如何从Kubernetes Pod中下载容器镜像？多容器场景需求问询

Absolutely, you can pull down container images running in a Kubernetes Pod for offline use—here’s how to do it, along with tips to replicate the Pod’s runtime setup so you can start the container with a simple Docker command (or even a docker-compose file, like you mentioned).

Step 1: Find out which images your Pod is using #

First, you need to get the exact image names/tags for all containers in your Pod. Run this command, replacing <pod-name> with your actual Pod name:

kubectl get pod <pod-name> -o jsonpath='{.spec.containers[*].image}'

This will spit out a space-separated list of all images running in the Pod (e.g., nginx:alpine redis:latest).

Step 2: Extract the image from the Pod’s node #

Kubernetes stores container images on the worker node where the Pod is running. So first, find which node your Pod is on:

kubectl get pod <pod-name> -o jsonpath='{.spec.nodeName}'

Next, SSH into that node (you’ll need admin access to the node for this). Once you’re in, export the image depending on the container runtime your cluster uses:

If using Docker: #

docker save <image-name> -o <image-file.tar>

Then use scp to copy the .tar file to your local machine for offline use.

If using containerd (common in modern Kubernetes clusters): #

ctr images export <image-file.tar> <image-name>

Again, copy the tar file to your local system.

Once you have the tar file locally, load it into Docker with:

docker load -i <image-file.tar>

Step 3: Replicate the Pod’s runtime configuration #

To start the container with a single Docker command (or a docker-compose file), you’ll need to mirror the environment settings from the original Pod. Here’s how to pull those details:

• Environment variables: Get all env vars for your container with:

  kubectl get pod <pod-name> -o jsonpath='{.spec.containers[0].env}'
  

  (Replace [0] with the index of the container you care about if there are multiple.)

• Port mappings: Extract container ports with:

  kubectl get pod <pod-name> -o jsonpath='{.spec.containers[0].ports[*].containerPort}'
  

• Volume mounts: Check the Pod’s volume configuration with kubectl describe pod <pod-name>—look for the Volumes and Mounts sections. For offline use, you’ll need to create local directories and map them using Docker’s -v flag.

Example docker-compose.yml #

Here’s how you might translate the Pod’s config into a docker-compose file for easy offline use:

version: '3.8'
services:
  app-container:
    image: <your-extracted-image-tag>
    environment:
      - DB_HOST=localhost
      - API_KEY=your-secret-key
    ports:
      - "8080:8080"
    volumes:
      - ./local-data:/app/data

Key considerations #

• Node access: If you don’t have permission to SSH into the worker node, this method won’t work. An alternative is to add a sidecar container to the Pod that can export the image, but this requires granting the Pod access to the node’s container runtime socket (which has security implications).
• Private images: Exported images retain their original tags, so when you load them locally, Docker won’t try to pull from a remote registry (perfect for offline use).
• Init containers: If your Pod uses init containers, don’t forget to export those images too if you need to replicate the full workflow.

内容的提问来源于stack exchange，提问作者user1595858