Merge pull request #820 from AkihiroSuda/containerd-1.6.0

update containerd (1.6.0), fuse-overlayfs (1.8.2), docs

Author: AkihiroSuda

.cirrus.yml

@@ -65,7 +65,7 @@ windows_task:
   matrix:
     - name: "Windows/containerd-1.6"
       env:
-        ctrdVersion: 1.6.0-beta.4
+        ctrdVersion: 1.6.0
   env:
     CGO_ENABLED: 0
   build_script:

.github/workflows/test.yml

@@ -55,7 +55,7 @@ jobs:
     timeout-minutes: 30
     strategy:
       matrix:
-        containerd: [v1.4.5, v1.5.9, main]
+        containerd: [v1.4.5, v1.6.0, main]
     env:
       CONTAINERD_VERSION: "${{ matrix.containerd }}"
     steps:
@@ -80,7 +80,7 @@ jobs:
     timeout-minutes: 60
     strategy:
       matrix:
-        containerd: [v1.4.5, v1.5.9, main]
+        containerd: [v1.4.5, v1.6.0, main]
     env:
       CONTAINERD_VERSION: "${{ matrix.containerd }}"
     steps:

Dockerfile

@@ -18,7 +18,7 @@
 # TODO: verify commit hash
 
 # Basic deps
-ARG CONTAINERD_VERSION=v1.5.9
+ARG CONTAINERD_VERSION=v1.6.0
 ARG RUNC_VERSION=v1.1.0
 ARG CNI_PLUGINS_VERSION=v1.0.1
 
@@ -36,7 +36,7 @@ ARG SLIRP4NETNS_VERSION=v1.1.12
 # Extra deps: bypass4netns
 ARG BYPASS4NETNS_VERSION=v0.2.2
 # Extra deps: FUSE-OverlayFS
-ARG FUSE_OVERLAYFS_VERSION=v1.8.1
+ARG FUSE_OVERLAYFS_VERSION=v1.8.2
 ARG CONTAINERD_FUSE_OVERLAYFS_VERSION=v1.0.4
 # Extra deps: IPFS
 ARG IPFS_VERSION=v0.11.0

Dockerfile.d/SHA256SUMS.d/fuse-overlayfs-v1.8.1

@@ -0,0 +1,5 @@
+7c2ffe7ad6fed957a400fb3900c1c2586d756aff0fa38c6998d5ac467a26f288  fuse-overlayfs-aarch64
+f081e183d58f634975c7aaa10bf0a4d9366d5def722638031d7dcd128d8dd0a0  fuse-overlayfs-armv7l
+1824b0e4fe0e3a8ebdb357371d8e21cf991046b2e0088c205ba20fdd9ecb1575  fuse-overlayfs-ppc64le
+5aa49c081dc4f9e0ad82f08fb90fb4e1bf1835c24ce0dc5cbd96d7d59d0cff8c  fuse-overlayfs-s390x
+d7488446d5a17586a4aa3cc15e21d675a04a04f553e031c7789ed5e83ec4d829  fuse-overlayfs-x86_64

Dockerfile.d/SHA256SUMS.d/fuse-overlayfs-v1.8.2

@@ -52,11 +52,32 @@ See also [`./examples/compose-wordpress`](./examples/compose-wordpress).
 
 ### Debugging Kubernetes
 
-To list Kubernetes containers:
+To list local Kubernetes containers:
 ```console
 # nerdctl --namespace k8s.io ps -a
 ```
 
+To build an image for local Kubernetes without using registry:
+```console
+# nerdctl --namespace k8s.io build -t foo /some-dockerfile-directory
+# kubectl apply -f - <<EOF
+apiVersion: v1
+kind: Pod
+metadata:
+  name: foo
+spec:
+  containers:
+    - name: foo
+      image: foo
+      imagePullPolicy: Never
+EOF
+```
+
+To load an image archive (`docker save` format or OCI format) into local Kubernetes:
+```console
+# nerdctl --namespace k8s.io load < /path/to/image.tar
+```
+
 ### Rootless mode
 
 To launch rootless containerd:
@@ -136,6 +157,7 @@ Major:
 - Recursive read-only (RRO) bind-mount: `nerdctl run -v /mnt:/mnt:rro` (make children such as `/mnt/usb` to be read-only, too).
   Requires kernel >= 5.12, and crun >= 1.4 or runc >= 1.1 (PR [#3272](https://github.com/opencontainers/runc/pull/3272)).
 - [Cosign integration](./docs/cosign.md): `nerdctl pull --verify=cosign` and `nerdctl push --sign=cosign`
+- [Accelerated rootless containers using bypass4netns](./docs/rootless.md): `nerdctl run --label nerdctl/bypass4netns=true`
 
 Minor:
 - Namespacing: `nerdctl --namespace=<NS> ps` .

README.md

@@ -20,6 +20,7 @@
   - [How to change the CNI binary path?](#how-to-change-the-cni-binary-path)
 - [Kubernetes](#kubernetes)
   - [`nerdctl ps -a` does not show Kubernetes containers](#nerdctl-ps--a-does-not-show-kubernetes-containers)
+  - [How to build an image for Kubernetes?](#how-to-build-an-image-for-kubernetes)
 - [containerd socket (`/run/containerd/containerd.sock`)](#containerd-socket-runcontainerdcontainerdsock)
   - [Does nerdctl have an equivalent of `DOCKER_HOST=ssh://<USER>@<REMOTEHOST>` ?](#does-nerdctl-have-an-equivalent-of-docker_hostsshuserremotehost-)
   - [Does nerdctl have an equivalent of `sudo usermod -aG docker <USER>` ?](#does-nerdctl-have-an-equivalent-of-sudo-usermod--ag-docker-user-)
@@ -243,6 +244,30 @@ Try `sudo nerdctl --namespace=k8s.io ps -a` .
 
 Note: k3s users have to specify `--address` too: `sudo nerdctl --address=/run/k3s/containerd/containerd.sock --namespace=k8s.io ps -a`
 
+### How to build an image for Kubernetes?
+
+For a multi-node cluster:
+```console
+$ nerdctl build -t example.com/foo /some-dockerfile-directory
+$ nerdctl push example.com/foo
+```
+
+For a single-node cluster w/o registry:
+```console
+# nerdctl --namespace k8s.io build -t foo /some-dockerfile-directory
+# kubectl apply -f - <<EOF
+apiVersion: v1
+kind: Pod
+metadata:
+  name: foo
+spec:
+  containers:
+    - name: foo
+      image: foo
+      imagePullPolicy: Never
+EOF
+```
+
 ## containerd socket (`/run/containerd/containerd.sock`)
 
 ### Does nerdctl have an equivalent of `DOCKER_HOST=ssh://<USER>@<REMOTEHOST>` ?

docs/faq.md

@@ -7,7 +7,7 @@ require (
 	github.com/compose-spec/compose-go v1.0.9
 	github.com/containerd/cgroups v1.0.3
 	github.com/containerd/console v1.0.3
-	github.com/containerd/containerd v1.6.0-rc.4
+	github.com/containerd/containerd v1.6.0
 	github.com/containerd/continuity v0.2.2
 	github.com/containerd/go-cni v1.1.3
 	github.com/containerd/imgcrypt v1.1.3

go.mod

@@ -294,8 +294,8 @@ github.com/containerd/containerd v1.5.1/go.mod h1:0DOxVqwDy2iZvrZp2JUx/E+hS0UNTV
 github.com/containerd/containerd v1.5.7/go.mod h1:gyvv6+ugqY25TiXxcZC3L5yOeYgEw0QMhscqVp1AR9c=
 github.com/containerd/containerd v1.5.8/go.mod h1:YdFSv5bTFLpG2HIYmfqDpSYYTDX+mc5qtSuYx1YUb/s=
 github.com/containerd/containerd v1.6.0-rc.1/go.mod h1:jdeOXdXovU4bWF2Bd2hJjqpcOrrpSC1wmFCTtf6LD+A=
-github.com/containerd/containerd v1.6.0-rc.4 h1:l3ngWaUxlPVURYC/4B+Uzc0m30H72K9MMbTqj6u0tZM=
-github.com/containerd/containerd v1.6.0-rc.4/go.mod h1:g4o55STrmMXiGegQmOMUb41SwwJk9wq+DlmFxuA8nu0=
+github.com/containerd/containerd v1.6.0 h1:CLa12ZcV0d2ZTRKq1ssioeJpTnPJBMyndpEKA+UtzJg=
+github.com/containerd/containerd v1.6.0/go.mod h1:1nJz5xCZPusx6jJU8Frfct988y0NpumIq9ODB0kLtoE=
 github.com/containerd/continuity v0.0.0-20190426062206-aaeac12a7ffc/go.mod h1:GL3xCUCBDV3CZiTSEKksMWbLE66hEyuu9qyDOOqM47Y=
 github.com/containerd/continuity v0.0.0-20190815185530-f2a389ac0a02/go.mod h1:GL3xCUCBDV3CZiTSEKksMWbLE66hEyuu9qyDOOqM47Y=
 github.com/containerd/continuity v0.0.0-20191127005431-f65d91d395eb/go.mod h1:GL3xCUCBDV3CZiTSEKksMWbLE66hEyuu9qyDOOqM47Y=