1.下載containerd-1.6.1-linux-amd64.tar.gz
tar -C /usr/local -xf containerd-1.6.1-linux-amd64.tar.gz

/lib/systemd/system/containerd.service 檔案如下:

[Unit]
Description=containerd container runtime
Documentation=https://containerd.io
After=network.target

[Service]
ExecStartPre=/sbin/modprobe overlay
ExecStart=/usr/local/bin/containerd
Delegate=yes
KillMode=process
LimitNOFILE=1048576
# Having non-zero Limit*s causes performance problems due to accounting overhead
# in the kernel. We recommend using cgroups to do container-local accounting.
LimitNPROC=infinity
LimitCORE=infinity

[Install]
WantedBy=multi-user.target

sudo systemctl daemon-reload
sudo systemctl enable containerd.service
sudo systemctl start containerd.service

2. 安裝網路外掛
https://github.com/containernetworking/plugins/releases
下載 cni-plugins-linux-amd64-v1.1.1.tgz
tar zxvf  cni-plugins-linux-amd64-v1.1.1.tgz -C /opt/cni/bin/

3.安裝crictl

vi /etc/crictl.yaml 
runtime-endpoint: unix:///run/containerd/containerd.sock
image-endpoint: unix:///run/containerd/containerd.sock
timeout: 10
debug: false

$ cat container-config.json
{
  "metadata": {
      "name": "busybox"
  },
  "image":{
      "image": "busybox"
  },
  "command": [
      "top"
  ],
  "log_path":"busybox.0.log",
  "linux": {
  }
}

$ cat pod-config.json
{
    "metadata": {
        "name": "nginx-sandbox",
        "namespace": "default",
        "attempt": 1,
        "uid": "hdishd83djaidwnduwk28bcsb"
    },
    "log_directory": "/tmp",
    "linux": {
    }
}

來源https://github.com/containernetworking/cni
$ mkdir -p /etc/cni/net.d
$ cat >/etc/cni/net.d/10-mynet.conf <<EOF
{
    "cniVersion": "0.2.0",
    "name": "mynet",
    "type": "bridge",
    "bridge": "cni0",
    "isGateway": true,
    "ipMasq": true,
    "ipam": {
        "type": "host-local",
        "subnet": "10.22.0.0/16",
        "routes": [
            { "dst": "0.0.0.0/0" }
        ]
    }
}
EOF
$ cat >/etc/cni/net.d/99-loopback.conf <<EOF
{
    "cniVersion": "0.2.0",
    "name": "lo",
    "type": "loopback"
}
EOF

nerdctl -n k8s.io  pull registry.aliyuncs.com/google_containers/pause:3.6
nerdctl -n k8s.io  tag registry.aliyuncs.com/google_containers/pause:3.6 k8s.gcr.io/pause:3.6 

crictl run --no-pull container-config.json pod-config.json 啟動pod

4. kata環境
https://github.com/kata-containers/kata-containers/releases
下載kata二進位制包
xz -d kata-static-2.3.2-x86_64.tar.xz 
tar xvf kata-static-2.3.2-x86_64.tar -C /
/opt/kata/bin下面把 containerd-shim-kata-v2和kata-runtime複製/usr/local/bin目錄

ref :https://github.com/kata-containers/kata-containers/blob/main/docs/install/container-manager/containerd/containerd-install.md
修改 /ect/containerd/config.toml
[plugins]
  [plugins."io.containerd.grpc.v1.cri"]
    [plugins."io.containerd.grpc.v1.cri".containerd]
      default_runtime_name = "kata"
      [plugins."io.containerd.grpc.v1.cri".containerd.runtimes]
        [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.kata]
          runtime_type = "io.containerd.kata.v2"

 kata-runtime kata-check
 如果報錯
 host system doesn't support vsock: stat /dev/vhost-vsock: no such file or directory: unknown
 執行

modprobe vhost-vsock
 把/opt/kata/share/defaults/kata-containers/configuration.toml 複製到  /etc/kata-containers/
 crictl run --no-pull container-config.json pod-config.json 啟動pod
 如果報錯
 Could not create the sandbox cgroup cgroups: cgroup mountpoint does not exist: not found

執行
sudo mkdir /sys/fs/cgroup/systemd
sudo mount -t cgroup -o none,name=systemd cgroup /sys/fs/cgroup/systemd

crictl run --no-pull container-config.json pod-config.json
62b048f367bde2235162df83e9c15acd02eff8f38d6bc68a0b1f39e41ab4c9e9
root@nmx-NUC8i5BEH:/home/nmx/pod# kata-runtime exec 62b048f367bde2235162df83e9c15acd02eff8f38d6bc68a0b1f39e41ab4c9e9
Get "http://shim/agent-url": context deadline exceeded (Client.Timeout exceeded while awaiting headers)

crictl inspectp podid
找到
"status": {
    "id": "ad7325b511a2cf1f185eaea86567ad188370df80e90e656558c9008ac7d822b7",

kata-runtime exec ad7325b511a2cf1f185eaea86567ad188370df80e90e656558c9008ac7d822b7