Learn how to - Using Mirantis Container Runtime(MCR) in Kubernetes and Docker Swarm

Felix Williams Containers How to Kubernetes April 17, 2023

Learn how to – Using Mirantis Container Runtime(MCR) in Kubernetes and Docker Swarm.

Welcome to this guide on how to use Mirantis Container Runtime(MCR) in Kubernetes and Docker Swarm. The Mirantis Container Runtime(MCR) formerly known as the Docker Engine (Enterprise), is a secure container runtime that provides a base for the Mirantis Kubernetes Engine and Container Cloud. It provides increased security using the Mirantis Secure Registry, incorporated with Content Trust and FIPS 140-2 encryption.

The Mirantis Container Runtime(MCR) installation has been made easy with the introduction of an automation script. Although there are still circumstances where you are required to perform a manual installation. For example, installing Mirantis Container Runtime(MCR) to prepare a server/node to be added to an existing Mirantis Kubernetes Engine cluster that originally wasn’t managed by Mirantis Container Cloud.

Using Mirantis Container Runtime(MCR) in Kubernetes and Docker Swarm 1

There are many features and capabilities provided by the Mirantis Container Runtime(MCR). Some of them are:

Intrinsic Security: It is secure by default. Containers are deployed with restricted host access, end-to-end encryption, secure mutual TLS authentication, and cryptographic node identity.
Multiple Operating Systems and Infrastructures: It is certified to run on multiple operating systems that include RHEL, Ubuntu, CentOS, and Windows systems.
Certified Plugins: There are certified plugins that let you extend the functionality of Mirantis Container Runtime(MCR). They include; Calico, Kubernetes ingress solutions like Istio e.t.c
Enforce Signed Images: Proper digital signing of images is required to validate the container provenance before they are deployed. This prevents users from using images from unknown sources.

By following this guide to the end, you will gain the required knowledge on how to use Mirantis Container Runtime in Kubernetes and Docker Swarm.

System Requirements

This guide will work with the following:

Minimum Hardware Requirements for MKE nodes

8GB of RAM for manager nodes
4GB of RAM for worker nodes
2 vCPUs for manager nodes
25GB of free disk space

Production Hardware Requirements for MKE nodes

16GB of RAM for manager nodes
4 vCPUs for manager nodes
25-100GB of free disk space. SSD is recommended.

Step 1 – Prepare your Server

This guide demonstrates how to install the Mirantis Container Runtime(MCR) on several Linux distributions from the repository.

Begin by removing previous docker installations:

On CentOS/Rhel

sudo yum remove docker 
                docker-client 
                docker-client-latest 
                docker-common 
                docker-latest 
                docker-latest-logrotate 
                docker-logrotate 
                docker-selinux 
                runc 
                docker-engine-selinux 
                docker-engine

On Ubuntu

sudo apt-get remove docker docker-engine docker-ce docker-ce-cli docker.io

On SLES

sudo zypper rm docker docker-engine runc
##OR
sudo rpm -e docker-engine

Step 2 – Add the Mirantis Container Runtime(MCR) Repository

Add the Mirantis Container Runtime(MCR) Repository to your system.

On Rhel/CentOS

Remove the available docker repo:

sudo rm /etc/yum.repos.d/docker*.repo
sudo yum install -y yum-utils
export DOCKERURL="https://repos.mirantis.com"

Enable the extras Rhel repo to install container-selinux packages

##On CentOS 7
sudo -E sh -c 'echo "$DOCKERURL/centos" > /etc/yum/vars/dockerurl'
sudo sh -c 'echo "7" > /etc/yum/vars/dockerosversion'
sudo yum-config-manager --enable rhel-7-server-extras-rpms

##On RHEL 7
sudo -E sh -c 'echo "$DOCKERURL/rhel" > /etc/yum/vars/dockerurl'
sudo sh -c 'echo "7" > /etc/yum/vars/dockerosversion'
sudo yum-config-manager --enable rhel-7-server-extras-rpms

##On CentOS 8
sudo -E sh -c 'echo "$DOCKERURL/centos" > /etc/yum/vars/dockerurl'
sudo sh -c 'echo "8" > /etc/yum/vars/dockerosversion'

##On Rocky Linux 8
sudo -E sh -c 'echo "$DOCKERURL/rocky" > /etc/yum/vars/dockerurl'
sudo sh -c 'echo "8" > /etc/yum/vars/dockerosversion'

##On RHEL 8
sudo -E sh -c 'echo "$DOCKERURL/rhel" > /etc/yum/vars/dockerurl'
sudo sh -c 'echo "8" > /etc/yum/vars/dockerosversion'

Now add the MCR stable repository:

sudo -E yum-config-manager 
    --add-repo 
    "$DOCKERURL/centos/docker-ee.repo"

On Ubuntu

Begin by installing the required packages:

sudo apt install 
  apt-transport-https 
  ca-certificates 
  curl 
  software-properties-common

Export the variables:

DOCKER_EE_URL="https://repos.mirantis.com"
DOCKER_EE_VERSION=20.10

Add the GPG keys for the repository:

curl -fsSL "${DOCKER_EE_URL}/ubuntu/gpg" | sudo apt-key add -

Finally, add the stable repository to the system.

### Ubuntu 22.04 / 20.04 ###
sudo add-apt-repository "deb [arch=$(dpkg --print-architecture)] $DOCKER_EE_URL/ubuntu focal stable"

### Ubuntu 18.04 ###
sudo add-apt-repository "deb [arch=$(dpkg --print-architecture)] $DOCKER_EE_URL/ubuntu bionic stable"

On SLES

Export the variables:

DOCKER_EE_BASE_URL="https://repos.mirantis.com"
DOCKER_EE_URL="${DOCKER_EE_BASE_URL}/sles/<SLES_VERSION>/<ARCH>/stable-<DOCKER_VERSION>"

Remember to replace the values for:

SLES_VERSION – 15 or 12.3.
ARCH – x86_64.
DOCKER_VERSION – 20.10, there are also older releases such as 19.03, 18.09, 18.03 e.t.c

Using the variables, set up the repository:

sudo zypper addrepo $DOCKER_EE_URL docker-ee-stable

Import the GPG keys:

sudo rpm --import "${DOCKER_EE_BASE_URL}/sles/gpg"

Step 3 – Install Mirantis Container Runtime(MCR)

Once the repository has been configured, proceed and install Mirantis Container Runtime(MCR) with the command:

##On CentOS/RHEL
sudo yum -y install docker-ee docker-ee-cli containerd.io

##On Ubuntu
sudo apt update
sudo apt install docker-ee docker-ee-cli containerd.io

##On SLES
sudo zypper refresh
sudo zypper install docker-ee docker-ee-cli containerd.io

You can also install a specific version for production purposes:

##On CentOS/RHEL
sudo yum -y install docker-ee-<VERSION_STRING> docker-ee-cli-<VERSION_STRING> containerd.io

##On Ubuntu
sudo apt-get install docker-ee=<VERSION_STRING> docker-ee-cli=<VERSION_STRING> containerd.io

##On SLES
sudo zypper install docker-ee-<VERSION_STRING> docker-ee-cli-<VERSION_STRING> containerd.io

Replace the VERSION_STRING with the appropriate version to install.

Step 4 – Test Mirantis Container Runtime(MCR)

Once installed, start the docker daemon.

sudo systemctl enable --now docker

Verify if it is running:

$ systemctl status docker
● docker.service - Docker Application Container Engine
     Loaded: loaded (/lib/systemd/system/docker.service; enabled; vendor preset: enabled)
     Active: active (running) since Thu 2022-06-02 10:01:03 UTC; 4min 32s ago
TriggeredBy: ● docker.socket
       Docs: https://docs.docker.com
   Main PID: 3811 (dockerd)
      Tasks: 8
     Memory: 27.6M
     CGroup: /system.slice/docker.service
             └─3811 /usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock

Add your user to the Docker group.

sudo usermod -aG docker $USER
newgrp docker

Test by running a hello-world container.

docker run hello-world

Sample Output:

Unable to find image 'hello-world:latest' locally
latest: Pulling from library/hello-world
2db29710123e: Pull complete 
Digest: sha256:80f31da1ac7b312ba29d65080fddf797dd76acfb870e677f390d5acba9741b17
Status: Downloaded newer image for hello-world:latest

Hello from Docker!
This message shows that your installation appears to be working correctly.

To generate this message, Docker took the following steps:
 1. The Docker client contacted the Docker daemon.
 2. The Docker daemon pulled the "hello-world" image from the Docker Hub.
    (amd64)
 3. The Docker daemon created a new container from that image which runs the
    executable that produces the output you are currently reading.
 4. The Docker daemon streamed that output to the Docker client, which sent it
    to your terminal.

To try something more ambitious, you can run an Ubuntu container with:
 $ docker run -it ubuntu bash

Share images, automate workflows, and more with a free Docker ID:
 https://hub.docker.com/

For more examples and ideas, visit:
 https://docs.docker.com/get-started/

Step 5 – Use MCR with Kubernetes

MCR can be used to provide a container runtime for Kubernetes pods. It is possible to use MCR with Kubernetes directly without MKE. Just enable the cri-dockerplugin.

sudo systemctl enable --now cri-docker.service

Check the status:

$ systemctl status cri-docker.socket
● cri-docker.socket - CRI Docker Socket for the API
   Loaded: loaded (/usr/lib/systemd/system/cri-docker.socket; disabled; vendor preset: disabled)
   Active: active (running) since Thu 2022-06-02 06:11:59 EDT; 10s ago
   Listen: /run/cri-docker.sock (Stream)
    Tasks: 0 (limit: 23505)
   Memory: 4.0K
   CGroup: /system.slice/cri-docker.socket

From the above output, we can identify the default socket:

Listen: /run/cri-docker.sock

Proceed and use the Mirantis Container Runtime(MCR) as preferred. On a new Kubernetes cluster, you can use MCR as shown. I assume you already have Kubeadmin and all the required kubelets installed.

You can use the below guide to achieve this.

Proceed and pull container images

$ sudo kubeadm config images pull --cri-socket /run/cri-docker.sock 
[config/images] Pulled k8s.gcr.io/kube-apiserver:v1.24.1
[config/images] Pulled k8s.gcr.io/kube-controller-manager:v1.24.1
[config/images] Pulled k8s.gcr.io/kube-scheduler:v1.24.1
[config/images] Pulled k8s.gcr.io/kube-proxy:v1.24.1
[config/images] Pulled k8s.gcr.io/pause:3.7
[config/images] Pulled k8s.gcr.io/etcd:3.5.3-0
[config/images] Pulled k8s.gcr.io/coredns/coredns:v1.8.6

Use MCR on a New Kubernetes cluster

Now bootstrap the control node. The below example can be used for a single node controller.

sudo kubeadm init 
  --pod-network-cidr=192.168.0.0/16 
  --cri-socket /run/cri-docker.sock

Sample Output:

Your Kubernetes control-plane has initialized successfully!

To start using your cluster, you need to run the following as a regular user:

  mkdir -p $HOME/.kube
  sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
  sudo chown $(id -u):$(id -g) $HOME/.kube/config

Alternatively, if you are the root user, you can run:

  export KUBECONFIG=/etc/kubernetes/admin.conf

You should now deploy a pod network to the cluster.
Run "kubectl apply -f [podnetwork].yaml" with one of the options listed at:
  https://kubernetes.io/docs/concepts/cluster-administration/addons/

Then you can join any number of worker nodes by running the following on each as root:

kubeadm join 192.168.205.9:6443 --token 4oga4y.6uhgxfvf2cm0hc3g 
	--discovery-token-ca-cert-hash sha256:7adf6b202bf0541bd0612b918477d979b6ed671bdcacf0d3910e521f66abc153

If you had the control node initialized, reset it before executing the above command.

sudo kubeadm reset

Once initialized, the certificate file

mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config

Verify if the nodes are running:

$ kubectl get nodes
NAME                    STATUS   ROLES           AGE     VERSION
localhost.localdomain   Ready    control-plane   3m21s   v1.24.1

Also, verify if the runtime endpoint is configured:

$ sudo cat /var/lib/kubelet/kubeadm-flags.env
KUBELET_KUBEADM_ARGS="--container-runtime=remote --container-runtime-endpoint=unix:///run/cri-docker.sock --pod-infra-container-image=k8s.gcr.io/pause:3.7"

Migrate Existing Nodes to MCR

At times, you might find yourself in a situation where you need to migrate existing nodes from dockershim to MCR

Cordon the node:

kubectl cordon <NODE_NAME>

Proceed and drain the node:

kubectl drain <NODE_NAME> --ignore-daemonsets

Open the file below on the node:

sudo vim /var/lib/kubelet/kubeadm-flags.env

Modify the line:

--container-runtime-endpoint
#TO
unix:///var/run/cri-docker.sock

Finally, edit the YAMLrepresentation for the node socket:

sudo KUBECONFIG=/etc/kubernetes/admin.conf kubectl edit no <NODE_NAME>

In the file, change kubeadm.alpha.kubernetes.io/cri-socket

##FROM
/var/run/dockershim.sock 

##TO
unix:///var/run/cri-docker.sock

Restart the kubelet and un cordon the node:

sudo systemctl restart kubelet
kubectl uncordon <NODE_NAME>

Step 6 – Install the Mirantis Container Runtime(MCR) License

Obtain a License from the Mirantis Container Runtime(MCR) page. Follow the provided email link to download your license file.

Copy the file data and paste it to the root directory in a file called docker.lic.

sudi vim /var/lib/docker/docker.lic

Once the file has been created, restart MCR.

sudo systemctl restart docker

Verify the installation.

sudo docker info | grep -i license

Closing Thoughts.

That was enough learning! We have walked through how to install and use the Mirantis Container Runtime(MCR) in Kubernetes and Docker Swarm. I hope this was significant.

See more:

Cart

Learn how to – Using Mirantis Container Runtime(MCR) in Kubernetes and Docker Swarm