nerdctl and image storage size

[yveszoundi]

Background information

I'm working on a document sanitizer (active content removal)

• There's a Live CD download artifact with a preloaded container image running via podman.
• I'd like to replace podman with nerdctl in order to easily leverage apparmor with rootless containers.

Question

Is it normal that disk storage requirements appear to double with nerdctl, in comparison to podman?
The resulting Live CD ISO image is almost twice its original size with nerdctl (800 MB to ~1.4 GB), apparently due to redundancy with the "snapshotter data".

• With podman I'm copying the ~/.local/share/containers folder onto the Live CD
• With nerdctl, I'm copying the entire ~/.local/share folder onto the Live CD
  • Can I get away with only copying ~/.local/share/containerd-fuse-overlayfs?
  • Or do I also need the contents of ~/.local/share/containerd?

Image load with podman

After loading the container tar image, prior copying data to the Live CD, local storage stands at 1.2 GB.

$ podman load -i /tmp/image.tar
Getting image source signatures
Copying blob 7abf701d9a62 done
Copying config 460c19e64a done
Writing manifest to image destination
Storing signatures
Loaded image(s): docker.io/uycyjnzgntrn/entrusted_container:0.3.1
$ du -hs /home/vip/.local/share/
1.2G    /home/vip/.local/share/

Image load with nerdctl

With nerdctl (fuse-overlayfs snapshotter), local storage used is double the size with 2.4 GB occupied.

$ nerdctl load -i /tmp/image.tar
unpacking docker.io/uycyjnzgntrn/entrusted_container:0.3.1 (sha256:dc36955748c3947109c4cf88bb1ce17c75b92d4e84a6323cf4fffb680eba9400)...
Loaded image: docker.io/uycyjnzgntrn/entrusted_container:0.3.1
$ du -hs /home/vip/.local/share/
2.4G    /home/vip/.local/share/

Few things that I've tried

• I switched from fuse-overlayfs to the 'native and stargz snapshotter to check if it would make any difference
• I compressed the image nerdctl image convert --estargz but that only seemed to impact the image blob size displayed via nerdctl images

[yveszoundi]

If my understanding of nerdctl behavior is correct, my question becomes "is it possible to disable the snapshots to keep the same disk space requirements as podman?"

• For my use case, as nerdctl is running on a Live CD, there's no apparent need to deal with historical data or snapshots
• However, if snapshots are only used for maintenance purposes (restore, etc.) and not tied directly to the core functionality, I'm hoping that there's a way to say "trust me, I don't need snapshots here"

Possibly related: containerd/containerd#7504

[yveszoundi]

Per further reading, it seems that snapshots are an integral part of container creation/execution within containerd.

• Thus my question wouldn't make sense in the isolated context of nerdctl
• Removing the snapshots folder of containerd creates problems (~/.local/share/containerd/somefolder)...

This was answered by AkihiroSuda below (added here because comments can't be used as answers?)

You can use nerdctl run --rootfs /DIR to run a container from a raw filesystem without using snapshots.

[AkihiroSuda]

You can use nerdctl run --rootfs /DIR to run a container from a raw filesystem without using snapshots.

[yveszoundi]

Thanks a lot, it helped tremendously. I'm now looking at permission (volumes), but that's another question...

Below are the steps that I followed successfully, in case it could help someone else.

1) Export the rootfs

In the context of my application, , the commands below would happen prior entering chroot.

podman create --name entrusted_container docker.io/uycyjnzgntrn/entrusted_container:0.3.1
podman export -o /tmp/image.tar  entrusted_container

2) Unpack the archive

In the context of my application, this would happen inside a chroot environment.

mkdir -p $HOME/rootfs && tar xf /tmp/image.tar -C $HOME/rootfs

3) Run a basic command in the container

In the context of my application, the rootless container user is called entrusted.
The binary entrusted-container only exists within the container image itself (not on the host).

$ nerdctl run --network none --user entrusted:entrusted --rootfs $HOME/rootfs  ls -al /usr/local/bin/
total 3944
drwxr-xr-x 2 root root    4096 Dec 19 10:16 .
drwxr-xr-x 4 root root    4096 Dec 19 10:16 ..
-rwxr-xr-x 1 root root 4028872 Dec 19 10:15 entrusted-container