Running containerd in a build container

[andrewrynhard]

Description
I have a use case for running containerd in a build container for unit tests. In talos we make use of containerd for creating containers. We would like to test this functionality, and we do so today by first building a container and then docker running it. The reason we do this is because we get operation not permitted when attempting to download an image here: https://github.com/talos-systems/talos/blob/master/internal/app/init/pkg/system/runner/containerd/containerd_test.go#L75. We would like to have everything run in the build of the container (using buildkit) instead of having to build a container and then run it. Is this something that would work? I have tried the native snapshotter when pulling the image, but that does not seem to work.

[AkihiroSuda]

As you already noticed this will be possible with security.unconfined moby/buildkit#950

[crosbymichael]

Try that buildkit feature referenced and see if that does it for you. Going to close this one for now. If you need more help on this feel free to ask.