diff --git a/content/zh/docs/setup/production-environment/container-runtimes.md b/content/zh/docs/setup/production-environment/container-runtimes.md index 2873951241..524e75b034 100644 --- a/content/zh/docs/setup/production-environment/container-runtimes.md +++ b/content/zh/docs/setup/production-environment/container-runtimes.md @@ -35,13 +35,13 @@ A flaw was found in the way runc handled system file descriptors when running co A malicious container could use this flaw to overwrite contents of the runc binary and consequently run arbitrary commands on the container host system. -Please refer to this link for more information about this issue -[cve-2019-5736 : runc vulnerability ] (https://access.redhat.com/security/cve/cve-2019-5736) +Please refer to [CVE-2019-5736](https://access.redhat.com/security/cve/cve-2019-5736) for more +information about the issue. --> 我们发现 runc 在运行容器,处理系统文件描述符时存在一个漏洞。 恶意容器可以利用此漏洞覆盖 runc 二进制文件的内容,并以此在主机系统的容器上运行任意的命令。 -请参考此链接以获取有关此问题的更多信息 [cve-2019-5736 : runc vulnerability ](https://access.redhat.com/security/cve/cve-2019-5736) +请参考此链接以获取有关此问题的更多信息 [cve-2019-5736: runc vulnerability](https://access.redhat.com/security/cve/cve-2019-5736) {{< /caution >}} -```shell -# 安装必备软件 -yum-config-manager --add-repo=https://cbs.centos.org/repos/paas7-crio-115-release/x86_64/os/ -``` +要在以下操作系统上安装,请将环境变量 `$OS` 设置为下表中的相应字段: + +| 操作系统 | $OS | +| ---------------- | ----------------- | +| Centos 8 | `CentOS_8` | +| Centos 8 Stream | `CentOS_8_Stream` | +| Centos 7 | `CentOS_7` | + +
+然后将 `$VERSION` 设置为与你的 Kubernetes 相匹配的 CRI-O 版本。 +例如,如果要安装 CRI-O 1.18,请设置 `VERSION=1.18`。 +你也可以安装特定版本,例如 1.18.3,请设置 `VERSION=1.18:1.18.3`。 +
+ +确保声明变量后,使用下面命令安装 ```shell -# 安装 CRI-O -yum install --nogpgcheck cri-o +curl -L -o /etc/yum.repos.d/devel:kubic:libcontainers:stable.repo https://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/$OS/devel:kubic:libcontainers:stable.repo +curl -L -o /etc/yum.repos.d/devel:kubic:libcontainers:stable:cri-o:$VERSION.repo https://download.opensuse.org/repositories/devel:kubic:libcontainers:stable:cri-o:$VERSION/$OS/devel:kubic:libcontainers:stable:cri-o:$VERSION.repo +yum install cri-o ``` {{% /tab %}} @@ -552,8 +583,43 @@ yum install --nogpgcheck cri-o ```shell sudo zypper install cri-o ``` + {{% /tab %}} +{{% tab name="Fedora" %}} + + +将 `$VERSION` 设置为与你的 Kubernetes 相匹配的 CRI-O 版本。 +例如,如果要安装 CRI-O 1.18,请设置 `VERSION=1.18`。 +你可以用下列命令查找可用的版本: + +```shell +dnf module list cri-o +``` + +CRI-O 不支持在 Fedora 上固定到特定的版本。 +运行下列命令安装 + +```shell +dnf module enable cri-o:$VERSION +dnf install cri-o +``` + +{{% /tab %}} {{< /tabs >}}