2. 首页 > 软件安装教程 > 正文

CRI-O安装配置-CRI-O容器安装配置_升级迁移详细过程

教程整理：风哥教程  |  更新时间：2026-01-03  |  教程分类：软件安装教程  |  文档学习：6

1. CRI-O概述与环境规划

CRI-O是一个轻量级的容器运行时，专为Kubernetes设计，实现了Kubernetes的容器运行时接口（CRI）。CRI-O提供了与Docker兼容的容器管理功能，但更加轻量级，适合在Kubernetes集群中使用。更多学习教程www.fgedu.net.cn

1.1 CRI-O版本说明

CRI-O目前主要版本为1.28.x系列，本教程以CRI-O 1.28.3为例进行详细讲解。CRI-O 1.28.x版本相比之前版本在性能、稳定性和功能方面都有显著提升，支持更多的容器管理特性。

# 查看CRI-O版本
$ crio –version
crio version 1.28.3
Version: 1.28.3
GitCommit: 1234567890abcdef1234567890abcdef12345678
GitTreeState: clean
BuildDate: 2024-04-01T00:00:00Z
GoVersion: go1.20.13
Compiler: gc
Platform: linux/amd64
Linkmode: dynamic
BuildTags: containers_image_ostree_stub, containers_image_openpgp, seccomp
SeccompEnabled: true
AppArmorEnabled: false

# 查看系统版本
$ cat /etc/os-release
NAME=”Oracle Linux Server”
VERSION=”8.9″
ID=”ol”
PRETTY_NAME=”Oracle Linux Server 8.9″

# 查看内核版本
$ uname -r
5.4.17-2136.302.7.2.el8uek.x86_64

1.2 环境规划

本次安装环境规划如下：

CRI-O服务器：
crio01.fgedu.net.cn (192.168.1.51) – CRI-O主机

CRI-O版本：1.28.3
操作系统：Oracle Linux 8.9
安装目录：/usr/bin/crio
配置目录：/etc/crio
存储目录：/var/lib/containers
镜像仓库：docker.io, quay.io
网络模式：bridge, host, none

2. 硬件环境要求

CRI-O作为容器运行时，对硬件资源要求相对较低，但需要考虑运行容器的数量和资源需求。学习交流加群风哥微信: itpux-com

2.1 物理主机环境要求

# 检查内存大小
# free -h
total used free shared buff/cache available
Mem: 16G 4.2G 10G 256M 1.8G 11G
Swap: 8G 0B 8G

# 检查磁盘空间
# df -h
Filesystem Size Used Avail Use% Mounted on
/dev/sda1 50G 12G 39G 24% /
/dev/sdb1 500G 50G 451G 10% /data
/dev/sdc1 200G 20G 181G 10% /backup

# 检查CPU核心数
# nproc
8

# 检查系统架构
# uname -m
x86_64

# 检查内核版本
# uname -r
5.4.17-2136.302.7.2.el8uek.x86_64

生产环境建议：最小内存4GB（测试环境），生产环境建议8GB以上。磁盘空间根据容器镜像和数据大小规划，建议至少100GB。CPU核心数建议4核以上，以支持并发容器运行。

2.2 vSphere虚拟主机环境要求

虚拟机配置：
– vCPU：4核
– 内存：8GB
– 磁盘：系统盘50GB + 数据盘200GB
– 网络：VMXNET3网卡，千兆网络
– 存储：建议使用SSD存储以提高I/O性能

资源池配置：
– CPU预留：2GHz
– 内存预留：4GB
– 内存限制：8GB
– CPU份额：正常
– 内存份额：正常

2.3 云平台主机环境要求

云主机规格（阿里云/腾讯云/华为云）：
– 实例规格：ecs.g6.xlarge或同等规格
– vCPU：4核
– 内存：16GB
– 系统盘：高效云盘 100GB
– 数据盘：SSD云盘 200GB
– 网络带宽：5Mbps以上

存储配置：
– OSS对象存储：用于存储容器镜像
– NAS文件存储：用于共享数据卷
– 云盘快照：定期备份容器数据

3. 操作系统环境准备

在安装CRI-O之前，需要对操作系统进行必要的配置和优化。

3.1 操作系统版本检查

# 检查操作系统版本
# cat /etc/os-release
NAME=”Oracle Linux Server”
VERSION=”8.9″
ID=”ol”
PRETTY_NAME=”Oracle Linux Server 8.9″

# 检查内核版本
# uname -r
5.4.17-2136.302.7.2.el8uek.x86_64

# 检查SELinux状态
# getenforce
Enforcing

# 检查防火墙状态
# systemctl status firewalld
● firewalld.service – firewalld – dynamic firewall daemon
Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor preset: enabled)
Active: active (running)

3.2 内核参数优化

# 编辑sysctl.conf文件
# vi /etc/sysctl.conf

# 添加以下内核参数
fs.file-max = 6815744
kernel.sem = 250 32000 100 128
kernel.shmmni = 4096
kernel.shmall = 4294967296
kernel.shmmax = 68719476736
net.ipv4.ip_local_port_range = 9000 65500
net.core.rmem_default = 262144
net.core.rmem_max = 4194304
net.core.wmem_default = 262144
net.core.wmem_max = 1048576
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_fin_timeout = 30
net.ipv4.tcp_keepalive_time = 1200
net.ipv4.tcp_max_syn_backlog = 8192
net.core.somaxconn = 1024
vm.swappiness = 10
vm.dirty_ratio = 15
vm.dirty_background_ratio = 5

# 容器相关内核参数
net.ipv4.ip_forward = 1
net.bridge.bridge-nf-call-iptables = 1
net.bridge.bridge-nf-call-ip6tables = 1

# 使内核参数生效
# sysctl -p

# 验证参数设置
# sysctl -a | grep fs.file-max
fs.file-max = 6815744

3.3 用户资源限制配置

# 配置用户资源限制
# vi /etc/security/limits.conf

# 添加以下内容
* soft nproc 65535
* hard nproc 65535
* soft nofile 65535
* hard nofile 65535
* soft stack 10240
* hard stack 32768

# 验证配置
# ulimit -a
core file size (blocks, -c) 0
data seg size (kbytes, -d) unlimited
scheduling priority (-e) 0
file size (blocks, -f) unlimited
pending signals (-i) 63499
max locked memory (kbytes, -l) 64
max memory size (kbytes, -m) unlimited
open files (-n) 65535
pipe size (512 bytes, -p) 8
POSIX message queues (bytes, -q) 819200
real-time priority (-r) 0
stack size (kbytes, -s) 10240
cpu time (seconds, -t) unlimited
max user processes (-u) 65535
virtual memory (kbytes, -v) unlimited

3.4 依赖包安装

# 安装必要的依赖包
# yum install -y curl wget yum-utils device-mapper-persistent-data lvm2

# 安装容器相关依赖
# yum install -y runc libseccomp containernetworking-plugins

# 验证依赖安装
# rpm -qa | grep -E “runc|libseccomp|containernetworking”
runc-1.1.7-1.module+el8.9.0+20474+e4e7624c.x86_64
libseccomp-2.5.2-1.el8.x86_64
containernetworking-plugins-1.1.1-3.module+el8.9.0+20474+e4e7624c.x86_64

4. CRI-O安装配置

完成环境准备后，开始安装CRI-O。

4.1 安装CRI-O

# 配置CRI-O仓库
# vi /etc/yum.repos.d/cri-o.repo

[cri-o]
name=CRI-O
baseurl=https://pkgs.k8s.io/addons:/cri-o:/stable:/v1.28/rpm/
enabled=1
gpgcheck=1
gpgkey=https://pkgs.k8s.io/addons:/cri-o:/stable:/v1.28/rpm/repodata/repomd.xml.key

# 安装CRI-O
# yum install -y cri-o

# 验证安装
# crio –version
crio version 1.28.3
Version: 1.28.3
GitCommit: 1234567890abcdef1234567890abcdef12345678
GitTreeState: clean
BuildDate: 2024-04-01T00:00:00Z
GoVersion: go1.20.13
Compiler: gc
Platform: linux/amd64
Linkmode: dynamic
BuildTags: containers_image_ostree_stub, containers_image_openpgp, seccomp
SeccompEnabled: true
AppArmorEnabled: false

# 查看CRI-O信息
# crio status
Version: 1.28.3
RuntimeName: runc
RuntimeVersion: 1.1.7
RuntimeApiVersion: v1

4.2 配置CRI-O

# 编辑CRI-O配置文件
# vi /etc/crio/crio.conf

# 基本配置
[crio]
root = “/var/lib/containers/storage”
runroot = “/run/containers/storage”
storage_driver = “overlay”

# 运行时配置
[crio.runtime]
runtime = “runc”
runtime_root = “/run/runc”

# 镜像仓库配置
[crio.image]
registries = [“docker.io”, “quay.io”]

# 网络配置
[crio.network]
network_dir = “/etc/cni/net.d”
plugin_dirs = [“/opt/cni/bin”]

# 验证配置
# cat /etc/crio/crio.conf | grep -v “^#” | grep -v “^$”

4.3 启动CRI-O服务

# 启动CRI-O服务
# systemctl start crio
# systemctl enable crio

# 验证服务状态
# systemctl status crio
● crio.service – Container Runtime Interface for OCI (CRI-O)
Loaded: loaded (/usr/lib/systemd/system/crio.service; enabled; vendor preset: disabled)
Active: active (running) since Fri 2024-04-05 10:00:00 CST; 1min ago
Docs: https://github.com/cri-o/cri-o
Main PID: 12345 (crio)
Tasks: 10
Memory: 100.0M
CGroup: /system.slice/crio.service
└─12345 /usr/bin/crio

# 验证CRI-O socket
# ls -la /run/crio/crio.sock
.srw-rw—- 1 root root 0 Apr 5 10:00 /run/crio/crio.sock

4.4 配置CNI网络

# 创建CNI配置目录
# mkdir -p /etc/cni/net.d

# 创建CNI配置文件
# vi /etc/cni/net.d/10-crio-bridge.conf

{
“cniVersion”: “0.4.0”,
“name”: “crio-bridge”,
“type”: “bridge”,
“bridge”: “cni0”,
“isGateway”: true,
“ipMasq”: true,
“ipam”: {
“type”: “host-local”,
“subnet”: “10.88.0.0/16”,
“routes”: [
{
“dst”: “0.0.0.0/0”
}
]
}
}

# 验证CNI配置
# cat /etc/cni/net.d/10-crio-bridge.conf

5. CRI-O配置优化

为了提高CRI-O的性能和稳定性，需要进行一些配置优化。

5.1 存储配置优化

# 编辑CRI-O配置
# vi /etc/crio/crio.conf

# 存储配置
[crio]
root = “/var/lib/containers/storage”
runroot = “/run/containers/storage”
storage_driver = “overlay”
storage_option = [“overlay.mountopt=nodev,metacopy=off”]

# 验证配置
# cat /etc/crio/crio.conf | grep -A 10 “storage”

5.2 运行时配置优化

# 编辑CRI-O配置
# vi /etc/crio/crio.conf

# 运行时配置
[crio.runtime]
runtime = “runc”
runtime_root = “/run/runc”
runtime_config_path = “/etc/crio/crio.json”
default_runtime = “runc”

# 验证配置
# cat /etc/crio/crio.conf | grep -A 10 “runtime”

5.3 镜像仓库配置优化

# 编辑CRI-O配置
# vi /etc/crio/crio.conf

# 镜像仓库配置
[crio.image]
registries = [“docker.io”, “quay.io”, “registry.access.redhat.com”]
insecure_registries = [“localhost:5000”]

# 验证配置
# cat /etc/crio/crio.conf | grep -A 10 “image”

5.4 重启CRI-O服务

# 重启CRI-O服务
# systemctl restart crio

# 验证服务状态
# systemctl status crio
● crio.service – Container Runtime Interface for OCI (CRI-O)
Loaded: loaded (/usr/lib/systemd/system/crio.service; enabled; vendor preset: disabled)
Active: active (running) since Fri 2024-04-05 10:00:00 CST; 1min ago
Docs: https://github.com/cri-o/cri-o
Main PID: 12345 (crio)
Tasks: 10
Memory: 100.0M
CGroup: /system.slice/crio.service
└─12345 /usr/bin/crio

# 验证配置生效
# crio status

6. CRI-O容器管理

本节介绍CRI-O容器的基本管理操作。

6.1 拉取镜像

# 安装crictl工具
# yum install -y cri-tools

# 配置crictl
# vi /etc/crictl.yaml
runtime-endpoint: unix:///run/crio/crio.sock
image-endpoint: unix:///run/crio/crio.sock
timeout: 10
debug: false

# 拉取Ubuntu镜像
# crictl pull docker.io/library/ubuntu:22.04

# 拉取Nginx镜像
# crictl pull docker.io/library/nginx:latest

# 拉取MySQL镜像
# crictl pull docker.io/library/mysql:8.0

# 查看镜像
# crictl images
IMAGE TAG IMAGE ID SIZE
docker.io/library/ubuntu 22.04 1234567890abcdef 70MB
docker.io/library/nginx latest 9876543210abcdef 140MB
docker.io/library/mysql 8.0 abcdef1234567890 500MB

6.2 运行容器

# 创建容器配置文件
# vi container-config.json
{
“metadata”: {
“name”: “ubuntu-test”
},
“spec”: {
“containers”: [
{
“name”: “ubuntu-test”,
“image”: “docker.io/library/ubuntu:22.04”,
“command”: [“/bin/bash”, “-c”, “sleep 3600”],
“resources”: {
“limits”: {
“cpu”: “500m”,
“memory”: “512Mi”
}
}
}
]
}
}

# 创建Pod配置文件
# vi pod-config.json
{
“metadata”: {
“name”: “ubuntu-pod”
},
“spec”: {
“containers”: [
{
“name”: “ubuntu-test”,
“image”: “docker.io/library/ubuntu:22.04”,
“command”: [“/bin/bash”, “-c”, “sleep 3600”]
}
]
}
}

# 运行容器
# crictl run container-config.json pod-config.json

# 查看运行中的容器
# crictl ps
CONTAINER IMAGE CREATED STATE NAME ATTEMPT POD ID
1234567890abcdef docker.io/library/ubuntu:22.04 1 minute ago Running ubuntu-test 1 abcdef1234567890

6.3 管理容器

# 停止容器
# crictl stop 1234567890abcdef

# 启动容器
# crictl start 1234567890abcdef

# 删除容器
# crictl rm 1234567890abcdef

# 查看所有容器
# crictl ps -a
CONTAINER IMAGE CREATED STATE NAME ATTEMPT POD ID
1234567890abcdef docker.io/library/ubuntu:22.04 1 minute ago Exited ubuntu-test 1 abcdef1234567890

6.4 容器监控

# 查看容器状态
# crictl inspect 1234567890abcdef

# 查看容器日志
# crictl logs 1234567890abcdef

# 进入容器
# crictl exec -it 1234567890abcdef /bin/bash

# 查看容器内进程
# crictl ps 1234567890abcdef

7. CRI-O网络配置

CRI-O使用CNI（Container Network Interface）来管理容器网络。

7.1 CNI网络配置

# 创建CNI配置文件
# vi /etc/cni/net.d/10-crio-bridge.conf

{
“cniVersion”: “0.4.0”,
“name”: “crio-bridge”,
“type”: “bridge”,
“bridge”: “cni0”,
“isGateway”: true,
“ipMasq”: true,
“mtu”: 1450,
“ipam”: {
“type”: “host-local”,
“subnet”: “10.88.0.0/16”,
“routes”: [
{
“dst”: “0.0.0.0/0”
}
]
}
}

# 验证CNI配置
# cat /etc/cni/net.d/10-crio-bridge.conf

7.2 网络故障排查

# 检查网络接口
# ip addr show cni0

# 检查网络路由
# ip route show

# 测试容器网络连接
# crictl exec -it 1234567890abcdef ping -c 4 www.baidu.com

# 检查防火墙规则
# firewall-cmd –list-all

# 允许容器网络流量
# firewall-cmd –add-masquerade –permanent
# firewall-cmd –reload

8. CRI-O存储配置

CRI-O使用存储驱动来管理容器的文件系统，支持多种存储驱动。

8.1 存储驱动配置

# 查看存储驱动
# crio status | grep “Storage”
Storage Driver: overlay

# 编辑CRI-O配置
# vi /etc/crio/crio.conf

# 存储配置
[crio]
root = “/var/lib/containers/storage”
runroot = “/run/containers/storage”
storage_driver = “overlay”
storage_option = [“overlay.mountopt=nodev,metacopy=off”]

# 验证存储配置
# cat /etc/crio/crio.conf | grep -A 5 “storage”

8.2 存储优化

# 清理未使用的镜像
# crictl rmi –prune

# 清理未使用的容器
# crictl rm –prune

# 查看存储使用情况
# du -sh /var/lib/containers/
1.2G /var/lib/containers/

9. CRI-O性能优化

在生产环境中，需要对CRI-O进行性能优化以提高容器运行效率。from:www.itpux.com

9.1 内存优化

# 编辑CRI-O配置
# vi /etc/crio/crio.conf

# 内存配置
[crio.runtime]
runtime = “runc”
runtime_root = “/run/runc”
runtime_config_path = “/etc/crio/crio.json”

# 编辑运行时配置
# vi /etc/crio/crio.json
{
“default_runtime”: “runc”,
“runtimes”: {
“runc”: {
“runtimeType”: “oci”,
“runtimePath”: “/usr/bin/runc”,
“runtimeArgs”: [
“–systemd-cgroup”
]
}
}
}

# 重启CRI-O服务
# systemctl restart crio

9.2 镜像优化

# 拉取轻量级镜像
# crictl pull docker.io/library/alpine:latest

# 构建优化的Dockerfile
# vi Dockerfile
FROM alpine:latest
RUN apk add –no-cache nginx
EXPOSE 80
CMD [“nginx”, “-g”, “daemon off;”]

# 使用buildah构建镜像
# buildah build -t localhost/fgedu/nginx:alpine .

# 查看镜像大小
# crictl images | grep fgedu/nginx
IMAGE TAG IMAGE ID SIZE
localhost/fgedu/nginx alpine 1234567890abcdef 15MB

9.3 网络优化

# 编辑CNI配置
# vi /etc/cni/net.d/10-crio-bridge.conf

{
“cniVersion”: “0.4.0”,
“name”: “crio-bridge”,
“type”: “bridge”,
“bridge”: “cni0”,
“isGateway”: true,
“ipMasq”: true,
“mtu”: 1450,
“ipam”: {
“type”: “host-local”,
“subnet”: “10.88.0.0/16”,
“routes”: [
{
“dst”: “0.0.0.0/0”
}
]
}
}

# 重启CRI-O服务
# systemctl restart crio

9.4 存储优化

# 编辑CRI-O配置
# vi /etc/crio/crio.conf

# 存储配置
[crio]
root = “/var/lib/containers/storage”
runroot = “/run/containers/storage”
storage_driver = “overlay”
storage_option = [“overlay.mountopt=nodev,metacopy=off”]

# 重启CRI-O服务
# systemctl restart crio

# 清理存储
# crictl rmi –prune
# crictl rm –prune

生产环境建议：根据服务器硬件配置和容器数量调整CRI-O的资源限制和配置。使用轻量级镜像，合理配置网络和存储，定期清理未使用的资源以提高性能。

10. CRI-O升级迁移

本节介绍CRI-O的版本升级和数据迁移方法。

10.1 CRI-O版本升级

# 备份当前CRI-O配置
# cp -r /etc/crio /backup/crio_$(date +%Y%m%d)

# 停止CRI-O服务
# systemctl stop crio

# 升级CRI-O
# yum update -y cri-o

# 启动CRI-O服务
# systemctl start crio

# 验证升级
# crio –version
crio version 1.28.3

# 验证服务状态
# systemctl status crio

10.2 CRI-O配置迁移

# 导出CRI-O配置
# cp -r /etc/crio /backup/crio_export

# 在新服务器上导入配置
# cp -r /backup/crio_export /etc/crio

# 启动CRI-O服务
# systemctl start crio

# 验证配置
# crio –version

11. CRI-O备份恢复

本节介绍CRI-O的备份和恢复方法。

11.1 CRI-O容器备份

# 备份镜像
# for image in $(crictl images -q); do crictl pull $image; done

# 备份配置
# cp -r /etc/crio /backup/crio_$(date +%Y%m%d)

# 备份CNI配置
# cp -r /etc/cni /backup/cni_$(date +%Y%m%d)

11.2 CRI-O容器恢复

# 恢复配置
# cp -r /backup/crio_20240405 /etc/crio

# 恢复CNI配置
# cp -r /backup/cni_20240405 /etc/cni

# 启动CRI-O服务
# systemctl start crio

# 验证恢复
# crio status

11.3 CRI-O监控脚本

# 创建CRI-O监控脚本
# vi /data/crio/scripts/crio_monitor.sh

#!/bin/bash
LOG_FILE=”/var/log/crio_monitor.log”
ALERT_EMAIL=”admin@fgedu.net.cn”

check_crio_status() {
echo “$(date): Checking crio status…” >> $LOG_FILE
status=$(systemctl status crio | grep -o “Active: active”)
if [ “$status” = “Active: active” ]; then
echo “$(date): CRI-O status: OK” >> $LOG_FILE
else
echo “$(date): CRI-O status: FAILED” >> $LOG_FILE
echo “CRI-O service failed” | mail -s “CRI-O Alert” $ALERT_EMAIL
fi
}

check_container_status() {
echo “$(date): Checking container status…” >> $LOG_FILE
containers=$(crictl ps -q | wc -l)
echo “$(date): Running containers: $containers” >> $LOG_FILE
if [ “$containers” -eq 0 ]; then
echo “$(date): No containers running” >> $LOG_FILE
echo “No containers running” | mail -s “CRI-O Alert” $ALERT_EMAIL
fi
}

check_storage_usage() {
echo “$(date): Checking storage usage…” >> $LOG_FILE
usage=$(du -sh /var/lib/containers/ | awk ‘{print $1}’)
echo “$(date): Storage usage: $usage” >> $LOG_FILE
if [[ “$usage” == *”G”* ]]; then
size=$(echo $usage | sed ‘s/G//’)
if (( $(echo “$size > 50” | bc -l) )); then
echo “$(date): Storage usage too high: $usage” >> $LOG_FILE
echo “Storage usage too high: $usage” | mail -s “CRI-O Alert” $ALERT_EMAIL
fi
fi
}

main() {
check_crio_status
check_container_status
check_storage_usage
}

main

# 添加执行权限
# chmod +x /data/crio/scripts/crio_monitor.sh

# 添加定时任务
# crontab -e
*/15 * * * * /data/crio/scripts/crio_monitor.sh

生产环境建议：定期备份CRI-O容器和镜像，建议每天执行一次完整备份。监控脚本建议每15分钟执行一次，及时发现并处理问题。恢复操作前务必停止CRI-O服务，避免数据不一致。

通过以上步骤，CRI-O安装配置、性能优化、升级迁移、备份恢复等内容已全部完成。CRI-O作为轻量级的容器运行时，能够高效地管理和运行容器，是Kubernetes集群中理想的容器运行时选择。

本文由风哥教程整理发布,仅用于学习测试使用,转载注明出处:http://www.fgedu.net.cn/10327.html

相关推荐

联系我们

在线咨询：点击这里给我发消息

微信号：itpux-com

工作日：9:30-18:30，节假日休息