# 1. 背景


![image.png](/static/img/cf2436b8e28b314e765def640570389a.image.webp)
containerd config.tmol v3标准出来很久了,而且在containerd2.1版本之后将不再支持旧的配置版本. 但到目前很多项目仍然在使用旧的配置版本. 如果在网上搜类似的文档,会得到很多使用旧版配置的内容, 进行像下面这样的配置:
``` toml
 [plugins."io.containerd.grpc.v1.cri".registry.mirrors]
        [plugins."io.containerd.grpc.v1.cri".registry.mirrors."myregistry"]
          endpoint = ["myregistry"]
 ...
  [plugins."io.containerd.grpc.v1.cri".registry.configs."myregistry".tls]
          insecure_skip_verify = true

``` 
然后就会在containerd的日志中看到类似这样的警告:

``` log
The `mirrors` property of `[plugins."io.containerd.grpc.v1.cri".registry]` is deprecated
```

本文会简短的以一个真实的示例来说明怎么使用v3 版本 配置文件，以及如何配置私有镜像仓库免TLS认证, 以及过程中遇到的坑.


# 1. 安装 containerd 
本示例containerd版本: v2.0.4. 安装过程不再赘述, 可以使用apt/dnf 等包管理工具，也可以使用二进制手动安装. 具体请参考文档: 
[Getting started with containerd](https://github.com/containerd/containerd/blob/main/docs/getting-started.md)

# 2. 生成空白 config.toml 文件. 默认会放置在目录 /etc/containerd 

# 3. 编辑/etc/containerd/config.toml 内容如下
注意: 
1. 里面使用了 'local1.harbor.com:8443' 私有仓库. 后面还会有怼他的配置.
2. config_path = "/etc/containerd/certs.d" 必须填写, 否则无法找到私有仓库的配置地址.

``` toml
version = 3
root = '/var/lib/containerd'
state = '/run/containerd'
temp = ''
plugin_dir = ''
disabled_plugins = []
required_plugins = []
oom_score = 0
imports = []

[grpc]
  address = '/run/containerd/containerd.sock'
  tcp_address = ''
  tcp_tls_ca = ''
  tcp_tls_cert = ''
  tcp_tls_key = ''
  uid = 0
  gid = 0
  max_recv_message_size = 16777216
  max_send_message_size = 16777216

[ttrpc]
  address = ''
  uid = 0
  gid = 0

[debug]
  address = ''
  uid = 0
  gid = 0
  level = ''
  format = ''

[metrics]
  address = ''
  grpc_histogram = false

[plugins]
  [plugins.'io.containerd.cri.v1.images']
    snapshotter = 'overlayfs'
    disable_snapshot_annotations = true
    discard_unpacked_layers = false
    max_concurrent_downloads = 3
    image_pull_progress_timeout = '15m0s'
    image_pull_with_sync_fs = false
    stats_collect_period = 10

    [plugins.'io.containerd.cri.v1.images'.pinned_images]
      sandbox = 'local1.harbor.com:8443/kubeapps/pause:3.10'

    [plugins.'io.containerd.cri.v1.images'.registry]
      config_path = "/etc/containerd/certs.d"



    [plugins.'io.containerd.cri.v1.images'.image_decryption]
      key_model = 'node'

  [plugins.'io.containerd.cri.v1.runtime']
    enable_selinux = false
    selinux_category_range = 1024
    max_container_log_line_size = 16384
    disable_apparmor = false
    restrict_oom_score_adj = false
    disable_proc_mount = false
    unset_seccomp_profile = ''
    tolerate_missing_hugetlb_controller = true
    disable_hugetlb_controller = true
    device_ownership_from_security_context = false
    ignore_image_defined_volumes = false
    netns_mounts_under_state_dir = false
    enable_unprivileged_ports = true
    enable_unprivileged_icmp = true
    enable_cdi = true
    cdi_spec_dirs = ['/etc/cdi', '/var/run/cdi']
    drain_exec_sync_io_timeout = '0s'
    ignore_deprecation_warnings = []

    [plugins.'io.containerd.cri.v1.runtime'.containerd]
      default_runtime_name = 'runc'
      ignore_blockio_not_enabled_errors = false
      ignore_rdt_not_enabled_errors = false

      [plugins.'io.containerd.cri.v1.runtime'.containerd.runtimes]
        [plugins.'io.containerd.cri.v1.runtime'.containerd.runtimes.runc]
          runtime_type = 'io.containerd.runc.v2'
          runtime_path = ''
          pod_annotations = []
          container_annotations = []
          privileged_without_host_devices = false
          privileged_without_host_devices_all_devices_allowed = false
          base_runtime_spec = ''
          cni_conf_dir = ''
          cni_max_conf_num = 0
          snapshotter = ''
          sandboxer = 'podsandbox'
          io_type = ''

          [plugins.'io.containerd.cri.v1.runtime'.containerd.runtimes.runc.options]
            BinaryName = ''
            CriuImagePath = ''
            CriuWorkPath = ''
            IoGid = 0
            IoUid = 0
            NoNewKeyring = false
            Root = ''
            ShimCgroup = ''

    [plugins.'io.containerd.cri.v1.runtime'.cni]
      bin_dir = '/opt/cni/bin'
      conf_dir = '/etc/cni/net.d'
      max_conf_num = 1
      setup_serially = false
      conf_template = '/etc/cni/net.d/10-default.conf'
      ip_pref = ''
      use_internal_loopback = false

  [plugins.'io.containerd.gc.v1.scheduler']
    pause_threshold = 0.02
    deletion_threshold = 0
    mutation_threshold = 100
    schedule_delay = '0s'
    startup_delay = '100ms'

  [plugins.'io.containerd.grpc.v1.cri']
    disable_tcp_service = true
    stream_server_address = '127.0.0.1'
    stream_server_port = '0'
    stream_idle_timeout = '4h0m0s'
    enable_tls_streaming = false

    [plugins.'io.containerd.grpc.v1.cri'.x509_key_pair_streaming]
      tls_cert_file = ''
      tls_key_file = ''

  [plugins.'io.containerd.image-verifier.v1.bindir']
    bin_dir = '/opt/containerd/image-verifier/bin'
    max_verifiers = 10
    per_verifier_timeout = '10s'

  [plugins.'io.containerd.internal.v1.opt']
    path = '/opt/containerd'

  [plugins.'io.containerd.internal.v1.tracing']

  [plugins.'io.containerd.metadata.v1.bolt']
    content_sharing_policy = 'shared'

  [plugins.'io.containerd.monitor.container.v1.restart']
    interval = '10s'

  [plugins.'io.containerd.monitor.task.v1.cgroups']
    no_prometheus = false

  [plugins.'io.containerd.nri.v1.nri']
    disable = false
    socket_path = '/var/run/nri/nri.sock'
    plugin_path = '/opt/nri/plugins'
    plugin_config_path = '/etc/nri/conf.d'
    plugin_registration_timeout = '5s'
    plugin_request_timeout = '2s'
    disable_connections = false

  [plugins.'io.containerd.runtime.v2.task']
    platforms = ['linux/arm64']

  [plugins.'io.containerd.service.v1.diff-service']
    default = ['walking']
    sync_fs = false

  [plugins.'io.containerd.service.v1.tasks-service']
    blockio_config_file = ''
    rdt_config_file = ''

  [plugins.'io.containerd.shim.v1.manager']
    env = []

  [plugins.'io.containerd.snapshotter.v1.blockfile']
    root_path = ''
    scratch_file = ''
    fs_type = ''
    mount_options = []
    recreate_scratch = false

  [plugins.'io.containerd.snapshotter.v1.btrfs']
    root_path = ''

  [plugins.'io.containerd.snapshotter.v1.devmapper']
    root_path = ''
    pool_name = ''
    base_image_size = ''
    async_remove = false
    discard_blocks = false
    fs_type = ''
    fs_options = ''

  [plugins.'io.containerd.snapshotter.v1.native']
    root_path = ''

  [plugins.'io.containerd.snapshotter.v1.overlayfs']
    root_path = ''
    upperdir_label = false
    sync_remove = false
    slow_chown = false
    mount_options = []

  [plugins.'io.containerd.snapshotter.v1.zfs']
    root_path = ''

  [plugins.'io.containerd.tracing.processor.v1.otlp']

  [plugins.'io.containerd.transfer.v1.local']
    max_concurrent_downloads = 3
    max_concurrent_uploaded_layers = 3
    config_path = ''

[cgroup]
  path = ''

[timeouts]
  'io.containerd.timeout.bolt.open' = '0s'
  'io.containerd.timeout.metrics.shimstats' = '2s'
  'io.containerd.timeout.shim.cleanup' = '5s'
  'io.containerd.timeout.shim.load' = '5s'
  'io.containerd.timeout.shim.shutdown' = '3s'
  'io.containerd.timeout.task.state' = '2s'

[stream_processors]
  [stream_processors.'io.containerd.ocicrypt.decoder.v1.tar']
    accepts = ['application/vnd.oci.image.layer.v1.tar+encrypted']
    returns = 'application/vnd.oci.image.layer.v1.tar'
    path = 'ctd-decoder'
    args = ['--decryption-keys-path', '/etc/containerd/ocicrypt/keys']
    env = ['OCICRYPT_KEYPROVIDER_CONFIG=/etc/containerd/ocicrypt/ocicrypt_keyprovider.conf']

  [stream_processors.'io.containerd.ocicrypt.decoder.v1.tar.gzip']
    accepts = ['application/vnd.oci.image.layer.v1.tar+gzip+encrypted']
    returns = 'application/vnd.oci.image.layer.v1.tar+gzip'
    path = 'ctd-decoder'
    args = ['--decryption-keys-path', '/etc/containerd/ocicrypt/keys']
    env = ['OCICRYPT_KEYPROVIDER_CONFIG=/etc/containerd/ocicrypt/ocicrypt_keyprovider.conf']
```

# 3. 配置私有镜像仓库

1. 在 /etc/containerd/certs.d 下创建目录 'local1.harbor.com:8443' **请注意，如果私有仓库不是使用的443 或80端口，目录名称一定要包含端口**.
2.  在 local1.harbor.com:8443 目录下创建 hosts.toml 文件
``` toml
server = "https://local1.harbor.com:8443"

[host."https://local1.harbor.com:8443"]
    capabilities = ["pull", "resolve", "push"]
    skip_verify = true
```
4.  重启 containerd 服务
``` shell
systemctl daemon-reload
systemctl restart containerd.service
```
6.  拉取镜像测试
``` shell
root@master-01:~# crictl  pull local1.harbor.com:8443/kubeapps/ubuntu/ubuntu:24.04
Image is up to date for sha256:7fc8925289a890695754108847a52df143c50fb950d185b28ec19be502d09071

```

# 4. 镜像加速

``` toml
server = "docker.io"

[host."https://docker.1ms.run"]
        capabilities = ["pull", "resolve"]
        skip_verify = true

[host."https://hub1.nat.tf"]
        capabilities = ["pull", "resolve"]
        skip_verify = true

[host."https://docker.1panel.live"]
        capabilities = ["pull", "resolve"]
        skip_verify = true

[host."https://proxy.1panel.live"]
        capabilities = ["pull", "resolve"]
        skip_verify = true

[host."https://hub.rat.dev"]
        capabilities = ["pull", "resolve"]
        skip_verify = true

[host."https://docker.amingg.com"]
        capabilities = ["pull", "resolve"]
        skip_verify = true
```


# The End

containerd config.toml v3 私有镜像仓库配置示例

### 震惊!Moto手机官方页面竟然出现图片错误
#### 真是一个草台的世界啊. 简直不能忍.

![image.png](/static/img/7b20b027921447a3f10e10f86607f39a.image.webp)

草台的世界

# 背景

在前端开发过程中,多数情况下，由于资金成本及其他因素的影响,尤其是一些中小型项目, 并不会花费太多时间专门处理 'aria-hidden' 相关的问题. 这也导致一些前端应用框架(非vue,react等原始框架), 在某些应用场景，比如弹出modal窗口的时候会出现如下警告或报错.

![image.png](/static/img/11fb1be38c97059310d5b069d4345f17.image.webp)




当然，如果去搜索这个问题，会得到一个几乎通用的答案(此处以ant-design-vue框架为例), 如下所示，即隐藏 aria-hidden='true' 的元素。

```
.ant-modal-root div[aria-hidden='true'] {
  display: none;
}
```
本文的讨论基于以上背景展开.

# 意外的问题及解决过程
在开发的一段时间内，博主本人也是按照通用方案解决这个问题的，而且效果很好。直到添加了一个xterm.js库并使用其展示websocket相应数据，相应的数据并没有被显示，从 debug log中可以看到数据确实在实时返回，虽然看不到数据但 可以看到垂直滑动条，这都说明其实是有数据的，但是并没有被显示，如下图所示:

![image.png](/static/img/efa1768a2cc2136b7fda6d9d873d4745.image.webp)

反复多次查看网页元素，发现 xtrm.js 渲染时候使用了 aria-hidden='true' , 而把通用解决方案拿掉，显示就正常了。所以可以断定通用解决方案正好把这个元素隐藏了。

![image.png](/static/img/396c81c27e27d8018c64c6f3011385da.image.webp)

因为并没有在 xterm.js 中找到 'aria-hidden' 相关的特殊设置. 所以，接下来只要在通用解决方案中排除 'xterm-rows' 这个类即可，所以解决方案变成了下面这样:

```
.ant-modal-root div:not(.xterm-rows)[aria-hidden='true'] {
  display: none;
}
```

确实，这样会起作用，但是只起了一点作用，看下面的图，是现在的输出:

![image.png](/static/img/93d90affc2f502aac89912c42d271903.image.webp)

可以看到，有输出了，但是字体是混乱的(正确的字体显示会在后面看到), 所以怀疑是不是还有别的元素被这个解决方案隐藏了。于是在浏览器页面元素一个一个点开看，终于又找打了一个，而这个正好是关于xtrm.js 字体定义的部分, 如下所示:

![image.png](/static/img/13d0b2b7d32779eed1d4d64f60bc7bcf.image.webp)

ok. 基本稳了，现在把 'xterm-width-cache-measure-container' 类也排除掉, 于是决绝方案就变成了下面的样子:

```
.ant-modal-root div:not(.xterm-rows, .xterm-width-cache-measure-container)[aria-hidden='true'] {
  display: none;
}
```

再次测试，发现正常了

![image.png](/static/img/06016279c6c11368d5a9686a5d568b67.image.webp)

## 总结

现在来看这个问题不复杂, 按部就班, 一条一条梳理, 就解决了。但是如果单纯的copy paste解决方案，加上如果又过了一段时间，已经几乎忘记了添加了这个规则，那怎么办呢? 本人也是就检查了大半天才发现 aria-hidden 这个可疑点的。不胜唏嘘. 看来大厂对流程的严格要求是有道理的，不然可能就会遇到像这种看起来莫名其妙无从下手的问题了。 共勉.

一个由aria-hidden引起的问题

## 结论

凡是使用了命令nvidia docker或者在docker中引入了--runtime=nvidia参数的都是过时教程，最新方法只需要下载nvidia-container-toolkits，在docker中引入--gpus参数即可




## 1. nvidia docker
nvidia docker是NVIDIA第一代支持docker容器内使用GPU资源的项目。运行时用nvidia-docker命令。

根据nvidia docker在github上的描述，已经不再使用了。
> The nvidia-docker wrapper script that was included in this repository is no longer included in the package and a configuration specific to the target container engine (e.g. Docker, Containerd, Cri-o, or Podman) is suggested instead.

## 2. nvidia docker2
nvidia docker2是NVIDIA第二代支持docker容器内使用GPU资源的项目。运行时用nvidia-docker命令，且需要指定参数--runtime=nvidia.

根据github wiki的描述，一代和二代之间有如下兼容性。

> Backward compatibility To help transitioning code from 1.0 to 2.0, a bash script is provided in /usr/bin/nvidia-docker for backward compatibility. It will automatically inject the --runtime=nvidia argument and convert NV_GPU to NVIDIA_VISIBLE_DEVICES.

也就是说，在二代中，既可以使用nvidia docker命令，这会自动引入参数--runtime=nvidia也可以使用docker命令，手动指定参数--runtime=nvidia
如帖子总结：

> docker run --runtime=nvidia is only available since nvidia-docker v2.
Both commands are equivalent with nvidia-docker v2, the former is a script provided for backward compatibility with nvidia-docker v1.


ps: 笔者上一次使用docker gpu 还停留在 nvidia docker2 的阶段. 技术果然在飞速进步啊.

## 3. nvidia-container-toolkits

根据github这是最新的支持方案，如帖子描述，nvidia docker2 被Nvidia container toolkits取代，无需指定--runtime参数，只需要传递--gpus参数

```
root@docker2-1:/# docker run --rm --gpus all ubuntu nvidia-smi
Tue Sep 10 08:31:49 2024       
+-----------------------------------------------------------------------------------------+
| NVIDIA-SMI 550.107.02             Driver Version: 550.107.02     CUDA Version: 12.4     |
|-----------------------------------------+------------------------+----------------------+
| GPU  Name                 Persistence-M | Bus-Id          Disp.A | Volatile Uncorr. ECC |
| Fan  Temp   Perf          Pwr:Usage/Cap |           Memory-Usage | GPU-Util  Compute M. |
|                                         |                        |               MIG M. |
|=========================================+========================+======================|
|   0  NVIDIA GeForce RTX 2080 Ti     Off |   00000000:03:00.0 Off |                  N/A |
|  0%   41C    P0             57W /  300W |       1MiB /  11264MiB |      0%      Default |
|                                         |                        |                  N/A |
+-----------------------------------------+------------------------+----------------------+
|   1  NVIDIA GeForce RTX 3060 Ti     Off |   00000000:04:00.0 Off |                  N/A |
|  0%   49C    P0             46W /  220W |       1MiB /   8192MiB |      0%      Default |
|                                         |                        |                  N/A |
+-----------------------------------------+------------------------+----------------------+
                                                                                         
+-----------------------------------------------------------------------------------------+
| Processes:                                                                              |
|  GPU   GI   CI        PID   Type   Process name                              GPU Memory |
|        ID   ID                                                               Usage      |
|=========================================================================================|
|  No running processes found                                                             |
+-----------------------------------------------------------------------------------------+
```
---

                        
原文链接：https://blog.csdn.net/yjy420/article/details/132305356

nvidia docker, nvidia docker2, nvidia container toolkits区别

今天无意间遇到一个mac上的Docker Desktop的快速轻量级替代品: [OrbStack](https://github.com/orbstack/orbstack). 安装体验之后，感觉非常不错，可以无缝衔接docker desktop. 推荐使用. 免费版可以满足个人用户所有需求.


![WX20240801-173328@2x.png](/static/img/6ef21339ec820aad8911c5be4e2b6917.WX20240801-173328@2x.webp)