containerd 2.x 配置 Harbor 私有仓库

原创已于 2026-05-09 09:55:32 修改 · 85 阅读

0 ·

本内容遵循CC 4.0 BY-SA版权协议

GEO检测

标签

#运维 #k8s

于 2026-05-09 09:17:29 首次发布

containerd 2.x 配置 Harbor 私有仓库，推荐两种方式：

方式一（推荐）：`certs.d` 方式（containerd 1.5+ / 2.x 推荐）

这种方式不用改 config.toml，更干净。

假设 Harbor 地址：

192.168.30.221

1. 创建目录

sudo mkdir -p /etc/containerd/certs.d/192.168.30.221

2. 创建 `hosts.toml`

sudo vi /etc/containerd/certs.d/192.168.30.221/hosts.toml

内容：

如果是 HTTP（内网常用）

server = "http://192.168.30.221"

[host."http://192.168.30.221"]
  capabilities = ["pull", "resolve", "push"]
  skip_verify = true

排错

出现错误
HTTP/1.1 308 Permanent Redirect
Location: https://10.2.2.240:443/v2/
说明 Harbor 强制 HTTP 跳转 HTTPS，不是纯 HTTP，需要将 hosts.toml 改为

server = "https://192.168.30.221"

[host."https://192.168.30.221"]
  capabilities = ["pull", "resolve", "push"]
  skip_verify = true

最后现象

root@master:/etc/containerd# sudo ctr images pull \
  --hosts-dir /etc/containerd/certs.d \
  --user admin:Aa12345 \
  192.168.30.221/library/mysql:latest
192.168.30.221/library/mysql:latest         	saved	
└──manifest (88b1423f0c31)              	complete   	|++++++++++++++++++++++++++++++++++++++|	
   ├──config (2c5440daffa8)             	complete   	|++++++++++++++++++++++++++++++++++++++|	
   ├──layer (4ea0fa0ace0c)              	extracted  	|++++++++++++++++++++++++++++++++++++++|	
   ├──layer (9effc86d91a3)              	extracted  	|++++++++++++++++++++++++++++++++++++++|	
   ├──layer (500d7b2546c4)              	extracted  	|++++++++++++++++++++++++++++++++++++++|	
   ├──layer (fc5138e88017)              	extracted  	|++++++++++++++++++++++++++++++++++++++|	
   ├──layer (b534c7c08c95)              	extracted  	|++++++++++++++++++++++++++++++++++++++|	
   ├──layer (5525b1bd2d5d)              	extracted  	|++++++++++++++++++++++++++++++++++++++|	
   ├──layer (fc3e1c37f699)              	extracted  	|++++++++++++++++++++++++++++++++++++++|	
   ├──layer (a1bcea418c7c)              	extracted  	|++++++++++++++++++++++++++++++++++++++|	
   ├──layer (30e3c68e682c)              	extracted  	|++++++++++++++++++++++++++++++++++++++|	
   └──layer (50786f9db9d5)              	extracted  	|++++++++++++++++++++++++++++++++++++++|	
application/vnd.docker.distribution.manifest.v2+json sha256:88b1423f0c3138fc488828126472b669fb6e442c2f9080701e18478a3b3a8171
Completed pull from OCI Registry (192.168.30.221/library/mysql:latest)	elapsed: 56.4s	total:  262.8 	(4.7 MiB/s)	
root@master:/etc/containerd# sudo ctr images ls
REF                             TYPE                                                 DIGEST                                                                  SIZE      PLATFORMS   LABELS 
192.168.30.221/library/mysql:latest application/vnd.docker.distribution.manifest.v2+json sha256:88b1423f0c3138fc488828126472b669fb6e442c2f9080701e18478a3b3a8171 262.8 MiB linux/amd64 -

如果是 HTTPS + 自签名证书

server = "https://192.168.30.221"

[host."https://192.168.30.221"]
  capabilities = ["pull", "resolve", "push"]
  ca = "/etc/containerd/certs.d/192.168.30.221/ca.crt"
  skip_verify = true

然后把 Harbor CA 放进去：

sudo cp ca.crt /etc/containerd/certs.d/192.168.30.221/

3. 重启 containerd

sudo systemctl restart containerd

4. 拉取测试

sudo ctr images pull \
  --user admin:Aa12345 \
  192.168.30.221/library/mysql:latest

方式二：修改 `config.toml`

先生成默认配置（如果没有）：

sudo containerd config default > /etc/containerd/config.toml

编辑：

sudo vi /etc/containerd/config.toml

找到：

[plugins."io.containerd.grpc.v1.cri".registry]

改成：

[plugins."io.containerd.grpc.v1.cri".registry]

  [plugins."io.containerd.grpc.v1.cri".registry.mirrors]

    [plugins."io.containerd.grpc.v1.cri".registry.mirrors."192.168.30.221"]
      endpoint = ["http://192.168.30.221"]

保存后：

sudo systemctl restart containerd

验证配置是否生效

查看：

sudo ctr version

测试：

sudo ctr images pull --user admin:Aa12345 192.168.30.221/library/mysql:latest

成功会看到：

unpacking linux/amd64 sha256:...
done

推荐你用哪个？

你的环境是：

Harbor 用 IP：192.168.30.221
证书报 IP SAN 错误
内网

建议直接用 方式一（certs.d + http）：

server = "http://192.168.30.221"

最快，最稳，不折腾证书。

kubelet

ctr：靠 --hosts-dir 成功
kubelet：直接走 HTTPS → x509 报错

在 `config.toml` 里加

方案 1（推荐：最简单

[plugins."io.containerd.grpc.v1.cri".registry]

  [plugins."io.containerd.grpc.v1.cri".registry.configs."192.168.30.221".tls]
    insecure_skip_verify = true

方案 2（mirror 方式）

[plugins."io.containerd.grpc.v1.cri".registry.mirrors."192.168.30.221"]
  endpoint = ["https://192.168.30.221"]

你这个环境必须注意: 你 Harbor 是 HTTP -> 308 -> HTTPS 所以必须走 HTTPS，但跳过证书验证

修改后必须执行

sudo systemctl restart containerd
sudo systemctl restart kubelet

验证 kubelet 是否生效

crictl pull 192.168.30.221/library/mysql:latest
# 或者
kubectl run test --image=192.168.30.221/library/mysql:latest