nerdctl

Kubernetes

Docker-compatible CLI for containerd, with Compose and rootless support

containerd/nerdctl

v2.4.0Sep 20, 202662 days after v2.3.5

View on GitHub

v2.4.0

Sep 20, 2026Compare GitHub

This release improves compatibility with Docker v29.

Changes

Major changes (💡 for highlights):

nerdctl image:
- 💡Adopted Docker v29 default nerdctl images output (IMAGE, ID, DISK USAGE, CONTENT SIZE, EXTRA) (#5093, thanks to @ekalinin)
- Added nerdctl images --tree to show a row per platform an image declares, like docker image ls --tree (#5092, thanks to @ekalinin)
- Added nerdctl push --all-tags (-a) to push every local tag of a repository (#5133, thanks to @ekalinin)
- Added nerdctl image convert --erofs {raw|zstd} and aligned EROFS pull/push with containerd (#4927, thanks to @ChengyuZhu6)
- Added nerdctl save --quiet (-q) to suppress progress output (#5064, thanks to @s3onghyun)
- Fixed nerdctl image ls <repo> to list all tags of a bare repository name (#5115, thanks to @ankit090701)
- Added snapshot info to native nerdctl image inspect (#5114, thanks to @ningmingxiao)
- Pinned the image a container runs to its digest (#5125, thanks to @ekalinin)
- Truncated the output file of nerdctl save and nerdctl image export (#5160, thanks to @ekalinin)
- Preserved equals signs in image label filter values (#5163, thanks to @immanuwell)
nerdctl container:
- 💡Added --mount type=image (read-only) (#4990, thanks to @mayur-tolexo)
- Added image-subpath to --mount type=image to mount a relative path inside the image rootfs instead of the whole rootfs (#4993, thanks to @mayur-tolexo)
- Added --expose and --publish-all (-P) (#5036, thanks to @Mujib-Ahasan)
- 💡Added support for the Docker v25 recursive read-only (RRO) mount form (#5043)
- Allocated a free host port from a published port range for a single container port (#4988, thanks to @s3onghyun)
- Added the volume-nocopy mount option, so existing data in the container is not copied into the volume (#5129, thanks to @jiwahn)
- Fixed --cpus writing cpuset instead of CFS quota/period (#5067, thanks to @kmaris)
- Fixed nerdctl run/exec -i hanging when stdin reaches EOF during task creation (#5042)
- Fixed a foreground stdio deadlock when the internal logging process stops consuming (#5151, thanks to @gsaddict91)
- Added snapshot info to native nerdctl container inspect (#5118, thanks to @ningmingxiao)
- Suppressed a spurious hostsstore NotFound warning on container removal (#5098, thanks to @pujitha24)
- Allowed removing containers that have no network annotations (#5211, thanks to @Arman16-1998)
- Matched nerdctl ps --filter keys exactly instead of by prefix (#5197, thanks to @immanuwell)
nerdctl system:
- 💡 Added nerdctl system df, with --verbose (-v) and --format (#5130, thanks to @ekalinin)
nerdctl build:
- Printed the image ID with --quiet when using the containerd worker (#5170, thanks to @locker95)
nerdctl network:
- Added --aux-address support for nerdctl network create (#5041, thanks to @mayur-tolexo)
- Added --ipv4 so --ipv4=false --ipv6 can create IPv6-only networks (#5024, thanks to @mayur-tolexo)
- Matched each --ip-range to its subnet for dual-stack networks (#5018, thanks to @mayur-tolexo)
- Stopped injecting ipRange into the CNI config (#5078, thanks to @mayur-tolexo)
- Keyed Networks in nerdctl inspect by the real CNI network name (#5164, thanks to @larrasket)
- Combined repeated --filter name= values with OR (#5206, thanks to @immanuwell)
- Supported big-endian hosts when parsing /proc/net/{tcp,udp} addresses (#5100, thanks to @larrasket)
nerdctl events:
- Added label-based filtering (#4999, thanks to @Mujib-Ahasan)
- Renamed the Status field to Action to match Docker v29 (#5087, thanks to @Akshitguptaa)
nerdctl login:
- Accepted equivalent registry hosts in the auth creds callback, and normalized bracketed IPv6 addresses (#5128, thanks to @xianyuwu)
nerdctl compose:
- Supported image volumes (services.<SERVICE>.volumes[].type: image) (#5161, thanks to @papidb)
- Stopped requiring CNI plugins for compose projects that do not use CNI (#5132, thanks to @ravi-arnan)
- Allowed detached runs with the default interactive setting (#5212, thanks to @immanuwell)
- Fixed a panic when asserting x-nerdctl-* compose extension types (#5073, thanks to @arpitjain099)
nerdctl info:
- Implemented rootless systemd cgroup discovery, removing a hard-coded cgroup path (#5182, thanks to @chemwolf6922)
nerdctl top:
- Fix handling stopped and paused containers (#5223, thanks to @immanuwell)
Healthcheck:
- Reduced unnecessary function calls (#5048, thanks to @ningmingxiao)
Logging:
- Added --log-file ($NERDCTL_LOG_FILE) to append nerdctl's own log to a file, in addition to the standard error (#5147, thanks to @ekalinin)
Rootless:
- Enabled IPv6 in the RootlessKit network namespace (#5055, thanks to @Akshitguptaa)
nerdctl-full:
- Updated containerd to v2.4.0 and RootlessKit to v3.2.0 (#5144, #5152, #5196, #5209, #5213, #5224, thanks to @ChengyuZhu6 and @haytok)
- Updated BuildKit to v0.33.0, imgcrypt to v2.0.3, and fuse-overlayfs to v1.18 (#5198)
- Updated gomodjail to v2.0.1 and enforced its static analysis in CI (#5192)
Documentation:
- Documented volume :z and :Z SELinux options (#5140, thanks to @VedantMadane)
- Corrected the tmpfs path /var/lib/journal to /var/log/journal (#5162, thanks to @MayCXC)
- Fixed typos in docs (#5146, #5166, thanks to @MsfPablo)
Misc:
- Hid internal alias flags from help output (#5025, thanks to @immanuwell)
CI and tests:
- Updated CI to Ubuntu 26.04 and Docker 29.6.1, and ran integration tests directly on hosts and Lima guests (#5020, #5021, #5035)
- Continued migrating container, network, and compose tests to Tigron (#4780, #5014, #5045, #5056, #5058, #5063, #5069, #5070, #5071, #5074, #5085, #5086, #5094, #5120, thanks to @must108, @takumi12311123, @papidb, @Mujib-Ahasan, and @ogulcanaydogan)
- Published a weekly flaky test dashboard ("Soigneur") and attempted to deflake several tests (#5201, #5217, #5218)
- Printed daemon logs after integration test failures (#5165, thanks to @loglapa)
- Dropped an outdated containerd 1.x plugin requirement from the restart tests (#5185, thanks to @webdevsamran)
- Fixed lint-licenses failing on MPL-2.0 (#5200, thanks to @filipPlevjak)
- Reported gosocialcheck findings as GitHub Actions annotations, and fixed a zizmor failure (#5208, #5215)
And more!

Full changes: https://github.com/containerd/nerdctl/milestone/66?closed=1

Thanks to @ChengyuZhu6, @ekalinin, @mayur-tolexo, @immanuwell, @ningmingxiao, @larrasket, @papidb, @haytok, @Mujib-Ahasan, @s3onghyun, @Akshitguptaa, @MsfPablo, @ankit090701, @ravi-arnan, @arpitjain099, @kmaris, @pujitha24, @VedantMadane, @xianyuwu, @jiwahn, @gsaddict91, @locker95, @chemwolf6922, @Arman16-1998, @loglapa, @webdevsamran, @filipPlevjak, @MayCXC, @ogulcanaydogan, @must108, @takumi12311123, @subotac, and @nikolauspschuetz.

[!NOTE] Claude Opus 5 was used for updating this release note from v2.4.0-beta.0.

Compatible containerd versions

This release of nerdctl is expected to be used with containerd v1.7 or later. Some features may not work with other releases of containerd.

About the binaries

Minimal (nerdctl-2.4.0-linux-amd64.tar.gz): nerdctl only
Full (nerdctl-full-2.4.0-linux-amd64.tar.gz): Includes dependencies such as containerd, runc, and CNI

Minimal

Extract the archive to a path like /usr/local/bin or ~/bin . <details><summary>tar Cxzvvf /usr/local/bin nerdctl-2.4.0-linux-amd64.tar.gz</summary>

-rwxr-xr-x root/root  32395426 2026-09-20 04:26 nerdctl
-rwxr-xr-x root/root     23390 2026-09-20 04:25 containerd-rootless-setuptool.sh
-rwxr-xr-x root/root      9555 2026-09-20 04:25 containerd-rootless.sh

</details>

Full

Extract the archive to a path like /usr/local or ~/.local .

<details><summary>tar Cxzvvf /usr/local nerdctl-full-2.4.0-linux-amd64.tar.gz</summary>

drwxr-xr-x 0/0               0 2026-09-20 04:36 bin/
-rwxr-xr-x 0/0        34512200 2026-09-01 12:47 bin/buildctl
-rwxr-xr-x 0/0        29909144 2025-05-12 13:10 bin/buildg
lrwxrwxrwx 0/0               0 2026-09-20 04:34 bin/buildkit-cni-bandwidth -> ../libexec/cni/bandwidth
lrwxrwxrwx 0/0               0 2026-09-20 04:34 bin/buildkit-cni-bridge -> ../libexec/cni/bridge
lrwxrwxrwx 0/0               0 2026-09-20 04:34 bin/buildkit-cni-dhcp -> ../libexec/cni/dhcp
lrwxrwxrwx 0/0               0 2026-09-20 04:34 bin/buildkit-cni-dummy -> ../libexec/cni/dummy
lrwxrwxrwx 0/0               0 2026-09-20 04:34 bin/buildkit-cni-firewall -> ../libexec/cni/firewall
lrwxrwxrwx 0/0               0 2026-09-20 04:34 bin/buildkit-cni-host-device -> ../libexec/cni/host-device
lrwxrwxrwx 0/0               0 2026-09-20 04:34 bin/buildkit-cni-host-local -> ../libexec/cni/host-local
lrwxrwxrwx 0/0               0 2026-09-20 04:34 bin/buildkit-cni-ipvlan -> ../libexec/cni/ipvlan
lrwxrwxrwx 0/0               0 2026-09-20 04:34 bin/buildkit-cni-loopback -> ../libexec/cni/loopback
lrwxrwxrwx 0/0               0 2026-09-20 04:34 bin/buildkit-cni-macvlan -> ../libexec/cni/macvlan
lrwxrwxrwx 0/0               0 2026-09-20 04:34 bin/buildkit-cni-portmap -> ../libexec/cni/portmap
lrwxrwxrwx 0/0               0 2026-09-20 04:34 bin/buildkit-cni-ptp -> ../libexec/cni/ptp
lrwxrwxrwx 0/0               0 2026-09-20 04:34 bin/buildkit-cni-sbr -> ../libexec/cni/sbr
lrwxrwxrwx 0/0               0 2026-09-20 04:34 bin/buildkit-cni-static -> ../libexec/cni/static
lrwxrwxrwx 0/0               0 2026-09-20 04:34 bin/buildkit-cni-tap -> ../libexec/cni/tap
lrwxrwxrwx 0/0               0 2026-09-20 04:34 bin/buildkit-cni-tuning -> ../libexec/cni/tuning
lrwxrwxrwx 0/0               0 2026-

…(truncated)

v2.3.5

Jul 20, 2026Compare GitHub

Changes

Cherry-picks from main to release/2.3 https://github.com/containerd/nerdctl/pull/5082
- nerdctl-full: Update containerd (2.3.3), RootlessKit (3.0.2), BuildKit (0.31.2), runc (1.5.1)

Full changes: https://github.com/containerd/nerdctl/milestone/67?closed=1

Compatible containerd versions

This release of nerdctl is expected to be used with containerd v1.7, v2.0, v2.1, v2.2, or v2.3. Some features may not work with other releases of containerd.

About the binaries

Minimal (nerdctl-2.3.5-linux-amd64.tar.gz): nerdctl only
Full (nerdctl-full-2.3.5-linux-amd64.tar.gz): Includes dependencies such as containerd, runc, and CNI

Minimal

Extract the archive to a path like /usr/local/bin or ~/bin . <details><summary>tar Cxzvvf /usr/local/bin nerdctl-2.3.5-linux-amd64.tar.gz</summary>

-rwxr-xr-x root/root  31334562 2026-07-20 07:58 nerdctl
-rwxr-xr-x root/root     23381 2026-07-20 07:57 containerd-rootless-setuptool.sh
-rwxr-xr-x root/root      8639 2026-07-20 07:57 containerd-rootless.sh

</details>

Full

Extract the archive to a path like /usr/local or ~/.local .

<details><summary>tar Cxzvvf /usr/local nerdctl-full-2.3.5-linux-amd64.tar.gz</summary>

drwxr-xr-x 0/0               0 2026-07-20 08:07 bin/
-rwxr-xr-x 0/0        34352159 2026-07-16 13:59 bin/buildctl
-rwxr-xr-x 0/0        29909144 2025-05-12 13:10 bin/buildg
lrwxrwxrwx 0/0               0 2026-07-20 08:06 bin/buildkit-cni-bandwidth -> ../libexec/cni/bandwidth
lrwxrwxrwx 0/0               0 2026-07-20 08:06 bin/buildkit-cni-bridge -> ../libexec/cni/bridge
lrwxrwxrwx 0/0               0 2026-07-20 08:06 bin/buildkit-cni-dhcp -> ../libexec/cni/dhcp
lrwxrwxrwx 0/0               0 2026-07-20 08:06 bin/buildkit-cni-dummy -> ../libexec/cni/dummy
lrwxrwxrwx 0/0               0 2026-07-20 08:06 bin/buildkit-cni-firewall -> ../libexec/cni/firewall
lrwxrwxrwx 0/0               0 2026-07-20 08:06 bin/buildkit-cni-host-device -> ../libexec/cni/host-device
lrwxrwxrwx 0/0               0 2026-07-20 08:06 bin/buildkit-cni-host-local -> ../libexec/cni/host-local
lrwxrwxrwx 0/0               0 2026-07-20 08:06 bin/buildkit-cni-ipvlan -> ../libexec/cni/ipvlan
lrwxrwxrwx 0/0               0 2026-07-20 08:06 bin/buildkit-cni-loopback -> ../libexec/cni/loopback
lrwxrwxrwx 0/0               0 2026-07-20 08:06 bin/buildkit-cni-macvlan -> ../libexec/cni/macvlan
lrwxrwxrwx 0/0               0 2026-07-20 08:06 bin/buildkit-cni-portmap -> ../libexec/cni/portmap
lrwxrwxrwx 0/0               0 2026-07-20 08:06 bin/buildkit-cni-ptp -> ../libexec/cni/ptp
lrwxrwxrwx 0/0               0 2026-07-20 08:06 bin/buildkit-cni-sbr -> ../libexec/cni/sbr
lrwxrwxrwx 0/0               0 2026-07-20 08:06 bin/buildkit-cni-static -> ../libexec/cni/static
lrwxrwxrwx 0/0               0 2026-07-20 08:06 bin/buildkit-cni-tap -> ../libexec/cni/tap
lrwxrwxrwx 0/0               0 2026-07-20 08:06 bin/buildkit-cni-tuning -> ../libexec/cni/tuning
lrwxrwxrwx 0/0               0 2026-07-20 08:06 bin/buildkit-cni-vlan -> ../libexec/cni/vlan
lrwxrwxrwx 0/0               0 2026-07-20 08:06 bin/buildkit-cni-vrf -> ../libexec/cni/vrf
-rwxr-xr-x 0/0        79620820 2026-07-16 13:59 bin/buildkitd
-rwxr-xr-x 0/0        16853648 2026-07-20 08:05 bin/bypass4netns
-rwxr-xr-x 0/0         6607010 2026-07-20 08:05 bin/bypass4netnsd
-rwxr-xr-x 0/0        39472016 2026-07-20 08:06 bin/containerd
-rwxr-xr-x 0/0        12079288 2025-11-06 01:44 bin/containerd-fuse-overlayfs-grpc
-rwxr-xr-x 0/0           23381 2026-07-20 08:07 bin/containerd-rootless-setuptool.sh
-rwxr-xr-x 0/0            8639 2026-07-20 08:07 bin/containerd-rootless.sh
-rwxr-xr-x 0/0         8458402 2026-07-20 08:06 bin/containerd-shim-runc-v2
-rwxr-xr-x 0/0        55267512 2026-01-21 14:59 bin/containerd-stargz-grpc
-rwxr-xr-x 0/0        23592589 2026-07-20 08:06 bin/ctd-decoder
-rwxr-xr-x 0/0        22597794 2026-07-20 08:05 bin/ctr
-rwxr-xr-x 0/0        31235564 2026-07-20 08:06 bin/ctr-enc
-rwxr-xr-x 0/0        23417016 2026-01-21 14:59 bin/ctr-remote
-rwxr-xr-x 0/0         1695448 2026-07-20 08:06 bin/fuse-overlayfs
-rwxr-xr-x 0/0         7913634 2026-07-20 08:05 bin/gomodjail
-rwxr-xr-x 0/0        31297698 2026-07-20 08:07 bin/nerdctl
-rwxr-xr-x 0/0        39219232 2026-07-20 08:07 bin/nerdctl.gomodjail
-rwxr-xr-x 0/0        12048966 2026-07-10 15:13 bin/rootlessctl
-rwxr-xr-x 0/0        23474629 2026-07-10 15:13 bin/rootlesskit
-rwxr-xr-x 0/0        15249872 2026-07-20 08:05 bin/runc
-rwxr-xr-x 0/0        53829816 2026-01-21 14:59 bin/stargz-fuse-manager
-rwxr-xr-x 0/0        10821816 2026-01-21 14:59 bin/stargz-store-helper
-rwxr-xr-x 0/0          870496 2026-07-20 08:06 bin/tini
drwxr-xr-x 0/0               0 2026-07-20 08:06 lib/
drwxr-xr-x 0/0               0 2026-07-20 08:06 lib/systemd/
drwxr-xr-x 0/0               0 2026-07-20 08:06 lib/systemd/system/
-rw-r--r-- 0/0            1309 2026-07-20 08:06 lib/systemd/system/buildkit.service
-rw-r--r-- 0/0            1248 2026-07-20 08:04 lib/systemd/system/containerd.service
-rw-r--r-- 0/0             312 2026-07-20 08:06 lib/systemd/system/stargz-snapshotter.service
drwxr-xr-x 0/0               0 2026-07-20 08:06 libexec/
drwxr-xr-x 0/0               0 2026-03-16 14:18 libexec/cni/
-rw-r--r-- 0/0           11357 2026-03-16 14:18 libexec/cni/LICENSE
-rw-r--r-- 0/0            2343 2026-03-16 14:18 libexec/cni/README.md
-rwxr-xr-x 0/0         5042926 2026-03-16 14:18 libexec/cni/bandwidth
-rwxr-xr-x 0/0         5698763 2026-03-16 14:18 libexec/cni/bridge
-rwxr-xr-x 0/0        13725422 2026-03-16 14:18 libexec/cni/dhcp
-rwxr-xr-x 0/0         5251069 2026-03-16 14:18 libexec/cni/dummy
-rwxr-xr-x 0/0         5702145 2026-03-16 14:18 libexec/cni/firewall
-rwxr-xr-x 0/0         5159967 2026-03-16 14:18 libexec/cni/host-device
-rwxr-xr-x 0/0         4350778 2026-03-16 14:18 libexec/cni/host-local
-rwxr-xr-x 0/0         5274322 2026-03-16 14:18 libexec/cni/ipvlan
-rwxr-xr-x 0/0         4302030 2026-03-16 14:18 libexec/cni/loopback
-rwxr-xr-x 0/0         5307111 2026-03-16 14:18 libexec/cni/macvlan
-rwxr-xr-x 0/0         5108385 2026-03-16 14:18 libexec/cni/portmap
-rwxr-xr-x 0/0         5475470 2026-03-16 14:18 libexec/cni/ptp
-rwxr-xr-x 0/0         4525826 2026-03-16 14:18 libexec/cni/sbr
-rwxr-xr-x 0/0         3776708 2026-03-16 14:18 libexec/cni/static
-rwxr-xr-x 0/0         5453308 2026-03-16 14:18 libexec/cni/tap
-rwxr-xr-x 0/0         4389084 2026-03-16 14:18 libexec/cni/tuning
-rwxr-xr-x 0/0         5267679 2026-03-16 14:18 libexec/cni/vlan
-rwxr-xr-x 0/0         4685012 2026-03-16 14:18 libexec/cni/vrf
drwxr-xr-x 0/0               0 2026-07-20 08:04 share/
drwxr-xr-x 0/0               0 2026-07-20 08:07 share/doc/
drwxr-xr-x 0/0               0 2026-07-20 08:07 share/doc/nerdctl/
-rw-r--r-- 0/0           12145 2026-07-20 07:57 share/doc/nerdctl/README.md
drwxr-xr-x 0/0               0 2026-07-20 07:57 share/doc/nerdctl/docs/
-rw-r--r-- 0/0            3953 2026-07-20 07:57 share/doc/nerdctl/docs/build.md
-rw-r--r-- 0/0            2570 2026-07-20 07:57 share/doc/nerdctl/docs/builder-debug.md
-rw-r--r-- 0/0            4779 2026-07-20 07:57 share/doc/nerdctl/docs/cni.md
-rw-r--r-- 0/0           90939 2026-07-20 07:57 share/doc/nerdctl/docs/command-reference.md
-rw-r--r-- 0/0            1829 2026-07-20 07:57 share/doc/nerdctl/docs/compose.md
-rw-r--r-- 0/0            7592 2026-07-20 07:57 share/doc/nerdctl/docs/config.md
-rw-r--r-- 0/0            9128 2026-07-20 07:57 share/doc/nerdctl/docs/cosign.md
-rw-r--r-- 0/0            5660 2026-07-20 07:57 share/doc/nerdctl/docs/cvmfs.md
drwxr-xr-x 0/0               0 2026-07-20 07:57 share/doc/nerdctl/docs/dev/
-rw-r--r-- 0/0           12701 2026-07-20 07:57 share/doc/nerdctl/docs/dev/auditing_dockerfile.md
-rw-r--r-- 0/0            8586 2026-07-20 07:57 share/doc/nerdctl/docs/dev/store.md
-rw-r--r-- 0/0            2879 2026-07-20 07:57 share/doc/nerdctl/docs/dir.md
-rw-r--r-- 0/0             906 2026-07-20 07:57 share/doc/nerdctl/docs/experimental.md
-rw-r--r-- 0/0           14757 2026-07-20 07:57 share/doc/nerdctl/docs/faq.md
-rw-r--r-- 0/0             884 2026-07-20 07:57 share/doc/nerdctl/docs/freebsd.md
-rw-r--r-- 0/0            5585 2026-07-20 07:57 share/doc/nerdctl/docs/gpu.md
-rw-r--r-- 0/0            3419 2026-07-20 07:57 share/doc/nerdctl/docs/healthchecks.md
drwxr-xr-x 0/0               0 2026-07-20 07:57 share/doc/nerdctl/docs/images/
-rw-r--r-- 0/0            1540 2026-07-20 07:57 share/doc/nerdctl/docs/images/nerdctl-white.svg
-rw-r--r-- 0/0            1462 2026-07-20 07:57 share/doc/nerdctl/docs/images/nerdctl.svg
-rw-r--r-- 0/0          684421 2026-07-20 07:57 share/doc/nerdctl/docs/images/rootlessKit-network-design.png
-rw-r--r-- 0/0           14462 2026-07-20 07:57 share/doc/nerdctl/docs/ipfs.md
-rw-r--r-- 0/0            2426 2026-07-20 07:57 share/doc/nerdctl/docs/multi-platform.md
-rw-r--r-- 0/0            2960 2026-07-20 07:57 share/doc/nerdctl/docs/notation.md
-rw-r--r-- 0/0            2805 2026-07-20 07:57 share/doc/nerdctl/docs/nydus.md
-rw-r--r-- 0/0            3277 2026-07-20 07:57 share/doc/nerdctl/docs/ocicrypt.md
-rw-r--r-- 0/0            2215 2026-07-20 07:57 share/doc/nerdctl/docs/overlaybd.md
-rw-r--r-- 0/0           15657 2026-07-20 07:57 share/doc/nerdctl/docs/registry.md
-rw-r--r-- 0/0            9388 2026-07-20 07:57 share/doc/nerdctl/docs/rootless.md
-rw-r--r-- 0/0            4126 2026-07-20 07:57 share/doc/nerdctl/docs/soci.md
-rw-r--r-- 0/0           11912 2026-07-20 07:57 share/doc/nerdctl/docs/stargz.md
drwxr-xr-x 0/0               0 2026-07-20 07:57 share/doc/nerdctl/docs/testing/
-rw-r--r-- 0/0            4897 2026-07-20 07:57 share/doc/nerdctl/docs/testing/README.md
-rw-r--r-- 0/0           16694 2026-07-20 07:57 share/doc/nerdctl/docs/testing/tools.md
drwxr-xr-x 0/0               0 2026-07-20 08:07 share/d

…(truncated)

v2.3.4

Jun 29, 2026Compare GitHub

Changes

nerdctl run:
- Allow -i and -d together when -t is set (#4989, thanks to @mayur-tolexo)
- Remove the non-Docker rw option from --mount (#4992, thanks to @mayur-tolexo)
nerdctl network create
- Match each gateway to its subnet for dual-stack (#5010, thanks to @mayur-tolexo)
nerdctl (container|image|network) inspect
- Fix format errors (#5019, thanks to @immanuwell)
nerdctl version
- Show RootlessKit version (#4971, thanks to @amarkdotdev)
nerdctl-full:
- update runc (1.5.0), BuildKit (0.31.1) (#5002)

Full changes: https://github.com/containerd/nerdctl/pulls?q=is%3Apr+milestone%3Av2.3.4+is%3Aclosed Thanks to @amarkdotdev @immanuwell @mayur-tolexo

Compatible containerd versions

This release of nerdctl is expected to be used with containerd v1.7, v2.0, v2.1, v2.2, or v2.3. Some features may not work with other releases of containerd.

About the binaries

Minimal (nerdctl-2.3.4-linux-amd64.tar.gz): nerdctl only
Full (nerdctl-full-2.3.4-linux-amd64.tar.gz): Includes dependencies such as containerd, runc, and CNI

Minimal

Extract the archive to a path like /usr/local/bin or ~/bin . <details><summary>tar Cxzvvf /usr/local/bin nerdctl-2.3.4-linux-amd64.tar.gz</summary>

-rwxr-xr-x root/root  31334562 2026-06-29 08:36 nerdctl
-rwxr-xr-x root/root     23381 2026-06-29 08:35 containerd-rootless-setuptool.sh
-rwxr-xr-x root/root      8639 2026-06-29 08:35 containerd-rootless.sh

</details>

Full

Extract the archive to a path like /usr/local or ~/.local .

<details><summary>tar Cxzvvf /usr/local nerdctl-full-2.3.4-linux-amd64.tar.gz</summary>

drwxr-xr-x 0/0               0 2026-06-29 08:44 bin/
-rwxr-xr-x 0/0        34345100 2026-06-24 17:16 bin/buildctl
-rwxr-xr-x 0/0        29909144 2025-05-12 13:10 bin/buildg
lrwxrwxrwx 0/0               0 2026-06-29 08:43 bin/buildkit-cni-bandwidth -> ../libexec/cni/bandwidth
lrwxrwxrwx 0/0               0 2026-06-29 08:43 bin/buildkit-cni-bridge -> ../libexec/cni/bridge
lrwxrwxrwx 0/0               0 2026-06-29 08:43 bin/buildkit-cni-dhcp -> ../libexec/cni/dhcp
lrwxrwxrwx 0/0               0 2026-06-29 08:43 bin/buildkit-cni-dummy -> ../libexec/cni/dummy
lrwxrwxrwx 0/0               0 2026-06-29 08:43 bin/buildkit-cni-firewall -> ../libexec/cni/firewall
lrwxrwxrwx 0/0               0 2026-06-29 08:43 bin/buildkit-cni-host-device -> ../libexec/cni/host-device
lrwxrwxrwx 0/0               0 2026-06-29 08:43 bin/buildkit-cni-host-local -> ../libexec/cni/host-local
lrwxrwxrwx 0/0               0 2026-06-29 08:43 bin/buildkit-cni-ipvlan -> ../libexec/cni/ipvlan
lrwxrwxrwx 0/0               0 2026-06-29 08:43 bin/buildkit-cni-loopback -> ../libexec/cni/loopback
lrwxrwxrwx 0/0               0 2026-06-29 08:43 bin/buildkit-cni-macvlan -> ../libexec/cni/macvlan
lrwxrwxrwx 0/0               0 2026-06-29 08:43 bin/buildkit-cni-portmap -> ../libexec/cni/portmap
lrwxrwxrwx 0/0               0 2026-06-29 08:43 bin/buildkit-cni-ptp -> ../libexec/cni/ptp
lrwxrwxrwx 0/0               0 2026-06-29 08:43 bin/buildkit-cni-sbr -> ../libexec/cni/sbr
lrwxrwxrwx 0/0               0 2026-06-29 08:43 bin/buildkit-cni-static -> ../libexec/cni/static
lrwxrwxrwx 0/0               0 2026-06-29 08:43 bin/buildkit-cni-tap -> ../libexec/cni/tap
lrwxrwxrwx 0/0               0 2026-06-29 08:43 bin/buildkit-cni-tuning -> ../libexec/cni/tuning
lrwxrwxrwx 0/0               0 2026-06-29 08:43 bin/buildkit-cni-vlan -> ../libexec/cni/vlan
lrwxrwxrwx 0/0               0 2026-06-29 08:43 bin/buildkit-cni-vrf -> ../libexec/cni/vrf
-rwxr-xr-x 0/0        79608020 2026-06-24 17:16 bin/buildkitd
-rwxr-xr-x 0/0        16853648 2026-06-29 08:43 bin/bypass4netns
-rwxr-xr-x 0/0         6607010 2026-06-29 08:43 bin/bypass4netnsd
-rwxr-xr-x 0/0        39463824 2026-06-29 08:43 bin/containerd
-rwxr-xr-x 0/0        12079288 2025-11-06 01:44 bin/containerd-fuse-overlayfs-grpc
-rwxr-xr-x 0/0           23381 2026-06-29 08:44 bin/containerd-rootless-setuptool.sh
-rwxr-xr-x 0/0            8639 2026-06-29 08:44 bin/containerd-rootless.sh
-rwxr-xr-x 0/0         8458402 2026-06-29 08:43 bin/containerd-shim-runc-v2
-rwxr-xr-x 0/0        55267512 2026-01-21 14:59 bin/containerd-stargz-grpc
-rwxr-xr-x 0/0        23592005 2026-06-29 08:44 bin/ctd-decoder
-rwxr-xr-x 0/0        22585506 2026-06-29 08:43 bin/ctr
-rwxr-xr-x 0/0        31234900 2026-06-29 08:44 bin/ctr-enc
-rwxr-xr-x 0/0        23417016 2026-01-21 14:59 bin/ctr-remote
-rwxr-xr-x 0/0         1695448 2026-06-29 08:44 bin/fuse-overlayfs
-rwxr-xr-x 0/0         7913634 2026-06-29 08:42 bin/gomodjail
-rwxr-xr-x 0/0        31297698 2026-06-29 08:44 bin/nerdctl
-rwxr-xr-x 0/0        39219232 2026-06-29 08:44 bin/nerdctl.gomodjail
-rwxr-xr-x 0/0        12041664 2026-05-27 10:30 bin/rootlessctl
-rwxr-xr-x 0/0        23473018 2026-05-27 10:30 bin/rootlesskit
-rwxr-xr-x 0/0        15245480 2026-06-29 08:42 bin/runc
-rwxr-xr-x 0/0        53829816 2026-01-21 14:59 bin/stargz-fuse-manager
-rwxr-xr-x 0/0        10821816 2026-01-21 14:59 bin/stargz-store-helper
-rwxr-xr-x 0/0          870496 2026-06-29 08:44 bin/tini
drwxr-xr-x 0/0               0 2026-06-29 08:43 lib/
drwxr-xr-x 0/0               0 2026-06-29 08:43 lib/systemd/
drwxr-xr-x 0/0               0 2026-06-29 08:43 lib/systemd/system/
-rw-r--r-- 0/0            1309 2026-06-29 08:43 lib/systemd/system/buildkit.service
-rw-r--r-- 0/0            1248 2026-06-29 08:42 lib/systemd/system/containerd.service
-rw-r--r-- 0/0             312 2026-06-29 08:43 lib/systemd/system/stargz-snapshotter.service
drwxr-xr-x 0/0               0 2026-06-29 08:43 libexec/
drwxr-xr-x 0/0               0 2026-03-16 14:18 libexec/cni/
-rw-r--r-- 0/0           11357 2026-03-16 14:18 libexec/cni/LICENSE
-rw-r--r-- 0/0            2343 2026-03-16 14:18 libexec/cni/README.md
-rwxr-xr-x 0/0         5042926 2026-03-16 14:18 libexec/cni/bandwidth
-rwxr-xr-x 0/0         5698763 2026-03-16 14:18 libexec/cni/bridge
-rwxr-xr-x 0/0        13725422 2026-03-16 14:18 libexec/cni/dhcp
-rwxr-xr-x 0/0         5251069 2026-03-16 14:18 libexec/cni/dummy
-rwxr-xr-x 0/0         5702145 2026-03-16 14:18 libexec/cni/firewall
-rwxr-xr-x 0/0         5159967 2026-03-16 14:18 libexec/cni/host-device
-rwxr-xr-x 0/0         4350778 2026-03-16 14:18 libexec/cni/host-local
-rwxr-xr-x 0/0         5274322 2026-03-16 14:18 libexec/cni/ipvlan
-rwxr-xr-x 0/0         4302030 2026-03-16 14:18 libexec/cni/loopback
-rwxr-xr-x 0/0         5307111 2026-03-16 14:18 libexec/cni/macvlan
-rwxr-xr-x 0/0         5108385 2026-03-16 14:18 libexec/cni/portmap
-rwxr-xr-x 0/0         5475470 2026-03-16 14:18 libexec/cni/ptp
-rwxr-xr-x 0/0         4525826 2026-03-16 14:18 libexec/cni/sbr
-rwxr-xr-x 0/0         3776708 2026-03-16 14:18 libexec/cni/static
-rwxr-xr-x 0/0         5453308 2026-03-16 14:18 libexec/cni/tap
-rwxr-xr-x 0/0         4389084 2026-03-16 14:18 libexec/cni/tuning
-rwxr-xr-x 0/0         5267679 2026-03-16 14:18 libexec/cni/vlan
-rwxr-xr-x 0/0         4685012 2026-03-16 14:18 libexec/cni/vrf
drwxr-xr-x 0/0               0 2026-06-29 08:42 share/
drwxr-xr-x 0/0               0 2026-06-29 08:44 share/doc/
drwxr-xr-x 0/0               0 2026-06-29 08:44 share/doc/nerdctl/
-rw-r--r-- 0/0           12145 2026-06-29 08:35 share/doc/nerdctl/README.md
drwxr-xr-x 0/0               0 2026-06-29 08:35 share/doc/nerdctl/docs/
-rw-r--r-- 0/0            3953 2026-06-29 08:35 share/doc/nerdctl/docs/build.md
-rw-r--r-- 0/0            2570 2026-06-29 08:35 share/doc/nerdctl/docs/builder-debug.md
-rw-r--r-- 0/0            4779 2026-06-29 08:35 share/doc/nerdctl/docs/cni.md
-rw-r--r-- 0/0           90939 2026-06-29 08:35 share/doc/nerdctl/docs/command-reference.md
-rw-r--r-- 0/0            1829 2026-06-29 08:35 share/doc/nerdctl/docs/compose.md
-rw-r--r-- 0/0            7592 2026-06-29 08:35 share/doc/nerdctl/docs/config.md
-rw-r--r-- 0/0            9128 2026-06-29 08:35 share/doc/nerdctl/docs/cosign.md
-rw-r--r-- 0/0            5660 2026-06-29 08:35 share/doc/nerdctl/docs/cvmfs.md
drwxr-xr-x 0/0               0 2026-06-29 08:35 share/doc/nerdctl/docs/dev/
-rw-r--r-- 0/0           12701 2026-06-29 08:35 share/doc/nerdctl/docs/dev/auditing_dockerfile.md
-rw-r--r-- 0/0            8586 2026-06-29 08:35 share/doc/nerdctl/docs/dev/store.md
-rw-r--r-- 0/0            2879 2026-06-29 08:35 share/doc/nerdctl/docs/dir.md
-rw-r--r-- 0/0             906 2026-06-29 08:35 share/doc/nerdctl/docs/experimental.md
-rw-r--r-- 0/0           14757 2026-06-29 08:35 share/doc/nerdctl/docs/faq.md
-rw-r--r-- 0/0             884 2026-06-29 08:35 share/doc/nerdctl/docs/freebsd.md
-rw-r--r-- 0/0            5585 2026-06-29 08:35 share/doc/nerdctl/docs/gpu.md
-rw-r--r-- 0/0            3419 2026-06-29 08:35 share/doc/nerdctl/docs/healthchecks.md
drwxr-xr-x 0/0               0 2026-06-29 08:35 share/doc/nerdctl/docs/images/
-rw-r--r-- 0/0            1540 2026-06-29 08:35 share/doc/nerdctl/docs/images/nerdctl-white.svg
-rw-r--r-- 0/0            1462 2026-06-29 08:35 share/doc/nerdctl/docs/images/nerdctl.svg
-rw-r--r-- 0/0          684421 2026-06-29 08:35 share/doc/nerdctl/docs/images/rootlessKit-network-design.png
-rw-r--r-- 0/0           14462 2026-06-29 08:35 share/doc/nerdctl/docs/ipfs.md
-rw-r--r-- 0/0            2426 2026-06-29 08:35 share/doc/nerdctl/docs/multi-platform.md
-rw-r--r-- 0/0            2960 2026-06-29 08:35 share/doc/nerdctl/docs/notation.md
-rw-r--r-- 0/0            2805 2026-06-29 08:35 share/doc/nerdctl/docs/nydus.md
-rw-r--r-- 0/0            3277 2026-06-29 08:35 share/doc/nerdctl/docs/ocicrypt.md
-rw-r--r-- 0/0            2215 2026-06-29 08:35 share/doc/nerdctl/docs/overlaybd.md
-rw-r--r-- 0/0           15657 2026-06-29 08:35 share/doc/nerdctl/docs/registry.md
-rw-r--r-- 0/0            9388 2026-06-29 08:35 share/doc/nerdctl/docs/rootless.md
-rw-r--r-- 0/0            4126

…(truncated)

v2.3.3

Jun 19, 2026Compare GitHub

Changes

nerdctl compose run:
- Honor --workdir (#4986, thanks to @immanuwell)
nerdctl network inspect:
- Support pseudo networks (#4953, thanks to @immanuwell)
nerdctl container inspect:
- Suppress warning message on a stopped container (#4967, thanks to @haytok)
Misc:
- Remove duplicated defaults from help output (#4972, thanks to @immanuwell)
go.mod:
- Update containerd library to v2.3.2 and use the new WithImageConfigLabels function (#4985, #4982)
  - Fixes CVE-2026-53488 "image-config LABEL flows to host-root command execution from an image pull" (affected nerdctl as well as CRI)
nerdctl-full:
- Update containerd to v2.3.2 (#4976)
  - Fixes CVE-2026-50195, CVE-2026-53488, CVE-2026-53492, CVE-2026-53489, CVE-2026-47262
- Update BuildKit to v0.31.0 (#4983)

Full changes: https://github.com/containerd/nerdctl/milestone/63?closed=1 Thanks to @haytok @immanuwell @opjt

Compatible containerd versions

This release of nerdctl is expected to be used with containerd v1.7, v2.0, v2.1, v2.2, or v2.3. Some features may not work with other releases of containerd.

About the binaries

Minimal (nerdctl-2.3.3-linux-amd64.tar.gz): nerdctl only
Full (nerdctl-full-2.3.3-linux-amd64.tar.gz): Includes dependencies such as containerd, runc, and CNI

Minimal

Extract the archive to a path like /usr/local/bin or ~/bin . <details><summary>tar Cxzvvf /usr/local/bin nerdctl-2.3.3-linux-amd64.tar.gz</summary>

-rwxr-xr-x root/root  31322274 2026-06-19 10:30 nerdctl
-rwxr-xr-x root/root     23381 2026-06-19 10:29 containerd-rootless-setuptool.sh
-rwxr-xr-x root/root      8639 2026-06-19 10:29 containerd-rootless.sh

</details>

Full

Extract the archive to a path like /usr/local or ~/.local .

<details><summary>tar Cxzvvf /usr/local nerdctl-full-2.3.3-linux-amd64.tar.gz</summary>

drwxr-xr-x 0/0               0 2026-06-19 10:39 bin/
-rwxr-xr-x 0/0        34344956 2026-06-16 17:37 bin/buildctl
-rwxr-xr-x 0/0        29909144 2025-05-12 13:10 bin/buildg
lrwxrwxrwx 0/0               0 2026-06-19 10:38 bin/buildkit-cni-bandwidth -> ../libexec/cni/bandwidth
lrwxrwxrwx 0/0               0 2026-06-19 10:38 bin/buildkit-cni-bridge -> ../libexec/cni/bridge
lrwxrwxrwx 0/0               0 2026-06-19 10:38 bin/buildkit-cni-dhcp -> ../libexec/cni/dhcp
lrwxrwxrwx 0/0               0 2026-06-19 10:38 bin/buildkit-cni-dummy -> ../libexec/cni/dummy
lrwxrwxrwx 0/0               0 2026-06-19 10:38 bin/buildkit-cni-firewall -> ../libexec/cni/firewall
lrwxrwxrwx 0/0               0 2026-06-19 10:38 bin/buildkit-cni-host-device -> ../libexec/cni/host-device
lrwxrwxrwx 0/0               0 2026-06-19 10:38 bin/buildkit-cni-host-local -> ../libexec/cni/host-local
lrwxrwxrwx 0/0               0 2026-06-19 10:38 bin/buildkit-cni-ipvlan -> ../libexec/cni/ipvlan
lrwxrwxrwx 0/0               0 2026-06-19 10:38 bin/buildkit-cni-loopback -> ../libexec/cni/loopback
lrwxrwxrwx 0/0               0 2026-06-19 10:38 bin/buildkit-cni-macvlan -> ../libexec/cni/macvlan
lrwxrwxrwx 0/0               0 2026-06-19 10:38 bin/buildkit-cni-portmap -> ../libexec/cni/portmap
lrwxrwxrwx 0/0               0 2026-06-19 10:38 bin/buildkit-cni-ptp -> ../libexec/cni/ptp
lrwxrwxrwx 0/0               0 2026-06-19 10:38 bin/buildkit-cni-sbr -> ../libexec/cni/sbr
lrwxrwxrwx 0/0               0 2026-06-19 10:38 bin/buildkit-cni-static -> ../libexec/cni/static
lrwxrwxrwx 0/0               0 2026-06-19 10:38 bin/buildkit-cni-tap -> ../libexec/cni/tap
lrwxrwxrwx 0/0               0 2026-06-19 10:38 bin/buildkit-cni-tuning -> ../libexec/cni/tuning
lrwxrwxrwx 0/0               0 2026-06-19 10:38 bin/buildkit-cni-vlan -> ../libexec/cni/vlan
lrwxrwxrwx 0/0               0 2026-06-19 10:38 bin/buildkit-cni-vrf -> ../libexec/cni/vrf
-rwxr-xr-x 0/0        79597466 2026-06-16 17:37 bin/buildkitd
-rwxr-xr-x 0/0        16853648 2026-06-19 10:37 bin/bypass4netns
-rwxr-xr-x 0/0         6607010 2026-06-19 10:37 bin/bypass4netnsd
-rwxr-xr-x 0/0        39463824 2026-06-19 10:38 bin/containerd
-rwxr-xr-x 0/0        12079288 2025-11-06 01:44 bin/containerd-fuse-overlayfs-grpc
-rwxr-xr-x 0/0           23381 2026-06-19 10:39 bin/containerd-rootless-setuptool.sh
-rwxr-xr-x 0/0            8639 2026-06-19 10:39 bin/containerd-rootless.sh
-rwxr-xr-x 0/0         8458402 2026-06-19 10:38 bin/containerd-shim-runc-v2
-rwxr-xr-x 0/0        55267512 2026-01-21 14:59 bin/containerd-stargz-grpc
-rwxr-xr-x 0/0        23592005 2026-06-19 10:38 bin/ctd-decoder
-rwxr-xr-x 0/0        22585506 2026-06-19 10:37 bin/ctr
-rwxr-xr-x 0/0        31234900 2026-06-19 10:38 bin/ctr-enc
-rwxr-xr-x 0/0        23417016 2026-01-21 14:59 bin/ctr-remote
-rwxr-xr-x 0/0         1695448 2026-06-19 10:38 bin/fuse-overlayfs
-rwxr-xr-x 0/0         7913634 2026-06-19 10:37 bin/gomodjail
-rwxr-xr-x 0/0        31285410 2026-06-19 10:39 bin/nerdctl
-rwxr-xr-x 0/0        39206944 2026-06-19 10:39 bin/nerdctl.gomodjail
-rwxr-xr-x 0/0        12041664 2026-05-27 10:30 bin/rootlessctl
-rwxr-xr-x 0/0        23473018 2026-05-27 10:30 bin/rootlesskit
-rwxr-xr-x 0/0        17096920 2026-06-19 10:37 bin/runc
-rwxr-xr-x 0/0        53829816 2026-01-21 14:59 bin/stargz-fuse-manager
-rwxr-xr-x 0/0        10821816 2026-01-21 14:59 bin/stargz-store-helper
-rwxr-xr-x 0/0          870496 2026-06-19 10:38 bin/tini
drwxr-xr-x 0/0               0 2026-06-19 10:38 lib/
drwxr-xr-x 0/0               0 2026-06-19 10:38 lib/systemd/
drwxr-xr-x 0/0               0 2026-06-19 10:38 lib/systemd/system/
-rw-r--r-- 0/0            1309 2026-06-19 10:38 lib/systemd/system/buildkit.service
-rw-r--r-- 0/0            1248 2026-06-19 10:36 lib/systemd/system/containerd.service
-rw-r--r-- 0/0             312 2026-06-19 10:38 lib/systemd/system/stargz-snapshotter.service
drwxr-xr-x 0/0               0 2026-06-19 10:38 libexec/
drwxr-xr-x 0/0               0 2026-03-16 14:18 libexec/cni/
-rw-r--r-- 0/0           11357 2026-03-16 14:18 libexec/cni/LICENSE
-rw-r--r-- 0/0            2343 2026-03-16 14:18 libexec/cni/README.md
-rwxr-xr-x 0/0         5042926 2026-03-16 14:18 libexec/cni/bandwidth
-rwxr-xr-x 0/0         5698763 2026-03-16 14:18 libexec/cni/bridge
-rwxr-xr-x 0/0        13725422 2026-03-16 14:18 libexec/cni/dhcp
-rwxr-xr-x 0/0         5251069 2026-03-16 14:18 libexec/cni/dummy
-rwxr-xr-x 0/0         5702145 2026-03-16 14:18 libexec/cni/firewall
-rwxr-xr-x 0/0         5159967 2026-03-16 14:18 libexec/cni/host-device
-rwxr-xr-x 0/0         4350778 2026-03-16 14:18 libexec/cni/host-local
-rwxr-xr-x 0/0         5274322 2026-03-16 14:18 libexec/cni/ipvlan
-rwxr-xr-x 0/0         4302030 2026-03-16 14:18 libexec/cni/loopback
-rwxr-xr-x 0/0         5307111 2026-03-16 14:18 libexec/cni/macvlan
-rwxr-xr-x 0/0         5108385 2026-03-16 14:18 libexec/cni/portmap
-rwxr-xr-x 0/0         5475470 2026-03-16 14:18 libexec/cni/ptp
-rwxr-xr-x 0/0         4525826 2026-03-16 14:18 libexec/cni/sbr
-rwxr-xr-x 0/0         3776708 2026-03-16 14:18 libexec/cni/static
-rwxr-xr-x 0/0         5453308 2026-03-16 14:18 libexec/cni/tap
-rwxr-xr-x 0/0         4389084 2026-03-16 14:18 libexec/cni/tuning
-rwxr-xr-x 0/0         5267679 2026-03-16 14:18 libexec/cni/vlan
-rwxr-xr-x 0/0         4685012 2026-03-16 14:18 libexec/cni/vrf
drwxr-xr-x 0/0               0 2026-06-19 10:36 share/
drwxr-xr-x 0/0               0 2026-06-19 10:39 share/doc/
drwxr-xr-x 0/0               0 2026-06-19 10:39 share/doc/nerdctl/
-rw-r--r-- 0/0           12145 2026-06-19 10:29 share/doc/nerdctl/README.md
drwxr-xr-x 0/0               0 2026-06-19 10:29 share/doc/nerdctl/docs/
-rw-r--r-- 0/0            3953 2026-06-19 10:29 share/doc/nerdctl/docs/build.md
-rw-r--r-- 0/0            2570 2026-06-19 10:29 share/doc/nerdctl/docs/builder-debug.md
-rw-r--r-- 0/0            4779 2026-06-19 10:29 share/doc/nerdctl/docs/cni.md
-rw-r--r-- 0/0           90862 2026-06-19 10:29 share/doc/nerdctl/docs/command-reference.md
-rw-r--r-- 0/0            1829 2026-06-19 10:29 share/doc/nerdctl/docs/compose.md
-rw-r--r-- 0/0            7592 2026-06-19 10:29 share/doc/nerdctl/docs/config.md
-rw-r--r-- 0/0            9128 2026-06-19 10:29 share/doc/nerdctl/docs/cosign.md
-rw-r--r-- 0/0            5660 2026-06-19 10:29 share/doc/nerdctl/docs/cvmfs.md
drwxr-xr-x 0/0               0 2026-06-19 10:29 share/doc/nerdctl/docs/dev/
-rw-r--r-- 0/0           12701 2026-06-19 10:29 share/doc/nerdctl/docs/dev/auditing_dockerfile.md
-rw-r--r-- 0/0            8586 2026-06-19 10:29 share/doc/nerdctl/docs/dev/store.md
-rw-r--r-- 0/0            2879 2026-06-19 10:29 share/doc/nerdctl/docs/dir.md
-rw-r--r-- 0/0             906 2026-06-19 10:29 share/doc/nerdctl/docs/experimental.md
-rw-r--r-- 0/0           14757 2026-06-19 10:29 share/doc/nerdctl/docs/faq.md
-rw-r--r-- 0/0             884 2026-06-19 10:29 share/doc/nerdctl/docs/freebsd.md
-rw-r--r-- 0/0            5585 2026-06-19 10:29 share/doc/nerdctl/docs/gpu.md
-rw-r--r-- 0/0            3419 2026-06-19 10:29 share/doc/nerdctl/docs/healthchecks.md
drwxr-xr-x 0/0               0 2026-06-19 10:29 share/doc/nerdctl/docs/images/
-rw-r--r-- 0/0            1540 2026-06-19 10:29 share/doc/nerdctl/docs/images/nerdctl-white.svg
-rw-r--r-- 0/0            1462 2026-06-19 10:29 share/doc/nerdctl/docs/images/nerdctl.svg
-rw-r--r-- 0/0          684421 2026-06-19 10:29 share/doc/nerdctl/docs/images/rootlessKit-network-design.png
-rw-r--r-- 0/0           14462 2026-06-19 10:29 share/doc/nerdctl/docs/ipfs.md
-rw-r--r-- 0/0            2426 2026-06-19 10:29 share/doc/nerdctl/docs/multi-platform.md
-rw-r--r-- 0/0            2960 2026-06-19 10:29 share/doc/nerdctl/docs/notation.md
-rw-r--r-- 0/0            2805 2026-0

…(truncated)

v2.3.2

Jun 15, 2026Compare GitHub

Changes

Major changes:

nerdctl container:
- Showed Pid as 0 for stopped containers in nerdctl container inspect (#4965, thanks to @haytok)
- Chunked mounts metadata to prevent max label size crashes (#4945, thanks to @Skywalkr-dev)
nerdctl image:
- Added the overlaybd vsize option (#4960, thanks to @fourierrr)
- Fixed nerdctl load failures (#4888, thanks to @ningmingxiao)
nerdctl network:
- Fixed a panic when statting an invalid CNI config path (#4890, thanks to @immanuwell)
nerdctl ps:
- Showed container health status in the STATUS column (#4933, thanks to @haytok)
nerdctl run:
- Rejected / as the -v destination for Docker compatibility (#4954, thanks to @haytok)
nerdctl healthcheck:
- Released exec process resources after probes (#4911, thanks to @haytok)
- Cleaned up transient units on container exit and start (#4935, thanks to @haytok)
nerdctl-full:
- Updated kubo to v0.42.0, soci-snapshotter to v0.14.1, nydus to v2.4.3, fuse-overlayfs to v1.17, and runc to v1.4.3 (#4962, thanks to @AkihiroSuda)
CI and tests:
- Continued migrating container tests to Tigron (#4897, #4900, #4898, #4916, thanks to @ogulcanaydogan and @opjt)
- Migrated compose run tests to the nerdtest framework (#4845, #4911, thanks to @sathiraumesh and @haytok)
- Replaced Vagrant with Lima for FreeBSD tests (#4952, thanks to @AkihiroSuda)
- Fixed syslog test timing and startup behavior (#4898, thanks to @ogulcanaydogan)
Documentation:
- Updated the Windows installation section in README.md (#4949, thanks to @ofek)
- Fixed a typo and a missing import in tools.md (#4917, thanks to @opjt)

Full changes: https://github.com/containerd/nerdctl/milestone/62?closed=1 Thanks to @AkihiroSuda, @haytok, @fourierrr, @Skywalkr-dev, @ningmingxiao, @immanuwell, @ogulcanaydogan, @opjt, @sathiraumesh and @ofek.

Compatible containerd versions

This release of nerdctl is expected to be used with containerd v1.7, v2.0, v2.1, v2.2, or v2.3. Some features may not work with other releases of containerd.

About the binaries

Minimal (nerdctl-2.3.2-linux-amd64.tar.gz): nerdctl only
Full (nerdctl-full-2.3.2-linux-amd64.tar.gz): Includes dependencies such as containerd, runc, and CNI

Minimal

Extract the archive to a path like /usr/local/bin or ~/bin . <details><summary>tar Cxzvvf /usr/local/bin nerdctl-2.3.2-linux-amd64.tar.gz</summary>

-rwxr-xr-x root/root  31117474 2026-06-15 14:34 nerdctl
-rwxr-xr-x root/root     23381 2026-06-15 14:33 containerd-rootless-setuptool.sh
-rwxr-xr-x root/root      8639 2026-06-15 14:33 containerd-rootless.sh

</details>

Full

Extract the archive to a path like /usr/local or ~/.local .

<details><summary>tar Cxzvvf /usr/local nerdctl-full-2.3.2-linux-amd64.tar.gz</summary>

drwxr-xr-x 0/0               0 2026-06-15 14:42 bin/
-rwxr-xr-x 0/0        34502474 2026-05-13 11:39 bin/buildctl
-rwxr-xr-x 0/0        29909144 2025-05-12 13:10 bin/buildg
lrwxrwxrwx 0/0               0 2026-06-15 14:41 bin/buildkit-cni-bandwidth -> ../libexec/cni/bandwidth
lrwxrwxrwx 0/0               0 2026-06-15 14:41 bin/buildkit-cni-bridge -> ../libexec/cni/bridge
lrwxrwxrwx 0/0               0 2026-06-15 14:41 bin/buildkit-cni-dhcp -> ../libexec/cni/dhcp
lrwxrwxrwx 0/0               0 2026-06-15 14:41 bin/buildkit-cni-dummy -> ../libexec/cni/dummy
lrwxrwxrwx 0/0               0 2026-06-15 14:41 bin/buildkit-cni-firewall -> ../libexec/cni/firewall
lrwxrwxrwx 0/0               0 2026-06-15 14:41 bin/buildkit-cni-host-device -> ../libexec/cni/host-device
lrwxrwxrwx 0/0               0 2026-06-15 14:41 bin/buildkit-cni-host-local -> ../libexec/cni/host-local
lrwxrwxrwx 0/0               0 2026-06-15 14:41 bin/buildkit-cni-ipvlan -> ../libexec/cni/ipvlan
lrwxrwxrwx 0/0               0 2026-06-15 14:41 bin/buildkit-cni-loopback -> ../libexec/cni/loopback
lrwxrwxrwx 0/0               0 2026-06-15 14:41 bin/buildkit-cni-macvlan -> ../libexec/cni/macvlan
lrwxrwxrwx 0/0               0 2026-06-15 14:41 bin/buildkit-cni-portmap -> ../libexec/cni/portmap
lrwxrwxrwx 0/0               0 2026-06-15 14:41 bin/buildkit-cni-ptp -> ../libexec/cni/ptp
lrwxrwxrwx 0/0               0 2026-06-15 14:41 bin/buildkit-cni-sbr -> ../libexec/cni/sbr
lrwxrwxrwx 0/0               0 2026-06-15 14:41 bin/buildkit-cni-static -> ../libexec/cni/static
lrwxrwxrwx 0/0               0 2026-06-15 14:41 bin/buildkit-cni-tap -> ../libexec/cni/tap
lrwxrwxrwx 0/0               0 2026-06-15 14:41 bin/buildkit-cni-tuning -> ../libexec/cni/tuning
lrwxrwxrwx 0/0               0 2026-06-15 14:41 bin/buildkit-cni-vlan -> ../libexec/cni/vlan
lrwxrwxrwx 0/0               0 2026-06-15 14:41 bin/buildkit-cni-vrf -> ../libexec/cni/vrf
-rwxr-xr-x 0/0        78723496 2026-05-13 11:39 bin/buildkitd
-rwxr-xr-x 0/0        16853648 2026-06-15 14:41 bin/bypass4netns
-rwxr-xr-x 0/0         6607010 2026-06-15 14:41 bin/bypass4netnsd
-rwxr-xr-x 0/0        39455632 2026-06-15 14:41 bin/containerd
-rwxr-xr-x 0/0        12079288 2025-11-06 01:44 bin/containerd-fuse-overlayfs-grpc
-rwxr-xr-x 0/0           23381 2026-06-15 14:42 bin/containerd-rootless-setuptool.sh
-rwxr-xr-x 0/0            8639 2026-06-15 14:42 bin/containerd-rootless.sh
-rwxr-xr-x 0/0         8458402 2026-06-15 14:41 bin/containerd-shim-runc-v2
-rwxr-xr-x 0/0        55267512 2026-01-21 14:59 bin/containerd-stargz-grpc
-rwxr-xr-x 0/0        23592005 2026-06-15 14:42 bin/ctd-decoder
-rwxr-xr-x 0/0        22577314 2026-06-15 14:41 bin/ctr
-rwxr-xr-x 0/0        31234900 2026-06-15 14:42 bin/ctr-enc
-rwxr-xr-x 0/0        23417016 2026-01-21 14:59 bin/ctr-remote
-rwxr-xr-x 0/0         1695448 2026-06-15 14:42 bin/fuse-overlayfs
-rwxr-xr-x 0/0         7913634 2026-06-15 14:40 bin/gomodjail
-rwxr-xr-x 0/0        31080610 2026-06-15 14:42 bin/nerdctl
-rwxr-xr-x 0/0        39002144 2026-06-15 14:42 bin/nerdctl.gomodjail
-rwxr-xr-x 0/0        12041664 2026-05-27 10:30 bin/rootlessctl
-rwxr-xr-x 0/0        23473018 2026-05-27 10:30 bin/rootlesskit
-rwxr-xr-x 0/0        17096920 2026-06-15 14:40 bin/runc
-rwxr-xr-x 0/0        53829816 2026-01-21 14:59 bin/stargz-fuse-manager
-rwxr-xr-x 0/0        10821816 2026-01-21 14:59 bin/stargz-store-helper
-rwxr-xr-x 0/0          870496 2026-06-15 14:42 bin/tini
drwxr-xr-x 0/0               0 2026-06-15 14:41 lib/
drwxr-xr-x 0/0               0 2026-06-15 14:41 lib/systemd/
drwxr-xr-x 0/0               0 2026-06-15 14:41 lib/systemd/system/
-rw-r--r-- 0/0            1309 2026-06-15 14:41 lib/systemd/system/buildkit.service
-rw-r--r-- 0/0            1248 2026-06-15 14:39 lib/systemd/system/containerd.service
-rw-r--r-- 0/0             312 2026-06-15 14:41 lib/systemd/system/stargz-snapshotter.service
drwxr-xr-x 0/0               0 2026-06-15 14:41 libexec/
drwxr-xr-x 0/0               0 2026-03-16 14:18 libexec/cni/
-rw-r--r-- 0/0           11357 2026-03-16 14:18 libexec/cni/LICENSE
-rw-r--r-- 0/0            2343 2026-03-16 14:18 libexec/cni/README.md
-rwxr-xr-x 0/0         5042926 2026-03-16 14:18 libexec/cni/bandwidth
-rwxr-xr-x 0/0         5698763 2026-03-16 14:18 libexec/cni/bridge
-rwxr-xr-x 0/0        13725422 2026-03-16 14:18 libexec/cni/dhcp
-rwxr-xr-x 0/0         5251069 2026-03-16 14:18 libexec/cni/dummy
-rwxr-xr-x 0/0         5702145 2026-03-16 14:18 libexec/cni/firewall
-rwxr-xr-x 0/0         5159967 2026-03-16 14:18 libexec/cni/host-device
-rwxr-xr-x 0/0         4350778 2026-03-16 14:18 libexec/cni/host-local
-rwxr-xr-x 0/0         5274322 2026-03-16 14:18 libexec/cni/ipvlan
-rwxr-xr-x 0/0         4302030 2026-03-16 14:18 libexec/cni/loopback
-rwxr-xr-x 0/0         5307111 2026-03-16 14:18 libexec/cni/macvlan
-rwxr-xr-x 0/0         5108385 2026-03-16 14:18 libexec/cni/portmap
-rwxr-xr-x 0/0         5475470 2026-03-16 14:18 libexec/cni/ptp
-rwxr-xr-x 0/0         4525826 2026-03-16 14:18 libexec/cni/sbr
-rwxr-xr-x 0/0         3776708 2026-03-16 14:18 libexec/cni/static
-rwxr-xr-x 0/0         5453308 2026-03-16 14:18 libexec/cni/tap
-rwxr-xr-x 0/0         4389084 2026-03-16 14:18 libexec/cni/tuning
-rwxr-xr-x 0/0         5267679 2026-03-16 14:18 libexec/cni/vlan
-rwxr-xr-x 0/0         4685012 2026-03-16 14:18 libexec/cni/vrf
drwxr-xr-x 0/0               0 2026-06-15 14:39 share/
drwxr-xr-x 0/0               0 2026-06-15 14:42 share/doc/
drwxr-xr-x 0/0               0 2026-06-15 14:42 share/doc/nerdctl/
-rw-r--r-- 0/0           12145 2026-06-15 14:33 share/doc/nerdctl/README.md
drwxr-xr-x 0/0               0 2026-06-15 14:33 share/doc/nerdctl/docs/
-rw-r--r-- 0/0            3953 2026-06-15 14:33 share/doc/nerdctl/docs/build.md
-rw-r--r-- 0/0            2570 2026-06-15 14:33 share/doc/nerdctl/docs/builder-debug.md
-rw-r--r-- 0/0            4779 2026-06-15 14:33 share/doc/nerdctl/docs/cni.md
-rw-r--r-- 0/0           90862 2026-06-15 14:33 share/doc/nerdctl/docs/command-reference.md
-rw-r--r-- 0/0            1829 2026-06-15 14:33 share/doc/nerdctl/docs/compose.md
-rw-r--r-- 0/0            7592 2026-06-15 14:33 share/doc/nerdctl/docs/config.md
-rw-r--r-- 0/0            9128 2026-06-15 14:33 share/doc/nerdctl/docs/cosign.md
-rw-r--r-- 0/0            5660 2026-06-15 14:33 share/doc/nerdctl/docs/cvmfs.md
drwxr-xr-x 0/0               0 2026-06-15 14:33 share/doc/nerdctl/docs/dev/
-rw-r--r-- 0/0           12701 2026-06-15 14:33 share/doc/nerdctl/docs/dev/auditing_dockerfile.md
-rw-r--r-- 0/0            8586 2026-06-15 14:33 share/doc/nerdctl/docs/dev/store.md
-rw-r--r-- 0/0            2879 2026-06-15 14:33 share/doc/nerdctl/docs/dir.md
-rw-r--r-- 0/0             906 2026-06-15 14:33 share/doc/nerdctl/docs/experimental.md
-rw-r--r-- 0/0           14757 2026-06-15 14:33 share/doc/nerdctl/docs/faq.md
-rw-r--r-- 0/0             884 2026-06-15 14:33 share/doc/nerdctl/docs/freebsd.md
-rw-r--r-- 0/0            5585 

…(truncated)

v2.3.1

May 21, 2026Compare GitHub

Changes

This is the release of nerdctl v2.3.1.

This is a patch release for v2.3.0. It promotes the v2.3.x line to a GA release by updating nerdctl-full to use the stable containerd v2.3.1 instead of the beta containerd build used in v2.3.0.

Major changes:

nerdctl compose:
- Added support for the Compose healthcheck field in service configs (#4869, thanks to @opjt)
- Added support for passing service names to nerdctl compose down (#4901, thanks to @ysedira)
nerdctl network:
- Fixed a panic when statting an invalid CNI config path (#4890, thanks to @immanuwell)
nerdctl-full:
- Updated containerd to v2.3.1, BuildKit to v0.30.0, and gomodjail to v0.3.2 (#4887, #4922)
Documentation:
- Fixed the spelling of the --sig-proxy flag in the command reference (#4903, thanks to @MukundaKatta)
- Removed a stray quote from the --interactive flag documentation (#4904, thanks to @MukundaKatta)
CI and tests:
- Added zizmor workflow linting and fixed reported workflow issues (#4909, thanks to @omribz156)
- Continued migrating container tests to Tigron (#4863, #4865, thanks to @opjt)

Full changes: https://github.com/containerd/nerdctl/milestone/61?closed=1 Thanks to @ChengyuZhu6, @opjt, @immanuwell, @ysedira, @MukundaKatta, and @omribz156.

Compatible containerd versions

This release of nerdctl is expected to be used with containerd v1.7, v2.0, v2.1, v2.2, or v2.3. Some features may not work with other releases of containerd.

About the binaries

Minimal (nerdctl-2.3.1-linux-amd64.tar.gz): nerdctl only
Full (nerdctl-full-2.3.1-linux-amd64.tar.gz): Includes dependencies such as containerd, runc, and CNI

Minimal

Extract the archive to a path like /usr/local/bin or ~/bin . <details><summary>tar Cxzvvf /usr/local/bin nerdctl-2.3.1-linux-amd64.tar.gz</summary>

-rwxr-xr-x root/root  31604898 2026-05-21 14:25 nerdctl
-rwxr-xr-x root/root     23381 2026-05-21 14:24 containerd-rootless-setuptool.sh
-rwxr-xr-x root/root      8639 2026-05-21 14:24 containerd-rootless.sh

</details>

Full

Extract the archive to a path like /usr/local or ~/.local .

<details><summary>tar Cxzvvf /usr/local nerdctl-full-2.3.1-linux-amd64.tar.gz</summary>

drwxr-xr-x 0/0               0 2026-05-21 14:33 bin/
-rwxr-xr-x 0/0        34502474 2026-05-13 11:39 bin/buildctl
-rwxr-xr-x 0/0        29909144 2025-05-12 13:10 bin/buildg
lrwxrwxrwx 0/0               0 2026-05-21 14:32 bin/buildkit-cni-bandwidth -> ../libexec/cni/bandwidth
lrwxrwxrwx 0/0               0 2026-05-21 14:32 bin/buildkit-cni-bridge -> ../libexec/cni/bridge
lrwxrwxrwx 0/0               0 2026-05-21 14:32 bin/buildkit-cni-dhcp -> ../libexec/cni/dhcp
lrwxrwxrwx 0/0               0 2026-05-21 14:32 bin/buildkit-cni-dummy -> ../libexec/cni/dummy
lrwxrwxrwx 0/0               0 2026-05-21 14:32 bin/buildkit-cni-firewall -> ../libexec/cni/firewall
lrwxrwxrwx 0/0               0 2026-05-21 14:32 bin/buildkit-cni-host-device -> ../libexec/cni/host-device
lrwxrwxrwx 0/0               0 2026-05-21 14:32 bin/buildkit-cni-host-local -> ../libexec/cni/host-local
lrwxrwxrwx 0/0               0 2026-05-21 14:32 bin/buildkit-cni-ipvlan -> ../libexec/cni/ipvlan
lrwxrwxrwx 0/0               0 2026-05-21 14:32 bin/buildkit-cni-loopback -> ../libexec/cni/loopback
lrwxrwxrwx 0/0               0 2026-05-21 14:32 bin/buildkit-cni-macvlan -> ../libexec/cni/macvlan
lrwxrwxrwx 0/0               0 2026-05-21 14:32 bin/buildkit-cni-portmap -> ../libexec/cni/portmap
lrwxrwxrwx 0/0               0 2026-05-21 14:32 bin/buildkit-cni-ptp -> ../libexec/cni/ptp
lrwxrwxrwx 0/0               0 2026-05-21 14:32 bin/buildkit-cni-sbr -> ../libexec/cni/sbr
lrwxrwxrwx 0/0               0 2026-05-21 14:32 bin/buildkit-cni-static -> ../libexec/cni/static
lrwxrwxrwx 0/0               0 2026-05-21 14:32 bin/buildkit-cni-tap -> ../libexec/cni/tap
lrwxrwxrwx 0/0               0 2026-05-21 14:32 bin/buildkit-cni-tuning -> ../libexec/cni/tuning
lrwxrwxrwx 0/0               0 2026-05-21 14:32 bin/buildkit-cni-vlan -> ../libexec/cni/vlan
lrwxrwxrwx 0/0               0 2026-05-21 14:32 bin/buildkit-cni-vrf -> ../libexec/cni/vrf
-rwxr-xr-x 0/0        78723496 2026-05-13 11:39 bin/buildkitd
-rwxr-xr-x 0/0        16853648 2026-05-21 14:31 bin/bypass4netns
-rwxr-xr-x 0/0         6607010 2026-05-21 14:31 bin/bypass4netnsd
-rwxr-xr-x 0/0        39455632 2026-05-21 14:32 bin/containerd
-rwxr-xr-x 0/0        12079288 2025-11-06 01:44 bin/containerd-fuse-overlayfs-grpc
-rwxr-xr-x 0/0           23381 2026-05-21 14:33 bin/containerd-rootless-setuptool.sh
-rwxr-xr-x 0/0            8639 2026-05-21 14:33 bin/containerd-rootless.sh
-rwxr-xr-x 0/0         8458402 2026-05-21 14:32 bin/containerd-shim-runc-v2
-rwxr-xr-x 0/0        55267512 2026-01-21 14:59 bin/containerd-stargz-grpc
-rwxr-xr-x 0/0        23592203 2026-05-21 14:33 bin/ctd-decoder
-rwxr-xr-x 0/0        22577314 2026-05-21 14:32 bin/ctr
-rwxr-xr-x 0/0        31235586 2026-05-21 14:33 bin/ctr-enc
-rwxr-xr-x 0/0        23417016 2026-01-21 14:59 bin/ctr-remote
-rwxr-xr-x 0/0         1885808 2026-05-21 14:33 bin/fuse-overlayfs
-rwxr-xr-x 0/0         7913634 2026-05-21 14:31 bin/gomodjail
-rwxr-xr-x 0/0        31568034 2026-05-21 14:33 bin/nerdctl
-rwxr-xr-x 0/0        39489638 2026-05-21 14:33 bin/nerdctl.gomodjail
-rwxr-xr-x 0/0        12034560 2026-04-09 19:03 bin/rootlessctl
-rwxr-xr-x 0/0        23451213 2026-04-09 19:03 bin/rootlesskit
-rwxr-xr-x 0/0        17088688 2026-05-21 14:31 bin/runc
-rwxr-xr-x 0/0        53829816 2026-01-21 14:59 bin/stargz-fuse-manager
-rwxr-xr-x 0/0        10821816 2026-01-21 14:59 bin/stargz-store-helper
-rwxr-xr-x 0/0          870496 2026-05-21 14:33 bin/tini
drwxr-xr-x 0/0               0 2026-05-21 14:32 lib/
drwxr-xr-x 0/0               0 2026-05-21 14:32 lib/systemd/
drwxr-xr-x 0/0               0 2026-05-21 14:32 lib/systemd/system/
-rw-r--r-- 0/0            1309 2026-05-21 14:32 lib/systemd/system/buildkit.service
-rw-r--r-- 0/0            1248 2026-05-21 14:30 lib/systemd/system/containerd.service
-rw-r--r-- 0/0             312 2026-05-21 14:32 lib/systemd/system/stargz-snapshotter.service
drwxr-xr-x 0/0               0 2026-05-21 14:32 libexec/
drwxr-xr-x 0/0               0 2026-03-16 14:18 libexec/cni/
-rw-r--r-- 0/0           11357 2026-03-16 14:18 libexec/cni/LICENSE
-rw-r--r-- 0/0            2343 2026-03-16 14:18 libexec/cni/README.md
-rwxr-xr-x 0/0         5042926 2026-03-16 14:18 libexec/cni/bandwidth
-rwxr-xr-x 0/0         5698763 2026-03-16 14:18 libexec/cni/bridge
-rwxr-xr-x 0/0        13725422 2026-03-16 14:18 libexec/cni/dhcp
-rwxr-xr-x 0/0         5251069 2026-03-16 14:18 libexec/cni/dummy
-rwxr-xr-x 0/0         5702145 2026-03-16 14:18 libexec/cni/firewall
-rwxr-xr-x 0/0         5159967 2026-03-16 14:18 libexec/cni/host-device
-rwxr-xr-x 0/0         4350778 2026-03-16 14:18 libexec/cni/host-local
-rwxr-xr-x 0/0         5274322 2026-03-16 14:18 libexec/cni/ipvlan
-rwxr-xr-x 0/0         4302030 2026-03-16 14:18 libexec/cni/loopback
-rwxr-xr-x 0/0         5307111 2026-03-16 14:18 libexec/cni/macvlan
-rwxr-xr-x 0/0         5108385 2026-03-16 14:18 libexec/cni/portmap
-rwxr-xr-x 0/0         5475470 2026-03-16 14:18 libexec/cni/ptp
-rwxr-xr-x 0/0         4525826 2026-03-16 14:18 libexec/cni/sbr
-rwxr-xr-x 0/0         3776708 2026-03-16 14:18 libexec/cni/static
-rwxr-xr-x 0/0         5453308 2026-03-16 14:18 libexec/cni/tap
-rwxr-xr-x 0/0         4389084 2026-03-16 14:18 libexec/cni/tuning
-rwxr-xr-x 0/0         5267679 2026-03-16 14:18 libexec/cni/vlan
-rwxr-xr-x 0/0         4685012 2026-03-16 14:18 libexec/cni/vrf
drwxr-xr-x 0/0               0 2026-05-21 14:30 share/
drwxr-xr-x 0/0               0 2026-05-21 14:33 share/doc/
drwxr-xr-x 0/0               0 2026-05-21 14:33 share/doc/nerdctl/
-rw-r--r-- 0/0           12036 2026-05-21 14:24 share/doc/nerdctl/README.md
drwxr-xr-x 0/0               0 2026-05-21 14:24 share/doc/nerdctl/docs/
-rw-r--r-- 0/0            3953 2026-05-21 14:24 share/doc/nerdctl/docs/build.md
-rw-r--r-- 0/0            2570 2026-05-21 14:24 share/doc/nerdctl/docs/builder-debug.md
-rw-r--r-- 0/0            4779 2026-05-21 14:24 share/doc/nerdctl/docs/cni.md
-rw-r--r-- 0/0           90467 2026-05-21 14:24 share/doc/nerdctl/docs/command-reference.md
-rw-r--r-- 0/0            1829 2026-05-21 14:24 share/doc/nerdctl/docs/compose.md
-rw-r--r-- 0/0            7592 2026-05-21 14:24 share/doc/nerdctl/docs/config.md
-rw-r--r-- 0/0            9128 2026-05-21 14:24 share/doc/nerdctl/docs/cosign.md
-rw-r--r-- 0/0            5660 2026-05-21 14:24 share/doc/nerdctl/docs/cvmfs.md
drwxr-xr-x 0/0               0 2026-05-21 14:24 share/doc/nerdctl/docs/dev/
-rw-r--r-- 0/0           12701 2026-05-21 14:24 share/doc/nerdctl/docs/dev/auditing_dockerfile.md
-rw-r--r-- 0/0            8586 2026-05-21 14:24 share/doc/nerdctl/docs/dev/store.md
-rw-r--r-- 0/0            2879 2026-05-21 14:24 share/doc/nerdctl/docs/dir.md
-rw-r--r-- 0/0             906 2026-05-21 14:24 share/doc/nerdctl/docs/experimental.md
-rw-r--r-- 0/0           14757 2026-05-21 14:24 share/doc/nerdctl/docs/faq.md
-rw-r--r-- 0/0             884 2026-05-21 14:24 share/doc/nerdctl/docs/freebsd.md
-rw-r--r-- 0/0            5585 2026-05-21 14:24 share/doc/nerdctl/docs/gpu.md
-rw-r--r-- 0/0            3419 2026-05-21 14:24 share/doc/nerdctl/docs/healthchecks.md
drwxr-xr-x 0/0               0 2026-05-21 14:24 share/doc/nerdctl/docs/images/
-rw-r--r-- 0/0            1540 2026-05-21 14:24 share/doc/nerdctl/docs/images/nerdctl-white.svg
-rw-r--r-- 0/0            1462 2026-05-21 14:24 share/doc/nerdctl/docs/images/nerdctl.svg
-rw-r--r-- 0/0          684421 2026-05-21 14:24 share/doc/nerdctl/docs/images/rootlessKit-network-design.png
-rw-r--r-- 0/0           14462 2026-05-21 14:24 share/doc/nerdctl/docs/ipfs.md
-rw-r--r-- 0/0            2

…(truncated)

v2.3.0

May 5, 2026Compare GitHub

(EDIT by @AkihiroSuda) This release of nerdctl-full uses a beta release of containerd. Expected to be fixed in v2.3.1. https://github.com/containerd/nerdctl/issues/4885

Changes

This is the release of nerdctl v2.3.0.

Major changes:

nerdctl image:
- Refactored image push/pull/save/load to use containerd's transfer service, while keeping legacy image push/pull support for containerd 1.7.x (#4583)
- Added a progress bar for nerdctl image convert (#4779, thanks to @must108)
nerdctl search:
- Added support for the nerdctl search command (#4660)
nerdctl container:
- Added SELinux support for nerdctl run and nerdctl info (#4639, thanks to @ningmingxiao)
- Improved nerdctl run --gpus handling by using CDI (#4617, thanks to @elezar)
- Improved GPU vendor detection for CDI device IDs (#4728, thanks to @shiv-tyagi)
- Fixed shared IPC namespace handling for nerdctl run (#4718, thanks to @weiyuhang2011)
- Added missing --ipc options to nerdctl run help text and shell completion (#4731, thanks to @haytok)
- Added support for nerdctl cp with tarballs (#4704, thanks to @sondavidb)
- Added missing HostConfig fields to the Docker-compatible nerdctl container inspect response (#4850, thanks to @ayush-panta)
- Fixed reading logs of stopped containers by waiting for the logger to finish (#4857, thanks to @haytok)
nerdctl build:
- Added --source-policy-file support (#4712, thanks to @tinovyatkin)
nerdctl network:
- Added MAC, IPv4, and IPv6 addresses to nerdctl network inspect output (#4680, thanks to @coderbirju)
- Fixed binding containers on different IP addresses to the same port (#4800, thanks to @yankay)
- Fixed cleanup of port-reserver state and unused iptables chains after container removal (#4801, #4811, #4820, #4835, thanks to @haytok)
- Fixed freeing reserved ports in rootful mode (#4862, thanks to @unsuman)
- Ignored missing /proc/net/tcp6 and /proc/net/udp6 on IPv6-disabled systems (#4824, thanks to @shouhei)
nerdctl compose:
- Fixed compose pull policy handling for invalid options (#4686, thanks to @haytok)
Rootless:
- Removed the dead -r argument from the rootless nsenter invocation (#4837, thanks to @MayCXC)
nerdctl-full:
- Updated containerd to v2.3.0, runc to v1.4.2, BuildKit to v0.29.0, Stargz Snapshotter to v0.18.2, Nydus to v2.4.1, SOCI Snapshotter to v0.13.0, Kubo to v0.41.0, RootlessKit to v3.0.0, CNI plugins to v1.9.1, and cosign to v3.0.5 (#4866, #4827, #4807, #4792, thanks to @AkihiroSuda and @Swapnanil-Gupta)
Documentation:
- Fixed the formatting of the --security-opt label=<selinuxlabel> entry in the command reference (#4882, thanks to @ogulcanaydogan)
CI and tests:
- Split Linux and Windows containerd version handling in CI and updated CI to Go 1.26 (#4867, #4806, thanks to @AkihiroSuda)
- Continued migrating compose tests to Tigron (#4670, #4672, #4676, #4688, #4713, #4790, #4796, #4834, thanks to @haytok, @robertcal, @Siddhesh002, @juannio, and @sathiraumesh)
- Continued migrating container tests to Tigron (#4675, #4687, #4698, #4700, #4703, #4708, #4711, #4714, #4719, #4726, #4729, #4734, #4737, #4742, #4748, thanks to @munshinuwed, @JoonsooWon, and @robertcal)
Misc:
- Added make uninstall (#4797, thanks to @mvanhorn)
- Fixed a nil pointer panic in commonLock cleanup (#4819, thanks to @fedebram)
- Corrected usage display to show [command] instead of [flags] (#4733, thanks to @niveshdandyan)
- Fixed building newer runc versions (#4653, thanks to @zhangyoufu)
- Updated the list of unimplemented Docker features (#4747, #4809, thanks to @rohansood10 and @IstvanCsVarga)
And more!

Full changes: https://github.com/containerd/nerdctl/milestone/60?closed=1

Thanks to @ChengyuZhu6, @AkihiroSuda, @ningmingxiao, @MayCXC, @unsuman, @haytok, @shouhei, @ayush-panta, @fedebram, @sathiraumesh, @yankay, @Swapnanil-Gupta, @IstvanCsVarga, @Siddhesh002, @coderbirju, @juannio, @mvanhorn, @must108, @Shubhranshu153, @rohansood10, @sondavidb, @weiyuhang2011, @shiv-tyagi, @tinovyatkin, @niveshdandyan, @JoonsooWon, @robertcal, @zhangyoufu, @munshinuwed, @elezar, and @ogulcanaydogan.

Compatible containerd versions

This release of nerdctl is expected to be used with containerd v1.7, v2.0, v2.1, v2.2, or v2.3. Some features may not work with other releases of containerd.

About the binaries

Minimal (nerdctl-2.3.0-linux-amd64.tar.gz): nerdctl only
Full (nerdctl-full-2.3.0-linux-amd64.tar.gz): Includes dependencies such as containerd, runc, and CNI

Minimal

Extract the archive to a path like /usr/local/bin or ~/bin . <details><summary>tar Cxzvvf /usr/local/bin nerdctl-2.3.0-linux-amd64.tar.gz</summary>

-rwxr-xr-x root/root  31547554 2026-05-05 10:54 nerdctl
-rwxr-xr-x root/root     23381 2026-05-05 10:53 containerd-rootless-setuptool.sh
-rwxr-xr-x root/root      8639 2026-05-05 10:53 containerd-rootless.sh

</details>

Full

Extract the archive to a path like /usr/local or ~/.local .

<details><summary>tar Cxzvvf /usr/local nerdctl-full-2.3.0-linux-amd64.tar.gz</summary>

drwxr-xr-x 0/0               0 2026-05-05 11:03 bin/
-rwxr-xr-x 0/0        34368905 2026-03-31 07:10 bin/buildctl
-rwxr-xr-x 0/0        29909144 2025-05-12 13:10 bin/buildg
lrwxrwxrwx 0/0               0 2026-05-05 11:02 bin/buildkit-cni-bandwidth -> ../libexec/cni/bandwidth
lrwxrwxrwx 0/0               0 2026-05-05 11:02 bin/buildkit-cni-bridge -> ../libexec/cni/bridge
lrwxrwxrwx 0/0               0 2026-05-05 11:02 bin/buildkit-cni-dhcp -> ../libexec/cni/dhcp
lrwxrwxrwx 0/0               0 2026-05-05 11:02 bin/buildkit-cni-dummy -> ../libexec/cni/dummy
lrwxrwxrwx 0/0               0 2026-05-05 11:02 bin/buildkit-cni-firewall -> ../libexec/cni/firewall
lrwxrwxrwx 0/0               0 2026-05-05 11:02 bin/buildkit-cni-host-device -> ../libexec/cni/host-device
lrwxrwxrwx 0/0               0 2026-05-05 11:02 bin/buildkit-cni-host-local -> ../libexec/cni/host-local
lrwxrwxrwx 0/0               0 2026-05-05 11:02 bin/buildkit-cni-ipvlan -> ../libexec/cni/ipvlan
lrwxrwxrwx 0/0               0 2026-05-05 11:02 bin/buildkit-cni-loopback -> ../libexec/cni/loopback
lrwxrwxrwx 0/0               0 2026-05-05 11:02 bin/buildkit-cni-macvlan -> ../libexec/cni/macvlan
lrwxrwxrwx 0/0               0 2026-05-05 11:02 bin/buildkit-cni-portmap -> ../libexec/cni/portmap
lrwxrwxrwx 0/0               0 2026-05-05 11:02 bin/buildkit-cni-ptp -> ../libexec/cni/ptp
lrwxrwxrwx 0/0               0 2026-05-05 11:02 bin/buildkit-cni-sbr -> ../libexec/cni/sbr
lrwxrwxrwx 0/0               0 2026-05-05 11:02 bin/buildkit-cni-static -> ../libexec/cni/static
lrwxrwxrwx 0/0               0 2026-05-05 11:02 bin/buildkit-cni-tap -> ../libexec/cni/tap
lrwxrwxrwx 0/0               0 2026-05-05 11:02 bin/buildkit-cni-tuning -> ../libexec/cni/tuning
lrwxrwxrwx 0/0               0 2026-05-05 11:02 bin/buildkit-cni-vlan -> ../libexec/cni/vlan
lrwxrwxrwx 0/0               0 2026-05-05 11:02 bin/buildkit-cni-vrf -> ../libexec/cni/vrf
-rwxr-xr-x 0/0        78258706 2026-03-31 07:10 bin/buildkitd
-rwxr-xr-x 0/0        16837264 2026-05-05 11:02 bin/bypass4netns
-rwxr-xr-x 0/0         6598818 2026-05-05 11:02 bin/bypass4netnsd
-rwxr-xr-x 0/0        39065808 2026-05-05 11:02 bin/containerd
-rwxr-xr-x 0/0        12079288 2025-11-06 01:44 bin/containerd-fuse-overlayfs-grpc
-rwxr-xr-x 0/0           23381 2026-05-05 11:03 bin/containerd-rootless-setuptool.sh
-rwxr-xr-x 0/0            8639 2026-05-05 11:03 bin/containerd-rootless.sh
-rwxr-xr-x 0/0         8450210 2026-05-05 11:02 bin/containerd-shim-runc-v2
-rwxr-xr-x 0/0        55267512 2026-01-21 14:59 bin/containerd-stargz-grpc
-rwxr-xr-x 0/0        23569418 2026-05-05 11:03 bin/ctd-decoder
-rwxr-xr-x 0/0        22565026 2026-05-05 11:02 bin/ctr
-rwxr-xr-x 0/0        31206521 2026-05-05 11:03 bin/ctr-enc
-rwxr-xr-x 0/0        23417016 2026-01-21 14:59 bin/ctr-remote
-rwxr-xr-x 0/0         1885808 2026-05-05 11:03 bin/fuse-overlayfs
-rwxr-xr-x 0/0         4153506 2026-05-05 11:01 bin/gomodjail
-rwxr-xr-x 0/0        31510690 2026-05-05 11:03 bin/nerdctl
-rwxr-xr-x 0/0        35672166 2026-05-05 11:03 bin/nerdctl.gomodjail
-rwxr-xr-x 0/0        12034560 2026-04-09 19:03 bin/rootlessctl
-rwxr-xr-x 0/0        23451213 2026-04-09 19:03 bin/rootlesskit
-rwxr-xr-x 0/0        17074344 2026-05-05 11:02 bin/runc
-rwxr-xr-x 0/0        53829816 2026-01-21 14:59 bin/stargz-fuse-manager
-rwxr-xr-x 0/0        10821816 2026-01-21 14:59 bin/stargz-store-helper
-rwxr-xr-x 0/0          870496 2026-05-05 11:03 bin/tini
drwxr-xr-x 0/0               0 2026-05-05 11:02 lib/
drwxr-xr-x 0/0               0 2026-05-05 11:02 lib/systemd/
drwxr-xr-x 0/0               0 2026-05-05 11:02 lib/systemd/system/
-rw-r--r-- 0/0            1309 2026-05-05 11:02 lib/systemd/system/buildkit.service
-rw-r--r-- 0/0            1248 2026-05-05 11:01 lib/systemd/system/containerd.service
-rw-r--r-- 0/0             312 2026-05-05 11:02 lib/systemd/system/stargz-snapshotter.service
drwxr-xr-x 0/0               0 2026-05-05 11:02 libexec/
drwxr-xr-x 0/0               0 2026-03-16 14:18 libexec/cni/
-rw-r--r-- 0/0           11357 2026-03-16 14:18 libexec/cni/LICENSE
-rw-r--r-- 0/0            2343 2026-03-16 14:18 libexec/cni/README.md
-rwxr-xr-x 0/0         5042926 2026-03-16 14:18 libexec/cni/bandwidth
-rwxr-xr-x 0/0         5698763 2026-03-16 14:18 libexec/cni/bridge
-rwxr-xr-x 0/0        13725422 2026-03-16 14:18 libexec/cni/dhcp
-rwxr-xr-x 0/0         5251069 2026-03-16 14:18 libexec/cni/dummy
-rwxr-xr-x 0/0         5702145 2026-03-16 14:18 libexec/cni/firewall
-rwxr-xr-x 0/0         5159967 2026-03-16 14:18 libexec/cni/host-device
-rwxr-xr-x 0/0         4350778 2026-03-16 14:18 li

…(truncated)

v2.2.2

Mar 31, 2026Compare GitHub

Changes

Update BuildKit (0.28.1), CNI plugins (1.9.1), and a few dependencies (#4815). See the release note of BuildKit and CNI plugins for their security updates.

Compatible containerd versions

This release of nerdctl is expected to be used with containerd v1.7, v2.0, v2.1, or v2.2. Some features may not work with other releases of containerd.

About the binaries

Minimal (nerdctl-2.2.2-linux-amd64.tar.gz): nerdctl only
Full (nerdctl-full-2.2.2-linux-amd64.tar.gz): Includes dependencies such as containerd, runc, and CNI

Minimal

Extract the archive to a path like /usr/local/bin or ~/bin . <details><summary>tar Cxzvvf /usr/local/bin nerdctl-2.2.2-linux-amd64.tar.gz</summary>

-rwxr-xr-x root/root  30376120 2026-03-31 09:20 nerdctl
-rwxr-xr-x root/root     22657 2026-03-31 09:20 containerd-rootless-setuptool.sh
-rwxr-xr-x root/root      8708 2026-03-31 09:20 containerd-rootless.sh

</details>

Full

Extract the archive to a path like /usr/local or ~/.local .

<details><summary>tar Cxzvvf /usr/local nerdctl-full-2.2.2-linux-amd64.tar.gz</summary>

drwxr-xr-x 0/0               0 2026-03-31 09:28 bin/
-rwxr-xr-x 0/0        33631905 2026-03-25 10:34 bin/buildctl
-rwxr-xr-x 0/0        29909144 2025-05-12 13:10 bin/buildg
lrwxrwxrwx 0/0               0 2026-03-31 09:27 bin/buildkit-cni-bandwidth -> ../libexec/cni/bandwidth
lrwxrwxrwx 0/0               0 2026-03-31 09:27 bin/buildkit-cni-bridge -> ../libexec/cni/bridge
lrwxrwxrwx 0/0               0 2026-03-31 09:27 bin/buildkit-cni-dhcp -> ../libexec/cni/dhcp
lrwxrwxrwx 0/0               0 2026-03-31 09:27 bin/buildkit-cni-dummy -> ../libexec/cni/dummy
lrwxrwxrwx 0/0               0 2026-03-31 09:27 bin/buildkit-cni-firewall -> ../libexec/cni/firewall
lrwxrwxrwx 0/0               0 2026-03-31 09:27 bin/buildkit-cni-host-device -> ../libexec/cni/host-device
lrwxrwxrwx 0/0               0 2026-03-31 09:27 bin/buildkit-cni-host-local -> ../libexec/cni/host-local
lrwxrwxrwx 0/0               0 2026-03-31 09:27 bin/buildkit-cni-ipvlan -> ../libexec/cni/ipvlan
lrwxrwxrwx 0/0               0 2026-03-31 09:27 bin/buildkit-cni-loopback -> ../libexec/cni/loopback
lrwxrwxrwx 0/0               0 2026-03-31 09:27 bin/buildkit-cni-macvlan -> ../libexec/cni/macvlan
lrwxrwxrwx 0/0               0 2026-03-31 09:27 bin/buildkit-cni-portmap -> ../libexec/cni/portmap
lrwxrwxrwx 0/0               0 2026-03-31 09:27 bin/buildkit-cni-ptp -> ../libexec/cni/ptp
lrwxrwxrwx 0/0               0 2026-03-31 09:27 bin/buildkit-cni-sbr -> ../libexec/cni/sbr
lrwxrwxrwx 0/0               0 2026-03-31 09:27 bin/buildkit-cni-static -> ../libexec/cni/static
lrwxrwxrwx 0/0               0 2026-03-31 09:27 bin/buildkit-cni-tap -> ../libexec/cni/tap
lrwxrwxrwx 0/0               0 2026-03-31 09:27 bin/buildkit-cni-tuning -> ../libexec/cni/tuning
lrwxrwxrwx 0/0               0 2026-03-31 09:27 bin/buildkit-cni-vlan -> ../libexec/cni/vlan
lrwxrwxrwx 0/0               0 2026-03-31 09:27 bin/buildkit-cni-vrf -> ../libexec/cni/vrf
-rwxr-xr-x 0/0        77710290 2026-03-25 10:34 bin/buildkitd
-rwxr-xr-x 0/0        16558528 2026-03-31 09:26 bin/bypass4netns
-rwxr-xr-x 0/0         6398136 2026-03-31 09:27 bin/bypass4netnsd
-rwxr-xr-x 0/0        44014112 2026-03-31 09:27 bin/containerd
-rwxr-xr-x 0/0        12079288 2025-11-06 01:44 bin/containerd-fuse-overlayfs-grpc
-rwxr-xr-x 0/0           22657 2026-03-31 09:28 bin/containerd-rootless-setuptool.sh
-rwxr-xr-x 0/0            8708 2026-03-31 09:28 bin/containerd-rootless.sh
-rwxr-xr-x 0/0         8339640 2026-03-31 09:27 bin/containerd-shim-runc-v2
-rwxr-xr-x 0/0        57000120 2025-11-06 05:35 bin/containerd-stargz-grpc
-rwxr-xr-x 0/0        23116481 2026-03-31 09:28 bin/ctd-decoder
-rwxr-xr-x 0/0        22188216 2026-03-31 09:27 bin/ctr
-rwxr-xr-x 0/0        30593972 2026-03-31 09:28 bin/ctr-enc
-rwxr-xr-x 0/0        23236792 2025-11-06 05:35 bin/ctr-remote
-rwxr-xr-x 0/0         1885808 2026-03-31 09:28 bin/fuse-overlayfs
-rwxr-xr-x 0/0         3989688 2026-03-31 09:26 bin/gomodjail
-rwxr-xr-x 0/0        30339256 2026-03-31 09:28 bin/nerdctl
-rwxr-xr-x 0/0        34336865 2026-03-31 09:28 bin/nerdctl.gomodjail
-rwxr-xr-x 0/0        12235590 2025-12-18 01:55 bin/rootlessctl
-rwxr-xr-x 0/0        14183868 2025-12-18 01:55 bin/rootlesskit
-rwxr-xr-x 0/0        18133536 2026-03-31 09:26 bin/runc
-rwxr-xr-x 0/0         2383224 2026-03-31 09:28 bin/slirp4netns
-rwxr-xr-x 0/0        55587000 2025-11-06 05:35 bin/stargz-fuse-manager
-rwxr-xr-x 0/0        10793144 2025-11-06 05:35 bin/stargz-store-helper
-rwxr-xr-x 0/0          870496 2026-03-31 09:28 bin/tini
drwxr-xr-x 0/0               0 2026-03-31 09:27 lib/
drwxr-xr-x 0/0               0 2026-03-31 09:27 lib/systemd/
drwxr-xr-x 0/0               0 2026-03-31 09:27 lib/systemd/system/
-rw-r--r-- 0/0            1309 2026-03-31 09:27 lib/systemd/system/buildkit.service
-rw-r--r-- 0/0            1248 2026-03-31 09:25 lib/systemd/system/containerd.service
-rw-r--r-- 0/0             312 2026-03-31 09:27 lib/systemd/system/stargz-snapshotter.service
drwxr-xr-x 0/0               0 2026-03-31 09:27 libexec/
drwxr-xr-x 0/0               0 2026-03-16 14:18 libexec/cni/
-rw-r--r-- 0/0           11357 2026-03-16 14:18 libexec/cni/LICENSE
-rw-r--r-- 0/0            2343 2026-03-16 14:18 libexec/cni/README.md
-rwxr-xr-x 0/0         5042926 2026-03-16 14:18 libexec/cni/bandwidth
-rwxr-xr-x 0/0         5698763 2026-03-16 14:18 libexec/cni/bridge
-rwxr-xr-x 0/0        13725422 2026-03-16 14:18 libexec/cni/dhcp
-rwxr-xr-x 0/0         5251069 2026-03-16 14:18 libexec/cni/dummy
-rwxr-xr-x 0/0         5702145 2026-03-16 14:18 libexec/cni/firewall
-rwxr-xr-x 0/0         5159967 2026-03-16 14:18 libexec/cni/host-device
-rwxr-xr-x 0/0         4350778 2026-03-16 14:18 libexec/cni/host-local
-rwxr-xr-x 0/0         5274322 2026-03-16 14:18 libexec/cni/ipvlan
-rwxr-xr-x 0/0         4302030 2026-03-16 14:18 libexec/cni/loopback
-rwxr-xr-x 0/0         5307111 2026-03-16 14:18 libexec/cni/macvlan
-rwxr-xr-x 0/0         5108385 2026-03-16 14:18 libexec/cni/portmap
-rwxr-xr-x 0/0         5475470 2026-03-16 14:18 libexec/cni/ptp
-rwxr-xr-x 0/0         4525826 2026-03-16 14:18 libexec/cni/sbr
-rwxr-xr-x 0/0         3776708 2026-03-16 14:18 libexec/cni/static
-rwxr-xr-x 0/0         5453308 2026-03-16 14:18 libexec/cni/tap
-rwxr-xr-x 0/0         4389084 2026-03-16 14:18 libexec/cni/tuning
-rwxr-xr-x 0/0         5267679 2026-03-16 14:18 libexec/cni/vlan
-rwxr-xr-x 0/0         4685012 2026-03-16 14:18 libexec/cni/vrf
drwxr-xr-x 0/0               0 2026-03-31 09:25 share/
drwxr-xr-x 0/0               0 2026-03-31 09:28 share/doc/
drwxr-xr-x 0/0               0 2026-03-31 09:28 share/doc/nerdctl/
-rw-r--r-- 0/0           12101 2026-03-31 09:20 share/doc/nerdctl/README.md
drwxr-xr-x 0/0               0 2026-03-31 09:20 share/doc/nerdctl/docs/
-rw-r--r-- 0/0            3953 2026-03-31 09:20 share/doc/nerdctl/docs/build.md
-rw-r--r-- 0/0            2570 2026-03-31 09:20 share/doc/nerdctl/docs/builder-debug.md
-rw-r--r-- 0/0            4779 2026-03-31 09:20 share/doc/nerdctl/docs/cni.md
-rw-r--r-- 0/0           89130 2026-03-31 09:20 share/doc/nerdctl/docs/command-reference.md
-rw-r--r-- 0/0            1814 2026-03-31 09:20 share/doc/nerdctl/docs/compose.md
-rw-r--r-- 0/0            7317 2026-03-31 09:20 share/doc/nerdctl/docs/config.md
-rw-r--r-- 0/0            9128 2026-03-31 09:20 share/doc/nerdctl/docs/cosign.md
-rw-r--r-- 0/0            5660 2026-03-31 09:20 share/doc/nerdctl/docs/cvmfs.md
drwxr-xr-x 0/0               0 2026-03-31 09:20 share/doc/nerdctl/docs/dev/
-rw-r--r-- 0/0           12701 2026-03-31 09:20 share/doc/nerdctl/docs/dev/auditing_dockerfile.md
-rw-r--r-- 0/0            8586 2026-03-31 09:20 share/doc/nerdctl/docs/dev/store.md
-rw-r--r-- 0/0            2879 2026-03-31 09:20 share/doc/nerdctl/docs/dir.md
-rw-r--r-- 0/0             906 2026-03-31 09:20 share/doc/nerdctl/docs/experimental.md
-rw-r--r-- 0/0           14687 2026-03-31 09:20 share/doc/nerdctl/docs/faq.md
-rw-r--r-- 0/0             884 2026-03-31 09:20 share/doc/nerdctl/docs/freebsd.md
-rw-r--r-- 0/0            3273 2026-03-31 09:20 share/doc/nerdctl/docs/gpu.md
-rw-r--r-- 0/0            3419 2026-03-31 09:20 share/doc/nerdctl/docs/healthchecks.md
drwxr-xr-x 0/0               0 2026-03-31 09:20 share/doc/nerdctl/docs/images/
-rw-r--r-- 0/0            1540 2026-03-31 09:20 share/doc/nerdctl/docs/images/nerdctl-white.svg
-rw-r--r-- 0/0            1462 2026-03-31 09:20 share/doc/nerdctl/docs/images/nerdctl.svg
-rw-r--r-- 0/0          684421 2026-03-31 09:20 share/doc/nerdctl/docs/images/rootlessKit-network-design.png
-rw-r--r-- 0/0           14462 2026-03-31 09:20 share/doc/nerdctl/docs/ipfs.md
-rw-r--r-- 0/0            2426 2026-03-31 09:20 share/doc/nerdctl/docs/multi-platform.md
-rw-r--r-- 0/0            2960 2026-03-31 09:20 share/doc/nerdctl/docs/notation.md
-rw-r--r-- 0/0            2610 2026-03-31 09:20 share/doc/nerdctl/docs/nydus.md
-rw-r--r-- 0/0            3277 2026-03-31 09:20 share/doc/nerdctl/docs/ocicrypt.md
-rw-r--r-- 0/0            1876 2026-03-31 09:20 share/doc/nerdctl/docs/overlaybd.md
-rw-r--r-- 0/0           15657 2026-03-31 09:20 share/doc/nerdctl/docs/registry.md
-rw-r--r-- 0/0            9147 2026-03-31 09:20 share/doc/nerdctl/docs/rootless.md
-rw-r--r-- 0/0            3933 2026-03-31 09:20 share/doc/nerdctl/docs/soci.md
-rw-r--r-- 0/0           11715 2026-03-31 09:20 share/doc/nerdctl/docs/stargz.md
drwxr-xr-x 0/0               0 2026-03-31 09:20 share/doc/nerdctl/docs/testing/
-rw-r--r-- 0/0            4897 2026-03-31 09:20 share/doc/nerdctl/docs/testing/README.md
-rw-r--r-- 0/0           16500 2026-03-31 09:20 share/doc/nerdctl/docs

…(truncated)

v2.2.1

Dec 22, 2025Compare GitHub

Changes

nerdctl run:
- Set net.ipv4.ip_unprivileged_port_start=0 by default inside containers (not on the host) (#4615, thanks to @yashkukrecha)
nerdctl ps:
- Improve output (#4602, #4628, thanks to @haytok)
nerdctl compose:
- Support long syntax for tmpfs volumes (#4637, thanks to @haytok)
healthcheck:
- Fix global options (#4575, thanks to @coderbirju)
nerdctl-full:
- Update containerd (2.2.1), runc (1.4.0), CNI plugins (1.9.0), BuildKit (0.26.3), imgcrypt (2.0.2), RootlessKit (2.3.6), etc. (#4667)

Full changes: https://github.com/containerd/nerdctl/milestone/58?closed=1

Thanks to @Swapnanil-Gupta @coderbirju @haytok @henry118 @krig @opjt @yashkukrecha

Compatible containerd versions

This release of nerdctl is expected to be used with containerd v1.7, v2.0, v2.1, or v2.2. Some features may not work with other releases of containerd.

About the binaries

Minimal (nerdctl-2.2.1-linux-amd64.tar.gz): nerdctl only
Full (nerdctl-full-2.2.1-linux-amd64.tar.gz): Includes dependencies such as containerd, runc, and CNI

Minimal

Extract the archive to a path like /usr/local/bin or ~/bin . <details><summary>tar Cxzvvf /usr/local/bin nerdctl-2.2.1-linux-amd64.tar.gz</summary>

-rwxr-xr-x root/root  30355640 2025-12-22 08:54 nerdctl
-rwxr-xr-x root/root     22657 2025-12-22 08:53 containerd-rootless-setuptool.sh
-rwxr-xr-x root/root      8708 2025-12-22 08:53 containerd-rootless.sh

</details>

Full

Extract the archive to a path like /usr/local or ~/.local .

<details><summary>tar Cxzvvf /usr/local nerdctl-full-2.2.1-linux-amd64.tar.gz</summary>

drwxr-xr-x 0/0               0 2025-12-22 09:02 bin/
-rwxr-xr-x 0/0        33267852 2025-12-16 19:06 bin/buildctl
-rwxr-xr-x 0/0        29909144 2025-05-12 13:10 bin/buildg
lrwxrwxrwx 0/0               0 2025-12-22 09:01 bin/buildkit-cni-bandwidth -> ../libexec/cni/bandwidth
lrwxrwxrwx 0/0               0 2025-12-22 09:01 bin/buildkit-cni-bridge -> ../libexec/cni/bridge
lrwxrwxrwx 0/0               0 2025-12-22 09:01 bin/buildkit-cni-dhcp -> ../libexec/cni/dhcp
lrwxrwxrwx 0/0               0 2025-12-22 09:01 bin/buildkit-cni-dummy -> ../libexec/cni/dummy
lrwxrwxrwx 0/0               0 2025-12-22 09:01 bin/buildkit-cni-firewall -> ../libexec/cni/firewall
lrwxrwxrwx 0/0               0 2025-12-22 09:01 bin/buildkit-cni-host-device -> ../libexec/cni/host-device
lrwxrwxrwx 0/0               0 2025-12-22 09:01 bin/buildkit-cni-host-local -> ../libexec/cni/host-local
lrwxrwxrwx 0/0               0 2025-12-22 09:01 bin/buildkit-cni-ipvlan -> ../libexec/cni/ipvlan
lrwxrwxrwx 0/0               0 2025-12-22 09:01 bin/buildkit-cni-loopback -> ../libexec/cni/loopback
lrwxrwxrwx 0/0               0 2025-12-22 09:01 bin/buildkit-cni-macvlan -> ../libexec/cni/macvlan
lrwxrwxrwx 0/0               0 2025-12-22 09:01 bin/buildkit-cni-portmap -> ../libexec/cni/portmap
lrwxrwxrwx 0/0               0 2025-12-22 09:01 bin/buildkit-cni-ptp -> ../libexec/cni/ptp
lrwxrwxrwx 0/0               0 2025-12-22 09:01 bin/buildkit-cni-sbr -> ../libexec/cni/sbr
lrwxrwxrwx 0/0               0 2025-12-22 09:01 bin/buildkit-cni-static -> ../libexec/cni/static
lrwxrwxrwx 0/0               0 2025-12-22 09:01 bin/buildkit-cni-tap -> ../libexec/cni/tap
lrwxrwxrwx 0/0               0 2025-12-22 09:01 bin/buildkit-cni-tuning -> ../libexec/cni/tuning
lrwxrwxrwx 0/0               0 2025-12-22 09:01 bin/buildkit-cni-vlan -> ../libexec/cni/vlan
lrwxrwxrwx 0/0               0 2025-12-22 09:01 bin/buildkit-cni-vrf -> ../libexec/cni/vrf
-rwxr-xr-x 0/0        70305635 2025-12-16 19:06 bin/buildkitd
-rwxr-xr-x 0/0        16550016 2025-12-22 09:00 bin/bypass4netns
-rwxr-xr-x 0/0         6394040 2025-12-22 09:00 bin/bypass4netnsd
-rwxr-xr-x 0/0        44023296 2025-12-22 09:01 bin/containerd
-rwxr-xr-x 0/0        12079288 2025-11-06 01:44 bin/containerd-fuse-overlayfs-grpc
-rwxr-xr-x 0/0           22657 2025-12-22 09:02 bin/containerd-rootless-setuptool.sh
-rwxr-xr-x 0/0            8708 2025-12-22 09:02 bin/containerd-rootless.sh
-rwxr-xr-x 0/0         8339640 2025-12-22 09:01 bin/containerd-shim-runc-v2
-rwxr-xr-x 0/0        57000120 2025-11-06 05:35 bin/containerd-stargz-grpc
-rwxr-xr-x 0/0        23103525 2025-12-22 09:01 bin/ctd-decoder
-rwxr-xr-x 0/0        22188216 2025-12-22 09:00 bin/ctr
-rwxr-xr-x 0/0        30581416 2025-12-22 09:01 bin/ctr-enc
-rwxr-xr-x 0/0        23236792 2025-11-06 05:35 bin/ctr-remote
-rwxr-xr-x 0/0         1885808 2025-12-22 09:01 bin/fuse-overlayfs
-rwxr-xr-x 0/0         3985592 2025-12-22 08:59 bin/gomodjail
-rwxr-xr-x 0/0        30318776 2025-12-22 09:02 bin/nerdctl
-rwxr-xr-x 0/0        34312240 2025-12-22 09:02 bin/nerdctl.gomodjail
-rwxr-xr-x 0/0        12235590 2025-12-18 01:55 bin/rootlessctl
-rwxr-xr-x 0/0        14183868 2025-12-18 01:55 bin/rootlesskit
-rwxr-xr-x 0/0        18127824 2025-12-22 09:00 bin/runc
-rwxr-xr-x 0/0         2383224 2025-12-22 09:01 bin/slirp4netns
-rwxr-xr-x 0/0        55587000 2025-11-06 05:35 bin/stargz-fuse-manager
-rwxr-xr-x 0/0        10793144 2025-11-06 05:35 bin/stargz-store-helper
-rwxr-xr-x 0/0          870496 2025-12-22 09:01 bin/tini
drwxr-xr-x 0/0               0 2025-12-22 09:01 lib/
drwxr-xr-x 0/0               0 2025-12-22 09:01 lib/systemd/
drwxr-xr-x 0/0               0 2025-12-22 09:01 lib/systemd/system/
-rw-r--r-- 0/0            1309 2025-12-22 09:01 lib/systemd/system/buildkit.service
-rw-r--r-- 0/0            1248 2025-12-22 08:59 lib/systemd/system/containerd.service
-rw-r--r-- 0/0             312 2025-12-22 09:01 lib/systemd/system/stargz-snapshotter.service
drwxr-xr-x 0/0               0 2025-12-22 09:01 libexec/
drwxr-xr-x 0/0               0 2025-12-09 10:49 libexec/cni/
-rw-r--r-- 0/0           11357 2025-12-09 10:49 libexec/cni/LICENSE
-rw-r--r-- 0/0            2343 2025-12-09 10:49 libexec/cni/README.md
-rwxr-xr-x 0/0         5042758 2025-12-09 10:49 libexec/cni/bandwidth
-rwxr-xr-x 0/0         5694787 2025-12-09 10:49 libexec/cni/bridge
-rwxr-xr-x 0/0        13722883 2025-12-09 10:49 libexec/cni/dhcp
-rwxr-xr-x 0/0         5251429 2025-12-09 10:49 libexec/cni/dummy
-rwxr-xr-x 0/0         5702489 2025-12-09 10:49 libexec/cni/firewall
-rwxr-xr-x 0/0         5160095 2025-12-09 10:49 libexec/cni/host-device
-rwxr-xr-x 0/0         4350898 2025-12-09 10:49 libexec/cni/host-local
-rwxr-xr-x 0/0         5278618 2025-12-09 10:49 libexec/cni/ipvlan
-rwxr-xr-x 0/0         4302030 2025-12-09 10:49 libexec/cni/loopback
-rwxr-xr-x 0/0         5307015 2025-12-09 10:49 libexec/cni/macvlan
-rwxr-xr-x 0/0         5108286 2025-12-09 10:49 libexec/cni/portmap
-rwxr-xr-x 0/0         5475550 2025-12-09 10:49 libexec/cni/ptp
-rwxr-xr-x 0/0         4525802 2025-12-09 10:49 libexec/cni/sbr
-rwxr-xr-x 0/0         3776700 2025-12-09 10:49 libexec/cni/static
-rwxr-xr-x 0/0         5331503 2025-12-09 10:49 libexec/cni/tap
-rwxr-xr-x 0/0         4389108 2025-12-09 10:49 libexec/cni/tuning
-rwxr-xr-x 0/0         5267823 2025-12-09 10:49 libexec/cni/vlan
-rwxr-xr-x 0/0         4685300 2025-12-09 10:49 libexec/cni/vrf
drwxr-xr-x 0/0               0 2025-12-22 08:59 share/
drwxr-xr-x 0/0               0 2025-12-22 09:02 share/doc/
drwxr-xr-x 0/0               0 2025-12-22 09:02 share/doc/nerdctl/
-rw-r--r-- 0/0           12101 2025-12-22 08:53 share/doc/nerdctl/README.md
drwxr-xr-x 0/0               0 2025-12-22 08:53 share/doc/nerdctl/docs/
-rw-r--r-- 0/0            3953 2025-12-22 08:53 share/doc/nerdctl/docs/build.md
-rw-r--r-- 0/0            2570 2025-12-22 08:53 share/doc/nerdctl/docs/builder-debug.md
-rw-r--r-- 0/0            4779 2025-12-22 08:53 share/doc/nerdctl/docs/cni.md
-rw-r--r-- 0/0           89130 2025-12-22 08:53 share/doc/nerdctl/docs/command-reference.md
-rw-r--r-- 0/0            1814 2025-12-22 08:53 share/doc/nerdctl/docs/compose.md
-rw-r--r-- 0/0            7317 2025-12-22 08:53 share/doc/nerdctl/docs/config.md
-rw-r--r-- 0/0            9128 2025-12-22 08:53 share/doc/nerdctl/docs/cosign.md
-rw-r--r-- 0/0            5660 2025-12-22 08:53 share/doc/nerdctl/docs/cvmfs.md
drwxr-xr-x 0/0               0 2025-12-22 08:53 share/doc/nerdctl/docs/dev/
-rw-r--r-- 0/0           12701 2025-12-22 08:53 share/doc/nerdctl/docs/dev/auditing_dockerfile.md
-rw-r--r-- 0/0            8586 2025-12-22 08:53 share/doc/nerdctl/docs/dev/store.md
-rw-r--r-- 0/0            2879 2025-12-22 08:53 share/doc/nerdctl/docs/dir.md
-rw-r--r-- 0/0             906 2025-12-22 08:53 share/doc/nerdctl/docs/experimental.md
-rw-r--r-- 0/0           14687 2025-12-22 08:53 share/doc/nerdctl/docs/faq.md
-rw-r--r-- 0/0             884 2025-12-22 08:53 share/doc/nerdctl/docs/freebsd.md
-rw-r--r-- 0/0            3273 2025-12-22 08:53 share/doc/nerdctl/docs/gpu.md
-rw-r--r-- 0/0            3419 2025-12-22 08:53 share/doc/nerdctl/docs/healthchecks.md
drwxr-xr-x 0/0               0 2025-12-22 08:53 share/doc/nerdctl/docs/images/
-rw-r--r-- 0/0            1540 2025-12-22 08:53 share/doc/nerdctl/docs/images/nerdctl-white.svg
-rw-r--r-- 0/0            1462 2025-12-22 08:53 share/doc/nerdctl/docs/images/nerdctl.svg
-rw-r--r-- 0/0          684421 2025-12-22 08:53 share/doc/nerdctl/docs/images/rootlessKit-network-design.png
-rw-r--r-- 0/0           14462 2025-12-22 08:53 share/doc/nerdctl/docs/ipfs.md
-rw-r--r-- 0/0            2426 2025-12-22 08:53 share/doc/nerdctl/docs/multi-platform.md
-rw-r--r-- 0/0            2960 2025-12-22 08:53 share/doc/nerdctl/docs/notation.md
-rw-r--r-- 0/0            2610 2025-12-22 08:53 share/doc/nerdctl/docs/nydus.md
-rw-r--r-- 0/0            3277 2025-12-22 08:53 share/doc/nerdctl/docs/ocicrypt.md
-rw-r--r-- 0/0            1876 2025-12-22 08:53 share/doc/nerdctl/docs/overlaybd.md
-rw-r--r-- 0/0           15657 2025-12-22 08:53 share/doc/nerdctl/docs/registry.md
-rw-r--r-- 0/0            9147 2025-12-22 08:53 share/doc/nerdctl/docs/r

…(truncated)

v2.2.0

Nov 6, 2025GitHub

Changes

nerdctl run:
- Fix namestore directory regression: /var/lib/nerdctl/1935db59/default/foo → /var/lib/nerdctl/1935db59/names/default/foo(#4535, thanks to @yankay)
  - This change was once misunderstood as a breaking change, but it turned out to be a non-breaking change for typical users (https://github.com/containerd/nerdctl/issues/4525#issuecomment-3473396840)
- Support mount manager (e.g., for erofs) (#4568, thanks to @hsiangkao)
nerdctl checkpoint:
- Add nerdctl checkpoint (create|ls|rm) commands (#4484, #4515, #4562, thanks to @ChengyuZhu6)
nerdctl image convert:
- Add --estargz-gzip-helper flag (#4543, thanks to @escapefreeg)
nerdctl-full:
- Update containerd (2.2.0), runc (1.3.3), BuildKit (0.25.2), stargz-snapshotter (0.18.1), fuse-overlayfs (1.16), containerd-fuse-overlayfs (2.1.7) (#4566, #4569, #4582, #4589, #4590 thanks to @ChengyuZhu6 @Shubhranshu153)
  - containerd v2.2.0 fixes CVE-2024-25621 and CVE-2025-64329
  - runc v1.3.3 fixes CVE-2025-31133, CVE-2025-52565, CVE-2025-52881

Full changes: https://github.com/containerd/nerdctl/milestone/57?closed=1 Thanks to @ChengyuZhu6 @Shubhranshu153 @coderbirju @escapefreeg @hsiangkao @smazmi @yankay

Compatible containerd versions

This release of nerdctl is expected to be used with containerd v1.7, v2.0, v2.1, or v2.2. Some features may not work with other releases of containerd.

About the binaries

Minimal (nerdctl-2.2.0-linux-amd64.tar.gz): nerdctl only
Full (nerdctl-full-2.2.0-linux-amd64.tar.gz): Includes dependencies such as containerd, runc, and CNI

Minimal

Extract the archive to a path like /usr/local/bin or ~/bin . <details><summary>tar Cxzvvf /usr/local/bin nerdctl-2.2.0-linux-amd64.tar.gz</summary>

-rwxr-xr-x root/root  29966520 2025-11-06 06:52 nerdctl
-rwxr-xr-x root/root     22657 2025-11-06 06:51 containerd-rootless-setuptool.sh
-rwxr-xr-x root/root      8708 2025-11-06 06:51 containerd-rootless.sh

</details>

Full

Extract the archive to a path like /usr/local or ~/.local .

<details><summary>tar Cxzvvf /usr/local nerdctl-full-2.2.0-linux-amd64.tar.gz</summary>

drwxr-xr-x 0/0               0 2025-11-06 07:01 bin/
-rwxr-xr-x 0/0        32911431 2025-11-05 10:29 bin/buildctl
-rwxr-xr-x 0/0        29909144 2025-05-12 13:10 bin/buildg
lrwxrwxrwx 0/0               0 2025-11-06 06:59 bin/buildkit-cni-bandwidth -> ../libexec/cni/bandwidth
lrwxrwxrwx 0/0               0 2025-11-06 06:59 bin/buildkit-cni-bridge -> ../libexec/cni/bridge
lrwxrwxrwx 0/0               0 2025-11-06 06:59 bin/buildkit-cni-dhcp -> ../libexec/cni/dhcp
lrwxrwxrwx 0/0               0 2025-11-06 06:59 bin/buildkit-cni-dummy -> ../libexec/cni/dummy
lrwxrwxrwx 0/0               0 2025-11-06 06:59 bin/buildkit-cni-firewall -> ../libexec/cni/firewall
lrwxrwxrwx 0/0               0 2025-11-06 06:59 bin/buildkit-cni-host-device -> ../libexec/cni/host-device
lrwxrwxrwx 0/0               0 2025-11-06 06:59 bin/buildkit-cni-host-local -> ../libexec/cni/host-local
lrwxrwxrwx 0/0               0 2025-11-06 06:59 bin/buildkit-cni-ipvlan -> ../libexec/cni/ipvlan
lrwxrwxrwx 0/0               0 2025-11-06 06:59 bin/buildkit-cni-loopback -> ../libexec/cni/loopback
lrwxrwxrwx 0/0               0 2025-11-06 06:59 bin/buildkit-cni-macvlan -> ../libexec/cni/macvlan
lrwxrwxrwx 0/0               0 2025-11-06 06:59 bin/buildkit-cni-portmap -> ../libexec/cni/portmap
lrwxrwxrwx 0/0               0 2025-11-06 06:59 bin/buildkit-cni-ptp -> ../libexec/cni/ptp
lrwxrwxrwx 0/0               0 2025-11-06 06:59 bin/buildkit-cni-sbr -> ../libexec/cni/sbr
lrwxrwxrwx 0/0               0 2025-11-06 06:59 bin/buildkit-cni-static -> ../libexec/cni/static
lrwxrwxrwx 0/0               0 2025-11-06 06:59 bin/buildkit-cni-tap -> ../libexec/cni/tap
lrwxrwxrwx 0/0               0 2025-11-06 06:59 bin/buildkit-cni-tuning -> ../libexec/cni/tuning
lrwxrwxrwx 0/0               0 2025-11-06 06:59 bin/buildkit-cni-vlan -> ../libexec/cni/vlan
lrwxrwxrwx 0/0               0 2025-11-06 06:59 bin/buildkit-cni-vrf -> ../libexec/cni/vrf
-rwxr-xr-x 0/0        65279046 2025-11-05 10:29 bin/buildkitd
-rwxr-xr-x 0/0        16545920 2025-11-06 06:59 bin/bypass4netns
-rwxr-xr-x 0/0         6394040 2025-11-06 06:59 bin/bypass4netnsd
-rwxr-xr-x 0/0        43658368 2025-11-06 06:59 bin/containerd
-rwxr-xr-x 0/0        12079288 2025-11-06 01:44 bin/containerd-fuse-overlayfs-grpc
-rwxr-xr-x 0/0           22657 2025-11-06 07:01 bin/containerd-rootless-setuptool.sh
-rwxr-xr-x 0/0            8708 2025-11-06 07:01 bin/containerd-rootless.sh
-rwxr-xr-x 0/0         8331448 2025-11-06 06:59 bin/containerd-shim-runc-v2
-rwxr-xr-x 0/0        57000120 2025-11-06 05:35 bin/containerd-stargz-grpc
-rwxr-xr-x 0/0        23102834 2025-11-06 07:00 bin/ctd-decoder
-rwxr-xr-x 0/0        22098104 2025-11-06 06:59 bin/ctr
-rwxr-xr-x 0/0        30561830 2025-11-06 07:00 bin/ctr-enc
-rwxr-xr-x 0/0        23236792 2025-11-06 05:35 bin/ctr-remote
-rwxr-xr-x 0/0         1885808 2025-11-06 07:00 bin/fuse-overlayfs
-rwxr-xr-x 0/0         3985592 2025-11-06 06:58 bin/gomodjail
-rwxr-xr-x 0/0        29929656 2025-11-06 07:01 bin/nerdctl
-rwxr-xr-x 0/0        33922934 2025-11-06 07:01 bin/nerdctl.gomodjail
-rwxr-xr-x 0/0        12236796 2025-05-08 06:00 bin/rootlessctl
-rwxr-xr-x 0/0        14176992 2025-05-08 06:00 bin/rootlesskit
-rwxr-xr-x 0/0        17918824 2025-11-06 06:59 bin/runc
-rwxr-xr-x 0/0         2383224 2025-11-06 07:00 bin/slirp4netns
-rwxr-xr-x 0/0        55587000 2025-11-06 05:35 bin/stargz-fuse-manager
-rwxr-xr-x 0/0        10793144 2025-11-06 05:35 bin/stargz-store-helper
-rwxr-xr-x 0/0          870496 2025-11-06 07:00 bin/tini
drwxr-xr-x 0/0               0 2025-11-06 06:59 lib/
drwxr-xr-x 0/0               0 2025-11-06 06:59 lib/systemd/
drwxr-xr-x 0/0               0 2025-11-06 07:00 lib/systemd/system/
-rw-r--r-- 0/0            1309 2025-11-06 06:59 lib/systemd/system/buildkit.service
-rw-r--r-- 0/0            1248 2025-11-06 06:58 lib/systemd/system/containerd.service
-rw-r--r-- 0/0             312 2025-11-06 07:00 lib/systemd/system/stargz-snapshotter.service
drwxr-xr-x 0/0               0 2025-11-06 06:59 libexec/
drwxr-xr-x 0/0               0 2025-09-01 15:29 libexec/cni/
-rw-r--r-- 0/0           11357 2025-09-01 15:29 libexec/cni/LICENSE
-rw-r--r-- 0/0            2343 2025-09-01 15:29 libexec/cni/README.md
-rwxr-xr-x 0/0         5042186 2025-09-01 15:29 libexec/cni/bandwidth
-rwxr-xr-x 0/0         5694189 2025-09-01 15:29 libexec/cni/bridge
-rwxr-xr-x 0/0        13719696 2025-09-01 15:29 libexec/cni/dhcp
-rwxr-xr-x 0/0         5251247 2025-09-01 15:29 libexec/cni/dummy
-rwxr-xr-x 0/0         5701763 2025-09-01 15:29 libexec/cni/firewall
-rwxr-xr-x 0/0         5159307 2025-09-01 15:29 libexec/cni/host-device
-rwxr-xr-x 0/0         4350430 2025-09-01 15:29 libexec/cni/host-local
-rwxr-xr-x 0/0         5273398 2025-09-01 15:29 libexec/cni/ipvlan
-rwxr-xr-x 0/0         4301450 2025-09-01 15:29 libexec/cni/loopback
-rwxr-xr-x 0/0         5306499 2025-09-01 15:29 libexec/cni/macvlan
-rwxr-xr-x 0/0         5107586 2025-09-01 15:29 libexec/cni/portmap
-rwxr-xr-x 0/0         5474778 2025-09-01 15:29 libexec/cni/ptp
-rwxr-xr-x 0/0         4521078 2025-09-01 15:29 libexec/cni/sbr
-rwxr-xr-x 0/0         3772408 2025-09-01 15:29 libexec/cni/static
-rwxr-xr-x 0/0         5330851 2025-09-01 15:29 libexec/cni/tap
-rwxr-xr-x 0/0         4384728 2025-09-01 15:29 libexec/cni/tuning
-rwxr-xr-x 0/0         5266939 2025-09-01 15:29 libexec/cni/vlan
-rwxr-xr-x 0/0         4684912 2025-09-01 15:29 libexec/cni/vrf
drwxr-xr-x 0/0               0 2025-11-06 06:58 share/
drwxr-xr-x 0/0               0 2025-11-06 07:01 share/doc/
drwxr-xr-x 0/0               0 2025-11-06 07:01 share/doc/nerdctl/
-rw-r--r-- 0/0           12101 2025-11-06 06:51 share/doc/nerdctl/README.md
drwxr-xr-x 0/0               0 2025-11-06 06:51 share/doc/nerdctl/docs/
-rw-r--r-- 0/0            3953 2025-11-06 06:51 share/doc/nerdctl/docs/build.md
-rw-r--r-- 0/0            2570 2025-11-06 06:51 share/doc/nerdctl/docs/builder-debug.md
-rw-r--r-- 0/0            4779 2025-11-06 06:51 share/doc/nerdctl/docs/cni.md
-rw-r--r-- 0/0           89194 2025-11-06 06:51 share/doc/nerdctl/docs/command-reference.md
-rw-r--r-- 0/0            1814 2025-11-06 06:51 share/doc/nerdctl/docs/compose.md
-rw-r--r-- 0/0            7317 2025-11-06 06:51 share/doc/nerdctl/docs/config.md
-rw-r--r-- 0/0            9128 2025-11-06 06:51 share/doc/nerdctl/docs/cosign.md
-rw-r--r-- 0/0            5660 2025-11-06 06:51 share/doc/nerdctl/docs/cvmfs.md
drwxr-xr-x 0/0               0 2025-11-06 06:51 share/doc/nerdctl/docs/dev/
-rw-r--r-- 0/0           12701 2025-11-06 06:51 share/doc/nerdctl/docs/dev/auditing_dockerfile.md
-rw-r--r-- 0/0            8586 2025-11-06 06:51 share/doc/nerdctl/docs/dev/store.md
-rw-r--r-- 0/0            2879 2025-11-06 06:51 share/doc/nerdctl/docs/dir.md
-rw-r--r-- 0/0             906 2025-11-06 06:51 share/doc/nerdctl/docs/experimental.md
-rw-r--r-- 0/0           14687 2025-11-06 06:51 share/doc/nerdctl/docs/faq.md
-rw-r--r-- 0/0             884 2025-11-06 06:51 share/doc/nerdctl/docs/freebsd.md
-rw-r--r-- 0/0            3273 2025-11-06 06:51 share/doc/nerdctl/docs/gpu.md
-rw-r--r-- 0/0            3419 2025-11-06 06:51 share/doc/nerdctl/docs/healthchecks.md
drwxr-xr-x 0/0               0 2025-11-06 06:51 share/doc/nerdctl/docs/images/
-rw-r--r-- 0/0            1540 2025-11-06 06:51 share/doc/nerdctl/docs/images/nerdctl-white.svg
-rw-r--r-- 0/0            1462 2025-11-06 06:51 share/doc/nerdctl/docs/images/nerdctl.svg
-rw-r--r-- 0/0          684421 2025-11-06 06:51 share/doc/nerdctl/docs/images/rootlessKit-network-design.png
-rw-r--r-- 0/0           14462 2025-11-06 06:51 share/doc/nerdctl/docs/ipfs.md
-rw-r--r-- 0/0            2426 2025-11-06 06:51

…(truncated)

[⬇️ Download] [📖 Command reference] [❓FAQs & Troubleshooting] [📚 Additional documents]

nerdctl: Docker-compatible CLI for containerd

nerdctl is a Docker-compatible CLI for containerd.

✅ Same UI/UX as docker

✅ Supports Docker Compose (nerdctl compose up)

✅ [Optional] Supports rootless mode, without slirp overhead (bypass4netns)

✅ [Optional] Supports lazy-pulling (Stargz, Nydus, OverlayBD)

✅ [Optional] Supports encrypted images (ocicrypt)

✅ [Optional] Supports P2P image distribution (IPFS) (*1)

✅ [Optional] Supports container image signing and verifying (cosign)

nerdctl is a non-core sub-project of containerd.

*1: P2P image distribution (IPFS) is completely optional. Your host is NOT connected to any P2P network, unless you opt in to install and run IPFS daemon.

Examples

Basic usage

To run a container with the default bridge CNI network (10.4.0.0/24):

# nerdctl run -it --rm alpine

To build an image using BuildKit:

# nerdctl build -t foo /some-dockerfile-directory
# nerdctl run -it --rm foo

To build and send output to a local directory using BuildKit:

# nerdctl build -o type=local,dest=. /some-dockerfile-directory

To run containers from docker-compose.yaml:

# nerdctl compose -f ./examples/compose-wordpress/docker-compose.yaml up

Debugging Kubernetes

To list local Kubernetes containers:

# nerdctl --namespace k8s.io ps -a

To build an image for local Kubernetes without using registry:

# nerdctl --namespace k8s.io build -t foo /some-dockerfile-directory
# kubectl apply -f - <<EOF
apiVersion: v1
kind: Pod
metadata:
  name: foo
spec:
  containers:
    - name: foo
      image: foo
      imagePullPolicy: Never
EOF

To load an image archive (docker save format or OCI format) into local Kubernetes:

# nerdctl --namespace k8s.io load < /path/to/image.tar

To read logs (experimental):

# nerdctl --namespace=k8s.io ps -a
CONTAINER ID    IMAGE                                                      COMMAND                   CREATED          STATUS    PORTS    NAMES
...
e8793b8cca8b    registry.k8s.io/coredns/coredns:v1.9.3                     "/coredns -conf /etc…"    2 minutes ago    Up                 k8s://kube-system/coredns-787d4945fb-mfx6b/coredns
...

# nerdctl --namespace=k8s.io logs -f e8793b8cca8b
[INFO] plugin/reload: Running configuration SHA512 = 591cf328cccc12bc490481273e738df59329c62c0b729d94e8b61db9961c2fa5f046dd37f1cf888b953814040d180f52594972691cd6ff41be96639138a43908
CoreDNS-1.9.3
linux/amd64, go1.18.2, 45b0a11
...

Rootless mode

To launch rootless containerd:

$ containerd-rootless-setuptool.sh install

To run a container with rootless containerd:

$ nerdctl run -d -p 8080:80 --name nginx nginx:alpine

See ./docs/rootless.md.

Install

Binaries are available here: <https://github.com/containerd/nerdctl/releases>

In addition to containerd, the following components should be installed:

CNI plugins: for using nerdctl run.
- v1.1.0 or later is highly recommended.
BuildKit (OPTIONAL): for using nerdctl build. BuildKit daemon (buildkitd) needs to be running. See also the document about setting up BuildKit.
- v0.11.0 or later is highly recommended. Some features, such as pruning caches with nerdctl system prune, do not work with older versions.
RootlessKit (OPTIONAL): for Rootless mode
- RootlessKit needs to be v0.10.0 or later. v3.0.0 or later is recommended.

These dependencies are included in nerdctl-full-<VERSION>-<OS>-<ARCH>.tar.gz, but not included in nerdctl-<VERSION>-<OS>-<ARCH>.tar.gz.

Brew

On Linux systems you can install nerdctl via brew:

brew install nerdctl

This is currently not supported for macOS. The section below shows how to install on macOS using brew.

macOS

Lima project provides Linux virtual machines for macOS, with built-in integration for nerdctl.

$ brew install lima
$ limactl start
$ lima nerdctl run -d --name nginx -p 127.0.0.1:8080:80 nginx:alpine

Windows

Install with Scoop:

scoop install nerdctl

Regarding compatibility, note that:

Linux containers: Known to work on WSL2
Windows containers: experimental support for Windows (see below for features that are currently known to work)

FreeBSD

See ./docs/freebsd.md.

Docker

To run containerd and nerdctl inside Docker:

docker build -t nerdctl .
docker run -it --rm --privileged nerdctl

Motivation

The goal of nerdctl is to facilitate experimenting the cutting-edge features of containerd that are not present in Docker (see below).

Note that competing with Docker is not the goal of nerdctl. Those cutting-edge features are expected to be eventually available in Docker as well.

Also, nerdctl might be potentially useful for debugging Kubernetes clusters, but it is not the primary goal.

Features present in `nerdctl` but not present in Docker

Major:

On-demand image pulling (lazy-pulling) using Stargz/Nydus/OverlayBD/SOCI Snapshotter: nerdctl --snapshotter=stargz|nydus|overlaybd|soci run IMAGE .
Image encryption and decryption using ocicrypt (imgcrypt): nerdctl image (encrypt|decrypt) SRC DST
P2P image distribution using IPFS: nerdctl run ipfs://CID . P2P image distribution (IPFS) is completely optional. Your host is NOT connected to any P2P network, unless you opt in to install and run IPFS daemon.
Cosign integration: nerdctl pull --verify=cosign and nerdctl push --sign=cosign, and in Compose
Accelerated rootless containers using bypass4netns: nerdctl run --annotation nerdctl/bypass4netns=true

Minor:

Namespacing: nerdctl --namespace=<NS> ps . (NOTE: All Kubernetes containers are in the k8s.io containerd namespace regardless to Kubernetes namespaces)
Exporting Docker/OCI dual-format archives: nerdctl save .
Importing OCI archives as well as Docker archives: nerdctl load .
Specifying a non-image rootfs: nerdctl run -it --rootfs <ROOTFS> /bin/sh . The CLI syntax conforms to Podman convention.
Connecting a container to multiple networks at once: nerdctl run --net foo --net bar
Running FreeBSD jails.
Better multi-platform support, e.g., nerdctl pull --all-platforms IMAGE
Applying an (existing) AppArmor profile to rootless containers: nerdctl run --security-opt apparmor=<PROFILE>. Use sudo nerdctl apparmor load to load the nerdctl-default profile.
Systemd compatibility support: nerdctl run --systemd=always

Trivial:

Inspecting raw OCI config: nerdctl container inspect --mode=native .

Features implemented in `nerdctl` ahead of Docker

Recursive read-only (RRO) bind-mount: nerdctl run -v /mnt:/mnt:rro (make children such as /mnt/usb to be read-only, too). Requires kernel >= 5.12. The same feature was later introduced in Docker v25 with a different syntax: read-only mounts are now recursively read-only by default when supported, and the behavior is customizable with --mount type=bind,...,readonly,bind-recursive=<enabled|disabled|writable|readonly>. nerdctl now supports the Docker v25 syntax too, and the old rro syntax is deprecated.

Similar tools

ctr: incompatible with Docker CLI, and not friendly to users. Notably, ctr lacks the equivalents of the following nerdctl commands:
- nerdctl run -p <PORT>
- nerdctl run --restart=always --net=bridge
- nerdctl pull with ~/.docker/config.json and credential helper binaries such as docker-credential-ecr-login
- nerdctl logs
- nerdctl build
- nerdctl compose up
crictl: incompatible with Docker CLI, not friendly to users, and does not support non-CRI features
k3c v0.2 (abandoned): needs an extra daemon, and does not support non-CRI features
Rancher Kim (nee k3c v0.3): needs Kubernetes, and only focuses on image management commands such as kim build and kim push
PouchContainer (abandoned?): needs an extra daemon

Developer guide

nerdctl is a containerd non-core sub-project, licensed under the Apache 2.0 license. As a containerd non-core sub-project, you will find the:

information in our containerd/project repository.

Compiling nerdctl from source

Run make && sudo make install.

See the header of go.mod for the minimum supported version of Go.

Using go install github.com/containerd/nerdctl/v2/cmd/nerdctl is possible, but unrecommended because it does not fill version strings printed in nerdctl version

Testing

See testing nerdctl.

Contributing to nerdctl

Lots of commands and flags are currently missing. Pull requests are highly welcome.

Please certify your Developer Certificate of Origin (DCO), by signing off your commit with git commit -s and with your real name.

Command reference

Moved to ./docs/command-reference.md

Additional documents

Configuration guide:

./docs/config.md: Configuration (/etc/nerdctl/nerdctl.toml, ~/.config/nerdctl/nerdctl.toml)
./docs/registry.md: Registry authentication (~/.docker/config.json)

Basic features:

./docs/compose.md: Compose
./docs/rootless.md: Rootless mode
./docs/cni.md: CNI for containers network
./docs/build.md: nerdctl build with BuildKit

Advanced features:

./docs/stargz.md: Lazy-pulling using Stargz Snapshotter
./docs/nydus.md: Lazy-pulling using Nydus Snapshotter
./docs/soci.md: Lazy-pulling using SOCI Snapshotter
./docs/overlaybd.md: Lazy-pulling using OverlayBD Snapshotter
./docs/ocicrypt.md: Running encrypted images
./docs/gpu.md: Using GPUs inside containers
./docs/multi-platform.md: Multi-platform mode

Experimental features:

./docs/experimental.md: Experimental features
./docs/freebsd.md: Running FreeBSD jails
./docs/ipfs.md: Distributing images on IPFS
./docs/builder-debug.md: Interactive debugging of Dockerfile

Implementation details:

./docs/dir.md: Directory layout (/var/lib/nerdctl)

Misc:

./docs/faq.md: FAQs and Troubleshooting

View the full README on GitHub

Release history

v2.4.0

v2.3.5

v2.3.4

v2.3.3

v2.3.2

v2.3.1

v2.3.0

v2.2.2

v2.2.1

v2.2.0

README

nerdctl: Docker-compatible CLI for containerd

Examples

Basic usage

Debugging Kubernetes

Rootless mode

Install

Brew

macOS

Windows

FreeBSD

Docker

Motivation

Features present in nerdctl but not present in Docker

Features implemented in nerdctl ahead of Docker

Similar tools

Developer guide

Compiling nerdctl from source

Testing

Contributing to nerdctl

Command reference

Additional documents

Features present in `nerdctl` but not present in Docker

Features implemented in `nerdctl` ahead of Docker