awesome-repositories.com
Blog
MCP
awesome-repositories.com

Discover the best open-source repositories with AI-powered search.

ExploreCurated searchesOpen-source alternativesSelf-hosted softwareBlogSitemap
ProjectMCP serverAboutHow we rankPress
LegalPrivacyTerms
© 2026 Bringes Technology SRL·VAT RO45896025·hello@awesome-repositories.com
containerd avatar

containerd/nerdctl

0
View on GitHub↗

Nerdctl

nerdctl is a command-line tool that manages containers and images using containerd as the runtime, providing a Docker-compatible interface for container lifecycle management. It supports running containers with the same command syntax and flags as Docker, including multi-container Compose workflows, and enables rootless container execution without host kernel escalation.

The tool extends beyond basic container management with several advanced distribution and security capabilities. It can start containers before full image download by fetching only metadata and on-demand layers from eStargz-formatted images, and can pull and run images from content-addressed identifiers on a peer-to-peer IPFS network. For security, it encrypts and decrypts image layers using OCIcrypt specifications with configurable cryptographic keys, and signs and verifies images using cosign.

nerdctl also integrates with Kubernetes for debugging and image management, allowing inspection of running containers and reading their logs by targeting the k8s.io containerd namespace, as well as loading image archives directly into a local cluster without needing a registry. Image building is handled through BuildKit delegation, supporting standard build commands and output options from a Dockerfile.

AI search

Explore more awesome repositories

Describe what you need in plain English — the AI ranks thousands of curated open-source projects by relevance.

Start searching with AI

Features

  • Docker-Compatible CLI Tools - A command-line tool that manages containers and images using containerd as the runtime, with Docker-compatible syntax and Compose support.
  • BuildKit-Based Builds - Builds container images from a Dockerfile using BuildKit with standard build commands and output options.
  • Containerd gRPC API Bridges - Translates Docker CLI commands into containerd's native gRPC API calls for container lifecycle management.
  • Docker Container Execution - Runs and manages containers with the same command-line interface and flags as Docker, including support for Compose workflows.
  • BuildKit Build Delegations - Delegates image building to BuildKit's concurrent, cache-efficient build engine through a dedicated client-server protocol.
  • Docker CLI Compatibility Layers - Maps Docker command syntax and flags to containerd's native API calls for seamless migration.
  • Rootless Container Runtimes - Launches and manages containers without root privileges to reduce the attack surface of the container runtime.
  • BuildKit Client Integrations - Delegates image building to BuildKit's concurrent build engine through a dedicated client-server protocol.
  • Rootless Container Runtimes - Maps container processes to unprivileged user namespaces, enabling rootless container execution without host kernel escalation.
  • Container Image Layer Loaders - Starts containers before full image download by fetching only metadata and on-demand layers.
  • Containerd Namespace Debugging - Provides direct debugging of Kubernetes containers by targeting the containerd namespace.
  • Compose Orchestrators - Orchestrates multi-container applications defined in a docker-compose.yaml file with a single command.
  • On-Demand Layer Loading - Pulls image layers only when a container starts, reducing initial download time and storage use.
  • eStargz Lazy Pulling Clients - Starts containers before full image download by fetching only the metadata and on-demand layers from eStargz-formatted images.
  • Image Encryption - Encrypts image layers during push and decrypts them on pull, protecting sensitive content at rest and in transit.
  • Image Encryptions - Encrypts and decrypts container image layers using OCIcrypt specifications with configurable cryptographic keys.
  • IPFS-Based Distribution - A container image distribution tool that pulls and runs images from content-addressed identifiers on a peer-to-peer network.
  • Local Image Loading - Loads container image archives in Docker or OCI format directly into a local Kubernetes cluster without needing a registry.
  • Container Image Distributions - Pulls and runs container images from IPFS using content-addressed hashes instead of registry-based references.
  • Container Image Signing - Signs images during push and verifies signatures on pull using cosign, ensuring image integrity and authenticity.
  • Image Signing and Encryption - Encrypts, decrypts, signs, and verifies container images to protect content at rest and in transit.
  • Transport Layer Encryption - Encrypts and decrypts container image layers using OCIcrypt specifications with configurable keys.
10,172 stars·793 forks·Go·Apache-2.0·52 views

Star history

Star history chart for containerd/nerdctlStar history chart for containerd/nerdctl

How this analysis was created: This summary and feature list are AI-generated from collected project material and can contain mistakes. Stars, license and language are imported from GitHub. Inclusion does not mean that we have tested or audited this project. Check the source documentation for any feature you depend on. Learn more on our About page.

Frequently asked questions

What does containerd/nerdctl do?

nerdctl is a command-line tool that manages containers and images using containerd as the runtime, providing a Docker-compatible interface for container lifecycle management. It supports running containers with the same command syntax and flags as Docker, including multi-container Compose workflows, and enables rootless container execution without host kernel escalation.

What are the main features of containerd/nerdctl?

The main features of containerd/nerdctl are: Docker-Compatible CLI Tools, BuildKit-Based Builds, Containerd gRPC API Bridges, Docker Container Execution, BuildKit Build Delegations, Docker CLI Compatibility Layers, Rootless Container Runtimes, BuildKit Client Integrations.

Which projects share features with containerd/nerdctl?

Projects with overlapping indexed features include: orbstack/orbstack — OrbStack is a native macOS application that replaces Docker Desktop, providing an all-in-one environment for running… containers/podman-compose — podman-compose is a command line tool and compose specification wrapper that translates YAML definitions into commands… runfinch/finch — Finch is a virtual machine-based container runtime and OCI container management CLI used for local container… docker/buildx — Buildx is a BuildKit build extension and container build instance manager that enables the creation of container… rootless-containers/rootlesskit — RootlessKit is a tool for running container workloads and isolated process trees securely as a standard non-privileged… codeedu/wsl2-docker-quickstart — This project is a technical setup guide for installing and configuring Docker within a Windows Subsystem for Linux 2…

Projects sharing features with Nerdctl

These projects share indexed features with Nerdctl. Shared tags can include platform or build tooling; verify the primary use case before treating a result as a replacement.
  • orbstack/orbstackorbstack avatar

    orbstack/orbstack

    8,903View on GitHub↗

    OrbStack is a native macOS application that replaces Docker Desktop, providing an all-in-one environment for running Docker containers, full Linux virtual machines, and local Kubernetes clusters. It runs Linux VMs directly on the macOS hypervisor framework for near-native performance, uses VirtioFS for fast bidirectional file sharing between macOS and Linux, and leverages Rosetta for near-native x86 emulation on Apple Silicon. The system assigns predictable local domain names to containers and VMs with automatic HTTPS certificate generation, forwards ports via event-driven updates, and stores

    Shellcolimadockerdocker-desktop
    View on GitHub↗8,903
  • containers/podman-composecontainers avatar

    containers/podman-compose

    6,115View on GitHub↗

    podman-compose is a command line tool and compose specification wrapper that translates YAML definitions into commands for the Podman container engine. It functions as a multi-container orchestrator that deploys application stacks without requiring a background daemon process. The tool enables rootless container management, allowing the execution of containerized applications and services without administrative privileges on the host. It translates high-level compose commands into individual shell calls to coordinate the deployment of multiple containers. The system manages container network

    Python
    View on GitHub↗6,115
  • runfinch/finchrunfinch avatar

    runfinch/finch

    4,036View on GitHub↗

    Finch is a virtual machine-based container runtime and OCI container management CLI used for local container development. It operates by running container workloads inside a background virtual machine to isolate them from the host operating system. The project serves as an OCI image builder and a multi-container service orchestrator for simulating complex production environments on a workstation. The runtime functions as a cross-platform container engine, utilizing emulation layers to execute container images built for foreign CPU architectures. It distinguishes its image distribution through

    Gocontainerdcontainerslima-vm
    View on GitHub↗4,036
  • docker/buildxdocker avatar

    docker/buildx

    4,410View on GitHub↗

    Buildx is a BuildKit build extension and container build instance manager that enables the creation of container images targeting multiple CPU architectures and operating systems simultaneously. It functions as a multi-platform image builder that leverages a BuildKit backend to extend standard image building capabilities. The project features a distributed build orchestrator capable of coordinating tasks across a cluster of remote nodes. This allows for native compilation across different hardware architectures by connecting multiple remote workers into a single instance to increase build con

    Go
    View on GitHub↗4,410
Compare all 30 related projects→