This is not for building inside a container, this is for running containerized CLI tools in a Job. I know the security implications. This is a lateral move security wise from DooD just to get us to EKS 1.24 while we transition away from running containers inside pods (which is not a simple task).

What volumes do I need to mount to be able to run nerdctl inside a container? I'm testing this locally in Pop_OS! (Ubuntu based) and mounting the containerd.sock is not enough.

This is where I'm at and it already seems like too much

nerdctl run --privileged -v /run/containerd:/run/containerd -v /var/lib/containerd:/var/lib/containerd -v /tmp:/tmp -it --rm --entrypoint bash --network foo ubuntu_runtime
root@574f151c1b7e:/# nerdctl run --rm hello-world
FATA[0000] failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: unable to apply cgroup configuration: mkdir /sys/fs/cgroup/default: permission denied: unknown 

I'm guessing some of this will be different for EKS, but I wanted to at least get it working locally.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.