notary VS containerd

We will be verifying container images using Notary. Notary uses the The Update Framework (TUF) specification for publishing and verifying content. Before we deep dive into enforcing image trust on Docker containers, let's take a quick look at both of these projects. a quick overview before deep dive.

Containerd and nerdctl

Kubernetes on the backend used to utilize docker for much of its container runtime solutions. One of the modular features of Kubernetes is the ability to utilize a Container Runtime Interface or CRI. The problem was that Docker didn't really meet the spec properly and they had to maintain a shim to translate properly. Instead users could utilize the popular containerd or cri-o runtimes. These follow the Open Container Initiative or OCI's guidelines on container formats.

Container Engine: A runtime that executes and manages containers. Docker and containerd are popular container engines.

Multiple container runtimes are supported, like conatinerd, cri-o, or other CRI compliant runtimes.

This is a failed attempt to upstream part of containerd changes: https://github.com/containerd/containerd/pull/8789

Other part of containerd changes waits for gods-know-what: https://github.com/containerd/containerd/pull/9054

But I haven't gave up yet.

containerd is required by kubernetes to handle containers on its behalf. A big thanks to the HostAfrica blog for the information on setting containerd up for debain. So the containerd install will need to happen on both the WSL2 instance and the Raspberry Pis. For WSL2 you can just install containerd directly:

The context deadline exceeded: unknown is also in containerd, and is a known problem.

Get:1 https://download.docker.com/linux/ubuntu focal/stable amd64 containerd.io amd64 1.6.21-1 [28.3 MB]

Docker Desktop adds a bunch of stuff to simplify local development and that’s why it has a larger memory footprint. You don’t use that when deploying but something like https://containerd.io/.