Ubuntu20.04下Podman无法显示K8s容器，如何修改运行时？

问题背景 #

在Ubuntu 20.04环境下，部署了Kubernetes 1.24版本并使用CRI-O作为容器运行时，同时安装Podman用于podman commit功能。当前Podman能正常查看镜像，但podman ps -a无任何容器输出，而crictl ps -a可以正常显示Kubernetes管理的容器，需修改Podman配置使其识别CRI-O容器。

相关命令输出 #

1. crictl ps -a执行结果：

CONTAINER           IMAGE                                                                                                       CREATED             STATE               NAME                        ATTEMPT             POD ID              POD
c798099462c9b       295c7be079025306c4f1d65997fcf7adb411c88f139ad1d34b537164aa060369                                            33 minutes ago      Running             nginx                       0                   e1bd39fd2b241       nginx-deployment-6595874d85-wksxq
e2da3de955397       295c7be079025306c4f1d65997fcf7adb411c88f139ad1d34b537164aa060369                                            33 minutes ago      Running             nginx                       0                   15bf749dc406f       nginx-deployment-6595874d85-8zbpx
a58db13acc2bf       295c7be079025306c4f1d65997fcf7adb411c88f139ad1d34b537164aa060369                                            33 minutes ago      Running             nginx                       0                   f5d775b0b78c0       nginx-deployment-6595874d85-pspvg
75573509b4b1e       docker.io/kubernetesui/dashboard@sha256:1b020f566b5d65a0273c3f4ed16f37dedcb95ee2c9fa6f1c42424ec10b2fd2d7    3 days ago          Running             kubernetes-dashboard        0                   bfb3ade50b952       kubernetes-dashboard-f8bb6d75-9g6p7
2ab98c33f2713       7801cfc6d5c072eb114355d369c830641064a246b5a774bcd668fac75ec728e9                                            3 days ago          Running             dashboard-metrics-scraper   0                   23da9b06873c9       dashboard-metrics-scraper-7bfdf779ff-qrdcj
ac41ff1d3a335       docker.io/calico/kube-controllers@sha256:57c40fdfb86dce269a8f93b4f5545b23b7ee9ba36d62e67e7ce367df8d753887   3 days ago          Running             calico-kube-controllers     0                   fac206793f1d5       calico-kube-controllers-6766647d54-sqjqx
0ec5b4d17ed3b       docker.io/calico/node@sha256:0a430186f9267218aed3e419a541e306eba3d0bbe5cf4f6a8b700d35d7a4f7fa               3 days ago          Running             calico-node                 0                   1a63a00117c7f       calico-node-mkvpg
6ec33c0ece470       a87d3f6f1b8fdc077e74ad6874301f57490f5b38cc731d5d6f5803f36837b4b1                                            3 days ago          Exited              install-cni                 0                   1a63a00117c7f       calico-node-mkvpg
8dd11d084b8f3       docker.io/calico/cni@sha256:7c7bd52f3c72917c28a6715740b4710e9a345a26a7d90556a471a3eb977d8cf7                3 days ago          Exited              upgrade-ipam                0                   1a63a00117c7f       calico-node-mkvpg
0ce4eaeb4d27b       k8s.gcr.io/kube-proxy@sha256:058460abb91c7c867f61f5a8a4c29d2cda605d8ff1dd389b1f7bad6c1db60a5b               3 days ago          Running             kube-proxy                  0 

2. podman ps -a执行结果：

CONTAINER ID  IMAGE       COMMAND     CREATED     STATUS      PORTS       NAMES

3. podman system info执行结果：

host:
  arch: amd64
  buildahVersion: 1.23.1
  cgroupControllers:
  - cpuset
  - cpu
  - cpuacct
  - blkio
  - memory
  - devices
  - freezer
  - net_cls
  - perf_event
  - net_prio
  - hugetlb
  - pids
  - rdma
  cgroupManager: systemd
  cgroupVersion: v1
  conmon:
    package: 'conmon: /usr/libexec/podman/conmon'
    path: /usr/libexec/podman/conmon
    version: 'conmon version 2.1.2, commit: '
  cpus: 4
  distribution:
    codename: focal
    distribution: ubuntu
    version: "20.04"
  eventLogger: journald
  hostname: realworker
  idMappings:
    gidmap: null
    uidmap: null
  kernel: 5.4.0-122-generic
  linkmode: dynamic
  logDriver: journald
  memFree: 4012826624
  memTotal: 16728518656
  ociRuntime:
    name: crun
    package: 'crun: /usr/bin/crun'
    path: /usr/bin/crun
    version: |-
      crun version UNKNOWN
      commit: ea1fe3938eefa14eb707f1d22adff4db670645d6
      spec: 1.0.0
      +SYSTEMD +SELINUX +APPARMOR +CAP +SECCOMP +EBPF +CRIU +YAJL
  os: linux
  remoteSocket:
    path: /run/podman/podman.sock
  security:
    apparmorEnabled: true
    capabilities: CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_NET_BIND_SERVICE,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID,CAP_SYS_CHROOT
    rootless: false
    seccompEnabled: true
    seccompProfilePath: /usr/share/containers/seccomp.json
    selinuxEnabled: false
  serviceIsRemote: false
  slirp4netns:
    executable: /usr/bin/slirp4netns
    package: 'slirp4netns: /usr/bin/slirp4netns'
    version: |-
      slirp4netns version 1.1.8
      commit: unknown
      libslirp: 4.3.1-git
      SLIRP_CONFIG_VERSION_MAX: 3
      libseccomp: 2.4.3
  swapFree: 0
  swapTotal: 0
  uptime: 95h 1m 37.73s (Approximately 3.96 days)
plugins:
  log:
  - k8s-file
  - none
  - journald
  network:
  - bridge
  - macvlan
  volume:
  - local
registries:
  search:
  - docker.io
  - quay.io
store:
  configFile: /etc/containers/storage.conf
  containerStore:
    number: 0
    paused: 0
    running: 0
    stopped: 0
  graphDriverName: overlay
  graphOptions:
    overlay.mountopt: nodev,metacopy=on
  graphRoot: /var/lib/containers/storage
  graphStatus:
    Backing Filesystem: extfs
    Native Overlay Diff: "false"
    Supports d_type: "true"
    Using metacopy: "true"
  imageStore:
    number: 11
  runRoot: /run/containers/storage
  volumePath: /var/lib/containers/storage/volumes
version:
  APIVersion: 3.4.2
  Built: 0
  BuiltTime: Thu Jan  1 00:00:00 1970
  GitCommit: ""
  GoVersion: go1.15.2
  OsArch: linux/amd64
  Version: 3.4.2

解决步骤 #

1. 确认CRI-O存储配置 #

先查看CRI-O的存储参数，确保和Podman的存储路径匹配：

sudo grep -A 15 "\[storage\]" /etc/crio/crio.conf

重点关注driver、graphroot、runroot和overlay.mountopt这几个参数。

2. 修改Podman核心配置 #

编辑/etc/containers/containers.conf文件，添加CRI支持配置：

sudo nano /etc/containers/containers.conf

在[engine]段添加以下内容：

[engine]
# 启用CRI容器识别
enable_cri_containerd = true
# 指定CRI-O的socket路径
cri_socket = "/run/crio/crio.sock"

3. 同步存储配置 #

编辑/etc/containers/storage.conf，确保和CRI-O的存储参数完全一致：

sudo nano /etc/containers/storage.conf

参考CRI-O的配置调整以下字段：

[storage]
driver = "overlay"
runroot = "/run/containers/storage"
graphroot = "/var/lib/containers/storage"

[storage.options.overlay]
mountopt = "nodev,metacopy=on"

4. 重启Podman服务 #

sudo systemctl restart podman

5. 验证配置 #

执行podman ps -a，此时应该能看到所有Kubernetes管理的容器。

注意事项 #

• 对Kubernetes容器执行podman commit后，建议将新镜像推送到镜像仓库，再通过更新Deployment的镜像版本来应用，避免直接修改K8s管理的容器导致状态不一致。
• 若需要区分Podman自身容器和K8s容器，可使用podman --runtime crun ps -a查看Podman独立管理的容器，podman --runtime crio ps -a查看K8s容器。

内容的提问来源于stack exchange，提问作者ymir0916