Containerd 容器镜像管理
·
首先，我们需要理解，什么是容器镜像，
容器镜像是一个小型的镜像，如ubuntu和其他的底层镜像一样，以最小化形式进行部署，去除了许多的不必要软件包
使用containerd客户端查看镜像管理命令
[root@containerd ~]# ctr --help
NAME:
ctr -
__
_____/ /______
/ ___/ __/ ___/
/ /__/ /_/ /
\___/\__/_/
containerd CLI
USAGE:
ctr [global options] command [command options] [arguments...]
VERSION:
v1.7.0
DESCRIPTION:
ctr is an unsupported debug and administrative client for interacting
with the containerd daemon. Because it is unsupported, the commands,
options, and operations are not guaranteed to be backward compatible or
stable from release to release of the containerd project.
COMMANDS:
plugins, plugin Provides information about containerd plugins
version Print the client and server versions
containers, c, container Manage containers
content Manage content
events, event Display containerd events
images, image, i Manage images
leases Manage leases
namespaces, namespace, ns Manage namespaces
pprof Provide golang pprof outputs for containerd
run Run a container
snapshots, snapshot Manage snapshots
tasks, t, task Manage tasks
install Install a new package
oci OCI tools
sandboxes, sandbox, sb, s Manage sandboxes
info Print the server info
shim Interact with a shim directly
help, h Shows a list of commands or help for one command
GLOBAL OPTIONS:
--debug Enable debug output in logs
--address value, -a value Address for containerd's GRPC server (default: "/run/containerd/containerd.sock") [$CONTAINERD_ADDRESS]
--timeout value Total timeout for ctr commands (default: 0s)
--connect-timeout value Timeout for connecting to containerd (default: 0s)
--namespace value, -n value Namespace to use with commands (default: "default") [$CONTAINERD_NAMESPACE]
--help, -h show help
--version, -v print the version在COMMANDS下，有一个images命令，这就是管理镜像的命令
这里可以使用image和i作为简写
查看ctr镜像管理帮助
[root@containerd ~]# ctr images --help
NAME:
ctr images - Manage images
USAGE:
ctr images command [command options] [arguments...]
COMMANDS:
check Check existing images to ensure all content is available locally
export Export images
import Import images
list, ls List images known to containerd
mount Mount an image to a target path
unmount Unmount the image from the target
pull Pull an image from a remote
push Push an image to a remote
prune Remove unused images
delete, del, remove, rm Remove one or more images by reference
tag Tag an image
label Set and clear labels for an image
convert Convert an image
usage Display usage of snapshots for a given image ref
OPTIONS:
--help, -h show help这里展示的是containerd的镜像管理命令
挑选其中较为常用的命令进行展示说明
查看镜像
[root@containerd ~]# ctr images --help
NAME:
ctr images - Manage images
USAGE:
ctr images command [command options] [arguments...]
COMMANDS:
check Check existing images to ensure all content is available locally
export Export images
import Import images
list, ls List images known to containerd
mount Mount an image to a target path
unmount Unmount the image from the target
pull Pull an image from a remote
push Push an image to a remote
prune Remove unused images
delete, del, remove, rm Remove one or more images by reference
tag Tag an image
label Set and clear labels for an image
convert Convert an image
usage Display usage of snapshots for a given image ref
OPTIONS:
--help, -h show help这里的镜像查看可以使用list和ls进行
查看帮助
[root@containerd ~]# ctr i ls --help
NAME:
ctr images list - List images known to containerd
USAGE:
ctr images list [command options] [flags] [<filter>, ...]
DESCRIPTION:
list images registered with containerd
OPTIONS:
--quiet, -q Print only the image refs查看镜像
[root@containerd ~]# ctr images ls
REF TYPE DIGEST SIZE PLATFORMS LABELS
[root@containerd ~]# 这里并没有返回存在容器镜像，是因为还没进行获取容器镜像命令
拉取镜像
[root@containerd ~]# ctr images --help
NAME:
ctr images - Manage images
USAGE:
ctr images command [command options] [arguments...]
COMMANDS:
check Check existing images to ensure all content is available locally
export Export images
import Import images
list, ls List images known to containerd
mount Mount an image to a target path
unmount Unmount the image from the target
pull Pull an image from a remote
push Push an image to a remote
prune Remove unused images
delete, del, remove, rm Remove one or more images by reference
tag Tag an image
label Set and clear labels for an image
convert Convert an image
usage Display usage of snapshots for a given image ref
OPTIONS:
--help, -h show help进行拉取操作只能使用pull命令进行，而push则是上传至镜像仓库，后续会发文章进行操作
拉取镜像帮助
[root@containerd ~]# ctr images pull --help
NAME:
ctr images pull - Pull an image from a remote
USAGE:
ctr images pull [command options] [flags] <ref>
DESCRIPTION:
Fetch and prepare an image for use in containerd.
After pulling an image, it should be ready to use the same reference in a run
command. As part of this process, we do the following:
1. Fetch all resources into containerd.
2. Prepare the snapshot filesystem with the pulled resources.
3. Register metadata for the image.
OPTIONS:
--skip-verify, -k Skip SSL certificate validation
--plain-http Allow connections using plain HTTP
--user value, -u value User[:password] Registry user and password
--refresh value Refresh token for authorization server
--hosts-dir value Custom hosts configuration directory
--tlscacert value Path to TLS root CA
--tlscert value Path to TLS client certificate
--tlskey value Path to TLS client key
--http-dump Dump all HTTP request/responses when interacting with container registry
--http-trace Enable HTTP tracing for registry interactions
--snapshotter value Snapshotter name. Empty value stands for the default value. [$CONTAINERD_SNAPSHOTTER]
--label value Labels to attach to the image
--platform value Pull content from a specific platform
--all-platforms Pull content and metadata from all platforms
--all-metadata Pull metadata for all platforms
--print-chainid Print the resulting image's chain ID
--max-concurrent-downloads value Set the max concurrent downloads for each pull (default: 0)
--local Fetch content from local client rather than using transfer service拉取镜像
[root@containerd ~]# ctr images pull busybox:latest
ctr: failed to resolve reference "busybox:3.15": parse "dummy://busybox:3.15": invalid port ":3.15" after host这里可以发现containerd是无法解析busybox的镜像
这个原因是因为containerd拉取镜像的时候需要添加完整的镜像仓库名，需要使用完全名才能拉取到镜像，而非像docker一样，直接输入镜像名，就可以自动补充docker.io的镜像仓库地址
拉取完整镜像地址
[root@containerd ~]# ctr images pull docker.io/library/busybox:latest
docker.io/library/busybox:3.15: resolving |--------------------------------------|
elapsed: 20.9s total: 0.0 B (0.0 B/s)
INFO[0021] trying next host error="failed to do request: Head \"https://registry-1.docker.io/v2/library/busybox/manifests/3.15\": dial tcp 185.60.216.36:443: connect: connection refused" host=registry-1.docker.io
ctr: failed to resolve reference "docker.io/library/busybox:3.15": failed to do request: Head "https://registry-1.docker.io/v2/library/busybox/manifests/3.15": dial tcp 185.60.216.36:443: connect: connection refused依旧是拉取失败，原因是containerd有检测机制，拉取20s后，发现依旧为获取到镜像的相关数据，就会弹出错误，无法找到对应的镜像仓库，这时就需要配置容器镜像加速了
扩展：配置镜像加速
官方文档：https://github.com/containerd/containerd/blob/main/docs/cri/registry.md
配置镜像加速器的作用是在国内的网络，是无法访问到docker.io这类国外的镜像仓库，这时就需要配置国内镜像仓库，或者对应的镜像加速器来进行成功拉取镜像的操作
创建containerd的目录
[root@containerd ~]# mkdir -p /etc/containerd
[root@containerd ~]# containerd config default > /etc/containerd/config.toml这里需要将关于containerd对应的配置文件生成到containerd的目录下，二进制方式部署的containerd是没有这个目录以及默认的文件的，所以需要手工的去配置这个文件以及创建目录
修改config.toml文件
[root@containerd ~]# vi /etc/containerd/config.toml
159 [plugins."io.containerd.grpc.v1.cri".registry]
160 config_path = "/etc/containerd/certs.d"
在配置文件中找到对应的位置，可以根据行号，以及plugins这个名字进行查找
修改完成后进行重启containerd
[root@containerd ~]# systemctl restart containerd在修改后指定的目录下，创建对应镜像仓库目录
[root@containerd ~]# mkdir -p /etc/containerd/certs.d/docker.iocontainerd配置镜像仓库，需要在指定的目录下，创建对应镜像仓库地址的目录
创建配置文件
[root@containerd ~]# touch /etc/containerd/certs.d/docker.io/hosts.toml
[root@containerd ~]# tee /etc/containerd/certs.d/docker.io/hosts.toml <<EOF
> server = "https://docker.io"
>
> [host."https://docker.m.daocloud.io"]
> capabilities = ["pull", "resolve"]
> [host."https://dockerproxy.com/"]
> capabilities = ["pull", "resolve"]
> EOF
server = "https://docker.io"
[host."https://docker.m.daocloud.io"]
capabilities = ["pull", "resolve"]
[host."https://dockerproxy.com/"]
capabilities = ["pull", "resolve"]
写入完成后，依旧重启服务器
[root@containerd ~]# systemctl restart containerd再次尝试拉取镜像
[root@containerd ~]# ctr images pull --hosts-dir "/etc/containerd/certs.d" docker.io/library/busybox:latest
docker.io/library/busybox:latest: resolved |++++++++++++++++++++++++++++++++++++++|
index-sha256:d82f458899c9696cb26a7c02d5568f81c8c8223f8661bb2a7988b269c8b9051e: exists |++++++++++++++++++++++++++++++++++++++|
manifest-sha256:182014572d8981d8323fe9944876f63b39694e16ce08ae6296e97686c52b150c: exists |++++++++++++++++++++++++++++++++++++++|
layer-sha256:80bfbb8a41a2b27d93763e96f5bdccb8ca289387946e406e6f24053f6a8e8494: done |++++++++++++++++++++++++++++++++++++++|
config-sha256:0ed463b26daee791b094dc3fff25edb3e79f153d37d274e5c2936923c38dac2b: exists |++++++++++++++++++++++++++++++++++++++|
elapsed: 1.6 s total: 1.0 Mi (639.9 KiB/s)
unpacking linux/amd64 sha256:d82f458899c9696cb26a7c02d5568f81c8c8223f8661bb2a7988b269c8b9051e...
done: 99.380644ms成功拉取镜像到本地
查看镜像
[root@containerd ~]# ctr i ls
REF TYPE DIGEST SIZE PLATFORMS LABELS
docker.io/library/busybox:latest application/vnd.oci.image.index.v1+json sha256:d82f458899c9696cb26a7c02d5568f81c8c8223f8661bb2a7988b269c8b9051e 2.1 MiB linux/386,linux/amd64,linux/arm/v5,linux/arm/v6,linux/arm/v7,linux/arm64/v8,linux/ppc64le,linux/riscv64,linux/s390x,unknown/unknown - | 字段 | 描述 | 示例值 |
|---|---|---|
REF | 镜像引用（名称+标签） | docker.io/library/busybox:latest |
TYPE | 镜像类型（OCI规范格式） | application/vnd.oci.image.index.v1+json |
DIGEST | 唯一标识符（内容哈希值） | sha256:d82f458899c9696cb26a7c02d5568f81c8c8223f8661bb2a7988b269c8b9051e |
SIZE | 镜像大小 | 2.1 MiB |
PLATFORMS | 支持的操作系统和架构 | linux/386, linux/amd64, linux/arm/v5 等（共10项） |
LABELS | 元数据标签（未标注时为-） | - |
镜像导出
[root@containerd ~]# ctr images --help
NAME:
ctr images - Manage images
USAGE:
ctr images command [command options] [arguments...]
COMMANDS:
check Check existing images to ensure all content is available locally
export Export images
import Import images
list, ls List images known to containerd
mount Mount an image to a target path
unmount Unmount the image from the target
pull Pull an image from a remote
push Push an image to a remote
prune Remove unused images
delete, del, remove, rm Remove one or more images by reference
tag Tag an image
label Set and clear labels for an image
convert Convert an image
usage Display usage of snapshots for a given image ref
OPTIONS:
--help, -h show help镜像的导出使用export命令
查看帮助
[root@containerd ~]# ctr i export --help
NAME:
ctr images export - Export images
USAGE:
ctr images export [command options] [flags] <out> <image> ...
DESCRIPTION:
Export images to an OCI tar archive.
Tar output is formatted as an OCI archive, a Docker manifest is provided for the platform.
Use '--skip-manifest-json' to avoid including the Docker manifest.json file.
Use '--platform' to define the output platform.
When '--all-platforms' is given all images in a manifest list must be available.
OPTIONS:
--skip-manifest-json Do not add Docker compatible manifest.json to archive
--skip-non-distributable Do not add non-distributable blobs such as Windows layers to archive
--platform value Pull content from a specific platform
--all-platforms Exports content from all platforms
--local Run export locally rather than through transfer API镜像导出
[root@containerd ~]# ctr i export --platform linux/amd64 busybox.tar docker.io/library/busybox:latest
[root@containerd ~]# ls -lh
-rw-r--r--. 1 root root 2.2M 10月 1 15:43 busybox.tar
这里只单独导出了linux/amd64的版本镜像，如果需要导出所有，可以添加--all-platforms参数
镜像删除
[root@containerd ~]# ctr images --help
NAME:
ctr images - Manage images
USAGE:
ctr images command [command options] [arguments...]
COMMANDS:
check Check existing images to ensure all content is available locally
export Export images
import Import images
list, ls List images known to containerd
mount Mount an image to a target path
unmount Unmount the image from the target
pull Pull an image from a remote
push Push an image to a remote
prune Remove unused images
delete, del, remove, rm Remove one or more images by reference
tag Tag an image
label Set and clear labels for an image
convert Convert an image
usage Display usage of snapshots for a given image ref
OPTIONS:
--help, -h show help这里的镜像删除可以使用delete，del，remove，rm一共四条命令进行镜像的删除操作
查看帮助
[root@containerd ~]# ctr images rm --help
NAME:
ctr images delete - Remove one or more images by reference
USAGE:
ctr images delete [command options] [flags] <ref> [<ref>, ...]
DESCRIPTION:
remove one or more images by reference
OPTIONS:
--sync Synchronously remove image and all associated resources镜像删除
[root@containerd ~]# ctr i rm docker.io/library/busybox:latest
docker.io/library/busybox:latest
[root@containerd ~]# ctr i ls
REF TYPE DIGEST SIZE PLATFORMS LABELS
[root@containerd ~]# 删除也是需要使用镜像的完整命名才能对镜像进行删除操作
镜像导入
[root@containerd ~]# ctr images --help
NAME:
ctr images - Manage images
USAGE:
ctr images command [command options] [arguments...]
COMMANDS:
check Check existing images to ensure all content is available locally
export Export images
import Import images
list, ls List images known to containerd
mount Mount an image to a target path
unmount Unmount the image from the target
pull Pull an image from a remote
push Push an image to a remote
prune Remove unused images
delete, del, remove, rm Remove one or more images by reference
tag Tag an image
label Set and clear labels for an image
convert Convert an image
usage Display usage of snapshots for a given image ref
OPTIONS:
--help, -h show help镜像导入的命令使用的是import命令
查看帮助
[root@containerd ~]# ctr i import --help
NAME:
ctr images import - Import images
USAGE:
ctr images import [command options] [flags] <in>
DESCRIPTION:
Import images from a tar stream.
Implemented formats:
- oci.v1
- docker.v1.1
- docker.v1.2
For OCI v1, you may need to specify --base-name because an OCI archive may
contain only partial image references (tags without the base image name).
If no base image name is provided, a name will be generated as "import-%{yyyy-MM-dd}".
e.g.
$ ctr images import --base-name foo/bar foobar.tar
If foobar.tar contains an OCI ref named "latest" and anonymous ref "sha256:deadbeef", the command will create
"foo/bar:latest" and "foo/bar@sha256:deadbeef" images in the containerd store.
OPTIONS:
--base-name value Base image name for added images, when provided only images with this name prefix are imported
--digests Whether to create digest images (default: false)
--skip-digest-for-named Skip applying --digests option to images named in the importing tar (use it in conjunction with --digests)
--index-name value Image name to keep index as, by default index is discarded
--all-platforms Imports content for all platforms, false by default
--platform value Imports content for specific platform
--no-unpack Skip unpacking the images, cannot be used with --discard-unpacked-layers, false by default
--local Run import locally rather than through transfer API
--compress-blobs Compress uncompressed blobs when creating manifest (Docker format only)
--discard-unpacked-layers Allow the garbage collector to clean layers up from the content store after unpacking, cannot be used with --no-unpack, false by default
--snapshotter value Snapshotter name. Empty value stands for the default value. [$CONTAINERD_SNAPSHOTTER]镜像导入
[root@containerd ~]# ctr i import --platform linux/amd64 busybox.tar
unpacking docker.io/library/busybox:latest (sha256:d82f458899c9696cb26a7c02d5568f81c8c8223f8661bb2a7988b269c8b9051e)...done注意：这里导入镜像时，如果导出的镜像是指定版本的镜像，则导入也需要进行指定版本的导入，否则会出现错误无法导入的情况，如果是导出的all全部版本镜像，则无需这一步
[root@containerd ~]# ctr i ls
REF TYPE DIGEST SIZE PLATFORMS LABELS
docker.io/library/busybox:latest application/vnd.oci.image.index.v1+json sha256:d82f458899c9696cb26a7c02d5568f81c8c8223f8661bb2a7988b269c8b9051e 2.1 MiB linux/386,linux/amd64,linux/arm/v5,linux/arm/v6,linux/arm/v7,linux/arm64/v8,linux/ppc64le,linux/riscv64,linux/s390x,unknown/unknown - 镜像tag修改
[root@containerd ~]# ctr i --help
NAME:
ctr images - Manage images
USAGE:
ctr images command [command options] [arguments...]
COMMANDS:
check Check existing images to ensure all content is available locally
export Export images
import Import images
list, ls List images known to containerd
mount Mount an image to a target path
unmount Unmount the image from the target
pull Pull an image from a remote
push Push an image to a remote
prune Remove unused images
delete, del, remove, rm Remove one or more images by reference
tag Tag an image
label Set and clear labels for an image
convert Convert an image
usage Display usage of snapshots for a given image ref
OPTIONS:
--help, -h show help修改镜像的tag，需要使用的命令是tag
查看帮助
[root@containerd ~]# ctr i tag --help
NAME:
ctr images tag - Tag an image
USAGE:
ctr images tag [command options] [flags] <source_ref> <target_ref> [<target_ref>, ...]
DESCRIPTION:
Tag an image for use in containerd.
OPTIONS:
--force Force target_ref to be created, regardless if it already exists
--local Run tag locally rather than through transfer API修改tag
[root@containerd ~]# ctr i tag docker.io/library/busybox:latest harbor.test/library/busybox:v1
harbor.test/library/busybox:v1这里首先写入的是本地所有的镜像名称，后面则是需要修改的
修改规范的话，默认是将拉取的镜像，打包成本地镜像仓库的镜像，然后进行push的
harbor.test：是镜像仓库的名称
library：是镜像仓库的一个项目目录，对于导入的镜像进行相关分类的，而library则是默认存在的
总结：
本次学习了对于容器镜像的了解，知道了容器镜像是一个小型的镜像，轻量化容器级别的镜像
对于containerd客户端的ctr中的images命令进行了常用命令的学习，如ls查看，pull拉取，export导出，rm删除，import导入以及tag进行镜像名称的修改
关于修改完tag后的镜像push上传操作，则留到后面学习完containerd的基本操作后，结合前面搭建的harbor仓库进行部署
码道开发者社区，聚焦华为云码道 CodeArts 代码智能体，沉淀 Agent、Skill、鸿蒙开发实战内容，供开发者查阅资料、交流技术、分享工程实践
更多推荐
26
0- 0
已为社区贡献4条内容
所有评论(0)