一、背景

使用Containerd理由

• kubernetes在1.23版本及以后版本不再默认采用Docker，而建议采用Containerd
• Containerd比Docker更加轻量级，在生产环境中使用更合适

二、说明

• 安装过程采用的kubernetes的集群的安装模式进行说明的，如果只需要在一台主机上安装containerd，忽略 可选择 和 scp 相关的命令及其说明即可
• 无论采用哪种系统进行安装，大同小异，最核心是 其配置信息

三、安装步骤

1. 环境

主机名称	系统	IP	描述
k8s-master01	Centos7 Core 3.10.0-1160.el7.x86_64	192.168.86.151	VMware虚拟机
k8s-node01	Centos7 Core 3.10.0-1160.el7.x86_64	192.168.86.161	VMware虚拟机
k8s-node02	Centos7 Core 3.10.0-1160.el7.x86_64	192.168.86.162	VMware虚拟机

2. 配置主机名称（可选择）

配置命令

# 1. 查看机器名称
hostname
# 2. 设置机器名称(下面的示例为设置当前机器名称为k8s-master01)
hostnamectl set-hostname k8s-master01
# 3. 修改hosts文件（配置主机名称和IP之间的映射）
echo -e "\n192.168.86.151  k8s-master01\n192.168.86.161  k8s-node01\n192.168.86.162 k8s-node02" >> /etc/hosts

3. 配置主机之间免密登录（可选择）

配置命令

# 1. 查看是否已经存在rsa公钥
cat ~/.ssh/id_rsa.pub
# 2. 如果不存在，则创建一个新的（可以设置密码，也可以不设置一直输入Enter键直到结束）
ssh-keygen -t rsa
# 3. copy公钥到指定的中间服务器（这里设置为k8s-master01）
ssh-copy-id root@k8s-master01

说明

• ssh 密钥默认保留在 ~/.ssh 目录中。
• ssh-keygen：用于为 ssh 生成、管理和转换认证密钥，支持RSA和DSA两种认证密钥。详细信息请通过 ssh-keygen --help 命令查看。
• ssh-copy-id：命令可以把本地主机的公钥复制到远程主机的authorized_keys文件上，给远程主机的用户主目录（home）和 /.ssh, 和/.ssh/authorized_keys设置合适的权限。也可以把本地的ssh公钥文件安装到远程主机对应的账户下。

参考资料：

ssh-keygen命令详解

免密登陆和ssh-copy-id命令解析

4. 下载安装文件

4.1 下载

根据系统和CPU类型选择cri-containerd-cni文件进行下载。下载完成后，将文件copy至中间主机（上面有例子为k8s-master01，也可以直接在k8s-master01上用wget命令下载）。

4.2 解压缩

将压缩包解压至 cri-containerd-cni 文件夹（这里用命令创建 cri-containerd-cni文件夹，因为没有实现创建该文件夹），防止将文件都解压缩到当前文件夹（可以看到有etc、opt、usr三个子文件夹）。

tar xzf cri-containerd-cni-1.5.9-linux-amd64.tar.gz -C cri-containerd-cni | mkdir cri-containerd-cni

5. 安装

先安装配置文件，然后安装执行文件。

5.1 复制配置文件

# 可以查看以下复制的相关文件内容，大概就明白什么意思了
cp cri-containerd-cni/etc/crictl.yaml /etc/
cp cri-containerd-cni/etc/systemd/system/containerd.service /etc/systemd/system/

（可选择） 执行并修改scp 命令，将文件复制到其他所有主机上（也可以将命令写入文件，也可以使用for循环）

# 可以查看以下复制的相关文件内容，大概就明白什么意思了
scp cri-containerd-cni/etc/crictl.yaml root@k8s-node01:/etc/
scp cri-containerd-cni/etc/systemd/system/containerd.service root@k8s-node01:/etc/systemd/system/

5.2 安装（需要在所有）

安装containerd 和相关依赖。

# 安装 containerd 和相关依赖
cp cri-containerd-cni/usr/local/bin/. /usr/local/bin/ -a
# 复制runc文件
cp cri-containerd-cni/usr/local/sbin/. /usr/local/sbin/ -a

（可选择） 执行并修改scp 命令，将文件复制到其他所有主机上（也可以将命令写入文件，也可以使用for循环）

scp -r cri-containerd-cni/usr/local/bin/. root@k8s-node01:/usr/local/bin/
scp -r cri-containerd-cni/usr/local/sbin/. root@k8s-node01:/usr/local/sbin/

5.3 生成和配置启动文件

# 1. 创建文件夹
mkdir -p /etc/containerd
# 2. 生成配置文件
containerd config default > /etc/containerd/config.toml

按照如下编辑 /etc/containerd/config.toml文件内容（基础镜像和仓库地址）

disabled_plugins = []
imports = []
oom_score = 0
plugin_dir = ""
required_plugins = []
root = "/var/lib/containerd"
state = "/run/containerd"
version = 2

[cgroup]
  path = ""

[debug]
  address = ""
  format = ""
  gid = 0
  level = ""
  uid = 0

[grpc]
  address = "/run/containerd/containerd.sock"
  gid = 0
  max_recv_message_size = 16777216
  max_send_message_size = 16777216
  tcp_address = ""
  tcp_tls_cert = ""
  tcp_tls_key = ""
  uid = 0

[metrics]
  address = ""
  grpc_histogram = false

[plugins]

  [plugins."io.containerd.gc.v1.scheduler"]
    deletion_threshold = 0
    mutation_threshold = 100
    pause_threshold = 0.02
    schedule_delay = "0s"
    startup_delay = "100ms"

  [plugins."io.containerd.grpc.v1.cri"]
    disable_apparmor = false
    disable_cgroup = false
    disable_hugetlb_controller = true
    disable_proc_mount = false
    disable_tcp_service = true
    enable_selinux = false
    enable_tls_streaming = false
    ignore_image_defined_volumes = false
    max_concurrent_downloads = 3
    max_container_log_line_size = 16384
    netns_mounts_under_state_dir = false
    restrict_oom_score_adj = false
#    sandbox_image = "k8s.gcr.io/pause:3.5"
#   1. 修改基础镜像地址
    sandbox_image = "registry.cn-hangzhou.aliyuncs.com/google_containers/pause:3.5"
    selinux_category_range = 1024
    stats_collect_period = 10
    stream_idle_timeout = "4h0m0s"
    stream_server_address = "127.0.0.1"
    stream_server_port = "0"
    systemd_cgroup = false
    tolerate_missing_hugetlb_controller = true
    unset_seccomp_profile = ""

    [plugins."io.containerd.grpc.v1.cri".cni]
      bin_dir = "/opt/cni/bin"
      conf_dir = "/etc/cni/net.d"
      conf_template = ""
      max_conf_num = 1

    [plugins."io.containerd.grpc.v1.cri".containerd]
      default_runtime_name = "runc"
      disable_snapshot_annotations = true
      discard_unpacked_layers = false
      no_pivot = false
      snapshotter = "overlayfs"

      [plugins."io.containerd.grpc.v1.cri".containerd.default_runtime]
        base_runtime_spec = ""
        container_annotations = []
        pod_annotations = []
        privileged_without_host_devices = false
        runtime_engine = ""
        runtime_root = ""
        runtime_type = ""

        [plugins."io.containerd.grpc.v1.cri".containerd.default_runtime.options]

      [plugins."io.containerd.grpc.v1.cri".containerd.runtimes]

        [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc]
          base_runtime_spec = ""
          container_annotations = []
          pod_annotations = []
          privileged_without_host_devices = false
          runtime_engine = ""
          runtime_root = ""
          runtime_type = "io.containerd.runc.v2"

          [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc.options]
            BinaryName = ""
            CriuImagePath = ""
            CriuPath = ""
            CriuWorkPath = ""
            IoGid = 0
            IoUid = 0
            NoNewKeyring = false
            NoPivotRoot = false
            Root = ""
            ShimCgroup = ""
            SystemdCgroup = false

      [plugins."io.containerd.grpc.v1.cri".containerd.untrusted_workload_runtime]
        base_runtime_spec = ""
        container_annotations = []
        pod_annotations = []
        privileged_without_host_devices = false
        runtime_engine = ""
        runtime_root = ""
        runtime_type = ""

        [plugins."io.containerd.grpc.v1.cri".containerd.untrusted_workload_runtime.options]

    [plugins."io.containerd.grpc.v1.cri".image_decryption]
      key_model = "node"

    [plugins."io.containerd.grpc.v1.cri".registry]
      config_path = ""

      [plugins."io.containerd.grpc.v1.cri".registry.auths]

      [plugins."io.containerd.grpc.v1.cri".registry.configs]

      [plugins."io.containerd.grpc.v1.cri".registry.headers]

      [plugins."io.containerd.grpc.v1.cri".registry.mirrors]
# 2. 设置仓库地址
        [plugins."io.containerd.grpc.v1.cri".registry.mirrors."docker.io"]
          endpoint = ["https://usydjf4t.mirror.aliyuncs.com"]
        [plugins."io.containerd.grpc.v1.cri".registry.mirrors."k8s.gcr.io"]
          endpoint = ["https://registry.cn-hangzhou.aliyuncs.com/google_containers"]
        [plugins."io.containerd.grpc.v1.cri".registry.mirrors."192.168.0.187:5000"]
          endpoint = ["http://192.168.0.187:5000"]
#      [plugins."io.containerd.grpc.v1.cri".registry.configs]
#        [plugins."io.containerd.grpc.v1.cri".registry.configs."192.168.0.187:5000".tls]
#          insecure_skip_verify = true
#        [plugins."io.containerd.grpc.v1.cri".registry.configs."harbor.creditgogogo.com".auth]
#          username = "admin"
#          password = "Harbor12345"

    [plugins."io.containerd.grpc.v1.cri".x509_key_pair_streaming]
      tls_cert_file = ""
      tls_key_file = ""

  [plugins."io.containerd.internal.v1.opt"]
    path = "/opt/containerd"

  [plugins."io.containerd.internal.v1.restart"]
    interval = "10s"

  [plugins."io.containerd.metadata.v1.bolt"]
    content_sharing_policy = "shared"

  [plugins."io.containerd.monitor.v1.cgroups"]
    no_prometheus = false

  [plugins."io.containerd.runtime.v1.linux"]
    no_shim = false
    runtime = "runc"
    runtime_root = ""
    shim = "containerd-shim"
    shim_debug = false

  [plugins."io.containerd.runtime.v2.task"]
    platforms = ["linux/amd64"]

  [plugins."io.containerd.service.v1.diff-service"]
    default = ["walking"]

  [plugins."io.containerd.snapshotter.v1.aufs"]
    root_path = ""

  [plugins."io.containerd.snapshotter.v1.btrfs"]
    root_path = ""

  [plugins."io.containerd.snapshotter.v1.devmapper"]
    async_remove = false
    base_image_size = ""
    pool_name = ""
    root_path = ""

  [plugins."io.containerd.snapshotter.v1.native"]
    root_path = ""

  [plugins."io.containerd.snapshotter.v1.overlayfs"]
    root_path = ""

  [plugins."io.containerd.snapshotter.v1.zfs"]
    root_path = ""

[proxy_plugins]

[stream_processors]

  [stream_processors."io.containerd.ocicrypt.decoder.v1.tar"]
    accepts = ["application/vnd.oci.image.layer.v1.tar+encrypted"]
    args = ["--decryption-keys-path", "/etc/containerd/ocicrypt/keys"]
    env = ["OCICRYPT_KEYPROVIDER_CONFIG=/etc/containerd/ocicrypt/ocicrypt_keyprovider.conf"]
    path = "ctd-decoder"
    returns = "application/vnd.oci.image.layer.v1.tar"

  [stream_processors."io.containerd.ocicrypt.decoder.v1.tar.gzip"]
    accepts = ["application/vnd.oci.image.layer.v1.tar+gzip+encrypted"]
    args = ["--decryption-keys-path", "/etc/containerd/ocicrypt/keys"]
    env = ["OCICRYPT_KEYPROVIDER_CONFIG=/etc/containerd/ocicrypt/ocicrypt_keyprovider.conf"]
    path = "ctd-decoder"
    returns = "application/vnd.oci.image.layer.v1.tar+gzip"

[timeouts]
  "io.containerd.timeout.shim.cleanup" = "5s"
  "io.containerd.timeout.shim.load" = "5s"
  "io.containerd.timeout.shim.shutdown" = "3s"
  "io.containerd.timeout.task.state" = "2s"

[ttrpc]
  address = ""
  gid = 0
  uid = 0

（可选择） 进入其他主机scp 命令，将文件复制到其他所有主机上（也可以将命令写入文件，也可以使用for循环）

# 如执行报错，需要先进入k8s-node01主机，创建/etc/containerd/文件夹
scp /etc/containerd/config.toml root@k8s-node01:/etc/containerd/

5.4 启动containerd

# 启动，并设置为开机启动
systemctl daemon-reload &&systemctl enable containerd && systemctl start containerd
# 查看是否启动成功
systemctl status containerd

（可选择） 执行以下命令

# 进入k8s-node01主机，执行以下命令，然后使用exit命令退出
ssh k8s-node01
# 启动，并设置为开机启动
systemctl daemon-reload &&systemctl enable containerd && systemctl start containerd
# 查看是否启动成功
systemctl status containerd
exit

安装成功，图例：