1.下载containerd-1.6.1-linux-amd64.tar.gz
tar -C /usr/local -xf containerd-1.6.1-linux-amd64.tar.gz
/lib/systemd/system/containerd.service 文件如下:
[Unit]
Description=containerd container runtime
Documentation=https://containerd.io
After=network.target
[Service]
ExecStartPre=/sbin/modprobe overlay
ExecStart=/usr/local/bin/containerd
Delegate=yes
KillMode=process
LimitNOFILE=1048576
# Having non-zero Limit*s causes performance problems due to accounting overhead
# in the kernel. We recommend using cgroups to do container-local accounting.
LimitNPROC=infinity
LimitCORE=infinity
[Install]
WantedBy=multi-user.target
sudo systemctl daemon-reload
sudo systemctl enable containerd.service
sudo systemctl start containerd.service
2. 安装网络插件
https://github.com/containernetworking/plugins/releases
下载 cni-plugins-linux-amd64-v1.1.1.tgz
tar zxvf cni-plugins-linux-amd64-v1.1.1.tgz -C /opt/cni/bin/
3.安装crictl
wget https://github.com/kubernetes-sigs/cri-tools/releases/download/v1.20.0/crictl-v1.20.0-linux-amd64.tar.gz
sudo tar zxvf crictl-v1.20.0-linux-amd64.tar.gz -C /usr/local/bin
vi /etc/crictl.yaml
runtime-endpoint: unix:///run/containerd/containerd.sock
image-endpoint: unix:///run/containerd/containerd.sock
timeout: 10
debug: false
$ cat container-config.json
{
"metadata": {
"name": "busybox"
},
"image":{
"image": "busybox"
},
"command": [
"top"
],
"log_path":"busybox.0.log",
"linux": {
}
}
$ cat pod-config.json
{
"metadata": {
"name": "nginx-sandbox",
"namespace": "default",
"attempt": 1,
"uid": "hdishd83djaidwnduwk28bcsb"
},
"log_directory": "/tmp",
"linux": {
}
}
来源https://github.com/containernetworking/cni
$ mkdir -p /etc/cni/net.d
$ cat >/etc/cni/net.d/10-mynet.conf <<EOF
{
"cniVersion": "0.2.0",
"name": "mynet",
"type": "bridge",
"bridge": "cni0",
"isGateway": true,
"ipMasq": true,
"ipam": {
"type": "host-local",
"subnet": "10.22.0.0/16",
"routes": [
{ "dst": "0.0.0.0/0" }
]
}
}
EOF
$ cat >/etc/cni/net.d/99-loopback.conf <<EOF
{
"cniVersion": "0.2.0",
"name": "lo",
"type": "loopback"
}
EOF
nerdctl -n k8s.io pull registry.aliyuncs.com/google_containers/pause:3.6
nerdctl -n k8s.io tag registry.aliyuncs.com/google_containers/pause:3.6 k8s.gcr.io/pause:3.6
crictl run --no-pull container-config.json pod-config.json 启动pod
4. kata环境
https://github.com/kata-containers/kata-containers/releases
下载kata二进制包
xz -d kata-static-2.3.2-x86_64.tar.xz
tar xvf kata-static-2.3.2-x86_64.tar -C /
/opt/kata/bin下面把 containerd-shim-kata-v2和kata-runtime复制/usr/local/bin目录
ref :https://github.com/kata-containers/kata-containers/blob/main/docs/install/container-manager/containerd/containerd-install.md
修改 /ect/containerd/config.toml
[plugins]
[plugins."io.containerd.grpc.v1.cri"]
[plugins."io.containerd.grpc.v1.cri".containerd]
default_runtime_name = "kata"
[plugins."io.containerd.grpc.v1.cri".containerd.runtimes]
[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.kata]
runtime_type = "io.containerd.kata.v2"
kata-runtime kata-check
如果报错
host system doesn't support vsock: stat /dev/vhost-vsock: no such file or directory: unknown
执行modprobe vhost-vsock
/opt/kata/share/defaults/kata-containers/configuration.toml 复制到 /etc/kata-containers/
crictl run --no-pull container-config.json pod-config.json 启动pod
如果报错
Could not create the sandbox cgroup cgroups: cgroup mountpoint does not exist: not found
sudo mkdir /sys/fs/cgroup/systemd
sudo mount -t cgroup -o none,name=systemd cgroup /sys/fs/cgroup/systemd
crictl run --no-pull container-config.json pod-config.json
62b048f367bde2235162df83e9c15acd02eff8f38d6bc68a0b1f39e41ab4c9e9
root@nmx-NUC8i5BEH:/home/nmx/pod# kata-runtime exec 62b048f367bde2235162df83e9c15acd02eff8f38d6bc68a0b1f39e41ab4c9e9
Get "http://shim/agent-url": context deadline exceeded (Client.Timeout exceeded while awaiting headers)
crictl inspectp podid
找到
"status": {
"id": "ad7325b511a2cf1f185eaea86567ad188370df80e90e656558c9008ac7d822b7",
kata-runtime exec ad7325b511a2cf1f185eaea86567ad188370df80e90e656558c9008ac7d822b7
