1
/var/run/containerd/containerd.sock
2

3
/var/run/crio/crio.sock
4

5
kubectl get nodes -o wide
6

7
crictl --runtime-endpoint unix:///var/run/containerd/containerd.sock info

1
// RuntimeService - 容器和 Pod 的生命周期管理
2
service RuntimeService {
3
    // Pod 管理
4
    rpc RunPodSandbox(RunPodSandboxRequest) returns (RunPodSandboxResponse);
5
    rpc StopPodSandbox(StopPodSandboxRequest) returns (StopPodSandboxResponse);
6
    rpc RemovePodSandbox(RemovePodSandboxRequest) returns (RemovePodSandboxResponse);
7
    rpc PodSandboxStatus(PodSandboxStatusRequest) returns (PodSandboxStatusResponse);
8
    rpc ListPodSandbox(ListPodSandboxRequest) returns (ListPodSandboxResponse);
9

10
    // 容器管理
11
    rpc CreateContainer(CreateContainerRequest) returns (CreateContainerResponse);
12
    rpc StartContainer(StartContainerRequest) returns (StartContainerResponse);
13
    rpc StopContainer(StopContainerRequest) returns (StopContainerResponse);
14
    rpc RemoveContainer(RemoveContainerRequest) returns (RemoveContainerResponse);
15
    rpc ContainerStatus(ContainerStatusRequest) returns (ContainerStatusResponse);
16
    rpc ListContainers(ListContainersRequest) returns (ListContainersResponse);
17
    // 其他
18
    rpc ExecSync(ExecSyncRequest) returns (ExecSyncResponse);
19
    rpc Exec(ExecRequest) returns (ExecResponse);
20
    rpc Attach(AttachRequest) returns (AttachResponse);
21
    rpc PortForward(PortForwardRequest) returns (PortForwardResponse);
22
}
23
// ImageService - 镜像管理
24
service ImageService {
25
    rpc ListImages(ListImagesRequest) returns (ListImagesResponse);
26
    rpc ImageStatus(ImageStatusRequest) returns (ImageStatusResponse);
27
    rpc PullImage(PullImageRequest) returns (PullImageResponse);
28
    rpc RemoveImage(RemoveImageRequest) returns (RemoveImageResponse);
29
    rpc ImageFsInfo(ImageFsInfoRequest) returns (ImageFsInfoResponse);
30
}

1
// containerd CRI 插件的核心映射（简化）
2
// RunPodSandbox → 创建 pause 容器
3
func (c *criService) RunPodSandbox(ctx context.Context, r *runtime.RunPodSandboxRequest) (*runtime.RunPodSandboxResponse, error) {
4
    // 1. 拉取 pause 镜像
5
    image, err := c.ensureImageExists(ctx, sandboxImage, config)
6

7
    // 2. 创建 containerd container（pause）
8
    container, err := c.containerService.Create(ctx, containerdContainer)
9

10
    // 3. 创建 task（启动容器进程）
11
    task, err := container.NewTask(ctx, cio.NewCreator())
12

13
    // 4. 设置网络（CNI）
14
    if config.NetworkConfig.PodCidr != "" {
15
        result, err := c.netPlugin.Setup(ctx, sandboxID, netnsPath)
16
    }
17

18
    // 5. 启动 task
19
    err = task.Start(ctx)
20

21
    return &runtime.RunPodSandboxResponse{PodSandboxId: sandboxID}, nil
22
}

1
spec:
2
  restartPolicy: Always    # 总是重启（默认）

1
// pause 容器的完整源码（kubernetes/build/pause/linux/pause.c）
2
#include <signal.h>
3
#include <stdio.h>
4
#include <stdlib.h>
5
#include <string.h>
6
#include <sys/types.h>
7
#include <unistd.h>
8

9
#define STRINGIFY(x) #x
10
#define VERSION_STRING(x) STRINGIFY(x)
11

12
#ifndef VERSION
13
#define VERSION HEAD
14
#endif
15

16
static void sigdown(int signo) {
17
  psignal(signo, "Shutting down, got signal");
18
  exit(0);
19
}
20

21
static void sigreap(int signo) {
22
  while (waitpid(-1, NULL, WNOHANG) > 0)
23
    ;
24
}
25

26
int main(int argc, char **argv) {
27
  int i;
28
  for (i = 1; i < argc; ++i) {
29
    if (!strcmp(argv[i], "-v")) {
30
      printf("pause " VERSION_STRING(VERSION) "\n");
31
      return 0;
32
    }
33
  }
34

35
  if (getpid() != 1)
36
    /* Not in a container, just sleep forever */
37
    while (1) sleep(10000);
38

39
  if (sigaction(SIGINT, &(struct sigaction){.sa_handler = sigdown}, NULL) < 0)
40
    return 1;
41
  if (sigaction(SIGTERM, &(struct sigaction){.sa_handler = sigdown}, NULL) < 0)
42
    return 1;
43
  if (sigaction(SIGCHLD, &(struct sigaction){.sa_handler = sigreap, .sa_flags = SA_NOCLDSTOP},
44
                NULL) < 0)
45
    return 1;
46

47
  for (;;)
48
    pause();
49
  fprintf(stderr, "Error: infinite loop terminated\n");
50
  return 42;
51
}

1
{
2
  "linux": {
3
    "namespaces": [
4
      {"type": "pid"},
5
      {"type": "ipc", "path": "/proc/3456/ns/ipc"},
6
      {"type": "uts", "path": "/proc/3456/ns/uts"},
7
      {"type": "mount"},
8
      {"type": "network", "path": "/proc/3456/ns/net"}
9
    ]
10
  }
11
}

1
crictl ps --name POD
2

3
ls -la /proc/$(crictl inspect abc123 | jq '.info.pid')/ns/
4

5
crictl inspect def456 | jq '.info.pid'
6
# 5678
7
ls -la /proc/5678/ns/net

1
apiVersion: v1
2
kind: Pod
3
metadata:
4
  name: app-with-log-collector
5
spec:
6
  containers:
7
    - name: app
8
      image: nginx:1.25
9
      volumeMounts:
10
        - name: logs
11
          mountPath: /var/log/nginx
12
    - name: log-collector
13
      image: fluent/fluentd:v1.16
14
      volumeMounts:
15
        - name: logs
16
          mountPath: /var/log/nginx
17
          readOnly: true
18
  volumes:
19
    - name: logs
20
      emptyDir: {}

1
apiVersion: v1
2
kind: Pod
3
metadata:
4
  name: app-with-db-proxy
5
spec:
6
  containers:
7
    - name: app
8
      image: myapp:latest
9
      env:
10
        - name: DB_HOST
11
          value: "127.0.0.1"  # 连接 Ambassador
12
        - name: DB_PORT
13
          value: "3306"
14
    - name: db-proxy
15
      image: prom/mysqld-exporter:latest

1
apiVersion: v1
2
kind: Pod
3
metadata:
4
  name: app-with-metrics-adapter
5
spec:
6
  containers:
7
    - name: app
8
      image: myapp:latest
9
    - name: metrics-adapter
10
      image: metrics-adapter:latest

1
apiVersion: v1
2
kind: Pod
3
metadata:
4
  name: app-with-init
5
spec:
6
  initContainers:
7
    - name: wait-for-db
8
      image: busybox:1.36
9
      command: ['sh', '-c', 'until nc -z db-service 5432; do echo waiting; sleep 2; done']
10
    - name: db-migrate
11
      image: myapp:latest
12
      command: ['sh', '-c', 'python manage.py migrate']
13
    - name: generate-config
14
      image: busybox:1.36
15
      command: ['sh', '-c', 'echo "config from $(hostname)" > /config/app.conf']
16
      volumeMounts:
17
        - name: config
18
          mountPath: /config
19
  containers:
20
    - name: app
21
      image: myapp:latest
22
      command: ['python', 'manage.py', 'runserver']
23
      volumeMounts:
24
        - name: config
25
          mountPath: /etc/app/config
26
  volumes:
27
    - name: config
28
      emptyDir: {}

1
# init-1: cpu=500m, memory=256Mi
2
# init-2: cpu=1000m, memory=128Mi
3
# app:    cpu=500m, memory=512Mi
4
# sidecar: cpu=200m, memory=128Mi

1
spec:
2
  initContainers:
3
    - name: log-collector
4
      image: fluent/fluentd:v1.16
5
      restartPolicy: Always    # 关键：标记为 Sidecar
6
      volumeMounts:
7
        - name: logs
8
          mountPath: /var/log
9
  containers:
10
    - name: app
11
      image: myapp:latest
12
      volumeMounts:
13
        - name: logs
14
          mountPath: /var/log
15
  volumes:
16
    - name: logs
17
      emptyDir: {}

1
spec:
2
  containers:
3
    - name: app
4
      image: nginx:1.25
5
      lifecycle:
6
        postStart:
7
          exec:
8
            command: ["/bin/sh", "-c", "echo 'Container started' > /tmp/started"]
9
        preStop:
10
          exec:
11
            command: ["/bin/sh", "-c", "nginx -s quit; while pgrep nginx; do sleep 1; done"]

1
kubectl describe pod my-app
2
# Events:

1
kubectl apply -f - <<EOF
2
apiVersion: v1
3
kind: Pod
4
metadata:
5
  name: demo-pod
6
spec:
7
  initContainers:
8
    - name: init-config
9
      image: busybox:1.36
10
      command: ['sh', '-c', 'echo "initialized" > /shared/config']
11
      volumeMounts:
12
        - name: shared
13
          mountPath: /shared
14
  containers:
15
    - name: app
16
      image: nginx:1.25
17
      volumeMounts:
18
        - name: shared
19
          mountPath: /usr/share/nginx/html
20
          readOnly: true
21
    - name: sidecar
22
      image: busybox:1.36
23
      command: ['sh', '-c', 'while true; do echo sidecar; sleep 10; done']
24
  volumes:
25
    - name: shared
26
      emptyDir: {}
27
EOF
28

29
crictl pods --name demo-pod
30

31
crictl ps -a --pod abc123
32

33
PAUSE_PID=$(crictl inspect def456 | jq '.info.pid')
34
ls -la /proc/$PAUSE_PID/ns/
35

36
APP_PID=$(crictl inspect jkl012 | jq '.info.pid')
37
readlink /proc/$APP_PID/ns/net
38

39
readlink /proc/$APP_PID/ns/mnt

1
kubectl apply -f - <<EOF
2
apiVersion: v1
3
kind: Pod
4
metadata:
5
  name: init-order-demo
6
spec:
7
  initContainers:
8
    - name: step-1
9
      image: busybox:1.36
10
      command: ['sh', '-c', 'echo "Step 1: $(date)" >> /log/init.log; sleep 3']
11
      volumeMounts:
12
        - name: log
13
          mountPath: /log
14
    - name: step-2
15
      image: busybox:1.36
16
      command: ['sh', '-c', 'echo "Step 2: $(date)" >> /log/init.log; sleep 3']
17
      volumeMounts:
18
        - name: log
19
          mountPath: /log
20
    - name: step-3
21
      image: busybox:1.36
22
      command: ['sh', '-c', 'echo "Step 3: $(date)" >> /log/init.log; sleep 3']
23
      volumeMounts:
24
        - name: log
25
          mountPath: /log
26
  containers:
27
    - name: app
28
      image: busybox:1.36
29
      command: ['sh', '-c', 'cat /log/init.log; sleep 3600']
30
      volumeMounts:
31
        - name: log
32
          mountPath: /log
33
  volumes:
34
    - name: log
35
      emptyDir: {}
36
EOF
37

38
kubectl get pods init-order-demo -w
39
# init-order-demo   0/1    1/1     Running           0
40

41
# 查看执行日志
42
kubectl logs init-order-demo app
43
# Step 1: Sat Apr 25 10:00:01 UTC 2026
44
# Step 2: Sat Apr 25 10:00:04 UTC 2026
45
# Step 3: Sat Apr 25 10:00:07 UTC 2026

1
# 创建一个带 preStop 钩子的 Pod
2
kubectl apply -f - <<EOF
3
apiVersion: v1
4
kind: Pod
5
metadata:
6
  name: graceful-shutdown
7
spec:
8
  terminationGracePeriodSeconds: 60
9
  containers:
10
    - name: app
11
      image: nginx:1.25
12
      lifecycle:
13
        preStop:
14
          exec:
15
            command: ["/bin/sh", "-c", "echo 'Graceful shutdown started' && nginx -s quit && sleep 10 && echo 'Graceful shutdown completed'"]
16
EOF
17

18
# 等待 Pod 运行
19
kubectl wait --for=condition=Ready pod/graceful-shutdown
20

21
# 删除 Pod 并观察事件
22
kubectl delete pod graceful-shutdown &
23
kubectl get events --field-selector involvedObject.name=graceful-shutdown -w
24
# 你会看到 preStop 钩子执行、SIGTERM 发送、容器退出的完整过程
25

26
# 对比：不带 preStop 的容器收到 SIGTERM 后可能直接退出
27
# Nginx 默认处理 SIGTERM 的方式是 worker 进程在处理完当前请求后退出

1
# 查看 containerd 版本和 CRI 支持情况
2
crictl info | jq '.config.cni'
3
crictl info | jq '.config.containerd.runtimes'
4
# {
5
#   "runc": {
6
#     "runtimeType": "io.containerd.runc.v2",
7
#     "options": {"BinaryName": "/usr/bin/runc"}
8
#   },
9
#   "runsc": {
10
#     "runtimeType": "io.containerd.runsc.v1",
11
#     "options": {"BinaryName": "/usr/bin/runsc"}
12
#   }
13
# }
14

15
# 查看容器运行时详情
16
kubectl get nodes -o jsonpath='{.items[0].status.nodeInfo.containerRuntimeVersion}'
17
# containerd://1.7.8
18

19
# 查看容器日志（通过 crictl）
20
CONTAINER_ID=$(crictl ps --name app -q | head -1)
21
crictl logs $CONTAINER_ID
22

23
# 在容器中执行命令
24
crictl exec $CONTAINER_ID cat /etc/hostname