github.com/containerd/nerdctl/v2@v2.0.0-beta.5.0.20240520001846-b5758f54fa28/README.md (about) 1 [[⬇️ **Download]**](https://github.com/containerd/nerdctl/releases) 2 [[📖 **Command reference]**](./docs/command-reference.md) 3 [[❓**FAQs & Troubleshooting]**](./docs/faq.md) 4 [[📚 **Additional documents]**](#additional-documents) 5 6 # nerdctl: Docker-compatible CLI for containerd 7 8 `nerdctl` is a Docker-compatible CLI for [contai**nerd**](https://containerd.io). 9 10 ✅ Same UI/UX as `docker` 11 12 ✅ Supports Docker Compose (`nerdctl compose up`) 13 14 ✅ [Optional] Supports [rootless mode, without slirp overhead (bypass4netns)](./docs/rootless.md) 15 16 ✅ [Optional] Supports lazy-pulling ([Stargz](./docs/stargz.md), [Nydus](./docs/nydus.md), [OverlayBD](./docs/overlaybd.md)) 17 18 ✅ [Optional] Supports [encrypted images (ocicrypt)](./docs/ocicrypt.md) 19 20 ✅ [Optional] Supports [P2P image distribution (IPFS)](./docs/ipfs.md) (\*1) 21 22 ✅ [Optional] Supports [container image signing and verifying (cosign)](./docs/cosign.md) 23 24 nerdctl is a **non-core** sub-project of containerd. 25 26 \*1: P2P image distribution (IPFS) is completely optional. Your host is NOT connected to any P2P network, unless you opt in to [install and run IPFS daemon](https://docs.ipfs.io/install/). 27 28 ## Examples 29 30 ### Basic usage 31 32 To run a container with the default `bridge` CNI network (10.4.0.0/24): 33 34 ```console 35 # nerdctl run -it --rm alpine 36 ``` 37 38 To build an image using BuildKit: 39 40 ```console 41 # nerdctl build -t foo /some-dockerfile-directory 42 # nerdctl run -it --rm foo 43 ``` 44 45 To build and send output to a local directory using BuildKit: 46 47 ```console 48 # nerdctl build -o type=local,dest=. /some-dockerfile-directory 49 ``` 50 51 To run containers from `docker-compose.yaml`: 52 53 ```console 54 # nerdctl compose -f ./examples/compose-wordpress/docker-compose.yaml up 55 ``` 56 57 See also [`./examples/compose-wordpress`](./examples/compose-wordpress). 58 59 ### Debugging Kubernetes 60 61 To list local Kubernetes containers: 62 63 ```console 64 # nerdctl --namespace k8s.io ps -a 65 ``` 66 67 To build an image for local Kubernetes without using registry: 68 69 ```console 70 # nerdctl --namespace k8s.io build -t foo /some-dockerfile-directory 71 # kubectl apply -f - <<EOF 72 apiVersion: v1 73 kind: Pod 74 metadata: 75 name: foo 76 spec: 77 containers: 78 - name: foo 79 image: foo 80 imagePullPolicy: Never 81 EOF 82 ``` 83 84 To load an image archive (`docker save` format or OCI format) into local Kubernetes: 85 86 ```console 87 # nerdctl --namespace k8s.io load < /path/to/image.tar 88 ``` 89 90 To read logs (experimental): 91 ```console 92 # nerdctl --namespace=k8s.io ps -a 93 CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES 94 ... 95 e8793b8cca8b registry.k8s.io/coredns/coredns:v1.9.3 "/coredns -conf /etc…" 2 minutes ago Up k8s://kube-system/coredns-787d4945fb-mfx6b/coredns 96 ... 97 98 # nerdctl --namespace=k8s.io logs -f e8793b8cca8b 99 [INFO] plugin/reload: Running configuration SHA512 = 591cf328cccc12bc490481273e738df59329c62c0b729d94e8b61db9961c2fa5f046dd37f1cf888b953814040d180f52594972691cd6ff41be96639138a43908 100 CoreDNS-1.9.3 101 linux/amd64, go1.18.2, 45b0a11 102 ... 103 ``` 104 105 ### Rootless mode 106 107 To launch rootless containerd: 108 109 ```console 110 $ containerd-rootless-setuptool.sh install 111 ``` 112 113 To run a container with rootless containerd: 114 115 ```console 116 $ nerdctl run -d -p 8080:80 --name nginx nginx:alpine 117 ``` 118 119 See [`./docs/rootless.md`](./docs/rootless.md). 120 121 ## Install 122 123 Binaries are available here: <https://github.com/containerd/nerdctl/releases> 124 125 In addition to containerd, the following components should be installed: 126 127 - [CNI plugins](https://github.com/containernetworking/plugins): for using `nerdctl run`. 128 - v1.1.0 or later is highly recommended. 129 - [BuildKit](https://github.com/moby/buildkit) (OPTIONAL): for using `nerdctl build`. BuildKit daemon (`buildkitd`) needs to be running. See also [the document about setting up BuildKit](./docs/build.md). 130 - v0.11.0 or later is highly recommended. Some features, such as pruning caches with `nerdctl system prune`, do not work with older versions. 131 - [RootlessKit](https://github.com/rootless-containers/rootlesskit) and [slirp4netns](https://github.com/rootless-containers/slirp4netns) (OPTIONAL): for [Rootless mode](./docs/rootless.md) 132 - RootlessKit needs to be v0.10.0 or later. v2.0.0 or later is recommended. 133 - slirp4netns needs to be v0.4.0 or later. v1.1.7 or later is recommended. 134 135 These dependencies are included in `nerdctl-full-<VERSION>-<OS>-<ARCH>.tar.gz`, but not included in `nerdctl-<VERSION>-<OS>-<ARCH>.tar.gz`. 136 137 ### Brew 138 139 On Linux systems you can install nerdctl via [brew](https://brew.sh): 140 141 ```bash 142 brew install nerdctl 143 ``` 144 145 This is currently not supported for macOS. The section below shows how to install on macOS using brew. 146 147 ### macOS 148 149 [Lima](https://github.com/lima-vm/lima) project provides Linux virtual machines for macOS, with built-in integration for nerdctl. 150 151 ```console 152 $ brew install lima 153 $ limactl start 154 $ lima nerdctl run -d --name nginx -p 127.0.0.1:8080:80 nginx:alpine 155 ``` 156 157 ### FreeBSD 158 159 See [`./docs/freebsd.md`](docs/freebsd.md). 160 161 ### Windows 162 163 - Linux containers: Known to work on WSL2 164 - Windows containers: experimental support for Windows (see below for features that are currently known to work) 165 166 ### Docker 167 168 To run containerd and nerdctl inside Docker: 169 170 ```bash 171 docker build -t nerdctl . 172 docker run -it --rm --privileged nerdctl 173 ``` 174 175 ## Motivation 176 177 The goal of `nerdctl` is to facilitate experimenting the cutting-edge features of containerd that are not present in Docker (see below). 178 179 Note that competing with Docker is _not_ the goal of `nerdctl`. Those cutting-edge features are expected to be eventually available in Docker as well. 180 181 Also, `nerdctl` might be potentially useful for debugging Kubernetes clusters, but it is not the primary goal. 182 183 ## Features present in `nerdctl` but not present in Docker 184 185 Major: 186 187 - On-demand image pulling (lazy-pulling) using [Stargz](./docs/stargz.md)/[Nydus](./docs/nydus.md)/[OverlayBD](./docs/overlaybd.md)/[SOCI](./docs/soci.md) Snapshotter: `nerdctl --snapshotter=stargz|nydus|overlaybd|soci run IMAGE` . 188 - [Image encryption and decryption using ocicrypt (imgcrypt)](./docs/ocicrypt.md): `nerdctl image (encrypt|decrypt) SRC DST` 189 - [P2P image distribution using IPFS](./docs/ipfs.md): `nerdctl run ipfs://CID` . 190 P2P image distribution (IPFS) is completely optional. Your host is NOT connected to any P2P network, unless you opt in to [install and run IPFS daemon](https://docs.ipfs.io/install/). 191 - [Cosign integration](./docs/cosign.md): `nerdctl pull --verify=cosign` and `nerdctl push --sign=cosign`, and [in Compose](./docs/cosign.md#cosign-in-compose) 192 - [Accelerated rootless containers using bypass4netns](./docs/rootless.md): `nerdctl run --annotation nerdctl/bypass4netns=true` 193 194 Minor: 195 196 - Namespacing: `nerdctl --namespace=<NS> ps` . 197 (NOTE: All Kubernetes containers are in the `k8s.io` containerd namespace regardless to Kubernetes namespaces) 198 - Exporting Docker/OCI dual-format archives: `nerdctl save` . 199 - Importing OCI archives as well as Docker archives: `nerdctl load` . 200 - Specifying a non-image rootfs: `nerdctl run -it --rootfs <ROOTFS> /bin/sh` . The CLI syntax conforms to Podman convention. 201 - Connecting a container to multiple networks at once: `nerdctl run --net foo --net bar` 202 - Running [FreeBSD jails](./docs/freebsd.md). 203 - Better multi-platform support, e.g., `nerdctl pull --all-platforms IMAGE` 204 - Applying an (existing) AppArmor profile to rootless containers: `nerdctl run --security-opt apparmor=<PROFILE>`. 205 Use `sudo nerdctl apparmor load` to load the `nerdctl-default` profile. 206 - Systemd compatibility support: `nerdctl run --systemd=always` 207 208 Trivial: 209 210 - Inspecting raw OCI config: `nerdctl container inspect --mode=native` . 211 212 ## Features implemented in `nerdctl` ahead of Docker 213 214 - Recursive read-only (RRO) bind-mount: `nerdctl run -v /mnt:/mnt:rro` (make children such as `/mnt/usb` to be read-only, too). 215 Requires kernel >= 5.12. 216 The same feature was later introduced in Docker v25 with a different syntax. nerdctl will support Docker v25 syntax too in the future. 217 ## Similar tools 218 219 - [`ctr`](https://github.com/containerd/containerd/tree/main/cmd/ctr): incompatible with Docker CLI, and not friendly to users. 220 Notably, `ctr` lacks the equivalents of the following nerdctl commands: 221 - `nerdctl run -p <PORT>` 222 - `nerdctl run --restart=always --net=bridge` 223 - `nerdctl pull` with `~/.docker/config.json` and credential helper binaries such as `docker-credential-ecr-login` 224 - `nerdctl logs` 225 - `nerdctl build` 226 - `nerdctl compose up` 227 228 - [`crictl`](https://github.com/kubernetes-sigs/cri-tools): incompatible with Docker CLI, not friendly to users, and does not support non-CRI features 229 - [k3c v0.2 (abandoned)](https://github.com/rancher/k3c/tree/v0.2.1): needs an extra daemon, and does not support non-CRI features 230 - [Rancher Kim (nee k3c v0.3)](https://github.com/rancher/kim): needs Kubernetes, and only focuses on image management commands such as `kim build` and `kim push` 231 - [PouchContainer (abandoned?)](https://github.com/alibaba/pouch): needs an extra daemon 232 233 ## Developer guide 234 235 nerdctl is a containerd **non-core** sub-project, licensed under the [Apache 2.0 license](./LICENSE). 236 As a containerd non-core sub-project, you will find the: 237 238 - [Project governance](https://github.com/containerd/project/blob/main/GOVERNANCE.md), 239 - [Maintainers](./MAINTAINERS), 240 - and [Contributing guidelines](https://github.com/containerd/project/blob/main/CONTRIBUTING.md) 241 242 information in our [`containerd/project`](https://github.com/containerd/project) repository. 243 244 ### Compiling nerdctl from source 245 246 Run `make && sudo make install`. 247 248 See the header of [`go.mod`](./go.mod) for the minimum supported version of Go. 249 250 Using `go install github.com/containerd/nerdctl/v2/cmd/nerdctl` is possible, but unrecommended because it does not fill version strings printed in `nerdctl version` 251 252 ### Test suite 253 254 #### Running unit tests 255 256 Run `go test -v ./pkg/...` 257 258 #### Running integration test suite against nerdctl 259 260 Run `go test -exec sudo -v ./cmd/nerdctl/...` after `make && sudo make install`. 261 262 For testing rootless mode, `-exec sudo` is not needed. 263 264 To run tests in a container: 265 266 ```bash 267 docker build -t test-integration --target test-integration . 268 docker run -t --rm --privileged test-integration 269 ``` 270 271 #### Running integration test suite against Docker 272 273 Run `go test -exec sudo -v ./cmd/nerdctl/... -args -test.target=docker` to ensure that the test suite is compatible with Docker. 274 275 ### Contributing to nerdctl 276 277 Lots of commands and flags are currently missing. Pull requests are highly welcome. 278 279 Please certify your [Developer Certificate of Origin (DCO)](https://developercertificate.org/), by signing off your commit with `git commit -s` and with your real name. 280 281 # Command reference 282 283 Moved to [`./docs/command-reference.md`](./docs/command-reference.md) 284 285 # Additional documents 286 287 Configuration guide: 288 289 - [`./docs/config.md`](./docs/config.md): Configuration (`/etc/nerdctl/nerdctl.toml`, `~/.config/nerdctl/nerdctl.toml`) 290 - [`./docs/registry.md`](./docs/registry.md): Registry authentication (`~/.docker/config.json`) 291 292 Basic features: 293 294 - [`./docs/compose.md`](./docs/compose.md): Compose 295 - [`./docs/rootless.md`](./docs/rootless.md): Rootless mode 296 - [`./docs/cni.md`](./docs/cni.md): CNI for containers network 297 - [`./docs/build.md`](./docs/build.md): `nerdctl build` with BuildKit 298 299 Advanced features: 300 301 - [`./docs/stargz.md`](./docs/stargz.md): Lazy-pulling using Stargz Snapshotter 302 - [`./docs/nydus.md`](./docs/nydus.md): Lazy-pulling using Nydus Snapshotter 303 - [`./docs/overlaybd.md`](./docs/overlaybd.md): Lazy-pulling using OverlayBD Snapshotter 304 - [`./docs/ocicrypt.md`](./docs/ocicrypt.md): Running encrypted images 305 - [`./docs/gpu.md`](./docs/gpu.md): Using GPUs inside containers 306 - [`./docs/multi-platform.md`](./docs/multi-platform.md): Multi-platform mode 307 308 Experimental features: 309 310 - [`./docs/experimental.md`](./docs/experimental.md): Experimental features 311 - [`./docs/freebsd.md`](./docs/freebsd.md): Running FreeBSD jails 312 - [`./docs/ipfs.md`](./docs/ipfs.md): Distributing images on IPFS 313 - [`./docs/builder-debug.md`](./docs/builder-debug.md): Interactive debugging of Dockerfile 314 315 Implementation details: 316 317 - [`./docs/dir.md`](./docs/dir.md): Directory layout (`/var/lib/nerdctl`) 318 319 Misc: 320 321 - [`./docs/faq.md`](./docs/faq.md): FAQs and Troubleshooting