@@ -21,8 +21,8 @@ A flaw was found in the way runc handled system file descriptors when running co
21
21
A malicious container could use this flaw to overwrite contents of the runc binary and
22
22
consequently run arbitrary commands on the container host system.
23
23
24
- Please refer to this link for more information about this issue
25
- [ cve- 2019 -5736 : runc vulnerability ] ( https://access.redhat.com/security/cve/cve-2019-5736 )
24
+ Please refer to [ CVE- 2019 -5736 ] ( https://access.redhat.com/security/cve/cve-2019-5736 ) for more
25
+ information about the issue.
26
26
{{< /caution >}}
27
27
28
28
### Applicability
@@ -70,29 +70,39 @@ Keep track of the latest verified Docker version in the Kubernetes release notes
70
70
Use the following commands to install Docker on your system:
71
71
72
72
{{< tabs name="tab-cri-docker-installation" >}}
73
- {{< tab name="Ubuntu 16.04+" codelang="bash" >}}
74
- # Install Docker CE
73
+ {{< tab name="Ubuntu 16.04+" >}}
74
+
75
+ ``` shell
76
+ # (Install Docker CE)
75
77
# # Set up the repository:
76
78
# ## Install packages to allow apt to use a repository over HTTPS
77
79
apt-get update && apt-get install -y \
78
80
apt-transport-https ca-certificates curl software-properties-common gnupg2
81
+ ```
79
82
80
- ### Add Docker’s official GPG key
83
+ ``` shell
84
+ # Add Docker’s official GPG key:
81
85
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | apt-key add -
86
+ ```
82
87
83
- ### Add Docker apt repository.
88
+ ``` shell
89
+ # Add the Docker apt repository:
84
90
add-apt-repository \
85
91
" deb [arch=amd64] https://download.docker.com/linux/ubuntu \
86
92
$( lsb_release -cs) \
87
93
stable"
94
+ ```
88
95
89
- ## Install Docker CE.
96
+ ``` shell
97
+ # Install Docker CE
90
98
apt-get update && apt-get install -y \
91
99
containerd.io=1.2.13-1 \
92
100
docker-ce=5:19.03.8~3-0~ubuntu-$( lsb_release -cs) \
93
101
docker-ce-cli=5:19.03.8~3-0~ubuntu-$( lsb_release -cs)
102
+ ```
94
103
95
- # Setup daemon.
104
+ ``` shell
105
+ # Set up the Docker daemon
96
106
cat > /etc/docker/daemon.json << EOF
97
107
{
98
108
"exec-opts": ["native.cgroupdriver=systemd"],
@@ -103,34 +113,48 @@ cat > /etc/docker/daemon.json <<EOF
103
113
"storage-driver": "overlay2"
104
114
}
105
115
EOF
116
+ ```
106
117
118
+ ``` shell
107
119
mkdir -p /etc/systemd/system/docker.service.d
120
+ ```
108
121
109
- # Restart docker.
122
+ ``` shell
123
+ # Restart Docker
110
124
systemctl daemon-reload
111
125
systemctl restart docker
126
+ ```
112
127
{{< /tab >}}
113
- {{< tab name="CentOS/RHEL 7.4+" codelang="bash" >}}
128
+ {{< tab name="CentOS/RHEL 7.4+" >}}
114
129
115
- # Install Docker CE
130
+ ``` shell
131
+ # (Install Docker CE)
116
132
# # Set up the repository
117
- ### Install required packages.
133
+ # ## Install required packages
118
134
yum install -y yum-utils device-mapper-persistent-data lvm2
135
+ ```
119
136
120
- ### Add Docker repository.
137
+ ``` shell
138
+ # # Add the Docker repository
121
139
yum-config-manager --add-repo \
122
140
https://download.docker.com/linux/centos/docker-ce.repo
141
+ ```
123
142
124
- ## Install Docker CE.
143
+ ``` shell
144
+ # Install Docker CE
125
145
yum update -y && yum install -y \
126
146
containerd.io-1.2.13 \
127
147
docker-ce-19.03.8 \
128
148
docker-ce-cli-19.03.8
149
+ ```
129
150
130
- ## Create /etc/docker directory.
151
+ ``` shell
152
+ # # Create /etc/docker
131
153
mkdir /etc/docker
154
+ ```
132
155
133
- # Setup daemon.
156
+ ``` shell
157
+ # Set up the Docker daemon
134
158
cat > /etc/docker/daemon.json << EOF
135
159
{
136
160
"exec-opts": ["native.cgroupdriver=systemd"],
@@ -144,12 +168,17 @@ cat > /etc/docker/daemon.json <<EOF
144
168
]
145
169
}
146
170
EOF
171
+ ```
147
172
173
+ ``` shell
148
174
mkdir -p /etc/systemd/system/docker.service.d
175
+ ```
149
176
177
+ ``` shell
150
178
# Restart Docker
151
179
systemctl daemon-reload
152
180
systemctl restart docker
181
+ ```
153
182
{{< /tab >}}
154
183
{{< /tabs >}}
155
184
@@ -173,7 +202,7 @@ For more information, see the [CRI-O compatiblity matrix](https://github.com/cri
173
202
modprobe overlay
174
203
modprobe br_netfilter
175
204
176
- # Setup required sysctl params, these persist across reboots.
205
+ # Set up required sysctl params, these persist across reboots.
177
206
cat > /etc/sysctl.d/99-kubernetes-cri.conf << EOF
178
207
net.bridge.bridge-nf-call-iptables = 1
179
208
net.ipv4.ip_forward = 1
@@ -184,55 +213,79 @@ sysctl --system
184
213
```
185
214
186
215
{{< tabs name="tab-cri-cri-o-installation" >}}
187
- {{< tab name="Debian" codelang="bash" >}}
216
+ {{< tab name="Debian" >}}
217
+
218
+ ``` shell
188
219
# Debian Unstable/Sid
189
220
echo ' deb http://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/Debian_Unstable/ /' > /etc/apt/sources.list.d/devel:kubic:libcontainers:stable.list
190
221
wget -nv https://download.opensuse.org/repositories/devel:kubic:libcontainers:stable/Debian_Unstable/Release.key -O- | sudo apt-key add -
222
+ ```
191
223
224
+ ``` shell
192
225
# Debian Testing
193
226
echo ' deb http://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/Debian_Testing/ /' > /etc/apt/sources.list.d/devel:kubic:libcontainers:stable.list
194
227
wget -nv https://download.opensuse.org/repositories/devel:kubic:libcontainers:stable/Debian_Testing/Release.key -O- | sudo apt-key add -
228
+ ```
195
229
230
+ ``` shell
196
231
# Debian 10
197
232
echo ' deb http://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/Debian_10/ /' > /etc/apt/sources.list.d/devel:kubic:libcontainers:stable.list
198
233
wget -nv https://download.opensuse.org/repositories/devel:kubic:libcontainers:stable/Debian_10/Release.key -O- | sudo apt-key add -
234
+ ```
199
235
236
+ ``` shell
200
237
# Raspbian 10
201
238
echo ' deb http://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/Raspbian_10/ /' > /etc/apt/sources.list.d/devel:kubic:libcontainers:stable.list
202
239
wget -nv https://download.opensuse.org/repositories/devel:kubic:libcontainers:stable/Raspbian_10/Release.key -O- | sudo apt-key add -
240
+ ```
203
241
204
- # Install CRI-O
242
+ and then install CRI-O:
243
+ ``` shell
205
244
sudo apt-get install cri-o-1.17
245
+ ```
206
246
{{< /tab >}}
207
247
208
- {{< tab name="Ubuntu 18.04, 19.04 and 19.10" codelang="bash" >}}
209
- # Setup repository
248
+ {{< tab name="Ubuntu 18.04, 19.04 and 19.10" >}}
249
+
250
+ ``` shell
251
+ # Configure package repository
210
252
. /etc/os-release
211
253
sudo sh -c " echo 'deb http://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/x${NAME} _${VERSION_ID} / /' > /etc/apt/sources.list.d/devel:kubic:libcontainers:stable.list"
212
254
wget -nv https://download.opensuse.org/repositories/devel:kubic:libcontainers:stable/x${NAME} _${VERSION_ID} /Release.key -O- | sudo apt-key add -
213
255
sudo apt-get update
256
+ ```
214
257
258
+ ``` shell
215
259
# Install CRI-O
216
260
sudo apt-get install cri-o-1.17
261
+ ```
217
262
{{< /tab >}}
218
263
219
- {{< tab name="CentOS/RHEL 7.4+" codelang="bash" >}}
264
+ {{< tab name="CentOS/RHEL 7.4+" >}}
265
+
266
+ ``` shell
220
267
# Install prerequisites
221
268
curl -L -o /etc/yum.repos.d/devel:kubic:libcontainers:stable.repo https://download.opensuse.org/repositories/devel:kubic:libcontainers:stable/CentOS_7/devel:kubic:libcontainers:stable.repo
222
269
curl -L -o /etc/yum.repos.d/devel:kubic:libcontainers:stable:cri-o:{{< skew latestVersion > }}.repo https://download.opensuse.org/repositories/devel:kubic:libcontainers:stable:cri-o:{{< skew latestVersion > }}/CentOS_7/devel:kubic:libcontainers:stable:cri-o:{{< skew latestVersion > }}.repo
270
+ ```
223
271
272
+ ``` shell
224
273
# Install CRI-O
225
274
yum install -y cri-o
275
+ ```
226
276
{{< /tab >}}
227
277
228
- {{< tab name="openSUSE Tumbleweed" codelang="bash" >}}
278
+ {{< tab name="openSUSE Tumbleweed" >}}
279
+
280
+ ``` shell
229
281
sudo zypper install cri-o
282
+ ```
230
283
{{< /tab >}}
231
284
{{< /tabs >}}
232
285
233
286
### Start CRI-O
234
287
235
- ```
288
+ ``` shell
236
289
systemctl daemon-reload
237
290
systemctl start crio
238
291
```
@@ -270,51 +323,72 @@ sysctl --system
270
323
### Install containerd
271
324
272
325
{{< tabs name="tab-cri-containerd-installation" >}}
273
- {{< tab name="Ubuntu 16.04" codelang="bash" >}}
274
- # Install containerd
326
+ {{< tab name="Ubuntu 16.04" >}}
327
+
328
+ ``` shell
329
+ # (Install containerd)
275
330
# # Set up the repository
276
331
# ## Install packages to allow apt to use a repository over HTTPS
277
332
apt-get update && apt-get install -y apt-transport-https ca-certificates curl software-properties-common
333
+ ```
278
334
279
- ### Add Docker’s official GPG key
335
+ ``` shell
336
+ # # Add Docker’s official GPG key
280
337
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | apt-key add -
338
+ ```
281
339
282
- ### Add Docker apt repository.
340
+ ``` shell
341
+ # # Add Docker apt repository.
283
342
add-apt-repository \
284
343
" deb [arch=amd64] https://download.docker.com/linux/ubuntu \
285
344
$( lsb_release -cs) \
286
345
stable"
346
+ ```
287
347
348
+ ``` shell
288
349
# # Install containerd
289
350
apt-get update && apt-get install -y containerd.io
351
+ ```
290
352
353
+ ``` shell
291
354
# Configure containerd
292
355
mkdir -p /etc/containerd
293
356
containerd config default > /etc/containerd/config.toml
357
+ ```
294
358
359
+ ``` shell
295
360
# Restart containerd
296
361
systemctl restart containerd
362
+ ```
297
363
{{< /tab >}}
298
- {{< tab name="CentOS/RHEL 7.4+" codelang="bash" >}}
299
- # Install containerd
364
+ {{< tab name="CentOS/RHEL 7.4+" >}}
365
+
366
+ ``` shell
367
+ # (Install containerd)
300
368
# # Set up the repository
301
369
# ## Install required packages
302
370
yum install -y yum-utils device-mapper-persistent-data lvm2
303
371
304
- ### Add docker repository
372
+ ` ` ` shell
373
+ # # Add docker repository
305
374
yum-config-manager \
306
375
--add-repo \
307
376
https://download.docker.com/linux/centos/docker-ce.repo
308
377
378
+ ` ` ` shell
309
379
# # Install containerd
310
380
yum update -y && yum install -y containerd.io
311
381
312
- # Configure containerd
382
+ ` ` ` shell
383
+ # # Configure containerd
313
384
mkdir -p /etc/containerd
314
385
containerd config default > /etc/containerd/config.toml
386
+ ` ` `
315
387
388
+ ` ` ` shell
316
389
# Restart containerd
317
390
systemctl restart containerd
391
+ ` ` `
318
392
{{< /tab > }}
319
393
{{< /tabs > }}
320
394
0 commit comments