Himanshu Pandey
235 lines
6.1 KiB
Markdown
235 lines
6.1 KiB
Markdown
---
|
||
reviewers:
|
||
- vincepri
|
||
- bart0sh
|
||
title: CRI installation
|
||
content_template: templates/concept
|
||
weight: 100
|
||
---
|
||
{{% capture overview %}}
|
||
Since v1.6.0, Kubernetes has enabled the use of CRI, Container Runtime Interface, by default.
|
||
This page contains installation instruction for various runtimes.
|
||
|
||
{{% /capture %}}
|
||
|
||
{{% capture body %}}
|
||
|
||
Please proceed with executing the following commands based on your OS as root.
|
||
You may become the root user by executing `sudo -i` after SSH-ing to each host.
|
||
|
||
{{< caution >}}
|
||
A flaw was found in the way runc handled system file descriptors when running containers.
|
||
A malicious container could use this flaw to overwrite contents of the runc binary and
|
||
consequently run arbitrary commands on the container host system.
|
||
|
||
Please refer to this link for more information about this issue
|
||
[cve-2019-5736 : runc vulnerability ] (https://access.redhat.com/security/cve/cve-2019-5736)
|
||
{{< /caution >}}
|
||
|
||
## Docker
|
||
|
||
On each of your machines, install Docker.
|
||
Version 18.06.2 is recommended, but 1.11, 1.12, 1.13, 17.03 and 18.09 are known to work as well.
|
||
Keep track of the latest verified Docker version in the Kubernetes release notes.
|
||
|
||
Use the following commands to install Docker on your system:
|
||
|
||
{{< tabs name="tab-cri-docker-installation" >}}
|
||
{{< tab name="Ubuntu 16.04" codelang="bash" >}}
|
||
# Install Docker CE
|
||
## Set up the repository:
|
||
### Update the apt package index
|
||
apt-get update
|
||
|
||
### Install packages to allow apt to use a repository over HTTPS
|
||
apt-get update && apt-get install apt-transport-https ca-certificates curl software-properties-common
|
||
|
||
### Add Docker’s official GPG key
|
||
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | apt-key add -
|
||
|
||
### Add docker apt repository.
|
||
add-apt-repository \
|
||
"deb [arch=amd64] https://download.docker.com/linux/ubuntu \
|
||
$(lsb_release -cs) \
|
||
stable"
|
||
|
||
## Install docker ce.
|
||
apt-get update && apt-get install docker-ce=18.06.2~ce~3-0~ubuntu
|
||
|
||
# Setup daemon.
|
||
cat > /etc/docker/daemon.json <<EOF
|
||
{
|
||
"exec-opts": ["native.cgroupdriver=systemd"],
|
||
"log-driver": "json-file",
|
||
"log-opts": {
|
||
"max-size": "100m"
|
||
},
|
||
"storage-driver": "overlay2"
|
||
}
|
||
EOF
|
||
|
||
mkdir -p /etc/systemd/system/docker.service.d
|
||
|
||
# Restart docker.
|
||
systemctl daemon-reload
|
||
systemctl restart docker
|
||
{{< /tab >}}
|
||
{{< tab name="CentOS/RHEL 7.4+" codelang="bash" >}}
|
||
|
||
# Install Docker CE
|
||
## Set up the repository
|
||
### Install required packages.
|
||
yum install yum-utils device-mapper-persistent-data lvm2
|
||
|
||
### Add docker repository.
|
||
yum-config-manager \
|
||
--add-repo \
|
||
https://download.docker.com/linux/centos/docker-ce.repo
|
||
|
||
## Install docker ce.
|
||
yum update && yum install docker-ce-18.06.2.ce
|
||
|
||
## Create /etc/docker directory.
|
||
mkdir /etc/docker
|
||
|
||
# Setup daemon.
|
||
cat > /etc/docker/daemon.json <<EOF
|
||
{
|
||
"exec-opts": ["native.cgroupdriver=systemd"],
|
||
"log-driver": "json-file",
|
||
"log-opts": {
|
||
"max-size": "100m"
|
||
},
|
||
"storage-driver": "overlay2",
|
||
"storage-opts": [
|
||
"overlay2.override_kernel_check=true"
|
||
]
|
||
}
|
||
EOF
|
||
|
||
mkdir -p /etc/systemd/system/docker.service.d
|
||
|
||
# Restart docker.
|
||
systemctl daemon-reload
|
||
systemctl restart docker
|
||
{{< /tab >}}
|
||
{{< /tabs >}}
|
||
|
||
Refer to the [official Docker installation guides](https://docs.docker.com/engine/installation/)
|
||
for more information.
|
||
|
||
## CRI-O
|
||
|
||
This section contains the necessary steps to install `CRI-O` as CRI runtime.
|
||
|
||
Use the following commands to install CRI-O on your system:
|
||
|
||
### Prerequisites
|
||
|
||
```shell
|
||
modprobe overlay
|
||
modprobe br_netfilter
|
||
|
||
# Setup required sysctl params, these persist across reboots.
|
||
cat > /etc/sysctl.d/99-kubernetes-cri.conf <<EOF
|
||
net.bridge.bridge-nf-call-iptables = 1
|
||
net.ipv4.ip_forward = 1
|
||
net.bridge.bridge-nf-call-ip6tables = 1
|
||
EOF
|
||
|
||
sysctl --system
|
||
```
|
||
|
||
{{< tabs name="tab-cri-cri-o-installation" >}}
|
||
{{< tab name="Ubuntu 16.04" codelang="bash" >}}
|
||
|
||
# Install prerequisites
|
||
apt-get update
|
||
apt-get install software-properties-common
|
||
|
||
add-apt-repository ppa:projectatomic/ppa
|
||
apt-get update
|
||
|
||
# Install CRI-O
|
||
apt-get install cri-o-1.11
|
||
|
||
{{< /tab >}}
|
||
{{< tab name="CentOS/RHEL 7.4+" codelang="bash" >}}
|
||
|
||
# Install prerequisites
|
||
yum-config-manager --add-repo=https://cbs.centos.org/repos/paas7-crio-311-candidate/x86_64/os/
|
||
|
||
# Install CRI-O
|
||
yum install --nogpgcheck cri-o
|
||
|
||
{{< /tab >}}
|
||
{{< /tabs >}}
|
||
|
||
### Start CRI-O
|
||
|
||
```
|
||
systemctl start crio
|
||
```
|
||
|
||
Refer to the [CRI-O installation guide](https://github.com/kubernetes-sigs/cri-o#getting-started)
|
||
for more information.
|
||
|
||
## Containerd
|
||
|
||
This section contains the necessary steps to use `containerd` as CRI runtime.
|
||
|
||
Use the following commands to install Containerd on your system:
|
||
|
||
### Prerequisites
|
||
|
||
```shell
|
||
modprobe overlay
|
||
modprobe br_netfilter
|
||
|
||
# Setup required sysctl params, these persist across reboots.
|
||
cat > /etc/sysctl.d/99-kubernetes-cri.conf <<EOF
|
||
net.bridge.bridge-nf-call-iptables = 1
|
||
net.ipv4.ip_forward = 1
|
||
net.bridge.bridge-nf-call-ip6tables = 1
|
||
EOF
|
||
|
||
sysctl --system
|
||
```
|
||
|
||
{{< tabs name="tab-cri-containerd-installation" >}}
|
||
{{< tab name="Ubuntu 16.04+" codelang="bash" >}}
|
||
apt-get install -y libseccomp2
|
||
{{< /tab >}}
|
||
{{< tab name="CentOS/RHEL 7.4+" codelang="bash" >}}
|
||
yum install -y libseccomp
|
||
{{< /tab >}}
|
||
{{< /tabs >}}
|
||
|
||
### Install containerd
|
||
|
||
[Containerd releases](https://github.com/containerd/containerd/releases) are published regularly, the values below are hardcoded to the latest version available at the time of writing. Please check for newer versions and hashes [here](https://storage.googleapis.com/cri-containerd-release).
|
||
|
||
```shell
|
||
# Export required environment variables.
|
||
export CONTAINERD_VERSION="1.1.2"
|
||
export CONTAINERD_SHA256="d4ed54891e90a5d1a45e3e96464e2e8a4770cd380c21285ef5c9895c40549218"
|
||
|
||
# Download containerd tar.
|
||
wget https://storage.googleapis.com/cri-containerd-release/cri-containerd-${CONTAINERD_VERSION}.linux-amd64.tar.gz
|
||
|
||
# Check hash.
|
||
echo "${CONTAINERD_SHA256} cri-containerd-${CONTAINERD_VERSION}.linux-amd64.tar.gz" | sha256sum --check -
|
||
|
||
# Unpack.
|
||
tar --no-overwrite-dir -C / -xzf cri-containerd-${CONTAINERD_VERSION}.linux-amd64.tar.gz
|
||
|
||
# Start containerd.
|
||
systemctl start containerd
|
||
```
|
||
|
||
## Other CRI runtimes: frakti
|
||
|
||
Refer to the [Frakti QuickStart guide](https://github.com/kubernetes/frakti#quickstart) for more information.
|
||
|
||
{{% /capture %}}
|