1. Toy模板网首页
  2. > Toy博客

基于nerdctl+buildkitd+containerd实现镜像构建

9月前 作者：Linux-1874 分类：Toy博客 阅读(33) 违法举报

这篇具有很好参考价值的文章主要介绍了基于nerdctl+buildkitd+containerd实现镜像构建。希望对大家有所帮助。如果存在错误或未考虑完全的地方，请大家不吝赐教，您也可以点击"举报违法"按钮提交疑问。

1、容器技术简介

容器技术除了的docker之外，还有coreOS的rkt、google的gvisor、以及docker开源的containerd、redhat的podman、阿⾥的pouch等，为了保证容器⽣态的标准性和健康可持续发展，包括Linux 基⾦会、Docker、微软、红帽、⾕歌和IBM等公司在2015年6⽉共同成⽴了⼀个叫open container（OCI）的组织，其⽬的就是制定开放的标准的容器规范，⽬前OCI⼀共发布了两个规范，分别是runtime spec和image format spec，有了这两个规范，不同的容器公司开发的容器只要兼容这两个规范，就可以保证容器的可移植性和相互可操作性。
containerd官网：https://containerd.io/
gvisor官网：https://gvisor.dev/
podman官网：https://podman.io
pouch项目地址：https://github.com/alibaba/pouch
buildkit: 从Docker公司的开源出来的⼀个镜像构建⼯具包，⽀持OCI标准的镜像构建,项目地址https://github.com/moby/buildkit

2、buildkitd组成部分

基于nerdctl+buildkitd+containerd实现镜像构建

buildkitd(服务端)，⽬前⽀持runc和containerd作为镜像构建环境，默认是runc，可以更换为containerd。
buildctl(客户端)，负责解析Dockerfile⽂件，并向服务端buildkitd发出构建请求。

3、部署buildkitd

3.1、下载二进制包

wget https://github.com/moby/buildkit/releases/download/v0.11.6/buildkit-v0.11.6.linux-amd64.tar.gz

解压压缩包，将二进制文件软连接至path环境变量

root@k8s-master01:/usr/local/src# ls
buildkit-v0.11.6.linux-amd64.tar.gz
root@k8s-master01:/usr/local/src# tar xf buildkit-v0.11.6.linux-amd64.tar.gz 
root@k8s-master01:/usr/local/src# ls
bin  buildkit-v0.11.6.linux-amd64.tar.gz
root@k8s-master01:/usr/local/src# cd bin
root@k8s-master01:/usr/local/src/bin# ls
buildctl               buildkit-qemu-arm   buildkit-qemu-mips64    buildkit-qemu-ppc64le  buildkit-qemu-s390x  buildkitd
buildkit-qemu-aarch64  buildkit-qemu-i386  buildkit-qemu-mips64el  buildkit-qemu-riscv64  buildkit-runc
root@k8s-master01:/usr/local/src/bin# ln -s /usr/local/src/bin/* /usr/local/bin/
root@k8s-master01:/usr/local/src/bin# buildctl --help
NAME:
   buildctl - build utility

USAGE:
   buildctl [global options] command [command options] [arguments...]

VERSION:
   v0.11.6

COMMANDS:
   du        disk usage
   prune     clean up build cache
   build, b  build
   debug     debug utilities
   help, h   Shows a list of commands or help for one command

GLOBAL OPTIONS:
   --debug                enable debug output in logs
   --addr value           buildkitd address (default: "unix:///run/buildkit/buildkitd.sock")
   --tlsservername value  buildkitd server name for certificate validation
   --tlscacert value      CA certificate for validation
   --tlscert value        client certificate
   --tlskey value         client key
   --tlsdir value         directory containing CA certificate, client certificate, and client key
   --timeout value        timeout backend connection after value seconds (default: 5)
   --help, -h             show help
   --version, -v          print the version
root@k8s-master01:/usr/local/src/bin#

能够正常在bash中执行buildkit --help ，表示对应命令已经正常软连接至path环境中。

3.2、提供buildkit.socket文件

root@k8s-master01:/usr/local/src/bin# cat /lib/systemd/system/buildkit.socket
[Unit]
Description=BuildKit
Documentation=https://github.com/moby/buildkit
[Socket]
ListenStream=%t/buildkit/buildkitd.sock
[Install]
WantedBy=sockets.target
root@k8s-master01:/usr/local/src/bin#

3.3、提供buildkit.service文件

root@k8s-master01:/usr/local/src/bin# cat /lib/systemd/system/buildkitd.service
[Unit]
Description=BuildKit
Requires=buildkit.socket
After=buildkit.socketDocumentation=https://github.com/moby/buildkit
[Service]
ExecStart=/usr/local/bin/buildkitd --oci-worker=false --containerd-worker=true
[Install]
WantedBy=multi-user.target
root@k8s-master01:/usr/local/src/bin#

3.4、启动buildiktd服务

root@k8s-master01:/usr/local/src/bin# systemctl daemon-reload
root@k8s-master01:/usr/local/src/bin# systemctl enable buildkitd
Created symlink /etc/systemd/system/multi-user.target.wants/buildkitd.service → /lib/systemd/system/buildkitd.service.
root@k8s-master01:/usr/local/src/bin# systemctl restart buildkitd
root@k8s-master01:/usr/local/src/bin# systemctl status buildkitd
● buildkitd.service - BuildKit
     Loaded: loaded (/lib/systemd/system/buildkitd.service; enabled; vendor preset: enabled)
     Active: active (running) since Wed 2023-05-31 13:32:38 UTC; 4s ago
   Main PID: 12191 (buildkitd)
      Tasks: 9 (limit: 4571)
     Memory: 7.8M
        CPU: 125ms
     CGroup: /system.slice/buildkitd.service
             └─12191 /usr/local/bin/buildkitd --oci-worker=false --containerd-worker=true

May 31 13:32:38 k8s-master01.ik8s.cc systemd[1]: Started BuildKit.
May 31 13:32:38 k8s-master01.ik8s.cc buildkitd[12191]: time="2023-05-31T13:32:38Z" level=warning msg="using host network as the default"
May 31 13:32:38 k8s-master01.ik8s.cc buildkitd[12191]: time="2023-05-31T13:32:38Z" level=warning msg="git source cannot be enabled: failed to find git 
binary: exec: \"git\": executable file not found in $PATH"
May 31 13:32:38 k8s-master01.ik8s.cc buildkitd[12191]: time="2023-05-31T13:32:38Z" level=info msg="found worker \"kffvitvra0b27yi956wa4xcal\", labels=m
ap[org.mobyproject.buildkit.worker.containerd.namespace:buildkit org.mobyproject.buildkit.worker.containerd.uuid:f27e8d21-8b1d-44ac-9233-f55b9b028fc0 o
rg.mobyproject.buildkit.worker.executor:containerd org.mobyproject.buildkit.worker.hostname:k8s-master01.ik8s.cc org.mobyproject.buildkit.worker.networ
k:host org.mobyproject.buildkit.worker.selinux.enabled:false org.mobyproject.buildkit.worker.snapshotter:overlayfs], platforms=[linux/amd64 linux/amd64
/v2 linux/386]"
May 31 13:32:38 k8s-master01.ik8s.cc buildkitd[12191]: time="2023-05-31T13:32:38Z" level=info msg="found 1 workers, default=\"kffvitvra0b27yi956wa4xcal
\""
May 31 13:32:38 k8s-master01.ik8s.cc buildkitd[12191]: time="2023-05-31T13:32:38Z" level=warning msg="currently, only the default worker can be used."
May 31 13:32:38 k8s-master01.ik8s.cc buildkitd[12191]: time="2023-05-31T13:32:38Z" level=info msg="running server on /run/buildkit/buildkitd.sock"
root@k8s-master01:/usr/local/src/bin#

4、基于nginx代理⾃签名证书harbor并实现https

4.1、将harbor修改为http协议

停止harbor服务

root@harbor:/app/harbor# docker-compose down
[+] Running 13/13
 ✔ Container notary-server       Removed                                                                                                          0.8s 
 ✔ Container nginx               Removed                                                                                                          1.7s 
 ✔ Container harbor-jobservice   Removed                                                                                                          0.7s 
 ✔ Container trivy-adapter       Removed                                                                                                          0.6s 
 ✔ Container notary-signer       Removed                                                                                                          0.5s 
 ✔ Container harbor-portal       Removed                                                                                                          0.3s 
 ✔ Container harbor-core         Removed                                                                                                          3.5s 
 ✔ Container harbor-db           Removed                                                                                                          0.7s 
 ✔ Container registry            Removed                                                                                                          0.5s 
 ✔ Container redis               Removed                                                                                                          0.5s 
 ✔ Network harbor_notary-sig     Removed                                                                                                          0.8s 
 ✔ Network harbor_harbor         Removed                                                                                                          0.2s 
 ✔ Network harbor_harbor-notary  Removed                                                                                                          0.5s 
root@harbor:/app/harbor#

修改harbor配置文件，注释https和证书的配置
基于nerdctl+buildkitd+containerd实现镜像构建
重新prepare

root@harbor:/app/harbor# ls
LICENSE  common  common.sh  docker-compose.yml  harbor.v2.8.0.tar.gz  harbor.yml  harbor.yml.tmpl  install.sh  prepare
root@harbor:/app/harbor# ./prepare 
prepare base dir is set to /app/harbor
WARNING:root:WARNING: HTTP protocol is insecure. Harbor will deprecate http protocol in the future. Please make sure to upgrade to https
Clearing the configuration file: /config/db/env
Clearing the configuration file: /config/registry/passwd
Clearing the configuration file: /config/registry/config.yml
Clearing the configuration file: /config/registry/root.crt
Clearing the configuration file: /config/notary/notary-signer-ca.crt
Clearing the configuration file: /config/notary/notary-signer.key
Clearing the configuration file: /config/notary/server-config.postgres.json
Clearing the configuration file: /config/notary/server_env
Clearing the configuration file: /config/notary/notary-signer.crt
Clearing the configuration file: /config/notary/signer_env
Clearing the configuration file: /config/notary/signer-config.postgres.json
Clearing the configuration file: /config/notary/root.crt
Clearing the configuration file: /config/trivy-adapter/env
Clearing the configuration file: /config/core/env
Clearing the configuration file: /config/core/app.conf
Clearing the configuration file: /config/jobservice/env
Clearing the configuration file: /config/jobservice/config.yml
Clearing the configuration file: /config/registryctl/env
Clearing the configuration file: /config/registryctl/config.yml
Clearing the configuration file: /config/nginx/conf.d/notary.upstream.conf
Clearing the configuration file: /config/nginx/conf.d/notary.server.conf
Clearing the configuration file: /config/nginx/nginx.conf
Clearing the configuration file: /config/log/rsyslog_docker.conf
Clearing the configuration file: /config/log/logrotate.conf
Clearing the configuration file: /config/portal/nginx.conf
Generated configuration file: /config/portal/nginx.conf
Generated configuration file: /config/log/logrotate.conf
Generated configuration file: /config/log/rsyslog_docker.conf
Generated configuration file: /config/nginx/nginx.conf
Generated configuration file: /config/core/env
Generated configuration file: /config/core/app.conf
Generated configuration file: /config/registry/config.yml
Generated configuration file: /config/registryctl/env
Generated configuration file: /config/registryctl/config.yml
Generated configuration file: /config/db/env
Generated configuration file: /config/jobservice/env
Generated configuration file: /config/jobservice/config.yml
loaded secret from file: /data/secret/keys/secretkey
Generated configuration file: /compose_location/docker-compose.yml
Clean up the input dir
root@harbor:/app/harbor#

启动harbor

root@harbor:/app/harbor# docker-compose up -d
[+] Running 10/10
 ✔ Network harbor_harbor        Created                                                                                                           0.2s 
 ✔ Container harbor-log         Started                                                                                                           1.2s 
 ✔ Container registry           Started                                                                                                           2.5s 
 ✔ Container harbor-portal      Started                                                                                                           2.7s 
 ✔ Container registryctl        Started                                                                                                           2.7s 
 ✔ Container harbor-db          Started                                                                                                           2.7s 
 ✔ Container redis              Started                                                                                                           2.6s 
 ✔ Container harbor-core        Started                                                                                                           3.2s 
 ✔ Container harbor-jobservice  Started                                                                                                           4.2s 
 ✔ Container nginx              Started                                                                                                           4.3s 
root@harbor:/app/harbor#

如果你给harbor添加的有service文件，也可以使用systemctl stop/start harbor来停止/启动harbor

验证harbor是否可以正常登录？
基于nerdctl+buildkitd+containerd实现镜像构建

4.2、nginx实现harbor的反向代理

4.2.1、nginx安装及配置

root@k8s-deploy:~# cd /usr/local/src/
root@k8s-deploy:/usr/local/src# wget https://nginx.org/download/nginx-1.22.0.tar.gz
--2023-05-31 13:59:55--  https://nginx.org/download/nginx-1.22.0.tar.gz
Resolving nginx.org (nginx.org)... 52.58.199.22, 3.125.197.172, 2a05:d014:edb:5704::6, ...
Connecting to nginx.org (nginx.org)|52.58.199.22|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 1073322 (1.0M) [application/octet-stream]
Saving to: ‘nginx-1.22.0.tar.gz’

nginx-1.22.0.tar.gz                        100%[=======================================================================================>]   1.02M  37.8KB/s    in 27s     

2023-05-31 14:00:23 (38.9 KB/s) - ‘nginx-1.22.0.tar.gz’ saved [1073322/1073322]

root@k8s-deploy:/usr/local/src# tar xf nginx-1.22.0.tar.gz 
root@k8s-deploy:/usr/local/src# cd nginx-1.22.0
root@k8s-deploy:/usr/local/src/nginx-1.22.0# ./configure --prefix=/apps/nginx \
> --with-http_ssl_module \
> --with-http_v2_module \
> --with-http_realip_module \
> --with-http_stub_status_module \
> --with-http_gzip_static_module \
> --with-pcre \
> --with-stream \
> --with-stream_ssl_module \
> --with-stream_realip_module

基于nerdctl+buildkitd+containerd实现镜像构建

上述报错没有找到http模块依赖的PCRE库

解决办法：安装libpcre3 libpcre3-dev

root@k8s-deploy:/usr/local/src/nginx-1.22.0# apt install libpcre3 libpcre3-dev -y

安装上述依赖后，重新configure

基于nerdctl+buildkitd+containerd实现镜像构建

上述报错没有找到ssl模块依赖的openssl库

解决办法：安装openssl libssl-dev

root@k8s-deploy:/usr/local/src/nginx-1.22.0# apt install openssl libssl-dev -y

基于nerdctl+buildkitd+containerd实现镜像构建

执行上述./configure 没有报错，并且能够看到上述截图，表示编译环境通过检查，可以进行下一步编译和安装

编译安装nginx

root@k8s-deploy:/usr/local/src/nginx-1.22.0# make && make install

创建证书⽬录，并生成私钥，证书

4.2.1.1、创建证书⽬录,并生成ca私钥

root@k8s-deploy:/apps/nginx/sbin# mkdir /apps/nginx/certs
root@k8s-deploy:/apps/nginx/sbin# cd /apps/nginx/certs
root@k8s-deploy:/apps/nginx/certs# openssl genrsa -out ca.key 4096

4.2.1.2、用ca私钥生成ca自签名证书

root@k8s-deploy:/apps/nginx/certs# openssl req -x509 -new -nodes -sha512 -days 3650 \
>  -subj "/C=CN/ST=Beijing/L=Beijing/O=Personal-CA/OU=Personal/CN=CA.com" \
>  -key ca.key \
>  -out ca.crt
root@k8s-deploy:/apps/nginx/certs# ls
ca.crt  ca.key
root@k8s-deploy:/apps/nginx/certs#

4.2.1.3、生成harbor服务器私钥

root@k8s-deploy:/apps/nginx/certs# openssl genrsa -out magedu.net.key 4096
root@k8s-deploy:/apps/nginx/certs# ls
ca.crt  ca.key  magedu.net.key
root@k8s-deploy:/apps/nginx/certs#

4.2.1.4、用harbor服务器私钥生成生成证书签名请求csr文件

root@k8s-deploy:/apps/nginx/certs# openssl req -sha512 -new \
>     -subj "/C=CN/ST=Beijing/L=Beijing/O=test/OU=Personal/CN=magedu.net" \
>     -key magedu.net.key \
>     -out magedu.net.csr
root@k8s-deploy:/apps/nginx/certs# ls
ca.crt  ca.key  magedu.net.csr  magedu.net.key
root@k8s-deploy:/apps/nginx/certs#

4.2.1.5、使用ca证书和私钥为harbor服务器签发证书

root@k8s-deploy:/apps/nginx/certs# openssl x509 -req -sha512 -days 3650 \
>     -CA ca.crt -CAkey ca.key -CAcreateserial \
>     -in magedu.net.csr \
>     -out magedu.net.crt
Certificate request self-signature ok
subject=C = CN, ST = Beijing, L = Beijing, O = test, OU = Personal, CN = magedu.net
root@k8s-deploy:/apps/nginx/certs# ls
ca.crt  ca.key  magedu.net.crt  magedu.net.csr  magedu.net.key
root@k8s-deploy:/apps/nginx/certs#

编辑nginx配置文件，配置证书和反向代理harbor

root@k8s-deploy:/apps/nginx/certs# cat /apps/nginx/conf/nginx.conf
worker_processes  1;
events {
    worker_connections  1024;
}
http {
    client_max_body_size 1000m;
    server {
        listen       80;
        listen       443 ssl;
        ssl_certificate /apps/nginx/certs/magedu.net.crt;
        ssl_certificate_key /apps/nginx/certs/magedu.net.key;
        ssl_session_cache shared:sslcache:20m;
        ssl_session_timeout 10m;
        location / {
                if ($scheme = http ){
                        rewrite / https://harbor.magedu.net permanent;
                }

                proxy_pass http://192.168.0.42;
        }
    }
}
root@k8s-deploy:/apps/nginx/certs#

检查nginx配置文件语法

root@k8s-deploy:/apps/nginx/certs# cd ..
root@k8s-deploy:/apps/nginx# /apps/nginx/sbin/nginx -t
nginx: the configuration file /apps/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /apps/nginx/conf/nginx.conf test is successful
root@k8s-deploy:/apps/nginx#

启动nginx

root@k8s-deploy:/apps/nginx# /apps/nginx/sbin/nginx
root@k8s-deploy:/apps/nginx# ss -tnl
State            Recv-Q            Send-Q                       Local Address:Port                       Peer Address:Port           Process           
LISTEN           0                 511                                0.0.0.0:80                              0.0.0.0:*                                
LISTEN           0                 4096                         127.0.0.53%lo:53                              0.0.0.0:*                                
LISTEN           0                 128                                0.0.0.0:22                              0.0.0.0:*                                
LISTEN           0                 511                                0.0.0.0:443                             0.0.0.0:*                                
root@k8s-deploy:/apps/nginx#

4.2.2、浏览器访问测试nginx 看看是否反向代理给harbor？是否为https？

基于nerdctl+buildkitd+containerd实现镜像构建

查看证书信息
基于nerdctl+buildkitd+containerd实现镜像构建

4.2.3、buildkitd配置⽂件

root@k8s-master01:/usr/local/src/bin# cat /etc/buildkit/buildkitd.toml
[registry."harbor.magedu.net"]
  http = true
  insecure = true
root@k8s-master01:

4.2.4、nerdctl配置⽂件

root@k8s-master01:/usr/local/src/bin# cat /etc/nerdctl/nerdctl.toml 
namespace = "k8s.io"
debug = false
debug_full = false
insecure_registry = true
root@k8s-master01:/usr/local/src/bin#

5、测试镜像构建

5.1、nerdctl常⽤命令

5.1.1 给nerdctl添加命令补全

root@k8s-master01:~# echo "source <(nerdctl completion bash)" >> /etc/profile
root@k8s-master01:~# cat /etc/profile
# /etc/profile: system-wide .profile file for the Bourne shell (sh(1))
# and Bourne compatible shells (bash(1), ksh(1), ash(1), ...).

if [ "${PS1-}" ]; then
  if [ "${BASH-}" ] && [ "$BASH" != "/bin/sh" ]; then
    # The file bash.bashrc already sets the default PS1.
    # PS1='\h:\w\$ '
    if [ -f /etc/bash.bashrc ]; then
      . /etc/bash.bashrc
    fi
  else
    if [ "$(id -u)" -eq 0 ]; then
      PS1='# '
    else
      PS1='$ '
    fi
  fi
fi

if [ -d /etc/profile.d ]; then
  for i in /etc/profile.d/*.sh; do
    if [ -r $i ]; then
      . $i
    fi
  done
  unset i
fi
source <(nerdctl completion bash)
root@k8s-master01:~# source /etc/profile

基于nerdctl+buildkitd+containerd实现镜像构建

5.1.2、登录harbor仓库

root@k8s-master01:~# nerdctl login harbor.magedu.net                             
Enter Username: admin
Enter Password: 
WARN[0005] skipping verifying HTTPS certs for "harbor.magedu.net" 
WARNING: Your password will be stored unencrypted in /root/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store

Login Succeeded
root@k8s-master01:~# nerdctl login --insecure-registry https://harbor.magedu.net 
WARN[0000] skipping verifying HTTPS certs for "harbor.magedu.net" 
WARNING: Your password will be stored unencrypted in /root/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store

Login Succeeded
root@k8s-master01:~#

自签名证书一般通过--insecure-registry 选项来指定该仓库是一个不安全的仓库

5.2、自签名harbor证书分发

5.2.1、创建证书⽬录

root@k8s-master01:~# mkdir -pv /etc/containerd/certs.d/harbor.magedu.net
mkdir: created directory '/etc/containerd/certs.d'
mkdir: created directory '/etc/containerd/certs.d/harbor.magedu.net'
root@k8s-master01:~#

5.2.2、证书格式转换

root@k8s-deploy:~# cd /apps/nginx/certs/
root@k8s-deploy:/apps/nginx/certs# openssl x509 -inform PEM -in magedu.net.crt -out magedu.net.cert
root@k8s-deploy:/apps/nginx/certs#

5.2.3、开始分发证书至镜像构建服务器

root@k8s-deploy:/apps/nginx/certs# scp ca.crt magedu.net.cert magedu.net.key 192.168.0.31:/etc/containerd/certs.d/harbor.magedu.net/
ca.crt                                                                                                               100% 2041     1.5MB/s   00:00    
magedu.net.cert                                                                                                      100% 1915     1.6MB/s   00:00    
magedu.net.key                                                                                                       100% 3272     2.9MB/s   00:00    
root@k8s-deploy:/apps/nginx/certs#

5.2.4、镜像构建服务器上验证证书

root@k8s-master01:~# cd /etc/containerd/certs.d/harbor.magedu.net
root@k8s-master01:/etc/containerd/certs.d/harbor.magedu.net# ll
total 20
drwxr-xr-x 2 root root 4096 May 31 17:49 ./
drwxr-xr-x 3 root root 4096 May 31 17:44 ../
-rw-r--r-- 1 root root 2041 May 31 17:49 ca.crt
-rw-r--r-- 1 root root 1915 May 31 17:49 magedu.net.cert
-rw------- 1 root root 3272 May 31 17:49 magedu.net.key
root@k8s-master01:/etc/containerd/certs.d/harbor.magedu.net#

5.2.5、删除原有登录信息，重新登录harbor

root@k8s-master01:~# rm -rf .docker/config.json 
root@k8s-master01:~# nerdctl login harbor.magedu.net
Enter Username: admin
Enter Password: 
WARN[0005] skipping verifying HTTPS certs for "harbor.magedu.net" 
WARNING: Your password will be stored unencrypted in /root/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store

Login Succeeded
root@k8s-master01:~#

5.3、镜像构建

root@k8s-master01:~/ubuntu# ll
total 1120
drwxr-xr-x  3 root root    4096 May 31 18:40 ./
drwx------ 11 root root    4096 May 31 18:40 ../
-rw-r--r--  1 root root     846 May 31 18:39 Dockerfile
-rw-r--r--  1 root root     266 May 31 18:40 build-command.sh
-rw-r--r--  1 root root   38751 Aug  5  2022 frontend.tar.gz
drwxr-xr-x  3 root root    4096 May 31 18:37 html/
-rw-r--r--  1 root root 1073322 May 24  2022 nginx-1.22.0.tar.gz
-rw-r--r--  1 root root    2812 Oct  3  2020 nginx.conf
-rw-r--r--  1 root root    1139 Aug  5  2022 sources.list
root@k8s-master01:~/ubuntu# cat Dockerfile 
FROM ubuntu:22.04
ADD sources.list /etc/apt/sources.list

RUN apt update && apt  install -y iproute2  ntpdate  tcpdump telnet traceroute nfs-kernel-server nfs-common  lrzsz tree  openssl libssl-dev libpcre3 libpcre3-dev zlib1g-dev ntpdate tcpdump telnet traceroute  gcc openssh-server lrzsz tree  openssl libssl-dev libpcre3 libpcre3-dev zlib1g-dev ntpdate tcpdump telnet traceroute iotop unzip zip make


ADD nginx-1.22.0.tar.gz /usr/local/src/
RUN cd /usr/local/src/nginx-1.22.0 && ./configure --prefix=/apps/nginx && make && make install  && ln -sv /apps/nginx/sbin/nginx /usr/bin
RUN groupadd  -g 2088 nginx && useradd  -g nginx -s /usr/sbin/nologin -u 2088 nginx && chown -R nginx.nginx /apps/nginx
ADD nginx.conf /apps/nginx/conf/
ADD frontend.tar.gz /apps/nginx/html/


EXPOSE 80 443
#ENTRYPOINT ["nginx"]
CMD ["nginx","-g","daemon off;"]
root@k8s-master01:~/ubuntu# cat build-command.sh 
#!/bin/bash
#docker build -t harbor.magedu.net/myserver/nginx:v1 .
#docker push harbor.magedu.net/myserver/nginx:v1

/usr/local/bin/nerdctl build -t harbor.magedu.net/magedu/nginx-base:1.22.0 .

/usr/local/bin/nerdctl push harbor.magedu.net/magedu/nginx-base:1.22.0
root@k8s-master01:~/ubuntu#

5.4、通过脚本⾃动构建并把镜像上传到镜像仓库

root@k8s-master01:~/ubuntu# bash build-command.sh

基于nerdctl+buildkitd+containerd实现镜像构建

5.5、验证镜像是否上传到harbor仓库？

基于nerdctl+buildkitd+containerd实现镜像构建
基于nerdctl+buildkitd+containerd实现镜像构建

6、基于⾃定义镜像创建测试容器

6.1、nerdctl命令

root@k8s-node01:~# nerdctl run -d -p 80:80 harbor.magedu.net/magedu/nginx-base:1.22.0
WARN[0000] skipping verifying HTTPS certs for "harbor.magedu.net" 
harbor.magedu.net/magedu/nginx-base:1.22.0:                                       resolved       |++++++++++++++++++++++++++++++++++++++| 
manifest-sha256:61c8355a7eabb8d24f31c8a48edb230d7709b455128a580e180a1a2f4188571c: done           |++++++++++++++++++++++++++++++++++++++| 
config-sha256:6c030d3d7f76a61e2bc706d98cdfa55b80f7a6d8491b85ede84d0dbb2c706a74:   done           |++++++++++++++++++++++++++++++++++++++| 
layer-sha256:4da3a93ac27213414b4de065a2603d7acbec5bd63d6198a62ad732fa7ac6afa0:    done           |++++++++++++++++++++++++++++++++++++++| 
layer-sha256:26039d49560ee304c7a41e00617e216bedb7e9c6b74263db5afe68a23425f286:    done           |++++++++++++++++++++++++++++++++++++++| 
layer-sha256:61967fbfff474bb397fbc7752b2097a1211fd9e22c85ce679d2b80c29477ca8d:    done           |++++++++++++++++++++++++++++++++++++++| 
layer-sha256:4179b69841babb645626f43f9f4eb8bf4fc9be92ef9819ea8d9335408178a497:    done           |++++++++++++++++++++++++++++++++++++++| 
layer-sha256:9e0da806173e5c7f5188ed9222e6caf214b43f6e0ed1f961ed8261cb4fbf9429:    done           |++++++++++++++++++++++++++++++++++++++| 
layer-sha256:1739bcae88003d009cb72941ca5085074a0d1257c971a3838e0d6402f010b38e:    done           |++++++++++++++++++++++++++++++++++++++| 
layer-sha256:f8a2ffd8882321b57192cce8fcaebab3657bb30e073e4f21eee91b3f44488809:    done           |++++++++++++++++++++++++++++++++++++++| 
elapsed: 18.6s                                                                    total:  149.3  (8.0 MiB/s)                                       
af08bef4d635f3f888c87120cc830b37e3f53121012ad59500a30c20ac065319
root@k8s-node01:~#

访问容器
基于nerdctl+buildkitd+containerd实现镜像构建文章来源地址https://www.toymoban.com/news/detail-467573.html

到了这里，关于基于nerdctl+buildkitd+containerd实现镜像构建的文章就介绍完了。如果您还想了解更多内容，请在右上角搜索TOY模板网以前的文章或继续浏览下面的相关文章，希望大家以后多多支持TOY模板网！

本文来自互联网用户投稿，该文观点仅代表作者本人，不代表本站立场。本站仅提供信息存储空间服务，不拥有所有权，不承担相关法律责任。如若转载，请注明出处： 如若内容造成侵权/违法违规/事实不符，请点击违法举报进行投诉反馈，一经查实，立即删除！

分享到：
领支付宝红包 赞助服务器费用

相关文章

  • Containerd配置镜像加速

    参考地址：containerd/config.md at main · containerd/containerd · GitHub

    2024年02月15日
    浏览(35)

  • 基于ubuntu构建jdk镜像

    Docker Hub 上有很多官方的 JDK 镜像，但是它们都不是基于 ubuntu 的，而是基于更小的 Linux 发行版，在使用一些命令行工具的之后老师报找不到，而且自己对 ubuntu 也更加熟悉。 以此 Dockerfile 构建的镜像拥有国内的apt源，且安装了jdk8。 在构建此镜像的时候我遇到了一个问题，如

    2024年02月09日
    浏览(42)
  • 基于Java8构建Docke镜像

    基于Java8构建Docke镜像

    搜索java8安装包 docker search java8 --no-trunc ， --no-trunc 展开描述信息 选择拉取 docker pull docker.io/mykro/java8-jre ，为了减少磁盘占用，选择jre版本基础镜像 在宿主机创建文件夹 iot ，并把所需 jar 包拷贝到当前目录，并创建 Dockerfile 文件，目录结构如下 编写 Dockerfile 文件 进入到当前

    2024年02月04日
    浏览(37)
  • docker、containerd 配置国内容器镜像源

    docker、containerd 配置国内容器镜像源

    国内容器镜像源地址：registry.aliyuncs.com/google_containers 文件路径：/etc/containerd/config.toml 在文件中加入一下配置 如下所示 在红框内容的下面添加 文件路径：/etc/docker/daemon.json 添加如下配置 “registry-mirrors”: [“registry.aliyuncs.com/google_containers”] 如下图所示 systemctl daemon-reload 以下

    2024年02月13日
    浏览(38)

  • containerd拉取私库镜像失败(kubelet)

    最近在跟着高塔老师的教程用二进制的方式搭建k8s kubernetes v1.20.0     我没有使用最新的版本，是因为内部网络问题。 containerd  v1.5.2        之前并没有使用过，但对docker比较熟悉 我所处的环境是一个内网环境，无法连接互联网，更无法连接国际互联网， 内网环境下部署了

    2024年02月09日
    浏览(40)
  • Dockerfile自定义镜像 - 基于 java:8-alpine 镜像，将一个Java项目构建为镜像

    Dockerfile自定义镜像 - 基于 java:8-alpine 镜像，将一个Java项目构建为镜像

    目录   一、前置知识 1.镜像结构 2.Dockerfile是什么 二、自定义一个 java 项目镜像 1.创建一个空目录，在这个空目录中创建一个文件，命名为 DockerFile，最后将 java 项目打包成 jar 包，放到这个目录中 2.编写 Dockerfile 文件 3.使用 docker build 构建为一个镜像 4.使用 docker run 运行镜像

    2024年02月07日
    浏览(46)

  • libreOffice构建docker镜像，并基于此运行项目

    一、libreOffice构建docker镜像，并启动项目 安装包准备 LibreOffice(v7.4.2): LibreOffice_7.4.2_Linux_x86-64_rpm.tar.gz LibreOffice-langpack:(v7.4.2): LibreOffice_7.4.2_Linux_x86-64_rpm_langpack_zh-CN.tar.gz jdk-8u202-linux-x64.tar.gz 打包windows字体包（C:WindowsFonts，搜索中文）：fonts.tar.gz Dockerfile编写 构建镜像 启动项

    2024年02月16日
    浏览(37)
  • Docker-基于java8构建java项目镜像

    Docker-基于java8构建java项目镜像

    需求：基于openjdk:8-jdk-alpine镜像，将一个java项目构建为镜像 实现步骤： 在linux系统检查有无openjdk:8-jdk-alpine镜像 如果没有，需要去镜像仓库拉取镜像，比如DockerHub 复制命令到linux系统控制台 运行成功 在linux系统新建一个空目录，然后在目录中新建一个文件，命令为Dockerfile，

    2024年02月05日
    浏览(43)

  • Docker基础（镜像的结构，Dockerfile语法介绍，基于Ubuntu镜像来构建一个Java应用）

    要想自己构建镜像，必须先了解镜像的结构。 镜像之所以能让我们快速跨操作系统部署应用而忽略其运行环境、配置，就是因为镜像中包含了程序运行需要的系统函数库、环境、配置、依赖。 因此，自定义镜像本质就是依次准备好程序运行的基础环境、依赖、应用本身、运

    2024年02月20日
    浏览(46)

  • Kubernetes ≥ 1.25 Containerd配置Harbor私有镜像仓库

    containerd 实现了 kubernetes 的 Container Runtime Interface (CRI) 接口，提供容器运行时核心功能，如镜像管理、容器管理等，相比 dockerd 更加简单、健壮和可移植。 从docker过度还是需要一点时间慢慢习惯的，今天来探讨containerd 如何从无域名与权威证书的私有仓库harbor，下载镜像！ c

    2024年01月15日
    浏览(44)

觉得文章有用就打赏一下文章作者

支付宝扫一扫打赏

博客赞助

微信扫一扫打赏

请作者喝杯咖啡吧~博客赞助

支付宝扫一扫领取红包，优惠每天领

二维码1

领取红包

二维码2

领红包