1
// containerd 镜像管理示例
2
package main
3

4
import (
5
    "context"
6
    "fmt"
7
    "log"
8

9
    containerd "github.com/containerd/containerd/v2/client"
10
)
11

12
func main() {
13
    // 1. 连接 containerd
14
    client, err := containerd.New("/run/containerd/containerd.sock")
15
    if err != nil {
16
        log.Fatal(err)
17
    }
18
    defer client.Close()
19

20
    ctx := context.Background()
21

22
    // 2. 拉取镜像
23
    image, err := client.Pull(ctx, "docker.io/library/nginx:latest",
24
        containerd.WithPullUnpack,  // 自动解压
25
    )
26
    if err != nil {
27
        log.Fatal(err)
28
    }
29
    fmt.Printf("Pulled image: %s\n", image.Name())
30

31
    // 3. 创建容器
32
    container, err := client.NewContainer(ctx, "my-nginx",
33
        containerd.WithImage(image),
34
        containerd.WithNewSnapshot("my-nginx-snapshot", image),
35
        containerd.WithNewSpec(
36
            containerd.WithImageConfig(image),
37
            containerd.WithHostNamespace(containerd.NetworkNamespace),
38
        ),
39
    )
40
    if err != nil {
41
        log.Fatal(err)
42
    }
43
    defer container.Delete(ctx, containerd.WithSnapshotCleanup)
44

45
    // 4. 创建并启动任务
46
    task, err := container.NewTask(ctx, containerd.NewIO(os.Stdin, os.Stdout, os.Stderr))
47
    if err != nil {
48
        log.Fatal(err)
49
    }
50
    defer task.Delete(ctx)
51

52
    if err := task.Start(ctx); err != nil {
53
        log.Fatal(err)
54
    }
55

56
    // 5. 等待任务退出
57
    status, err := task.Wait(ctx)
58
    if err != nil {
59
        log.Fatal(err)
60
    }
61
    fmt.Printf("Task exited with status: %d\n", <-status)
62
}

1
# 使用 ctr 命令行操作 containerd
2

3
# 镜像操作
4
ctr images pull docker.io/library/nginx:latest
5
ctr images list
6
ctr images inspect docker.io/library/nginx:latest
7

8
# 容器操作
9
ctr containers create docker.io/library/nginx:latest mynginx
10
ctr containers list
11

12
# 任务操作
13
ctr tasks start mynginx
14
ctr tasks list
15
ctr tasks kill mynginx
16
ctr tasks attach mynginx
17

18
# 快照操作
19
ctr snapshots list
20
ctr snapshots prepare my-snapshot
21
ctr snapshots commit my-snapshot my-committed-snapshot

1
# 查看 containerd 的内容存储
2
ls /var/lib/containerd/io.containerd.content.v1.content/blobs/sha256/
3

4
# 查看已下载的 blob
5
ctr content list
6

7
# 查看快照
8
ctr snapshots list

1
# 查看 containerd 的 OverlayFS 快照
2
ls /var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/
3

4
# 查看快照的元数据
5
ctr snapshots list
6

7
# 查看容器的 OverlayFS 挂载
8
mount | grep overlay

1
# Container 可以没有 Task（已停止的容器）
2
ctr containers list
3
# NAME       IMAGE
4
# mynginx    nginx:latest
5

6
ctr tasks list
7
# TASK       PID     STATUS
8
# (空——容器未运行)
9

10
# 启动 Task
11
ctr tasks start mynginx
12
ctr tasks list
13
# TASK       PID     STATUS
14
# mynginx    12345   RUNNING

1
// containerd 的 Task 创建流程（简化）
2
func (c *container) NewTask(ctx context.Context, ioCreator IOCreator) (Task, error) {
3
    // 1. 获取容器的 rootfs 挂载点
4
    mounts, err := c.snapshotter.Mounts(ctx, c.snapshotID)
5

6
    // 2. 准备 OCI Bundle
7
    bundle := &Bundle{
8
        ID:      c.id,
9
        Path:    c.bundlePath,
10
        Rootfs:  mounts,
11
        Spec:    c.spec,
12
    }
13

14
    // 3. 启动 containerd-shim
15
    shim, err := shim.Start(ctx, bundle, c.runtime)
16
    if err != nil {
17
        return nil, err
18
    }
19

20
    // 4. 通过 shim 创建 Task
21
    task, err := shim.Create(ctx, &task.CreateRequest{
22
        ID:       c.id,
23
        Bundle:   bundle.Path,
24
        Rootfs:   mounts,
25
        Terminal: true,
26
        Stdin:    "/dev/null",
27
        Stdout:   "/dev/null",
28
        Stderr:   "/dev/null",
29
    })
30

31
    return task, nil
32
}

1
# 查看 containerd 的插件列表
2
ctr plugins list
3

4
# 输出示例：
5
# TYPE                            ID             PLATFORMS      STATUS
6
# io.containerd.content.v1        content        -              ok
7
# io.containerd.snapshotter.v1    overlayfs      linux/amd64    ok
8
# io.containerd.diff.v1           walking        linux/amd64    ok
9
# io.containerd.runtime.v2        task/shim      -              ok
10
# io.containerd.service.v1        diff           -              ok
11
# io.containerd.service.v1        images         -              ok
12
# io.containerd.service.v1        containers     -              ok
13
# io.containerd.service.v1        tasks          -              ok
14
# io.containerd.grpc.v1           containers     -              ok
15
# io.containerd.grpc.v1           content        -              ok
16
# io.containerd.grpc.v1           diff           -              ok
17
# io.containerd.grpc.v1           images         -              ok
18
# io.containerd.grpc.v1           introspection  -              ok
19
# io.containerd.grpc.v1           leases         -              ok
20
# io.containerd.grpc.v1           namespaces     -              ok
21
# io.containerd.grpc.v1           snapshots      -              ok
22
# io.containerd.grpc.v1           tasks          -              ok
23
# io.containerd.cri.v1            cri            -              ok

1
// 自定义 Snapshotter 插件（简化骨架）
2
package mysnapshotter
3

4
import (
5
    "context"
6
    "github.com/containerd/containerd/v2/plugins/snapshots"
7
)
8

9
type mySnapshotter struct {
10
    root string
11
}
12

13
func NewSnapshotter(root string) snapshots.Snapshotter {
14
    return &mySnapshotter{root: root}
15
}
16

17
func (s *mySnapshotter) Prepare(ctx context.Context, key, parent string, opts ...snapshots.Opt) ([]mount.Mount, error) {
18
    // 创建可写快照
19
    return nil, nil
20
}
21

22
func (s *mySnapshotter) Commit(ctx context.Context, name, key string, opts ...snapshots.Opt) error {
23
    // 提交快照为只读
24
    return nil
25
}
26

27
func (s *mySnapshotter) Mounts(ctx context.Context, key string) ([]mount.Mount, error) {
28
    // 返回挂载点
29
    return nil, nil
30
}
31

32
func (s *mySnapshotter) Remove(ctx context.Context, key string) error {
33
    // 删除快照
34
    return nil
35
}

1
# 订阅 containerd 事件
2
ctr events
3

4
# 输出示例：
5
# ENVELOPE TIMESTAMP                TOPIC                EVENT
6
# 1       2026-08-14T10:00:00Z     /containers/create   {"id":"mynginx",...}
7
# 2       2026-08-14T10:00:01Z     /tasks/create        {"id":"mynginx",...}
8
# 3       2026-08-14T10:00:01Z     /tasks/start         {"id":"mynginx",...}

1
// CRI 事件处理（简化）
2
func (c *criService) handleEvent(event *eventtypes.Event) {
3
    switch event.Topic {
4
    case "/tasks/exit":
5
        // 容器退出，更新 Pod 状态
6
        c.handleContainerExit(event)
7
    case "/tasks/oom":
8
        // 容器 OOM，记录事件
9
        c.handleContainerOOM(event)
10
    }
11
}

1
package main
2

3
import (
4
    "context"
5
    "fmt"
6
    "log"
7
    "os"
8
    "syscall"
9

10
    containerd "github.com/containerd/containerd/v2/client"
11
    "github.com/containerd/containerd/v2/pkg/namespaces"
12
)
13

14
func main() {
15
    ctx := namespaces.WithNamespace(context.Background(), "default")
16

17
    client, err := containerd.New("/run/containerd/containerd.sock")
18
    if err != nil {
19
        log.Fatal(err)
20
    }
21
    defer client.Close()
22

23
    // 拉取镜像
24
    image, err := client.Pull(ctx, "docker.io/library/redis:alpine",
25
        containerd.WithPullUnpack,
26
    )
27
    if err != nil {
28
        log.Fatal(err)
29
    }
30
    fmt.Printf("Pulled: %s\n", image.Name())
31

32
    // 创建容器
33
    container, err := client.NewContainer(ctx, "my-redis",
34
        containerd.WithImage(image),
35
        containerd.WithNewSnapshot("redis-snap", image),
36
        containerd.WithNewSpec(
37
            containerd.WithImageConfig(image),
38
        ),
39
    )
40
    if err != nil {
41
        log.Fatal(err)
42
    }
43
    defer container.Delete(ctx, containerd.WithSnapshotCleanup)
44

45
    // 创建任务
46
    task, err := container.NewTask(ctx, containerd.NewIO(os.Stdin, os.Stdout, os.Stderr))
47
    if err != nil {
48
        log.Fatal(err)
49
    }
50
    defer task.Delete(ctx)
51

52
    // 启动任务
53
    if err := task.Start(ctx); err != nil {
54
        log.Fatal(err)
55
    }
56

57
    // 等待退出
58
    statusC, err := task.Wait(ctx)
59
    if err != nil {
60
        log.Fatal(err)
61
    }
62

63
    // 发送 SIGTERM
64
    task.Kill(ctx, syscall.SIGTERM)
65
    status := <-statusC
66
    fmt.Printf("Redis exited: %v\n", status)
67
}

1
# 查看 containerd 日志
2
journalctl -u containerd -f
3

4
# 查看 containerd 的 gRPC 调试端点
5
curl --unix-socket /run/containerd/containerd.sock http://localhost/v2/
6

7
# 查看容器详情
8
ctr containers inspect mynginx
9

10
# 查看任务详情
11
ctr tasks inspect mynginx
12

13
# 查看镜像层
14
ctr images inspect docker.io/library/nginx:latest | jq .rootfs
15

16
# 查看快照信息
17
ctr snapshots inspect mynginx-snap
18

19
# 查看内容信息
20
ctr content inspect sha256:abc123...