NTT's engineering lab writes about containers, Docker alternatives, Linux, Kubernetes, and reproducible builds, often by maintainer Akihiro Suda.
HN commenters link it for practical container guidance: Containerd with Lima on Mac, avoiding host networking, reproducible Dockerfile builds, and nerdctl.
On an M1 Mac I believe that rancher desktop (mentioned in a sibling thread) is the way to go if you are going the kubernetes route. Because I only have a really simple usecase and want something just like docker I've been using lima[1] which you can just install with homebrew and set up an alias and then pretend you're using docker. I have had some problems where in long-running processes with a lot of network usage in the container after a while I get some network timeouts. I'm not sure whether that's a problem with lima or qemu or what else might actually be causing it. But basically as a dev experience it works fine even on a pretty underpowered laptop (which is what I'm using it on in this case).
[1] https://medium.com/nttlabs/containerd-and-lima-39e0b64d2a59
>having all cgroup operations flow through its opinionated dbus api was simply unacceptable for docker, kubernetes, lxc, runc, and everybody else maintaining quality container runtimes.
I think you're off-base on this. Work is being done to get support for cgroupsv2 in all the major container runtimes. Source: https://medium.com/nttlabs/cgroup-v2-596d035be4d7
In any case single-writer was not an explicit goal of systemd, it was an intentional design decision that came from the kernel. TFA even mentions this, although it is somewhat lost within the pages of ranting. You also don't even have to use systemd's D-Bus APIs to deal with this. Container managers can if they want to provide additional integrations. Source: https://systemd.io/CGROUP_DELEGATION/
On top of that, you usually want to isolate the container workload with an observable network abstraction instead of granting it full (albeit non-root) access to host network facilities (including sockets).
See https://medium.com/nttlabs/dont-use-host-network-namespace-f548aeeef575 for just an example of what can go wrong otherwise.
Agreed with most of the points raised here although reproducible images are currently hard to achieve due to technical reasons on how docker builder operates. See https://medium.com/nttlabs/bit-for-bit-reproducible-builds-with-dockerfile-7cc2b9faed9f
Thanks, I wasn’t thinking only about docker desktop, but also more specifically docker cli and compose (but now makes sense)
btw for mac there’s Containerd + Lima https://medium.com/nttlabs/containerd-and-lima-39e0b64d2a59
is this a fork of nerdctl ?
nerdctl is the coolest project ever. created by Akihiro Suda (https://medium.com/nttlabs/nerdctl-v1-0-fb6bf8e1b0b) for a containerd equivalent with the exact same UX of docker.