脚本会安装以下组件
containerd
runc
cni
crictl
nerdctl
buildkit
nerdctl 使用与docker命令相似
buildkit 的功能为建立镜像
yum install wget -y
cat > install_containerd.sh << 'EOS'
#!/bin/bash
############################
# #
# install containerd #
# #
############################
arch=amd64
cni_version=v1.4.1
containerd_version=1.7.14
crictl_version=1.29.0
nerdctl_version=1.7.4
runc_version=1.1.12
buildkit_version=0.13.0
export CNI_PLUGINS_URL="https://github.com/containernetworking/plugins/releases/download/${cni_version}/cni-plugins-linux-${arch}-${cni_version}.tgz"
export CRI_CONTAINERD_URL="https://github.com/containerd/containerd/releases/download/v${containerd_version}/cri-containerd-cni-${containerd_version}-linux-${arch}.tar.gz"
export CRICTL_URL="https://github.com/kubernetes-sigs/cri-tools/releases/download/v${crictl_version}/crictl-v${crictl_version}-linux-${arch}.tar.gz"
export NERDCTL_URL="https://github.com/containerd/nerdctl/releases/download/v${nerdctl_version}/nerdctl-${nerdctl_version}-linux-${arch}.tar.gz"
export RUNC_URL="https://github.com/opencontainers/runc/releases/download/v${runc_version}/runc.${arch}"
export BUILDKIT_URL="https://github.com/moby/buildkit/releases/download/v${buildkit_version}/buildkit-v${buildkit_version}.linux-${arch}.tar.gz"
export CNI_PLUGINS_PACKAGE=`basename $CNI_PLUGINS_URL`
export CRI_CONTAINERD_PACKAGE=`basename $CRI_CONTAINERD_URL`
export CRICTL_PACKAGE=`basename $CRICTL_URL`
export NERDCTL_PACKAGE=`basename $NERDCTL_URL`
export RUNC_PACKAGE=`basename $RUNC_URL`
export BUILDKIT_PACKAGE=`basename $BUILDKIT_URL`
#下载
if [ ! -f $CNI_PLUGINS_PACKAGE ]; then
wget $CNI_PLUGINS_URL;
fi
if [ ! -f $CRI_CONTAINERD_PACKAGE ]; then
wget $CRI_CONTAINERD_URL;
fi
if [ ! -f $CRICTL_PACKAGE ]; then
wget $CRICTL_URL;
fi
if [ ! -f $NERDCTL_PACKAGE ]; then
wget $NERDCTL_URL;
fi
if [ ! -f $RUNC_PACKAGE ]; then
wget $RUNC_URL;
fi
if [ ! -f $BUILDKIT_PACKAGE ]; then
wget $BUILDKIT_URL;
fi
#安装
if [ -f $CNI_PLUGINS_PACKAGE ]; then
mkdir -pv /etc/cni/{net.d,bin}
tar -xf $CNI_PLUGINS_PACKAGE -C /opt/cni/bin/
fi
if [ -f $CRI_CONTAINERD_PACKAGE ]; then
tar -xf $CRI_CONTAINERD_PACKAGE -C /
fi
if [ -f $CRICTL_PACKAGE ]; then
tar -xf $CRICTL_PACKAGE -C /usr/bin/
fi
if [ -f $NERDCTL_PACKAGE ]; then
tar -xf $NERDCTL_PACKAGE -C /usr/bin/
ln -s /usr/bin/nerdctl /usr/bin/docker
fi
if [ -f $RUNC_PACKAGE ]; then
\cp $RUNC_PACKAGE /usr/local/sbin/runc -rf
fi
if [ -f $BUILDKIT_PACKAGE ]; then
tar -xf $BUILDKIT_PACKAGE -C /usr/local/
fi
cat > /usr/lib/systemd/system/containerd.service <<EOF
[Unit]
Description=containerd container runtime
Documentation=https://containerd.io
After=network.target local-fs.target
[Service]
ExecStartPre=-/sbin/modprobe overlay
ExecStart=/usr/local/bin/containerd
Type=notify
Delegate=yes
KillMode=process
Restart=always
RestartSec=5
LimitNPROC=infinity
LimitCORE=infinity
LimitNOFILE=infinity
TasksMax=infinity
OOMScoreAdjust=-999
[Install]
WantedBy=multi-user.target
EOF
cat > /etc/modules-load.d/containerd.conf <<EOF
overlay
br_netfilter
EOF
systemctl restart systemd-modules-load.service
cat > /etc/sysctl.d/99-kubernetes-cri.conf <<EOF
net.bridge.bridge-nf-call-iptables = 1
net.ipv4.ip_forward = 1
net.bridge.bridge-nf-call-ip6tables = 1
EOF
sysctl -p
mkdir -p /etc/containerd
containerd config default > /etc/containerd/config.toml
sed -i "s#SystemdCgroup\ \=\ false#SystemdCgroup\ \=\ true#g" /etc/containerd/config.toml
cat /etc/containerd/config.toml | grep SystemdCgroup
sed -i "s#registry.k8s.io#registry.aliyuncs.com/google_containers#g" /etc/containerd/config.toml
cat /etc/containerd/config.toml | grep sandbox_image
sed -i 's#config_path\ \=\ \"\"#config_path\ \=\ \"/etc/containerd/certs.d\"#g' /etc/containerd/config.toml
cat /etc/containerd/config.toml | grep certs.d
# 配置加速器
mkdir /etc/containerd/certs.d/docker.io -pv
cat > /etc/containerd/certs.d/docker.io/hosts.toml << EOF
server = "https://docker.io"
[host."https://docker.nju.edu.cn"]
capabilities = ["pull", "resolve"]
#skip_verify = true
EOF
systemctl daemon-reload
systemctl enable containerd
systemctl start containerd
mkdir /etc/nerdctl/ -pv
cat > /etc/nerdctl/nerdctl.toml << EOF
namespace = "k8s.io"
insecure_registry = true
cni_path = "/opt/cni/bin"
EOF
mkdir -pv /etc/buildkit/
cat > /etc/buildkit/buildkitd.toml << 'EOF'
insecure-entitlements = [ "network.host", "security.insecure" ]
[worker.oci]
enabled = true
platforms = [ "linux/amd64", "linux/arm64" ]
snapshotter = "auto"
rootless = false
noProcessSandbox = false
gc = true
gckeepstorage = 9000
max-parallelism = 4
[[worker.oci.gcpolicy]]
keepBytes = 512000000
keepDuration = 172800
filters = [ "type==source.local", "type==exec.cachemount", "type==source.git.checkout"]
#私仓配置
[registry."harbor.lady.cn"]
mirrors = ["harbor.lady.cn"]
http = true #使用http协议
insecure = true #不验证安全证书
EOF
cat > /etc/systemd/system/buildkit.service << 'EOF'
[Unit]
Description=BuildKit
Documentation=https://github.com/moby/buildkit
[Service]
ExecStart=/usr/local/bin/buildkitd --oci-worker=false --containerd-worker=true
[Install]
WantedBy=multi-user.target
EOF
systemctl daemon-reload
systemctl enable buildkit
systemctl start buildkit
EOS
bash install_containerd.sh