Trying to run a container built with nerdctl

[mgingell]

I am trying to deploy a locally built image on Rancher-Desktop for windows running in WSL ubuntu but am getting the following error:

Failed to pull image "howdy:1": rpc error: code = Unknown desc = failed to pull and unpack image "docker.io/library/howdy:1": failed to resolve reference "docker.io/library/howdy:1": pull access denied, repository does not exist or may require authorization: server message: insufficient_scope: authorization failed

My Dockerfile is simple:
FROM hello-world
My build and deploy is also simple:
nerdctl build -t howdy:1 .

[+] Building 0.6s (5/5) FINISHED
 -- lines removed --
 => exporting to oci image format                                                                                                                                  0.0s
 => => exporting layers                                                                                                                                            0.0s
 => => exporting manifest sha256:9d0196d854da51fb8fc2997c2d183bccce2c3eeeca7e5606e42b367dd06c8f09                                                                  0.0s
 => => exporting config sha256:bb31f47d8cce4ac32588f855be49807af0926c794495faaf2cceee57f89e1ce9                                                                    0.0s
 => => sending tarball                                                                                                                                             0.0s
unpacking docker.io/library/howdy:1 (sha256:9d0196d854da51fb8fc2997c2d183bccce2c3eeeca7e5606e42b367dd06c8f09)...done
[1541]:[LAPTOP-P5530-1:test]$`

kubectl run hw --image=howdy:1 --restart=Never

Am I missing something obvious?
Thanks for your help,

• Mike

[mook-as]

Hi! nerdctl uses containerd namespaces, so if you're using it with kubectl you'll need to tell it to build in the k8s.io namespace:
nerdctl build -n k8s.io -t howdy:1 .

Hope that helps!

[mgingell]

Doh! That makes sense now. I am switching between docker engine (that also uses containerd) but doesn't use namespaces and the containerd installed by rancher desktop and used by nerdctl that does.
nerdctl -n k8s.io build -t image . works.
Is there a way to set the default namespace? Otherwise I will probably create an alias....
Thanks for your help,

• Mike

[mook-as]

I do not believe it's possible at the moment; that would be a feature request for nerdctl in either case.

[jandubois]

You can set the default namespace via CONTAINERD_NAMESPACE. I don't know if the nerdctl-stub on Windows has a way to forward it to the nerdctl running inside the VM.

On macOS we could forward it via the wrapper, but don't right now. You can set it directly on the host via override.yaml:

env:
  CONTAINERD_NAMESPACE: k8s.io

After a reboot it works:

$ nerdctl ps | head -2
CONTAINER ID    IMAGE                                                                                                 COMMAND                   CREATED          STATUS    PORTS    NAMES
1a7b1fe6def5    docker.io/rancher/pause:3.1                                                                           "/pause"                  5 minutes ago    Up                 k8s://kube-system/local-path-provisioner-5ff76fc89d-77rrn

Anyways, nerdctl already has the feature, we just need to expose it better.