From 4f4b41bb221066ee2ff7f6a8eb0e8a97ad734b24 Mon Sep 17 00:00:00 2001 From: Andreas Trawoeger Date: Fri, 23 Oct 2026 18:47:15 +0200 Subject: [PATCH] docs: the layer-nerdctl prose names the containerd engine word, not the retired nerdctl (#15) spec#266 retired `nerdctl` as an ENGINE NAME; the word is now `containerd`, and `nerdctl` is only the CLI binary that drives it (the spec-owned #EngineBinaries map holds `containerd -> nerdctl`). README.md, AGENTS.md and the owning skill still called nerdctl the engine, so a reader was taught a word the loader now rejects. Also corrects the AGENTS.md "edit the candy entity AND the skill entity" note: since #14 the skill node is routing-only and `.agents/skills/layer-nerdctl/SKILL.md` is the source of record. R5 claim-keyed sweep (engine-word uses, CHANGELOG excluded): zero hits after the change. The nerdctl CLI, the nerdctl/nerdctl-full packages and the layer-nerdctl/plugin-nerdctl repo names are correct and unchanged. Assisted-by: Claude Code deepseek-v4.1-flash:cloud (documentation reviewed) --- .agents/skills/layer-nerdctl/SKILL.md | 18 +++++++++++------- AGENTS.md | 16 +++++++++------- README.md | 14 +++++++++----- 3 files changed, 29 insertions(+), 19 deletions(-) diff --git a/.agents/skills/layer-nerdctl/SKILL.md b/.agents/skills/layer-nerdctl/SKILL.md index 79e14d7..d330e35 100644 --- a/.agents/skills/layer-nerdctl/SKILL.md +++ b/.agents/skills/layer-nerdctl/SKILL.md @@ -5,14 +5,14 @@ description: 'nerdctl (containerd CLI) + the rootless containerd/buildkit/CNI st on Fedora/Debian/Ubuntu, nerdctl.toml with namespace=default, the charly CNI conflist, the written rootless containerd/buildkit user units, the CONTAINERD.md §2/§4 checklist (uidmap helpers, subuid/subgid, delegation, /dev/fuse, user D-Bus, - slirp4netns), and the nested-pod posture. Use when working with the nerdctl engine, - the layer-nerdctl candy, or engine: nerdctl deploys.' + slirp4netns), and the nested-pod posture. Use when working with the containerd engine + (driven through the nerdctl CLI), the layer-nerdctl candy, or engine: containerd deploys.' --- # layer-nerdctl nerdctl (the containerd CLI) plus the rootless containerd + buildkit + CNI -stack, as ONE candy. Composed by a box that wants the opt-in `engine: nerdctl` +stack, as ONE candy. Composed by a box that wants the opt-in `engine: containerd` engine. ## What it installs @@ -85,9 +85,12 @@ specific deploy needs the publish side, set it deliberately in ## Engine capability -The `engine: nerdctl` word is served by `opencharly/plugin-nerdctl` +The `engine: containerd` word is served by `opencharly/plugin-nerdctl` (out-of-process) or compiled in; every engine op delegates to -`container.InvokeEngineOp("nerdctl", …)` in the spec module. nerdctl has no +`container.InvokeEngineOp("containerd", …)` in the spec module. `containerd` is +the engine WORD; `nerdctl` is the CLI BINARY that drives it — the spec-owned +`#EngineBinaries` map (`containerd → nerdctl`) is the one home for that mapping. +nerdctl has no `--keep-id`, so the start-plan runs the workload as `--user 0:0` (uid 0 == the host user under rootless), guaranteeing uid-identical sharing; a non-zero uid needs the subuid caveat. @@ -108,5 +111,6 @@ needs the subuid caveat. ## Use when -Working with the nerdctl engine, the layer-nerdctl candy, the rootless -containerd/buildkit checklist, or an `engine: nerdctl` deploy. +Working with the containerd engine (driven through the nerdctl CLI), the +layer-nerdctl candy, the rootless containerd/buildkit checklist, or an +`engine: containerd` deploy. diff --git a/AGENTS.md b/AGENTS.md index 1a2cc8a..11f214b 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -24,11 +24,12 @@ Canonical files: ## Load these skills first (R0) -- `/charly-distros:layer-nerdctl` — the owning skill. The nerdctl engine, the - `layer-nerdctl` candy, the nested-pod posture, and `engine: nerdctl` deploys. +- `/charly-distros:layer-nerdctl` — the owning skill. The containerd engine + (driven through the nerdctl CLI), the `layer-nerdctl` candy, the nested-pod + posture, and `engine: containerd` deploys. Load before editing or troubleshooting the layer. - `/charly-internals:plugin-nerdctl` — the out-of-tree engine plugin that serves - `engine: nerdctl`. + `engine: containerd`. - `/charly-image:layer` — the candy authoring reference (`charly.yml` schema, `plan:` step verbs incl. `mkdir:`/`write:`/`check:`, per-distro `distro:` arms, package/repo sections, and service declarations). Load before editing any @@ -54,10 +55,11 @@ Canonical files: ## Modify this repo -- Edit the `layer-nerdctl:` candy entity AND the `layer-nerdctl-skill:` skill - entity in `candy/layer-nerdctl/charly.yml` together. The skill is the projected - usage source, so a behaviour change not mirrored in the skill leaves the corpus - stale. +- Edit the `layer-nerdctl:` candy entity in `candy/layer-nerdctl/charly.yml` AND + the skill body in `.agents/skills/layer-nerdctl/SKILL.md` together. The + `layer-nerdctl-skill:` node carries ROUTING only; the file is the source of + record for the skill's prose, so a behaviour change not mirrored there leaves + the corpus stale. - The pinned `NERDCTL_FULL_VERSION` and its sha256 verification are the contract; the native-package distro arms (arch/alpine) short-circuit the tarball step — preserve that split. diff --git a/README.md b/README.md index 558a507..f015b53 100644 --- a/README.md +++ b/README.md @@ -3,7 +3,7 @@ nerdctl (the containerd CLI) plus the full rootless containerd + buildkit + CNI stack, as a standalone OpenCharly layer repo. -Composed by a box that wants the opt-in `engine: nerdctl` engine. On +Composed by a box that wants the opt-in `engine: containerd` engine. On Arch/CachyOS/Omarchy and Alpine the candy uses native distro packages; on Fedora, Debian, and Ubuntu it installs the pinned, **fatally** sha256-verified `nerdctl-full` tarball (which supplies nerdctl + containerd + @@ -24,8 +24,11 @@ containerd/buildkit user units. | Nested-pod posture | userns-scoped `cap_add: ALL`, `/dev/fuse`, `/dev/net/tun`, `unmask=/proc/*` | | Service / port | none | -The engine word is served by `opencharly/plugin-nerdctl` (out-of-process) or -compiled in; every engine op delegates to `container.InvokeEngineOp("nerdctl", …)`. +The `engine: containerd` word is served by `opencharly/plugin-nerdctl` +(out-of-process) or compiled in; every engine op delegates to +`container.InvokeEngineOp("containerd", …)`. `containerd` is the engine word; +`nerdctl` is the CLI binary that drives it (the spec-owned `#EngineBinaries` map +holds `containerd → nerdctl`). ## Rootless networking @@ -67,8 +70,9 @@ my-nested-box: ## Related -- Owning skill: `/charly-distros:layer-nerdctl` — the nerdctl engine, the - `layer-nerdctl` candy, the rootless checklist, and `engine: nerdctl` deploys. +- Owning skill: `/charly-distros:layer-nerdctl` — the containerd engine (driven + through the nerdctl CLI), the `layer-nerdctl` candy, the rootless checklist, + and `engine: containerd` deploys. - `/charly-internals:plugin-nerdctl` — the out-of-tree engine plugin. - `/charly-image:layer` — candy authoring reference. - [`opencharly/charly`](https://github.com/opencharly/charly) — the charly CLI and image builder