nerdctl VS kaniko

https://github.com/containerd/nerdctl/blob/main/docs/nydus.m... :

nydusify and Check Nydus image: https://github.com/dragonflyoss/nydus/blob/master/docs/nydus... :

> Nydusify provides a checker to validate Nydus image, the checklist includes image manifest, Nydus bootstrap, file metadata, and data consistency in rootfs with the original OCI image. Meanwhile, the checker dumps OCI & Nydus image information to output (default) directory.

nydus: https://github.com/dragonflyoss/nydus

awslabs/soci-snapshotter:

on a related note, nerdctl latest release adds a lot of compat command features as well

https://github.com/containerd/nerdctl/releases/tag/v2.1.4

nerdctl CLI for containerd (Docker replacement) Feels like Docker. But lighter. And hipster-approved.

If you are unfamiliar with the concept of containers and docker images, I suggest you have a look at docker. It will be leveraged here to start the Spark server for the tests; it's important to mention there are other opensource alternatives like podman or nerdctl to allow containerization.

NERDCTL_VERSION=2.0.3 wget https://github.com/containerd/nerdctl/releases/download/v2.0.3/nerdctl-$NERDCTL_VERSION-linux-arm64.tar.gz tar -xzvf nerdctl-$NERDCTL_VERSION-linux-arm64.tar.gz -C /sbin CNI_VERSION wget https://github.com/containernetworking/plugins/releases/download/v1.6.2/cni-plugins-linux-arm64-vCNI_VERSION.tgz mkdir -p /opt/cni/bin tar -xzvf cni-plugins-linux-arm64-vCNI_VERSION.tgz -C /opt/cni/bin

Here's a script that left me in awe the first time I saw it:

https://github.com/containerd/nerdctl/blob/main/extras/rootl...

I have since copied this pattern for many scripts: logging functions, grouping all global vars and constants at the top and creating subcommands using shift.

Rancher Desktop allows you to choose between the Moby engine (offered by Continered) and the dockerd engine (offered by Docker) for building, pushing, and running containers. Compared with Docker Desktop, which provides Docker CLI as a CLI tool, Rancher provides both kubectl and nerdctl for managing Kubernetes and containers, respectively.

What about the docker-cli? colima also ships with a docker-compatible cli to interact with containerd called nerdctl. We can execute the same docker cli commands like:

Using nerdctl: https://github.com/containerd/nerdctl

I'd really disagree that compose files are somehow one-shot, or blindly modified. To the contrary, really, we have them checked in with the source code. Upon deployment to the cluster, the (running) services will be intelligently updated or replaced (in a rolling manner, causing zero downtime). LXC might be more elegant, but I have no idea what simple, file-based format I could use to let engineers describe the environment their app should run in without compose.

I need something that even junior devs can start up with a single command, that can be placed in the VCS along with the code, and that will not require deep Linux knowledge to get running. Open for suggestions here, really.

It spins up a GitHub Actions runner pool inside your cluster. When you push code, the runner builds your containers using Kaniko and deploys everything to the cluster. Your app gets real Postgres, Redis, Kafka, or whatever you need — already configured and wired up.

Kaniko Build Images in Kubernetes Without Docker For secure image builds inside CI/CD pipelines.

AFAIU this is because it manually detects changes in a given image layer by walking the directory tree. See also https://github.com/GoogleContainerTools/kaniko/issues/875

kaniko <https://github.com/GoogleContainerTools/kaniko>, ko <https://github.com/ko-build/ko>, bazel <https://github.com/bazel-contrib/rules_oci>, apko <https://github.com/chainguard-dev/apko>, or other tools.

Each of those has tradeoffs compared to Dockerfiles (I have no need for bazel, but if I did, then adding `rules_oci` might be a win-win, rather than using a Dockerfile). If I used Nix, then the Nix dockerTools would be a huge win (I don't use Nix). If I were shipping Go programs, `ko` would likely be a good baseline.

Kaniko is a tool from Google that builds container images from a Dockerfile inside a container or Kubernetes cluster without requiring privileged mode: