一键安装containerd

脚本会安装以下组件
containerd
runc
cni
crictl
nerdctl
buildkit

nerdctl 使用与docker命令相似
buildkit 的功能为建立镜像

yum install wget -y

cat > install_containerd.sh << 'EOS'
#!/bin/bash
############################
#                          #
#    install containerd    #
#                          #
############################
arch=amd64
cni_version=v1.4.1
containerd_version=1.7.14
crictl_version=1.29.0
nerdctl_version=1.7.4
runc_version=1.1.12
buildkit_version=0.13.0

export CNI_PLUGINS_URL="https://github.com/containernetworking/plugins/releases/download/${cni_version}/cni-plugins-linux-${arch}-${cni_version}.tgz"
export CRI_CONTAINERD_URL="https://github.com/containerd/containerd/releases/download/v${containerd_version}/cri-containerd-cni-${containerd_version}-linux-${arch}.tar.gz"
export CRICTL_URL="https://github.com/kubernetes-sigs/cri-tools/releases/download/v${crictl_version}/crictl-v${crictl_version}-linux-${arch}.tar.gz"
export NERDCTL_URL="https://github.com/containerd/nerdctl/releases/download/v${nerdctl_version}/nerdctl-${nerdctl_version}-linux-${arch}.tar.gz"
export RUNC_URL="https://github.com/opencontainers/runc/releases/download/v${runc_version}/runc.${arch}"
export BUILDKIT_URL="https://github.com/moby/buildkit/releases/download/v${buildkit_version}/buildkit-v${buildkit_version}.linux-${arch}.tar.gz"


export CNI_PLUGINS_PACKAGE=`basename $CNI_PLUGINS_URL`
export CRI_CONTAINERD_PACKAGE=`basename $CRI_CONTAINERD_URL`
export CRICTL_PACKAGE=`basename $CRICTL_URL`
export NERDCTL_PACKAGE=`basename $NERDCTL_URL`
export RUNC_PACKAGE=`basename $RUNC_URL`
export BUILDKIT_PACKAGE=`basename $BUILDKIT_URL`


#下载
if [ ! -f $CNI_PLUGINS_PACKAGE ]; then
    wget $CNI_PLUGINS_URL;
fi

if [ ! -f $CRI_CONTAINERD_PACKAGE ]; then
    wget $CRI_CONTAINERD_URL;
fi

if [ ! -f $CRICTL_PACKAGE ]; then
    wget $CRICTL_URL;
fi

if [ ! -f $NERDCTL_PACKAGE ]; then
    wget $NERDCTL_URL;
fi

if [ ! -f $RUNC_PACKAGE ]; then
    wget $RUNC_URL;
fi

if [ ! -f $BUILDKIT_PACKAGE ]; then
    wget $BUILDKIT_URL;
fi


#安装
if [ -f $CNI_PLUGINS_PACKAGE ]; then
    mkdir -pv /etc/cni/{net.d,bin}
    tar -xf $CNI_PLUGINS_PACKAGE -C /opt/cni/bin/
fi

if [ -f $CRI_CONTAINERD_PACKAGE ]; then
    tar -xf $CRI_CONTAINERD_PACKAGE -C /
fi

if [ -f $CRICTL_PACKAGE ]; then
    tar -xf $CRICTL_PACKAGE -C /usr/bin/
fi

if [ -f $NERDCTL_PACKAGE ]; then
    tar -xf $NERDCTL_PACKAGE -C /usr/bin/
    ln -s /usr/bin/nerdctl /usr/bin/docker
fi

if [ -f $RUNC_PACKAGE ]; then
    \cp $RUNC_PACKAGE  /usr/local/sbin/runc -rf
fi


if [ -f $BUILDKIT_PACKAGE ]; then
    tar -xf $BUILDKIT_PACKAGE -C /usr/local/
fi


cat > /usr/lib/systemd/system/containerd.service <<EOF
[Unit]
Description=containerd container runtime
Documentation=https://containerd.io
After=network.target local-fs.target

[Service]
ExecStartPre=-/sbin/modprobe overlay
ExecStart=/usr/local/bin/containerd
Type=notify
Delegate=yes
KillMode=process
Restart=always
RestartSec=5
LimitNPROC=infinity
LimitCORE=infinity
LimitNOFILE=infinity
TasksMax=infinity
OOMScoreAdjust=-999

[Install]
WantedBy=multi-user.target
EOF


cat > /etc/modules-load.d/containerd.conf <<EOF
overlay
br_netfilter
EOF
systemctl restart systemd-modules-load.service


cat > /etc/sysctl.d/99-kubernetes-cri.conf <<EOF
net.bridge.bridge-nf-call-iptables  = 1
net.ipv4.ip_forward                 = 1
net.bridge.bridge-nf-call-ip6tables = 1
EOF
sysctl -p

mkdir -p /etc/containerd
containerd config default > /etc/containerd/config.toml

sed -i "s#SystemdCgroup\ \=\ false#SystemdCgroup\ \=\ true#g" /etc/containerd/config.toml
cat /etc/containerd/config.toml | grep SystemdCgroup

sed -i "s#registry.k8s.io#registry.aliyuncs.com/google_containers#g" /etc/containerd/config.toml
cat /etc/containerd/config.toml | grep sandbox_image

sed -i 's#config_path\ \=\ \"\"#config_path\ \=\ \"/etc/containerd/certs.d\"#g' /etc/containerd/config.toml
cat /etc/containerd/config.toml | grep certs.d

# 配置加速器
mkdir /etc/containerd/certs.d/docker.io -pv
cat > /etc/containerd/certs.d/docker.io/hosts.toml << EOF
server = "https://docker.io"
[host."https://docker.nju.edu.cn"]
  capabilities = ["pull", "resolve"]
  #skip_verify = true
EOF

systemctl daemon-reload
systemctl enable containerd
systemctl start containerd

mkdir /etc/nerdctl/ -pv
cat > /etc/nerdctl/nerdctl.toml << EOF
namespace      = "k8s.io"
insecure_registry = true
cni_path  = "/opt/cni/bin"
EOF

mkdir -pv /etc/buildkit/
cat > /etc/buildkit/buildkitd.toml << 'EOF'
insecure-entitlements = [ "network.host", "security.insecure" ]

[worker.oci]
  enabled = true
  platforms = [ "linux/amd64", "linux/arm64" ]
  snapshotter = "auto"
  rootless = false
  noProcessSandbox = false
  gc = true
  gckeepstorage = 9000
  max-parallelism = 4

  [[worker.oci.gcpolicy]]
    keepBytes = 512000000
    keepDuration = 172800
    filters = [ "type==source.local", "type==exec.cachemount", "type==source.git.checkout"]

#私仓配置
[registry."harbor.lady.cn"]
  mirrors = ["harbor.lady.cn"]
  http = true       #使用http协议
  insecure = true    #不验证安全证书
EOF

cat > /etc/systemd/system/buildkit.service << 'EOF'
[Unit]
Description=BuildKit
Documentation=https://github.com/moby/buildkit

[Service]
ExecStart=/usr/local/bin/buildkitd --oci-worker=false --containerd-worker=true

[Install]
WantedBy=multi-user.target
EOF

systemctl daemon-reload
systemctl enable buildkit
systemctl start buildkit

EOS

bash install_containerd.sh