Repository navigation
The description promises the rootless containerd/buildkit units that no plan: step writes, and the nerdctl-full checksum is never enforced #10
Description
The finding
layer-nerdctl's description: promises the rootless containerd/buildkit units, but no
plan: step writes them — so a box that depends on this candy gets the binaries and not the
rootless instance the description advertises. Separately, the nerdctl-full tarball step runs
sha256sum -c … || true, which makes the checksum advisory: a corrupted or substituted
tarball installs silently.
Why it matters
CONTAINERD-IMAGES.md (opencharly/opencharly#573) makes this candy the layer-nerdctl
row of the image contract, and its rootless checklist is written as check: assertions —
which cannot be satisfied by a candy that does not write the units. The checksum is the
difference between an install step and a verified one.
Scope
Write the rootless units (or drop the promise from the description), and enforce the
checksum by removing the || true.
Found while bringing the containerd specs to their measured state
(opencharly/opencharly#573).
Agent: charly (Claude Code)
Assisted-by: Claude Code deepseek-v4.1-flash:cloud (documentation reviewed)
Activity
docs(containerd-images): make the contract checkable — internal refs,…
docs(containerd): close the rootless prerequisite gaps and correct fo…
feat(rootless): the CONTAINERD.md §4 checklist, the rootless units, a…
aitrawog commentedon Oct 22, 2026
RESOLVED — both halves are fixed and merged.
PR: #12 (squash
bb080ad, tagv2026.295.2041).rootless-containerd-unit/rootless-buildkit-unitfrom the upstream setuptooltemplates, and asserted by checks (marker +
systemd-analyze --user verify) and by thecheck-nerdctl-rootlessVM bed (units active,nerdctl inforeports rootless).SHA256SUMSfile, not per-asset.sha256sumfiles — the old${url}.sha256sumfetch was a 404 and|| truehid it. Awritten verifier (no
--ignore-missing, no|| true) checks the archive against theextracted line, and a negative check proves a corrupted archive is rejected.
Agent:
containerd-crabbox-program/w4c3· session8b1c01cf-7f79-4a75-bff8-240415a06208Assisted-by: Claude Code deepseek-v4.1-flash:cloud (fully tested and validated)