Run a lean VM without containerd/nerdctl

[chenxiaoqino]

Description

I am trying to run a lightweight VM on hardware-constrained laptops, and want to minimize the VM's unnecessary CPU/Memory footprint. In my use case, I run single pre-built Linux binaries in the VM, and do not need containerd/nerdctl. However, a bare-bone default VM with nothing running costs 5-10% CPU and close to 1GB host memory (~300MB resident as seen inside the VM), mostly due to many containerd-related processes.

Since I don't run containers I want to remove these background processes in the VM. However, seems like there is no option to avoid adding containerd-related stuff when launching the VM. The launch script always attempt to download and install nerdctl -- it appears that even if I delete everything, it gets installed again in the next reboot. (I believe the "sticky" logic is here:

lima/pkg/cidata/cidata.TEMPLATE.d/boot/40-install-containerd.sh

Line 11 in 67e465e

if [ ! -x /usr/local/bin/nerdctl ]; then

)

I can open a pull-request myself if the authors can advise on where to change the logic. Is start.go the best place to change?

[jandubois]

However, seems like there is no option to avoid adding containerd-related stuff when launching the VM.

You can disable installation of nerdctl and containerd by editing your lima.yaml file:

lima/pkg/limayaml/default.yaml

Lines 90 to 92 in f24302b

	# Enable user-scoped (aka rootless) containerd and its dependencies
	# Default: true
	user: null

The default for containerd.user is true, so set it to false to disable:

containerd:
  system: false
  user: false

This is done in the Alpine example, which is also generally the smallest instance you can use.

[chenxiaoqino]

Thanks a lot!

[afbjorklund]

This is done in the Alpine example

But that's probably a "bug", right ?

Once the nerdctl installation works on Alpine, it should probably be included there - like with any other distro ?

• Systemd requirement for running rootless containers #310

The recommendation to set them both to false to avoid installing nerdctl/containerd/buildkit still holds, though.

[jandubois]

But that's probably a "bug", right ?

It is not a bug, it is a limitation! �😛

Once the nerdctl installation works on Alpine, it should probably be included there - like with any other distro ?

It probably should, but not totally sure if we should still change it after it being a bare/minimal instance for such a long time. Consistency vs. expectations... I guess I could be persuaded either way still...

[afbjorklund]

Oh well, it is spelled out in the yaml so should not come as a surprise either way.