github.com/SagerNet/gvisor@v0.0.0-20210707092255-7731c139d75c/g3doc/user_guide/containerd/containerd_11.md (about)

     1  # Older Versions (containerd 1.1)
     2  
     3  **WARNING: containerd 1.1 and shim v1 is no longer supported. The instructions
     4  below is kept just for reference in case you're dealing with an old version.
     5  It's highly recommended upgrading to the latest version.**
     6  
     7  This document describes how to install and run the `gvisor-containerd-shim`
     8  using the untrusted workload CRI extension. This requires `containerd` 1.1 or
     9  later.
    10  
    11  *Note: The untrusted workload CRI extension is deprecated by containerd and
    12  `gvisor-containerd-shim` is maintained on a best-effort basis. If you are using
    13  containerd 1.2+, please see the
    14  [containerd 1.2+ documentation](./quick_start.md) and use
    15  `containerd-shim-runsc-v1`.*
    16  
    17  ## Requirements
    18  
    19  -   **runsc** and **gvisor-containerd-shim**: See the
    20      [installation guide](/docs/user_guide/install/).
    21  -   **containerd**: See the [containerd website](https://containerd.io/) for
    22      information on how to install containerd.
    23  
    24  ## Configure containerd
    25  
    26  Create the configuration for the gvisor shim in
    27  `/etc/containerd/gvisor-containerd-shim.toml`:
    28  
    29  ```shell
    30  cat <<EOF | sudo tee /etc/containerd/gvisor-containerd-shim.toml
    31  # This is the path to the default runc containerd-shim.
    32  runc_shim = "/usr/local/bin/containerd-shim"
    33  EOF
    34  ```
    35  
    36  Update `/etc/containerd/config.toml`. Be sure to update the path to
    37  `gvisor-containerd-shim` and `runsc` if necessary:
    38  
    39  ```shell
    40  cat <<EOF | sudo tee /etc/containerd/config.toml
    41  disabled_plugins = ["restart"]
    42  [plugins.linux]
    43    shim = "/usr/local/bin/gvisor-containerd-shim"
    44    shim_debug = true
    45  [plugins.cri.containerd.untrusted_workload_runtime]
    46    runtime_type = "io.containerd.runtime.v1.linux"
    47    runtime_engine = "/usr/local/bin/runsc"
    48    runtime_root = "/run/containerd/runsc"
    49  EOF
    50  ```
    51  
    52  Restart `containerd`:
    53  
    54  ```shell
    55  sudo systemctl restart containerd
    56  ```
    57  
    58  ## Usage
    59  
    60  You can run containers in gVisor via containerd's CRI.
    61  
    62  ### Install crictl
    63  
    64  Download and install the `crictl` binary:
    65  
    66  ```shell
    67  {
    68  wget https://github.com/kubernetes-sigs/cri-tools/releases/download/v1.13.0/crictl-v1.13.0-linux-amd64.tar.gz
    69  tar xf crictl-v1.13.0-linux-amd64.tar.gz
    70  sudo mv crictl /usr/local/bin
    71  }
    72  ```
    73  
    74  Write the `crictl` configuration file:
    75  
    76  ```shell
    77  cat <<EOF | sudo tee /etc/crictl.yaml
    78  runtime-endpoint: unix:///run/containerd/containerd.sock
    79  EOF
    80  ```
    81  
    82  ### Create the nginx Sandbox in gVisor
    83  
    84  Pull the nginx image:
    85  
    86  ```shell
    87  sudo crictl pull nginx
    88  ```
    89  
    90  Create the sandbox creation request:
    91  
    92  ```shell
    93  cat <<EOF | tee sandbox.json
    94  {
    95      "metadata": {
    96          "name": "nginx-sandbox",
    97          "namespace": "default",
    98          "attempt": 1,
    99          "uid": "hdishd83djaidwnduwk28bcsb"
   100      },
   101      "annotations": {
   102        "io.kubernetes.cri.untrusted-workload": "true"
   103      },
   104      "linux": {
   105      },
   106      "log_directory": "/tmp"
   107  }
   108  EOF
   109  ```
   110  
   111  Create the pod in gVisor:
   112  
   113  ```shell
   114  SANDBOX_ID=$(sudo crictl runp sandbox.json)
   115  ```
   116  
   117  ### Run the nginx Container in the Sandbox
   118  
   119  Create the nginx container creation request:
   120  
   121  ```shell
   122  cat <<EOF | tee container.json
   123  {
   124    "metadata": {
   125        "name": "nginx"
   126      },
   127    "image":{
   128        "image": "nginx"
   129      },
   130    "log_path":"nginx.0.log",
   131    "linux": {
   132    }
   133  }
   134  EOF
   135  ```
   136  
   137  Create the nginx container:
   138  
   139  ```shell
   140  CONTAINER_ID=$(sudo crictl create ${SANDBOX_ID} container.json sandbox.json)
   141  ```
   142  
   143  Start the nginx container:
   144  
   145  ```shell
   146  sudo crictl start ${CONTAINER_ID}
   147  ```
   148  
   149  ### Validate the container
   150  
   151  Inspect the created pod:
   152  
   153  ```shell
   154  sudo crictl inspectp ${SANDBOX_ID}
   155  ```
   156  
   157  Inspect the nginx container:
   158  
   159  ```shell
   160  sudo crictl inspect ${CONTAINER_ID}
   161  ```
   162  
   163  Verify that nginx is running in gVisor:
   164  
   165  ```shell
   166  sudo crictl exec ${CONTAINER_ID} dmesg | grep -i gvisor
   167  ```