#containerd — Public Fediverse posts

Could someone convince me that the #toml file format belongs anywhere in the modern #Kubernetes stack? #yaml, obviously. #json? Sure, while we're phasing it out. But toml? It's full of repetition, it's not really well supported by neither Ansible nor Terraform and it's not easy to manipulate in a sane and safe way with simple search-and-replace. In short, a nightmare when attempting to apply configuration management.

It's a mystery to me why #containerd is still configured with toml. Even #Traefik supports yaml now. Please help me understand.

Note: Mike Farah's excellent yq can handle toml files, but it would have been so much easier if it was just yaml.

Could someone convince me that the #toml file format belongs anywhere in the modern #Kubernetes stack? #yaml, obviously. #json? Sure, while we're phasing it out. But toml? It's full of repetition, it's not really well supported by neither Ansible nor Terraform and it's not easy to manipulate in a sane and safe way with simple search-and-replace. In short, a nightmare when attempting to apply configuration management.

It's a mystery to me why #containerd is still configured with toml. Even #Traefik supports yaml now. Please help me understand.

Note: Mike Farah's excellent yq can handle toml files, but it would have been so much easier if it was just yaml.

firecracker-containerd enables #containerd to manage containers as Firecracker microVMs

https://github.com/firecracker-microvm/firecracker-containerd

#linux #containers #microvm

firecracker-containerd enables #containerd to manage containers as Firecracker microVMs

https://github.com/firecracker-microvm/firecracker-containerd

#linux #containers #microvm

WSL can be a great tool to enable cross-platform development from Windows. However, you might have to move machines, ... and what if that is actually not a Windows machine? You can use your exported environment easily in a container runtime like #containerd or #podman I just got my 99G environment with mingw64, android-sdk, etc moved over. ... and can continue developing.

https://gist.github.com/gbraad/861e322b794a011444a33262a256be6e

#linux

WSL can be a great tool to enable cross-platform development from Windows. However, you might have to move machines, ... and what if that is actually not a Windows machine? You can use your exported environment easily in a container runtime like #containerd or #podman I just got my 99G environment with mingw64, android-sdk, etc moved over. ... and can continue developing.

https://gist.github.com/gbraad/861e322b794a011444a33262a256be6e

#linux

Docker 29 has changed its default image store for new installs

https://docs.docker.com/engine/storage/containerd

#HackerNews #Docker #Docker29 #ImageStore #Containerd #DevOps

Docker 29 has changed its default image store for new installs

https://docs.docker.com/engine/storage/containerd

#HackerNews #Docker #Docker29 #ImageStore #Containerd #DevOps

🚨 PSA: #Docker 29 has changed its default image store to use #containerd; as a consequence, new installs have a second data directory besides the traditional `/var/lib/docker`, `/var/lib/containerd`.

**This means that if you kept your docker data dir on a separate (potentially shared) storage, now you need to do the same for containerd.**

https://docs.docker.com/engine/daemon/#daemon-data-directory

#linux #container #sysadmin

[Перевод] Настройка сети в Kubernetes: основы CNI

Kubernetes-кластер без сети — не кластер, а просто набор несвязанных компонентов. Чтобы «оживить» его, важно понимать, что такое Container Network Interface (CNI) и как он работает. В статье — детальный разбор механизма CNI: что такое CNI-плагин, как он запускается и какие операции выполняет в кластере. В конце работа CNI демонстрируется на примере кастомного плагина. Для желающих глубже погрузиться в тему есть список дополнительных материалов.

https://habr.com/ru/companies/flant/articles/1015810/

#сеть #cni #cniплагин #Container_Network_Interface #ipam #containerd #vxlan #static_routing #iptables

Что внутри «Штурвала 2.13». Декларативная установка, переход на containerd 2.x, профили кластеров и прочее

Хабр, привет! На связи команда разработки контейнерной платформы «Штурвал». Недавно мы выпустили новую версию 2.13. Теперь пользователям доступны установка через YAML и флаги командной строки, профили кластеров по шаблонам, containerd 2.x с шифрованием образов, сводные отчеты по безопасности. Под катом делимся самым интересным.

https://habr.com/ru/companies/chislitellab/articles/1014916/

#штурвал #kubernetes #k8s #containerd #yaml #кластеры #контейнеризация

Final optimizations for the Dockerfile, and the new image is now under 500MB which is a heluva-lot better than the original 1.3GB. The results are good, images are now in Forgejo, and even better: they work.

#homelab #encoding #docker #containerd

Final optimizations for the Dockerfile, and the new image is now under 500MB which is a heluva-lot better than the original 1.3GB. The results are good, images are now in Forgejo, and even better: they work.

#homelab #encoding #docker #containerd

Docker switches to Containerd Image Store

Since #Docker Engine 29.0 (Nov 2025), new installation use #containerd image store by default.

This is supposed to align Docker Engine with #Kubernetes.

For now, I see the risk that Docker on CI server might behave differently than docker on my machine if I do not migrate manually.

Should I migrate now?
In the release notes, I can see quite some fixes, so better wait?

Did anyone migrate and live to tell the tale?

https://www.docker.com/blog/docker-engine-version-29/

[Перевод] Хаос монтирования в Netflix: масштабирование контейнеров на современных CPU

Представьте себе такую картину: пятничным вечером вы нажимаете кнопку воспроизведения видео на Netflix. Не проходит и нескольких секунд, как в ответ на это в недрах системы оживают сотни контейнеров. Обеспечение эффективной работы большого количества контейнеров в Netflix — это один из краеугольных камней обеспечения качественного потокового видео для миллионов пользователей со всего мира. Для того чтобы обеспечить высокую скорость реакции системы таких масштабов, мы модернизировали нашу среду выполнения контейнеров (контейнерный рантайм, container runtime), но, сделав это, мы столкнулись с неприятной неожиданностью, сдерживающей рост нашей системы. Это — архитектура процессоров. Предлагаем вашему вниманию историю о том, как мы диагностировали эту проблему, и о том, что мы узнали о масштабировании контейнеров на аппаратном уровне.

https://habr.com/ru/companies/wunderfund/articles/982870/

#Инфраструктура #облачные_технологии #разработка #контейнеры #containerd #Netflix

If you experienced an issue updating the #containerd package on #ubuntu today, #docker is rolling out a fix now:

https://github.com/docker/packaging/issues/342#issuecomment-3705602800

If you experienced an issue updating the #containerd package on #ubuntu today, #docker is rolling out a fix now:

https://github.com/docker/packaging/issues/342#issuecomment-3705602800

Pretty goofy that Ptyxis, the container-focused terminal emulator, which is now the default Terminal on ubuntu, does not support #docker nor #containerd (nor #systemd nspawn)

https://gitlab.gnome.org/chergert/ptyxis#supported-container-technologies

Pretty goofy that Ptyxis, the container-focused terminal emulator, which is now the default Terminal on ubuntu, does not support #docker nor #containerd (nor #systemd nspawn)

https://gitlab.gnome.org/chergert/ptyxis#supported-container-technologies

#Containerd issue for #docker is such a pain. Everything is working via downgrading to v1.28 except #watchtower... So now my server is a upgrade hell!!

What are you using at the moment for running containers?

#containers #sysadmin #homelab #podman #docker #buildah #lxc #containerd #devops #devsecops

Anyone using #docker inside #lxc containers?

Beware of an "interesting" issue that might arise when you install the latest update of #containerd.

https://github.com/containerd/containerd/issues/12484

TL;DR: No docker containers can start any more (but running containers keep on running).
The root cause seems to be in AppArmor.
Quick fixes are deactivating AppArmor for an LXC container or downgrading the containerd.io package.

Внутреннее устройство Docker. Заглянем под капот

Сначала были физические серверы - дорогие и неэффективные. Затем пришли виртуальные машины , которые позволили запускать несколько изолированных ОС на одном железе. Но цена изоляции оставалась высокой: полная копия ОС, гигабайты диска, минуты на запуск. Контейнеры - следующий шаг эволюции. Зачем виртуализировать целое железо и запускать полноценную ОС, если можно изолировать только сам процесс , используя встроенные механизмы ядра? Этот подход на порядок легче, быстрее и эффективнее.

https://habr.com/ru/articles/963702/

#docker #containerd #runc #linux #containers #container #контейнеризация #докер #devops #линукс

Trying to work out if it's possible to configure Containerd to set (or the equivalent of) the `--init` flag on container run so `tini` hosts PID 1 and signal handling works properly.

It looks like `--init` does some magic - I can see runc has some PID/FD parameters, but it loooks like CRI doesn't have an escape hatch for any say, arbitrary arguments - even if I did work out the magic.

https://github.com/kubernetes/cri-api/blob/15d088979b4574be15436b5b9772f934874a27ad/pkg/apis/runtime/v1/api.proto#L1133

Containerd config is even more sparse on the CRI (or at least, the man page is)
https://github.com/containerd/containerd/blob/main/docs/man/containerd-config.toml.5.md

I really don't want to have to insist that every damn Dockerfile bundles `tini` and sets `ENTRYPOINT`.

#Containers #CRI #OCI #Docker #Containerd #k8s #Kubernetes

Trying to work out if it's possible to configure Containerd to set (or the equivalent of) the `--init` flag on container run so `tini` hosts PID 1 and signal handling works properly.

It looks like `--init` does some magic - I can see runc has some PID/FD parameters, but it loooks like CRI doesn't have an escape hatch for any say, arbitrary arguments - even if I did work out the magic.

https://github.com/kubernetes/cri-api/blob/15d088979b4574be15436b5b9772f934874a27ad/pkg/apis/runtime/v1/api.proto#L1133

Containerd config is even more sparse on the CRI (or at least, the man page is)
https://github.com/containerd/containerd/blob/main/docs/man/containerd-config.toml.5.md

I really don't want to have to insist that every damn Dockerfile bundles `tini` and sets `ENTRYPOINT`.

#Containers #CRI #OCI #Docker #Containerd #k8s #Kubernetes

"If you're looking to optimize your containerization workflow, here's the good news - the ecosystem has evolved far beyond Docker's original design.

Docker revolutionized software deployment by making containerization a standard, but the ecosystem has grown to address specific use cases that Docker wasn't originally designed for. Modern alternatives like Podman, containerd, and CRI-O offer specialized features like daemonless designs, rootless operations, and native Kubernetes integration. These tools don't just offer incremental improvements, but instead they represent fundamental shifts in how we think about container security, performance, and workflow integration.

The container ecosystem has matured beyond Docker's monolithic approach, with specialized runtimes optimizing for specific use cases. Whether you're running microservices in production, developing locally, or managing enterprise workloads, there's likely a tool that's better suited to your specific requirements.

In this guide, I'll walk you through the most promising Docker alternatives in 2025 and help you choose the right tool for your specific needs."

https://www.datacamp.com/blog/docker-alternatives

#DevOps #Docker #Containers #Kubernetes #Podman #Containerd #OpenSource #CICD

"If you're looking to optimize your containerization workflow, here's the good news - the ecosystem has evolved far beyond Docker's original design.

Docker revolutionized software deployment by making containerization a standard, but the ecosystem has grown to address specific use cases that Docker wasn't originally designed for. Modern alternatives like Podman, containerd, and CRI-O offer specialized features like daemonless designs, rootless operations, and native Kubernetes integration. These tools don't just offer incremental improvements, but instead they represent fundamental shifts in how we think about container security, performance, and workflow integration.

The container ecosystem has matured beyond Docker's monolithic approach, with specialized runtimes optimizing for specific use cases. Whether you're running microservices in production, developing locally, or managing enterprise workloads, there's likely a tool that's better suited to your specific requirements.

In this guide, I'll walk you through the most promising Docker alternatives in 2025 and help you choose the right tool for your specific needs."

https://www.datacamp.com/blog/docker-alternatives

#DevOps #Docker #Containers #Kubernetes #Podman #Containerd #OpenSource #CICD

https://gist.github.com/thaJeztah/b1cf4149d7f0bb326aed5224bc12893e - in #Docker Desktop in #containerd mode, it stores the uncompressed image as it did before and also the compressed image tar. This means containerd takes more drive space, but doesn't need to re-compress on every push, and it keeps attached files like SBOMs.

https://gist.github.com/thaJeztah/b1cf4149d7f0bb326aed5224bc12893e - in #Docker Desktop in #containerd mode, it stores the uncompressed image as it did before and also the compressed image tar. This means containerd takes more drive space, but doesn't need to re-compress on every push, and it keeps attached files like SBOMs.

🏗️ Supports distributable workers, multiple output formats & pluggable architecture for maximum flexibility
🔒 Execution without root privileges using #runc or #crun backends with #containerd worker support

🏗️ Supports distributable workers, multiple output formats & pluggable architecture for maximum flexibility
🔒 Execution without root privileges using #runc or #crun backends with #containerd worker support

#containerd contains #nerd

Unhappy with #DockerDesktop on #macOS? Give #Colima a try!

It's a free and open #container runtime for macOS. It now supports the macOS #virtualization framework, #virtiofs for fast volume mounts and forwarding #inotify events for hot/live reloading. It can even provide a #containerd, #kubernetes or #incus runtime.

https://github.com/abiosoft/colima

(I would've preferred #podman, as that's what I'm mostly using in production, but it still doesn't support forwarding inotify events on macOS)

Unhappy with #DockerDesktop on #macOS? Give #Colima a try!

It's a free and open #container runtime for macOS. It now supports the macOS #virtualization framework, #virtiofs for fast volume mounts and forwarding #inotify events for hot/live reloading. It can even provide a #containerd, #kubernetes or #incus runtime.

https://github.com/abiosoft/colima

(I would've preferred #podman, as that's what I'm mostly using in production, but it still doesn't support forwarding inotify events on macOS)

Устанавливаем кластер Kubernetes в LXC-контейнерах Proxmox

Если вы когда-либо разворачивали Kubernetes-кластер на виртуальных машинах (ВМ), то знаете, насколько это может быть ресурсоёмко. Особенно это ощущается на одноплатных компьютерах вроде Orange Pi 5 Plus, даже несмотря на его 16 ГБ оперативной памяти. Для домашнего лабораторного стенда или лёгкой продакшн-инфраструктуры хочется чего-то более лёгкого и быстрого

https://habr.com/ru/articles/901260/

#kubernetes #keepalived #haproxy #containerd #crio #orange_pi #arm64

Hey Everyone, You've been meaning to do it but now is the time 'circle the wagons' and get your systems moved from docker to something else.

Time for me to 'restart' the migration.

Remember: never Oracle

https://techcrunch.com/2025/02/13/former-oracle-cloud-exec-don-johnson-takes-over-as-dockers-new-ceo/

#docker #podman #containerd #lxc #lxd

Any good guides xor tipps for a single node kubernetes cluster setup that can be scaled up to 3 nodes later on?

#kubernetes #containerd #linux

Any good guides xor tipps for a single node kubernetes cluster setup that can be scaled up to 3 nodes later on?

#kubernetes #containerd #linux

Trying #containerd 2.0.0 on #flatcar - this is a good opportunity to test the User Namespace feature on #kubernetes:
```
$ kubectl exec -ti userns-01 -- cat /proc/self/uid_map
0 391577600 65536
$ ssh to-k8s-node -- cat /proc/self/uid_map
0 0 4294967295
```

If you want to try it out, here's the containerd 2.0.0 sysext definition: https://github.com/flatcar/sysext-bakery/pull/97 and doc to BYO containerd on Flatcar: https://www.flatcar.org/docs/latest/provisioning/sysext/#remove-docker-and--or-containerd-from-flatcar

Trying #containerd 2.0.0 on #flatcar - this is a good opportunity to test the User Namespace feature on #kubernetes:
```
$ kubectl exec -ti userns-01 -- cat /proc/self/uid_map
0 391577600 65536
$ ssh to-k8s-node -- cat /proc/self/uid_map
0 0 4294967295
```

If you want to try it out, here's the containerd 2.0.0 sysext definition: https://github.com/flatcar/sysext-bakery/pull/97 and doc to BYO containerd on Flatcar: https://www.flatcar.org/docs/latest/provisioning/sysext/#remove-docker-and--or-containerd-from-flatcar

#containerd just released v2.0.0! 🎉

I expect it will take a bit to work through the various pipelines before everyone is running it. This was also their chance to remove a bunch of deprecated features. Specifics are in the release notes.

https://github.com/containerd/containerd/releases/tag/v2.0.0

#containerd just released v2.0.0! 🎉

I expect it will take a bit to work through the various pipelines before everyone is running it. This was also their chance to remove a bunch of deprecated features. Specifics are in the release notes.

https://github.com/containerd/containerd/releases/tag/v2.0.0

Just recently:

- Why do you have 64GB of RAM? That’s just overkill, there is no way you—

* opens VM Manager *

- Oh… nevermind.

#Virtualization #Docker #Containers #Container #OCI #ContainerD #VM #VMManager

Just recently:

- Why do you have 64GB of RAM? That’s just overkill, there is no way you—

* opens VM Manager *

- Oh… nevermind.

#Virtualization #Docker #Containers #Container #OCI #ContainerD #VM #VMManager

#Buildpacks do not support #Docker with #containerd image store

https://github.com/spring-projects/spring-boot/issues/40100

#Buildpacks do not support #Docker with #containerd image store

https://github.com/spring-projects/spring-boot/issues/40100

Awesome 🎉 #rust #rocket #digitalocean #kubernetes 👇star my code
https://github.com/giuliohome/rust-rocket-playground

Btw podman is yet another fake #opensource #foss repository

I stop suggesting @Podman_io
I wasted my time with those stupid idiots.

https://github.com/containers/podman/issues/24013

I admit that @docker is the way to go to #build a #Dockerfile

Or #containerd ctr + #kaniko !
+ #chatgpt for support 💪 instead of github useless maintainers

All tested on #WSL #Ubuntu ☕

Docker Desktop 4.34: MSI Installer GA, Upgraded Host Networking, and Powerful Enhancements for Boosted Productivity & Administration
#Docker #Products #AIML #Containerd #DockerDesktop #DockerDesktoprelease #Microsoft #WSL2

https://www.docker.com/blog/docker-desktop-4-34/

Can you pull a container image with a known good digest from an untrusted registry?

It depends. Following the OCI distribution spec, a client is not required to validate the digest. Instead, the registry can send a header with another hash algorithm, and the client must validate using algo and hash from the header. A malicious registry can deliver both malicious manifests and blobs to a spec conform client.

Docker & containerd seem to check the digest as one might expect, many other clients don't.

My colleague @burger is proposing to tighten the spec and require clients to verify the digest if present: https://github.com/opencontainers/distribution-spec/issues/549

#container #security #OCI #containerd #Docker #Kubernetes #infosec

Ok #GetFediHired, I finally got one for ya!

Dagger (https://dagger.io/) is building a "#DevOps operating system" using containers and we're looking for someone to help build the core platform. Product is #OpenSource!

Needed Skills: #Go, #Docker, AWS, Moby/Buildkit

Bonus Points: #Containerd #OCI

Location: Remote! North or South America

Note: While it's a DevOps tool, this is not a DevOps role.

Shoot an email to [email protected] if you're interested!

#Hiring #JobOpportunity

I just read #containerd as contaiNerd…

#kubernetes

containerd vs. Docker: Understanding Their Relationship and How They Work Together
#Products #Containerd #Containers #Docker

https://www.docker.com/blog/containerd-vs-docker/