nestybox/kindind repository overview

⁠kindind: kubernetes-in-docker ... in docker :)

⁠Why?

This is useful as a way of encapsulating a full K8s cluster in a single container image and properly isolating it from the underlying host. On the latter point, K8s.io KinD uses unsecure privileged containers; by placing K8s.io KinD inside a Sysbox container, the Sysbox container acts as secure (rootless) boundary around that entire K8s cluster.

It's very useful for CI/CD, local dev environments, learning, and more.

⁠Usage:

$ docker run --runtime=sysbox-runc -it --rm -P --name=syscont --hostname=syscont nestybox/kindind

This will spawn a container which includes systemd, Docker, and the K8s.io KinD⁠ tool inside. Systemd login is "admin/admin". Once you log in you can run K8s.io KinD as if you were in a VM. For example:

admin@syscont ~$ kind create cluster --image=nestybox/kindestnode:v1.18.2

The "nestybox/kindestnode" image is currently required to setup the KinD cluster, because the default kindest/node image used by KinD carries an OCI runc that has a bug that prevents it from running correctly inside a rootless container. That bug is resolved in v1.0.0-rc93 of the OCI runc (released 02/03/2021). Once that version is picked up by the K8s.io KinD kindest/node image, the nestybox/kindestnode image won't be required anymore.