nerdctl tips — authorized containerd cli literacy

Snapshot

Tip checklist (authorized only)

1. Confirm you may run nerdctl on the lab host (syllabus box you own or were given access to).
2. Prefer documenting who / why / ticket before any pull/push/run — never poke production engines without change control.
3. Record short factual notes; quote short Evidence (image name, digest, id — never registry tokens or secret mounts).
4. Optional: runtime peer → podman-tips.
5. Optional: build peer → buildah-tips.
6. Prefer disposable lab images/registries for nerdctl drills; quote non-secret labels afterward as Evidence.
7. Prefer read-only inspect/list modes for most Evidence binders unless the syllabus asks for write drills.
8. Stop at literacy — no attack or unauthorized container-escape cookbooks.

Allowed framing

• Classroom labs reviewing nerdctl on authorized disposable engines (nerdctl ps / images / inspect).
• Binding short factual notes as Evidence (image/id/network — no secrets).
• Documenting expected vs observed containerd cli literacy for authorized inventory notes.
• Comparing nerdctl ↔ peer tip pages under one binder.
• Testing write/push/run only when the syllabus authorizes that drill on lab resources.

Scope we will not cover

• No crack/pirate/keygen via nerdctl.
• No intentional unauthorized container escapes or privileged mounts against foreign hosts.
• No secret-theft or credential harvesting via secret mounts / registry tokens on hosts you do not own.
• No cookbooks that weaken containerd namespaces or smuggle images against foreign hosts without authorization.

Beginner path (authorized only)

1. Obtain one syllabus-approved disposable lab host with a usable nerdctl toolchain.
2. Prefer a throwaway lab image/registry before any write drill.
3. With authorization, run a syllabus-approved nerdctl list/inspect; quote non-secret labels as Evidence (nerdctl images / ps on a lab containerd the syllabus provides).
4. Optional: peer tip pages above when the syllabus asks.
5. Stop at literacy — no attack or unauthorized escape cookbooks.

Practical notes for authorized labs

• nerdctl is a Docker-compatible CLI over containerd — keep Evidence labels distinct from Docker-daemon assumptions and from podman-tips.
• Pair with systemctl-service-tips when containerd.service owns the lab runtime.
• Registry logins and secret mounts may embed credentials — never paste them into notes or git.
• Prefer documenting image/name/network labels the syllabus authorized without dumping full secret inspect JSON.
• Never commit nerdctl dumps with secrets to git — even for labs.
• Label lab-only artifacts clearly so they are not mistaken for production posture.
• Prefer lab namespaces (--namespace) the syllabus named — never assume default k8s.io on foreign nodes is yours.

FAQ-aligned refusals (quick)

• Foreign-host container inspect / escape → refuse.
• Unauthorized containerd-namespace / image-smuggle cookbooks → refuse.
• Attack/credential-theft framing → refuse.

For legal, authorized and educational use only.

FAQ

Sources