Ubuntu系统和CentOS系统到底区别在哪？全面从docker到k8s进阶！！！

Ubuntu apt 包管理与 containerd nerdctl 容器化入门整理自 2026-08-04 一次完整的终端实操日志11:05 — 16:59。已忽略误输、重复内容超长的帮助信息以......省略。环境Ubuntu主机名ubuntu2204软件源为 noble/24.04apt 2.7.14root 用户。 目录 点击章节标题可跳转每个章节末尾都有「回到目录」链接。章节核心内容① apt 包管理对标 yum软件源缓存、查询、安装、卸载、升级、源与密钥② containerd 安装与配置指定版本安装、certs.d 镜像加速、K8s 内核参数③ nerdctl 安装与 bash 补全二进制安装、CNI 插件、bash 补全踩坑④ 镜像管理 nerdctl imagepull、tag、login、push、save/load、prune⑤ 容器管理 nerdctl container运行、生命周期、exec、日志、端口映射⑥ 容器网络bridge 子网、容器 IP、容器互通验证⑦ 数据卷与 namespacebind mount、命名卷、k8s.io 命名空间⑧ 命令速查表apt vs yum 对照、nerdctl 常用命令一、apt 包管理对标 yumapt 是 Debian/Ubuntu 系的包管理器功能上对标 CentOS 的 yum。本次从帮助信息开始逐一实践。1.1 更新软件源缓存aptupdate作用相当于yum makecache把阿里云等源的软件包索引拉到本地Get:1 http://mirrors.aliyun.com/ubuntu noble InRelease [256 kB] ... Fetched 38.1 MB in 56s (685 kB/s) 286 packages can be upgraded. Run apt list --upgradable to see them.1.2 查询软件包aptlist# 列出所有可安装包输出很长略aptlist openssh-server# 查看指定包状态aptlist openssh*# 通配符匹配aptlist openssh-server-a# 查看该包所有可用版本-a显示多版本例如openssh-server/noble-updates,noble-security 1:9.6p1-3ubuntu13.18 amd64 [upgradable from: 1:9.6p1-3ubuntu13] openssh-server/noble,now 1:9.6p1-3ubuntu13 amd64 [installed,upgradable to: 1:9.6p1-3ubuntu13.18]1.3 查看包详细信息aptshow openssh-server输出包含版本、维护者、依赖、大小、描述等如Package: openssh-server Version: 1:9.6p1-3ubuntu13.18 Priority: optional Section: net Source: openssh ... Depends: adduser, libpam-modules, ... Download-Size: 511 kB Description: secure shell (SSH) server, for secure access from remote machines1.4 搜索软件包aptsearch --names-only apache2只按包名匹配不加--names-only会做全文搜索结果如apache2/noble-updates,noble-security 2.4.58-1ubuntu8.15 amd64 Apache HTTP Server apache2-bin/... Apache HTTP Server (modules and other binary files) apache2-data/... Apache HTTP Server (common files)1.5 安装 / 重装 / 卸载aptinstallapache2-y# 安装-y 免确认aptreinstall apache2-y# 重装aptremove apache2-y# 卸载保留配置文件aptautoremove-y# 清理不再需要的依赖包安装指定版本后面 containerd 就用到了aptinstall-ycontainerd1.7.12-0ubuntu4踩坑1.7.12-Oubuntu4大写 O是误输正确写法是0ubuntu4数字 0否则报E: Version 1.7.12-Oubuntu4 for containerd was not found。1.6 升级软件包aptupgrade# 常规升级安装/升级现有包aptfull-upgrade openssh-server-y# 完整升级可处理依赖变更1.7 只下载不安装aptdownload openssh-server仅把.deb下载到当前目录不做安装。1.8 编辑软件源exportEDITORvimaptedit-sources默认用 vim 打开源配置文件等价于手改/etc/apt/sources.list。1.9 apt-file查包内文件清单apt-file相当于 yum 的yum provides可以反查“某个文件属于哪个包 / 某个包包含哪些文件”aptinstall-yapt-file apt-file update# 更新文件索引比较慢本次中途放弃apt-file list openssh-serverapt-file --help的完整用法以......省略。1.10 apt-key管理仓库密钥apt-key用于添加/删除软件源的 GPG 公钥帮助信息较长此处省略新版本建议使用sources.list内的signed-by方式。↑ 回到目录二、containerd 安装与配置目标安装 containerd 并配置镜像加速为 nerdctl/K8s 做准备。2.1 安装指定版本aptlist containerd-aaptinstall-ycontainerd1.7.12-0ubuntu4安装时自动带上依赖runcThe following NEW packages will be installed: containerd runc Need to get 48.2 MB of archives.2.2 生成默认配置mkdir/etc/containerd containerd config default/etc/containerd/config.toml默认配置里config_path是空的需要改成 certs.d 目录以启用镜像加速[plugins.io.containerd.grpc.v1.cri.registry] config_path /etc/containerd/certs.d2.3 配置镜像加速certs.dcontainerd 从 1.7 起支持按域名配置镜像仓库镜像类似 Docker 的 daemon.json mirrors配置目录为/etc/containerd/certs.d/域名/hosts.toml。docker.ioDocker Hub加速mkdir-p/etc/containerd/certs.d/docker.iocat/etc/containerd/certs.d/docker.io/hosts.tomlEOF server https://registry-1.docker.io [host.https://docker.m.daocloud.io] capabilities [pull, resolve] [host.https://09def58152000fc00ff0c00057bad7e0.mirror.swr.myhuaweicloud.com] capabilities [pull, resolve] EOFregistry.k8s.io 加速K8s 官方镜像mkdir-p/etc/containerd/certs.d/registry.k8s.iocat/etc/containerd/certs.d/registry.k8s.io/hosts.tomlEOF server https://registry.k8s.io # 首选 DaoCloud [host.https://k8s.m.daocloud.io] capabilities [pull, resolve] [host.https://09def58152000fc00ff0c00057bad7e0.mirror.swr.myhuaweicloud.com] capabilities [pull, resolve] EOF内网/私有仓库 hub.laoma.cloudmkdir-p/etc/containerd/certs.d/hub.laoma.cloudcat/etc/containerd/certs.d/hub.laoma.cloud/hosts.tomlEOF server http://hub.laoma.cloud [host.http://hub.laoma.cloud] capabilities [pull, resolve] EOF2.4 K8s 环境内核参数准备加载网络相关内核模块并开启转发属于部署 K8s 的标准前置步骤modprobe-aoverlay br_netfiltercat/etc/modules-load.d/k8s-net.confEOF br_netfilter overlay EOFcat/etc/sysctl.d/k8s.confEOF net.bridge.bridge-nf-call-iptables1 net.bridge.bridge-nf-call-ip6tables1 net.ipv4.ip_forward1 EOFsysctl-p/etc/sysctl.d/k8s.conf生效验证net.bridge.bridge-nf-call-iptables 1 net.bridge.bridge-nf-call-ip6tables 1 net.ipv4.ip_forward 12.5 重启 containerd 使配置生效systemctl restart containerd↑ 回到目录三、nerdctl 安装与 bash 补全nerdctl 是 containerd 的 Docker 兼容命令行工具。3.1 安装 nerdctl 与 CNI 插件wgethttp://192.168.46.200/class/course-materials/softwares/stage03/nerdctl-1.7.7-linux-amd64.tar.gztar-xfnerdctl-1.7.7-linux-amd64.tar.gz-C/usr/bin/wgethttp://192.168.46.200/class/course-materials/softwares/stage03/cni-plugins-linux-amd64-v1.6.0.tgzmkdir-p/opt/cni/bintar-xfcni-plugins-linux-amd64-v1.6.0.tgz-C/opt/cni/bin验证版本$ nerdctl version Client: Version: v1.7.7 OS/Arch: linux/amd64 Server: containerd: ...3.2 bash 补全含踩坑生成补全脚本时一直报错-bash: _get_comp_words_by_ref: command not found原因是系统没装bash-completion。解决aptinstall-ybash-completionsource/root/.bashrc补全脚本放哪其实无所谓系统装好bash-completion后自动加载本次把之前手动生成的脚本删掉、直接依赖系统机制rm-f/etc/bash_completion.d/nerdctlsource/root/.bashrc↑ 回到目录四、镜像管理nerdctl image4.1 拉取镜像nerdctl pull busybox# Docker Hub走加速nerdctl pull registry.k8s.io/pause:3.9# K8s 沙箱镜像pausenerdctl pull hub.laoma.cloud/library/mysql# 内网仓库镜像pull 过程中可见resolving | downloading的进度条走 hosts.toml 配置的加速镜像。4.2 查看镜像nerdctl images# 或 nerdctl image lsREPOSITORY TAG IMAGE ID PLATFORM SIZE busybox latest dc2d74b28e4c linux/amd64 4.4 MiB ubuntu latest 678c6550cc43 linux/amd64 109.8 MiB hub.laoma.cloud/library/mysql latest 3b1edfde8351 linux/amd64 938.2 MiB hub.laoma.cloud/library/nginx 1.27 114dff0fc8ee linux/amd64 197.3 MiB registry.k8s.io/pause 3.9 7031c1b28338 linux/amd64 732.0 KiB4.3 查看镜像详情nerdctl image inspect busybox输出 JSON 格式包含Id、RepoTags、RepoDigests、Created、Config等长输出以......省略。4.4 打标签、登录与推送nerdctl tag busybox mage161196/busybox nerdctl image tag hub.laoma.cloud/library/nginx:1.27 hub.laoma.cloud/ningcode/nginx:1.27 nerdctl login hub.laoma.cloud-uadmin nerdctl push hub.laoma.cloud/ningcode/nginx:1.274.5 导出与导入nerdctl image save busybox-obusybox.tar# 导出为 tarnerdctl imagermbusybox# 删除本地镜像nerdctl image load-ibusybox.tar# 从 tar 导入4.6 清理与历史nerdctl image prune-a--force# 清理全部未使用镜像nerdctl imagehistoryhub.laoma.cloud/library/mysql# 查看分层历史nerdctl imagermdocker.io/library/mysql注意镜像删除要用完整仓库名。日志中先执行nerdctl image rm docker.io/library/mysql报no such image因为实际拉取的镜像名是hub.laoma.cloud/library/mysql。↑ 回到目录五、容器管理nerdctl container5.1 运行容器nerdctl container run-itubuntu# 交互式运行直接进入容器nerdctl run--nameweb-dhub.laoma.cloud/library/nginx:1.27# 后台运行 nginxnerdctl run-dnginx# 简写形式注意nerdctl不能省略日志中误输run --name web ...直接报-bash: run: command not found。5.2 查看容器nerdctl containerls# 只显示运行中的容器nerdctl containerls-a# 显示所有容器含已退出CONTAINER ID IMAGE STATUS NAMES 32c67ad53ae5 hub.laoma.cloud/library/nginx:1.27 Up web 9fe197759311 docker.io/library/ubuntu:latest Exited (0) ubuntu ed1123ae9708 docker.io/library/ubuntu:latest Created ubuntu-ed1125.3 生命周期管理nerdctl containerrenameubuntu-1 ubuntu# 改名nerdctl container stop775# 停止nerdctl container start775# 启动nerdctl container restart775# 重启nerdctl container pause775/ unpause775# 暂停 / 恢复nerdctl containerrm592# 删除需先 stop5.4 查看容器详情与“杀进程”实验nerdctl container inspect775nerdctl container inspect775|grepPid通过 inspect 拿到容器主进程 PID 后直接kill 59856模拟容器主进程被杀的场景进程退出容器即停止。5.5 在容器内执行命令nerdctlexecbusybox-af1d1 --ipa# 查看容器内网络nerdctlexecbusybox-b2f40 --ls/data/f1注意--前后要有空格--ip会报参数解析错误。5.6 查看日志nerdctl container logs bb3f5.7 端口映射nerdctl container run--namenginx-d-p8080:80 nginx nerdctl container port nginx80/tcp - 0.0.0.0:8080验证访问curl10.1.8.10:8080返回Welcome to nginx!的 HTML 页面端口映射成功。↑ 回到目录六、容器网络6.1 默认 bridge 网络nerdctl networklsnerdctl network inspect bridge{Name:bridge,IPAM:{Config:[{Subnet:10.4.0.0/24,Gateway:10.4.0.1}]},Labels:{nerdctl/default-network:true}}宿主机侧网卡ipaddr show nerdctl03: nerdctl0: BROADCAST,MULTICAST,UP,LOWER_UP mtu 1500 ... inet 10.4.0.1/24 brd 10.4.0.255 scope global nerdctl06.2 容器内 IPnerdctlexecbusybox-af1d1 --ipa容器内eth0从 bridge 自动分配2: eth0if14: BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN mtu 1500 ... inet 10.4.0.12/24 brd 10.4.0.255 scope global eth0本次实践里 nginx 容器web拿到10.4.0.3容器间通过 bridge 直接互通curl10.4.0.3# 返回 nginx 欢迎页↑ 回到目录七、数据卷与 namespace7.1 挂载宿主机目录bind mountmkdir-p/data nerdctl run-d-v/data/:/data busybox --sleepinfinity宿主机建文件容器内立即可见touch/data/f1 nerdctlexecbusybox-b2f40 --ls/data/f17.2 命名卷named volumenerdctl run-d-vdata:/data busybox --sleepinfinity nerdctlexecbusybox-3f2dc --touch/data/f1 nerdctl volumels误输nerdctl -d -v ...漏了 run会报unknown shorthand flag: d。7.3 namespace命名空间nerdctl namespacelsNAME CONTAINERS IMAGES VOLUMES LABELS default 9 5 1注K8s 使用 containerd 时默认命名空间是k8s.io与 nerdctl 默认的default不同。↑ 回到目录八、命令速查表apt vs yum 对照功能yumapt更新缓存yum makecacheapt update搜索yum searchapt search查看详情yum infoapt show安装yum installapt install指定版本安装yum install pkg-版本apt install pkg版本重装yum reinstallapt reinstall卸载yum removeapt remove清理依赖yum autoremoveapt autoremove升级yum updateapt upgrade / full-upgrade查文件所属包yum providesapt-file search / list只下载yumdownloaderapt download编辑源vim /etc/yum.repos.d/apt edit-sourcesnerdctl 常用命令操作命令拉取镜像nerdctl pull 镜像查看镜像nerdctl images删除镜像nerdctl image rm 镜像导出/导入nerdctl image save -o x.tar 镜像/nerdctl image load -i x.tar登录/推送nerdctl login 仓库/nerdctl push 仓库/镜像运行容器nerdctl run -d -p 8080:80 --name nginx nginx查看容器nerdctl container ls -a启停/重启nerdctl container start/stop/restart ID暂停/恢复nerdctl container pause/unpause ID进容器执行nerdctl exec ID -- 命令看日志nerdctl container logs ID端口查看nerdctl container port 名称网络管理nerdctl network ls/inspect数据卷nerdctl volume ls/create/rm命名空间nerdctl namespace ls↑ 回到目录小结apt 是 Ubuntu 的包管理核心绝大多数操作与 yum 一一对应重点是apt install 包名版本号这种指定版本安装方式。containerd 的镜像加速不再靠 daemon.json而是每个仓库域名一个certs.d/域名/hosts.toml并且要在config.toml里把config_path指到/etc/containerd/certs.d。nerdctl 是 containerd 的“docker 命令”镜像、容器、网络、卷、namespace 的用法与 Docker 高度一致适合作为 K8s 落地前的容器运行时演练。部署 K8s 前的内核参数overlay、br_netfilter、ip_forward在本次已提前配置好。