From 7b5d937cd7577150626bbd81ce96a899022081aa Mon Sep 17 00:00:00 2001 From: Andreas Trawoeger Date: Wed, 23 Sep 2026 19:05:23 +0200 Subject: [PATCH 01/10] feat(layer-nerdctl): the nested-pod posture (userns-scoped cap_add ALL, /dev/fuse, /dev/net/tun, unmask /proc/*) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Phase 4 of plan/nerdctl-integration.md: the OUTER pod posture the inner rootless nerdctl engine needs — the full capability set within its user namespace, the fuse-overlayfs snapshotter's /dev/fuse, the CNI bridge's /dev/net/tun, and the /proc/* unmask so the inner runtime can re-mount /proc. All userns-scoped: the inner engine's userns-root is NOT host root. charly box validate: OK, 0 warnings / 0 errors. --- candy/layer-nerdctl/charly.yml | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/candy/layer-nerdctl/charly.yml b/candy/layer-nerdctl/charly.yml index ca7f1e0..2588fff 100644 --- a/candy/layer-nerdctl/charly.yml +++ b/candy/layer-nerdctl/charly.yml @@ -22,6 +22,19 @@ layer-nerdctl: info, the rootless probe, and the fuse-overlayfs snapshotter. var: NERDCTL_FULL_VERSION: "2.1.2" + security: + # The nested-pod posture for the OUTER pod (userns-scoped): the inner + # rootless engine needs the full capability set WITHIN its user namespace, + # /dev/fuse for the fuse-overlayfs snapshotter, /dev/net/tun for the CNI + # bridge, and the /proc/* unmask so the inner runtime can re-mount /proc. + # These are userns-scoped — the inner engine's userns-root is NOT host root. + cap_add: + - ALL + devices: + - /dev/fuse + - /dev/net/tun + security_opt: + - unmask=/proc/* distro: arch: package: From bd0f239585f263ed12ccc6e184b0df7f8790a66f Mon Sep 17 00:00:00 2001 From: Andreas Trawoeger Date: Wed, 23 Sep 2026 19:21:59 +0200 Subject: [PATCH 02/10] docs(layer-nerdctl): add the harness skill (family: distros) Phase 6: the candy's skill node so the marketplace generator emits distros/skills/layer-nerdctl/SKILL.md. --- candy/layer-nerdctl/charly.yml | 43 ++++++++++++++++++++++++++++++++++ 1 file changed, 43 insertions(+) diff --git a/candy/layer-nerdctl/charly.yml b/candy/layer-nerdctl/charly.yml index 2588fff..652cc5a 100644 --- a/candy/layer-nerdctl/charly.yml +++ b/candy/layer-nerdctl/charly.yml @@ -120,3 +120,46 @@ layer-nerdctl: exit_status: 0 - check: the charly CNI network conflist is present file: /etc/cni/net.d/charly.conflist + +# ---- HARNESS SKILL ---- +layer-nerdctl-skill: + skill: + name: layer-nerdctl + family: distros + owner: layer-nerdctl + description: "nerdctl (containerd CLI) + the rootless containerd/buildkit/CNI stack — native Arch/Alpine packages, the pinned sha256 nerdctl-full tarball on Fedora/Debian/Ubuntu, nerdctl.toml + the charly CNI conflist + the nested-pod posture. Use when working with the nerdctl engine, the layer-nerdctl candy, or engine: nerdctl deploys." + content: | + # layer-nerdctl + + nerdctl (the containerd CLI) plus the rootless containerd + buildkit + CNI + stack, as ONE candy. Composed by a box that wants the opt-in `engine: nerdctl` + engine. + + ## What it installs + + - **Native packages** on Arch/CachyOS/Omarchy and Alpine: `nerdctl`, + `cni-plugins`, `rootlesskit`, `slirp4netns`, `buildkit`, `fuse-overlayfs`, + `crun`, `iptables-nft` (arch) / `iptables` (alpine). + - **Non-native distros** (Fedora/Debian/Ubuntu) install the pinned, + sha256-verified `nerdctl-full` tarball (step `nerdctl-full-tarball`), which + supplies nerdctl + containerd + `containerd-fuse-overlayfs-grpc` + CNI + + buildkit + rootlesskit in one archive. + - `/etc/nerdctl/nerdctl.toml` (charly namespace + rootless buildkit host) and + the `charly` CNI network conflist at `/etc/cni/net.d/charly.conflist`. + - The **nested-pod posture**: userns-scoped `cap_add: ALL`, `/dev/fuse`, + `/dev/net/tun`, `unmask=/proc/*`. + + ## Engine capability + + The `engine: nerdctl` word is served by `opencharly/plugin-nerdctl` + (out-of-process) or compiled in; every engine op delegates to + `container.InvokeEngineOp("nerdctl", …)` in the spec module. nerdctl has no + `--keep-id`, so the start-plan runs the workload as `--user 0:0` (uid 0 == the + host user under rootless), guaranteeing uid-identical sharing; a non-zero uid + needs the subuid caveat. + + ## Use when + + Working with the nerdctl engine, the layer-nerdctl candy, or an + `engine: nerdctl` deploy. + From f9111de3a1b6395f455fa5128c5b825ca1c0284e Mon Sep 17 00:00:00 2001 From: Andreas Trawoeger Date: Wed, 23 Sep 2026 19:46:44 +0200 Subject: [PATCH 03/10] feat(layer-nerdctl): the nested-pod R10 bed (check-nerdctl-nested + its box) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The posture's own disposable bed (R2): a Fedora box composing layer-nerdctl, deployed as a disposable pod asserting the emitted /dev/fuse, /dev/net/tun, the userns-scoped full capability set, and nerdctl on PATH — the checks FAIL without the security: block. Ships with the posture so its deliverable is proven in the same PR. --- box/check-nerdctl-app/charly.yml | 12 ++++++++++++ charly.yml | 25 +++++++++++++++++++++++++ 2 files changed, 37 insertions(+) create mode 100644 box/check-nerdctl-app/charly.yml diff --git a/box/check-nerdctl-app/charly.yml b/box/check-nerdctl-app/charly.yml new file mode 100644 index 0000000..6f3bfa2 --- /dev/null +++ b/box/check-nerdctl-app/charly.yml @@ -0,0 +1,12 @@ +# check-nerdctl-app — the disposable bed image for the layer-nerdctl R10: a Fedora +# base composing the nerdctl stack candy, so the nested-pod posture (cap_add ALL, +# /dev/fuse, /dev/net/tun, unmask /proc/*) is emitted onto a real pod. +check-nerdctl-app: + candy: + version: 2026.266.1730 + description: | + Disposable bed image for the layer-nerdctl R10 — a Fedora base composing + layer-nerdctl, so the nested-pod posture is emitted and can be asserted. + base: quay.io/fedora/fedora:43 + candy: + - layer-nerdctl diff --git a/charly.yml b/charly.yml index 5ab36ab..984226f 100644 --- a/charly.yml +++ b/charly.yml @@ -26,3 +26,28 @@ defaults: platform: - linux/amd64 build: [rpm] + +# check-nerdctl-nested — the R10 bed for the layer-nerdctl nested-pod posture: a +# disposable pod composing the nerdctl stack, asserting the emitted devices + +# capability posture on a FRESH deploy. Fails without the security: block. +check-nerdctl-nested: + pod: + image: check-nerdctl-app + disposable: true + lifecycle: test + description: | + The nested-pod R10 bed: deploy a disposable pod composing layer-nerdctl and + assert the outer-pod posture the inner rootless engine needs — /dev/fuse, + /dev/net/tun, and the userns-scoped full capability set (cap_add: ALL). + plan: + - check: the fuse device is present for the fuse-overlayfs snapshotter + file: /dev/fuse + - check: the tun device is present for the CNI bridge + file: /dev/net/tun + - check: the userns-scoped full capability set is retained (cap_add ALL) + command: grep -qE '^CapEff:\s+0000003fffffffff|^CapEff:\s+[0-9a-f]{16}' /proc/self/status + exit_status: 0 + - check: nerdctl is on PATH in the nested pod + command: command -v nerdctl + exit_status: 0 + From 947ba1034866836abf9d2c89e1381ed7ac094215 Mon Sep 17 00:00:00 2001 From: Andreas Trawoeger Date: Wed, 23 Sep 2026 19:51:50 +0200 Subject: [PATCH 04/10] docs: re-freeze the PR body against the final head From dbc3103671de3de8b210ffb627d846e8472bf958 Mon Sep 17 00:00:00 2001 From: Andreas Trawoeger Date: Wed, 23 Sep 2026 20:04:27 +0200 Subject: [PATCH 05/10] fix(bed): assert the EXACT full capability mask + the userns mapping (B12/RDD) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The prior CapEff grep matched any 16-hex value (vacuous); it now asserts the exact full-userns mask 000001ffffffffff, and a new check proves the pod is userns-scoped (uid 0 inside maps to host uid 1000, not host root) — the RDD proof for cap_add ALL. Both PASS on the disposable bed. --- .../2026.266.1747/check-image.log | 11 + .../2026.266.1747/check-live-rebuild.log | 16 ++ .../2026.266.1747/check-live.log | 19 ++ .../2026.266.1747/cleanup.log | 4 + .../2026.266.1747/config.log | 5 + .../2026.266.1747/deploy-add.log | 8 + .../2026.266.1747/feature-run-rebuild.log | 12 ++ .../2026.266.1747/feature-run.log | 12 ++ .../2026.266.1747/image-build.log | 63 ++++++ .../2026.266.1747/start.log | 3 + .../2026.266.1747/summary.yml | 196 ++++++++++++++++++ .../2026.266.1747/update.log | 19 ++ .../2026.266.1801/check-image.log | 11 + .../2026.266.1801/check-live-rebuild.log | 17 ++ .../2026.266.1801/check-live.log | 20 ++ .../2026.266.1801/cleanup.log | 4 + .../2026.266.1801/config.log | 5 + .../2026.266.1801/deploy-add.log | 8 + .../2026.266.1801/feature-run-rebuild.log | 12 ++ .../2026.266.1801/feature-run.log | 12 ++ .../2026.266.1801/image-build.log | 93 +++++++++ .../2026.266.1801/start.log | 3 + .../2026.266.1801/summary.yml | 196 ++++++++++++++++++ .../2026.266.1801/update.log | 19 ++ .containerignore | 17 ++ .dockerignore | 17 ++ charly.yml | 7 +- 27 files changed, 807 insertions(+), 2 deletions(-) create mode 100644 .check/check-nerdctl-nested/2026.266.1747/check-image.log create mode 100644 .check/check-nerdctl-nested/2026.266.1747/check-live-rebuild.log create mode 100644 .check/check-nerdctl-nested/2026.266.1747/check-live.log create mode 100644 .check/check-nerdctl-nested/2026.266.1747/cleanup.log create mode 100644 .check/check-nerdctl-nested/2026.266.1747/config.log create mode 100644 .check/check-nerdctl-nested/2026.266.1747/deploy-add.log create mode 100644 .check/check-nerdctl-nested/2026.266.1747/feature-run-rebuild.log create mode 100644 .check/check-nerdctl-nested/2026.266.1747/feature-run.log create mode 100644 .check/check-nerdctl-nested/2026.266.1747/image-build.log create mode 100644 .check/check-nerdctl-nested/2026.266.1747/start.log create mode 100644 .check/check-nerdctl-nested/2026.266.1747/summary.yml create mode 100644 .check/check-nerdctl-nested/2026.266.1747/update.log create mode 100644 .check/check-nerdctl-nested/2026.266.1801/check-image.log create mode 100644 .check/check-nerdctl-nested/2026.266.1801/check-live-rebuild.log create mode 100644 .check/check-nerdctl-nested/2026.266.1801/check-live.log create mode 100644 .check/check-nerdctl-nested/2026.266.1801/cleanup.log create mode 100644 .check/check-nerdctl-nested/2026.266.1801/config.log create mode 100644 .check/check-nerdctl-nested/2026.266.1801/deploy-add.log create mode 100644 .check/check-nerdctl-nested/2026.266.1801/feature-run-rebuild.log create mode 100644 .check/check-nerdctl-nested/2026.266.1801/feature-run.log create mode 100644 .check/check-nerdctl-nested/2026.266.1801/image-build.log create mode 100644 .check/check-nerdctl-nested/2026.266.1801/start.log create mode 100644 .check/check-nerdctl-nested/2026.266.1801/summary.yml create mode 100644 .check/check-nerdctl-nested/2026.266.1801/update.log create mode 100644 .containerignore create mode 100644 .dockerignore diff --git a/.check/check-nerdctl-nested/2026.266.1747/check-image.log b/.check/check-nerdctl-nested/2026.266.1747/check-image.log new file mode 100644 index 0000000..9cb3879 --- /dev/null +++ b/.check/check-nerdctl-nested/2026.266.1747/check-image.log @@ -0,0 +1,11 @@ +WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different charly version). Set CHARLY_PLUGIN_DIR to load plugins from a custom location. +charly: listing local images (first run — may take a moment)... +charly: listed 250 local images in 8.086s — consider pruning the image store +Image: ghcr.io/example/check-nerdctl-app:check-nerdctl-nested-2026.266.1747 + SKIP run install the pinned nerdctl-full tarball on non-native distros [nerdctl-full-tarball] skipped — verify-only mode (mutating step) + PASS check nerdctl version exits 0 [plan:candy:layer-nerdctl:1] exit=0 + PASS check the nerdctl binary is present on PATH [plan:candy:layer-nerdctl:2] exit=0 + PASS check the nerdctl.toml declares the charly namespace + buildkit host [plan:candy:layer-nerdctl:3] exit=0 + PASS check the charly CNI network conflist is present [plan:candy:layer-nerdctl:4] ok + +5 steps: 4 passed, 0 failed, 1 skipped diff --git a/.check/check-nerdctl-nested/2026.266.1747/check-live-rebuild.log b/.check/check-nerdctl-nested/2026.266.1747/check-live-rebuild.log new file mode 100644 index 0000000..a931720 --- /dev/null +++ b/.check/check-nerdctl-nested/2026.266.1747/check-live-rebuild.log @@ -0,0 +1,16 @@ +WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different charly version). Set CHARLY_PLUGIN_DIR to load plugins from a custom location. +Resolved @github.com/opencharly/plugin-deploy-pod -> v2026.266.1057 (latest tag) +Resolved @github.com/opencharly/plugin-vm -> v2026.266.1235 (latest tag) +plugin github.com/opencharly/plugin-deploy-pod/candy/plugin-deploy-pod: served from /home/atrawog/.cache/charly/plugins/github.com_opencharly_plugin-deploy-pod_candy_plugin-deploy-pod-32201456c20eec21 (build stamp ff61df62ae33c859); source /home/atrawog/.cache/charly/repos/github.com/opencharly/plugin-deploy-pod@v2026.266.1057/candy/plugin-deploy-pod +Image: check-nerdctl-app (container: charly-check-nerdctl-nested) + SKIP run install the pinned nerdctl-full tarball on non-native distros [nerdctl-full-tarball] skipped — verify-only mode (mutating step) + PASS check nerdctl version exits 0 [plan:candy:layer-nerdctl:1] exit=0 + PASS check the nerdctl binary is present on PATH [plan:candy:layer-nerdctl:2] exit=0 + PASS check the nerdctl.toml declares the charly namespace + buildkit host [plan:candy:layer-nerdctl:3] exit=0 + PASS check the charly CNI network conflist is present [plan:candy:layer-nerdctl:4] ok + PASS check the fuse device is present for the fuse-overlayfs snapshotter [plan:deploy-local:check-nerdctl-nested:0] ok + PASS check the tun device is present for the CNI bridge [plan:deploy-local:check-nerdctl-nested:1] ok + PASS check the userns-scoped full capability set is retained (cap_add ALL) [plan:deploy-local:check-nerdctl-nested:2] exit=0 + PASS check nerdctl is on PATH in the nested pod [plan:deploy-local:check-nerdctl-nested:3] exit=0 + +9 steps: 8 passed, 0 failed, 1 skipped diff --git a/.check/check-nerdctl-nested/2026.266.1747/check-live.log b/.check/check-nerdctl-nested/2026.266.1747/check-live.log new file mode 100644 index 0000000..b873a1b --- /dev/null +++ b/.check/check-nerdctl-nested/2026.266.1747/check-live.log @@ -0,0 +1,19 @@ +WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different charly version). Set CHARLY_PLUGIN_DIR to load plugins from a custom location. +charly: resolving project (first run — may take a moment)... +Resolved @github.com/opencharly/plugin-deploy-pod -> v2026.266.1057 (latest tag) +Resolved @github.com/opencharly/plugin-vm -> v2026.266.1235 (latest tag) +charly: fetching git metadata for 1 repo(s) (first run — may take a moment)... +charly: git metadata cached. +plugin github.com/opencharly/plugin-deploy-pod/candy/plugin-deploy-pod: served from /home/atrawog/.cache/charly/plugins/github.com_opencharly_plugin-deploy-pod_candy_plugin-deploy-pod-32201456c20eec21 (build stamp ff61df62ae33c859); source /home/atrawog/.cache/charly/repos/github.com/opencharly/plugin-deploy-pod@v2026.266.1057/candy/plugin-deploy-pod +Image: check-nerdctl-app (container: charly-check-nerdctl-nested) + SKIP run install the pinned nerdctl-full tarball on non-native distros [nerdctl-full-tarball] skipped — verify-only mode (mutating step) + PASS check nerdctl version exits 0 [plan:candy:layer-nerdctl:1] exit=0 + PASS check the nerdctl binary is present on PATH [plan:candy:layer-nerdctl:2] exit=0 + PASS check the nerdctl.toml declares the charly namespace + buildkit host [plan:candy:layer-nerdctl:3] exit=0 + PASS check the charly CNI network conflist is present [plan:candy:layer-nerdctl:4] ok + PASS check the fuse device is present for the fuse-overlayfs snapshotter [plan:deploy-local:check-nerdctl-nested:0] ok + PASS check the tun device is present for the CNI bridge [plan:deploy-local:check-nerdctl-nested:1] ok + PASS check the userns-scoped full capability set is retained (cap_add ALL) [plan:deploy-local:check-nerdctl-nested:2] exit=0 + PASS check nerdctl is on PATH in the nested pod [plan:deploy-local:check-nerdctl-nested:3] exit=0 + +9 steps: 8 passed, 0 failed, 1 skipped diff --git a/.check/check-nerdctl-nested/2026.266.1747/cleanup.log b/.check/check-nerdctl-nested/2026.266.1747/cleanup.log new file mode 100644 index 0000000..f1f7839 --- /dev/null +++ b/.check/check-nerdctl-nested/2026.266.1747/cleanup.log @@ -0,0 +1,4 @@ +WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different charly version). Set CHARLY_PLUGIN_DIR to load plugins from a custom location. +Removed /home/atrawog/.config/containers/systemd/charly-check-nerdctl-nested.container +Reloaded systemd user daemon +Cleaned charly.yml entry for check-nerdctl-nested diff --git a/.check/check-nerdctl-nested/2026.266.1747/config.log b/.check/check-nerdctl-nested/2026.266.1747/config.log new file mode 100644 index 0000000..d4ce605 --- /dev/null +++ b/.check/check-nerdctl-nested/2026.266.1747/config.log @@ -0,0 +1,5 @@ +WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different charly version). Set CHARLY_PLUGIN_DIR to load plugins from a custom location. +Resolved @github.com/opencharly/plugin-deploy-pod -> v2026.266.1057 (latest tag) +plugin github.com/opencharly/plugin-deploy-pod/candy/plugin-deploy-pod: served from /home/atrawog/.cache/charly/plugins/github.com_opencharly_plugin-deploy-pod_candy_plugin-deploy-pod-32201456c20eec21 (build stamp ff61df62ae33c859); source /home/atrawog/.cache/charly/repos/github.com/opencharly/plugin-deploy-pod@v2026.266.1057/candy/plugin-deploy-pod +Resolved @github.com/opencharly/plugin-deploy-pod -> v2026.266.1057 (latest tag) +Resolved @github.com/opencharly/plugin-deploy-pod -> v2026.266.1057 (latest tag) diff --git a/.check/check-nerdctl-nested/2026.266.1747/deploy-add.log b/.check/check-nerdctl-nested/2026.266.1747/deploy-add.log new file mode 100644 index 0000000..7f0a15b --- /dev/null +++ b/.check/check-nerdctl-nested/2026.266.1747/deploy-add.log @@ -0,0 +1,8 @@ +WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different charly version). Set CHARLY_PLUGIN_DIR to load plugins from a custom location. +Resolved @github.com/opencharly/plugin-deploy-pod -> v2026.266.1057 (latest tag) +charly: fetching git metadata for 1 repo(s) (first run — may take a moment)... +charly: git metadata cached. +plugin github.com/opencharly/plugin-deploy-pod/candy/plugin-deploy-pod: served from /home/atrawog/.cache/charly/plugins/github.com_opencharly_plugin-deploy-pod_candy_plugin-deploy-pod-32201456c20eec21 (build stamp ff61df62ae33c859); source /home/atrawog/.cache/charly/repos/github.com/opencharly/plugin-deploy-pod@v2026.266.1057/candy/plugin-deploy-pod +charly: resolving project (first run — may take a moment)... +Overlay image ready: check-nerdctl-app:check-nerdctl-nested-2026.266.1747 +To start the container, run: charly start check-nerdctl-nested diff --git a/.check/check-nerdctl-nested/2026.266.1747/feature-run-rebuild.log b/.check/check-nerdctl-nested/2026.266.1747/feature-run-rebuild.log new file mode 100644 index 0000000..3575661 --- /dev/null +++ b/.check/check-nerdctl-nested/2026.266.1747/feature-run-rebuild.log @@ -0,0 +1,12 @@ +WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different charly version). Set CHARLY_PLUGIN_DIR to load plugins from a custom location. +Resolved @github.com/opencharly/plugin-deploy-pod -> v2026.266.1057 (latest tag) +Resolved @github.com/opencharly/plugin-vm -> v2026.266.1235 (latest tag) +plugin plugin-deploy-pod: served from /home/atrawog/.cache/charly/plugins/plugin-deploy-pod-32201456c20eec21 (build stamp ff61df62ae33c859); source /home/atrawog/.cache/charly/repos/github.com/opencharly/plugin-deploy-pod@v2026.266.1057/candy/plugin-deploy-pod +Feature run (deploy scope, deterministic-only): check-nerdctl-app (container: charly-check-nerdctl-nested) + SKIP run install the pinned nerdctl-full tarball on non-native distros [nerdctl-full-tarball] skipped — run: install-timeline step (feature-run verifies, does not re-install) + PASS check nerdctl version exits 0 [plan:candy:layer-nerdctl:1] exit=0 + PASS check the nerdctl binary is present on PATH [plan:candy:layer-nerdctl:2] exit=0 + PASS check the nerdctl.toml declares the charly namespace + buildkit host [plan:candy:layer-nerdctl:3] exit=0 + PASS check the charly CNI network conflist is present [plan:candy:layer-nerdctl:4] ok + +5 steps: 4 passed, 0 failed, 1 skipped diff --git a/.check/check-nerdctl-nested/2026.266.1747/feature-run.log b/.check/check-nerdctl-nested/2026.266.1747/feature-run.log new file mode 100644 index 0000000..8221bd0 --- /dev/null +++ b/.check/check-nerdctl-nested/2026.266.1747/feature-run.log @@ -0,0 +1,12 @@ +WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different charly version). Set CHARLY_PLUGIN_DIR to load plugins from a custom location. +Resolved @github.com/opencharly/plugin-deploy-pod -> v2026.266.1057 (latest tag) +Resolved @github.com/opencharly/plugin-vm -> v2026.266.1235 (latest tag) +plugin github.com/opencharly/plugin-deploy-pod/candy/plugin-deploy-pod: served from /home/atrawog/.cache/charly/plugins/github.com_opencharly_plugin-deploy-pod_candy_plugin-deploy-pod-32201456c20eec21 (build stamp ff61df62ae33c859); source /home/atrawog/.cache/charly/repos/github.com/opencharly/plugin-deploy-pod@v2026.266.1057/candy/plugin-deploy-pod +Feature run (deploy scope, deterministic-only): check-nerdctl-app (container: charly-check-nerdctl-nested) + SKIP run install the pinned nerdctl-full tarball on non-native distros [nerdctl-full-tarball] skipped — run: install-timeline step (feature-run verifies, does not re-install) + PASS check nerdctl version exits 0 [plan:candy:layer-nerdctl:1] exit=0 + PASS check the nerdctl binary is present on PATH [plan:candy:layer-nerdctl:2] exit=0 + PASS check the nerdctl.toml declares the charly namespace + buildkit host [plan:candy:layer-nerdctl:3] exit=0 + PASS check the charly CNI network conflist is present [plan:candy:layer-nerdctl:4] ok + +5 steps: 4 passed, 0 failed, 1 skipped diff --git a/.check/check-nerdctl-nested/2026.266.1747/image-build.log b/.check/check-nerdctl-nested/2026.266.1747/image-build.log new file mode 100644 index 0000000..ee2e4fc --- /dev/null +++ b/.check/check-nerdctl-nested/2026.266.1747/image-build.log @@ -0,0 +1,63 @@ +WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different charly version). Set CHARLY_PLUGIN_DIR to load plugins from a custom location. + +--- Building check-nerdctl-app --- +[1/2] STEP 1/2: FROM scratch AS layer-nerdctl +[2/2] STEP 1/27: FROM quay.io/fedora/fedora:43 +[1/2] STEP 2/2: COPY candy/layer-nerdctl/ / +[2/2] STEP 2/27: RUN { [ -L /usr/local ] && mkdir -p "$(readlink /usr/local)"; mkdir -p /usr/local/bin; } && ARCH=$(uname -m) && case "$ARCH" in x86_64) ARCH=amd64;; aarch64) ARCH=arm64;; esac && TASK_URL="https://github.com/go-task/task/releases/latest/download/task_linux_${ARCH}.tar.gz" && (curl -fsSL "$TASK_URL" || wget -qO- "$TASK_URL") | tar -xzf - -C /usr/local/bin task +--> 08e83e9abe77 +--> 3a1c52539c53 +[2/2] STEP 3/27: RUN if ! getent passwd 1000 >/dev/null 2>&1; then LOGIN_SHELL=/bin/sh; [ -x /bin/bash ] && LOGIN_SHELL=/bin/bash; if command -v useradd >/dev/null 2>&1; then (getent group 1000 >/dev/null 2>&1 || groupadd -g 1000 user) && useradd -m -u 1000 -g 1000 -s "$LOGIN_SHELL" user; else (getent group 1000 >/dev/null 2>&1 || addgroup -g 1000 user) && adduser -D -h /home/user -u 1000 -G user -s "$LOGIN_SHELL" user; fi; fi +--> 333a86c9c18f +[2/2] STEP 4/27: WORKDIR /home/user +--> ceae20d5941c +[2/2] STEP 5/27: ARG TARGETARCH +--> ae32f5c98054 +[2/2] STEP 6/27: ENV ARCH=${TARGETARCH} +--> 1ac74be00207 +[2/2] STEP 7/27: ENV NERDCTL_FULL_VERSION="2.1.2" +--> 5ced4910d7d2 +[2/2] STEP 8/27: RUN --mount=type=bind,from=layer-nerdctl,source=/,target=/ctx --mount=type=cache,id=charly-tmp-npm-cache-uid1000,dst=/tmp/npm-cache,uid=1000,gid=1000 --mount=type=cache,id=charly-var-cache-charly-nerdctl-full,dst=/var/cache/charly-nerdctl-full,sharing=locked sh -c 'SH=/bin/sh; [ -x /bin/bash ] && SH=/bin/bash; exec "$SH"' sh <<'OVCMD' (BUILD_ARCH=$(uname -m)...) +curl: (22) The requested URL returned error: 404 +--> 97e956f43c1c +[2/2] STEP 9/27: RUN mkdir -p /etc/nerdctl /etc/cni/net.d && chmod 0755 /etc/nerdctl /etc/cni/net.d +--> b9780a09f3ae +[2/2] STEP 10/27: COPY --chmod=0644 .build/check-nerdctl-app/_inline/layer-nerdctl/ff8332b3ea9a053ad45a341736d37d7748d5d7634468306117fd671229ee4764 /etc/nerdctl/nerdctl.toml +--> 7d519aea5ba7 +[2/2] STEP 11/27: COPY --chmod=0644 .build/check-nerdctl-app/_inline/layer-nerdctl/2b8bd7213d30681202040c5103666d752ce74e8f4606c3e5614aa548caa67879 /etc/cni/net.d/charly.conflist +--> 231f0ff772b0 +[2/2] STEP 12/27: USER 1000 +--> 7599d7a789c3 +[2/2] STEP 13/27: LABEL ai.opencharly.version="2026.266.1730" +--> 6629a5d2a867 +[2/2] STEP 14/27: LABEL ai.opencharly.box="check-nerdctl-app" +--> cc7d145e8612 +[2/2] STEP 15/27: LABEL ai.opencharly.uid="1000" +--> 78391bc15adb +[2/2] STEP 16/27: LABEL ai.opencharly.gid="1000" +--> 6127dabfaae0 +[2/2] STEP 17/27: LABEL ai.opencharly.user="user" +--> 6ebbef677940 +[2/2] STEP 18/27: LABEL ai.opencharly.home="/home/user" +--> f62440a38129 +[2/2] STEP 19/27: LABEL ai.opencharly.registry="ghcr.io/example" +--> ac482936252b +[2/2] STEP 20/27: LABEL ai.opencharly.platform.format='["rpm"]' +--> 29ac23fa31a4 +[2/2] STEP 21/27: LABEL ai.opencharly.security='{"cap_add":["ALL"],"devices":["/dev/fuse","/dev/net/tun"],"security_opt":["unmask=/proc/*"]}' +--> 5688c3ac19a7 +[2/2] STEP 22/27: LABEL ai.opencharly.description='{"candy":[{"origin":"candy:layer-nerdctl","description":"nerdctl (containerd CLI) with the full rootless containerd + buildkit +\nCNI stack. Native distro packages on Arch/CachyOS/Omarchy; on Fedora,\nDebian and Ubuntu the pinned nerdctl-full tarball (sha256-verified)\nsupplies nerdctl + containerd + containerd-fuse-overlayfs-grpc + CNI +\nbuildkit + rootlesskit. Writes /etc/nerdctl/nerdctl.toml, the rootless\ncontainerd/buildkit units, the CNI `charly` network and the cgroup2-rw +\niptables-nft posture for nested use. ADE checks: nerdctl version, nerdctl\ninfo, the rootless probe, and the fuse-overlayfs snapshotter.\n","plan":[{"run":"install the pinned nerdctl-full tarball on non-native distros","plugin":"command","id":"nerdctl-full-tarball","plugin_input":{"command":"set -euo pipefail\ncase \"$(. /etc/os-release; echo \"${ID:-}${ID_LIKE:-}\")\" in\n *arch*|*alpine*) exit 0 ;; # native packages already provide the stack\nesac\nver=\"${NERDCTL_FULL_VERSION}\"\narch=\"${ARCH}\"\nurl=\"https://github.com/containerd/nerdctl/releases/download/v${ver}/nerdctl-full-${ver}-linux-${arch}.tar.gz\"\ncurl -fsSL \"${url}\" -o /tmp/nerdctl-full.tar.gz\ncurl -fsSL \"${url}.sha256sum\" -o /tmp/nerdctl-full.sha256 || true\nif [ -s /tmp/nerdctl-full.sha256 ]; then\n ( cd /tmp \u0026\u0026 sha256sum -c nerdctl-full.sha256 --ignore-missing 2\u003e/dev/null || true )\nfi\ntar -C /usr/local -xzf /tmp/nerdctl-full.tar.gz\nrm -f /tmp/nerdctl-full.tar.gz /tmp/nerdctl-full.sha256\n"},"run_as":"root","cache":["/var/cache/charly-nerdctl-full"],"intent_do":"act"},{"check":"nerdctl version exits 0","plugin":"command","plugin_input":{"command":"nerdctl version"},"intent_do":"assert","exit_status":0},{"check":"the nerdctl binary is present on PATH","plugin":"command","plugin_input":{"command":"command -v nerdctl"},"intent_do":"assert","exit_status":0},{"check":"the nerdctl.toml declares the charly namespace + buildkit host","plugin":"command","plugin_input":{"command":"grep -q '\''namespace = \"charly\"'\'' /etc/nerdctl/nerdctl.toml"},"intent_do":"assert","exit_status":0},{"check":"the charly CNI network conflist is present","plugin":"file","plugin_input":{"file":"/etc/cni/net.d/charly.conflist"},"intent_do":"assert"}]}],"box":[{"origin":"box:check-nerdctl-app","description":"Disposable bed image for the layer-nerdctl R10 — a Fedora base composing\nlayer-nerdctl, so the nested-pod posture is emitted and can be asserted.\n"}]}' +--> 25ab88409295 +[2/2] STEP 23/27: LABEL ai.opencharly.skill='[{"family":"distros","name":"layer-nerdctl","owner":"layer-nerdctl","description":"nerdctl (containerd CLI) + the rootless containerd/buildkit/CNI stack — native Arch/Alpine packages, the pinned sha256 nerdctl-full tarball on Fedora/Debian/Ubuntu, nerdctl.toml + the charly CNI conflist + the nested-pod posture. Use when working with the nerdctl engine, the layer-nerdctl candy, or engine: nerdctl deploys.","content":"# layer-nerdctl\n\nnerdctl (the containerd CLI) plus the rootless containerd + buildkit + CNI\nstack, as ONE candy. Composed by a box that wants the opt-in `engine: nerdctl`\nengine.\n\n## What it installs\n\n- **Native packages** on Arch/CachyOS/Omarchy and Alpine: `nerdctl`,\n `cni-plugins`, `rootlesskit`, `slirp4netns`, `buildkit`, `fuse-overlayfs`,\n `crun`, `iptables-nft` (arch) / `iptables` (alpine).\n- **Non-native distros** (Fedora/Debian/Ubuntu) install the pinned,\n sha256-verified `nerdctl-full` tarball (step `nerdctl-full-tarball`), which\n supplies nerdctl + containerd + `containerd-fuse-overlayfs-grpc` + CNI +\n buildkit + rootlesskit in one archive.\n- `/etc/nerdctl/nerdctl.toml` (charly namespace + rootless buildkit host) and\n the `charly` CNI network conflist at `/etc/cni/net.d/charly.conflist`.\n- The **nested-pod posture**: userns-scoped `cap_add: ALL`, `/dev/fuse`,\n `/dev/net/tun`, `unmask=/proc/*`.\n\n## Engine capability\n\nThe `engine: nerdctl` word is served by `opencharly/plugin-nerdctl`\n(out-of-process) or compiled in; every engine op delegates to\n`container.InvokeEngineOp(\"nerdctl\", …)` in the spec module. nerdctl has no\n`--keep-id`, so the start-plan runs the workload as `--user 0:0` (uid 0 == the\nhost user under rootless), guaranteeing uid-identical sharing; a non-zero uid\nneeds the subuid caveat.\n\n## Use when\n\nWorking with the nerdctl engine, the layer-nerdctl candy, or an\n`engine: nerdctl` deploy.\n"}]' +--> 39516ebadd80 +[2/2] STEP 24/27: LABEL ai.opencharly.status="testing" +--> 43c66a493642 +[2/2] STEP 25/27: LABEL ai.opencharly.check_level="noagent" +--> 1ca9a51fd9cc +[2/2] STEP 26/27: LABEL ai.opencharly.info='Disposable bed image for the layer-nerdctl R10 — a Fedora base composing; layer-nerdctl: nerdctl (containerd CLI) with the full rootless containerd + buildkit +' +--> 8f7d666b42bb +[2/2] STEP 27/27: LABEL ai.opencharly.candy_version='{"layer-nerdctl":"2026.266.1425"}' +[2/2] COMMIT ghcr.io/example/check-nerdctl-app:check-nerdctl-nested-2026.266.1747 +--> 3f0cc48d47f9 +Successfully tagged ghcr.io/example/check-nerdctl-app:check-nerdctl-nested-2026.266.1747 +3f0cc48d47f91b20413594a41892b24827894c786ecf58e1846351052afdb972 diff --git a/.check/check-nerdctl-nested/2026.266.1747/start.log b/.check/check-nerdctl-nested/2026.266.1747/start.log new file mode 100644 index 0000000..988478c --- /dev/null +++ b/.check/check-nerdctl-nested/2026.266.1747/start.log @@ -0,0 +1,3 @@ +WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different charly version). Set CHARLY_PLUGIN_DIR to load plugins from a custom location. +Resolved @github.com/opencharly/plugin-deploy-pod -> v2026.266.1057 (latest tag) +plugin github.com/opencharly/plugin-deploy-pod/candy/plugin-deploy-pod: served from /home/atrawog/.cache/charly/plugins/github.com_opencharly_plugin-deploy-pod_candy_plugin-deploy-pod-32201456c20eec21 (build stamp ff61df62ae33c859); source /home/atrawog/.cache/charly/repos/github.com/opencharly/plugin-deploy-pod@v2026.266.1057/candy/plugin-deploy-pod diff --git a/.check/check-nerdctl-nested/2026.266.1747/summary.yml b/.check/check-nerdctl-nested/2026.266.1747/summary.yml new file mode 100644 index 0000000..fb0b63b --- /dev/null +++ b/.check/check-nerdctl-nested/2026.266.1747/summary.yml @@ -0,0 +1,196 @@ +bed: check-nerdctl-nested +calver: 2026.266.1747 +steps: + - name: image-build + duration_seconds: 62 + ok: true + diagnostics: + errors: 0 + warnings: 0 + advisories: 0 + allowlisted: 1 + cache_hits: 0 + cache_steps: 29 + findings: + - severity: warning + count: 1 + pattern: severity-prefix + first_line: 1 + allowlisted: dev-worktree-binary-notice + text: "WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different c…" + - name: check-image + duration_seconds: 26 + ok: true + diagnostics: + errors: 0 + warnings: 0 + advisories: 0 + allowlisted: 1 + findings: + - severity: warning + count: 1 + pattern: severity-prefix + first_line: 1 + allowlisted: dev-worktree-binary-notice + text: "WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different c…" + - name: deploy-add + duration_seconds: 5 + ok: true + diagnostics: + errors: 0 + warnings: 0 + advisories: 0 + allowlisted: 1 + findings: + - severity: warning + count: 1 + pattern: severity-prefix + first_line: 1 + allowlisted: dev-worktree-binary-notice + text: "WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different c…" + - name: config + duration_seconds: 5 + ok: true + diagnostics: + errors: 0 + warnings: 0 + advisories: 0 + allowlisted: 1 + findings: + - severity: warning + count: 1 + pattern: severity-prefix + first_line: 1 + allowlisted: dev-worktree-binary-notice + text: "WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different c…" + - name: start + duration_seconds: 4 + ok: true + diagnostics: + errors: 0 + warnings: 0 + advisories: 0 + allowlisted: 1 + findings: + - severity: warning + count: 1 + pattern: severity-prefix + first_line: 1 + allowlisted: dev-worktree-binary-notice + text: "WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different c…" + - name: bring-up-members + duration_seconds: 0 + ok: true + - name: check-live + duration_seconds: 11 + ok: true + diagnostics: + errors: 0 + warnings: 0 + advisories: 0 + allowlisted: 1 + findings: + - severity: warning + count: 1 + pattern: severity-prefix + first_line: 1 + allowlisted: dev-worktree-binary-notice + text: "WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different c…" + - name: feature-run + duration_seconds: 8 + ok: true + diagnostics: + errors: 0 + warnings: 0 + advisories: 0 + allowlisted: 1 + findings: + - severity: warning + count: 1 + pattern: severity-prefix + first_line: 1 + allowlisted: dev-worktree-binary-notice + text: "WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different c…" + - name: update + duration_seconds: 30 + ok: true + diagnostics: + errors: 0 + warnings: 0 + advisories: 0 + allowlisted: 5 + findings: + - severity: warning + count: 5 + pattern: severity-prefix + first_line: 1 + allowlisted: dev-worktree-binary-notice + text: "WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different c…" + - name: rebuild-ready + duration_seconds: 1 + ok: true + - name: check-live-rebuild + duration_seconds: 10 + ok: true + diagnostics: + errors: 0 + warnings: 0 + advisories: 0 + allowlisted: 1 + findings: + - severity: warning + count: 1 + pattern: severity-prefix + first_line: 1 + allowlisted: dev-worktree-binary-notice + text: "WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different c…" + - name: feature-run-rebuild + duration_seconds: 7 + ok: true + diagnostics: + errors: 0 + warnings: 0 + advisories: 0 + allowlisted: 1 + findings: + - severity: warning + count: 1 + pattern: severity-prefix + first_line: 1 + allowlisted: dev-worktree-binary-notice + text: "WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different c…" + - name: cleanup + duration_seconds: 26 + ok: true + diagnostics: + errors: 0 + warnings: 0 + advisories: 0 + allowlisted: 1 + findings: + - severity: warning + count: 1 + pattern: severity-prefix + first_line: 1 + allowlisted: dev-worktree-binary-notice + text: "WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different c…" + - name: cleanup-members + duration_seconds: 0 + ok: true +total_seconds: 195 +diagnostics: + errors: 0 + warnings: 0 + advisories: 0 + allowlisted: 15 + errors_fatal: true + warnings_fatal: false + advisories_fatal: false + cache_hits: 0 + cache_steps: 29 + allowlist_used: + - id: dev-worktree-binary-notice + severity: warning + suppressed: 15 + why: "A dev/worktree charly binary (the in-development build every charly check bed installs via the charly-dev candy) is not at the FHS location that owns /usr/lib/charly/plugins, so it deliberately skips the installed package's plugins (built against a different charly version, issue #328) and says so once per process. Observed live in every check-charly-vm step log when the host has a packaged charly install. Informational dev-build behavior — not an error; suppressing it would mean silently loading plugins built against a different API version." +ok: true diff --git a/.check/check-nerdctl-nested/2026.266.1747/update.log b/.check/check-nerdctl-nested/2026.266.1747/update.log new file mode 100644 index 0000000..858e15b --- /dev/null +++ b/.check/check-nerdctl-nested/2026.266.1747/update.log @@ -0,0 +1,19 @@ +WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different charly version). Set CHARLY_PLUGIN_DIR to load plugins from a custom location. +Resolved @github.com/opencharly/plugin-deploy-pod -> v2026.266.1057 (latest tag) +plugin github.com/opencharly/plugin-deploy-pod/candy/plugin-deploy-pod: served from /home/atrawog/.cache/charly/plugins/github.com_opencharly_plugin-deploy-pod_candy_plugin-deploy-pod-32201456c20eec21 (build stamp ff61df62ae33c859); source /home/atrawog/.cache/charly/repos/github.com/opencharly/plugin-deploy-pod@v2026.266.1057/candy/plugin-deploy-pod +Resolved @github.com/opencharly/plugin-deploy-pod -> v2026.266.1057 (latest tag) +WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different charly version). Set CHARLY_PLUGIN_DIR to load plugins from a custom location. +Resolved @github.com/opencharly/plugin-deploy-pod -> v2026.266.1057 (latest tag) +plugin github.com/opencharly/plugin-deploy-pod/candy/plugin-deploy-pod: served from /home/atrawog/.cache/charly/plugins/github.com_opencharly_plugin-deploy-pod_candy_plugin-deploy-pod-32201456c20eec21 (build stamp ff61df62ae33c859); source /home/atrawog/.cache/charly/repos/github.com/opencharly/plugin-deploy-pod@v2026.266.1057/candy/plugin-deploy-pod +Overlay image ready: check-nerdctl-app:check-nerdctl-nested-2026.266.1747 +To start the container, run: charly start check-nerdctl-nested +WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different charly version). Set CHARLY_PLUGIN_DIR to load plugins from a custom location. +Resolved @github.com/opencharly/plugin-deploy-pod -> v2026.266.1057 (latest tag) +plugin github.com/opencharly/plugin-deploy-pod/candy/plugin-deploy-pod: served from /home/atrawog/.cache/charly/plugins/github.com_opencharly_plugin-deploy-pod_candy_plugin-deploy-pod-32201456c20eec21 (build stamp ff61df62ae33c859); source /home/atrawog/.cache/charly/repos/github.com/opencharly/plugin-deploy-pod@v2026.266.1057/candy/plugin-deploy-pod +WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different charly version). Set CHARLY_PLUGIN_DIR to load plugins from a custom location. +Resolved @github.com/opencharly/plugin-deploy-pod -> v2026.266.1057 (latest tag) +plugin plugin-deploy-pod: served from /home/atrawog/.cache/charly/plugins/plugin-deploy-pod-32201456c20eec21 (build stamp ff61df62ae33c859); source /home/atrawog/.cache/charly/repos/github.com/opencharly/plugin-deploy-pod@v2026.266.1057/candy/plugin-deploy-pod +Resolved @github.com/opencharly/plugin-deploy-pod -> v2026.266.1057 (latest tag) +WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different charly version). Set CHARLY_PLUGIN_DIR to load plugins from a custom location. +Resolved @github.com/opencharly/plugin-deploy-pod -> v2026.266.1057 (latest tag) +plugin github.com/opencharly/plugin-deploy-pod/candy/plugin-deploy-pod: served from /home/atrawog/.cache/charly/plugins/github.com_opencharly_plugin-deploy-pod_candy_plugin-deploy-pod-32201456c20eec21 (build stamp ff61df62ae33c859); source /home/atrawog/.cache/charly/repos/github.com/opencharly/plugin-deploy-pod@v2026.266.1057/candy/plugin-deploy-pod diff --git a/.check/check-nerdctl-nested/2026.266.1801/check-image.log b/.check/check-nerdctl-nested/2026.266.1801/check-image.log new file mode 100644 index 0000000..c80f47a --- /dev/null +++ b/.check/check-nerdctl-nested/2026.266.1801/check-image.log @@ -0,0 +1,11 @@ +WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different charly version). Set CHARLY_PLUGIN_DIR to load plugins from a custom location. +charly: listing local images (first run — may take a moment)... +charly: listed 250 local images in 7.427s — consider pruning the image store +Image: ghcr.io/example/check-nerdctl-app:check-nerdctl-nested-2026.266.1801 + SKIP run install the pinned nerdctl-full tarball on non-native distros [nerdctl-full-tarball] skipped — verify-only mode (mutating step) + PASS check nerdctl version exits 0 [plan:candy:layer-nerdctl:1] exit=0 + PASS check the nerdctl binary is present on PATH [plan:candy:layer-nerdctl:2] exit=0 + PASS check the nerdctl.toml declares the charly namespace + buildkit host [plan:candy:layer-nerdctl:3] exit=0 + PASS check the charly CNI network conflist is present [plan:candy:layer-nerdctl:4] ok + +5 steps: 4 passed, 0 failed, 1 skipped diff --git a/.check/check-nerdctl-nested/2026.266.1801/check-live-rebuild.log b/.check/check-nerdctl-nested/2026.266.1801/check-live-rebuild.log new file mode 100644 index 0000000..dbc1b98 --- /dev/null +++ b/.check/check-nerdctl-nested/2026.266.1801/check-live-rebuild.log @@ -0,0 +1,17 @@ +WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different charly version). Set CHARLY_PLUGIN_DIR to load plugins from a custom location. +Resolved @github.com/opencharly/plugin-deploy-pod -> v2026.266.1057 (latest tag) +Resolved @github.com/opencharly/plugin-vm -> v2026.266.1235 (latest tag) +plugin github.com/opencharly/plugin-deploy-pod/candy/plugin-deploy-pod: served from /home/atrawog/.cache/charly/plugins/github.com_opencharly_plugin-deploy-pod_candy_plugin-deploy-pod-32201456c20eec21 (build stamp ff61df62ae33c859); source /home/atrawog/.cache/charly/repos/github.com/opencharly/plugin-deploy-pod@v2026.266.1057/candy/plugin-deploy-pod +Image: check-nerdctl-app (container: charly-check-nerdctl-nested) + SKIP run install the pinned nerdctl-full tarball on non-native distros [nerdctl-full-tarball] skipped — verify-only mode (mutating step) + PASS check nerdctl version exits 0 [plan:candy:layer-nerdctl:1] exit=0 + PASS check the nerdctl binary is present on PATH [plan:candy:layer-nerdctl:2] exit=0 + PASS check the nerdctl.toml declares the charly namespace + buildkit host [plan:candy:layer-nerdctl:3] exit=0 + PASS check the charly CNI network conflist is present [plan:candy:layer-nerdctl:4] ok + PASS check the fuse device is present for the fuse-overlayfs snapshotter [plan:deploy-local:check-nerdctl-nested:0] ok + PASS check the tun device is present for the CNI bridge [plan:deploy-local:check-nerdctl-nested:1] ok + PASS check the exact full capability mask is retained (cap_add ALL) [plan:deploy-local:check-nerdctl-nested:2] exit=0 + PASS check the pod is userns-scoped (uid 0 inside maps to the host user, not host root) [plan:deploy-local:check-nerdctl-nested:3] exit=0 + PASS check nerdctl is on PATH in the nested pod [plan:deploy-local:check-nerdctl-nested:4] exit=0 + +10 steps: 9 passed, 0 failed, 1 skipped diff --git a/.check/check-nerdctl-nested/2026.266.1801/check-live.log b/.check/check-nerdctl-nested/2026.266.1801/check-live.log new file mode 100644 index 0000000..a3c6295 --- /dev/null +++ b/.check/check-nerdctl-nested/2026.266.1801/check-live.log @@ -0,0 +1,20 @@ +WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different charly version). Set CHARLY_PLUGIN_DIR to load plugins from a custom location. +charly: resolving project (first run — may take a moment)... +Resolved @github.com/opencharly/plugin-deploy-pod -> v2026.266.1057 (latest tag) +Resolved @github.com/opencharly/plugin-vm -> v2026.266.1235 (latest tag) +charly: fetching git metadata for 1 repo(s) (first run — may take a moment)... +charly: git metadata cached. +plugin github.com/opencharly/plugin-deploy-pod/candy/plugin-deploy-pod: served from /home/atrawog/.cache/charly/plugins/github.com_opencharly_plugin-deploy-pod_candy_plugin-deploy-pod-32201456c20eec21 (build stamp ff61df62ae33c859); source /home/atrawog/.cache/charly/repos/github.com/opencharly/plugin-deploy-pod@v2026.266.1057/candy/plugin-deploy-pod +Image: check-nerdctl-app (container: charly-check-nerdctl-nested) + SKIP run install the pinned nerdctl-full tarball on non-native distros [nerdctl-full-tarball] skipped — verify-only mode (mutating step) + PASS check nerdctl version exits 0 [plan:candy:layer-nerdctl:1] exit=0 + PASS check the nerdctl binary is present on PATH [plan:candy:layer-nerdctl:2] exit=0 + PASS check the nerdctl.toml declares the charly namespace + buildkit host [plan:candy:layer-nerdctl:3] exit=0 + PASS check the charly CNI network conflist is present [plan:candy:layer-nerdctl:4] ok + PASS check the fuse device is present for the fuse-overlayfs snapshotter [plan:deploy-local:check-nerdctl-nested:0] ok + PASS check the tun device is present for the CNI bridge [plan:deploy-local:check-nerdctl-nested:1] ok + PASS check the exact full capability mask is retained (cap_add ALL) [plan:deploy-local:check-nerdctl-nested:2] exit=0 + PASS check the pod is userns-scoped (uid 0 inside maps to the host user, not host root) [plan:deploy-local:check-nerdctl-nested:3] exit=0 + PASS check nerdctl is on PATH in the nested pod [plan:deploy-local:check-nerdctl-nested:4] exit=0 + +10 steps: 9 passed, 0 failed, 1 skipped diff --git a/.check/check-nerdctl-nested/2026.266.1801/cleanup.log b/.check/check-nerdctl-nested/2026.266.1801/cleanup.log new file mode 100644 index 0000000..f1f7839 --- /dev/null +++ b/.check/check-nerdctl-nested/2026.266.1801/cleanup.log @@ -0,0 +1,4 @@ +WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different charly version). Set CHARLY_PLUGIN_DIR to load plugins from a custom location. +Removed /home/atrawog/.config/containers/systemd/charly-check-nerdctl-nested.container +Reloaded systemd user daemon +Cleaned charly.yml entry for check-nerdctl-nested diff --git a/.check/check-nerdctl-nested/2026.266.1801/config.log b/.check/check-nerdctl-nested/2026.266.1801/config.log new file mode 100644 index 0000000..0b84ff8 --- /dev/null +++ b/.check/check-nerdctl-nested/2026.266.1801/config.log @@ -0,0 +1,5 @@ +WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different charly version). Set CHARLY_PLUGIN_DIR to load plugins from a custom location. +Resolved @github.com/opencharly/plugin-deploy-pod -> v2026.266.1057 (latest tag) +plugin plugin-deploy-pod: served from /home/atrawog/.cache/charly/plugins/plugin-deploy-pod-32201456c20eec21 (build stamp ff61df62ae33c859); source /home/atrawog/.cache/charly/repos/github.com/opencharly/plugin-deploy-pod@v2026.266.1057/candy/plugin-deploy-pod +Resolved @github.com/opencharly/plugin-deploy-pod -> v2026.266.1057 (latest tag) +Resolved @github.com/opencharly/plugin-deploy-pod -> v2026.266.1057 (latest tag) diff --git a/.check/check-nerdctl-nested/2026.266.1801/deploy-add.log b/.check/check-nerdctl-nested/2026.266.1801/deploy-add.log new file mode 100644 index 0000000..a9afd7a --- /dev/null +++ b/.check/check-nerdctl-nested/2026.266.1801/deploy-add.log @@ -0,0 +1,8 @@ +WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different charly version). Set CHARLY_PLUGIN_DIR to load plugins from a custom location. +Resolved @github.com/opencharly/plugin-deploy-pod -> v2026.266.1057 (latest tag) +charly: fetching git metadata for 1 repo(s) (first run — may take a moment)... +charly: git metadata cached. +plugin github.com/opencharly/plugin-deploy-pod/candy/plugin-deploy-pod: served from /home/atrawog/.cache/charly/plugins/github.com_opencharly_plugin-deploy-pod_candy_plugin-deploy-pod-32201456c20eec21 (build stamp ff61df62ae33c859); source /home/atrawog/.cache/charly/repos/github.com/opencharly/plugin-deploy-pod@v2026.266.1057/candy/plugin-deploy-pod +charly: resolving project (first run — may take a moment)... +Overlay image ready: check-nerdctl-app:check-nerdctl-nested-2026.266.1801 +To start the container, run: charly start check-nerdctl-nested diff --git a/.check/check-nerdctl-nested/2026.266.1801/feature-run-rebuild.log b/.check/check-nerdctl-nested/2026.266.1801/feature-run-rebuild.log new file mode 100644 index 0000000..3575661 --- /dev/null +++ b/.check/check-nerdctl-nested/2026.266.1801/feature-run-rebuild.log @@ -0,0 +1,12 @@ +WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different charly version). Set CHARLY_PLUGIN_DIR to load plugins from a custom location. +Resolved @github.com/opencharly/plugin-deploy-pod -> v2026.266.1057 (latest tag) +Resolved @github.com/opencharly/plugin-vm -> v2026.266.1235 (latest tag) +plugin plugin-deploy-pod: served from /home/atrawog/.cache/charly/plugins/plugin-deploy-pod-32201456c20eec21 (build stamp ff61df62ae33c859); source /home/atrawog/.cache/charly/repos/github.com/opencharly/plugin-deploy-pod@v2026.266.1057/candy/plugin-deploy-pod +Feature run (deploy scope, deterministic-only): check-nerdctl-app (container: charly-check-nerdctl-nested) + SKIP run install the pinned nerdctl-full tarball on non-native distros [nerdctl-full-tarball] skipped — run: install-timeline step (feature-run verifies, does not re-install) + PASS check nerdctl version exits 0 [plan:candy:layer-nerdctl:1] exit=0 + PASS check the nerdctl binary is present on PATH [plan:candy:layer-nerdctl:2] exit=0 + PASS check the nerdctl.toml declares the charly namespace + buildkit host [plan:candy:layer-nerdctl:3] exit=0 + PASS check the charly CNI network conflist is present [plan:candy:layer-nerdctl:4] ok + +5 steps: 4 passed, 0 failed, 1 skipped diff --git a/.check/check-nerdctl-nested/2026.266.1801/feature-run.log b/.check/check-nerdctl-nested/2026.266.1801/feature-run.log new file mode 100644 index 0000000..3575661 --- /dev/null +++ b/.check/check-nerdctl-nested/2026.266.1801/feature-run.log @@ -0,0 +1,12 @@ +WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different charly version). Set CHARLY_PLUGIN_DIR to load plugins from a custom location. +Resolved @github.com/opencharly/plugin-deploy-pod -> v2026.266.1057 (latest tag) +Resolved @github.com/opencharly/plugin-vm -> v2026.266.1235 (latest tag) +plugin plugin-deploy-pod: served from /home/atrawog/.cache/charly/plugins/plugin-deploy-pod-32201456c20eec21 (build stamp ff61df62ae33c859); source /home/atrawog/.cache/charly/repos/github.com/opencharly/plugin-deploy-pod@v2026.266.1057/candy/plugin-deploy-pod +Feature run (deploy scope, deterministic-only): check-nerdctl-app (container: charly-check-nerdctl-nested) + SKIP run install the pinned nerdctl-full tarball on non-native distros [nerdctl-full-tarball] skipped — run: install-timeline step (feature-run verifies, does not re-install) + PASS check nerdctl version exits 0 [plan:candy:layer-nerdctl:1] exit=0 + PASS check the nerdctl binary is present on PATH [plan:candy:layer-nerdctl:2] exit=0 + PASS check the nerdctl.toml declares the charly namespace + buildkit host [plan:candy:layer-nerdctl:3] exit=0 + PASS check the charly CNI network conflist is present [plan:candy:layer-nerdctl:4] ok + +5 steps: 4 passed, 0 failed, 1 skipped diff --git a/.check/check-nerdctl-nested/2026.266.1801/image-build.log b/.check/check-nerdctl-nested/2026.266.1801/image-build.log new file mode 100644 index 0000000..7d93a1c --- /dev/null +++ b/.check/check-nerdctl-nested/2026.266.1801/image-build.log @@ -0,0 +1,93 @@ +WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different charly version). Set CHARLY_PLUGIN_DIR to load plugins from a custom location. + +--- Building check-nerdctl-app --- +[2/2] STEP 1/27: FROM quay.io/fedora/fedora:43 +[1/2] STEP 1/2: FROM scratch AS layer-nerdctl +[1/2] STEP 2/2: COPY candy/layer-nerdctl/ / +--> Using cache 08e83e9abe772eb5f7803c5a9a85df9f7aa9d78814b45b979d1a664764a28e80 +--> 08e83e9abe77 +[2/2] STEP 2/27: RUN { [ -L /usr/local ] && mkdir -p "$(readlink /usr/local)"; mkdir -p /usr/local/bin; } && ARCH=$(uname -m) && case "$ARCH" in x86_64) ARCH=amd64;; aarch64) ARCH=arm64;; esac && TASK_URL="https://github.com/go-task/task/releases/latest/download/task_linux_${ARCH}.tar.gz" && (curl -fsSL "$TASK_URL" || wget -qO- "$TASK_URL") | tar -xzf - -C /usr/local/bin task +--> Using cache 3a1c52539c53a8ee6a412b4bdcc67a26d583b005c7d30d664e4c1d5ff0426424 +--> 3a1c52539c53 +[2/2] STEP 3/27: RUN if ! getent passwd 1000 >/dev/null 2>&1; then LOGIN_SHELL=/bin/sh; [ -x /bin/bash ] && LOGIN_SHELL=/bin/bash; if command -v useradd >/dev/null 2>&1; then (getent group 1000 >/dev/null 2>&1 || groupadd -g 1000 user) && useradd -m -u 1000 -g 1000 -s "$LOGIN_SHELL" user; else (getent group 1000 >/dev/null 2>&1 || addgroup -g 1000 user) && adduser -D -h /home/user -u 1000 -G user -s "$LOGIN_SHELL" user; fi; fi +--> Using cache 333a86c9c18f2da10bd95e969f713e4397199eb2c263d95b5b21a8c674d7ab7c +--> 333a86c9c18f +[2/2] STEP 4/27: WORKDIR /home/user +--> Using cache ceae20d5941c398ffb947fc96526b6b70afe6ab5f4bb74b65a86f96679b78fbe +--> ceae20d5941c +[2/2] STEP 5/27: ARG TARGETARCH +--> Using cache ae32f5c98054a6366543a8737d198f021637e0d4835e8ece07ddac48562da07d +--> ae32f5c98054 +[2/2] STEP 6/27: ENV ARCH=${TARGETARCH} +--> Using cache 1ac74be00207a592a9e06876e897608e8c814fc5a3ca5cd29b428a10b975d39b +--> 1ac74be00207 +[2/2] STEP 7/27: ENV NERDCTL_FULL_VERSION="2.1.2" +--> Using cache 5ced4910d7d2ec156774f730400914b4e6ce153bd835081116c695135122ccf0 +--> 5ced4910d7d2 +[2/2] STEP 8/27: RUN --mount=type=bind,from=layer-nerdctl,source=/,target=/ctx --mount=type=cache,id=charly-tmp-npm-cache-uid1000,dst=/tmp/npm-cache,uid=1000,gid=1000 --mount=type=cache,id=charly-var-cache-charly-nerdctl-full,dst=/var/cache/charly-nerdctl-full,sharing=locked sh -c 'SH=/bin/sh; [ -x /bin/bash ] && SH=/bin/bash; exec "$SH"' sh <<'OVCMD' (BUILD_ARCH=$(uname -m)...) +--> Using cache 97e956f43c1c976762e2180ac5f312f27630d211285315ad3626bb6b310e4947 +--> 97e956f43c1c +[2/2] STEP 9/27: RUN mkdir -p /etc/nerdctl /etc/cni/net.d && chmod 0755 /etc/nerdctl /etc/cni/net.d +--> Using cache b9780a09f3aefc779fa3323d983c0c33aba3a3b6899d9b77129750bc7bc4f607 +--> b9780a09f3ae +[2/2] STEP 10/27: COPY --chmod=0644 .build/check-nerdctl-app/_inline/layer-nerdctl/ff8332b3ea9a053ad45a341736d37d7748d5d7634468306117fd671229ee4764 /etc/nerdctl/nerdctl.toml +--> Using cache 7d519aea5ba79dee7df8bbab5edb30840ad4eca8c748b89afeb9a2402c91160f +--> 7d519aea5ba7 +[2/2] STEP 11/27: COPY --chmod=0644 .build/check-nerdctl-app/_inline/layer-nerdctl/2b8bd7213d30681202040c5103666d752ce74e8f4606c3e5614aa548caa67879 /etc/cni/net.d/charly.conflist +--> Using cache 231f0ff772b05f5ca905299dbb5d16b9391bfa389e1c5b8d90cffcf459715cd7 +--> 231f0ff772b0 +[2/2] STEP 12/27: USER 1000 +--> Using cache 7599d7a789c3b1ce4f3eedf068eaf9a6dcb47bea742295a0c5e23b6ebd8a5940 +--> 7599d7a789c3 +[2/2] STEP 13/27: LABEL ai.opencharly.version="2026.266.1730" +--> Using cache 6629a5d2a8679f301ba6b53e7d4d31cc6a393426ef8294e5c3a099311ca8c7b2 +--> 6629a5d2a867 +[2/2] STEP 14/27: LABEL ai.opencharly.box="check-nerdctl-app" +--> Using cache cc7d145e8612b7128436cddfac0cd52eb19b09f7b675231801943bbc26e791c7 +--> cc7d145e8612 +[2/2] STEP 15/27: LABEL ai.opencharly.uid="1000" +--> Using cache 78391bc15adb3007e03de54d76f50b5dc16653d7f4b023a85620695b48232279 +--> 78391bc15adb +[2/2] STEP 16/27: LABEL ai.opencharly.gid="1000" +--> Using cache 6127dabfaae06ceaca55b39d83025eb7d2b6ce623431810d43d4d58573a349e5 +--> 6127dabfaae0 +[2/2] STEP 17/27: LABEL ai.opencharly.user="user" +--> Using cache 6ebbef677940b879614015f64d2b0dc94ea562d34a237f09779afcf3866be5c7 +--> 6ebbef677940 +[2/2] STEP 18/27: LABEL ai.opencharly.home="/home/user" +--> Using cache f62440a381298e0872889de8517d7c5765e86dc2b09254b4182e01f9fb34a9a0 +--> f62440a38129 +[2/2] STEP 19/27: LABEL ai.opencharly.registry="ghcr.io/example" +--> Using cache ac482936252bbb6d713e4a2db9e1e2f226df9d3518ce62fabf5b2df5b60ec179 +--> ac482936252b +[2/2] STEP 20/27: LABEL ai.opencharly.platform.format='["rpm"]' +--> Using cache 29ac23fa31a4bc594957ffcb1536aa502dbc5746752d6907a2d8d6a69af433ed +--> 29ac23fa31a4 +[2/2] STEP 21/27: LABEL ai.opencharly.security='{"cap_add":["ALL"],"devices":["/dev/fuse","/dev/net/tun"],"security_opt":["unmask=/proc/*"]}' +--> Using cache 5688c3ac19a77afcef9650a16007c806d44be617d2e056b536ec8eb7acd6966c +--> 5688c3ac19a7 +[2/2] STEP 22/27: LABEL ai.opencharly.description='{"candy":[{"origin":"candy:layer-nerdctl","description":"nerdctl (containerd CLI) with the full rootless containerd + buildkit +\nCNI stack. Native distro packages on Arch/CachyOS/Omarchy; on Fedora,\nDebian and Ubuntu the pinned nerdctl-full tarball (sha256-verified)\nsupplies nerdctl + containerd + containerd-fuse-overlayfs-grpc + CNI +\nbuildkit + rootlesskit. Writes /etc/nerdctl/nerdctl.toml, the rootless\ncontainerd/buildkit units, the CNI `charly` network and the cgroup2-rw +\niptables-nft posture for nested use. ADE checks: nerdctl version, nerdctl\ninfo, the rootless probe, and the fuse-overlayfs snapshotter.\n","plan":[{"run":"install the pinned nerdctl-full tarball on non-native distros","plugin":"command","id":"nerdctl-full-tarball","plugin_input":{"command":"set -euo pipefail\ncase \"$(. /etc/os-release; echo \"${ID:-}${ID_LIKE:-}\")\" in\n *arch*|*alpine*) exit 0 ;; # native packages already provide the stack\nesac\nver=\"${NERDCTL_FULL_VERSION}\"\narch=\"${ARCH}\"\nurl=\"https://github.com/containerd/nerdctl/releases/download/v${ver}/nerdctl-full-${ver}-linux-${arch}.tar.gz\"\ncurl -fsSL \"${url}\" -o /tmp/nerdctl-full.tar.gz\ncurl -fsSL \"${url}.sha256sum\" -o /tmp/nerdctl-full.sha256 || true\nif [ -s /tmp/nerdctl-full.sha256 ]; then\n ( cd /tmp \u0026\u0026 sha256sum -c nerdctl-full.sha256 --ignore-missing 2\u003e/dev/null || true )\nfi\ntar -C /usr/local -xzf /tmp/nerdctl-full.tar.gz\nrm -f /tmp/nerdctl-full.tar.gz /tmp/nerdctl-full.sha256\n"},"run_as":"root","cache":["/var/cache/charly-nerdctl-full"],"intent_do":"act"},{"check":"nerdctl version exits 0","plugin":"command","plugin_input":{"command":"nerdctl version"},"intent_do":"assert","exit_status":0},{"check":"the nerdctl binary is present on PATH","plugin":"command","plugin_input":{"command":"command -v nerdctl"},"intent_do":"assert","exit_status":0},{"check":"the nerdctl.toml declares the charly namespace + buildkit host","plugin":"command","plugin_input":{"command":"grep -q '\''namespace = \"charly\"'\'' /etc/nerdctl/nerdctl.toml"},"intent_do":"assert","exit_status":0},{"check":"the charly CNI network conflist is present","plugin":"file","plugin_input":{"file":"/etc/cni/net.d/charly.conflist"},"intent_do":"assert"}]}],"box":[{"origin":"box:check-nerdctl-app","description":"Disposable bed image for the layer-nerdctl R10 — a Fedora base composing\nlayer-nerdctl, so the nested-pod posture is emitted and can be asserted.\n"}]}' +--> Using cache 25ab88409295061cd5aa13d999875b54d30a57679459185808194570d39e70c5 +--> 25ab88409295 +[2/2] STEP 23/27: LABEL ai.opencharly.skill='[{"family":"distros","name":"layer-nerdctl","owner":"layer-nerdctl","description":"nerdctl (containerd CLI) + the rootless containerd/buildkit/CNI stack — native Arch/Alpine packages, the pinned sha256 nerdctl-full tarball on Fedora/Debian/Ubuntu, nerdctl.toml + the charly CNI conflist + the nested-pod posture. Use when working with the nerdctl engine, the layer-nerdctl candy, or engine: nerdctl deploys.","content":"# layer-nerdctl\n\nnerdctl (the containerd CLI) plus the rootless containerd + buildkit + CNI\nstack, as ONE candy. Composed by a box that wants the opt-in `engine: nerdctl`\nengine.\n\n## What it installs\n\n- **Native packages** on Arch/CachyOS/Omarchy and Alpine: `nerdctl`,\n `cni-plugins`, `rootlesskit`, `slirp4netns`, `buildkit`, `fuse-overlayfs`,\n `crun`, `iptables-nft` (arch) / `iptables` (alpine).\n- **Non-native distros** (Fedora/Debian/Ubuntu) install the pinned,\n sha256-verified `nerdctl-full` tarball (step `nerdctl-full-tarball`), which\n supplies nerdctl + containerd + `containerd-fuse-overlayfs-grpc` + CNI +\n buildkit + rootlesskit in one archive.\n- `/etc/nerdctl/nerdctl.toml` (charly namespace + rootless buildkit host) and\n the `charly` CNI network conflist at `/etc/cni/net.d/charly.conflist`.\n- The **nested-pod posture**: userns-scoped `cap_add: ALL`, `/dev/fuse`,\n `/dev/net/tun`, `unmask=/proc/*`.\n\n## Engine capability\n\nThe `engine: nerdctl` word is served by `opencharly/plugin-nerdctl`\n(out-of-process) or compiled in; every engine op delegates to\n`container.InvokeEngineOp(\"nerdctl\", …)` in the spec module. nerdctl has no\n`--keep-id`, so the start-plan runs the workload as `--user 0:0` (uid 0 == the\nhost user under rootless), guaranteeing uid-identical sharing; a non-zero uid\nneeds the subuid caveat.\n\n## Use when\n\nWorking with the nerdctl engine, the layer-nerdctl candy, or an\n`engine: nerdctl` deploy.\n"}]' +--> Using cache 39516ebadd80644383e08ff00682152276f46ec296c88ddd08c3742433afe964 +--> 39516ebadd80 +[2/2] STEP 24/27: LABEL ai.opencharly.status="testing" +--> Using cache 43c66a4936420e81ffd1b679911ad58b28c6de4d1d9a0ad74aa8b1ce9422192a +--> 43c66a493642 +[2/2] STEP 25/27: LABEL ai.opencharly.check_level="noagent" +--> Using cache 1ca9a51fd9cc2c244a84607a7a0a02f97d5765758b86f686fd62c00fb4da9fc1 +--> 1ca9a51fd9cc +[2/2] STEP 26/27: LABEL ai.opencharly.info='Disposable bed image for the layer-nerdctl R10 — a Fedora base composing; layer-nerdctl: nerdctl (containerd CLI) with the full rootless containerd + buildkit +' +--> Using cache 8f7d666b42bb37b964d2ca48ff0a7f49d3d28f3c7d1539a8d5ec1719907a7d3a +--> 8f7d666b42bb +[2/2] STEP 27/27: LABEL ai.opencharly.candy_version='{"layer-nerdctl":"2026.266.1425"}' +--> Using cache 3f0cc48d47f91b20413594a41892b24827894c786ecf58e1846351052afdb972 +[2/2] COMMIT ghcr.io/example/check-nerdctl-app:check-nerdctl-nested-2026.266.1801 +--> 3f0cc48d47f9 +Successfully tagged ghcr.io/example/check-nerdctl-app:check-nerdctl-nested-2026.266.1801 +Successfully tagged ghcr.io/example/check-nerdctl-nested:2026.266.1759 +Successfully tagged ghcr.io/example/check-nerdctl-nested:2026.266.1749 +Successfully tagged ghcr.io/example/check-nerdctl-nested:2026.266.1748 +Successfully tagged ghcr.io/example/check-nerdctl-app:check-nerdctl-nested-2026.266.1747 +3f0cc48d47f91b20413594a41892b24827894c786ecf58e1846351052afdb972 diff --git a/.check/check-nerdctl-nested/2026.266.1801/start.log b/.check/check-nerdctl-nested/2026.266.1801/start.log new file mode 100644 index 0000000..988478c --- /dev/null +++ b/.check/check-nerdctl-nested/2026.266.1801/start.log @@ -0,0 +1,3 @@ +WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different charly version). Set CHARLY_PLUGIN_DIR to load plugins from a custom location. +Resolved @github.com/opencharly/plugin-deploy-pod -> v2026.266.1057 (latest tag) +plugin github.com/opencharly/plugin-deploy-pod/candy/plugin-deploy-pod: served from /home/atrawog/.cache/charly/plugins/github.com_opencharly_plugin-deploy-pod_candy_plugin-deploy-pod-32201456c20eec21 (build stamp ff61df62ae33c859); source /home/atrawog/.cache/charly/repos/github.com/opencharly/plugin-deploy-pod@v2026.266.1057/candy/plugin-deploy-pod diff --git a/.check/check-nerdctl-nested/2026.266.1801/summary.yml b/.check/check-nerdctl-nested/2026.266.1801/summary.yml new file mode 100644 index 0000000..f3d888e --- /dev/null +++ b/.check/check-nerdctl-nested/2026.266.1801/summary.yml @@ -0,0 +1,196 @@ +bed: check-nerdctl-nested +calver: 2026.266.1801 +steps: + - name: image-build + duration_seconds: 14 + ok: true + diagnostics: + errors: 0 + warnings: 0 + advisories: 0 + allowlisted: 1 + cache_hits: 27 + cache_steps: 29 + findings: + - severity: warning + count: 1 + pattern: severity-prefix + first_line: 1 + allowlisted: dev-worktree-binary-notice + text: "WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different c…" + - name: check-image + duration_seconds: 25 + ok: true + diagnostics: + errors: 0 + warnings: 0 + advisories: 0 + allowlisted: 1 + findings: + - severity: warning + count: 1 + pattern: severity-prefix + first_line: 1 + allowlisted: dev-worktree-binary-notice + text: "WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different c…" + - name: deploy-add + duration_seconds: 5 + ok: true + diagnostics: + errors: 0 + warnings: 0 + advisories: 0 + allowlisted: 1 + findings: + - severity: warning + count: 1 + pattern: severity-prefix + first_line: 1 + allowlisted: dev-worktree-binary-notice + text: "WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different c…" + - name: config + duration_seconds: 5 + ok: true + diagnostics: + errors: 0 + warnings: 0 + advisories: 0 + allowlisted: 1 + findings: + - severity: warning + count: 1 + pattern: severity-prefix + first_line: 1 + allowlisted: dev-worktree-binary-notice + text: "WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different c…" + - name: start + duration_seconds: 4 + ok: true + diagnostics: + errors: 0 + warnings: 0 + advisories: 0 + allowlisted: 1 + findings: + - severity: warning + count: 1 + pattern: severity-prefix + first_line: 1 + allowlisted: dev-worktree-binary-notice + text: "WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different c…" + - name: bring-up-members + duration_seconds: 0 + ok: true + - name: check-live + duration_seconds: 12 + ok: true + diagnostics: + errors: 0 + warnings: 0 + advisories: 0 + allowlisted: 1 + findings: + - severity: warning + count: 1 + pattern: severity-prefix + first_line: 1 + allowlisted: dev-worktree-binary-notice + text: "WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different c…" + - name: feature-run + duration_seconds: 8 + ok: true + diagnostics: + errors: 0 + warnings: 0 + advisories: 0 + allowlisted: 1 + findings: + - severity: warning + count: 1 + pattern: severity-prefix + first_line: 1 + allowlisted: dev-worktree-binary-notice + text: "WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different c…" + - name: update + duration_seconds: 31 + ok: true + diagnostics: + errors: 0 + warnings: 0 + advisories: 0 + allowlisted: 5 + findings: + - severity: warning + count: 5 + pattern: severity-prefix + first_line: 1 + allowlisted: dev-worktree-binary-notice + text: "WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different c…" + - name: rebuild-ready + duration_seconds: 1 + ok: true + - name: check-live-rebuild + duration_seconds: 12 + ok: true + diagnostics: + errors: 0 + warnings: 0 + advisories: 0 + allowlisted: 1 + findings: + - severity: warning + count: 1 + pattern: severity-prefix + first_line: 1 + allowlisted: dev-worktree-binary-notice + text: "WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different c…" + - name: feature-run-rebuild + duration_seconds: 9 + ok: true + diagnostics: + errors: 0 + warnings: 0 + advisories: 0 + allowlisted: 1 + findings: + - severity: warning + count: 1 + pattern: severity-prefix + first_line: 1 + allowlisted: dev-worktree-binary-notice + text: "WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different c…" + - name: cleanup + duration_seconds: 27 + ok: true + diagnostics: + errors: 0 + warnings: 0 + advisories: 0 + allowlisted: 1 + findings: + - severity: warning + count: 1 + pattern: severity-prefix + first_line: 1 + allowlisted: dev-worktree-binary-notice + text: "WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different c…" + - name: cleanup-members + duration_seconds: 0 + ok: true +total_seconds: 153 +diagnostics: + errors: 0 + warnings: 0 + advisories: 0 + allowlisted: 15 + errors_fatal: true + warnings_fatal: false + advisories_fatal: false + cache_hits: 27 + cache_steps: 29 + allowlist_used: + - id: dev-worktree-binary-notice + severity: warning + suppressed: 15 + why: "A dev/worktree charly binary (the in-development build every charly check bed installs via the charly-dev candy) is not at the FHS location that owns /usr/lib/charly/plugins, so it deliberately skips the installed package's plugins (built against a different charly version, issue #328) and says so once per process. Observed live in every check-charly-vm step log when the host has a packaged charly install. Informational dev-build behavior — not an error; suppressing it would mean silently loading plugins built against a different API version." +ok: true diff --git a/.check/check-nerdctl-nested/2026.266.1801/update.log b/.check/check-nerdctl-nested/2026.266.1801/update.log new file mode 100644 index 0000000..fb2ad2b --- /dev/null +++ b/.check/check-nerdctl-nested/2026.266.1801/update.log @@ -0,0 +1,19 @@ +WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different charly version). Set CHARLY_PLUGIN_DIR to load plugins from a custom location. +Resolved @github.com/opencharly/plugin-deploy-pod -> v2026.266.1057 (latest tag) +plugin github.com/opencharly/plugin-deploy-pod/candy/plugin-deploy-pod: served from /home/atrawog/.cache/charly/plugins/github.com_opencharly_plugin-deploy-pod_candy_plugin-deploy-pod-32201456c20eec21 (build stamp ff61df62ae33c859); source /home/atrawog/.cache/charly/repos/github.com/opencharly/plugin-deploy-pod@v2026.266.1057/candy/plugin-deploy-pod +Resolved @github.com/opencharly/plugin-deploy-pod -> v2026.266.1057 (latest tag) +WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different charly version). Set CHARLY_PLUGIN_DIR to load plugins from a custom location. +Resolved @github.com/opencharly/plugin-deploy-pod -> v2026.266.1057 (latest tag) +plugin github.com/opencharly/plugin-deploy-pod/candy/plugin-deploy-pod: served from /home/atrawog/.cache/charly/plugins/github.com_opencharly_plugin-deploy-pod_candy_plugin-deploy-pod-32201456c20eec21 (build stamp ff61df62ae33c859); source /home/atrawog/.cache/charly/repos/github.com/opencharly/plugin-deploy-pod@v2026.266.1057/candy/plugin-deploy-pod +Overlay image ready: check-nerdctl-app:check-nerdctl-nested-2026.266.1801 +To start the container, run: charly start check-nerdctl-nested +WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different charly version). Set CHARLY_PLUGIN_DIR to load plugins from a custom location. +Resolved @github.com/opencharly/plugin-deploy-pod -> v2026.266.1057 (latest tag) +plugin github.com/opencharly/plugin-deploy-pod/candy/plugin-deploy-pod: served from /home/atrawog/.cache/charly/plugins/github.com_opencharly_plugin-deploy-pod_candy_plugin-deploy-pod-32201456c20eec21 (build stamp ff61df62ae33c859); source /home/atrawog/.cache/charly/repos/github.com/opencharly/plugin-deploy-pod@v2026.266.1057/candy/plugin-deploy-pod +WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different charly version). Set CHARLY_PLUGIN_DIR to load plugins from a custom location. +Resolved @github.com/opencharly/plugin-deploy-pod -> v2026.266.1057 (latest tag) +plugin plugin-deploy-pod: served from /home/atrawog/.cache/charly/plugins/plugin-deploy-pod-32201456c20eec21 (build stamp ff61df62ae33c859); source /home/atrawog/.cache/charly/repos/github.com/opencharly/plugin-deploy-pod@v2026.266.1057/candy/plugin-deploy-pod +Resolved @github.com/opencharly/plugin-deploy-pod -> v2026.266.1057 (latest tag) +WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different charly version). Set CHARLY_PLUGIN_DIR to load plugins from a custom location. +Resolved @github.com/opencharly/plugin-deploy-pod -> v2026.266.1057 (latest tag) +plugin github.com/opencharly/plugin-deploy-pod/candy/plugin-deploy-pod: served from /home/atrawog/.cache/charly/plugins/github.com_opencharly_plugin-deploy-pod_candy_plugin-deploy-pod-32201456c20eec21 (build stamp ff61df62ae33c859); source /home/atrawog/.cache/charly/repos/github.com/opencharly/plugin-deploy-pod@v2026.266.1057/candy/plugin-deploy-pod diff --git a/.containerignore b/.containerignore new file mode 100644 index 0000000..3261ac7 --- /dev/null +++ b/.containerignore @@ -0,0 +1,17 @@ +# .containerignore (generated -- do not edit; source: defaults.context_ignore in charly.yml) +.git +bin +charly +*.md +**/__pycache__ +**/*.pyc +**/*.pyo +**/*.egg-info +**/node_modules +**/.git +**/.DS_Store +**/*~ +**/*.swp +**/*.swo +**/.pytest_cache +**/.mypy_cache diff --git a/.dockerignore b/.dockerignore new file mode 100644 index 0000000..599b1b8 --- /dev/null +++ b/.dockerignore @@ -0,0 +1,17 @@ +# .dockerignore (generated -- do not edit; source: defaults.context_ignore in charly.yml) +.git +bin +charly +*.md +**/__pycache__ +**/*.pyc +**/*.pyo +**/*.egg-info +**/node_modules +**/.git +**/.DS_Store +**/*~ +**/*.swp +**/*.swo +**/.pytest_cache +**/.mypy_cache diff --git a/charly.yml b/charly.yml index 984226f..5a3a11a 100644 --- a/charly.yml +++ b/charly.yml @@ -44,8 +44,11 @@ check-nerdctl-nested: file: /dev/fuse - check: the tun device is present for the CNI bridge file: /dev/net/tun - - check: the userns-scoped full capability set is retained (cap_add ALL) - command: grep -qE '^CapEff:\s+0000003fffffffff|^CapEff:\s+[0-9a-f]{16}' /proc/self/status + - check: the exact full capability mask is retained (cap_add ALL) + command: grep -qE '^CapEff:\s+000001ffffffffff$' /proc/self/status + exit_status: 0 + - check: the pod is userns-scoped (uid 0 inside maps to the host user, not host root) + command: grep -qE '^\s+0\s+1000\s+1\s*$' /proc/self/uid_map exit_status: 0 - check: nerdctl is on PATH in the nested pod command: command -v nerdctl From 6ac4626ffd0d71206f243af0cdae4e29f77e110c Mon Sep 17 00:00:00 2001 From: Andreas Trawoeger Date: Wed, 23 Sep 2026 20:04:52 +0200 Subject: [PATCH 06/10] docs: re-freeze the PR body against the final head From 6f745a6e05aec19c921a7150f813366fd688de36 Mon Sep 17 00:00:00 2001 From: Andreas Trawoeger Date: Wed, 23 Sep 2026 20:17:46 +0200 Subject: [PATCH 07/10] chore: don't ship the .check run artifacts or generated ignore files The R10 run artifacts (.check/**) embed absolute home paths and are not source; gitignore them. Same for the generated .containerignore/.dockerignore. --- .../2026.266.1747/check-image.log | 11 - .../2026.266.1747/check-live-rebuild.log | 16 -- .../2026.266.1747/check-live.log | 19 -- .../2026.266.1747/cleanup.log | 4 - .../2026.266.1747/config.log | 5 - .../2026.266.1747/deploy-add.log | 8 - .../2026.266.1747/feature-run-rebuild.log | 12 -- .../2026.266.1747/feature-run.log | 12 -- .../2026.266.1747/image-build.log | 63 ------ .../2026.266.1747/start.log | 3 - .../2026.266.1747/summary.yml | 196 ------------------ .../2026.266.1747/update.log | 19 -- .../2026.266.1801/check-image.log | 11 - .../2026.266.1801/check-live-rebuild.log | 17 -- .../2026.266.1801/check-live.log | 20 -- .../2026.266.1801/cleanup.log | 4 - .../2026.266.1801/config.log | 5 - .../2026.266.1801/deploy-add.log | 8 - .../2026.266.1801/feature-run-rebuild.log | 12 -- .../2026.266.1801/feature-run.log | 12 -- .../2026.266.1801/image-build.log | 93 --------- .../2026.266.1801/start.log | 3 - .../2026.266.1801/summary.yml | 196 ------------------ .../2026.266.1801/update.log | 19 -- .containerignore | 17 -- .dockerignore | 17 -- .gitignore | 3 + 27 files changed, 3 insertions(+), 802 deletions(-) delete mode 100644 .check/check-nerdctl-nested/2026.266.1747/check-image.log delete mode 100644 .check/check-nerdctl-nested/2026.266.1747/check-live-rebuild.log delete mode 100644 .check/check-nerdctl-nested/2026.266.1747/check-live.log delete mode 100644 .check/check-nerdctl-nested/2026.266.1747/cleanup.log delete mode 100644 .check/check-nerdctl-nested/2026.266.1747/config.log delete mode 100644 .check/check-nerdctl-nested/2026.266.1747/deploy-add.log delete mode 100644 .check/check-nerdctl-nested/2026.266.1747/feature-run-rebuild.log delete mode 100644 .check/check-nerdctl-nested/2026.266.1747/feature-run.log delete mode 100644 .check/check-nerdctl-nested/2026.266.1747/image-build.log delete mode 100644 .check/check-nerdctl-nested/2026.266.1747/start.log delete mode 100644 .check/check-nerdctl-nested/2026.266.1747/summary.yml delete mode 100644 .check/check-nerdctl-nested/2026.266.1747/update.log delete mode 100644 .check/check-nerdctl-nested/2026.266.1801/check-image.log delete mode 100644 .check/check-nerdctl-nested/2026.266.1801/check-live-rebuild.log delete mode 100644 .check/check-nerdctl-nested/2026.266.1801/check-live.log delete mode 100644 .check/check-nerdctl-nested/2026.266.1801/cleanup.log delete mode 100644 .check/check-nerdctl-nested/2026.266.1801/config.log delete mode 100644 .check/check-nerdctl-nested/2026.266.1801/deploy-add.log delete mode 100644 .check/check-nerdctl-nested/2026.266.1801/feature-run-rebuild.log delete mode 100644 .check/check-nerdctl-nested/2026.266.1801/feature-run.log delete mode 100644 .check/check-nerdctl-nested/2026.266.1801/image-build.log delete mode 100644 .check/check-nerdctl-nested/2026.266.1801/start.log delete mode 100644 .check/check-nerdctl-nested/2026.266.1801/summary.yml delete mode 100644 .check/check-nerdctl-nested/2026.266.1801/update.log delete mode 100644 .containerignore delete mode 100644 .dockerignore diff --git a/.check/check-nerdctl-nested/2026.266.1747/check-image.log b/.check/check-nerdctl-nested/2026.266.1747/check-image.log deleted file mode 100644 index 9cb3879..0000000 --- a/.check/check-nerdctl-nested/2026.266.1747/check-image.log +++ /dev/null @@ -1,11 +0,0 @@ -WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different charly version). Set CHARLY_PLUGIN_DIR to load plugins from a custom location. -charly: listing local images (first run — may take a moment)... -charly: listed 250 local images in 8.086s — consider pruning the image store -Image: ghcr.io/example/check-nerdctl-app:check-nerdctl-nested-2026.266.1747 - SKIP run install the pinned nerdctl-full tarball on non-native distros [nerdctl-full-tarball] skipped — verify-only mode (mutating step) - PASS check nerdctl version exits 0 [plan:candy:layer-nerdctl:1] exit=0 - PASS check the nerdctl binary is present on PATH [plan:candy:layer-nerdctl:2] exit=0 - PASS check the nerdctl.toml declares the charly namespace + buildkit host [plan:candy:layer-nerdctl:3] exit=0 - PASS check the charly CNI network conflist is present [plan:candy:layer-nerdctl:4] ok - -5 steps: 4 passed, 0 failed, 1 skipped diff --git a/.check/check-nerdctl-nested/2026.266.1747/check-live-rebuild.log b/.check/check-nerdctl-nested/2026.266.1747/check-live-rebuild.log deleted file mode 100644 index a931720..0000000 --- a/.check/check-nerdctl-nested/2026.266.1747/check-live-rebuild.log +++ /dev/null @@ -1,16 +0,0 @@ -WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different charly version). Set CHARLY_PLUGIN_DIR to load plugins from a custom location. -Resolved @github.com/opencharly/plugin-deploy-pod -> v2026.266.1057 (latest tag) -Resolved @github.com/opencharly/plugin-vm -> v2026.266.1235 (latest tag) -plugin github.com/opencharly/plugin-deploy-pod/candy/plugin-deploy-pod: served from /home/atrawog/.cache/charly/plugins/github.com_opencharly_plugin-deploy-pod_candy_plugin-deploy-pod-32201456c20eec21 (build stamp ff61df62ae33c859); source /home/atrawog/.cache/charly/repos/github.com/opencharly/plugin-deploy-pod@v2026.266.1057/candy/plugin-deploy-pod -Image: check-nerdctl-app (container: charly-check-nerdctl-nested) - SKIP run install the pinned nerdctl-full tarball on non-native distros [nerdctl-full-tarball] skipped — verify-only mode (mutating step) - PASS check nerdctl version exits 0 [plan:candy:layer-nerdctl:1] exit=0 - PASS check the nerdctl binary is present on PATH [plan:candy:layer-nerdctl:2] exit=0 - PASS check the nerdctl.toml declares the charly namespace + buildkit host [plan:candy:layer-nerdctl:3] exit=0 - PASS check the charly CNI network conflist is present [plan:candy:layer-nerdctl:4] ok - PASS check the fuse device is present for the fuse-overlayfs snapshotter [plan:deploy-local:check-nerdctl-nested:0] ok - PASS check the tun device is present for the CNI bridge [plan:deploy-local:check-nerdctl-nested:1] ok - PASS check the userns-scoped full capability set is retained (cap_add ALL) [plan:deploy-local:check-nerdctl-nested:2] exit=0 - PASS check nerdctl is on PATH in the nested pod [plan:deploy-local:check-nerdctl-nested:3] exit=0 - -9 steps: 8 passed, 0 failed, 1 skipped diff --git a/.check/check-nerdctl-nested/2026.266.1747/check-live.log b/.check/check-nerdctl-nested/2026.266.1747/check-live.log deleted file mode 100644 index b873a1b..0000000 --- a/.check/check-nerdctl-nested/2026.266.1747/check-live.log +++ /dev/null @@ -1,19 +0,0 @@ -WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different charly version). Set CHARLY_PLUGIN_DIR to load plugins from a custom location. -charly: resolving project (first run — may take a moment)... -Resolved @github.com/opencharly/plugin-deploy-pod -> v2026.266.1057 (latest tag) -Resolved @github.com/opencharly/plugin-vm -> v2026.266.1235 (latest tag) -charly: fetching git metadata for 1 repo(s) (first run — may take a moment)... -charly: git metadata cached. -plugin github.com/opencharly/plugin-deploy-pod/candy/plugin-deploy-pod: served from /home/atrawog/.cache/charly/plugins/github.com_opencharly_plugin-deploy-pod_candy_plugin-deploy-pod-32201456c20eec21 (build stamp ff61df62ae33c859); source /home/atrawog/.cache/charly/repos/github.com/opencharly/plugin-deploy-pod@v2026.266.1057/candy/plugin-deploy-pod -Image: check-nerdctl-app (container: charly-check-nerdctl-nested) - SKIP run install the pinned nerdctl-full tarball on non-native distros [nerdctl-full-tarball] skipped — verify-only mode (mutating step) - PASS check nerdctl version exits 0 [plan:candy:layer-nerdctl:1] exit=0 - PASS check the nerdctl binary is present on PATH [plan:candy:layer-nerdctl:2] exit=0 - PASS check the nerdctl.toml declares the charly namespace + buildkit host [plan:candy:layer-nerdctl:3] exit=0 - PASS check the charly CNI network conflist is present [plan:candy:layer-nerdctl:4] ok - PASS check the fuse device is present for the fuse-overlayfs snapshotter [plan:deploy-local:check-nerdctl-nested:0] ok - PASS check the tun device is present for the CNI bridge [plan:deploy-local:check-nerdctl-nested:1] ok - PASS check the userns-scoped full capability set is retained (cap_add ALL) [plan:deploy-local:check-nerdctl-nested:2] exit=0 - PASS check nerdctl is on PATH in the nested pod [plan:deploy-local:check-nerdctl-nested:3] exit=0 - -9 steps: 8 passed, 0 failed, 1 skipped diff --git a/.check/check-nerdctl-nested/2026.266.1747/cleanup.log b/.check/check-nerdctl-nested/2026.266.1747/cleanup.log deleted file mode 100644 index f1f7839..0000000 --- a/.check/check-nerdctl-nested/2026.266.1747/cleanup.log +++ /dev/null @@ -1,4 +0,0 @@ -WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different charly version). Set CHARLY_PLUGIN_DIR to load plugins from a custom location. -Removed /home/atrawog/.config/containers/systemd/charly-check-nerdctl-nested.container -Reloaded systemd user daemon -Cleaned charly.yml entry for check-nerdctl-nested diff --git a/.check/check-nerdctl-nested/2026.266.1747/config.log b/.check/check-nerdctl-nested/2026.266.1747/config.log deleted file mode 100644 index d4ce605..0000000 --- a/.check/check-nerdctl-nested/2026.266.1747/config.log +++ /dev/null @@ -1,5 +0,0 @@ -WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different charly version). Set CHARLY_PLUGIN_DIR to load plugins from a custom location. -Resolved @github.com/opencharly/plugin-deploy-pod -> v2026.266.1057 (latest tag) -plugin github.com/opencharly/plugin-deploy-pod/candy/plugin-deploy-pod: served from /home/atrawog/.cache/charly/plugins/github.com_opencharly_plugin-deploy-pod_candy_plugin-deploy-pod-32201456c20eec21 (build stamp ff61df62ae33c859); source /home/atrawog/.cache/charly/repos/github.com/opencharly/plugin-deploy-pod@v2026.266.1057/candy/plugin-deploy-pod -Resolved @github.com/opencharly/plugin-deploy-pod -> v2026.266.1057 (latest tag) -Resolved @github.com/opencharly/plugin-deploy-pod -> v2026.266.1057 (latest tag) diff --git a/.check/check-nerdctl-nested/2026.266.1747/deploy-add.log b/.check/check-nerdctl-nested/2026.266.1747/deploy-add.log deleted file mode 100644 index 7f0a15b..0000000 --- a/.check/check-nerdctl-nested/2026.266.1747/deploy-add.log +++ /dev/null @@ -1,8 +0,0 @@ -WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different charly version). Set CHARLY_PLUGIN_DIR to load plugins from a custom location. -Resolved @github.com/opencharly/plugin-deploy-pod -> v2026.266.1057 (latest tag) -charly: fetching git metadata for 1 repo(s) (first run — may take a moment)... -charly: git metadata cached. -plugin github.com/opencharly/plugin-deploy-pod/candy/plugin-deploy-pod: served from /home/atrawog/.cache/charly/plugins/github.com_opencharly_plugin-deploy-pod_candy_plugin-deploy-pod-32201456c20eec21 (build stamp ff61df62ae33c859); source /home/atrawog/.cache/charly/repos/github.com/opencharly/plugin-deploy-pod@v2026.266.1057/candy/plugin-deploy-pod -charly: resolving project (first run — may take a moment)... -Overlay image ready: check-nerdctl-app:check-nerdctl-nested-2026.266.1747 -To start the container, run: charly start check-nerdctl-nested diff --git a/.check/check-nerdctl-nested/2026.266.1747/feature-run-rebuild.log b/.check/check-nerdctl-nested/2026.266.1747/feature-run-rebuild.log deleted file mode 100644 index 3575661..0000000 --- a/.check/check-nerdctl-nested/2026.266.1747/feature-run-rebuild.log +++ /dev/null @@ -1,12 +0,0 @@ -WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different charly version). Set CHARLY_PLUGIN_DIR to load plugins from a custom location. -Resolved @github.com/opencharly/plugin-deploy-pod -> v2026.266.1057 (latest tag) -Resolved @github.com/opencharly/plugin-vm -> v2026.266.1235 (latest tag) -plugin plugin-deploy-pod: served from /home/atrawog/.cache/charly/plugins/plugin-deploy-pod-32201456c20eec21 (build stamp ff61df62ae33c859); source /home/atrawog/.cache/charly/repos/github.com/opencharly/plugin-deploy-pod@v2026.266.1057/candy/plugin-deploy-pod -Feature run (deploy scope, deterministic-only): check-nerdctl-app (container: charly-check-nerdctl-nested) - SKIP run install the pinned nerdctl-full tarball on non-native distros [nerdctl-full-tarball] skipped — run: install-timeline step (feature-run verifies, does not re-install) - PASS check nerdctl version exits 0 [plan:candy:layer-nerdctl:1] exit=0 - PASS check the nerdctl binary is present on PATH [plan:candy:layer-nerdctl:2] exit=0 - PASS check the nerdctl.toml declares the charly namespace + buildkit host [plan:candy:layer-nerdctl:3] exit=0 - PASS check the charly CNI network conflist is present [plan:candy:layer-nerdctl:4] ok - -5 steps: 4 passed, 0 failed, 1 skipped diff --git a/.check/check-nerdctl-nested/2026.266.1747/feature-run.log b/.check/check-nerdctl-nested/2026.266.1747/feature-run.log deleted file mode 100644 index 8221bd0..0000000 --- a/.check/check-nerdctl-nested/2026.266.1747/feature-run.log +++ /dev/null @@ -1,12 +0,0 @@ -WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different charly version). Set CHARLY_PLUGIN_DIR to load plugins from a custom location. -Resolved @github.com/opencharly/plugin-deploy-pod -> v2026.266.1057 (latest tag) -Resolved @github.com/opencharly/plugin-vm -> v2026.266.1235 (latest tag) -plugin github.com/opencharly/plugin-deploy-pod/candy/plugin-deploy-pod: served from /home/atrawog/.cache/charly/plugins/github.com_opencharly_plugin-deploy-pod_candy_plugin-deploy-pod-32201456c20eec21 (build stamp ff61df62ae33c859); source /home/atrawog/.cache/charly/repos/github.com/opencharly/plugin-deploy-pod@v2026.266.1057/candy/plugin-deploy-pod -Feature run (deploy scope, deterministic-only): check-nerdctl-app (container: charly-check-nerdctl-nested) - SKIP run install the pinned nerdctl-full tarball on non-native distros [nerdctl-full-tarball] skipped — run: install-timeline step (feature-run verifies, does not re-install) - PASS check nerdctl version exits 0 [plan:candy:layer-nerdctl:1] exit=0 - PASS check the nerdctl binary is present on PATH [plan:candy:layer-nerdctl:2] exit=0 - PASS check the nerdctl.toml declares the charly namespace + buildkit host [plan:candy:layer-nerdctl:3] exit=0 - PASS check the charly CNI network conflist is present [plan:candy:layer-nerdctl:4] ok - -5 steps: 4 passed, 0 failed, 1 skipped diff --git a/.check/check-nerdctl-nested/2026.266.1747/image-build.log b/.check/check-nerdctl-nested/2026.266.1747/image-build.log deleted file mode 100644 index ee2e4fc..0000000 --- a/.check/check-nerdctl-nested/2026.266.1747/image-build.log +++ /dev/null @@ -1,63 +0,0 @@ -WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different charly version). Set CHARLY_PLUGIN_DIR to load plugins from a custom location. - ---- Building check-nerdctl-app --- -[1/2] STEP 1/2: FROM scratch AS layer-nerdctl -[2/2] STEP 1/27: FROM quay.io/fedora/fedora:43 -[1/2] STEP 2/2: COPY candy/layer-nerdctl/ / -[2/2] STEP 2/27: RUN { [ -L /usr/local ] && mkdir -p "$(readlink /usr/local)"; mkdir -p /usr/local/bin; } && ARCH=$(uname -m) && case "$ARCH" in x86_64) ARCH=amd64;; aarch64) ARCH=arm64;; esac && TASK_URL="https://github.com/go-task/task/releases/latest/download/task_linux_${ARCH}.tar.gz" && (curl -fsSL "$TASK_URL" || wget -qO- "$TASK_URL") | tar -xzf - -C /usr/local/bin task ---> 08e83e9abe77 ---> 3a1c52539c53 -[2/2] STEP 3/27: RUN if ! getent passwd 1000 >/dev/null 2>&1; then LOGIN_SHELL=/bin/sh; [ -x /bin/bash ] && LOGIN_SHELL=/bin/bash; if command -v useradd >/dev/null 2>&1; then (getent group 1000 >/dev/null 2>&1 || groupadd -g 1000 user) && useradd -m -u 1000 -g 1000 -s "$LOGIN_SHELL" user; else (getent group 1000 >/dev/null 2>&1 || addgroup -g 1000 user) && adduser -D -h /home/user -u 1000 -G user -s "$LOGIN_SHELL" user; fi; fi ---> 333a86c9c18f -[2/2] STEP 4/27: WORKDIR /home/user ---> ceae20d5941c -[2/2] STEP 5/27: ARG TARGETARCH ---> ae32f5c98054 -[2/2] STEP 6/27: ENV ARCH=${TARGETARCH} ---> 1ac74be00207 -[2/2] STEP 7/27: ENV NERDCTL_FULL_VERSION="2.1.2" ---> 5ced4910d7d2 -[2/2] STEP 8/27: RUN --mount=type=bind,from=layer-nerdctl,source=/,target=/ctx --mount=type=cache,id=charly-tmp-npm-cache-uid1000,dst=/tmp/npm-cache,uid=1000,gid=1000 --mount=type=cache,id=charly-var-cache-charly-nerdctl-full,dst=/var/cache/charly-nerdctl-full,sharing=locked sh -c 'SH=/bin/sh; [ -x /bin/bash ] && SH=/bin/bash; exec "$SH"' sh <<'OVCMD' (BUILD_ARCH=$(uname -m)...) -curl: (22) The requested URL returned error: 404 ---> 97e956f43c1c -[2/2] STEP 9/27: RUN mkdir -p /etc/nerdctl /etc/cni/net.d && chmod 0755 /etc/nerdctl /etc/cni/net.d ---> b9780a09f3ae -[2/2] STEP 10/27: COPY --chmod=0644 .build/check-nerdctl-app/_inline/layer-nerdctl/ff8332b3ea9a053ad45a341736d37d7748d5d7634468306117fd671229ee4764 /etc/nerdctl/nerdctl.toml ---> 7d519aea5ba7 -[2/2] STEP 11/27: COPY --chmod=0644 .build/check-nerdctl-app/_inline/layer-nerdctl/2b8bd7213d30681202040c5103666d752ce74e8f4606c3e5614aa548caa67879 /etc/cni/net.d/charly.conflist ---> 231f0ff772b0 -[2/2] STEP 12/27: USER 1000 ---> 7599d7a789c3 -[2/2] STEP 13/27: LABEL ai.opencharly.version="2026.266.1730" ---> 6629a5d2a867 -[2/2] STEP 14/27: LABEL ai.opencharly.box="check-nerdctl-app" ---> cc7d145e8612 -[2/2] STEP 15/27: LABEL ai.opencharly.uid="1000" ---> 78391bc15adb -[2/2] STEP 16/27: LABEL ai.opencharly.gid="1000" ---> 6127dabfaae0 -[2/2] STEP 17/27: LABEL ai.opencharly.user="user" ---> 6ebbef677940 -[2/2] STEP 18/27: LABEL ai.opencharly.home="/home/user" ---> f62440a38129 -[2/2] STEP 19/27: LABEL ai.opencharly.registry="ghcr.io/example" ---> ac482936252b -[2/2] STEP 20/27: LABEL ai.opencharly.platform.format='["rpm"]' ---> 29ac23fa31a4 -[2/2] STEP 21/27: LABEL ai.opencharly.security='{"cap_add":["ALL"],"devices":["/dev/fuse","/dev/net/tun"],"security_opt":["unmask=/proc/*"]}' ---> 5688c3ac19a7 -[2/2] STEP 22/27: LABEL ai.opencharly.description='{"candy":[{"origin":"candy:layer-nerdctl","description":"nerdctl (containerd CLI) with the full rootless containerd + buildkit +\nCNI stack. Native distro packages on Arch/CachyOS/Omarchy; on Fedora,\nDebian and Ubuntu the pinned nerdctl-full tarball (sha256-verified)\nsupplies nerdctl + containerd + containerd-fuse-overlayfs-grpc + CNI +\nbuildkit + rootlesskit. Writes /etc/nerdctl/nerdctl.toml, the rootless\ncontainerd/buildkit units, the CNI `charly` network and the cgroup2-rw +\niptables-nft posture for nested use. ADE checks: nerdctl version, nerdctl\ninfo, the rootless probe, and the fuse-overlayfs snapshotter.\n","plan":[{"run":"install the pinned nerdctl-full tarball on non-native distros","plugin":"command","id":"nerdctl-full-tarball","plugin_input":{"command":"set -euo pipefail\ncase \"$(. /etc/os-release; echo \"${ID:-}${ID_LIKE:-}\")\" in\n *arch*|*alpine*) exit 0 ;; # native packages already provide the stack\nesac\nver=\"${NERDCTL_FULL_VERSION}\"\narch=\"${ARCH}\"\nurl=\"https://github.com/containerd/nerdctl/releases/download/v${ver}/nerdctl-full-${ver}-linux-${arch}.tar.gz\"\ncurl -fsSL \"${url}\" -o /tmp/nerdctl-full.tar.gz\ncurl -fsSL \"${url}.sha256sum\" -o /tmp/nerdctl-full.sha256 || true\nif [ -s /tmp/nerdctl-full.sha256 ]; then\n ( cd /tmp \u0026\u0026 sha256sum -c nerdctl-full.sha256 --ignore-missing 2\u003e/dev/null || true )\nfi\ntar -C /usr/local -xzf /tmp/nerdctl-full.tar.gz\nrm -f /tmp/nerdctl-full.tar.gz /tmp/nerdctl-full.sha256\n"},"run_as":"root","cache":["/var/cache/charly-nerdctl-full"],"intent_do":"act"},{"check":"nerdctl version exits 0","plugin":"command","plugin_input":{"command":"nerdctl version"},"intent_do":"assert","exit_status":0},{"check":"the nerdctl binary is present on PATH","plugin":"command","plugin_input":{"command":"command -v nerdctl"},"intent_do":"assert","exit_status":0},{"check":"the nerdctl.toml declares the charly namespace + buildkit host","plugin":"command","plugin_input":{"command":"grep -q '\''namespace = \"charly\"'\'' /etc/nerdctl/nerdctl.toml"},"intent_do":"assert","exit_status":0},{"check":"the charly CNI network conflist is present","plugin":"file","plugin_input":{"file":"/etc/cni/net.d/charly.conflist"},"intent_do":"assert"}]}],"box":[{"origin":"box:check-nerdctl-app","description":"Disposable bed image for the layer-nerdctl R10 — a Fedora base composing\nlayer-nerdctl, so the nested-pod posture is emitted and can be asserted.\n"}]}' ---> 25ab88409295 -[2/2] STEP 23/27: LABEL ai.opencharly.skill='[{"family":"distros","name":"layer-nerdctl","owner":"layer-nerdctl","description":"nerdctl (containerd CLI) + the rootless containerd/buildkit/CNI stack — native Arch/Alpine packages, the pinned sha256 nerdctl-full tarball on Fedora/Debian/Ubuntu, nerdctl.toml + the charly CNI conflist + the nested-pod posture. Use when working with the nerdctl engine, the layer-nerdctl candy, or engine: nerdctl deploys.","content":"# layer-nerdctl\n\nnerdctl (the containerd CLI) plus the rootless containerd + buildkit + CNI\nstack, as ONE candy. Composed by a box that wants the opt-in `engine: nerdctl`\nengine.\n\n## What it installs\n\n- **Native packages** on Arch/CachyOS/Omarchy and Alpine: `nerdctl`,\n `cni-plugins`, `rootlesskit`, `slirp4netns`, `buildkit`, `fuse-overlayfs`,\n `crun`, `iptables-nft` (arch) / `iptables` (alpine).\n- **Non-native distros** (Fedora/Debian/Ubuntu) install the pinned,\n sha256-verified `nerdctl-full` tarball (step `nerdctl-full-tarball`), which\n supplies nerdctl + containerd + `containerd-fuse-overlayfs-grpc` + CNI +\n buildkit + rootlesskit in one archive.\n- `/etc/nerdctl/nerdctl.toml` (charly namespace + rootless buildkit host) and\n the `charly` CNI network conflist at `/etc/cni/net.d/charly.conflist`.\n- The **nested-pod posture**: userns-scoped `cap_add: ALL`, `/dev/fuse`,\n `/dev/net/tun`, `unmask=/proc/*`.\n\n## Engine capability\n\nThe `engine: nerdctl` word is served by `opencharly/plugin-nerdctl`\n(out-of-process) or compiled in; every engine op delegates to\n`container.InvokeEngineOp(\"nerdctl\", …)` in the spec module. nerdctl has no\n`--keep-id`, so the start-plan runs the workload as `--user 0:0` (uid 0 == the\nhost user under rootless), guaranteeing uid-identical sharing; a non-zero uid\nneeds the subuid caveat.\n\n## Use when\n\nWorking with the nerdctl engine, the layer-nerdctl candy, or an\n`engine: nerdctl` deploy.\n"}]' ---> 39516ebadd80 -[2/2] STEP 24/27: LABEL ai.opencharly.status="testing" ---> 43c66a493642 -[2/2] STEP 25/27: LABEL ai.opencharly.check_level="noagent" ---> 1ca9a51fd9cc -[2/2] STEP 26/27: LABEL ai.opencharly.info='Disposable bed image for the layer-nerdctl R10 — a Fedora base composing; layer-nerdctl: nerdctl (containerd CLI) with the full rootless containerd + buildkit +' ---> 8f7d666b42bb -[2/2] STEP 27/27: LABEL ai.opencharly.candy_version='{"layer-nerdctl":"2026.266.1425"}' -[2/2] COMMIT ghcr.io/example/check-nerdctl-app:check-nerdctl-nested-2026.266.1747 ---> 3f0cc48d47f9 -Successfully tagged ghcr.io/example/check-nerdctl-app:check-nerdctl-nested-2026.266.1747 -3f0cc48d47f91b20413594a41892b24827894c786ecf58e1846351052afdb972 diff --git a/.check/check-nerdctl-nested/2026.266.1747/start.log b/.check/check-nerdctl-nested/2026.266.1747/start.log deleted file mode 100644 index 988478c..0000000 --- a/.check/check-nerdctl-nested/2026.266.1747/start.log +++ /dev/null @@ -1,3 +0,0 @@ -WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different charly version). Set CHARLY_PLUGIN_DIR to load plugins from a custom location. -Resolved @github.com/opencharly/plugin-deploy-pod -> v2026.266.1057 (latest tag) -plugin github.com/opencharly/plugin-deploy-pod/candy/plugin-deploy-pod: served from /home/atrawog/.cache/charly/plugins/github.com_opencharly_plugin-deploy-pod_candy_plugin-deploy-pod-32201456c20eec21 (build stamp ff61df62ae33c859); source /home/atrawog/.cache/charly/repos/github.com/opencharly/plugin-deploy-pod@v2026.266.1057/candy/plugin-deploy-pod diff --git a/.check/check-nerdctl-nested/2026.266.1747/summary.yml b/.check/check-nerdctl-nested/2026.266.1747/summary.yml deleted file mode 100644 index fb0b63b..0000000 --- a/.check/check-nerdctl-nested/2026.266.1747/summary.yml +++ /dev/null @@ -1,196 +0,0 @@ -bed: check-nerdctl-nested -calver: 2026.266.1747 -steps: - - name: image-build - duration_seconds: 62 - ok: true - diagnostics: - errors: 0 - warnings: 0 - advisories: 0 - allowlisted: 1 - cache_hits: 0 - cache_steps: 29 - findings: - - severity: warning - count: 1 - pattern: severity-prefix - first_line: 1 - allowlisted: dev-worktree-binary-notice - text: "WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different c…" - - name: check-image - duration_seconds: 26 - ok: true - diagnostics: - errors: 0 - warnings: 0 - advisories: 0 - allowlisted: 1 - findings: - - severity: warning - count: 1 - pattern: severity-prefix - first_line: 1 - allowlisted: dev-worktree-binary-notice - text: "WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different c…" - - name: deploy-add - duration_seconds: 5 - ok: true - diagnostics: - errors: 0 - warnings: 0 - advisories: 0 - allowlisted: 1 - findings: - - severity: warning - count: 1 - pattern: severity-prefix - first_line: 1 - allowlisted: dev-worktree-binary-notice - text: "WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different c…" - - name: config - duration_seconds: 5 - ok: true - diagnostics: - errors: 0 - warnings: 0 - advisories: 0 - allowlisted: 1 - findings: - - severity: warning - count: 1 - pattern: severity-prefix - first_line: 1 - allowlisted: dev-worktree-binary-notice - text: "WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different c…" - - name: start - duration_seconds: 4 - ok: true - diagnostics: - errors: 0 - warnings: 0 - advisories: 0 - allowlisted: 1 - findings: - - severity: warning - count: 1 - pattern: severity-prefix - first_line: 1 - allowlisted: dev-worktree-binary-notice - text: "WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different c…" - - name: bring-up-members - duration_seconds: 0 - ok: true - - name: check-live - duration_seconds: 11 - ok: true - diagnostics: - errors: 0 - warnings: 0 - advisories: 0 - allowlisted: 1 - findings: - - severity: warning - count: 1 - pattern: severity-prefix - first_line: 1 - allowlisted: dev-worktree-binary-notice - text: "WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different c…" - - name: feature-run - duration_seconds: 8 - ok: true - diagnostics: - errors: 0 - warnings: 0 - advisories: 0 - allowlisted: 1 - findings: - - severity: warning - count: 1 - pattern: severity-prefix - first_line: 1 - allowlisted: dev-worktree-binary-notice - text: "WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different c…" - - name: update - duration_seconds: 30 - ok: true - diagnostics: - errors: 0 - warnings: 0 - advisories: 0 - allowlisted: 5 - findings: - - severity: warning - count: 5 - pattern: severity-prefix - first_line: 1 - allowlisted: dev-worktree-binary-notice - text: "WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different c…" - - name: rebuild-ready - duration_seconds: 1 - ok: true - - name: check-live-rebuild - duration_seconds: 10 - ok: true - diagnostics: - errors: 0 - warnings: 0 - advisories: 0 - allowlisted: 1 - findings: - - severity: warning - count: 1 - pattern: severity-prefix - first_line: 1 - allowlisted: dev-worktree-binary-notice - text: "WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different c…" - - name: feature-run-rebuild - duration_seconds: 7 - ok: true - diagnostics: - errors: 0 - warnings: 0 - advisories: 0 - allowlisted: 1 - findings: - - severity: warning - count: 1 - pattern: severity-prefix - first_line: 1 - allowlisted: dev-worktree-binary-notice - text: "WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different c…" - - name: cleanup - duration_seconds: 26 - ok: true - diagnostics: - errors: 0 - warnings: 0 - advisories: 0 - allowlisted: 1 - findings: - - severity: warning - count: 1 - pattern: severity-prefix - first_line: 1 - allowlisted: dev-worktree-binary-notice - text: "WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different c…" - - name: cleanup-members - duration_seconds: 0 - ok: true -total_seconds: 195 -diagnostics: - errors: 0 - warnings: 0 - advisories: 0 - allowlisted: 15 - errors_fatal: true - warnings_fatal: false - advisories_fatal: false - cache_hits: 0 - cache_steps: 29 - allowlist_used: - - id: dev-worktree-binary-notice - severity: warning - suppressed: 15 - why: "A dev/worktree charly binary (the in-development build every charly check bed installs via the charly-dev candy) is not at the FHS location that owns /usr/lib/charly/plugins, so it deliberately skips the installed package's plugins (built against a different charly version, issue #328) and says so once per process. Observed live in every check-charly-vm step log when the host has a packaged charly install. Informational dev-build behavior — not an error; suppressing it would mean silently loading plugins built against a different API version." -ok: true diff --git a/.check/check-nerdctl-nested/2026.266.1747/update.log b/.check/check-nerdctl-nested/2026.266.1747/update.log deleted file mode 100644 index 858e15b..0000000 --- a/.check/check-nerdctl-nested/2026.266.1747/update.log +++ /dev/null @@ -1,19 +0,0 @@ -WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different charly version). Set CHARLY_PLUGIN_DIR to load plugins from a custom location. -Resolved @github.com/opencharly/plugin-deploy-pod -> v2026.266.1057 (latest tag) -plugin github.com/opencharly/plugin-deploy-pod/candy/plugin-deploy-pod: served from /home/atrawog/.cache/charly/plugins/github.com_opencharly_plugin-deploy-pod_candy_plugin-deploy-pod-32201456c20eec21 (build stamp ff61df62ae33c859); source /home/atrawog/.cache/charly/repos/github.com/opencharly/plugin-deploy-pod@v2026.266.1057/candy/plugin-deploy-pod -Resolved @github.com/opencharly/plugin-deploy-pod -> v2026.266.1057 (latest tag) -WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different charly version). Set CHARLY_PLUGIN_DIR to load plugins from a custom location. -Resolved @github.com/opencharly/plugin-deploy-pod -> v2026.266.1057 (latest tag) -plugin github.com/opencharly/plugin-deploy-pod/candy/plugin-deploy-pod: served from /home/atrawog/.cache/charly/plugins/github.com_opencharly_plugin-deploy-pod_candy_plugin-deploy-pod-32201456c20eec21 (build stamp ff61df62ae33c859); source /home/atrawog/.cache/charly/repos/github.com/opencharly/plugin-deploy-pod@v2026.266.1057/candy/plugin-deploy-pod -Overlay image ready: check-nerdctl-app:check-nerdctl-nested-2026.266.1747 -To start the container, run: charly start check-nerdctl-nested -WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different charly version). Set CHARLY_PLUGIN_DIR to load plugins from a custom location. -Resolved @github.com/opencharly/plugin-deploy-pod -> v2026.266.1057 (latest tag) -plugin github.com/opencharly/plugin-deploy-pod/candy/plugin-deploy-pod: served from /home/atrawog/.cache/charly/plugins/github.com_opencharly_plugin-deploy-pod_candy_plugin-deploy-pod-32201456c20eec21 (build stamp ff61df62ae33c859); source /home/atrawog/.cache/charly/repos/github.com/opencharly/plugin-deploy-pod@v2026.266.1057/candy/plugin-deploy-pod -WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different charly version). Set CHARLY_PLUGIN_DIR to load plugins from a custom location. -Resolved @github.com/opencharly/plugin-deploy-pod -> v2026.266.1057 (latest tag) -plugin plugin-deploy-pod: served from /home/atrawog/.cache/charly/plugins/plugin-deploy-pod-32201456c20eec21 (build stamp ff61df62ae33c859); source /home/atrawog/.cache/charly/repos/github.com/opencharly/plugin-deploy-pod@v2026.266.1057/candy/plugin-deploy-pod -Resolved @github.com/opencharly/plugin-deploy-pod -> v2026.266.1057 (latest tag) -WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different charly version). Set CHARLY_PLUGIN_DIR to load plugins from a custom location. -Resolved @github.com/opencharly/plugin-deploy-pod -> v2026.266.1057 (latest tag) -plugin github.com/opencharly/plugin-deploy-pod/candy/plugin-deploy-pod: served from /home/atrawog/.cache/charly/plugins/github.com_opencharly_plugin-deploy-pod_candy_plugin-deploy-pod-32201456c20eec21 (build stamp ff61df62ae33c859); source /home/atrawog/.cache/charly/repos/github.com/opencharly/plugin-deploy-pod@v2026.266.1057/candy/plugin-deploy-pod diff --git a/.check/check-nerdctl-nested/2026.266.1801/check-image.log b/.check/check-nerdctl-nested/2026.266.1801/check-image.log deleted file mode 100644 index c80f47a..0000000 --- a/.check/check-nerdctl-nested/2026.266.1801/check-image.log +++ /dev/null @@ -1,11 +0,0 @@ -WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different charly version). Set CHARLY_PLUGIN_DIR to load plugins from a custom location. -charly: listing local images (first run — may take a moment)... -charly: listed 250 local images in 7.427s — consider pruning the image store -Image: ghcr.io/example/check-nerdctl-app:check-nerdctl-nested-2026.266.1801 - SKIP run install the pinned nerdctl-full tarball on non-native distros [nerdctl-full-tarball] skipped — verify-only mode (mutating step) - PASS check nerdctl version exits 0 [plan:candy:layer-nerdctl:1] exit=0 - PASS check the nerdctl binary is present on PATH [plan:candy:layer-nerdctl:2] exit=0 - PASS check the nerdctl.toml declares the charly namespace + buildkit host [plan:candy:layer-nerdctl:3] exit=0 - PASS check the charly CNI network conflist is present [plan:candy:layer-nerdctl:4] ok - -5 steps: 4 passed, 0 failed, 1 skipped diff --git a/.check/check-nerdctl-nested/2026.266.1801/check-live-rebuild.log b/.check/check-nerdctl-nested/2026.266.1801/check-live-rebuild.log deleted file mode 100644 index dbc1b98..0000000 --- a/.check/check-nerdctl-nested/2026.266.1801/check-live-rebuild.log +++ /dev/null @@ -1,17 +0,0 @@ -WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different charly version). Set CHARLY_PLUGIN_DIR to load plugins from a custom location. -Resolved @github.com/opencharly/plugin-deploy-pod -> v2026.266.1057 (latest tag) -Resolved @github.com/opencharly/plugin-vm -> v2026.266.1235 (latest tag) -plugin github.com/opencharly/plugin-deploy-pod/candy/plugin-deploy-pod: served from /home/atrawog/.cache/charly/plugins/github.com_opencharly_plugin-deploy-pod_candy_plugin-deploy-pod-32201456c20eec21 (build stamp ff61df62ae33c859); source /home/atrawog/.cache/charly/repos/github.com/opencharly/plugin-deploy-pod@v2026.266.1057/candy/plugin-deploy-pod -Image: check-nerdctl-app (container: charly-check-nerdctl-nested) - SKIP run install the pinned nerdctl-full tarball on non-native distros [nerdctl-full-tarball] skipped — verify-only mode (mutating step) - PASS check nerdctl version exits 0 [plan:candy:layer-nerdctl:1] exit=0 - PASS check the nerdctl binary is present on PATH [plan:candy:layer-nerdctl:2] exit=0 - PASS check the nerdctl.toml declares the charly namespace + buildkit host [plan:candy:layer-nerdctl:3] exit=0 - PASS check the charly CNI network conflist is present [plan:candy:layer-nerdctl:4] ok - PASS check the fuse device is present for the fuse-overlayfs snapshotter [plan:deploy-local:check-nerdctl-nested:0] ok - PASS check the tun device is present for the CNI bridge [plan:deploy-local:check-nerdctl-nested:1] ok - PASS check the exact full capability mask is retained (cap_add ALL) [plan:deploy-local:check-nerdctl-nested:2] exit=0 - PASS check the pod is userns-scoped (uid 0 inside maps to the host user, not host root) [plan:deploy-local:check-nerdctl-nested:3] exit=0 - PASS check nerdctl is on PATH in the nested pod [plan:deploy-local:check-nerdctl-nested:4] exit=0 - -10 steps: 9 passed, 0 failed, 1 skipped diff --git a/.check/check-nerdctl-nested/2026.266.1801/check-live.log b/.check/check-nerdctl-nested/2026.266.1801/check-live.log deleted file mode 100644 index a3c6295..0000000 --- a/.check/check-nerdctl-nested/2026.266.1801/check-live.log +++ /dev/null @@ -1,20 +0,0 @@ -WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different charly version). Set CHARLY_PLUGIN_DIR to load plugins from a custom location. -charly: resolving project (first run — may take a moment)... -Resolved @github.com/opencharly/plugin-deploy-pod -> v2026.266.1057 (latest tag) -Resolved @github.com/opencharly/plugin-vm -> v2026.266.1235 (latest tag) -charly: fetching git metadata for 1 repo(s) (first run — may take a moment)... -charly: git metadata cached. -plugin github.com/opencharly/plugin-deploy-pod/candy/plugin-deploy-pod: served from /home/atrawog/.cache/charly/plugins/github.com_opencharly_plugin-deploy-pod_candy_plugin-deploy-pod-32201456c20eec21 (build stamp ff61df62ae33c859); source /home/atrawog/.cache/charly/repos/github.com/opencharly/plugin-deploy-pod@v2026.266.1057/candy/plugin-deploy-pod -Image: check-nerdctl-app (container: charly-check-nerdctl-nested) - SKIP run install the pinned nerdctl-full tarball on non-native distros [nerdctl-full-tarball] skipped — verify-only mode (mutating step) - PASS check nerdctl version exits 0 [plan:candy:layer-nerdctl:1] exit=0 - PASS check the nerdctl binary is present on PATH [plan:candy:layer-nerdctl:2] exit=0 - PASS check the nerdctl.toml declares the charly namespace + buildkit host [plan:candy:layer-nerdctl:3] exit=0 - PASS check the charly CNI network conflist is present [plan:candy:layer-nerdctl:4] ok - PASS check the fuse device is present for the fuse-overlayfs snapshotter [plan:deploy-local:check-nerdctl-nested:0] ok - PASS check the tun device is present for the CNI bridge [plan:deploy-local:check-nerdctl-nested:1] ok - PASS check the exact full capability mask is retained (cap_add ALL) [plan:deploy-local:check-nerdctl-nested:2] exit=0 - PASS check the pod is userns-scoped (uid 0 inside maps to the host user, not host root) [plan:deploy-local:check-nerdctl-nested:3] exit=0 - PASS check nerdctl is on PATH in the nested pod [plan:deploy-local:check-nerdctl-nested:4] exit=0 - -10 steps: 9 passed, 0 failed, 1 skipped diff --git a/.check/check-nerdctl-nested/2026.266.1801/cleanup.log b/.check/check-nerdctl-nested/2026.266.1801/cleanup.log deleted file mode 100644 index f1f7839..0000000 --- a/.check/check-nerdctl-nested/2026.266.1801/cleanup.log +++ /dev/null @@ -1,4 +0,0 @@ -WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different charly version). Set CHARLY_PLUGIN_DIR to load plugins from a custom location. -Removed /home/atrawog/.config/containers/systemd/charly-check-nerdctl-nested.container -Reloaded systemd user daemon -Cleaned charly.yml entry for check-nerdctl-nested diff --git a/.check/check-nerdctl-nested/2026.266.1801/config.log b/.check/check-nerdctl-nested/2026.266.1801/config.log deleted file mode 100644 index 0b84ff8..0000000 --- a/.check/check-nerdctl-nested/2026.266.1801/config.log +++ /dev/null @@ -1,5 +0,0 @@ -WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different charly version). Set CHARLY_PLUGIN_DIR to load plugins from a custom location. -Resolved @github.com/opencharly/plugin-deploy-pod -> v2026.266.1057 (latest tag) -plugin plugin-deploy-pod: served from /home/atrawog/.cache/charly/plugins/plugin-deploy-pod-32201456c20eec21 (build stamp ff61df62ae33c859); source /home/atrawog/.cache/charly/repos/github.com/opencharly/plugin-deploy-pod@v2026.266.1057/candy/plugin-deploy-pod -Resolved @github.com/opencharly/plugin-deploy-pod -> v2026.266.1057 (latest tag) -Resolved @github.com/opencharly/plugin-deploy-pod -> v2026.266.1057 (latest tag) diff --git a/.check/check-nerdctl-nested/2026.266.1801/deploy-add.log b/.check/check-nerdctl-nested/2026.266.1801/deploy-add.log deleted file mode 100644 index a9afd7a..0000000 --- a/.check/check-nerdctl-nested/2026.266.1801/deploy-add.log +++ /dev/null @@ -1,8 +0,0 @@ -WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different charly version). Set CHARLY_PLUGIN_DIR to load plugins from a custom location. -Resolved @github.com/opencharly/plugin-deploy-pod -> v2026.266.1057 (latest tag) -charly: fetching git metadata for 1 repo(s) (first run — may take a moment)... -charly: git metadata cached. -plugin github.com/opencharly/plugin-deploy-pod/candy/plugin-deploy-pod: served from /home/atrawog/.cache/charly/plugins/github.com_opencharly_plugin-deploy-pod_candy_plugin-deploy-pod-32201456c20eec21 (build stamp ff61df62ae33c859); source /home/atrawog/.cache/charly/repos/github.com/opencharly/plugin-deploy-pod@v2026.266.1057/candy/plugin-deploy-pod -charly: resolving project (first run — may take a moment)... -Overlay image ready: check-nerdctl-app:check-nerdctl-nested-2026.266.1801 -To start the container, run: charly start check-nerdctl-nested diff --git a/.check/check-nerdctl-nested/2026.266.1801/feature-run-rebuild.log b/.check/check-nerdctl-nested/2026.266.1801/feature-run-rebuild.log deleted file mode 100644 index 3575661..0000000 --- a/.check/check-nerdctl-nested/2026.266.1801/feature-run-rebuild.log +++ /dev/null @@ -1,12 +0,0 @@ -WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different charly version). Set CHARLY_PLUGIN_DIR to load plugins from a custom location. -Resolved @github.com/opencharly/plugin-deploy-pod -> v2026.266.1057 (latest tag) -Resolved @github.com/opencharly/plugin-vm -> v2026.266.1235 (latest tag) -plugin plugin-deploy-pod: served from /home/atrawog/.cache/charly/plugins/plugin-deploy-pod-32201456c20eec21 (build stamp ff61df62ae33c859); source /home/atrawog/.cache/charly/repos/github.com/opencharly/plugin-deploy-pod@v2026.266.1057/candy/plugin-deploy-pod -Feature run (deploy scope, deterministic-only): check-nerdctl-app (container: charly-check-nerdctl-nested) - SKIP run install the pinned nerdctl-full tarball on non-native distros [nerdctl-full-tarball] skipped — run: install-timeline step (feature-run verifies, does not re-install) - PASS check nerdctl version exits 0 [plan:candy:layer-nerdctl:1] exit=0 - PASS check the nerdctl binary is present on PATH [plan:candy:layer-nerdctl:2] exit=0 - PASS check the nerdctl.toml declares the charly namespace + buildkit host [plan:candy:layer-nerdctl:3] exit=0 - PASS check the charly CNI network conflist is present [plan:candy:layer-nerdctl:4] ok - -5 steps: 4 passed, 0 failed, 1 skipped diff --git a/.check/check-nerdctl-nested/2026.266.1801/feature-run.log b/.check/check-nerdctl-nested/2026.266.1801/feature-run.log deleted file mode 100644 index 3575661..0000000 --- a/.check/check-nerdctl-nested/2026.266.1801/feature-run.log +++ /dev/null @@ -1,12 +0,0 @@ -WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different charly version). Set CHARLY_PLUGIN_DIR to load plugins from a custom location. -Resolved @github.com/opencharly/plugin-deploy-pod -> v2026.266.1057 (latest tag) -Resolved @github.com/opencharly/plugin-vm -> v2026.266.1235 (latest tag) -plugin plugin-deploy-pod: served from /home/atrawog/.cache/charly/plugins/plugin-deploy-pod-32201456c20eec21 (build stamp ff61df62ae33c859); source /home/atrawog/.cache/charly/repos/github.com/opencharly/plugin-deploy-pod@v2026.266.1057/candy/plugin-deploy-pod -Feature run (deploy scope, deterministic-only): check-nerdctl-app (container: charly-check-nerdctl-nested) - SKIP run install the pinned nerdctl-full tarball on non-native distros [nerdctl-full-tarball] skipped — run: install-timeline step (feature-run verifies, does not re-install) - PASS check nerdctl version exits 0 [plan:candy:layer-nerdctl:1] exit=0 - PASS check the nerdctl binary is present on PATH [plan:candy:layer-nerdctl:2] exit=0 - PASS check the nerdctl.toml declares the charly namespace + buildkit host [plan:candy:layer-nerdctl:3] exit=0 - PASS check the charly CNI network conflist is present [plan:candy:layer-nerdctl:4] ok - -5 steps: 4 passed, 0 failed, 1 skipped diff --git a/.check/check-nerdctl-nested/2026.266.1801/image-build.log b/.check/check-nerdctl-nested/2026.266.1801/image-build.log deleted file mode 100644 index 7d93a1c..0000000 --- a/.check/check-nerdctl-nested/2026.266.1801/image-build.log +++ /dev/null @@ -1,93 +0,0 @@ -WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different charly version). Set CHARLY_PLUGIN_DIR to load plugins from a custom location. - ---- Building check-nerdctl-app --- -[2/2] STEP 1/27: FROM quay.io/fedora/fedora:43 -[1/2] STEP 1/2: FROM scratch AS layer-nerdctl -[1/2] STEP 2/2: COPY candy/layer-nerdctl/ / ---> Using cache 08e83e9abe772eb5f7803c5a9a85df9f7aa9d78814b45b979d1a664764a28e80 ---> 08e83e9abe77 -[2/2] STEP 2/27: RUN { [ -L /usr/local ] && mkdir -p "$(readlink /usr/local)"; mkdir -p /usr/local/bin; } && ARCH=$(uname -m) && case "$ARCH" in x86_64) ARCH=amd64;; aarch64) ARCH=arm64;; esac && TASK_URL="https://github.com/go-task/task/releases/latest/download/task_linux_${ARCH}.tar.gz" && (curl -fsSL "$TASK_URL" || wget -qO- "$TASK_URL") | tar -xzf - -C /usr/local/bin task ---> Using cache 3a1c52539c53a8ee6a412b4bdcc67a26d583b005c7d30d664e4c1d5ff0426424 ---> 3a1c52539c53 -[2/2] STEP 3/27: RUN if ! getent passwd 1000 >/dev/null 2>&1; then LOGIN_SHELL=/bin/sh; [ -x /bin/bash ] && LOGIN_SHELL=/bin/bash; if command -v useradd >/dev/null 2>&1; then (getent group 1000 >/dev/null 2>&1 || groupadd -g 1000 user) && useradd -m -u 1000 -g 1000 -s "$LOGIN_SHELL" user; else (getent group 1000 >/dev/null 2>&1 || addgroup -g 1000 user) && adduser -D -h /home/user -u 1000 -G user -s "$LOGIN_SHELL" user; fi; fi ---> Using cache 333a86c9c18f2da10bd95e969f713e4397199eb2c263d95b5b21a8c674d7ab7c ---> 333a86c9c18f -[2/2] STEP 4/27: WORKDIR /home/user ---> Using cache ceae20d5941c398ffb947fc96526b6b70afe6ab5f4bb74b65a86f96679b78fbe ---> ceae20d5941c -[2/2] STEP 5/27: ARG TARGETARCH ---> Using cache ae32f5c98054a6366543a8737d198f021637e0d4835e8ece07ddac48562da07d ---> ae32f5c98054 -[2/2] STEP 6/27: ENV ARCH=${TARGETARCH} ---> Using cache 1ac74be00207a592a9e06876e897608e8c814fc5a3ca5cd29b428a10b975d39b ---> 1ac74be00207 -[2/2] STEP 7/27: ENV NERDCTL_FULL_VERSION="2.1.2" ---> Using cache 5ced4910d7d2ec156774f730400914b4e6ce153bd835081116c695135122ccf0 ---> 5ced4910d7d2 -[2/2] STEP 8/27: RUN --mount=type=bind,from=layer-nerdctl,source=/,target=/ctx --mount=type=cache,id=charly-tmp-npm-cache-uid1000,dst=/tmp/npm-cache,uid=1000,gid=1000 --mount=type=cache,id=charly-var-cache-charly-nerdctl-full,dst=/var/cache/charly-nerdctl-full,sharing=locked sh -c 'SH=/bin/sh; [ -x /bin/bash ] && SH=/bin/bash; exec "$SH"' sh <<'OVCMD' (BUILD_ARCH=$(uname -m)...) ---> Using cache 97e956f43c1c976762e2180ac5f312f27630d211285315ad3626bb6b310e4947 ---> 97e956f43c1c -[2/2] STEP 9/27: RUN mkdir -p /etc/nerdctl /etc/cni/net.d && chmod 0755 /etc/nerdctl /etc/cni/net.d ---> Using cache b9780a09f3aefc779fa3323d983c0c33aba3a3b6899d9b77129750bc7bc4f607 ---> b9780a09f3ae -[2/2] STEP 10/27: COPY --chmod=0644 .build/check-nerdctl-app/_inline/layer-nerdctl/ff8332b3ea9a053ad45a341736d37d7748d5d7634468306117fd671229ee4764 /etc/nerdctl/nerdctl.toml ---> Using cache 7d519aea5ba79dee7df8bbab5edb30840ad4eca8c748b89afeb9a2402c91160f ---> 7d519aea5ba7 -[2/2] STEP 11/27: COPY --chmod=0644 .build/check-nerdctl-app/_inline/layer-nerdctl/2b8bd7213d30681202040c5103666d752ce74e8f4606c3e5614aa548caa67879 /etc/cni/net.d/charly.conflist ---> Using cache 231f0ff772b05f5ca905299dbb5d16b9391bfa389e1c5b8d90cffcf459715cd7 ---> 231f0ff772b0 -[2/2] STEP 12/27: USER 1000 ---> Using cache 7599d7a789c3b1ce4f3eedf068eaf9a6dcb47bea742295a0c5e23b6ebd8a5940 ---> 7599d7a789c3 -[2/2] STEP 13/27: LABEL ai.opencharly.version="2026.266.1730" ---> Using cache 6629a5d2a8679f301ba6b53e7d4d31cc6a393426ef8294e5c3a099311ca8c7b2 ---> 6629a5d2a867 -[2/2] STEP 14/27: LABEL ai.opencharly.box="check-nerdctl-app" ---> Using cache cc7d145e8612b7128436cddfac0cd52eb19b09f7b675231801943bbc26e791c7 ---> cc7d145e8612 -[2/2] STEP 15/27: LABEL ai.opencharly.uid="1000" ---> Using cache 78391bc15adb3007e03de54d76f50b5dc16653d7f4b023a85620695b48232279 ---> 78391bc15adb -[2/2] STEP 16/27: LABEL ai.opencharly.gid="1000" ---> Using cache 6127dabfaae06ceaca55b39d83025eb7d2b6ce623431810d43d4d58573a349e5 ---> 6127dabfaae0 -[2/2] STEP 17/27: LABEL ai.opencharly.user="user" ---> Using cache 6ebbef677940b879614015f64d2b0dc94ea562d34a237f09779afcf3866be5c7 ---> 6ebbef677940 -[2/2] STEP 18/27: LABEL ai.opencharly.home="/home/user" ---> Using cache f62440a381298e0872889de8517d7c5765e86dc2b09254b4182e01f9fb34a9a0 ---> f62440a38129 -[2/2] STEP 19/27: LABEL ai.opencharly.registry="ghcr.io/example" ---> Using cache ac482936252bbb6d713e4a2db9e1e2f226df9d3518ce62fabf5b2df5b60ec179 ---> ac482936252b -[2/2] STEP 20/27: LABEL ai.opencharly.platform.format='["rpm"]' ---> Using cache 29ac23fa31a4bc594957ffcb1536aa502dbc5746752d6907a2d8d6a69af433ed ---> 29ac23fa31a4 -[2/2] STEP 21/27: LABEL ai.opencharly.security='{"cap_add":["ALL"],"devices":["/dev/fuse","/dev/net/tun"],"security_opt":["unmask=/proc/*"]}' ---> Using cache 5688c3ac19a77afcef9650a16007c806d44be617d2e056b536ec8eb7acd6966c ---> 5688c3ac19a7 -[2/2] STEP 22/27: LABEL ai.opencharly.description='{"candy":[{"origin":"candy:layer-nerdctl","description":"nerdctl (containerd CLI) with the full rootless containerd + buildkit +\nCNI stack. Native distro packages on Arch/CachyOS/Omarchy; on Fedora,\nDebian and Ubuntu the pinned nerdctl-full tarball (sha256-verified)\nsupplies nerdctl + containerd + containerd-fuse-overlayfs-grpc + CNI +\nbuildkit + rootlesskit. Writes /etc/nerdctl/nerdctl.toml, the rootless\ncontainerd/buildkit units, the CNI `charly` network and the cgroup2-rw +\niptables-nft posture for nested use. ADE checks: nerdctl version, nerdctl\ninfo, the rootless probe, and the fuse-overlayfs snapshotter.\n","plan":[{"run":"install the pinned nerdctl-full tarball on non-native distros","plugin":"command","id":"nerdctl-full-tarball","plugin_input":{"command":"set -euo pipefail\ncase \"$(. /etc/os-release; echo \"${ID:-}${ID_LIKE:-}\")\" in\n *arch*|*alpine*) exit 0 ;; # native packages already provide the stack\nesac\nver=\"${NERDCTL_FULL_VERSION}\"\narch=\"${ARCH}\"\nurl=\"https://github.com/containerd/nerdctl/releases/download/v${ver}/nerdctl-full-${ver}-linux-${arch}.tar.gz\"\ncurl -fsSL \"${url}\" -o /tmp/nerdctl-full.tar.gz\ncurl -fsSL \"${url}.sha256sum\" -o /tmp/nerdctl-full.sha256 || true\nif [ -s /tmp/nerdctl-full.sha256 ]; then\n ( cd /tmp \u0026\u0026 sha256sum -c nerdctl-full.sha256 --ignore-missing 2\u003e/dev/null || true )\nfi\ntar -C /usr/local -xzf /tmp/nerdctl-full.tar.gz\nrm -f /tmp/nerdctl-full.tar.gz /tmp/nerdctl-full.sha256\n"},"run_as":"root","cache":["/var/cache/charly-nerdctl-full"],"intent_do":"act"},{"check":"nerdctl version exits 0","plugin":"command","plugin_input":{"command":"nerdctl version"},"intent_do":"assert","exit_status":0},{"check":"the nerdctl binary is present on PATH","plugin":"command","plugin_input":{"command":"command -v nerdctl"},"intent_do":"assert","exit_status":0},{"check":"the nerdctl.toml declares the charly namespace + buildkit host","plugin":"command","plugin_input":{"command":"grep -q '\''namespace = \"charly\"'\'' /etc/nerdctl/nerdctl.toml"},"intent_do":"assert","exit_status":0},{"check":"the charly CNI network conflist is present","plugin":"file","plugin_input":{"file":"/etc/cni/net.d/charly.conflist"},"intent_do":"assert"}]}],"box":[{"origin":"box:check-nerdctl-app","description":"Disposable bed image for the layer-nerdctl R10 — a Fedora base composing\nlayer-nerdctl, so the nested-pod posture is emitted and can be asserted.\n"}]}' ---> Using cache 25ab88409295061cd5aa13d999875b54d30a57679459185808194570d39e70c5 ---> 25ab88409295 -[2/2] STEP 23/27: LABEL ai.opencharly.skill='[{"family":"distros","name":"layer-nerdctl","owner":"layer-nerdctl","description":"nerdctl (containerd CLI) + the rootless containerd/buildkit/CNI stack — native Arch/Alpine packages, the pinned sha256 nerdctl-full tarball on Fedora/Debian/Ubuntu, nerdctl.toml + the charly CNI conflist + the nested-pod posture. Use when working with the nerdctl engine, the layer-nerdctl candy, or engine: nerdctl deploys.","content":"# layer-nerdctl\n\nnerdctl (the containerd CLI) plus the rootless containerd + buildkit + CNI\nstack, as ONE candy. Composed by a box that wants the opt-in `engine: nerdctl`\nengine.\n\n## What it installs\n\n- **Native packages** on Arch/CachyOS/Omarchy and Alpine: `nerdctl`,\n `cni-plugins`, `rootlesskit`, `slirp4netns`, `buildkit`, `fuse-overlayfs`,\n `crun`, `iptables-nft` (arch) / `iptables` (alpine).\n- **Non-native distros** (Fedora/Debian/Ubuntu) install the pinned,\n sha256-verified `nerdctl-full` tarball (step `nerdctl-full-tarball`), which\n supplies nerdctl + containerd + `containerd-fuse-overlayfs-grpc` + CNI +\n buildkit + rootlesskit in one archive.\n- `/etc/nerdctl/nerdctl.toml` (charly namespace + rootless buildkit host) and\n the `charly` CNI network conflist at `/etc/cni/net.d/charly.conflist`.\n- The **nested-pod posture**: userns-scoped `cap_add: ALL`, `/dev/fuse`,\n `/dev/net/tun`, `unmask=/proc/*`.\n\n## Engine capability\n\nThe `engine: nerdctl` word is served by `opencharly/plugin-nerdctl`\n(out-of-process) or compiled in; every engine op delegates to\n`container.InvokeEngineOp(\"nerdctl\", …)` in the spec module. nerdctl has no\n`--keep-id`, so the start-plan runs the workload as `--user 0:0` (uid 0 == the\nhost user under rootless), guaranteeing uid-identical sharing; a non-zero uid\nneeds the subuid caveat.\n\n## Use when\n\nWorking with the nerdctl engine, the layer-nerdctl candy, or an\n`engine: nerdctl` deploy.\n"}]' ---> Using cache 39516ebadd80644383e08ff00682152276f46ec296c88ddd08c3742433afe964 ---> 39516ebadd80 -[2/2] STEP 24/27: LABEL ai.opencharly.status="testing" ---> Using cache 43c66a4936420e81ffd1b679911ad58b28c6de4d1d9a0ad74aa8b1ce9422192a ---> 43c66a493642 -[2/2] STEP 25/27: LABEL ai.opencharly.check_level="noagent" ---> Using cache 1ca9a51fd9cc2c244a84607a7a0a02f97d5765758b86f686fd62c00fb4da9fc1 ---> 1ca9a51fd9cc -[2/2] STEP 26/27: LABEL ai.opencharly.info='Disposable bed image for the layer-nerdctl R10 — a Fedora base composing; layer-nerdctl: nerdctl (containerd CLI) with the full rootless containerd + buildkit +' ---> Using cache 8f7d666b42bb37b964d2ca48ff0a7f49d3d28f3c7d1539a8d5ec1719907a7d3a ---> 8f7d666b42bb -[2/2] STEP 27/27: LABEL ai.opencharly.candy_version='{"layer-nerdctl":"2026.266.1425"}' ---> Using cache 3f0cc48d47f91b20413594a41892b24827894c786ecf58e1846351052afdb972 -[2/2] COMMIT ghcr.io/example/check-nerdctl-app:check-nerdctl-nested-2026.266.1801 ---> 3f0cc48d47f9 -Successfully tagged ghcr.io/example/check-nerdctl-app:check-nerdctl-nested-2026.266.1801 -Successfully tagged ghcr.io/example/check-nerdctl-nested:2026.266.1759 -Successfully tagged ghcr.io/example/check-nerdctl-nested:2026.266.1749 -Successfully tagged ghcr.io/example/check-nerdctl-nested:2026.266.1748 -Successfully tagged ghcr.io/example/check-nerdctl-app:check-nerdctl-nested-2026.266.1747 -3f0cc48d47f91b20413594a41892b24827894c786ecf58e1846351052afdb972 diff --git a/.check/check-nerdctl-nested/2026.266.1801/start.log b/.check/check-nerdctl-nested/2026.266.1801/start.log deleted file mode 100644 index 988478c..0000000 --- a/.check/check-nerdctl-nested/2026.266.1801/start.log +++ /dev/null @@ -1,3 +0,0 @@ -WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different charly version). Set CHARLY_PLUGIN_DIR to load plugins from a custom location. -Resolved @github.com/opencharly/plugin-deploy-pod -> v2026.266.1057 (latest tag) -plugin github.com/opencharly/plugin-deploy-pod/candy/plugin-deploy-pod: served from /home/atrawog/.cache/charly/plugins/github.com_opencharly_plugin-deploy-pod_candy_plugin-deploy-pod-32201456c20eec21 (build stamp ff61df62ae33c859); source /home/atrawog/.cache/charly/repos/github.com/opencharly/plugin-deploy-pod@v2026.266.1057/candy/plugin-deploy-pod diff --git a/.check/check-nerdctl-nested/2026.266.1801/summary.yml b/.check/check-nerdctl-nested/2026.266.1801/summary.yml deleted file mode 100644 index f3d888e..0000000 --- a/.check/check-nerdctl-nested/2026.266.1801/summary.yml +++ /dev/null @@ -1,196 +0,0 @@ -bed: check-nerdctl-nested -calver: 2026.266.1801 -steps: - - name: image-build - duration_seconds: 14 - ok: true - diagnostics: - errors: 0 - warnings: 0 - advisories: 0 - allowlisted: 1 - cache_hits: 27 - cache_steps: 29 - findings: - - severity: warning - count: 1 - pattern: severity-prefix - first_line: 1 - allowlisted: dev-worktree-binary-notice - text: "WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different c…" - - name: check-image - duration_seconds: 25 - ok: true - diagnostics: - errors: 0 - warnings: 0 - advisories: 0 - allowlisted: 1 - findings: - - severity: warning - count: 1 - pattern: severity-prefix - first_line: 1 - allowlisted: dev-worktree-binary-notice - text: "WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different c…" - - name: deploy-add - duration_seconds: 5 - ok: true - diagnostics: - errors: 0 - warnings: 0 - advisories: 0 - allowlisted: 1 - findings: - - severity: warning - count: 1 - pattern: severity-prefix - first_line: 1 - allowlisted: dev-worktree-binary-notice - text: "WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different c…" - - name: config - duration_seconds: 5 - ok: true - diagnostics: - errors: 0 - warnings: 0 - advisories: 0 - allowlisted: 1 - findings: - - severity: warning - count: 1 - pattern: severity-prefix - first_line: 1 - allowlisted: dev-worktree-binary-notice - text: "WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different c…" - - name: start - duration_seconds: 4 - ok: true - diagnostics: - errors: 0 - warnings: 0 - advisories: 0 - allowlisted: 1 - findings: - - severity: warning - count: 1 - pattern: severity-prefix - first_line: 1 - allowlisted: dev-worktree-binary-notice - text: "WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different c…" - - name: bring-up-members - duration_seconds: 0 - ok: true - - name: check-live - duration_seconds: 12 - ok: true - diagnostics: - errors: 0 - warnings: 0 - advisories: 0 - allowlisted: 1 - findings: - - severity: warning - count: 1 - pattern: severity-prefix - first_line: 1 - allowlisted: dev-worktree-binary-notice - text: "WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different c…" - - name: feature-run - duration_seconds: 8 - ok: true - diagnostics: - errors: 0 - warnings: 0 - advisories: 0 - allowlisted: 1 - findings: - - severity: warning - count: 1 - pattern: severity-prefix - first_line: 1 - allowlisted: dev-worktree-binary-notice - text: "WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different c…" - - name: update - duration_seconds: 31 - ok: true - diagnostics: - errors: 0 - warnings: 0 - advisories: 0 - allowlisted: 5 - findings: - - severity: warning - count: 5 - pattern: severity-prefix - first_line: 1 - allowlisted: dev-worktree-binary-notice - text: "WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different c…" - - name: rebuild-ready - duration_seconds: 1 - ok: true - - name: check-live-rebuild - duration_seconds: 12 - ok: true - diagnostics: - errors: 0 - warnings: 0 - advisories: 0 - allowlisted: 1 - findings: - - severity: warning - count: 1 - pattern: severity-prefix - first_line: 1 - allowlisted: dev-worktree-binary-notice - text: "WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different c…" - - name: feature-run-rebuild - duration_seconds: 9 - ok: true - diagnostics: - errors: 0 - warnings: 0 - advisories: 0 - allowlisted: 1 - findings: - - severity: warning - count: 1 - pattern: severity-prefix - first_line: 1 - allowlisted: dev-worktree-binary-notice - text: "WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different c…" - - name: cleanup - duration_seconds: 27 - ok: true - diagnostics: - errors: 0 - warnings: 0 - advisories: 0 - allowlisted: 1 - findings: - - severity: warning - count: 1 - pattern: severity-prefix - first_line: 1 - allowlisted: dev-worktree-binary-notice - text: "WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different c…" - - name: cleanup-members - duration_seconds: 0 - ok: true -total_seconds: 153 -diagnostics: - errors: 0 - warnings: 0 - advisories: 0 - allowlisted: 15 - errors_fatal: true - warnings_fatal: false - advisories_fatal: false - cache_hits: 27 - cache_steps: 29 - allowlist_used: - - id: dev-worktree-binary-notice - severity: warning - suppressed: 15 - why: "A dev/worktree charly binary (the in-development build every charly check bed installs via the charly-dev candy) is not at the FHS location that owns /usr/lib/charly/plugins, so it deliberately skips the installed package's plugins (built against a different charly version, issue #328) and says so once per process. Observed live in every check-charly-vm step log when the host has a packaged charly install. Informational dev-build behavior — not an error; suppressing it would mean silently loading plugins built against a different API version." -ok: true diff --git a/.check/check-nerdctl-nested/2026.266.1801/update.log b/.check/check-nerdctl-nested/2026.266.1801/update.log deleted file mode 100644 index fb2ad2b..0000000 --- a/.check/check-nerdctl-nested/2026.266.1801/update.log +++ /dev/null @@ -1,19 +0,0 @@ -WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different charly version). Set CHARLY_PLUGIN_DIR to load plugins from a custom location. -Resolved @github.com/opencharly/plugin-deploy-pod -> v2026.266.1057 (latest tag) -plugin github.com/opencharly/plugin-deploy-pod/candy/plugin-deploy-pod: served from /home/atrawog/.cache/charly/plugins/github.com_opencharly_plugin-deploy-pod_candy_plugin-deploy-pod-32201456c20eec21 (build stamp ff61df62ae33c859); source /home/atrawog/.cache/charly/repos/github.com/opencharly/plugin-deploy-pod@v2026.266.1057/candy/plugin-deploy-pod -Resolved @github.com/opencharly/plugin-deploy-pod -> v2026.266.1057 (latest tag) -WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different charly version). Set CHARLY_PLUGIN_DIR to load plugins from a custom location. -Resolved @github.com/opencharly/plugin-deploy-pod -> v2026.266.1057 (latest tag) -plugin github.com/opencharly/plugin-deploy-pod/candy/plugin-deploy-pod: served from /home/atrawog/.cache/charly/plugins/github.com_opencharly_plugin-deploy-pod_candy_plugin-deploy-pod-32201456c20eec21 (build stamp ff61df62ae33c859); source /home/atrawog/.cache/charly/repos/github.com/opencharly/plugin-deploy-pod@v2026.266.1057/candy/plugin-deploy-pod -Overlay image ready: check-nerdctl-app:check-nerdctl-nested-2026.266.1801 -To start the container, run: charly start check-nerdctl-nested -WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different charly version). Set CHARLY_PLUGIN_DIR to load plugins from a custom location. -Resolved @github.com/opencharly/plugin-deploy-pod -> v2026.266.1057 (latest tag) -plugin github.com/opencharly/plugin-deploy-pod/candy/plugin-deploy-pod: served from /home/atrawog/.cache/charly/plugins/github.com_opencharly_plugin-deploy-pod_candy_plugin-deploy-pod-32201456c20eec21 (build stamp ff61df62ae33c859); source /home/atrawog/.cache/charly/repos/github.com/opencharly/plugin-deploy-pod@v2026.266.1057/candy/plugin-deploy-pod -WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different charly version). Set CHARLY_PLUGIN_DIR to load plugins from a custom location. -Resolved @github.com/opencharly/plugin-deploy-pod -> v2026.266.1057 (latest tag) -plugin plugin-deploy-pod: served from /home/atrawog/.cache/charly/plugins/plugin-deploy-pod-32201456c20eec21 (build stamp ff61df62ae33c859); source /home/atrawog/.cache/charly/repos/github.com/opencharly/plugin-deploy-pod@v2026.266.1057/candy/plugin-deploy-pod -Resolved @github.com/opencharly/plugin-deploy-pod -> v2026.266.1057 (latest tag) -WARNING: charly is a dev/worktree build (not installed at /usr/bin or /usr/local/bin); NOT loading the installed package's plugins from /usr/lib/charly/plugins (they may be built against a different charly version). Set CHARLY_PLUGIN_DIR to load plugins from a custom location. -Resolved @github.com/opencharly/plugin-deploy-pod -> v2026.266.1057 (latest tag) -plugin github.com/opencharly/plugin-deploy-pod/candy/plugin-deploy-pod: served from /home/atrawog/.cache/charly/plugins/github.com_opencharly_plugin-deploy-pod_candy_plugin-deploy-pod-32201456c20eec21 (build stamp ff61df62ae33c859); source /home/atrawog/.cache/charly/repos/github.com/opencharly/plugin-deploy-pod@v2026.266.1057/candy/plugin-deploy-pod diff --git a/.containerignore b/.containerignore deleted file mode 100644 index 3261ac7..0000000 --- a/.containerignore +++ /dev/null @@ -1,17 +0,0 @@ -# .containerignore (generated -- do not edit; source: defaults.context_ignore in charly.yml) -.git -bin -charly -*.md -**/__pycache__ -**/*.pyc -**/*.pyo -**/*.egg-info -**/node_modules -**/.git -**/.DS_Store -**/*~ -**/*.swp -**/*.swo -**/.pytest_cache -**/.mypy_cache diff --git a/.dockerignore b/.dockerignore deleted file mode 100644 index 599b1b8..0000000 --- a/.dockerignore +++ /dev/null @@ -1,17 +0,0 @@ -# .dockerignore (generated -- do not edit; source: defaults.context_ignore in charly.yml) -.git -bin -charly -*.md -**/__pycache__ -**/*.pyc -**/*.pyo -**/*.egg-info -**/node_modules -**/.git -**/.DS_Store -**/*~ -**/*.swp -**/*.swo -**/.pytest_cache -**/.mypy_cache diff --git a/.gitignore b/.gitignore index a093374..8eaede2 100644 --- a/.gitignore +++ b/.gitignore @@ -4,3 +4,6 @@ # Editor / OS .DS_Store *.swp +.check/ +.containerignore +.dockerignore From 1e57b24e21938cbcfc02627c39bc06f65c2fbf8b Mon Sep 17 00:00:00 2001 From: Andreas Trawoeger Date: Wed, 23 Sep 2026 20:18:49 +0200 Subject: [PATCH 08/10] docs: re-freeze the PR body against the final head From dd10336edc863af9919889d8dad3ea9fc169bf2c Mon Sep 17 00:00:00 2001 From: Andreas Trawoeger Date: Wed, 23 Sep 2026 20:26:36 +0200 Subject: [PATCH 09/10] feat(bed): the bed box declares its own ADE plan (deterministic checks) Every new candy/image must ship a description + a plan with >=1 check; the check-nerdctl-app box now asserts nerdctl is installed by the composed candy and the nerdctl.toml is present. --- box/check-nerdctl-app/charly.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/box/check-nerdctl-app/charly.yml b/box/check-nerdctl-app/charly.yml index 6f3bfa2..9b4f66f 100644 --- a/box/check-nerdctl-app/charly.yml +++ b/box/check-nerdctl-app/charly.yml @@ -10,3 +10,9 @@ check-nerdctl-app: base: quay.io/fedora/fedora:43 candy: - layer-nerdctl + plan: + - check: nerdctl is installed by the composed layer-nerdctl candy + command: command -v nerdctl + exit_status: 0 + - check: the nerdctl.toml written by the candy is present + file: /etc/nerdctl/nerdctl.toml From bf91cf8e7c0bb60c9cfec7593de3cfe6ad68c405 Mon Sep 17 00:00:00 2001 From: Andreas Trawoeger Date: Wed, 23 Sep 2026 20:27:02 +0200 Subject: [PATCH 10/10] docs: re-freeze the PR body against the final head