6PrefixLen": 0,
"MacAddress": "32:81:21:fb:b4:72"
}
}
}
}
]
[root@localhost ~]#

logs

作用：显示容器console终端内容。

示例：

bash 复制代码 
[root@localhost ~]# nerdctl container logs nginx1 
/docker-entrypoint.sh: /docker-entrypoint.d/ is not empty, will attempt to perform configuration /docker-entrypoint.sh: Looking for shell scripts in /docker-entrypoint.d/ /docker-entrypoint.sh: Launching /docker-entrypoint.d/10-listen-on-ipv6-by- default.sh
10-listen-on-ipv6-by-default.sh: info: IPv6 listen already enabled
/docker-entrypoint.sh: Sourcing /docker-entrypoint.d/15-local-resolvers.envsh
/docker-entrypoint.sh: Launching /docker-entrypoint.d/20-envsubst-on-templates.sh
/docker-entrypoint.sh: Launching /docker-entrypoint.d/30-tune-worker-processes.sh
/docker-entrypoint.sh: Configuration complete; ready for start up
2025/08/02 14:10:40 [notice] 1#1: using the "epoll" event method
2025/08/02 14:10:40 [notice] 1#1: nginx/1.29.0
2025/08/02 14:10:40 [notice] 1#1: built by gcc 12.2.0 (Debian 12.2.0-14+deb12u1)
2025/08/02 14:10:40 [notice] 1#1: OS: Linux 4.18.0-553.6.1.el8.x86_64
2025/08/02 14:10:40 [notice] 1#1: getrlimit(RLIMIT_NOFILE): 1024:1024
2025/08/02 14:10:40 [notice] 1#1: start worker processes
2025/08/02 14:10:40 [notice] 1#1: start worker process 22
2025/08/02 14:10:40 [notice] 1#1: start worker process 23
2025/08/02 14:10:40 [notice] 1#1: start worker process 24
2025/08/02 14:10:40 [notice] 1#1: start worker process 25

port作用：显示宿主机和容器之间端口映射关系。

示例：

bash 复制代码 
[root@localhost ~]# nerdctl container run --name nginx -d -p 8080:80 nginx
2d0923e9f7c816d9fc8f5fa30b1be332c90fff0e354c981b919fc67bd1f97101

[root@localhost ~]# nerdctl container port nginx
80/tcp -> 0.0.0.0:8080

commit

作用：将容器提交为镜像。

示例：

bash 复制代码 
[root@localhost ~]# nerdctl commit nginx nginx_containerd
sha256:6e60d18c9e7f7968f49edfacae16e39df2a995d3119b0b23356fd501cd8348a6
[root@localhost ~]# nerdctl images
REPOSITORY          TAG       IMAGE ID        CREATED           PLATFORM
SIZE         BLOB SIZE
nginx               latest    84ec966e61a8    17 minutes ago    linux/amd64
194.4 MiB    68.9 MiB
nginx_containerd    latest    d59a30a56f7f    3 seconds ago     linux/amd64
194.4 MiB    68.9 MiB
ubuntu              latest    a08e551cb338    26 minutes ago    linux/amd64
81.1 MiB     28.4 MiB

nerdctl 管理网络

Containerd 中的网络与Docker类似，所有网络接口默认都是虚拟接口。

当使用nerdctl创建容器时，nerdctl命令会创建一个名称为bridge的Linux网桥（其上有一个nerdctl0内部接口），利用了Linux虚拟网络技术，在本地主机和容器内分别创建一个虚拟接口，并让它们彼此连通（这样的一对接口叫做veth pair）。Containerd 默认指定了nerdctl0接口的IP地址和子网掩码，让主机和容器之间可以通过网桥相互通信。

示例

bash 复制代码 
[root@localhost ~]# nerdctl run -d busybox -- sleep infinity
b721795e02103578656152662f414e88f32191e64976ccafe60c4af10a8fa8c8

[root@localhost ~]# nerdctl container ls
CONTAINER ID    IMAGE                               COMMAND             CREATED
STATUS    PORTS    NAMES
b721795e0210    docker.io/library/busybox:latest    "sleep infinity"    12
seconds ago    Up                 busybox-b7217

[root@localhost ~]# nerdctl exec busybox-b7217 -- ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: eth0@if5: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1500 qdisc noqueue
link/ether f6:fc:0b:35:5e:2c brd ff:ff:ff:ff:ff:ff
inet 10.4.0.18/24 brd 10.4.0.255 scope global eth0
valid_lft forever preferred_lft forever
inet6 fe80::f4fc:bff:fe35:5e2c/64 scope link
valid_lft forever preferred_lft forever
[root@localhost ~]#


容器内看到的网卡名：2: eth0@if5 ，@if5代表对端是5号网卡。
[root@localhost ~]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default
qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: ens160: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group
default qlen 1000
link/ether 00:0c:29:a7:b8:a7 brd ff:ff:ff:ff:ff:ff
altname enp3s0
inet 192.168.108.30/24 brd 192.168.108.255 scope global noprefixroute ens160
valid_lft forever preferred_lft forever
inet6 fe80::20c:29ff:fea7:b8a7/64 scope link noprefixroute
valid_lft forever preferred_lft forever
3: nerdctl0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP
group default qlen 1000
link/ether 3a:1a:93:b7:ea:d7 brd ff:ff:ff:ff:ff:ff
inet 10.4.0.1/24 brd 10.4.0.255 scope global nerdctl0
valid_lft forever preferred_lft forever
inet6 fe80::381a:93ff:feb7:ead7/64 scope link
valid_lft forever preferred_lft forever
5: veth790d9140@if2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue
master nerdctl0 state UP group default
link/ether 3a:fa:0e:fd:27:5b brd ff:ff:ff:ff:ff:ff link-netnsid 0
inet6 fe80::38fa:eff:fefd:275b/64 scope link
valid_lft forever preferred_lft forever

对应容器主机的网卡：5: veth790d9140@if2 ，@if2 代表对端容器内对应2号网卡。

示例：

bash 复制代码 
[root@localhost ~]# nerdctl network ls
NETWORK ID NAME FILE
17f29b073143 bridge /etc/cni/net.d/nerdctl-bridge.conflist
host
none
[root@localhost ~]# nerdctl network inspect bridge
[
{
"Name": "bridge",
"Id": "17f29b073143d8cd97b5bbe492bdeffec1c5fee55cc1fe2112c8b9335f8b6121",
"IPAM": {
"Config": [
{
"Subnet": "10.4.0.0/24",
"Gateway": "10.4.0.1"
}
]
},
"Labels": {
"nerdctl/default-network": "true"
}
}
]

# 主机中nerdctl0就是容器的网关
[root@localhost ~]# ip addr show nerdctl0
3: nerdctl0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP
group default qlen 1000
link/ether 3a:1a:93:b7:ea:d7 brd ff:ff:ff:ff:ff:ff
inet 10.4.0.1/24 brd 10.4.0.255 scope global nerdctl0
valid_lft forever preferred_lft forever
inet6 fe80::381a:93ff:feb7:ead7/64 scope link
valid_lft forever preferred_lft forever

目前 Containerd 网桥是Linux网桥，用户可以使用brctl show 命令查看网桥和端口连接信息。
# 查看网桥
[root@localhost ~]# brctl show
bridge name     bridge id               STP enabled     interfaces
nerdctl0                8000.3a1a93b7ead7       no              veth790d9140

nerdctl network 命令使用帮助

bash 复制代码 
[root@localhost ~]# nerdctl network --help Manage networks
Usage: nerdctl network [flags]
Commands:
create   Create a network
inspect  Display detailed information on one or more networks
ls       List networks
prune    Remove all unused networks
rm       Remove one or more networks
Flags:
-h, --help   help for network
See also 'nerdctl --help' for the global flags such as '--namespace', '--
snapshotter', and '--cgroup-manager'.

nerdctl 管理存储

nerdctl volume 命令使用帮助

bash 复制代码 
[root@localhost ~]# nerdctl volume --help Manage volumes
Usage: nerdctl volume [flags]
Commands:
create   Create a volume
inspect  Display detailed information on one or more volumes
ls       List volumes
prune    Remove all unused local volumes
rm       Remove one or more volumes
Flags:
-h, --help   help for volume
See also 'nerdctl --help' for the global flags such as '--namespace', '--
snapshotter', and '--cgroup-manager'.

nerdctl 命令创建容器的时候，可以使用 -v 选项将本地目录挂载给容器实现数据持久化。

示例：

bash 复制代码 
[root@localhost ~]# mkdir /data
[root@localhost ~]# nerdctl run -d -v /data:/data busybox -- sleep infinity
d00a1646169a199e3038851f86b82bff03ac2db6ffd8ea3e875789d2a6d1a000
[root@localhost ~]# touch /data/f1
[root@localhost ~]# nerdctl exec busybox-d00a1 -- ls /data 
f1

nerdctl 命令创建容器的时候，也可以使用 -v 选项指定volume。

bash 复制代码 
# 直接写容器目录，会自动生成目录
[root@localhost ~]# nerdctl run -d -v /data busybox -- sleep infinity
29c94622886a219c93b5f6cd1c1ab190f998c66e3b4cbce75437507803b82eea
[root@localhost ~]# nerdctl exec busybox-29c94 -- touch /data/f2
#在/var/lib/nerdctl/xx/volumes/default/xx/_data/f2

#指定宿主机生成的目录名为data
[root@localhost ~]# nerdctl run -d -v data:/data busybox -- sleep infinity
1b1fc00e88471a5abd8787bae438ab8d5ab08f4ec4fa073805407f9fffe2fe73
[root@localhost ~]# nerdctl exec busybox-1b1fc -- touch /data/f3

# 生成data名字的卷
[root@localhost ~]# nerdctl volume ls
VOLUME NAME                                                         DIRECTORY
0c70033c26bcf456d9a0dc3f7dfe723f232e48dee2c8898bf987f8aeebacc1c7
/var/lib/nerdctl/1935db59/volumes/default/0c70033c26bcf456d9a0dc3f7dfe723f232e48d
ee2c8898bf987f8aeebacc1c7/_data
data
/var/lib/nerdctl/1935db59/volumes/default/data/_data

[root@localhost ~]# ls /var/lib/nerdctl/1935db59/volumes/default/0c70033c26bcf456d9a0dc3f7dfe723f232e48dee2c8898bf987f8aeebacc1c7/_data
f2
[root@localhost ~]# ls /var/lib/nerdctl/1935db59/volumes/default/data/_data 
f3

nerdctl 管理命名空间

bash 复制代码 
[root@localhost ~]# nerdctl namespace
Unrelated to Linux namespaces and Kubernetes namespaces

Usage: nerdctl namespace [flags]

Aliases: namespace, ns
Commands:
create   Create a new namespace
inspect  Display detailed information on one or more namespaces.
ls       List containerd namespaces
remove   Remove one or more namespaces
update   Update labels for a namespace

Flags:
-h, --help   help for namespace
See also 'nerdctl --help' for the global flags such as '--namespace', '--
snapshotter', and '--cgroup-manager'.

示例：

bash 复制代码 
# nerdctl容器管理工具
[root@localhost ~]# nerdctl namespace ls
NAME       CONTAINERS    IMAGES    VOLUMES    LABELS
default    10            4         2
相关推荐
九皇叔叔2 小时前
Kubernetes 命令式对象配置详解：使用 YAML 管理 Kubernetes 资源
docker·容器·k8s
CVer儿3 小时前
docker内llama.cpp和TRT-LLM win11本机部署qwen3.8
docker
萤火夜3 小时前
Docker(四) Docker介绍
docker·容器
.冰块.4 小时前
Docker 镜像深度学习：分层 Copy‑on‑Write、Dockerfile 语法、Harbor 私有仓库实操
docker·容器·harbor·镜像·dockerfile·images
szephyr4 小时前
Docker 镜像瘦身实战：从 1.2GB 压到 85MB 的完整过程
docker·容器·部署·多阶段构建·镜像优化
小马同学-4 小时前
Containerd入门：架构原理与安装部署
容器·containerd
溪语流沙7 小时前
Django + Vue电商项目第001讲：开篇｜注册登录加增删改查，那不是电商
redis·python·mysql·docker·typescript·django·vue
一直在努力学习的菜鸟8 小时前
Docker Info 详细解析（Rocky Linux 8.10 / Docker 29.8.1）
docker
小马同学-8 小时前
crictl实战：K8s容器运行时排障工具
容器·k8s·crictl
热门推荐
01国内可直接用、免费额度/永久免费的大模型API清单（含 SiliconFlow、火山、阿里、智谱、百度、Kimi、DeepSeek、DMXAPI 等）02蜘蛛磁力 搜索引擎大全，如何使用蜘蛛磁力查找磁力链接03GitHub 镜像站点04历年考研数学一、数学二、数学三真题试卷及答案PDF05人工智能（AI）发展史：详细里程碑06微信历史版本含下载地址（ Windows PC | 安卓 | MAC ）及设置微信不更新072026 国产 AI 大模型横评：DeepSeek、通义千问、Kimi、文心一言、星火、豆包谁更能打？08ZCode 周末送额度活动开启：3 亿 Token 免费领取09数学公理体系大全:第六章 选择公理的等价形式及证明102026 爱知・名古屋亚运会怎么看？直播平台+赛程安排分享