CRI(Container Runtime Interface)
# 소켓 명시
crictl --runtime-endpoint unix:///run/containerd/containerd.sock <cmd>
# 또는 /etc/crictl.yaml 설정
runtime-endpoint: unix:///run/containerd/containerd.sock
image-endpoint: unix:///run/containerd/containerd.sock
timeout: 10
debug: false
# 특정 k8s namespace의 pod 조회
crictl pods --namespace kube-system
# pod id로 컨테이너 찾기
crictl ps --pod <pod-id>
# 컨테이너 로그 + exec 콤보
crictl logs -f $(crictl ps --name nginx -q)
crictl exec -it $(crictl ps --name nginx -q) sh
# 죽은 컨테이너 정리
crictl ps -a | grep Exited | awk '{print $1}' | xargs crictl rm
# 이미지 전체 정리 (사용 중인 것 제외하고 자동)
crictl rmi --prune
pod (sandbox)
- pod-config.json
{
"metadata": { "name": "debug-pod", "namespace": "default" },
"log_directory": "/tmp",
"linux": {}
}
crictl --help
WARN[0000] Failed to stat /var/lib/rancher/k3s/agent/etc/crictl.yaml: permission denied
NAME:
crictl - client for CRI
USAGE:
crictl [global options] command [command options]
VERSION:
v1.34.0-k3s2
COMMANDS:
attach Attach to a running container
checkpoint Checkpoint one or more running containers
completion Output shell completion code
config Get, set and list crictl configuration options
create Create a new container
events, event Stream the events of containers
exec Run a command in a running container
imagefsinfo Return image filesystem info
images, image, img List images
info Display information of the container runtime
inspect Display the status of one or more containers
inspecti Return the status of one or more images
inspectp Display the status of one or more pods
logs Fetch the logs of a container
metricdescs List metric descriptors. Returns information about the metrics available through the CRI.
metricsp List pod metrics. Metrics are unstructured key/value pairs gathered by CRI meant to replace cAdvisor's /metrics/cadvisor endpoint.
pods List pods
port-forward Forward local port to a pod
ps List containers
pull Pull an image from a registry
rm Remove one or more containers
rmi Remove one or more images
rmp Remove one or more pods
run Run a new container inside a sandbox
runp Run a new pod
runtime-config Retrieve the container runtime configuration
start Start one or more created containers
stats List container(s) resource usage statistics
statsp List pod statistics. Stats represent a structured API that will fulfill the Kubelet's /stats/summary endpoint.
stop Stop one or more running containers
stopp Stop one or more running pods
update Update one or more running containers
update-runtime-config Update the runtime configuration
version Display runtime version information
help, h Shows a list of commands or help for one command
GLOBAL OPTIONS:
--config value, -c value Location of the client config file. If not specified and the default does not exist, the program's directory is searched as well (default: "/etc/crictl.yaml") [$CRI_CONFIG_FILE]
--debug, -D Enable debug mode (default: false)
--enable-tracing Enable OpenTelemetry tracing. (default: false)
--image-endpoint value, -i value Endpoint of CRI image manager service (default: uses 'runtime-endpoint' setting) [$IMAGE_SERVICE_ENDPOINT]
--profile-cpu value Write a pprof CPU profile to the provided path.
--profile-mem value Write a pprof memory profile to the provided path.
--runtime-endpoint value, -r value Endpoint of CRI container runtime service (default: uses in order the first successful one of [unix:///run/k3s/containerd/containerd.sock unix:///var/run/dockershim.sock unix:///run/containerd/containerd.sock unix:///run/crio/crio.sock unix:///var/run/cri-dockerd.sock]). Default is now deprecated and the endpoint should be set instead. [$CONTAINER_RUNTIME_ENDPOINT]
--timeout value, -t value Timeout of connecting to the server in seconds (e.g. 2s, 20s.). 0 or less is set to default (default: 2s)
--tracing-endpoint value Address to which the gRPC tracing collector will send spans to. (default: "127.0.0.1:4317")
--tracing-sampling-rate-per-million value Number of samples to collect per million OpenTelemetry spans. Set to 1000000 or -1 to always sample. (default: -1)
--help, -h Show help (default: false)
--version, -v Print the version (default: false)