![kubernetes 集群 - 只有 crictl 可以真正看到容器(容器资产)](https://linux22.com/image/230383/kubernetes%20%E9%9B%86%E7%BE%A4%20-%20%E5%8F%AA%E6%9C%89%20crictl%20%E5%8F%AF%E4%BB%A5%E7%9C%9F%E6%AD%A3%E7%9C%8B%E5%88%B0%E5%AE%B9%E5%99%A8%EF%BC%88%E5%AE%B9%E5%99%A8%E8%B5%84%E4%BA%A7%EF%BC%89.png)
在我的kubernetes(v1.28.7)中,docker使用containerd作为底层容器管理引擎。
(我想我可以称之为容器运行时接口 - CRI?)。
这就是我的假设(查看最后一行并一直滚动到右侧):
lab@worker01:~$ sudo systemctl status docker
● docker.service - Docker Application Container Engine
Loaded: loaded (/lib/systemd/system/docker.service; enabled; vendor preset: enabled)
Active: active (running) since Wed 2024-03-27 14:22:36 UTC; 1h 11min ago
TriggeredBy: ● docker.socket
Docs: https://docs.docker.com
Main PID: 946 (dockerd)
Tasks: 7
Memory: 87.3M
CPU: 1.080s
CGroup: /system.slice/docker.service
└─946 /usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock --exec-opt native.cgroupdriver=systemd <--- HERE!!! containerd instead of docker.
问题: 如果containerd是我的CRI,为什么是唯一的方法,例如。列出图像或显示正在运行的容器是“crictl”?
sudo crictl image ls
IMAGE TAG IMAGE ID SIZE
docker.io/calico/cni v3.26.0 5d6f5c26c6554 93.3MB
docker.io/calico/node v3.26.0 44f52c09decec 87.6MB
docker.io/library/busybox latest ba5dc23f65d4c 2.16MB
docker.io/library/nginx latest 92b11f67642b6 70.5MB
docker.io/library/redis latest 170a1e90f8436 51.4MB
k8s.gcr.io/metrics-server/metrics-server v0.6.2 25561daa66605 28.1MB
registry.k8s.io/coredns/coredns v1.10.1 ead0a4a53df89 16.2MB
registry.k8s.io/kube-proxy v1.28.7 123aa721f941b 28.1MB
registry.k8s.io/pause 3.8 4873874c08efc 311kB
registry.k8s.io/pause 3.9 e6f1816883972 322kB
为什么泊坞窗或者点击率不显示图像:
sudo ctr images ls
REF TYPE DIGEST SIZE PLATFORMS LABELS
sudo docker images ls
REPOSITORY TAG IMAGE ID CREATED SIZE
答案1
Containerd 允许客户端设置“命名空间”以管理不同的资源集。例如,在我的本地系统上,运行 Docker 26.0.0,Docker 使用 containerd 作为容器运行时。
有几个正在运行的 Docker 容器:
$ docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
7cfbf97a9275 alpinelinux/darkhttpd "darkhttpd /var/www/…" 7 seconds ago Up 6 seconds 0.0.0.0:8080->8080/tcp, :::8080->8080/tcp boring_thompson
0e1ede44350e kindest/node:v1.29.2 "/usr/local/bin/entr…" 3 weeks ago Up 12 hours 127.0.0.1:39949->6443/tcp kind-control-plane
如果我运行,我什么也看不到ctr container ls
:
# ctr container ls
CONTAINER IMAGE RUNTIME
但如果我使用moby
命名空间,我会看到两个 Docker 容器:
# ctr --namespace moby container ls
CONTAINER IMAGE RUNTIME
0e1ede44350e15fa2305f4b2dbfa0a5023de645bb535b05cac232e91069c4e7e - io.containerd.runc.v2
7cfbf97a9275edb79228d241c221b665659e3688bbc96ac879bb950db481e912 - io.containerd.runc.v2
同样,在运行 Kubernetes 的系统上,运行ctr container ls
显示默认命名空间中没有容器,但如果我们使用k8s.io
命名空间,我们会看到 Kubernetes 管理的容器:
# ctr --namespace k8s.io container ls
CONTAINER IMAGE RUNTIME
007dc9290e81c88cc85cf1b74b50c535420f1e1b4188eca4dfbd46e14881d2ab registry.k8s.io/kube-apiserver-amd64:v1.29.2 io.containerd.runc.v2
00c5f27f9125eb7132277585d450c904f4ff9542f5f70130855d268debad0624 registry.k8s.io/pause:3.7 io.containerd.runc.v2
0f2968f76498a18b098bc5a11f1b8071e261d74e0790bc7df6a56f0b37e9b293 registry.k8s.io/kube-proxy-amd64:v1.29.2 io.containerd.runc.v2
...
containerd 中的命名空间支持描述于本文。