Kubernetes | 二进制安装Containerd v1.6.6

从官网下载二进制包，解压到 /usr/local 目录。
下载链接：https://github.com/containerd/containerd/releases/download/v1.6.6/containerd-1.6.6-linux-amd64.tar.gz

root@timo:~# tar Cxzvf /usr/local containerd-1.6.6-linux-amd64.tar.gz
bin/
bin/containerd-shim
bin/containerd
bin/containerd-shim-runc-v1
bin/containerd-stress
bin/containerd-shim-runc-v2
bin/ctr
root@timo:~# ls /usr/local/bin/
containerd  containerd-shim  containerd-shim-runc-v1  containerd-shim-runc-v2  containerd-stress  ctr
root@timo:~# 

配置文件没有提供，可以通过命令手动生成。
有两处需要修改。
1、SystemdCgroup = false改为SystemdCgroup = true
2、k8s.gcr.io改为registry.aliyuncs.com/google_containers

root@timo:~# mkdir -p /etc/containerd
root@timo:~# containerd config default > /etc/containerd/config.toml
root@timo:~# sed -i "s#SystemdCgroup = false#SystemdCgroup = true#" /etc/containerd/config.toml
root@timo:~# sed -i "s#k8s.gcr.io#registry.aliyuncs.com/google_containers#" /etc/containerd/config.toml

Service启动文件也没有提供，直接从官网下载。
下载链接：https://raw.githubusercontent.com/containerd/containerd/main/containerd.service

containerd命令是存放在 /usr/local/bin 目录的，如果是在别的路径，需要修改ExecStart参数。

root@timo:~# mv containerd.service /etc/systemd/system/containerd.service 
root@timo:~# cat /etc/systemd/system/containerd.service
# Copyright The containerd Authors.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

[Unit]
Description=containerd container runtime
Documentation=https://containerd.io
After=network.target local-fs.target

[Service]
ExecStartPre=-/sbin/modprobe overlay
ExecStart=/usr/local/bin/containerd

Type=notify
Delegate=yes
KillMode=process
Restart=always
RestartSec=5
# Having non-zero Limit*s causes performance problems due to accounting overhead
# in the kernel. We recommend using cgroups to do container-local accounting.
LimitNPROC=infinity
LimitCORE=infinity
LimitNOFILE=infinity
# Comment TasksMax if your systemd version does not supports it.
# Only systemd 226 and above support this version.
TasksMax=infinity
OOMScoreAdjust=-999

[Install]
WantedBy=multi-user.target
root@timo:~# 

上面步骤都完成就可以启动containerd了。

root@timo:~# systemctl daemon-reload
root@timo:~# systemctl enable --now containerd
Created symlink /etc/systemd/system/multi-user.target.wants/containerd.service → /etc/systemd/system/containerd.service.
root@timo:~# 
root@timo:~# ss -lnpt | grep containerd 
LISTEN    0         4096             127.0.0.1:38949            0.0.0.0:*        users:(("containerd",pid=5195,fd=18))                                          
root@timo:~# ps -ef | grep containerd
root        5195       1  0 12:39 ?        00:00:00 /usr/local/bin/containerd
root        5298    4480  0 12:39 pts/1    00:00:00 grep --color=auto containerd
root@timo:~# 

containerd提供了个 ctr 命令可以启动容器，启动一个redis容器试试。

root@timo:~# ctr images pull docker.io/library/redis:alpine
docker.io/library/redis:alpine:                                                   resolved       |++++++++++++++++++++++++++++++++++++++| 
index-sha256:5916c280afae05baf0dc9a0cc82fa8e51477bdbfc72f60a5c14fd2b7735bcf07:    done           |++++++++++++++++++++++++++++++++++++++| 
manifest-sha256:58ff33524a6664b35e50c1a243f07096eb05b479dc65e06f3592197353ca10fa: done           |++++++++++++++++++++++++++++++++++++++| 
layer-sha256:abe61b7e68d2f0e1b0ec8a60132416ee2a6347b65d999622e3fcdf8ef0b099c6:    done           |++++++++++++++++++++++++++++++++++++++| 
config-sha256:f934e82c14d178bda705b7c6363b065f3fc49bcbaf7914c181b117c65c566a1e:   done           |++++++++++++++++++++++++++++++++++++++| 
layer-sha256:2408cc74d12b6cd092bb8b516ba7d5e290f485d3eb9672efc00f0583730179e8:    done           |++++++++++++++++++++++++++++++++++++++| 
layer-sha256:e90389148883be3c6500b090644113cf690b528e6f057515568a36bfd0b0d87c:    done           |++++++++++++++++++++++++++++++++++++++| 
layer-sha256:c6c08b6ea4d56366e32f458bcaeb9933840882cfa4ac9073d0d42649e34d1a16:    done           |++++++++++++++++++++++++++++++++++++++| 
layer-sha256:a1a4b4673a2365320badae5b96d7638c5901770884781d8695c8378499c72e73:    done           |++++++++++++++++++++++++++++++++++++++| 
layer-sha256:e14aa32bdd63af41851e289cafde7077de5e474d6521ca720bbfae51e29b401d:    done           |++++++++++++++++++++++++++++++++++++++| 
elapsed: 16.1s                                                                    total:  11.3 M (718.9 KiB/s)                                     
unpacking linux/amd64 sha256:5916c280afae05baf0dc9a0cc82fa8e51477bdbfc72f60a5c14fd2b7735bcf07...
done: 9.498455ms        
root@timo:~# ctr run -d docker.io/library/redis:alpine redis
ctr: failed to create shim task: OCI runtime create failed: unable to retrieve OCI runtime error (open /run/containerd/io.containerd.runtime.v2.task/default/redis/log.json: no such file or directory): exec: "runc": executable file not found in $PATH: unknown
root@timo:~# 

直接报错了，报错很明显是缺少 runc，那就下载吧。

containerd在v1.6.4版本以后使用v1.1.2的runc和v1.1.1的cni。

image.png

下载链接：https://github.com/opencontainers/runc/releases/download/v1.1.2/runc.amd64

root@timo:~# install -m 755 runc.amd64 /usr/local/sbin/runc
root@timo:~# ls /usr/local/sbin/runc
/usr/local/sbin/runc
root@timo:~# runc -v
runc version 1.1.2
commit: v1.1.2-0-ga916309f
spec: 1.0.2-dev
go: go1.17.10
libseccomp: 2.5.3
root@timo:~# 

顺便把CNI插件也安装上。
下载链接：https://github.com/containernetworking/plugins/releases/download/v1.1.1/cni-plugins-linux-amd64-v1.1.1.tgz

root@timo:~# mkdir -p /opt/cni/bin
root@timo:~# tar Cxzvf /opt/cni/bin cni-plugins-linux-amd64-v1.1.1.tgz
./
./macvlan
./static
./vlan
./portmap
./host-local
./vrf
./bridge
./tuning
./firewall
./host-device
./sbr
./loopback
./dhcp
./ptp
./ipvlan
./bandwidth
root@timo:~# 

runc安装之后，前面的redis容器再重新启动试试。

root@timo:~# ctr container ls
CONTAINER    IMAGE                             RUNTIME                  
redis        docker.io/library/redis:alpine    io.containerd.runc.v2    
root@timo:~# 
root@timo:~# ctr task start -d redis
root@timo:~# ctr task ls 
TASK     PID     STATUS    
redis    5602    RUNNING
root@timo:~# 

containerd自带的 ctr 命令仅用于调试，建议下载 crictl。
下载链接：https://github.com/kubernetes-sigs/cri-tools/releases/download/v1.24.2/crictl-v1.24.2-linux-amd64.tar.gz

root@timo:~# tar xzvf crictl-v1.24.2-linux-amd64.tar.gz
crictl
root@timo:~# install -m 755 crictl /usr/local/bin/crictl
root@timo:~# ls /usr/local/bin/crictl
/usr/local/bin/crictl
root@timo:~# 
root@timo:~# crictl -v
crictl version v1.24.2
root@timo:~# 

生成 crictl 的配置文件，用于连接到containerd。
建议做一下，可以将报错给屏蔽掉。

root@timo:~# crictl images 
WARN[0000] image connect using default endpoints: [unix:///var/run/dockershim.sock unix:///run/containerd/containerd.sock unix:///run/crio/crio.sock unix:///var/run/cri-dockerd.sock]. As the default settings are now deprecated, you should set the endpoint instead. 
ERRO[0000] unable to determine image API version: rpc error: code = Unavailable desc = connection error: desc = "transport: Error while dialing dial unix /var/run/dockershim.sock: connect: no such file or directory" 
IMAGE               TAG                 IMAGE ID            SIZE
root@timo:~# 
root@timo:~# cat > /etc/crictl.yaml < runtime-endpoint: unix:///run/containerd/containerd.sock
> image-endpoint: unix:///run/containerd/containerd.sock
> timeout: 10
> debug: false
> EOF
root@timo:~#
root@timo:~# cat /etc/crictl.yaml
runtime-endpoint: unix:///run/containerd/containerd.sock
image-endpoint: unix:///run/containerd/containerd.sock
timeout: 10
debug: false
root@timo:~#
root@timo:~# crictl images
IMAGE               TAG                 IMAGE ID            SIZE
root@timo:~# crictl pull busybox 
Image is up to date for sha256:62aedd01bd8520c43d06b09f7a0f67ba9720bdc04631a8242c65ea995f3ecac8
root@timo:~# crictl images 
IMAGE                       TAG                 IMAGE ID            SIZE
docker.io/library/busybox   latest              62aedd01bd852       778kB
root@timo:~# 

温馨提示
containerd---.tar.gz 默认没提供runc和cni插件。
cri-containerd-(cni-)-.tar.gz 提供了runc和cni插件，但runc的依赖包libseccomp没有安装，有两种方式。
1、下载二进制的runc，替换掉原来的（推荐）。
2、Ubuntu的apt-get或CentOS的yum安装libseccomp。