Finally!! I've managed to molest containerd and kubernetes!!

Now I can run k8s in a container :) yayy!!!

https://gitlab.com/netikras/KubICon

Next: figure out a way to automatically and transparently share certs

Dear Lord, please stop people from enforcing standards and bypassing them themselves.

Take kubernetes for example. Since v1.24 CRI has been announced as the standard, and kubernetes is shifting to live by it.

But it's not.

Yes, it's got the CRI spec defined and the unix://cri.sock used for that standardised communication. What nobody's telling you, is that that socket MUST be on the same runtime as the kube. I.e. you can't simply spin up a dockerd/containerd/cri-o server and share its CRI socket via CIFS/NFS/etc. Because kube-cp will assume that contained is running on the same host as cp and will try to access its services via localhost.

So effectively you feed the container via a socket to another machine, it spins up the container and that container tries to
- bind to your local machine's IP (not the one's the container is running on)
- access its dependencies via localhost:port, while they are actually running on your local machine (not the CRI host)

I HOPE this will change some day. And we'll have a clear cut between dependencies and dependents, separated by a single communications channel - a single unix socket. That'd be a solution I'd really enjoy working with. NOT the ip-port-connect-bind spaghetti we have now.