OPTIONS: --skip-verify, -k skip SSL certificate validation --plain-http allow connections using plain HTTP --user value, -u value user[:password] Registry user and password --refresh value refresh token for authorization server --hosts-dir value Custom hosts configuration directory --tlscacert value path to TLS root CA --tlscert value path to TLS client certificate --tlskey value path to TLS client key --http-dump dump all HTTP request/responses when interacting with container registry --http-trace enable HTTP tracing for registry interactions --snapshotter value snapshotter name. Empty value stands for the default value. [$CONTAINERD_SNAPSHOTTER] --label value labels to attach to the image --platform value Pull content from a specific platform --all-platforms pull content and metadata from all platforms --all-metadata Pull metadata for all platforms --print-chainid Print the resulting image's chain ID --max-concurrent-downloads value Set the max concurrent downloads for each pull (default: 0)
$ ctr --namespace k8s.io images pull 192.168.66.42:5000/busybox:latest INFO[0000] trying next host error="failed to do request: Head \"https://192.168.66.42:5000/v2/busybox/manifests/latest\": http: server gave HTTP response to HTTPS client" host="192.168.66.42:5000" ctr: failed to resolve reference "192.168.66.42:5000/busybox:latest": failed to do request: Head "https://192.168.66.42:5000/v2/busybox/manifests/latest": http: server gave HTTP response to HTTPS client
$ ctr --namespace k8s.io images pull harbor.test-cri.com/test-cri/busybox:latest INFO[0000] trying next host error="failed to do request: Head \"https://harbor.test-cri.com/v2/test-cri/busybox/manifests/latest\": x509: certificate signed by unknown authority" host=harbor.test-cri.com ctr: failed to resolve reference "harbor.test-cri.com/test-cri/busybox:latest": failed to do request: Head "https://harbor.test-cri.com/v2/test-cri/busybox/manifests/latest": x509: certificate signed by unknown authority
$ ctr --namespace k8s.io images pull registry.cn-hangzhou.aliyuncs.com/test-cri/busybox:latest registry.cn-hangzhou.aliyuncs.com/test-cri/busybox:latest: resolving |--------------------------------------| elapsed: 0.5 s total: 0.0 B (0.0 B/s) INFO[0000] trying next host error="pull access denied, repository does not exist or may require authorization: server message: insufficient_scope: authorization failed" host=registry.cn-hangzhou.aliyuncs.com ctr: failed to resolve reference "registry.cn-hangzhou.aliyuncs.com/test-cri/busybox:latest": pull access denied, repository does not exist or may require authorization: server message: insufficient_scope: authorization failed
OPTIONS: --annotation value, -a value [ --annotation value, -a value ] Annotation to be set on the pulled image --auth AUTH_STRING Use AUTH_STRING for accessing the registry. AUTH_STRING is a base64 encoded 'USERNAME[:PASSWORD]' [$CRICTL_AUTH] --creds USERNAME[:PASSWORD] Use USERNAME[:PASSWORD] for accessing the registry [$CRICTL_CREDS] --pod-config pod-config.[json|yaml] Use pod-config.[json|yaml] to override the the pull c --username USERNAME, -u USERNAME Use USERNAME for accessing the registry. The password will be requested on the command line --help, -h show help
拉取docker官方镜像
1 2
$ crictl pull busybox:latest Image is up to datefor sha256:beae173ccac6ad749f76713cf4440fe3d21d1043fe616dfbe30775815d1d0f6a
$ crictl pull registry.cn-hangzhou.aliyuncs.com/test-cri/busybox:latest E0619 16:44:57.810567 1900073 remote_image.go:171] "PullImage from image service failed" err="rpc error: code = Unknown desc = failed to pull and unpack image \"registry.cn-hangzhou.aliyuncs.com/test-cri/busybox:latest\": failed to resolve reference \"registry.cn-hangzhou.aliyuncs.com/test-cri/busybox:latest\": pull access denied, repository does not exist or may require authorization: server message: insufficient_scope: authorization failed" image="registry.cn-hangzhou.aliyuncs.com/test-cri/busybox:latest" FATA[0000] pulling image: rpc error: code = Unknown desc = failed to pull and unpack image "registry.cn-hangzhou.aliyuncs.com/test-cri/busybox:latest": failed to resolve reference "registry.cn-hangzhou.aliyuncs.com/test-cri/busybox:latest": pull access denied, repository does not exist or may require authorization: server message: insufficient_scope: authorization failed
$ crictl pull --creds $username:$password registry.cn-hangzhou.aliyuncs.com/test-cri/busybox:latest Image is up to datefor sha256:beae173ccac6ad749f76713cf4440fe3d21d1043fe616dfbe30775815d1d0f6a