### Author:  [@hinshun](https://discourse.nixosstag.fcio.net/u/hinshun)
#### Post date: [September 6, 2023, 10:14pm UTC](https://discourse.nixosstag.fcio.net/t/nix-snapshotter-native-understanding-of-nix-packages-for-containerd/32696/1 "2023-09-06T22:14:39Z")
Hello! This is Edgar and Robbie, and we’re excited to share with you the public release of [nix-snapshotter](https://github.com/pdtpartners/nix-snapshotter)! nix-snapshotter brings native understanding of Nix packages to [containerd](https://github.com/containerd/containerd), the industry standard container runtime.
We built this because Nix is a great fit for making efficient containers. They don’t need an OS because Nix captures all dependencies exactly. However, the current process of creating Nix images is subpar because one needs to transform Nix packages into a format that container runtimes understand.
Using nix-snapshotter, instead of downloading image layers, packages come directly from the Nix store. Packages can be fetched from a binary cache or built on the fly if necessary. All existing non-Nix images continue to be supported, and Nix layers can be interleaved with normal layers.
nix-snapshotter also provides a CRI image service, which allows Kubernetes to resolve image manifests from Nix directly too. This enables for the first time, fully declarative Kubernetes resources, all the way down to the image specification and its contents. With this, you can even run pure Nix images without a Docker Registry at all, if you wish.
We’d love for you to try it out, there is a one-liner for Nix users to boot a VM with everything pre-configured: [GitHub - pdtpartners/nix-snapshotter: Brings native understanding of Nix packages to containerd](https://github.com/pdtpartners/nix-snapshotter)
```auto
nix run "github:pdtpartners/nix-snapshotter#vm"
nixos login: root # (Ctrl-a then x to quit)
Password: root
# Running `pkgs.hello` image with nix-snapshotter
nerdctl run ghcr.io/pdtpartners/hello
# Running `pkgs.redis` image with kubernetes & nix-snapshotter
kubectl apply -f /etc/kubernetes/redis/
# Wait a few seconds...
watch kubectl get pods
# And a kubernetes service will be ready to forward port 30000 to the redis
# pod, so you can test it out with a `ping` command
redis-cli -p 30000 ping
```
See corresponding [HackerNews discussion](https://news.ycombinator.com/item?id=37407758).
---
### Author:  [@blaggacao](https://discourse.nixosstag.fcio.net/u/blaggacao)
#### Post date: [September 7, 2023, 7:05am UTC](https://discourse.nixosstag.fcio.net/t/nix-snapshotter-native-understanding-of-nix-packages-for-containerd/32696/2 "2023-09-07T07:05:48Z")
The link that probably everybody in here is looking for:
>
This is great stuff!
Have you been in contact with the OCI committee? About a year ago similar ideas where tossed around. If not, it might be worthwhile to present there. Folks seemed pretty interested and open to those ideas.
A long term goal could be to make this a recommended extension of the runtime spec.
Edit: I also think `nlewo/nix2container` may deserve some honorary mention in the “how is this different” section. That project move the goal post of more efficient OCI workflows by one important marginal step for ~2 years now.
---
### Author:  [@hinshun](https://discourse.nixosstag.fcio.net/u/hinshun)
#### Post date: [September 7, 2023, 8:15am UTC](https://discourse.nixosstag.fcio.net/t/nix-snapshotter-native-understanding-of-nix-packages-for-containerd/32696/3 "2023-09-07T08:15:56Z")
Thank you! That’s a good idea, we’ll see if they are interested in a presentation. We have been to containerd meetings to give them a heads up and made several upstream contributions but that is separate from the OCI committee.
I think it will be beneficial to have it documented/recommended, but I don’t think we should modify the runtime spec. Adding a new media type [suggested in your issue](https://github.com/opencontainers/image-spec/issues/922) will require native support in all the container runtimes, whereas in our design it works with off the shelf containerd/Kubernetes.
I’ve opened a PR to add a FAQ entry for `nlewo/nix2container`, appreciate your feedback! [Add FAQ entry for nix2container by elpdt852 · Pull Request #82 · pdtpartners/nix-snapshotter · GitHub](https://github.com/pdtpartners/nix-snapshotter/pull/82)
---
### Author:  [@bbigras](https://discourse.nixosstag.fcio.net/u/bbigras)
#### Post date: [September 14, 2023, 4:17pm UTC](https://discourse.nixosstag.fcio.net/t/nix-snapshotter-native-understanding-of-nix-packages-for-containerd/32696/4 "2023-09-14T16:17:50Z")
Can I use this without Kubernetes? I mean running a container on nixos with my configuration.nix.
---
### Author:  [@nrdxp](https://discourse.nixosstag.fcio.net/u/nrdxp)
#### Post date: [September 14, 2023, 5:32pm UTC](https://discourse.nixosstag.fcio.net/t/nix-snapshotter-native-understanding-of-nix-packages-for-containerd/32696/5 "2023-09-14T17:32:08Z")
containerd is the default backend for docker, so yes via `virtualisation.oci-containers.containers`.
---
### Author:  [@bbigras](https://discourse.nixosstag.fcio.net/u/bbigras)
#### Post date: [September 14, 2023, 5:58pm UTC](https://discourse.nixosstag.fcio.net/t/nix-snapshotter-native-understanding-of-nix-packages-for-containerd/32696/6 "2023-09-14T17:58:29Z")
I just tried with `virtualisation.oci-containers.containers` and I got `docker: no matching manifest for linux/amd64 in the manifest list entries.`.
Note that I’m building the image on another computer and I push it to a docker registry.
`nerdctl run image` seems to fetch the image, but doesn’t find the paths in the nix store (but that’s for my next question).
---
### Author:  [@hinshun](https://discourse.nixosstag.fcio.net/u/hinshun)
#### Post date: [September 14, 2023, 6:02pm UTC](https://discourse.nixosstag.fcio.net/t/nix-snapshotter-native-understanding-of-nix-packages-for-containerd/32696/7 "2023-09-14T18:02:11Z")
Yes, the NixOS and home-manager modules both set up containerd with nix-snapshotter without Kubernetes, [see installation steps](https://github.com/pdtpartners/nix-snapshotter#installation). For example with the NixOS module, all you need is `services.nix-snapshotter.enable = true` and it’ll configure containerd for you as well.
I don’t recommend `virtualisation.oci-containers.containers` since it only works with docker or podman backend, and we don’t have support for either atm. [See tracking issue](https://github.com/pdtpartners/nix-snapshotter/issues/88)
---
### Author:  [@bbigras](https://discourse.nixosstag.fcio.net/u/bbigras)
#### Post date: [September 14, 2023, 6:06pm UTC](https://discourse.nixosstag.fcio.net/t/nix-snapshotter-native-understanding-of-nix-packages-for-containerd/32696/8 "2023-09-14T18:06:56Z")
Beside `virtualisation.oci-containers.containers`, is there anything I can put in my configuration.nix to run a container with containerd?
---
### Author:  [@hinshun](https://discourse.nixosstag.fcio.net/u/hinshun)
#### Post date: [September 14, 2023, 6:36pm UTC](https://discourse.nixosstag.fcio.net/t/nix-snapshotter-native-understanding-of-nix-packages-for-containerd/32696/9 "2023-09-14T18:36:36Z")
Have you read through the [installation steps](https://github.com/pdtpartners/nix-snapshotter#installation)? You need to set the following:
```nix
services.nix-snapshotter = {
enable = true;
# Sets CONTAINERD_SNAPSHOTTER=nix
setContainerdSnapshotter = true;
};
# A CLI for containerd, so you can run `nerdctl run --rm ghcr.io/pdtpartners/hello`
environment.systemPackages = [pkgs.nerdctl];
```
---
### Author:  [@bbigras](https://discourse.nixosstag.fcio.net/u/bbigras)
#### Post date: [September 14, 2023, 6:54pm UTC](https://discourse.nixosstag.fcio.net/t/nix-snapshotter-native-understanding-of-nix-packages-for-containerd/32696/10 "2023-09-14T18:54:17Z")
Yes I already have that.
My understanding is that I can only start a container with `nerdctl`.
I was wondering if I was able to “start” a container declaratively using my config, like with `virtualisation.oci-containers.containers`.
---
### Author:  [@hinshun](https://discourse.nixosstag.fcio.net/u/hinshun)
#### Post date: [September 14, 2023, 7:44pm UTC](https://discourse.nixosstag.fcio.net/t/nix-snapshotter-native-understanding-of-nix-packages-for-containerd/32696/11 "2023-09-14T19:44:10Z")
Ah sorry, I misunderstood. We don’t have declarative containers yet, but please do file an issue we can track this. Welcome any ideas or contributions.
For this feature in particular, it’s more about containerd than nix-snapshotter. Perhaps this just involves adding containerd support to the `virtualisation.oci-containers.containers` backends.
---
### Author:  [@bbigras](https://discourse.nixosstag.fcio.net/u/bbigras)
#### Post date: [September 14, 2023, 8:02pm UTC](https://discourse.nixosstag.fcio.net/t/nix-snapshotter-native-understanding-of-nix-packages-for-containerd/32696/12 "2023-09-14T20:02:15Z")
Gotcha, thanks. Yeah that makes sense.
Does running `nerdctl run ` automatically fetch nix store path from my configured substituters? It didn’t seem to be the case, but maybe I needed to restart something. (note that I built the image on another computer, so the files are missing from the nix store).
---
### Author:  [@hinshun](https://discourse.nixosstag.fcio.net/u/hinshun)
#### Post date: [September 14, 2023, 9:09pm UTC](https://discourse.nixosstag.fcio.net/t/nix-snapshotter-native-understanding-of-nix-packages-for-containerd/32696/13 "2023-09-14T21:09:47Z")
Yes, it’s meant to run `nix build ` under the hood, so it should use your configured substituter. You can check `journalctl -u nix-snapshotter` to see the logs if something is going wrong.
---
### Author:  [@bb010g](https://discourse.nixosstag.fcio.net/u/bb010g)
#### Post date: [October 16, 2023, 9:48am UTC](https://discourse.nixosstag.fcio.net/t/nix-snapshotter-native-understanding-of-nix-packages-for-containerd/32696/14 "2023-10-16T09:48:27Z")
First off, incredible work! The Nix store always should have meshed with containers like this.
Is support for CRI-O / Podman feasible? The closest work I could find is [containers/podman#4739: Remote snapshotter in podman](https://github.com/containers/podman/issues/4739), which supports the [Stargz Store](https://github.com/containerd/stargz-snapshotter/blob/2713db58dc69454d4ed5cffdd277560e5c52aa25/docs/INSTALL.md#install-stargz-store-for-cri-opodman-with-systemd) CRI-O plugin. I’d absolutely love to use nix-snapshotter with [Quadlets](https://docs.podman.io/en/v4.6.1/markdown/podman-systemd.unit.5.html) for local, rootless `.container` and `.kube` systemd units. (I don’t know of an equivalent systemd generator for k3s.)
EDIT: I’ve opened an issue for this: [pdtpartners/nix-snapshotter#103: [Feature request] CRI-O support (CRI-O driver)](https://github.com/pdtpartners/nix-snapshotter/issues/103)
---
### Author:  [@hinshun](https://discourse.nixosstag.fcio.net/u/hinshun)
#### Post date: [February 18, 2024, 7:37am UTC](https://discourse.nixosstag.fcio.net/t/nix-snapshotter-native-understanding-of-nix-packages-for-containerd/32696/15 "2024-02-18T07:37:09Z")
CRI-O support is definitely feasible like how it is for `stargz-snapshotter`, we could definitely use the help to gain this capability.
---
### Author:  [@hinshun](https://discourse.nixosstag.fcio.net/u/hinshun)
#### Post date: [February 18, 2024, 7:37am UTC](https://discourse.nixosstag.fcio.net/t/nix-snapshotter-native-understanding-of-nix-packages-for-containerd/32696/16 "2024-02-18T07:37:50Z")
We just opened a PR to package `nix-snapshotter` in nixpkgs. The plan is to upstream the NixOS / Home Manager modules to make it dead easy to get started with `nix-snapshotter`: [nix-snapshotter: init at 0.2.0 by elpdt852 · Pull Request #289682 · NixOS/nixpkgs · GitHub](https://github.com/NixOS/nixpkgs/pull/289682)