nerdctl CLI
nerdctl controls containerd with Docker-like commands for containers and images, including Compose and optional BuildKit builds.
- 10,467 ★ on the repository
- Last commit
- Apache-2.0
Broad access
Why this level
- Container and containerd access can grant broad host capabilities through privileges and mounts.
Install
Manual install
Use the first Install option, release binaries. Verify dependencies and engine, then inspect containers without mutation.
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- Container and containerd access can grant broad host capabilities through privileges and mounts.
This is third-party code. Review the repository files before installing.
What it does
A containerd instance separates containers by namespace. In nerdctl, users select the engine address and namespace, such as `k8s.io` for local Kubernetes. Familiar commands then inspect containers, load images or run an application from a Compose file. Image builds use a separately running BuildKit daemon. Rootless setup starts by installing RootlessKit and running `containerd-rootless-setuptool.sh install` to configure containerd for the user. Switching to nerdctl alone does not convert an existing engine to rootless operation.
Who it is for. Administrators of containerd and local Kubernetes environments needing a familiar container CLI without Docker daemon.
Good fit when
- Use familiar Docker-style operations on an existing containerd node.
- Load an image into local Kubernetes without a registry.
- Run a Compose-defined app on containerd.
- Build through nerdctl using an existing BuildKit setup.
Not a fit when
- Every Docker feature must work identically without compatibility checks.
- The process may not access the container engine.
- macOS must run Linux containers without a virtual environment.
Example request
List local Kubernetes containers in the correct namespace without stopping, deleting or launching workloads.Limitations
containerd and CNI networking are required, with a running BuildKit for builds. The minimal binary archive does not include every dependency; a full bundle is separate. macOS uses a Linux environment such as Lima, while the direct brew option in the README targets Linux. Engine access and container settings can expose host files or devices, so inspect namespaces, mounts and privileges before running, especially on shared machines.
How to disable. End nerdctl jobs and stop only agreed containers. Removing the CLI does not stop containerd or existing workloads.
FAQ
How do I list local Kubernetes containers?
Run `nerdctl --namespace k8s.io ps -a` on the intended node. It lists containerd containers in `k8s.io`; a different namespace may appear empty.
When is BuildKit needed?
`nerdctl build` requires a running `buildkitd` daemon. Listing containers with `ps` does not need the builder.
Is Compose supported?
Yes. `nerdctl compose` runs supported Compose operations on containerd.
Why are dependencies missing from the archive?
The minimal archive supplies the CLI, while nerdctl-full includes extra components. Choose based on the existing environment.
How do I use it on macOS?
Through a Linux VM. The README demonstrates Lima with nerdctl integration.
Discussion
No questions or reviews yet.
Related
CLI toolsThe terminal interface presents Docker containers, services and images for user-led investigation with agent assistance.
Container by Aerovato
Container
A CLI for persistent per-project Linux workspaces in Docker or Podman that keep the agent away from the rest of your system
Docker’s terminal client connects agent commands to containers, images, networks and volumes in the selected environment.
dive explores Docker and OCI image layers, highlights file changes and estimates wasted space for inspection or CI checks.
MCP server for managing Docker in natural language: containers, images, networks and volumes, including remote hosts over SSH
CLI for full-cycle CI/CD to Kubernetes: image builds, Helm-based deploys and container registry cleanup
README in short
Optional features include image signing and lazy pulling. IPFS is a separate operator opt-in.