https://liangyuanpeng.com/post/registry-mirrors-for-containerd/
https://gist.github.com/qwfys/aec4d2ab79281aeafebdb40b22d0b748
https://kubernetes.feisky.xyz/appendix/mirrors
https://www.cnblogs.com/wubolive/p/17317586.html （有用）
https://blog.realvarez.com/use-containerd-to-handle-k8s-gcr-io-deprecation/
下载失败
[root@VM-201-31-centos ~]# ctr images pull registry.k8s.io/pause:3.7
registry.k8s.io/pause:3.7: resolving |--------------------------------------|
elapsed: 30.4s total: 0.0 B (0.0 B/s)
INFO[0030] trying next host error="failed to do request: Head \"https://us-west2-docker.pkg.dev/v2/k8s-artifacts-prod/images/pause/manifests/3.7\": dial tcp 64.233.188.82:443: i/o timeout" host=registry.k8s.io
ctr: failed to resolve reference "registry.k8s.io/pause:3.7": failed to do request: Head "https://us-west2-docker.pkg.dev/v2/k8s-artifacts-prod/images/pause/manifests/3.7": dial tcp 64.233.188.82:443: i/o timeout
debug 过程
[root@VM-201-31-centos containerd]# ctr --debug images pull registry.k8s.io/pause:3.7
DEBU[0000] fetching image="registry.k8s.io/pause:3.7"
DEBU[0000] resolving host=registry.k8s.io
DEBU[0000] do request host=registry.k8s.io request.header.accept="application/vnd.docker.distribution.manifest.v2+json, application/vnd.docker.distribution.manifest.list.v2+json, application/vnd.oci.image.manifest.v1+json, application/vnd.oci.image.index.v1+json, */*" request.header.user-agent=containerd/1.6.28 request.method=HEAD url="https://registry.k8s.io/v2/pause/manifests/3.7"
INFO[0030] trying next host error="failed to do request: Head \"https://us-west2-docker.pkg.dev/v2/k8s-artifacts-prod/images/pause/manifests/3.7\": dial tcp 173.194.174.82:443: i/o timeout" host=registry.k8s.io
ctr: failed to resolve reference "registry.k8s.io/pause:3.7": failed to do request: Head "https://us-west2-docker.pkg.dev/v2/k8s-artifacts-prod/images/pause/manifests/3.7": dial tcp 173.194.174.82:443: i/o timeout
修改配置文件
config.toml
[plugins."io.containerd.grpc.v1.cri".registry]
config_path = "/etc/containerd/certs.d"
certs.d/registry.k8s.io/hosts.toml
server = "registry.k8s.io"
[host."https://registry.aliyuncs.com/v2/google_containers"]
capabilities = ["pull", "resolve"]
override_path = true
必须指定 --hosts-dir 才能通过mirror下载
[root@VM-201-31-centos containerd]# ctr images pull --hosts-dir /etc/containerd/certs.d/ registry.k8s.io/pause:3.7
registry.k8s.io/pause:3.7: resolved |++++++++++++++++++++++++++++++++++++++|
index-sha256:bb6ed397957e9ca7c65ada0db5c5d1c707c9c8afc80a94acbe69f3ae76988f0c: done |++++++++++++++++++++++++++++++++++++++|
manifest-sha256:f81611a21cf91214c1ea751c5b525931a0e2ebabe62b3937b6158039ff6f922d: done |++++++++++++++++++++++++++++++++++++++|
layer-sha256:7582c2cc65ef30105b84c1c6812f71c8012663c6352b01fe2f483238313ab0ed: done |++++++++++++++++++++++++++++++++++++++|
config-sha256:221177c6082a88ea4f6240ab2450d540955ac6f4d5454f0e15751b653ebda165: done |++++++++++++++++++++++++++++++++++++++|
elapsed: 0.9 s total: 4.2 Ki (4.6 KiB/s)
unpacking linux/amd64 sha256:bb6ed397957e9ca7c65ada0db5c5d1c707c9c8afc80a94acbe69f3ae76988f0c...
done: 52.164897ms
debug 过程
[root@VM-201-31-centos containerd]# ctr --debug images pull --hosts-dir /etc/containerd/certs.d/ registry.k8s.io/pause:3.7
DEBU[0000] fetching image="registry.k8s.io/pause:3.7"
DEBU[0000] loading host directory dir=/etc/containerd/certs.d/registry.k8s.io
DEBU[0000] resolving host=registry.aliyuncs.com
DEBU[0000] do request host=registry.aliyuncs.com request.header.accept="application/vnd.docker.distribution.manifest.v2+json, application/vnd.docker.distribution.manifest.list.v2+json, application/vnd.oci.image.manifest.v1+json, application/vnd.oci.image.index.v1+json, */*" request.header.user-agent=containerd/1.6.28 request.method=HEAD url="https://registry.aliyuncs.com/v2/google_containers/pause/manifests/3.7?ns=registry.k8s.io"
DEBU[0000] fetch response received host=registry.aliyuncs.com response.header.content-length=166 response.header.content-type="application/json; charset=utf-8" response.header.date="Thu, 29 Feb 2024 14:10:59 GMT" response.header.docker-distribution-api-version=registry/2.0 response.header.www-authenticate="Bearer realm=\"https://dockerauth.cn-hangzhou.aliyuncs.com/auth\",service=\"registry.aliyuncs.com:cn-hangzhou:26842\",scope=\"repository:google_containers/pause:pull\"" response.status="401 Unauthorized" url="https://registry.aliyuncs.com/v2/google_containers/pause/manifests/3.7?ns=registry.k8s.io"
DEBU[0000] Unauthorized header="Bearer realm=\"https://dockerauth.cn-hangzhou.aliyuncs.com/auth\",service=\"registry.aliyuncs.com:cn-hangzhou:26842\",scope=\"repository:google_containers/pause:pull\"" host=registry.aliyuncs.com
DEBU[0000] do request host=registry.aliyuncs.com request.header.accept="application/vnd.docker.distribution.manifest.v2+json, application/vnd.docker.distribution.manifest.list.v2+json, application/vnd.oci.image.manifest.v1+json, application/vnd.oci.image.index.v1+json, */*" request.header.user-agent=containerd/1.6.28 request.method=HEAD url="https://registry.aliyuncs.com/v2/google_containers/pause/manifests/3.7?ns=registry.k8s.io"
DEBU[0000] fetch response received host=registry.aliyuncs.com response.header.content-length=2761 response.header.content-type=application/vnd.docker.distribution.manifest.list.v2+json response.header.date="Thu, 29 Feb 2024 14:10:59 GMT" response.header.docker-content-digest="sha256:bb6ed397957e9ca7c65ada0db5c5d1c707c9c8afc80a94acbe69f3ae76988f0c" response.header.docker-distribution-api-version=registry/2.0 response.header.etag="\"sha256:bb6ed397957e9ca7c65ada0db5c5d1c707c9c8afc80a94acbe69f3ae76988f0c\"" response.status="200 OK" url="https://registry.aliyuncs.com/v2/google_containers/pause/manifests/3.7?ns=registry.k8s.io"
DEBU[0000] resolved desc.digest="sha256:bb6ed397957e9ca7c65ada0db5c5d1c707c9c8afc80a94acbe69f3ae76988f0c" host=registry.aliyuncs.com
DEBU[0000] loading host directory dir=/etc/containerd/certs.d/registry.k8s.io
DEBU[0000] fetch digest="sha256:bb6ed397957e9ca7c65ada0db5c5d1c707c9c8afc80a94acbe69f3ae76988f0c" mediatype=application/vnd.docker.distribution.manifest.list.v2+json size=2761
DEBU[0000] fetch digest="sha256:f81611a21cf91214c1ea751c5b525931a0e2ebabe62b3937b6158039ff6f922d" mediatype=application/vnd.docker.distribution.manifest.v2+json size=526
DEBU[0000] fetch digest="sha256:7582c2cc65ef30105b84c1c6812f71c8012663c6352b01fe2f483238313ab0ed" mediatype=application/vnd.docker.image.rootfs.diff.tar.gzip size=307023
DEBU[0000] fetch digest="sha256:221177c6082a88ea4f6240ab2450d540955ac6f4d5454f0e15751b653ebda165" mediatype=application/vnd.docker.container.image.v1+json size=968
DEBU[0000] unpacking image="registry.k8s.io/pause:3.7"
unpacking linux/amd64 sha256:bb6ed397957e9ca7c65ada0db5c5d1c707c9c8afc80a94acbe69f3ae76988f0c...
done: 11.492205ms
为什么必须指定 --hosts-dir 才能生效
https://blog.realvarez.com/use-containerd-to-handle-k8s-gcr-io-deprecation/
https://github.com/containerd/containerd/discussions/7897#discussioncomment-4574365
Apparently, ctr cannot be configured to behave the way I want. According to this discussion on the containerd repo, you are expected to either create a custom wrapper script or shell alias that will automatically inject --hosts-dir, or you should use an alternate containerd client which supports configuration in the same way that the docker CLI behaved: one such example is nerdctl.
只有使用特殊客户端才能避免使用 --hosts-dir。
k3s、microk8s 配置后就能下载镜像。
