nerdctl VS kaniko

nerdctl CLI for containerd (Docker replacement) Feels like Docker. But lighter. And hipster-approved.

If you are unfamiliar with the concept of containers and docker images, I suggest you have a look at docker. It will be leveraged here to start the Spark server for the tests; it's important to mention there are other opensource alternatives like podman or nerdctl to allow containerization.

NERDCTL_VERSION=2.0.3 wget https://github.com/containerd/nerdctl/releases/download/v2.0.3/nerdctl-$NERDCTL_VERSION-linux-arm64.tar.gz tar -xzvf nerdctl-$NERDCTL_VERSION-linux-arm64.tar.gz -C /sbin CNI_VERSION wget https://github.com/containernetworking/plugins/releases/download/v1.6.2/cni-plugins-linux-arm64-vCNI_VERSION.tgz mkdir -p /opt/cni/bin tar -xzvf cni-plugins-linux-arm64-vCNI_VERSION.tgz -C /opt/cni/bin

Here's a script that left me in awe the first time I saw it:

https://github.com/containerd/nerdctl/blob/main/extras/rootl...

I have since copied this pattern for many scripts: logging functions, grouping all global vars and constants at the top and creating subcommands using shift.

Rancher Desktop allows you to choose between the Moby engine (offered by Continered) and the dockerd engine (offered by Docker) for building, pushing, and running containers. Compared with Docker Desktop, which provides Docker CLI as a CLI tool, Rancher provides both kubectl and nerdctl for managing Kubernetes and containers, respectively.

What about the docker-cli? colima also ships with a docker-compatible cli to interact with containerd called nerdctl. We can execute the same docker cli commands like:

Using nerdctl: https://github.com/containerd/nerdctl

I'd really disagree that compose files are somehow one-shot, or blindly modified. To the contrary, really, we have them checked in with the source code. Upon deployment to the cluster, the (running) services will be intelligently updated or replaced (in a rolling manner, causing zero downtime). LXC might be more elegant, but I have no idea what simple, file-based format I could use to let engineers describe the environment their app should run in without compose.

I need something that even junior devs can start up with a single command, that can be placed in the VCS along with the code, and that will not require deep Linux knowledge to get running. Open for suggestions here, really.

Now since Kubernetes works off of containerd I'll be taking a different approach on handling container builds by using nerdctl and the buildkit that comes bundled with it. I'll do this on the amd64 control plane node since it's beefier than my Raspberry Pi workers for handling builds and build related services. Go ahead and download and unpack the latest nerdctl release as of writing (make sure to check the release page in case there's a new one):

That's why nerdctl, their cli binary, is so well named.

Kaniko Build Images in Kubernetes Without Docker For secure image builds inside CI/CD pipelines.

AFAIU this is because it manually detects changes in a given image layer by walking the directory tree. See also https://github.com/GoogleContainerTools/kaniko/issues/875

kaniko <https://github.com/GoogleContainerTools/kaniko>, ko <https://github.com/ko-build/ko>, bazel <https://github.com/bazel-contrib/rules_oci>, apko <https://github.com/chainguard-dev/apko>, or other tools.

Each of those has tradeoffs compared to Dockerfiles (I have no need for bazel, but if I did, then adding `rules_oci` might be a win-win, rather than using a Dockerfile). If I used Nix, then the Nix dockerTools would be a huge win (I don't use Nix). If I were shipping Go programs, `ko` would likely be a good baseline.

Kaniko is a tool from Google that builds container images from a Dockerfile inside a container or Kubernetes cluster without requiring privileged mode: