Containerd 进阶实战｜nerdctl、crictl 实操与命令横向对比

容器管理工具Containerd（下篇）：nerdctl、crictl与容器管理工具对比

一、nerdctl 实践

nerdctl 安装

我们推荐使用 nerdctl 管理containerd，命令语法与 docker 一致。 截止 2023-05-24 最新版本是 v 1.4.0 github项目地址：https://github.com/containerd/nerdctl/releases cni插件项目地址：https://github.com/containernetworking/plugins/releases

# 使用wget下载nerdctl二进制安装包
[root@localhost ~]# wget https://github.com/containerd/nerdctl/releases/download/v1.4.0/nerdctl-1.4.0-linux-amd64.tar.gz

# 解压nerdctl安装包到/usr/bin目录，-xf解压文件，-C指定目标目录
[root@localhost ~]# tar -xf nerdctl-1.4.0-linux-amd64.tar.gz -C /usr/bin/

# 生成nerdctl的bash自动补全脚本，输出到/etc/bash_completion.d/nerdctl
[root@localhost ~]# nerdctl completion bash > /etc/bash_completion.d/nerdctl
# 加载自动补全脚本，使补全功能立即生效
[root@localhost ~]# source /etc/bash_completion.d/nerdctl

# 使用wget下载nerdctl所需的CNI网络插件
[root@localhost ~]# wget https://github.com/containernetworking/plugins/releases/download/v1.3.0/cni-plugins-linux-amd64-v1.3.0.tgz

# 创建CNI插件目录，-p递归创建父目录
[root@localhost ~]# mkdir -p /opt/cni/bin
# 解压CNI插件到/opt/cni/bin目录，-xf解压文件，-C指定目标目录
[root@localhost ~]# tar -xf cni-plugins-linux-amd64-v1.3.0.tgz -C /opt/cni/bin

如果nerdctl补全是报错信息如下：
_get_comp_words_by_ref: command not found
解决方法：安装 bash-completion
# 安装bash-completion软件包，解决nerdctl补全报错
[root@localhost ~]# yum install -y bash-completion

配置镜像加速

#编辑containerd的配置文件config.toml，如果不存在，需要手动生成，方法 containerd config default > /etc/containerd/config.toml，在配置文件中搜索关键字“config_path”，在其下面添加镜像加速参数
# 生成containerd默认配置文件，重定向输出到/etc/containerd/config.toml
[root@docker ~]# containerd config default > /etc/containerd/config.toml
# 编辑containerd配置文件，搜索config_path关键字添加镜像加速参数
[root@control ~]# vim /etc/containerd/config.toml
146 [plugins."io.containerd.grpc.v1.cri".registry]
147 config_path = "/etc/containerd/certs.d" #配置这里
# 创建docker.io镜像加速配置目录，-p递归创建父目录
[root@control ~]# mkdir -p /etc/containerd/certs.d/docker.io
# 编辑docker.io镜像加速的hosts.toml配置文件
[root@localhost ~]# vim /etc/containerd/certs.d/docker.io/hosts.toml
server = "https://054b8ac70e8010d90f2ac00ef29e6580.mirror.swr.myhuaweicloud.com"
[host."https://054b8ac70e8010d90f2ac00ef29e6580.mirror.swr.myhuaweicloud.com"]
capabilities = ["pull", "resolve"]
#重启containerd服务生效

# 重启containerd服务，使镜像加速配置生效
[root@control ~]# systemctl restart containerd

nerdctl 管理镜像

# 按两次Tab键触发nerdctl image子命令自动补全，查看可用的子命令
[root@localhost ~]# nerdctl image <按tab键><按tab键>
build (Build an image from a Dockerfile. Needs buildkitd to be running.)
convert (convert an image)
decrypt (decrypt an image)
encrypt (encrypt image layers)
history (Show the history of an image)
inspect (Display detailed information on one or more images.)
load (Load an image from a tar archive or STDIN)
ls (List images)
prune (Remove unused images)
pull (Pull an image from a registry. Optionally specify "ipfs://" or
"ipns://" scheme to pull image from IPFS.)
push (Push an image or a repository to a registry. Optionally specify
"ipfs://" or "ipns://" scheme to push image to IPFS.)
rm (Remove one or more images)
save (Save one or more images to a tar archive (streamed to STDOUT by
default))
tag (Create a tag TARGET_IMAGE that refers to SOURCE_IMAGE)

ls

作用：查看本地镜像清单。 示例：

# 查看本地镜像列表
[root@localhost ~]# nerdctl image ls
REPOSITORY TAG IMAGE ID CREATED PLATFORM SIZE BLOB SIZE
# 可简写如下
# 简写形式查看本地镜像列表
[root@localhost ~]# nerdctl images

pull

作用：从网络上下载镜像。 示例：

# 从网络下载busybox镜像
[root@localhost ~]# nerdctl image pull busybox

# 简写形式(pull)下载httpd镜像
[root@localhost ~]# nerdctl pull httpd

# 查看本地镜像列表
[root@localhost ~]# nerdctl image ls
REPOSITORY TAG IMAGE ID CREATED PLATFORM SIZE BLOB SIZE
busybox latest f9a104fddb33 19 minutes ago linux/amd64 4.1 MiB 2.1 MiB
httpd latest fbc12199ccad 44 seconds ago linux/amd64 152.4 MiB 55.8 MiB

rm

作用：删除本地不用的镜像。 示例：

# 删除httpd镜像
[root@localhost ~]# nerdctl image rm httpd

# 简写形式(rmi)删除busybox镜像
[root@localhost ~]# nerdctl rmi busybox

# 简写形式查看本地镜像列表
[root@localhost ~]# nerdctl images
REPOSITORY TAG IMAGE ID CREATED PLATFORM SIZE BLOB SIZE
busybox latest f9a104fddb33 19 minutes ago linux/amd64 4.1 MiB 2.1 MiB

tag

作用：给镜像打标签。 示例：

# 为busybox镜像打上busybox_containerd标签
[root@localhost ~]# nerdctl tag busybox busybox_containerd

# 简写形式查看本地镜像列表
[root@localhost ~]# nerdctl images
REPOSITORY TAG IMAGE ID CREATED PLATFORM SIZE BLOB SIZE
busybox latest f9a104fddb33 34 minutes ago linux/amd64 4.1 MiB 2.1 MiB
busybox_containerd latest f9a104fddb33 3 seconds ago linux/amd64 4.1 MiB 2.1 MiB

save

作用：将本地镜像导出为文件。 示例：

# 将busybox镜像导出为busybox.tar文件，-o指定输出文件
[root@localhost ~]# nerdctl image save busybox -o busybox.tar

# 可简写为
# 简写形式(save)导出busybox镜像为tar文件
[root@localhost ~]# nerdctl save busybox -o busybox.tar

# 删除busybox镜像
[root@localhost ~]# nerdctl image rm busybox

# 简写形式查看本地镜像列表
[root@localhost ~]# nerdctl images
REPOSITORY TAG IMAGE ID CREATED PLATFORM SIZE BLOB SIZE
busybox_containerd latest f9a104fddb33 57 seconds ago linux/amd64 4.1 MiB 2.1 MiB

load

作用：导入tar文件中镜像。 示例：

# 从busybox.tar文件导入镜像，-i指定输入文件
[root@localhost ~]# nerdctl image load -i busybox.tar

# 可简写为
# 简写形式(load)导入busybox.tar镜像
[root@localhost ~]# nerdctl load -i busybox.tar

# 简写形式查看本地镜像列表
[root@localhost ~]# nerdctl images
REPOSITORY TAG IMAGE ID CREATED PLATFORM SIZE BLOB SIZE
busybox latest f9a104fddb33 7 seconds ago linux/amd64 4.1 MiB 2.1 MiB
busybox_containerd latest f9a104fddb33 About a minute ago linux/amd64 4.1 MiB 2.1 MiB

history

作用：查看镜像构建时的历史命令层次结构。 示例：

# 查看busybox镜像构建的历史命令层次结构
[root@localhost ~]# nerdctl image history busybox
SNAPSHOT
CREATED CREATED BY SIZE COMMENT
sha256:65014c70e84b6817fac42bb201ec5c1ea460a8da246cac0e481f5c9a9491eac0 10
months ago BusyBox 1.37.0 (glibc), Debian 12 4.1 MiB

inspect

作用：查看镜像详细信息。 示例：

# 查看busybox镜像的详细信息
[root@localhost ~]# nerdctl image inspect busybox
[
{
"Id":
"sha256:6d3e4188a38af91b0c1577b9e88c53368926b2fe0e1fb985d6e8a70040520c4d",
"RepoTags": [
"busybox:latest"
],
"RepoDigests": [
"busybox@sha256:f9a104fddb33220ec80fc45a4e606c74aadf1ef7a3832eb0b05be9e90cd61f5f
"
],
"Comment": "",
"Created": "2024-09-26T21:31:42Z",
"Author": "",
"Config": {
"AttachStdin": false,
"Env": [
"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
],
"Cmd": [
"sh"
]
},
"Architecture": "amd64",
"Os": "linux",
"Size": 4337664,
"RootFS": {
"Type": "layers",
"Layers": [
"sha256:65014c70e84b6817fac42bb201ec5c1ea460a8da246cac0e481f5c9a9491eac0"
]
},
"Metadata": {
"LastTagTime": "0001-01-01T00:00:00Z"
}
}
]

prune

作用：删除所有未使用的镜像。 示例：

# 删除所有未使用的镜像，–all删除全部未使用镜像，–force不提示确认
[root@localhost ~]# nerdctl image prune –all –force

# 查看本地镜像列表
[root@localhost ~]# nerdctl image ls
REPOSITORY TAG IMAGE ID CREATED PLATFORM SIZE BLOB SIZE

[root@localhost ~]#

nerdctl 管理容器

帮助信息

# 查看nerdctl container容器管理子命令帮助
[root@localhost ~]# nerdctl container –help
Manage containers
Usage: nerdctl container [flags]
Commands:
commit Create a new image from a container's changes
cp Copy files/folders between a running container and the local
filesystem.
create Create a new container. Optionally specify "ipfs://" or "ipns://"
scheme to pull image from IPFS.
exec Run a command in a running container
inspect Display detailed information on one or more containers.
kill Kill one or more running containers
logs Fetch the logs of a container. Expected to be used with 'nerdctl run –
d'.
ls List containers
pause Pause all processes within one or more containers
port List port mappings or a specific mapping for the container
prune Remove all stopped containers
rename rename a container
restart Restart one or more running containers
rm Remove one or more containers
run Run a command in a new container. Optionally specify "ipfs://" or
"ipns://" scheme to pull image from IPFS.
start Start one or more running containers
stop Stop one or more running containers
unpause Unpause all processes within one or more containers
update Update one or more running containers
wait Block until one or more containers stop, then print their exit codes.
Flags:
-h, –help help for container
See also 'nerdctl –help' for the global flags such as '–namespace', '—
snapshotter', and '–cgroup-manager'.

ls

作用：查看容器清单。 示例：

# 查看容器列表
[root@localhost ~]# nerdctl container ls
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
# 可简写为
# 简写形式(ps)查看容器列表
[root@localhost ~]# nerdctl ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
# 查看所有容器，-a/–all包含未运行的容器
[root@localhost ~]# nerdctl container ls -a
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES

常用选项：

• -a, –all Show all containers (default shows just running)
• -f, –filter strings Filter matches containers based on given conditions
• –format string Format the output using the given Go template, e.g, ‘{{json .}}’, ‘wide’

run

作用：创建并运行容器。 示例：

# 语法：
# 查看nerdctl run命令帮助，了解运行容器的语法和选项
[root@localhost ~]# nerdctl run –help
Run a command in a new container. Optionally specify "ipfs://" or "ipns://"
scheme to pull image from IPFS.
Usage: nerdctl run [flags] IMAGE [COMMAND] [ARG...]

# 创建并运行ubuntu容器，-i保持标准输入打开，-t分配终端，进入容器交互
[root@localhost ~]# nerdctl container run -it ubuntu
root@0da9aad32119:/# exit
exit

# 可简写为
# 简写形式(run)创建并运行ubuntu容器
[root@localhost ~]# nerdctl run -it ubuntu

# 容器状态为Exited
# 查看容器列表
[root@localhost ~]# nerdctl container ls
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES

# 查看所有容器，-a/–all包含未运行的容器
[root@localhost ~]# nerdctl container ls -a
CONTAINER ID IMAGE COMMAND CREATED
STATUS PORTS NAMES
0da9aad32119 docker.io/library/ubuntu:latest "/bin/bash" 3 minutes ago
Exited (130) 2 minutes ago ubuntu-0da9a

常用选项：

• –cpu-shares uint CPU shares (relative weight)
• –cpus float Number of CPUs
• -d, –detach Run container in background and print container ID
• –dns strings Set custom DNS servers
• -e, –env stringArray Set environment variables
• -h, –hostname string Container host name
• -i, –interactive Keep STDIN open even if not attached
• –ip string Pv4 address to assign to the container
• –mac-address string MAC address to assign to the container
• -m, –memory string Memory limit
• –name string Assign a name to the container
• –net strings Connect a container to a network (“bridge”|“host”|“none”|) (default [bridge])
• –network strings Connect a container to a network (“bridge”|“host”|“none”|“container:”|) (default [bridge])
• –privileged Give extended privileges to this container
• –pull string Pull image before running (“always”|“missing”|“never”) (default “missing”)
• –restart string Restart policy to apply when a container exits (implemented values: “no”|“always|on-failure:n|unless-stopped”) (default “no”)
• –rm Automatically remove the container when it exits
• –runtime string Runtime to use for this container, e.g.
• –stop-signal string Signal to stop a container (default “SIGTERM”)
• –stop-timeout Timeout (in seconds) to stop a container
• -t, –tty Allocate a pseudo-TTY
• -v, –volume Bind mount a volume

rm

作用：删除容器。 示例：

# 删除指定容器ID的容器
[root@localhost ~]# nerdctl container rm 0da9aad32119
0da9aad32119

# 查看所有容器，-a/–all包含未运行的容器
[root@localhost ~]# nerdctl container ls -a
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES

prune

作用：删除所有未运行的容器。 示例：

# 创建并运行ubuntu容器(前台运行，exit后退出)
[root@localhost ~]# nerdctl container run ubuntu
# 创建并运行ubuntu容器(前台运行，exit后退出)
[root@localhost ~]# nerdctl container run ubuntu
# 查看所有容器，-a/–all包含未运行的容器
[root@localhost ~]# nerdctl container ls -a
CONTAINER ID IMAGE COMMAND CREATED
STATUS PORTS NAMES
3778651cfacb docker.io/library/ubuntu:latest "/bin/bash" 5 seconds ago
Exited (0) 5 seconds ago ubuntu-37786
3e8221845ab4 docker.io/library/ubuntu:latest "/bin/bash" 11 seconds ago
Exited (0) 11 seconds ago ubuntu-3e822

# 删除所有已停止的容器，–force不提示确认
[root@localhost ~]# nerdctl container prune –force
Deleted Containers:
3778651cfacba1cd489b065ff7017b272b9edddc71211e2a6e567d9d0ec8ac54
3e8221845ab479f18a091c04443d26632946c9ced264c21a490f6b3052bde0b2

rename

作用：重命名容器。 示例：

# 创建并运行ubuntu容器，–name指定容器名为ubuntu-1
[root@localhost ~]# nerdctl container run –name ubuntu-1 ubuntu
# 查看所有容器，-a/–all包含未运行的容器
[root@localhost ~]# nerdctl container ls -a
CONTAINER ID IMAGE COMMAND CREATED
STATUS PORTS NAMES
61384145427a docker.io/library/ubuntu:latest "/bin/bash" 13 seconds ago
Exited (0) 13 seconds ago ubuntu-1

# 将容器ubuntu-1重命名为ubuntu
[root@localhost ~]# nerdctl container rename ubuntu-1 ubuntu
# 查看所有容器，-a/–all包含未运行的容器
[root@localhost ~]# nerdctl container ls -a
CONTAINER ID IMAGE COMMAND CREATED
STATUS PORTS NAMES
61384145427a docker.io/library/ubuntu:latest "/bin/bash" 26 seconds ago
Exited (0) 26 seconds ago ubuntu

# 删除ubuntu容器
[root@localhost ~]# nerdctl container rm ubuntu
ubuntu

stop 和 start

作用：停止和启动容器。 示例：

# 后台运行nginx容器，-d后台运行，–name指定容器名为nginx1
[root@localhost ~]# nerdctl container run -d –name nginx1 nginx
# 查看容器列表，–format自定义输出格式，只显示容器名和状态
[root@localhost ~]# nerdctl container ls –format "{{.Names}} {{.Status}}"
nginx1 Up

# 停止nginx1容器
[root@localhost ~]# nerdctl container stop nginx1
nginx1

# 查看所有容器状态，–format自定义输出格式，确认nginx1已暂停(Paused)
[root@localhost ~]# nerdctl container ls –format "{{.Names}} {{.Status}}" -a
nginx1 Exited (0) 13 seconds ago

# 启动nginx1容器
[root@localhost ~]# nerdctl container start nginx1
nginx1

# 查看容器列表，–format自定义输出格式，只显示容器名和状态
[root@localhost ~]# nerdctl container ls –format "{{.Names}} {{.Status}}"
nginx1 Up

restart

作用：重启容器。 示例：

# 重启nginx1容器
[root@localhost ~]# nerdctl container restart nginx1
nginx1

pause 和 unpause

作用：暂停和取消挂起容器。 示例：

# 暂停nginx1容器
[root@localhost ~]# nerdctl container pause nginx1
nginx1

# 查看所有容器状态，–format自定义输出格式，确认nginx1已暂停(Paused)
[root@localhost ~]# nerdctl container ls –format "{{.Names}} {{.Status}}" -a
nginx1 Paused

# 取消暂停(恢复)nginx1容器
[root@localhost ~]# nerdctl container unpause nginx1
nginx1

# 查看所有容器状态，–format自定义输出格式，确认nginx1已暂停(Paused)
[root@localhost ~]# nerdctl container ls –format "{{.Names}} {{.Status}}" -a
nginx1 Up

kill

作用：给容器发信号，默认发KILL信号。 示例：

# 给nginx1容器发送信号，默认发送KILL信号强制终止
[root@localhost ~]# nerdctl container kill nginx1
945c89b61aafc3475317e8801ad8526fdf337b038bfa315472e4c723bf5406f1

# 查看所有容器状态，–format自定义输出格式，确认nginx1被强制终止
[root@localhost ~]# nerdctl container ls -a –format "{{.Names}} {{.Status}}"
nginx1 Exited (137) 8 seconds ago

exec

作用：在运行的容器内部执行命令。 示例：

# 启动nginx1容器
[root@localhost ~]# nerdctl container start nginx1
nginx1

# 在运行中的nginx1容器内执行bash命令，-it交互式终端
[root@localhost ~]# nerdctl container exec -it nginx1 bash
root@945c89b61aaf:/# exit
exit

cp

作用：将宿主机文件复制给容器。 示例：

# 将宿主机/etc/hostname文件复制到nginx1容器内
[root@localhost ~]# nerdctl container cp /etc/hostname nginx1:
# 在nginx1容器内执行ls命令查看hostname文件
[root@localhost ~]# nerdctl container exec nginx1 ls hostname
hostname

思考：如果容器中的文件拷贝给宿主机该如何操作

inspect

作用：查看容器详细信息。 示例：

# 查看nginx1容器的详细信息
[root@localhost ~]# nerdctl container inspect nginx1
[
{
"Id": "945c89b61aafc3475317e8801ad8526fdf337b038bfa315472e4c723bf5406f1",
"Created": "2025-08-02T14:07:36.213384887Z",
"Path": "/docker-entrypoint.sh",
"Args": [
"nginx",
"-g",
"daemon off;"
],
"State": {
"Status": "running",
"Running": true,
"Paused": false,
"Restarting": false,
"Pid": 49359,
"ExitCode": 0,
"Error": "",
"FinishedAt": "0001-01-01T00:00:00Z"
},
"Image": "docker.io/library/nginx:latest",
"ResolvConfPath":
"/var/lib/nerdctl/1935db59/containers/default/945c89b61aafc3475317e8801ad8526fdf3
37b038bfa315472e4c723bf5406f1/resolv.conf",
"HostnamePath":
"/var/lib/nerdctl/1935db59/containers/default/945c89b61aafc3475317e8801ad8526fdf3
37b038bfa315472e4c723bf5406f1/hostname",
"LogPath":
"/var/lib/nerdctl/1935db59/containers/default/945c89b61aafc3475317e8801ad8526fdf3
37b038bfa315472e4c723bf5406f1/945c89b61aafc3475317e8801ad8526fdf337b038bfa315472e
4c723bf5406f1-json.log",
"Name": "nginx1",
"RestartCount": 0,
"Driver": "overlayfs",
"Platform": "linux",
"AppArmorProfile": "",
"Mounts": null,
"Config": {
"Hostname": "945c89b61aaf",
"AttachStdin": false,
"Labels": {
"containerd.io/restart.explicitly-stopped": "false",
"io.containerd.image.config.stop-signal": "SIGQUIT",
"nerdctl/extraHosts": "null",
"nerdctl/hostname": "945c89b61aaf",
"nerdctl/log-uri": "binary:///usr/bin/nerdctl?
_NERDCTL_INTERNAL_LOGGING=%2Fvar%2Flib%2Fnerdctl%2F1935db59",
"nerdctl/name": "nginx1",
"nerdctl/namespace": "default",
"nerdctl/networks": "[\\"bridge\\"]",
"nerdctl/platform": "linux/amd64",
"nerdctl/state-dir":
"/var/lib/nerdctl/1935db59/containers/default/945c89b61aafc3475317e8801ad8526fdf3
37b038bfa315472e4c723bf5406f1"
}
},
"NetworkSettings": {
"GlobalIPv6Address": "",
"GlobalIPv6PrefixLen": 0,
"IPAddress": "10.4.0.15",
"IPPrefixLen": 24,
"MacAddress": "32:81:21:fb:b4:72",
"Networks": {
"unknown-eth0": {
"IPAddress": "10.4.0.15",
"IPPrefixLen": 24,
"GlobalIPv6Address": "",
"GlobalIPv6PrefixLen": 0,
"MacAddress": "32:81:21:fb:b4:72"
}
}
}
}
]

[root@localhost ~]#

logs

作用：显示容器console终端内容。 示例：

# 查看nginx1容器的日志(console终端输出)
[root@localhost ~]# nerdctl container logs nginx1
/docker-entrypoint.sh: /docker-entrypoint.d/ is not empty, will attempt to
perform configuration
/docker-entrypoint.sh: Looking for shell scripts in /docker-entrypoint.d/
/docker-entrypoint.sh: Launching /docker-entrypoint.d/10-listen-on-ipv6-by-
default.sh
10-listen-on-ipv6-by-default.sh: info: IPv6 listen already enabled
/docker-entrypoint.sh: Sourcing /docker-entrypoint.d/15-local-resolvers.envsh
/docker-entrypoint.sh: Launching /docker-entrypoint.d/20-envsubst-on-templates.sh
/docker-entrypoint.sh: Launching /docker-entrypoint.d/30-tune-worker-processes.sh
/docker-entrypoint.sh: Configuration complete; ready for start up
2025/08/02 14:10:40 [notice] 1#1: using the "epoll" event method
2025/08/02 14:10:40 [notice] 1#1: nginx/1.29.0
2025/08/02 14:10:40 [notice] 1#1: built by gcc 12.2.0 (Debian 12.2.0-14+deb12u1)
2025/08/02 14:10:40 [notice] 1#1: OS: Linux 4.18.0-553.6.1.el8.x86_64
2025/08/02 14:10:40 [notice] 1#1: getrlimit(RLIMIT_NOFILE): 1024:1024
2025/08/02 14:10:40 [notice] 1#1: start worker processes
2025/08/02 14:10:40 [notice] 1#1: start worker process 22
2025/08/02 14:10:40 [notice] 1#1: start worker process 23
2025/08/02 14:10:40 [notice] 1#1: start worker process 24
2025/08/02 14:10:40 [notice] 1#1: start worker process 25

port

作用：显示宿主机和容器之间端口映射关系。 示例：

# 后台运行nginx容器，-p 8080:80将宿主机8080端口映射到容器80端口，–name指定容器名nginx
[root@localhost ~]# nerdctl container run –name nginx -d -p 8080:80 nginx
2d0923e9f7c816d9fc8f5fa30b1be332c90fff0e354c981b919fc67bd1f97101

# 查看nginx容器的端口映射关系
[root@localhost ~]# nerdctl container port nginx
80/tcp –> 0.0.0.0:8080

commit

作用：将容器提交为镜像。 示例：

# 将nginx容器提交(commit)为nginx_containerd镜像
[root@localhost ~]# nerdctl commit nginx nginx_containerd
sha256:6e60d18c9e7f7968f49edfacae16e39df2a995d3119b0b23356fd501cd8348a6

# 简写形式查看本地镜像列表
[root@localhost ~]# nerdctl images
REPOSITORY TAG IMAGE ID CREATED PLATFORM SIZE BLOB SIZE
nginx latest 84ec966e61a8 17 minutes ago linux/amd64 194.4 MiB 68.9 MiB
nginx_containerd latest d59a30a56f7f 3 seconds ago linux/amd64 194.4 MiB 68.9 MiB
ubuntu latest a08e551cb338 26 minutes ago linux/amd64 81.1 MiB 28.4 MiB

nerdctl 管理网络

Containerd 中的网络与Docker类似，所有网络接口默认都是虚拟接口。 当使用nerdctl创建容器时，nerdctl命令会创建一个名称为bridge的Linux网桥（其上有一个nerdctl0内部接口），利用了Linux虚拟网络技术，在本地主机和容器内分别创建一个虚拟接口，并让它们彼此连通（这样的一对接口叫做veth pair）。Containerd 默认指定了nerdctl0接口的IP地址和子网掩码，让主机和容器之间可以通过网桥相互通信。 示例

# 后台运行busybox容器，– sleep infinity让容器保持运行不退出
[root@localhost ~]# nerdctl run -d busybox — sleep infinity
b721795e02103578656152662f414e88f32191e64976ccafe60c4af10a8fa8c8

# 查看容器列表
[root@localhost ~]# nerdctl container ls
CONTAINER ID IMAGE COMMAND CREATED
STATUS PORTS NAMES
b721795e0210 docker.io/library/busybox:latest "sleep infinity" 12
seconds ago Up busybox-b7217

# 在busybox容器内执行ip a命令，查看容器内网卡信息
[root@localhost ~]# nerdctl exec busybox-b7217 — ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: eth0@if5: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1500 qdisc noqueue
link/ether f6:fc:0b:35:5e:2c brd ff:ff:ff:ff:ff:ff
inet 10.4.0.18/24 brd 10.4.0.255 scope global eth0
valid_lft forever preferred_lft forever
inet6 fe80::f4fc:bff:fe35:5e2c/64 scope link
valid_lft forever preferred_lft forever

[root@localhost ~]#

容器内看到的网卡名：2: eth0@if5 ，@if5代表对端是5号网卡。

# 查看宿主机网卡信息，与容器内网卡对比(veth pair成对出现)
[root@localhost ~]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default
qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: ens160: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group
default qlen 1000
link/ether 00:0c:29:a7:b8:a7 brd ff:ff:ff:ff:ff:ff
altname enp3s0
inet 192.168.108.30/24 brd 192.168.108.255 scope global noprefixroute ens160
valid_lft forever preferred_lft forever
inet6 fe80::20c:29ff:fea7:b8a7/64 scope link noprefixroute
valid_lft forever preferred_lft forever
3: nerdctl0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP
group default qlen 1000
link/ether 3a:1a:93:b7:ea:d7 brd ff:ff:ff:ff:ff:ff
inet 10.4.0.1/24 brd 10.4.0.255 scope global nerdctl0
valid_lft forever preferred_lft forever
inet6 fe80::381a:93ff:feb7:ead7/64 scope link
valid_lft forever preferred_lft forever
5: veth790d9140@if2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue
master nerdctl0 state UP group default
link/ether 3a:fa:0e:fd:27:5b brd ff:ff:ff:ff:ff:ff link-netnsid 0
inet6 fe80::38fa:eff:fefd:275b/64 scope link
valid_lft forever preferred_lft forever

对应容器主机的网卡：5: veth790d9140@if2 ，@if2 代表对端容器内对应2号网卡。 示例：

# 查看网络列表
[root@localhost ~]# nerdctl network ls
NETWORK ID NAME FILE
17f29b073143 bridge /etc/cni/net.d/nerdctl-bridge.conflist
host
none

# 查看bridge网络的详细信息(子网、网关等)
[root@localhost ~]# nerdctl network inspect bridge
[
{
"Name": "bridge",
"Id": "17f29b073143d8cd97b5bbe492bdeffec1c5fee55cc1fe2112c8b9335f8b6121",
"IPAM": {
"Config": [
{
"Subnet": "10.4.0.0/24",
"Gateway": "10.4.0.1"
}
]

# 查看nerdctl0网桥接口的IP地址，主机中nerdctl0是容器的网关
[root@localhost ~]# ip addr show nerdctl0
3: nerdctl0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP
group default qlen 1000
link/ether 3a:1a:93:b7:ea:d7 brd ff:ff:ff:ff:ff:ff
inet 10.4.0.1/24 brd 10.4.0.255 scope global nerdctl0
valid_lft forever preferred_lft forever

目前 Containerd 网桥是Linux网桥，用户可以使用brctl show 命令查看网桥和端口连接信息。

# 查看Linux网桥和端口连接信息
[root@localhost ~]# brctl show
bridge name bridge id STP enabled interfaces
nerdctl0 8000.3a1a93b7ead7 no veth790d9140

nerdctl network 命令使用帮助

# 查看nerdctl network网络管理命令帮助
[root@localhost ~]# nerdctl network –help
Manage networks
Usage: nerdctl network [flags]
Commands:
create Create a network
inspect Display detailed information on one or more networks
ls List networks
prune Remove all unused networks
rm Remove one or more networks
Flags:
-h, –help help for network
See also 'nerdctl –help' for the global flags such as '–namespace', '–
snapshotter', and '–cgroup-manager'.

nerdctl 管理存储

nerdctl volume 命令使用帮助

# 查看nerdctl volume卷管理命令帮助
[root@localhost ~]# nerdctl volume –help
Manage volumes
Usage: nerdctl volume [flags]
Commands:
create Create a volume
inspect Display detailed information on one or more volumes
ls List volumes
prune Remove all unused local volumes
rm Remove one or more volumes
Flags:
-h, –help help for volume
See also 'nerdctl –help' for the global flags such as '–namespace', '–
snapshotter', and '–cgroup-manager'.

nerdctl 命令创建容器的时候，可以使用 -v 选项将本地目录挂载给容器实现数据持久化。 示例：

# 创建/data目录，作为挂载源目录
[root@localhost ~]# mkdir /data
# 后台运行busybox容器，-v /data:/data将宿主机/data目录挂载到容器/data目录，实现数据持久化
[root@localhost ~]# nerdctl run -d -v /data:/data busybox — sleep infinity
d00a1646169a199e3038851f86b82bff03ac2db6ffd8ea3e875789d2a6d1a000

# 在宿主机/data目录创建f1文件
[root@localhost ~]# touch /data/f1
# 在容器内执行ls查看/data目录，确认f1文件同步到容器
[root@localhost ~]# nerdctl exec busybox-d00a1 — ls /data
f1

nerdctl 命令创建容器的时候，也可以使用 -v 选项指定volume。

# 后台运行busybox容器，-v /data只写容器目录，会自动生成匿名卷目录
[root@localhost ~]# nerdctl run -d -v /data busybox — sleep infinity
29c94622886a219c93b5f6cd1c1ab190f998c66e3b4cbce75437507803b82eea

# 在容器内创建f2文件(实际存储在宿主机匿名卷目录)
[root@localhost ~]# nerdctl exec busybox-29c94 — touch /data/f2
#在/var/lib/nerdctl/xx/volumes/default/xx/_data/f2

# 后台运行busybox容器，-v data:/data指定宿主机生成名为data的卷
[root@localhost ~]# nerdctl run -d -v data:/data busybox — sleep infinity
1b1fc00e88471a5abd8787bae438ab8d5ab08f4ec4fa073805407f9fffe2fe73

# 在容器内创建f3文件(存储在data卷中)
[root@localhost ~]# nerdctl exec busybox-1b1fc — touch /data/f3

# 生成data名字的卷
# 查看卷列表，确认data卷已生成
[root@localhost ~]# nerdctl volume ls
VOLUME NAME DIRECTORY
0c70033c26bcf456d9a0dc3f7dfe723f232e48dee2c8898bf987f8aeebacc1c7
/var/lib/nerdctl/1935db59/volumes/default/0c70033c26bcf456d9a0dc3f7dfe723f232e48d
ee2c8898bf987f8aeebacc1c7/_data
data
/var/lib/nerdctl/1935db59/volumes/default/data/_data

# 查看当前目录下的文件
[root@localhost ~]# ls
/var/lib/nerdctl/1935db59/volumes/default/0c70033c26bcf456d9a0dc3f7dfe723f232e48d
ee2c8898bf987f8aeebacc1c7/_data
f2

# 查看data卷目录内容，确认f3文件存在
[root@localhost ~]# ls /var/lib/nerdctl/1935db59/volumes/default/data/_data
f3

nerdctl 管理命名空间

示例：

# 查看nerdctl namespace命名空间命令帮助
[root@localhost ~]# nerdctl namespace
Unrelated to Linux namespaces and Kubernetes namespaces
Usage: nerdctl namespace [flags]
Aliases: namespace, ns
Commands:
create Create a new namespace
inspect Display detailed information on one or more namespaces.
ls List containerd namespaces
remove Remove one or more namespaces
update Update labels for a namespace
Flags:
-h, –help help for namespace
See also 'nerdctl –help' for the global flags such as '–namespace', '–
snapshotter', and '–cgroup-manager'.

# 查看命名空间列表
[root@localhost ~]# nerdctl namespace ls
NAME CONTAINERS IMAGES VOLUMES LABELS
default 10 4 2

八、crictl 实践

crictl 命令介绍

crictl 命令是遵循 CRI 接口规范的一个命令行工具，通常用它来检查和管理kubelet 节点上的容器运行时和镜像。 在kubernetes集群环境中，当我们执行kubectl 命令式，kubelet 代理会自动调用crictl命令管理镜像和容器。 手动执行 crictl 命令时，一般用于查看镜像和容器。

crictl 命令安装

配置kubernetes源：

# 编辑kubernetes的YUM源配置文件
[root@localhost ~]# vim /etc/yum.repos.d/kubernetes.repo
[kubernetes]
name=Kubernetes
baseurl=https://mirrors.aliyun.com/kubernetes-new/core/stable/v1.30/rpm/
enabled=1
gpgcheck=1
gpgkey=https://mirrors.aliyun.com/kubernetes-new/core/stable/v1.30/rpm/repodata/repomd.xml.key

安装CRI命令

# 安装cri-tools软件包(提供crictl命令)
[root@localhost ~]# yum install -y cri-tools

crictl 命令配置 使用crictl 命令之前，需要先配置/etc/crictl.yaml 。 示例：配置crictl后端运行时使用containerd。

# 编辑crictl配置文件，配置后端运行时为containerd
[root@localhost ~]# vim /etc/crictl.yaml
runtime-endpoint: unix:///run/containerd/containerd.sock
image-endpoint: unix:///run/containerd/containerd.sock
timeout: 5
debug: false

也可以通过命令进行设置：

# 查看crictl的runtime-endpoint运行时端点配置
[root@localhost ~]# crictl config runtime-endpoint
unix:///run/containerd/containerd.sock

# 查看crictl的image-endpoint镜像端点配置
[root@localhost ~]# crictl config image-endpoint
unix:///run/containerd/containerd.sock

更多命令操作，可以直接在命令行输入命令查看帮助。

# 查看crictl config命令的帮助
[root@localhost ~]# crictl config –help
NAME:
crictl config – Get and set crictl client configuration options
USAGE:
crictl config [command options] [<crictl options>]
EXAMPLE:
crictl config –set debug=true
CRICTL OPTIONS:
runtime-endpoint: Container runtime endpoint
image-endpoint: Image endpoint
timeout: Timeout of connecting to server (default: 2s)
debug: Enable debug output (default: false)
pull-image-on-create: Enable pulling image on create requests (default:
false)
disable-pull-on-run: Disable pulling image on run requests (default: false)

OPTIONS:
–get value show the option value
–list show all option value (default: false)
–set value [ –set value ] set option (can specify multiple or separate
values with commas: opt1=val1,opt2=val2)
–help, -h show help

crictl 命令实践

帮助信息

# 直接输入crictl命令查看帮助信息
[root@localhost ~]# crictl
NAME:
crictl – client for CRI
USAGE:
crictl [global options] command [command options]
VERSION:
v1.30.1
COMMANDS:
attach Attach to a running container
create Create a new container
exec Run a command in a running container
version Display runtime version information
images, image, img List images
inspect Display the status of one or more containers
inspecti Return the status of one or more images
imagefsinfo Return image filesystem info
inspectp Display the status of one or more pods
logs Fetch the logs of a container
port-forward Forward local port to a pod
ps List containers
pull Pull an image from a registry
run Run a new container inside a sandbox
runp Run a new pod
rm Remove one or more containers
rmi Remove one or more images
rmp Remove one or more pods
pods List pods
start Start one or more created containers
info Display information of the container runtime
stop Stop one or more running containers
stopp Stop one or more running pods
update Update one or more running containers
config Get and set crictl client configuration options
stats List container(s) resource usage statistics
statsp List pod statistics. Stats represent a structured API that
will fulfill the Kubelet's /stats/summary endpoint.
metricsp List pod metrics. Metrics are unstructured key/value pairs
gathered by CRI meant to replace cAdvisor's /metrics/cadvisor endpoint.

completion Output shell completion code
checkpoint Checkpoint one or more running containers
runtime-config Retrieve the container runtime configuration
events, event Stream the events of containers
help, h Shows a list of commands or help for one command
GLOBAL OPTIONS:
–config value, -c value Location of the client config file.
If not specified and the default does not exist, the program's directory is
searched as well (default: "/etc/crictl.yaml") [$CRI_CONFIG_FILE]
–debug, -D Enable debug mode (default: false)
–enable-tracing Enable OpenTelemetry tracing.
(default: false)
–image-endpoint value, -i value Endpoint of CRI image manager
service (default: uses 'runtime-endpoint' setting) [$IMAGE_SERVICE_ENDPOINT]
–runtime-endpoint value, -r value Endpoint of CRI container runtime
service (default: uses in order the first successful one of
[unix:///run/containerd/containerd.sock unix:///run/crio/crio.sock
unix:///var/run/cri-dockerd.sock]). Default is now deprecated and the endpoint
should be set instead. [$CONTAINER_RUNTIME_ENDPOINT]
–timeout value, -t value Timeout of connecting to the server
in seconds (e.g. 2s, 20s.). 0 or less is set to default (default: 2s)
–tracing-endpoint value Address to which the gRPC tracing
collector will send spans to. (default: "127.0.0.1:4317")
–tracing-sampling-rate-per-million value Number of samples to collect per
million OpenTelemetry spans. Set to 1000000 or -1 to always sample. (default: -1)
–help, -h show help
–version, -v print the version

案列

# 使用crictl拉取nginx镜像
[root@localhost ~]# crictl pull 054b8ac70e8010d90f2ac00ef29e6580.mirror.swr.myhuaweicloud.com/library/nginx:latest
Image is up to date for
sha256:9f33606b36859ee2db3b761a893fb7c2fc8a13c0fe5f24e304b129f3caf499ad

# 使用crictl查看镜像列表
[root@localhost ~]# crictl images
IMAGE TAG IMAGE ID SIZE
docker.io/library/httpd latest 65005131d37e9 45.2MB

镜像命令

• images, image, img List images
• pull Pull an image from a registry
• inspecti Return the status of one or more images
• imagefsinfo Return image filesystem info
• rmi Remove one or more images

容器命令

• ps List containers
• create Create a new container
• run Run a new container inside a sandbox
• inspect Display the status of one or more containers
• info Display information of the container runtime
• attach Attach to a running container
• exec Run a command in a running container
• logs Fetch the logs of a container
• update Update one or more running containers
• stats List container(s) resource usage statistics
• checkpoint Checkpoint one or more running containers
• start Start one or more created containers
• stop Stop one or more running containers
• rm Remove one or more containers

pod命令

• pods List pods
• runp Run a new pod
• inspectp Display the status of one or more pods
• statsp List pod resource usage statistics
• port-forward Forward local port to a pod
• stopp Stop one or more running pods
• rmp Remove one or more pods

其他命令

• version Display runtime version information
• config Get and set crictl client configuration options
• completion Output shell completion code
• help, h Shows a list of commands or help for one command

命令行对照表

如果您还对Docker比较怀旧的话，执行“alias docker=nerdctl”这样的命令后，您依然可以体验到与Docker相似的感觉。 nerdctl 和crictl 都是用于管理和操作容器的命令行工具，但是它们在开发者、设计目的和功能上有所不同。 1. nerdctl：

• 开发者：由Docker的创始人之一，也是containerd项目的主要贡献者Akihiro Suda开发。
• 设计目的：nerdctl是一个兼容Docker CLI的containerd CLI，意味着大部分Docker命令可以在nerdctl中运行。
• 功能：它可以管理容器的生命周期，如创建、运行、停止和删除容器。此外，它还支持镜像管理，网络管理，卷管理等。 2. crictl：
• 开发者：由Kubernetes项目社区开发。
• 设计目的：crictl是一个命令行接口，用于与任何实现了Kubernetes容器运行时接口(CRI)的容器运行时进行交互，例如containerd，CRI-O等。
• 功能：它主要用于调试，可以从Kubernetes API Server的角度检查和理解容器运行时的行为。它允许用户直接与容器运行时进行交互，实现容器生命周期管理，镜像管理等。 总的来说，二者主要区别在于他们的使用场景和目标用户并不完全相同。nerdctl更适合需要Docker CLI兼容性的用户，而crictl则更适合需要调试和理解Kubernetes CRI容器运行时行为的用户。