Containerd Snapshotter 介绍

type Snapshotter interface {
// Stat returns the info for an active or committed snapshot by name or
// key.
//
// Should be used for parent resolution, existence checks and to discern
// the kind of snapshot.
        Stat(ctx context.Context, key string) (Info, error)

// Update updates the info for a snapshot.
//
// Only mutable properties of a snapshot may be updated.
        Update(ctx context.Context, info Info, fieldpaths ...string) (Info, error)

// Usage returns the resource usage of an active or committed snapshot
// excluding the usage of parent snapshots.
//
// The running time of this call for active snapshots is dependent on
// implementation, but may be proportional to the size of the resource.
// Callers should take this into consideration. Implementations should
// attempt to honor context cancellation and avoid taking locks when making
// the calculation.
        Usage(ctx context.Context, key string) (Usage, error)

// Mounts returns the mounts for the active snapshot transaction identified
// by key. Can be called on a read-write or readonly transaction. This is
// available only for active snapshots.
//
// This can be used to recover mounts after calling View or Prepare.
        Mounts(ctx context.Context, key string) ([]mount.Mount, error)

// Prepare creates an active snapshot identified by key descending from the
// provided parent.  The returned mounts can be used to mount the snapshot
// to capture changes.
//
// If a parent is provided, after performing the mounts, the destination
// will start with the content of the parent. The parent must be a
// committed snapshot. Changes to the mounted destination will be captured
// in relation to the parent. The default parent, "", is an empty
// directory.
//
// The changes may be saved to a committed snapshot by calling Commit. When
// one is done with the transaction, Remove should be called on the key.
//
// Multiple calls to Prepare or View with the same key should fail.
        Prepare(ctx context.Context, key, parent string, opts ...Opt) ([]mount.Mount, error)

// View behaves identically to Prepare except the result may not be
// committed back to the snapshot snapshotter. View returns a readonly view on
// the parent, with the active snapshot being tracked by the given key.
//
// This method operates identically to Prepare, except the mounts returned
// may have the readonly flag set. Any modifications to the underlying
// filesystem will be ignored. Implementations may perform this in a more
// efficient manner that differs from what would be attempted with
// `Prepare`.
//
// Commit may not be called on the provided key and will return an error.
// To collect the resources associated with key, Remove must be called with
// key as the argument.
        View(ctx context.Context, key, parent string, opts ...Opt) ([]mount.Mount, error)

// Commit captures the changes between key and its parent into a snapshot
// identified by name.  The name can then be used with the snapshotter's other
// methods to create subsequent snapshots.
//
// A committed snapshot will be created under name with the parent of the
// active snapshot.
//
// After commit, the snapshot identified by key is removed.
        Commit(ctx context.Context, name, key string, opts ...Opt) error

// Remove the committed or active snapshot by the provided key.
//
// All resources associated with the key will be removed.
//
// If the snapshot is a parent of another snapshot, its children must be
// removed before proceeding.
        Remove(ctx context.Context, key string) error

// Walk will call the provided function for each snapshot in the
// snapshotter which match the provided filters. If no filters are
// given all items will be walked.
// Filters:
//  name
//  parent
//  kind (active,view,committed)
//  labels.(label)
        Walk(ctx context.Context, fn WalkFunc, filters ...string) error

// Close releases the internal resources.
//
// Close is expected to be called on the end of the lifecycle of the snapshotter,
// but not mandatory.
//
// Close returns nil when it is already closed.
        Close() error
}

mv /etc/containerd/config.toml /etc/containerd/config.toml.bak

# 修改containerd配置文件
tee /etc/containerd/config.toml <<-EOF
version = 2

# Enable stargz snapshotter for CRI
[plugins."io.containerd.grpc.v1.cri".containerd]
  snapshotter = "stargz"
  disable_snapshot_annotations = false

# Plug stargz snapshotter into containerd
[proxy_plugins]
  [proxy_plugins.stargz]
    type = "snapshot"
    address = "/run/containerd-stargz-grpc/containerd-stargz-grpc.sock"
EOF

# 下载stargz-snapshotter二进制文件
wget https://github.com/containerd/stargz-snapshotter/releases/download/v0.14.3/stargz-snapshotter-v0.14.3-linux-amd64.tar.gz

tar -C /usr/local/bin -xvf stargz-snapshotter-v0.14.3-linux-amd64.tar.gz

# 下载service文件并启动服务
wget -O /etc/systemd/system/stargz-snapshotter.service https://raw.githubusercontent.com/containerd/stargz-snapshotter/main/script/config/etc/systemd/system/stargz-snapshotter.service
systemctl enable --now stargz-snapshotter

# 重启containerd，使配置生效（加载stargz插件）
systemctl restart containerd

# 拉取镜像(优化后的镜像)
ctr-remote image rpull --plain-http ghcr.io/stargz-containers/alpine:3.15.3-esgz
# 启动容器
ctr-remote run --rm -t --snapshotter=stargz ghcr.io/stargz-containers/alpine:3.15.3-esgz test echo hello

# 拉取 stargz 格式镜像
ctr-remote image rpull --plain-http ghcr.io/stargz-containers/golang:1.15.3-buster-org

# 基于entrypoint优化
ctr-remote image optimize --oci \
           --entrypoint='[ "/bin/bash", "-c" ]' --args='[ "go version" ]' \
           ghcr.io/stargz-containers/golang:1.15.3-buster-org \
           localhost:5000/golang:1.15.3-esgz-go-abin

ctr-remote run --rm -t --snapshotter=stargz localhost:5000/golang:1.15.3-esgz-go-abin test

# 基于本地文件runtime优化

tee /tmp/hello.go <<- EOF
package main

import "fmt"

func main() {
     fmt.Println("hello world")
}
EOF

ctr-remote image optimize --oci \
           --mount=type=bind,source=/tmp/hello.go,destination=/hello.go,options=bind:ro \
           --entrypoint='[ "/bin/bash", "-c" ]' --args='[ "go build -o /hello /hello.go && /hello" ]' \
           ghcr.io/stargz-containers/golang:1.15.3-buster-org \
           localhost:5000/golang:1.15.3-esgz-abin-hello-world

ctr-remote run --rm -t --snapshotter=stargz localhost:5000/golang:1.15.3-esgz-abin-hello-world test

ctr-remote image optimize --oci \
           --cni \
           --entrypoint='[ "/bin/bash", "-c" ]' \
           --args='[ "curl example.com" ]' \
           ghcr.io/stargz-containers/golang:1.15.3-buster-org \
           registry2:5000/golang:1.15.3-esgz-curl

# 删除本地启动的 registry
docker rm -f registry
# 启动基于 ORAS 项目的 registry
docker run -d -p 5000:5000 --restart=always --name registry ghcr.io/oras-project/registry:v1.0.0-rc

# 下载镜像
ctr i pull docker.io/library/rabbitmq:latest
# 打 tag
ctr i tag docker.io/library/rabbitmq:latest localhost:5000/rabbitmq:latest

# 上传到本地 registry
ctr i push --platform linux/amd64 --plain-http localhost:5000/rabbitmq:latest
curl http://localhost:5000/v2/_catalog
curl http://localhost:5000/v2/golang/tags/list
# 查看详细信息
curl http://localhost:5000/v2/golang/manifests/latest

# 下载 soci-snapshotter
git clone https://github.com/awslabs/soci-snapshotter.git
cd soci-snapshotter
make

# 创建 SOCI index，产生 ztocs 文件（每个镜像层一个）和 manifest（将ztocs和镜像层联系起来）
./out/soci create --oras localhost:5000/rabbitmq:latest

# 查看ztoc的信息
./out/soci ztoc info sha256:6e956974b9a4c9b1f5ae93e4be741e5a5c6cb55bf3181e68e89fa60ef8884c28

# 查看索引 manifest
./out/soci index list
# 查看索引manifest信息
./out/soci index info sha256:ee961dc6c0aea50ac4975918070e55ed7239aaa9e9c4d68191be2745c6a70a24 | jq

# 将 SOCI manifest上传到 registry
./out/soci push --plain-http localhost:5000/rabbitmq:latest

# 为containerd配置snapshotter插件
tee -a /etc/containerd/config.toml <<- EOF
[proxy_plugins]
  [proxy_plugins.soci]
    type = "snapshot"
    address = "/run/soci-snapshotter-grpc/soci-snapshotter-grpc.sock"
EOF

sudo systemctl restart containerd
ctr plugin ls | grep snapshotter | grep soci

# 启动 SOCI snapshotter
./out/soci-snapshotter-grpc&> ./soci-snapshotter-logs &

# 通过 SOCI snapshotter 拉取镜像
./out/soci image rpull --plain-http --soci-index-digest sha256:ee961dc6c0aea50ac4975918070e55ed7239aaa9e9c4d68191be2745c6a70a24 localhost:5000/rabbitmq:latest

mount | grep soci

# 启动容器
ctr run --snapshotter soci --net-host localhost:5000/rabbitmq:latest soci
ctr c ls
ctr c d soci

git clone https://github.com/containerd/accelerated-container-image.git
cd accelerated-container-image
make
sudo make install

# 创建配置文件
sudo tee /etc/overlaybd-snapshotter/config.json <<- EOF
{
    "root": "/var/lib/containerd/io.containerd.snapshotter.v1.overlaybd",
    "address": "/run/overlaybd-snapshotter/overlaybd.sock",
    "verbose": "info",
    "rwMode": "overlayfs",
    "logReportCaller": false,
    "autoRemoveDev": false
}
EOF

# 启动 overlaybd-snapshotter 服务
sudo systemctl enable /opt/overlaybd/snapshotter/overlaybd-snapshotter.service
sudo systemctl start overlaybd-snapshotter

sudo apt install -y libcurl4-openssl-dev libssl-dev libaio-dev libnl-3-dev libnl-genl-3-dev libgflags-dev

# 安装 zstd
git clone https://github.com/facebook/zstd.git
make -j 8
sudo make install

# 安装 cmake，需要版本大于 3.15
wget https://github.com/Kitware/CMake/releases/download/v3.25.1/cmake-3.25.1.tar.gz
tar -zxvf cmake-3.25.1.tar.gz
cd cmake-3.25.1
make -j 8
sudo make install

# 加载 target_core_user 内核模块
modprobe target_core_user
lsmod | grep target_core_user

git clone https://github.com/containerd/overlaybd.git
cd overlaybd
git submodule update --init
mkdir build
cd build
cmake -DCMAKE_BUILD_TYPE=Release ..
make -j 8
sudo make install

# 启动 overlaybd-tcmu 服务
sudo systemctl enable /opt/overlaybd/overlaybd-tcmu.service
sudo systemctl start overlaybd-tcmu

sudo tee /etc/containerd/config.toml -a <<- EOF

[proxy_plugins.overlaybd]
    type = "snapshot"
    address = "/run/overlaybd-snapshotter/overlaybd.sock"
EOF

sudo systemctl restart containerd
sudo ctr plugins ls | grep snapshotter

sudo nerdctl run --net host -it --rm --snapshotter=overlaybd registry.hub.docker.com/overlaybd/redis:6.2.1_obd

sudo nerdctl pull golang:1.15.3
sudo /opt/overlaybd/snapshotter/ctr obdconv docker.io/library/golang:1.15.3 localhost:5000/golang:1.15.3-obd
sudo nerdctl push localhost:5000/golang:1.15.3-obd

# 启动容器
sudo nerdctl run --net host -it --rm --snapshotter=overlaybd localhost:5000/golang:1.15.3-obd