You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
[Containers] Support using nerdctl to connect to a containerd backend #6014
So now there is more and more servers, that uses other container runtimes (containerd, CRI-O) instead of Docker.
But Visual Studio Code Remote - Containers extension doesn't see CRI containers, that using runtime other than Docker, because instead of list of containers I see the placeholder:
Get started with containers by installing Docker or by visiting the help view.
So, is it possible to add support for other container runtimes to VS Code Remote Containers extension?
Now we have nerdctl as a Docker-compatible CLI for containerd, maybe we can reuse it instead of docker backend to manage container operations for VS Code Remote Containers extension?
We should make this more specific about nerdctl. Updating the subject.
Remote - Containers does not touch container engines or daemons directly but rather interacts with CLIs. It makes no assumptions about how the engine functions. There's no "containerd, CRI-O" CLI per-se. For example, Docker itself uses containerd on Linux, so really it's already supported. Dockershim going away will not have any affect.
The issue is that each CLI that needs to be supported will require separate work unless it supports everything the docker CLI does with the same arguments. Podman is closest but there are always nuances.
While the nerdctl CLI is part of the containerd project, it currently has gaps most notably around the missing --mount property that has replaced -v and automatic creation of named volumes in either syntax (nerdctl requires a separate command be called). Would love to see those gaps resolved.
changed the title [-][Containers] Connecting VS Code Remote to container runtimes other than Docker (containerd, CRI-O)[/-][+][Containers] Support using nerdctl to connect to a container backend[/+]on Dec 15, 2021
nerdctl is only one option, most easier to integrate (because of Docker compatibility), but we have also crictl that must give compatibility with any CRI-compatible container engine!
So maybe split the issue to 2 parts - nerdctl and crictl?
changed the title [-][Containers] Support using nerdctl to connect to a container backend[/-][+][Containers] Support using nerdctl to connect to a containerd backend[/+]on Dec 16, 2021
FYI - For those not aware, the dev container CLI is now open source and is what the extension uses to interoperate with container engines if anyone has interest in contributing. https://github.com/devcontainers/cli
Reacted by Sander Maijers, Peter Roberts and Braxton Beyer
Reacted by inliquid, Joe Bowbeer, Sampath Sukesh Ravolaparthi, CasperX, Christopher Mullarkey, Zvika Almog, Lina, Jan Nemcik, Lucas Mello, Jordan Peterson and 4 more
FYI - For those not aware, the dev container CLI is now open source and is what the extension uses to interoperate with container engines if anyone has interest in contributing. https://github.com/devcontainers/cli
Chuck Lantz (@Chuxel) I checked the devcontainers/cli repo and searched forAPIVersion and got no results. This leads me to believe the change we need is not in that repo, since the command VSCode runs when spinning up a devcontainer (when trying finch) is finch version --format {{.Server.APIVersion}}.
Is the code for this extension not open? This repo is just for feedback, correct?
FYI - For those not aware, the dev container CLI is now open source and is what the extension uses to interoperate with container engines if anyone has interest in contributing. https://github.com/devcontainers/cli
@Chuxel I checked the devcontainers/cli repo and searched forAPIVersion and got no results. This leads me to believe the change we need is not in that repo, since the command VSCode runs when spinning up a devcontainer (when trying finch) is finch version --format {{.Server.APIVersion}}.
Is the code for this extension not open? This repo is just for feedback, correct?
Yeah, I'd recommend opening an issue in the CLI repository to discuss the specific scenario you are looking into.
Christof Marti (@chrmarti) is the version check in the CLI or extension? Generally, seems like these kinds of checks should end up in the CLI (if not the broader spec) so they can be contributed, but I'm not sure if this is a proposed feature.
I'm hesitant to make details like --sig-proxy=false conditional on the detected CLI as that might quickly become a long list of cases to distinguish given the growing list of Docker-like CLIs.
The more tolerant version check is available in Dev Containers extension 0.330.0-pre-release.
I'm hesitant to make details like --sig-proxy=false conditional on the detected CLI as that might quickly become a long list of cases to distinguish given the growing list of Docker-like CLIs.
In this case, for docker, you are tuning off the feature... and this feature doesn't even exists in nerdctl... you can safely be "non conditional" just detecting you are using nerdctl (which it already do) and not sending the argument.
I tried substituting the docker command with nerdctl using the --docker-path option.
The issue I encountered was with the additional_contexts support detection logic, and possibly also with parseVersion.
The CLI always determined that nerdctl compose was unsupported, which caused the build to fail.
ERROR [internal] load metadata for docker.io/library/dev_container_feature_content_temp:latest
For reference, my nerdctl is integrated with version 0.19:
buildctl:
Version: 0.19.0
I wish the docker compose module of the CLI to be refactored into a class, so we can inject the differences as functions into the constructor (or extract the differences to the constructor).
Activity
MurzNN commentedon Dec 8, 2021
Now we have nerdctl as a Docker-compatible CLI for containerd, maybe we can reuse it instead of docker backend to manage container operations for VS Code Remote Containers extension?
MurzNN commentedon Dec 8, 2021
Removing Dockershim and Docker support from Kubernetes is scheduled for Kubernetes v1.24.
chrmarti commentedon Dec 10, 2021
You can use a Docker compatible CLI by changing this setting:

When I tried nerdctl with lima a while ago, it looked like it was not fully compatible with the Docker CLI yet.
Chuxel commentedon Dec 15, 2021
We should make this more specific about
nerdctl. Updating the subject.Remote - Containers does not touch container engines or daemons directly but rather interacts with CLIs. It makes no assumptions about how the engine functions. There's no "containerd, CRI-O" CLI per-se. For example, Docker itself uses containerd on Linux, so really it's already supported. Dockershim going away will not have any affect.
The issue is that each CLI that needs to be supported will require separate work unless it supports everything the docker CLI does with the same arguments. Podman is closest but there are always nuances.
While the
nerdctlCLI is part of the containerd project, it currently has gaps most notably around the missing--mountproperty that has replaced-vand automatic creation of named volumes in either syntax (nerdctl requires a separate command be called). Would love to see those gaps resolved.[-][Containers] Connecting VS Code Remote to container runtimes other than Docker (containerd, CRI-O)[/-][+][Containers] Support using nerdctl to connect to a container backend[/+]MurzNN commentedon Dec 16, 2021
nerdctlis only one option, most easier to integrate (because of Docker compatibility), but we have also crictl that must give compatibility with any CRI-compatible container engine!So maybe split the issue to 2 parts - nerdctl and crictl?
[-][Containers] Support using nerdctl to connect to a container backend[/-][+][Containers] Support using nerdctl to connect to a containerd backend[/+]Chuxel commentedon Dec 16, 2021
We should track
crictlas a separate issue. Each CLI will be a separate effort. Raised #6075Chuxel commentedon Oct 12, 2022
FYI - For those not aware, the dev container CLI is now open source and is what the extension uses to interoperate with container engines if anyone has interest in contributing. https://github.com/devcontainers/cli
Anutrix commentedon Mar 28, 2023
Any updates on this?
kidbrax commentedon Dec 14, 2023
Chuck Lantz (@Chuxel) I checked the devcontainers/cli repo and searched for
APIVersionand got no results. This leads me to believe the change we need is not in that repo, since the command VSCode runs when spinning up a devcontainer (when trying finch) isfinch version --format {{.Server.APIVersion}}.Is the code for this extension not open? This repo is just for feedback, correct?
Chuxel commentedon Dec 14, 2023
Yeah, I'd recommend opening an issue in the CLI repository to discuss the specific scenario you are looking into.
Christof Marti (@chrmarti) is the version check in the CLI or extension? Generally, seems like these kinds of checks should end up in the CLI (if not the broader spec) so they can be contributed, but I'm not sure if this is a proposed feature.
chrmarti commentedon Dec 18, 2023
The version check is in the extension. Making that more tolerant now.
jsamuel1 commentedon Jan 2, 2024
nerdctl and finch also don't support --sig-proxy=false
This appears to be a fixed parameter in devcontainer when using single-container devcontainer configurations.
https://github.com/containerd/nerdctl/blob/main/docs/command-reference.md#whale-nerdctl-attach
(Offending Line in devcontainer code: https://github.com/devcontainers/cli/blob/f7d4c853bf8c284d784173f3e915a34d961b0b55/src/spec-node/singleContainer.ts#L396 )
chrmarti commentedon Jan 9, 2024
I'm hesitant to make details like
--sig-proxy=falseconditional on the detected CLI as that might quickly become a long list of cases to distinguish given the growing list of Docker-like CLIs.The more tolerant version check is available in Dev Containers extension 0.330.0-pre-release.
Bigous commentedon Jan 18, 2024
Hi Christof Marti (@chrmarti) ,
In this case, for docker, you are tuning off the feature... and this feature doesn't even exists in nerdctl... you can safely be "non conditional" just detecting you are using nerdctl (which it already do) and not sending the argument.
Could that be a solution?
CodeChanning commentedon Jun 25, 2024
A --sig-proxy change was merged to nerdctl yesterday that should supports the flag in run
containerd/nerdctl#3043
midnight-wonderer commentedon Feb 11, 2025
I tried substituting the
dockercommand withnerdctlusing the--docker-pathoption.The issue I encountered was with the
additional_contextssupport detection logic, and possibly also withparseVersion.The CLI always determined that
nerdctl composewas unsupported, which caused the build to fail.For reference, my
nerdctlis integrated with version0.19:I wish the
docker composemodule of the CLI to be refactored into a class, so we can inject the differences as functions into the constructor (or extract the differences to the constructor).cmullark commentedon Apr 18, 2025
I tried this today with version 0.409.0 of this extension with finch, which uses nerdctl, instead of docker and I am able to spin up a devcontainer!
Not sure where the rough edges are yet but this is now possible today.
subesokun commentedon Apr 23, 2025
Finch's devcontainer Mac integration worked for me: https://runfinch.com/docs/integrations/mac/devcontainers. Consider tweaking the default config (cups, memory, ...): https://runfinch.com/docs/configuration-reference/.