幫助菜單

COMMANDS:
   plugins, plugin            provides information about containerd plugins
   version                    print the client and server versions
   containers, c, container   manage containers
   content                    manage content
   events, event              display containerd events
   images, image, i           manage images
   leases                     manage leases
   namespaces, namespace, ns  manage namespaces
   pprof                      provide golang pprof outputs for containerd
   run                        run a container
   snapshots, snapshot        manage snapshots
   tasks, t, task             manage tasks
   install                    install a new package
   oci                        OCI tools
   shim                       interact with a shim directly
   help, h                    Shows a list of commands or help for one command

GLOBAL OPTIONS:
   --debug                      enable debug output in logs
   --address value, -a value    address for containerd's GRPC server (default: "/run/containerd/containerd.sock") [$CONTAINERD_ADDRESS]
   --timeout value              total timeout for ctr commands (default: 0s)
   --connect-timeout value      timeout for connecting to containerd (default: 0s)
   --namespace value, -n value  namespace to use with commands (default: "default") [$CONTAINERD_NAMESPACE]
   --help, -h                   show help
   --version, -v                print the version

將鏡像掛載到主機目錄
#ctr i mount docker.io/library/nginx:alpine /mnt
 sha256:5da2ba1075ada2783aada4fa30ec8cdd56a072759ea7c283de1c505b56ed0e70
 [root@containerd ~]#tree -L 1 /mnt/
/mnt/
├── bin
├── dev
├── docker-entrypoint.d
├── docker-entrypoint.sh
├── etc
├── home
├── lib
├── media
├── mnt
├── opt
├── proc
├── root
├── run
├── sbin
├── srv
├── sys
├── tmp
├── usr
└── var

18 directories, 1 file
 ctr i unmount /mnt  #將鏡像從主機目錄上卸載
 ctr i check #主要查看其中的 `STATUS`，`complete` 表示鏡像是完整可用的狀態。
ctr -n k8s.io images ls              #查看鏡像
ctr -n k8s.io images pull -k         #拉取鏡像，拉取的時候忽略校驗
ctr -n k8s.io images pull --tlscacert /etc/....../tls.crt   #拉取鏡像，拉鏡像的時候使用tls證書進行驗證

#將離線鏡像tar包導入到本地鏡像緩存中，打tag并push鏡像到鏡像倉庫

ctr -n k8s.io i import containerd-build-aarch64-1.1.0.tar
ctr -n k8s.io i ls |grep build-aarch64
ctr -n k8s.io i tag docker.io/containerd/build-aarch64:1.1.0 harbor.xxx.com/
ctr -n k8s.io i push --tlscacert /etc/containerd/certs.dxxxx/tls.crt harbor.xxx.com/ -u admin:Harbor12345
 
ctr -n k8s.io i push --tlscacert /etc/....../tls.crt  #上傳鏡像,基于tls驗證
ctr -n k8s.io i push -k  #上傳鏡像,忽略認證
 
ctr -n k8s.io c ls     #查看容器對象元數據，不包含狀態
ctr -n k8s.io task ls  #查看容器，包含容器狀態
ctr -n k8s.io task kill -a -s 9  {id}     #根據容器id停止容器，停止時會殺死容器中的所有服務
ctr -n k8s.io c rm  {id}    #刪除容器對象元數據，注意：如果容器狀態為Running，則無法進行刪除

#例：創建一個容器對象

ctr -n k8s.io c create -t  --net-host --privileged --env GOPATH=/go \
    --mount type=bind,src=${PWD}/containerd,dst=/go/src/github.com/containerd/containerd,options=rbind:rw \
    docker.io/containerd/build-aarch64:1.1.0 containerd-build-aarch64
 
#這里 --mount 與docker -v 作用相同,
 –null-io: 將容器內標準輸出重定向到/dev/null
–net-host: 主機網絡
-d: 當task執行后就進行下一步shell命令,如沒有選項,則會等待用戶輸入,并定向到容器內


#啟動一個容器進程，名稱是上一步創建的容器對象的名稱
ctr -n k8s.io task start -d containerd-build-aarch64
 
#連接到一個處于RUNNING狀態容器的標準流，注意：如果在這里exit，會退出容器，并刪除當前的容器進程，僅容器對象還在
ctr -n k8s.io task attach containerd-build-aarch64
 
#與docker run 的效果一樣，在這里exit，會退出容器，但不會對容器狀態產生影響，其還存在且是RUNNING
ctr -n k8s.io task exec -t --exec-id bash_1 containerd-build-aarch64 sh
 
#殺死一個容器進程中的所有子進程，執行之后容器狀態為STOPPED,此時可以使用 task rm 進行刪除
ctr -n k8s.io task kill -a -s 9 containerd-build-aarch64
 
#刪除非運行狀態的容器，但是不刪除容器元數據，使用ctr -n k8s.io -c ls 還可以查看到
ctr -n k8s.io task rm containerd-build-aarch64
 
#如果要刪除容器元數據，下面的命令不光刪除容器對象數據，同時還會級聯刪除對應的容器的task
ctr -n k8s.io c rm containerd-build-aarch64
 
# ctr c create hub.renwoxing.com/library/nginx:latest nginx
# ctr c ls

CONTAINER    IMAGE                                     RUNTIME                  
nginx        hub.renwoxing.com/library/nginx:latest    io.containerd.runc.v2    
# ctr c ls -q
nginx
[root@master01 ~]# ctr c info nginx
{
    "ID": "nginx",
    "Labels": {
        "io.containerd.image.config.stop-signal": "SIGQUIT"
    },
    "Image": "hub.renwoxing.com/library/nginx:latest",
    "Runtime": {
        "Name": "io.containerd.runc.v2",
        "Options": {
            "type_url": "containerd.runc.v1.Options"
        }
    },

# ctr task  start  -d nginx
/docker-entrypoint.sh: /docker-entrypoint.d/ is not empty, will attempt to perform configuration
/docker-entrypoint.sh: Looking for shell scripts in /docker-entrypoint.d/
/docker-entrypoint.sh: Launching /docker-entrypoint.d/10-listen-on-ipv6-by-default.sh
You have new mail in /var/spool/mail/root
[root@master01 ~]# ctr task  ls
TASK     PID      STATUS    
nginx    58028    RUNNING
[root@master01 ~]# ctr task  ls -q
nginx
[root@master01 ~]# ctr task  exec  --exec-id 0 -t nginx sh   # 注意必須要指定 --exec-id 參數，這個 id 可以隨便寫，只要唯一就行
# ls
bin   docker-entrypoint.d   home   media  proc	sbin  tmp
boot  docker-entrypoint.sh  lib    mnt	  root	srv   usr
dev   etc		    lib64  opt	  run	sys   var
[root@master01 ~]# ctr task pause  nginx
[root@master01 ~]# ctr task  ls 
TASK     PID      STATUS    
nginx    58028    PAUSED
[root@master01 ~]# ctr task resume  nginx
[root@master01 ~]# ctr task  ls 
TASK     PID      STATUS    
nginx    58028    RUNNING
[root@master01 ~]# ctr task kill  nginx
[root@master01 ~]# ctr task  ls 
TASK     PID      STATUS    
nginx    58028    STOPPED
[root@master01 ~]# ctr task rm  nginx
[root@master01 ~]# ctr task  ls 
TASK    PID    STATUS  
[root@master01 ~]# 
[root@master01 ~]# ctr task metrics nginx
ID       TIMESTAMP                                 
nginx    2022-01-09 09:13:15.82922356 +0000 UTC    

METRIC                   VALUE                  
memory.usage_in_bytes    2093056                
memory.limit_in_bytes    9223372036854771712    
memory.stat.cache        16384                  
cpuacct.usage            38240875               
cpuacct.usage_percpu     [21321842 16919033]    
pids.current             3                      
pids.limit               0                      
[root@master01 ~]# ctr task  ps nginx
PID      INFO
68922    -
68951    -
68952    -
[root@master01 ~]# ps -ef| grep nginx
root      68901      1  0 17:12 ?        00:00:00 /usr/local/bin/containerd-shim-runc-v2 -namespace default -id nginx -address /run/containerd/containerd.sock
root      68922  68901  0 17:12 ?        00:00:00 nginx: master process nginx -g daemon off;
101       68951  68922  0 17:12 ?        00:00:00 nginx: worker process
101       68952  68922  0 17:12 ?        00:00:00 nginx: worker process
root      70706 113990  0 17:14 pts/0    00:00:00 grep --color=auto nginx

*************************************************************************************************************
 
ctr --help
ctr i --help
ctr i pull --help

#example: 基于tls證書，使用ctr命令 ctr i pull --help

ctr -n k8s.io i pull -k harbor.xxx.com/
ctr -n k8s.io i pull --tlscacert /etc/containerd/certs.d/harbor.xxx.com/tls.crt harbor.xxx.com/
ctr -n k8s.io i push --tlscacert /etc/containerd/certs.d/harbor.xxx.com/tls.crt   harbor.xxx.com/
ctr -n k8s.io i push -k harbor.xxx.com/k8s-infra/us.gcr.io/k8s-artifacts-prod/build-image/kube-cross:v1.13.15-1

特別的:基于私有鏡像倉庫，如果上面的pull 或 push 報401錯誤, username與pwd使用對應鏡像倉庫的用戶名和密碼替換

ctr -n k8s.io i push -u username:pwd --tlscacert /etc/containerd/certs.d/xxx/tls.crt harbor.xxx.com/

注意：
ctr 不支持 build,commit 鏡像