HackerReposA FIELD GUIDE TO OPEN SOURCE
ProSponsor the shelf♧ 0
← Back to top all-time
containerd
nerdctl
Go2021–2025
containerd / nerdctl

nerdctl

contaiNERD CTL - Docker-compatible CLI for containerd, with support for Compose, Rootless, eStargz, OCIcrypt, IPFS, ...

Command LineSystems & InfrastructureDevOps & Cloud
Explore on GitHubRead Hacker News discussions
21Distinct people
26Mentions
0Explicit recommenders
10.5KGitHub stars
REPOSITORY AT A GLANCE

What to know before exploring

What it is

contaiNERD CTL - Docker-compatible CLI for containerd, with support for Compose, Rootless, eStargz, OCIcrypt, IPFS, ...

GitHub

Where it is used

No documented product use was verified in the last source check.

What people are saying

No recommendation phrase was found in the indexed comments.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

No other repository is repeatedly linked in the same discussions.

This week on Hacker News

Nov 8–Nov 15 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/15/2026, 12:45:45 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by year26 dated mentions

Observed mentions: 2021-03-23 07:59:48 UTC to 2025-09-17 01:24:52 UTC.

02462021-01-01 00:00:00 UTC to 2022-01-01 00:00:00 UTC (exclusive): 6 mentions; 2 submissions, 4 comments20212022-01-01 00:00:00 UTC to 2023-01-01 00:00:00 UTC (exclusive): 7 mentions; 0 submissions, 7 comments2023-01-01 00:00:00 UTC to 2024-01-01 00:00:00 UTC (exclusive): 4 mentions; 0 submissions, 4 comments20232024-01-01 00:00:00 UTC to 2025-01-01 00:00:00 UTC (exclusive): 5 mentions; 1 submissions, 4 comments2025-01-01 00:00:00 UTC to 2026-01-01 00:00:00 UTC (exclusive): 4 mentions; 0 submissions, 4 comments2025

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges
UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
PeriodStart (UTC)End (exclusive, UTC)MentionsSubmissionsComments
20212021-01-01 00:00:00 UTC2022-01-01 00:00:00 UTC624
20222022-01-01 00:00:00 UTC2023-01-01 00:00:00 UTC707
20232023-01-01 00:00:00 UTC2024-01-01 00:00:00 UTC404
20242024-01-01 00:00:00 UTC2025-01-01 00:00:00 UTC514
20252025-01-01 00:00:00 UTC2026-01-01 00:00:00 UTC404

What Hacker News says

26 sources
westurner·Sep 17, 2025
Containerd/nerdctl supports a number of snapshotter plugins: Nydus, e Stargz, SOCI: Seekable OCI, fuse-overlayfs; containerd/stargz-snapshotter: https://github.com/containerd/stargz-snapshotter containerd/nerdctl//docs/nydus.md: https://github.com/containerd/nerdctl/blob/main/docs/nydus.m... : nydusify and Check Nydus image: https://github.com/dragonflyoss/nydus/blob/master/docs/nydus... : > Nydusify provides a checker to validate Nydus image, the checklist includes image manifest, Nydus bootstrap, file metadata, and data consistency in rootfs with the original OCI image. Meanwhile, the checker dumps OCI & Nydus image information to output (default) directory. nydus: https://github.com/dragonflyoss/nydus awslabs/soci-snapshotter: https://github.com/awslabs/soci-snapshotter ; lazy start standard OCI images /? lxc copy on write: https://
Read the rest
www.google.com/search?q=lxc+copy+on+write : lxc-copy supports btrfs, zfs, lvm, overlayfs lxc/incus: "Add OCI image support" https://github.com/lxc/incus/issues/908 opencontainers/image-spec; OCI Image spec: https://github.com/opencontainers/image-spec opencontainers/distribution-spec; OCI Image distribution spec: https://github.com/opencontainers/distribution-spec But then in the opencontainers/runtime-spec//config.md OCI runtime spec TODO bundle config.json there is an example of a config.json https://github.com/opencontainers/runtime-spec/blob/main/con... The LXC approach is to run systemd in the container. The quadlet approach is to not run systemd /sbin/init in the container; instead create .container files in /etc/containers/systemd/ (rootful) or ~/.config/containers/systemd/*.container (for rootless) so that the host systemd manages and logs the container processes. Then realized you said QEMU not LXC. LXD: https://canonical.com/lxd : > LXD provides both [QEMU,] KVM-based VMs and system containers based on LXC – that can run a full Linux OS – in a single open source virtualisation platform. LXD has numerous built-in management features, including live migration, snapshots, resource restrictions, projects and profiles, and governs the interaction with various storage and networking options. From https://documentation.ubuntu.com/lxd/latest/reference/storag... : > LXD supports the following storage drivers for storing images, instances and custom volumes: > Btrfs, CephFS, Ceph Object, Ceph RBD, Dell PowerFlex, Pure Storage, HPE Alletra, Directory, LVM, ZFS You can run Podman or Docker within an LXD host; with or without a backing storage pool. FWIU it's possible for containers in an LXD VM to use BTRFS, ZFS, or KVM storage drivers to create e.g. BTRFS subvolumes instead of running overlayfs within the VM by editing storage.conf.
In How Container Filesystem Works: Building a Docker-Like Container from Scratch
westurner·Jun 21, 2025
From nerdctl/docs/cosign.md "Container Image Sign and Verify with cosign tool" https://github.com/containerd/nerdctl/blob/main/docs/cosign.... ; handily answering my own question aloud: Sign the container image while pushing, verify the signature on fetch/pull: # Sign the image with Keyless mode $ nerdctl push --sign=cosign devopps/hello-world # Sign the image and store the signature in the registry $ nerdctl push --sign=cosign --cosign-key cosign.key devopps/hello-world # Verify the image with Keyless mode $ nerdctl pull --verify=cosign --certificate-identity=name@example.com --certificate-oidc-issuer=https://accounts.example.com devopps/hello-world # You can not verify the image if it is not signed $ nerdctl pull --verify=cosign --cosign-key cosign.pub devopps/hello-world-bad
In Show HN: Unregistry – “docker push” directly to servers without a registry
westurner·Dec 26, 2024
The original Labrea Tarpit avoids DOS'ing it's own conntrack table somehow, too; LaBrea.py: https://github.com/dhoelzer/ShowMeThePackets/blob/master/Sca... La Brea Tar Pits and museum: https://en.wikipedia.org/wiki/La_Brea_Tar_Pits The NERDctl readme says: https://github.com/containerd/nerdctl : > Supports rootless mode, without slirp overhead (bypass4netns) How does that work, though? (And unfortunately podman replaced slirp4netns with pasta from psst.) rootless-containers/bypass4netns: https://github.com/rootless-containers/bypass4netns/ : > [Experimental] Accelerates slirp4netns using SECCOMP_IOCTL_NOTIF_ADDFD. As fast as `--net=host` Which is good, because --net=host with rootless containers is security inadvisable FWIU. "bypass4netns: Accelerating TCP/IP Communications in Rootless Containers" (2023) https://arxiv.org/abs/2402.00365
Read the rest
: > bypass4netns uses sockets allocated on the host. It switches sockets in containers to the host's sockets by intercepting syscalls and injecting the file descriptors using Seccomp. Our method with Seccomp can handle statically linked applications that previous works could not handle. Also, we propose high-performance rootless multi-node communication. We confirmed that rootless containers with bypass4netns achieve more than 30x faster throughput than rootless containers without it RunCVM, Kata containers, GVisor all have a better host/guest boundary than rootful or rootless containers; which is probably better for honeypot research on a different subnet. IIRC there are various utilities for monitoring and diffing VMs, for honeypot research. There could be a list of expected syscalls. If the simulated workload can be exhaustively enumerated, the expected syscalls are known ahead of time and so anomaly detection should be easier. "Oh, like Ghostbusters."
In Portspoof: Emulate a valid service on all 65535 TCP ports
moondowner·Sep 20, 2024
I've been using Rancher Desktop as an alternative to Docker Desktop, https://rancherdesktop.io/ on macOS and Windows, it's pretty solid. It has some kinks to work out but I got it working with IDEs too (e.g. the Intellij IDEA Docker Compose integration to work with it). What I also like is that existing scripts and etc that use the docker-compose cli work with Rancher Desktop too, as it uses nerdctl https://github.com/containerd/nerdctl
In Show HN: Container Desktop – Podman Desktop Companion
westurner·Dec 12, 2023
https://gvisor.dev/docs/architecture_guide/platforms/ : > gVisor requires a platform to implement interception of syscalls, basic context switching, and memory mapping functionality. Internally, gVisor uses an abstraction sensibly called Platform. Chrome sandbox: https://chromium.googlesource.com/chromium/src/+/refs/heads/... Firefox sandbox: https://wiki.mozilla.org/Security/Sandbox Chromium sandbox types summary: https://github.com/chromium/chromium/blob/main/docs/linux/sa... Minijail: https://github.com/google/minijail : > Minijail is a sandboxing and containment tool used in ChromeOS and Android. It provides an executable that can be used to launch and sandbox other programs, and a library that can be used by code to sandbox itself. Chrome vulnerability reward amounts: https://bughunters.google.com/about/rules/5745167867576320/c... Sy
Read the rest
stemd has SystemCallFilter= to limit processes to certain syscall: https://news.ycombinator.com/item?id=36693366 Nerdctl: https://github.com/containerd/nerdctl Nerdctl, podman, and podman-remote do rootless containers.
In The best WebAssembly runtime may be no runtime
9dev·Sep 12, 2023
Using Docker Compose with Podman: https://www.redhat.com/sysadmin/podman-docker-compose Using containerd: https://github.com/mc256/containerd-compose Using nerdctl: https://github.com/containerd/nerdctl I'd really disagree that compose files are somehow one-shot, or blindly modified. To the contrary, really, we have them checked in with the source code. Upon deployment to the cluster, the (running) services will be intelligently updated or replaced (in a rolling manner, causing zero downtime). LXC might be more elegant, but I have no idea what simple, file-based format I could use to let engineers describe the environment their app should run in without compose. I need something that even junior devs can start up with a single command, that can be placed in the VCS along with the code, and that will not require deep Linux knowledge to get
Read the rest
running. Open for suggestions here, really.
In Nginx Unit – Universal web app server
hericium·Aug 17, 2022
> lack of docker on freebsd I'm using sysutils/docker on FreeBSD with DOCKER_HOST env var set to "ssh://user@linuxvm" where linuxvm is a local VM running on bhyve[1]. Part of local FreeBSD filesystem is shared with the Linux VM via virtio-9p passthrough. Everything plays together nicely. nerdctl[2] works with sysutils/containerd. You can't run Linux images on FreeBSD kernel (Linux jails may be an option) but there are FreeBSD images. Pkgbase[3] aims to make FreeBSD more modular, divided in chunks smaller than "base", "ports", "src"; feasible for containers. [1] https://wiki.freebsd.org/bhyve [2] https://github.com/containerd/nerdctl [3] https://wiki.freebsd.org/PkgBase
In RavynOS – Finesse of macOS, freedom of FreeBSD

Showing the 15 most recent of 26 sources. Enable JavaScript to search and browse every indexed mention.

MAKE YOURSELF AT HOME

A few shortcuts

/
Search the collection
?
Open this guide
Esc
Close dialogs and navigation

Your saved repositories and interests stay in this browser.