Managing the Lifecycle of a Secure Container
- Managing the Lifecycle of a Secure Container
Starting a Secure Container
You can use iSulad as the container engine of the secure container. To start a secure container, perform the following steps:
Ensure that the secure container component has been correctly installed and deployed.
Prepare the container image. Assume that the container image is busybox. Run the following commands to download the container image using iSulad:
isula pull busybox
Start a secure container. Run the following commands to start a secure container using iSulad:
isula run -tid --runtime io.containerd.kata.v2 --net none busybox <command>
The secure container supports the CNI network only and does not support the CNM network. The -p and --expose options cannot be used to expose container ports. When using a secure container, you need to specify the --net=none option.
Start a pod.
Start the pause container and obtain the sandbox ID of the pod based on the command output. Run the following command to start a pause container using iSulad:
isula run -tid --runtime io.containerd.kata.v2 --net none --annotation io.kubernetes.cri.container-type=sandbox <pause-image> <command>
Create a service container and add it to the pod. Run the following command to create a service container using iSulad:
isula run -tid --runtime kata-runtime --network none --annotation io.kubernetes.cri.container-type=container --annotation io.kubernetes.cri.sandbox-id=<sandbox-id> busybox <command>
--annotation is used to mark the container type.
Stopping a Secure Container
Run the following command to stop a secure container:
isula stop <contaienr-id>
Stop a pod.
When stopping a pod, note that the lifecycle of the pause container is the same as that of the pod. Therefore, stop service containers before the pause container.
Deleting a Secure Container
Ensure that the container has been stopped. Run the following command to delete the container:
isula rm <container-id>
To forcibly delete a running container, use the -f option:
isula rm -f <container-id>
Running a New Command in the Container
The pause container functions only as a placeholder container. Therefore, after a pod is started, run the new command in the service container. The pause container does not execute the corresponding command. If you need to start only one container, you can run the following command:
isula exec -ti <container-id> <command>
- If the -d option is used, the command is executed in the background and no error information is displayed. The exit code cannot be used to determine whether the command is executed correctly.