What is the path to the containerd socket in the host?

[bubbajoe]

I am trying to connect to /run/containerd/containerd.sock socket, but i can seem to find the lima containerd unix socket path.

Code

func main() {
	client, err := containerd.New("/run/containerd/containerd.sock")
	if err != nil {
		panic(err)
	}
	defer client.Close()
}

[afbjorklund]

If you are running rootless containerd, the .sock is in a different path namespace

[bubbajoe]

I just installed lima and i ran sudo systemctl start containerd

Im not sure if it's rootless or not.

[bubbajoe]

Also i should mentioned that im using MacOS M1

[bubbajoe]

Also this program is running on the host.

[afbjorklund]

• Direct access to containerd socket? #1275

[bubbajoe]

Yea I saw this. Didn't work for me.

[afbjorklund]

I was wondering how you did this for rootless containerd, so adopted the example from https://containerd.io/docs/getting-started/

package main

import (
	"context"
	"fmt"
	"log"

	//"github.com/containerd/containerd"
	"github.com/containerd/nerdctl/pkg/clientutil"
	"github.com/containerd/nerdctl/pkg/rootlessutil"
)

func main() {
	if err := example(); err != nil {
		log.Fatal(err)
	}
}

func example() error {
	if rootlessutil.IsRootlessParent() {
		return rootlessutil.ParentMain()
	}
	//client, err := containerd.New("/run/containerd/containerd.sock")
	client, ctx, _, err := clientutil.NewClient(context.Background(), "default", "/run/containerd/containerd.sock
")
	if err != nil {
		return err
	}
	defer client.Close()

	version, err := client.Version(ctx)
	if err != nil {
		return err
	}
	fmt.Printf("containerd version: %s\n", version.Version)
	fmt.Printf("containerd address: %s\n", client.Conn().Target())
	fmt.Printf("rootless: %v\n", rootlessutil.IsRootless())
	return nil
}

It will actually print the same address for both (unlike Docker or Podman sockets), since it is in a "rootlesskit" Linux namespace.

[afbjorklund]

Example of running this program with template://default, with some minor modifications to the yaml

containerd:
  system: false
  user: true

$ limactl shell nerdctl ./containerdtest
containerd version: v1.6.12
containerd address: unix:///run/containerd/containerd.sock
rootless: true

containerd:
  system: true
  user: false

$ limactl shell nerdctl-rootful sudo ./containerdtest
containerd version: v1.6.12
containerd address: unix:///run/containerd/containerd.sock
rootless: false

[afbjorklund]

Here was the original example: (more or less, anyway - adopted from #implementing-your-own-containerd-client

package main

import (
	"context"
	"fmt"
	"log"

	"github.com/containerd/containerd"
)

func main() {
	if err := example(); err != nil {
		log.Fatal(err)
	}
}

func example() error {
	client, err := containerd.New("/run/containerd/containerd.sock")
	if err != nil {
		return err
	}
	defer client.Close()

	ctx := context.Background()
	version, err := client.Version(ctx)
	if err != nil {
		return err
	}
	fmt.Printf("containerd version: %s\n", version.Version)
	fmt.Printf("containerd address: %s\n", client.Conn().Target())
	return nil
}

It fails with failed to dial "/run/containerd/containerd.sock": connection error: desc = "transport: error while dialing: dial unix /run/containerd/containerd.sock: connect: permission denied", and can only talk to the system socket (with sudo)

[AkihiroSuda]

The socket path is /proc/$(cat $XDG_RUNTIME_DIR/containerd-rootless/child_pid)/root/run/containerd/containerd.sock in the guest, but it is not exposed to the host, as most containerd operations needs the daemon and the client to share the same filesystem

[afbjorklund]

Are there any thoughts of symlinking the "usual" socket location of $XDG_RUNTIME_DIR/containerd/containerd.sock ?

So that it would match the other container runtimes, I mean... (like: $XDG_RUNTIME_DIR/podman/podman.sock)

[AkihiroSuda]

No, because a client program has to join the daemon's mountNS anyway.

[afbjorklund]

I meant that rootlesskitd could recreate when it is restarted, so that you don't have to "remember" the complicated one ?

ln -s /proc/$(cat $XDG_RUNTIME_DIR/containerd-rootless/child_pid)/root/run/containerd/containerd.sock \ $XDG_RUNTIME_DIR/containerd/containerd.sock

[AkihiroSuda]

Most snapshot operations still do not work as expected when the daemon process and the client process do not share the same mount namespace.

This limitation may change in a future though, with the experimental transfer API (https://github.com/containerd/containerd/blob/release/1.7/api/services/transfer/v1/transfer.proto).