<div id="readability-page-1" class="page"><div><div><a href="https://rkttu.com/?source=post_page-----50d4a46daccf--------------------------------" rel="noopener follow ugc nofollow"><div><img alt="Jung-Hyun Nam" src="https://miro.medium.com/fit/c/96/96/2*P1z-D515GRYQ6WaumcAxVQ.png" width="48" height="48"></div></a></div><figure><div role="button" tabindex="0"><img alt="https://unsplash.com/photos/mE9PgAS96O8" src="https://miro.medium.com/max/1400/0*r-WNCk642c1HEZp1" width="700" height="395"></div><figcaption>Photo by <a href="https://unsplash.com/@capyvara?utm_source=unsplash&amp;utm_medium=referral&amp;utm_content=creditCopyText" target="_blank" rel="noopener ugc nofollow">Hama Haki</a> on <a href="https://unsplash.com/s/photos/container-window?utm_source=unsplash&amp;utm_medium=referral&amp;utm_content=creditCopyText" target="_blank" rel="noopener ugc nofollow">Unsplash</a></figcaption></figure>Have you ever wondered does Windows containerd works as a standalone service? I recently found that the Windows Server 2022 was released, and the ContainerD also reached a generally available state on Windows this year.This post will show detailed steps to install and launch your own Windows containers on your standalone Windows server machine without Docker Enterprise. Then, you can configure and understand your hybrid Kubernetes cluster with multiple Windows worker nodes based on this guide.<h2 id="7d46">Background</h2>As you already know, Mirantis bought the Docker Enterprise department, and they updated Docker Enterprise into Mirantis Container Runtime. Simultaneously, the Kubernetes community decided about Dockershim, so they will not support Dockershim as their primary container runtime inside the cluster. Ultimately, these changes affected the existing Windows container ecosystem.You can migrate your existing Docker Enterprise configuration to the Mirantis Container Runtime if you wish. But in most cases, people will prefer Kubernetes-based workload instead of other kinds of container orchestration platforms. This situation made the ContainerD replace the Docker Enterprise in the Windows Server container host.<h2 id="a5b2">Prerequisites</h2>Please make sure the following items are ready before you test this article.<ul><li id="af90">You should use the Windows Server 2022 LTSC.</li><li id="bd30">At least 4GiB or more system memory is required.</li><li id="7061">At least 16GiB or more disk is needed.</li><li id="9b2d">You have logged into your local Administrators group.</li></ul><h2 id="64cc">Configure ContainerD</h2>First, let’s activate the container-related features. Your server may restart during this step, so please save your data and close your apps.<pre>$RestartRequired = (Add-WindowsFeature -Name Containers)if ($RestartRequired.RestartNeeded) { Restart-Computer -Force }</pre>Then, download the latest version of the ContainerD.<pre>$ContainerDVersion = '1.5.5' curl.exe -LO "<a href="https://github.com/containerd/containerd/releases/download/v$%7BContainerDVersion%7D/cri-containerd-cni-$%7BContainerDVersion%7D-windows-amd64.tar.gz" target="_blank" rel="noopener ugc nofollow">https://github.com/containerd/containerd/releases/download/v${ContainerDVersion}/cri-containerd-cni-${ContainerDVersion}-windows-amd64.tar.gz</a>" tar.exe xvzf ".\cri-containerd-cni-${ContainerDVersion}-windows-amd64.tar.gz" del ".\cri-containerd-cni-${ContainerDVersion}-windows-amd64.tar.gz"</pre>Extract the archive file into the program files directory, make up the CNI plugin directory layout and fit it to ContainerD.<pre>mkdir -force "$env:ProgramFiles\containerd" mv .\*.exe "$env:ProgramFiles\containerd" mv .\cni "$env:ProgramFiles\containerd" mkdir "$env:ProgramFiles\containerd\cni\bin" -force mv "$env:ProgramFiles\containerd\cni\*.exe" "$env:ProgramFiles\containerd\cni\bin"</pre>Make default configuration file for the ContainerD. Thankfully, the ContainerD binary can produce its self-descriptive entire configuration file with the default values, so we can just render and put it.<pre>&amp; "$env:ProgramFiles\containerd\containerd.exe" config default | Out-File "$env:ProgramFiles\containerd\config.toml" -Encoding ascii</pre>Then, open the configuration file with the notepad or your favorite text editor. We need to update the configuration file to correct the pause image reference. Lower than v3.5 will cause pod initialization failure due to a non-compatible pause image for the Windows host.<pre>... [plugins][plugins."io.containerd.gc.v1.scheduler"] deletion_threshold = 0 mutation_threshold = 100 pause_threshold = 0.02 schedule_delay = "0s" startup_delay = "100ms"[plugins."io.containerd.grpc.v1.cri"] disable_apparmor = false disable_cgroup = false disable_hugetlb_controller = false disable_proc_mount = false disable_tcp_service = true enable_selinux = false enable_tls_streaming = false ignore_image_defined_volumes = false max_concurrent_downloads = 3 max_container_log_line_size = 16384 netns_mounts_under_state_dir = false restrict_oom_score_adj = false sandbox_image = "k8s.gcr.io/pause:3.6" # &lt;- Change the tag version from 3.5 to higher version (I recommend 3.6) ...</pre>Let’s add an exception for Windows Defender. Windows container relies on the kernel’s API just like Linux, and Windows Defender scans all file contents via hooking up the device driver’s call. This makes the container’s I/O performance dreadful, so we need to make a smooth configuration.<pre>Add-MpPreference -ExclusionProcess "$env:ProgramFiles\containerd\containerd.exe"</pre>Finally, we can register the ContainerD service and start it.<pre>&amp; "$env:ProgramFiles\containerd\containerd.exe" --register-serviceStart-Service containerd</pre><h2 id="c003">Configure HNS NAT Network</h2>As you already know, Windows provides its own container networking infrastructure called HNS (Host Network Service). The ContainerD was decoupled with the networking feature, and those features headed into the different plugin types called CNI.This guide will choose the built-in NAT CNI plugin and make the NAT CNI plugin work correctly.There is no built-in HNS control command inside the Windows Server. So we need to download the HNS PowerShell module and import it.<pre>curl.exe -LO '<a href="https://raw.githubusercontent.com/microsoft/SDN/master/Kubernetes/windows/hns.psm1'" target="_blank" rel="noopener ugc nofollow">https://raw.githubusercontent.com/microsoft/SDN/master/Kubernetes/windows/hns.psm1'</a> Import-Module .\hns.psm1</pre>Then, let’s define a virtual network subnet and register it.<pre>$subnet='10.0.0.0/16' $gateway='10.0.0.1' New-HnsNetwork -Type NAT -AddressPrefix $subnet -Gateway $gateway -Name "nat"</pre>Finally, rewrite the NAT plugin configuration file before creating a new pod. CNI is an independent plugin regardless of the ContainerD’s running status, so we can just put the configuration file without restarting the ContaienrD service.<pre>@" { "cniVersion": "0.2.0", "name": "nat", "type": "nat", "master": "Ethernet", "ipam": { "subnet": "$subnet", "routes": [ { "gateway": "$gateway" } ] }, "capabilities": { "portMappings": true, "dns": true } } "@ | Set-Content "$env:ProgramFiles\containerd\cni\conf\0-containerd-nat.conf" -Force</pre><h2 id="0cda">Configure CRICTL Client Tool</h2>To access the ContainerD and incorporate it with the CRI (Container Runtime Interface), we need to CRICTL client tool. The CTR tool is also available, but this tool does not use the CRI, so containers created with the CTR may not have the network interface attached.First, download the CRICTL tool from GitHub.<pre>$CriCtlVersion = '1.22.0' curl.exe -LO "<a href="https://github.com/kubernetes-sigs/cri-tools/releases/download/v$%7BCriCtlVersion%7D/crictl-v$%7BCriCtlVersion%7D-windows-amd64.tar.gz" target="_blank" rel="noopener ugc nofollow">https://github.com/kubernetes-sigs/cri-tools/releases/download/v${CriCtlVersion}/crictl-v${CriCtlVersion}-windows-amd64.tar.gz</a>" tar.exe xvzf ".\crictl-v${CriCtlVersion}-windows-amd64.tar.gz" del ".\crictl-v${CriCtlVersion}-windows-amd64.tar.gz"</pre>Then, create a CRICTL configuration file in your user profile directory. In Windows, ContainerD will open the control channel via a named pipe instead of sockets.<pre>mkdir -Force "$home\.crictl"@" runtime-endpoint: npipe://./pipe/containerd-containerd image-endpoint: npipe://./pipe/containerd-containerd timeout: 10 "@ | Set-Content "$home\.crictl\crictl.yaml" -Force</pre>You can test the configuration file with the below command.<pre>.\crictl.exe info</pre><h2 id="9bb6">Final Step: Create and run IIS container</h2>The long journey concludes here! If you followed all steps before here, you could now create and run an IIS container.Before beginning, we need to prepare some artifacts to create a pod and a container.First, create a directory for saving logs.<pre>mkdir -Force \logs</pre>Then, define a pod configuration file.<pre>@" metadata: attempt: 1 name: sample-sandbox namespace: default uid: $((New-Guid).ToString("N").Substring(0, 25)).log log_directory: /logs windows: namespaces: options: {} "@ | Set-Content "pod-config.yaml" -Force</pre>Pass the created pod configuration file to CRICTL. The tool will communicate to the ContainerD via CRI and returns the created pod id.<pre>$PodId = (.\crictl.exe runp --runtime runhcs-wcow-process .\pod-config.yaml) .\crictl.exe pods $PodId</pre>Pull the IIS image.<pre>.\crictl.exe pull mcr.microsoft.com/windows/servercore/iis:windowsservercore-ltsc2022</pre>Then, create a container configuration file.<pre>@" metadata: name: simple-server image: image: mcr.microsoft.com/windows/servercore/iis:windowsservercore-ltsc2022 log_path: $((New-Guid).ToString("N").Substring(0, 8)).log ports: containerPort: 80 "@ | Set-Content "simple-server.yaml" -Force</pre>Lastly, pass the created container configuration file to the CRICTL tool and obtain the container ID.<pre>$ContainerId = (.\crictl.exe create $PodId .\simple-server.yaml .\pod-config.yaml) .\crictl.exe start $ContainerId</pre>To check the IP address, please run the following command.<pre>.\crictl.exe exec -i $ContainerId ipconfig curl.exe '&lt;IPAddressOfContainer&gt;'</pre>So you may find that the IIS container returns its welcome page code.<pre>&lt;!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "<a href="http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd" target="_blank" rel="noopener ugc nofollow">http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd</a>"&gt; &lt;html xmlns="<a href="http://www.w3.org/1999/xhtml" target="_blank" rel="noopener ugc nofollow">http://www.w3.org/1999/xhtml</a>"&gt; &lt;head&gt; &lt;meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" /&gt; &lt;title&gt;IIS Windows Server&lt;/title&gt; &lt;style type="text/css"&gt; &lt;!-- body { color:#000000; background-color:#0072C6; margin:0; }#container { margin-left:auto; margin-right:auto; text-align:center; }a img { border:none; }--&gt; &lt;/style&gt; &lt;/head&gt; &lt;body&gt; &lt;div id="container"&gt; &lt;a href="<a href="http://go.microsoft.com/fwlink/?linkid=66138&amp;amp;clcid=0x409" target="_blank" rel="noopener ugc nofollow">http://go.microsoft.com/fwlink/?linkid=66138&amp;amp;clcid=0x409</a>"&gt;&lt;img src="iisstart.png" alt="IIS" width="960" height="600" /&gt;&lt;/a&gt; &lt;/div&gt; &lt;/body&gt; &lt;/html&gt;</pre><h2 id="6b94">Some Caveats</h2>Sadly, most ContainerD related projects heavily rely on the buildkit (especially the buildkitd). However, buildkitd was not developed for the Windows container ecosystem. So you cannot build your own Windows container images in this configuration today.<h2 id="2e47">Conclusion</h2>Sooner or later, ContainerD will debut into the Windows container ecosystem widely. Windows ContainerD uses the latest HCS v2 API to support more equivalent container features compared to Linux. (For example, in HCS v2, you can mount a single file instead of a directory.)Also, Microsoft decided they would not release the Semi-Annual Channel releases and just keep the Long-Term Servicing Channel for several years. This decision will make a more stable, intuitive, and straightforward container platform for DevOps engineers and existing Windows application developers.So I think it’s worth investigating this new Windows container platform to modernize your traditional Windows server application.<h2 id="bbbf">References</h2><ul><li id="a7d2"><a href="https://www.jamessturtevant.com/posts/Windows-Containers-on-Windows-10-without-Docker-using-Containerd/" target="_blank" rel="noopener ugc nofollow">https://www.jamessturtevant.com/posts/Windows-Containers-on-Windows-10-without-Docker-using-Containerd/</a></li><li id="9391"><a href="https://kubernetes.io/docs/tasks/debug-application-cluster/crictl/" target="_blank" rel="noopener ugc nofollow">https://kubernetes.io/docs/tasks/debug-application-cluster/crictl/</a></li><li id="88e5"><a href="https://jayunit100.blogspot.com/2020/12/debugging-containerd-on-windows.html?view=mosaic" target="_blank" rel="noopener ugc nofollow">https://jayunit100.blogspot.com/2020/12/debugging-containerd-on-windows.html?view=mosaic</a></li><li id="7962"><a href="https://kubernetes.io/ko/docs/setup/production-environment/windows/user-guide-windows-containers/" target="_blank" rel="noopener ugc nofollow">https://kubernetes.io/ko/docs/setup/production-environment/windows/user-guide-windows-containers/</a></li></ul></div></div>

Stories by Jung-Hyun Nam on Medium

Latest Windows Container Evolution Finally Made
Continue reading on Dev Genius »

Gentle ContainerD on Windows Guide For You

댓글