Debian13配置nerdctl容器

一、环境准备

更新apt阿里云源

deb https://mirrors.aliyun.com/debian/ trixie main non-free non-free-firmware contrib
deb-src https://mirrors.aliyun.com/debian/ trixie main non-free non-free-firmware contrib
deb https://mirrors.aliyun.com/debian-security/ trixie-security main
deb-src https://mirrors.aliyun.com/debian-security/ trixie-security main
deb https://mirrors.aliyun.com/debian/ trixie-updates main non-free non-free-firmware contrib
deb-src https://mirrors.aliyun.com/debian/ trixie-updates main non-free non-free-firmware contrib
deb https://mirrors.aliyun.com/debian/ trixie-backports main non-free non-free-firmware contrib
deb-src https://mirrors.aliyun.com/debian/ trixie-backports main non-free non-free-firmware contrib

安装常用软件

apt install vim ufw containerd
systemctl enable containerd

关闭 IPv6 sysctl 配置

vim /etc/sysctl.d/99-disable-ipv6.conf
#写入下面内容
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1
net.ipv6.conf.lo.disable_ipv6 = 1

重载 sysctl 配置

sysctl --system

验证是否生效

# 返回 1 = 已关闭；0=开启
sysctl net.ipv6.conf.all.disable_ipv6

配置防火墙ufw

vim /etc/default/ufw
# 修改前
# DEFAULT_FORWARD_POLICY="DROP"
# IPV6=yes

# 修改后
IPV6=no
DEFAULT_FORWARD_POLICY="ACCEPT"

配置转发

vim /etc/ufw/before.rules
# End required lines 插入下面内容
-A ufw-before-forward -d 172.20.0.0/24 -j ACCEPT
-A ufw-before-forward -s 172.20.0.0/24 -j ACCEPT

重新加载 UFW

ufw reload
ufw disable && ufw enable

二、配置容器

下载nerdctl

#下载
wget https://github.com/containerd/nerdctl/releases/download/v2.3.5/nerdctl-2.3.5-linux-amd64.tar.gz
#解压
tar zxf nerdctl-2.3.5-linux-amd64.tar.gz -C /usr/local/bin

授权nerdctl

chmod +x /usr/local/bin/nerdctl

配置镜像加速

vim /etc/containerd/config.toml

写入下面内容

[plugins."io.containerd.grpc.v1.cri".registry]
  [plugins."io.containerd.grpc.v1.cri".registry.mirrors]
    [plugins."io.containerd.grpc.v1.cri".registry.mirrors."docker.io"]
      endpoint = [
        "https://docker.1ms.run",
        "https://docker.m.daocloud.io",
        "https://registry-1.docker.io"
      ]

创建目录和文件

mkdir -p /etc/containerd/certs.d/docker.io
vim /etc/containerd/certs.d/docker.io/hosts.toml

写入加速器地址：

server = "https://docker.io"

[host."https://xxxxx.mirror.swr.myhuaweicloud.com"]
  capabilities = ["pull", "resolve"]

重启容器

systemctl restart containerd

配置cni

#创建目录
mkdir -p /opt/cni/bin /etc/cni/net.d
# 下载 CNI 插件
wget https://github.com/containernetworking/plugins/releases/download/v1.9.1/cni-plugins-linux-amd64-v1.9.1.tgz
# 解压到 /opt/cni/bin
tar -zxvf cni-plugins-linux-amd64-v1.9.1.tgz -C /opt/cni/bin/
# 查看是否有 bridge、host-local 等
ls /opt/cni/bin

编排

nerdctl compose up -d
nerdctl compose down

其他问题

debian自启问题

#启用用户 linger（允许用户服务开机自启）
loginctl enable-linger $USER

底层数据损坏，需要手动清理 containerd 存储

# 停止 containerd
systemctl stop containerd
#删除containerd配置镜像等所有
rm /var/lib/containerd/io.containerd.metadata.v1.bolt/meta.db
# 重启 containerd（会自动重建数据库，但会丢失所有容器记录）
systemctl start containerd

如果容器访问宿主机，例如：nginx反向代理宿主机端口

解决容器网络隔离办法：

#启动 nerdctl nginx 时添加 
`--add-host=host.docker.internal:host‑gateway`
#也可以改成自定义域名 + 写死网关IP
`--add-host=www.xxx.com:172.20.0.1`

#`host‑gateway` 指向宿主机网关 IP，容器内用域名访问宿主机服务。
#`host.docker.internal` 这个域名指向宿主机的网关 IP，等于容器的 `/etc/hosts` 增加一条域名解析

# 编排增加格式
# 等价于命令行 --add-host=host.docker.internal:host-gateway
    extra_hosts:
      - "host.docker.internal:host-gateway"
    restart: always

nginx配置修改

proxy_pass http://host.docker.internal:5001;
#或直接写容器的网关地址，上面所有配置不用配
proxy_pass http://172.20.0.1:5001;