下载安装包
wget https://github.com/containerd/containerd/releases/download/v1.6.8/cri-containerd-1.6.8-linux-amd64.tar.gz
wget https://github.com/opencontainers/runc/releases/download/v1.1.4/runc.amd64
cri-containerd有包含 runc 二进制文件，但是编译的时候没有包含 libseccomp 依赖。
两个方法解决：
- 下载包含 libseccomp 依赖的 runc 二进制文件（本文章采用该方式）
- 宿主机安装依赖。例如用于 CentOS 的
libseccomp-devel，或用于 Ubuntu 的libseccomp-dev
解压文件
mkdir cri-containerd
tar xf cri-containerd-1.6.8-linux-amd64.tar.gz -C cri-containerd
sudo cp cri-containerd/usr/local/bin/* /usr/local/bin
sudo cp runc.amd64 /usr/local/bin/runc && chmod +x /usr/local/bin/runc
生成contaienrd配置文件
sudo mkdir -p /app/containerd/{config,data}
containerd config default | sudo tee /app/containerd/config/config.toml
修改containerd默认配置
$ diff /app/containerd/config/config.toml /tmp/config.toml
6c6
< root = "/app/containerd/data"
---
> root = "/var/lib/containerd"
61c61
< sandbox_image = "registry.aliyuncs.com/k8sxio/pause:3.6"
---
> sandbox_image = "k8s.gcr.io/pause:3.6"
125c125
< SystemdCgroup = true
---
> SystemdCgroup = false
154,155d153
< [plugins."io.containerd.grpc.v1.cri".registry.mirrors."docker.io"]
< endpoint = ["https://docker.mirrors.ustc.edu.cn", "https://registry.docker-cn.com"]
crictl连接containerd配置文件
$ cat <<-EOF | sudo tee /etc/crictl.yaml > /dev/null
runtime-endpoint: unix:///run/containerd/containerd.sock
image-endpoint: unix:///run/containerd/containerd.sock
timeout: 10
debug: false
EOF
配置systemd服务
sudo cp cri-containerd/etc/systemd/system/containerd.service /usr/lib/systemd/system
sudo sed -ri 's@(ExecStart)=.*@\1=/usr/local/bin/containerd --config /app/containerd/config/config.toml@g' /usr/lib/systemd/system/containerd.service
启动containerd
sudo systemctl daemon-reload
sudo systemctl start containerd && sudo systemctl enable containerd
验证服务
$ sudo /usr/local/bin/ctr version
Client:
Version: v1.6.8
Revision: 9cd3357b7fd7218e4aec3eae239db1f68a5a6ec6
Go version: go1.17.13
Server:
Version: v1.6.8
Revision: 9cd3357b7fd7218e4aec3eae239db1f68a5a6ec6
UUID: 88acbbf1-2a1e-435c-8056-4d0d4734e341
$ sudo /usr/local/bin/crictl pull registry.aliyuncs.com/k8sxio/pause:3.6
Image is up to date for sha256:6270bb605e12e581514ada5fd5b3216f727db55dc87d5889c790e4c760683fee