Switch to containerd, how to keep my docker-compose steps in CI?

[nicolasespiau]

Hello folks,

I had a Kube cluster running on Docker, and some projects with a CI step performing docker actions like docker-compose.

I redeployed a new cluster, and since Docker is deprecated I switched to containerd.

All my steps with docker-compose do not work anymore.

I'm running CI pipeline thanks to a Gitlab Runner Executor in my Kube cluster.

I thought about replacing them by a nerdctl compose, but for that I need a nerdctl image with buildkit in it.

I tried to reverse engineer the Dockerfile, but when I build an image like that:

nerdctl build --target=build-full --platform "linux/amd64" -t MYREGISTRY/nerdctl:full .

there is no nerdctl executable in the container:
From my CI:

/scripts-25793245-2722594858/step_script: eval: line 160: nerdctl: not found

From a local container:

/nowhere # nerdctl
sh: nerdctl: not found

Is there any trick to build a full image for nerdctl with capabilities to nerdctl build, nerdctl login, nerdctl push and of course nerdctl compose --build?

I can see that all binaries are present in /out/bin but how to use them properly?

[fahedouch]

That depends on your Dockerfile. Which dockerfile are using to build. FYI if you are using containerd as buildkit worker you also need containerd. This may help you #1090

[nicolasespiau]

I'm using the Dockerfile from containerd/nerdctl repo here.

But basically, if I understand well, your advice is to build my own image with containerd, buildkit and nerdctl?

[nicolasespiau]

Just for information, the solution here #1090 does not work. A lot of issues occur, and no matter what variation I try it always fails.

My conclusion is: it's impossible to have a proper image allowing to run nerdctl compose.

[AkihiroSuda]

You can run docker run -it --rm --privileged ghcr.io/containerd/nerdctl:v0.21.0 and run nerdctl compose inside there.

[nicolasespiau]

Because there is no buildkit installed un the node I can't mount buildkit.sock into the container, therefor the build part of the compose does not work.
I think I can try 2 solutions here: install buildkit on the node and mount the sock or build images in a before_step (with kaniko for example)

[AkihiroSuda]

--target=build-full

This is wrong for your use case. Just the default target should work.