源代码

https://gitcode.com/zhudev2026/containerd-deploy

说明

离线环境部署containerd

支持操作系统Ubuntu

源代码https://github.com/containerd/containerd

参考文档https://github.com/containerd/containerd/blob/main/docs/getting-started.md

下载文件

应选择需要使用的版本，或最新稳定版本，应适配部署环境CPU架构。

下载containerd

访问https://github.com/containerd/containerd/releases，例如

下载containerd服务文件

下载https://raw.githubusercontent.com/containerd/containerd/main/containerd.service

下载runc

访问https://github.com/opencontainers/runc，例如

下载CNI插件

访问https://github.com/containernetworking/plugins/releases，例如

下载nerdctl-可选

访问https://github.com/containerd/nerdctl，例如

下载crictl-可选

访问https://github.com/kubernetes-sigs/cri-tools，例如

上传文件

将文件上传至部署环境的目录，例如/opt，后续在此目录操作。

配置文件到指定目录

tar Cxzvf /usr/local containerd-2.4.2-linux-amd64.tar.gz
mkdir -p /usr/local/lib/systemd/system/
cp containerd.service /usr/local/lib/systemd/system/

运行containerd

systemctl daemon-reload
systemctl enable --now containerd

安装runc

install -m 755 runc.amd64 /usr/local/sbin/runc

安装CNI插件

mkdir -p /opt/cni/bin
tar Cxzvf /opt/cni/bin cni-plugins-linux-amd64-v1.9.1.tgz

安装CLI工具

默认内置ctr命令，安装工具可以更方便使用和管理containerd。

安装nerdctl

tar Cxzvvf /usr/local/bin nerdctl-2.4.1-linux-amd64.tar.gz

安装crictl

tar zxvf crictl-v1.37.0-linux-amd64.tar.gz -C /usr/local/bin

配置containerd

mkdir -p /etc/containerd
# 生成配置文件
containerd config default > /etc/containerd/config.toml

配置镜像加速

参考文档https://github.com/containerd/containerd/blob/main/docs/cri/registry.md

修改配置文件

修改文件/etc/containerd/config.toml

默认配置是

修改后是

[plugins.'io.containerd.cri.v1.images'.registry]
      config_path = '/etc/containerd/certs.d'

配置加速

可参考1ms.run，在专属域名批量初始化生成域名用于加速。

创建专用目录

mkdir -p /etc/containerd/certs.d/{docker.io,registry.k8s.io,mcr.microsoft.com,quay.io,nvcr.io,ghcr.io,gcr.io,docker.elastic.co}

配置加速地址

# docker.io
cat > /etc/containerd/certs.d/docker.io/hosts.toml <<'EOF'
server = "https://docker.io"
[host."https://967aef17d3fe0ac37927d23d8b4e4df9.d.1ms.run"]
  capabilities = ["pull", "resolve"]
  # skip_verify = true
EOF

# registry.k8s.io
cat > /etc/containerd/certs.d/registry.k8s.io/hosts.toml <<'EOF'
server = "https://registry.k8s.io"
[host."https://de1e8615566a3ef17c7936c65eec24ab.d.1ms.run"]
  capabilities = ["pull", "resolve"]
  # skip_verify = true
EOF

# mcr.microsoft.com
cat > /etc/containerd/certs.d/mcr.microsoft.com/hosts.toml <<'EOF'
server = "https://mcr.microsoft.com"
[host."https://67b187d52637d588e6d4f719b7d2fc3d.d.1ms.run"]
  capabilities = ["pull", "resolve"]
  # skip_verify = true
EOF

# quay.io
cat > /etc/containerd/certs.d/quay.io/hosts.toml <<'EOF'
server = "https://quay.io"
[host."https://228851c6edbff794e5d79fcf08c0af9f.d.1ms.run"]
  capabilities = ["pull", "resolve"]
  # skip_verify = true
EOF

# nvcr.io
cat > /etc/containerd/certs.d/nvcr.io/hosts.toml <<'EOF'
server = "https://nvcr.io"
[host."https://e30955e13153e4af7a7630dd0f69d536.d.1ms.run"]
  capabilities = ["pull", "resolve"]
  # skip_verify = true
EOF

# ghcr.io
cat > /etc/containerd/certs.d/ghcr.io/hosts.toml <<'EOF'
server = "https://ghcr.io"
[host."https://b80c723cb8b92071cd743b1c0664ea27.d.1ms.run"]
  capabilities = ["pull", "resolve"]
  # skip_verify = true
EOF

# gcr.io
cat > /etc/containerd/certs.d/gcr.io/hosts.toml <<'EOF'
server = "https://gcr.io"
[host."https://5faa96fb32a2632a7a6234d41f8480b0.d.1ms.run"]
  capabilities = ["pull", "resolve"]
  # skip_verify = true
EOF

# docker.elastic.co
cat > /etc/containerd/certs.d/docker.elastic.co/hosts.toml <<'EOF'
server = "https://docker.elastic.co"
[host."https://e1a7a09fe8821fac8cb7a96eb60d21d0.d.1ms.run"]
  capabilities = ["pull", "resolve"]
  # skip_verify = true
EOF

重启组件

使配置生效

systemctl daemon-reload
systemctl restart containerd
systemctl status containerd

拉取镜像验证

注意：此处仅使用nerdctl测试。

# 拉取中国地区镜像
nerdctl pull swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/mysql:26.7.0
# 拉取海外镜像测试
# docker.io
nerdctl pull docker.io/library/nginx:1.27-alpine

# registry.k8s.io，注意，gcr的镜像目前已经迁移到此仓库。
nerdctl pull registry.k8s.io/pause:3.10

# mcr.microsoft.com
nerdctl pull mcr.microsoft.com/mssql/server:2022-CU14-ubuntu-22.04

# quay.io
nerdctl pull quay.io/prometheus/prometheus:v2.53.0

# nvcr.io
nerdctl pull nvcr.io/nvidia/cuda:12.4.1-base-ubuntu22.04

# ghcr.io
nerdctl pull ghcr.io/containerd/nerdctl:v2.0.0

# docker.elastic.co
nerdctl pull docker.elastic.co/elasticsearch/elasticsearch:8.15.0

s/prometheus:v2.53.0

nvcr.io

nerdctl pull nvcr.io/nvidia/cuda:12.4.1-base-ubuntu22.04

ghcr.io

nerdctl pull ghcr.io/containerd/nerdctl:v2.0.0

docker.elastic.co

nerdctl pull docker.elastic.co/elasticsearch/elasticsearch:8.15.0