Rocky Linux 9.0 完整安装 containerdK8s 标准容器运行时分步教程Rocky9 系列官方弃用 DockerK8s 1.24 强制使用 containerd全程永久配置、重启不失效适配 K8s 1.24~1.33。前置准备所有节点必须执行1. 关闭防火墙 / SELinux生产可选放行端口测试直接关闭bash# 关闭防火墙开机自启并立即停止systemctl stop firewalldsystemctl disable firewalld# SELinux 永久关闭sed -i s/^SELINUXenforcing/SELINUXdisabled/ /etc/selinux/config# 临时生效setenforce 02. 永久关闭 SwapK8s 硬性要求bash# 临时关闭swapoff -a# 永久注释 fstab 中的swapsed -i /swap/s/^/#/ /etc/fstab3. 加载内核模块、开启 ip 转发容器网络必需bash# 加载overlay、br_netfilter内核模块modprobe overlaymodprobe br_netfilter# 永久内核参数配置cat /etc/sysctl.d/k8s.conf EOFnet.bridge.bridge-nf-call-iptables 1net.bridge.bridge-nf-call-ip6tables 1net.ipv4.ip_forward 1EOF# 生效配置sysctl --system# 验证sysctl net.ipv4.ip_forward步骤 1配置阿里云 containerd 软件源国外源太慢bash# 安装yum工具dnf install -y dnf-utils# 添加kubernetes阿里云yum源同时附带containerdcat /etc/yum.repos.d/kubernetes.repo EOF[kubernetes]nameKubernetesbaseurlhttps://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el9-x86_64/enabled1gpgcheck1repo_gpgkeyhttps://mirrors.aliyun.com/kubernetes/yum/doc/yum-key.gpg https://mirrors.aliyun.com/kubernetes/yum/doc/rpm-package-key.gpgEOF# 刷新yum缓存dnf clean all dnf makecache步骤 2安装 containerdbash# 安装指定稳定版 1.7.20适配K8s全版本dnf install -y containerd.io-1.7.20步骤 3生成默认配置文件关键containerd 默认无配置文件需要导出标准配置到/etc/containerd/config.tomlbashcontainerd config default /etc/containerd/config.toml步骤 4修改配置文件4 项核心修改K8s 必改4.1 修改配置bashvim /etc/containerd/config.toml执行以下替换命令不用手动改文件一键替换bash# 1. cgroup驱动改为systemdK8s强制要求sed -i s/SystemdCgroup \ false/SystemdCgroup \ true/g /etc/containerd/config.toml# 2. 修改镜像加速器阿里云镜像仓库解决拉取k8s镜像超时sed -i s#registry.k8s.io#registry.aliyuncs.com/google_containers#g /etc/containerd/config.toml# 3. 配置国内docker.io镜像加速可选加速业务镜像sed -i /\[plugins.io.containerd.grpc.v1.cri.registry.mirrors\]/a \ [plugins.io.containerd.grpc.v1.cri.registry.mirrors.docker.io]\n endpoint [https://docker.mirrors.ustc.edu.cn] /etc/containerd/config.toml4.2 验证修改结果bashgrep SystemdCgroup /etc/containerd/config.toml# 输出 SystemdCgroup true 代表修改成功步骤 5设置 containerd 开机自启 启动服务bash# 开机自启并立即启动systemctl enable --now containerd# 查看运行状态显示 active (running) 正常systemctl status containerd步骤 6验证 containerd 功能6.1 查看版本bashctr --version6.2 测试拉取镜像bash# 拉取nginx测试镜像ctr images pull docker.io/library/nginx:alpine# 查看本地镜像ctr images list步骤 7可选安装 crictl 工具K8s 专用容器调试工具crictl 是 k8s 标准容器调试命令替代 docker 命令bash# 安装dnf install -y cri-tools# 配置crictl连接containerdcat /etc/crictl.yaml EOFruntime-endpoint: unix:///run/containerd/containerd.sockimage-endpoint: unix:///run/containerd/containerd.socktimeout: 10debug: falseEOF# 验证连通性crictl info完整一键脚本复制直接整条执行Rocky9.0 通用bash# 1. 基础环境优化systemctl stop firewalld systemctl disable firewalldsetenforce 0sed -i s/^SELINUXenforcing/SELINUXdisabled/ /etc/selinux/configswapoff -ased -i /swap/s/^/#/ /etc/fstabmodprobe overlay modprobe br_netfiltercat /etc/sysctl.d/k8s.conf EOFnet.bridge.bridge-nf-call-iptables 1net.bridge.bridge-nf-call-ip6tables 1net.ipv4.ip_forward 1EOFsysctl --system# 2. 配置yum源dnf install -y dnf-utilscat /etc/yum.repos.d/kubernetes.repo EOF[kubernetes]nameKubernetesbaseurlhttps://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el9-x86_64/enabled1gpgcheck1repo_gpgkeyhttps://mirrors.aliyun.com/kubernetes/yum/doc/yum-key.gpg https://mirrors.aliyun.com/kubernetes/yum/doc/rpm-package-key.gpgEOFdnf clean all dnf makecache# 3. 安装并配置containerddnf install -y containerd.io-1.7.20 cri-toolscontainerd config default /etc/containerd/config.tomlsed -i s/SystemdCgroup \ false/SystemdCgroup \ true/g /etc/containerd/config.tomlsed -i s#registry.k8s.io#registry.aliyuncs.com/google_containers#g /etc/containerd/config.tomlsed -i /\[plugins.io.containerd.grpc.v1.cri.registry.mirrors\]/a \ [plugins.io.containerd.grpc.v1.cri.registry.mirrors.docker.io]\n endpoint [https://docker.mirrors.ustc.edu.cn] /etc/containerd/config.toml# 4. 启动服务systemctl enable --now containerdcat /etc/crictl.yaml EOFruntime-endpoint: unix:///run/containerd/containerd.sockimage-endpoint: unix:///run/containerd/containerd.socktimeout: 10debug: falseEOF# 5. 校验systemctl status containerdcrictl info常见故障排查containerd 启动失败检查/etc/containerd/config.toml语法不能有多余空格K8s node 初始化报错 cgroup确认SystemdCgroup true镜像拉取超时检查镜像加速器配置切换阿里云 / 中科大镜像源重启后失效确认systemctl enable containerd执行成功swap、sysctl 配置写入永久文件