macOS
Homebrewverified · 100%
brew install nerdctllocal Homebrew formula metadata
brew / rank 2421
Install nerdctl with Homebrew, apk, Nix, pacman, zypper, scoop
ContaiNERD CTL - Docker-compatible CLI for containerd. Version 2.3.5 via Homebrew; verified 2026-07-26. Also installable with nix: nix profile install nixpkgs#nerdctl.
install
Additional install commands
Linux
Alpine Linux apkverified · 92%
sudo apk add nerdctlAlpine Linux edge package indexes · nerdctl · source: dl-cdn.alpinelinux.org
Nixverified · 92%
nix profile install nixpkgs#nerdctlnixpkgs package indexes · pkgs/by-name/ne/nerdctl/package.nix · source: api.github.com
Arch Linux pacmanverified · 92%
sudo pacman -S nerdctlArch Linux sync databases · nerdctl · source: geo.mirror.pkgbuild.com
openSUSE zypperverified · 92%
sudo zypper install nerdctlopenSUSE Tumbleweed package metadata · nerdctl · source: download.opensuse.org
Windows
Scoopverified · 92%
scoop install main/nerdctlScoop official bucket manifest trees · bucket/nerdctl.json · source: api.github.com
overview
Package summary
ContaiNERD CTL - Docker-compatible CLI for containerd
Project links
Commands and aliases
- containerd-rootless-setuptool.sh
- containerd-rootless.sh
- nerdctl
history
Project history and usage
nerdctl is the Docker-compatible command-line client for containerd. It was created under the containerd organization in December 2020, shipped its first GitHub release v0.0.1 on 2020-12-09, and is explicitly described by the project as a non-core containerd subproject. Its practical niche is not to replace Docker as a product, but to expose containerd directly through familiar Docker-like commands while also surfacing containerd features that Docker historically did not expose.
Project history
The project grew out of the containerd ecosystem after containerd had become a common runtime substrate for Kubernetes and local developer environments. The README describes the tool as supporting Docker-like UX, Compose, rootless operation, lazy pulling through eStargz/Nydus/OverlayBD, encrypted images through ocicrypt, IPFS-based distribution, and image signing and verification. Release artifacts are split into minimal archives containing nerdctl itself and full archives bundling dependencies such as containerd, runc, CNI, and BuildKit.
GitHub metadata retrieved on 2026-07-01 showed the repository created on 2020-12-04, written in Go, with about 10.2k stars and 795 forks. GitHub releases showed 94 releases through v2.3.4, published on 2026-06-29, with compatibility notes for containerd v1.7 and v2.0 through v2.3.
Adoption history
nerdctl became important because containerd itself is a runtime API, not a friendly end-user container workflow. Tools such as Rancher Desktop and Lima document nerdctl as the CLI users run when they select or start a containerd-backed environment. Rancher Desktop documentation says nerdctl is Docker-compatible and is for experimenting with containerd features not present in Docker, while Lima documents built-in containerd and nerdctl integration and shows `lima nerdctl run` as its container example.
Package-manager adoption is broad for a container tool: Homebrew, Alpine, Nix, Arch, Scoop, and openSUSE entries are present in the av.db source record. The Homebrew formula API reported stable version 2.3.4 and 259 install-on-request events in the prior 30 days when checked on 2026-07-01.
How it is used
Package nerds use nerdctl when they want Docker-shaped commands against containerd: `nerdctl run`, `nerdctl build`, `nerdctl compose up`, image inspection, registry operations, and rootless containerd setup. It is also common as the terminal face of Lima, Rancher Desktop's containerd mode, and other Docker Desktop replacement stacks.
Its more specialized value is for containerd-native experiments: lazy-pulled images, encrypted images, rootless containerd, image signing verification, and debugging containerd behavior without going through dockerd.
Why package nerds care
nerdctl is a high-signal package because it sits at the boundary between everyday Docker muscle memory and lower-level OCI/containerd infrastructure. If a package collection wants to represent modern container workflows, nerdctl is one of the few CLIs that explains how containerd is actually used by humans.
Timeline
- 2020-12-04: GitHub repository created under containerd.
- 2020-12-09: v0.0.1 release published.
- 2026-06-29: v2.3.4 release published, with release notes listing containerd compatibility through v2.3 and minimal/full binary distributions.
Related projects
- containerd
- Docker
- BuildKit
- Rancher Desktop
- Lima
- RootlessKit
- eStargz
- Nydus
- ocicrypt
Sources
- https://api.github.com/repos/containerd/nerdctl
- https://api.github.com/repos/containerd/nerdctl/releases?per_page=100
- https://docs.rancherdesktop.io/tutorials/working-with-containers/
- https://formulae.brew.sh/api/formula/nerdctl.json
- https://github.com/containerd/nerdctl
- https://github.com/containerd/nerdctl/releases
- https://lima-vm.io/docs/examples/containers/containerd/
security posture
Risk level: orange
infrastructure mutation or orchestration signal.
Risk classifier
orange risk · medium confidence · infrastructure
Why
- infrastructure mutation or orchestration signal
Signals
- text:container
Install behavior
- No Homebrew bottle metadata was recorded.
Recommended review
Before unattended agent use, check whether the tool reads plaintext credentials, writes remote state, publishes artifacts, or shells out to plugins.
local files
Configuration and credential file locations
These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval.
Configuration files
Config paths the tool may read or write during local use.
- Unix
/etc/nerdctl/nerdctl.toml~/.config/nerdctl/nerdctl.toml
Credential files
Credential-bearing paths to review before unattended agent runs.
- Unix
~/.docker/config.json
executables
Installed executables
| Command | Kind | Exposure | Note |
|---|---|---|---|
containerd-rootless-setuptool.sh | executable | indexed executable | Discovered from the local executable index. |
containerd-rootless.sh | executable | indexed executable | Discovered from the local executable index. |
nerdctl | executable | indexed executable | Discovered from the local executable index. |
freshness
Version and freshness
These signals separate page generation age, package-manager activity, and upstream release comparison. Version lag is warned only when an evidence URL and comparable versions are present.
page generated2026-08-03
manager version2.3.5
manager updated2026-07-26
local dataunknown
upstreamnot available
latest detectednot detected
- okNo freshness warnings were generated.
install metadata
Package metadata
| Package key | brew:nerdctl |
|---|---|
| Version | 2.3.5 |
| Package manager | Homebrew |
| Homepage | https://github.com/containerd/nerdctl |
| Repository | https://github.com/containerd/nerdctl |
| Last updated | 2026-07-26T19:43:14+02:00 |
| Pulse | updated |
| Bottle | not recorded |
| Service | none declared |
source database matches
Other package-manager records
Matches are pulled from external package-manager indexes and kept separate from local Automic Vault package links.
Nix95%
nerdctl
nix profile install nixpkgs#nerdctl- normalized package name match
- Matched by: Nerdctl
apk95%
nerdctl 2.3.4-r0
Docker-compatible CLI for containerd
https://github.com/containerd/nerdctl/
sudo apk add nerdctl- License: Apache-2.0
- Architecture: x86_64
- Source Package: nerdctl
- 1 dependencies
- 1 provides
- normalized package name match
- Matched by: Nerdctl
apk95%
nerdctl-bash-completion 2.3.4-r0
Bash completions for nerdctl
https://github.com/containerd/nerdctl/
sudo apk add nerdctl-bash-completion- License: Apache-2.0
- Architecture: x86_64
- Source Package: nerdctl
- normalized package name match
- Matched by: Nerdctl
apk95%
nerdctl-doc 2.3.4-r0
Docker-compatible CLI for containerd (documentation)
https://github.com/containerd/nerdctl/
sudo apk add nerdctl-doc- License: Apache-2.0
- Architecture: x86_64
- Source Package: nerdctl
- normalized package name match
- Matched by: Nerdctl
apk95%
nerdctl-fish-completion 2.3.4-r0
Fish completions for nerdctl
https://github.com/containerd/nerdctl/
sudo apk add nerdctl-fish-completion- License: Apache-2.0
- Architecture: x86_64
- Source Package: nerdctl
- normalized package name match
- Matched by: Nerdctl
apk95%
nerdctl-zsh-completion 2.3.4-r0
Zsh completions for nerdctl
https://github.com/containerd/nerdctl/
sudo apk add nerdctl-zsh-completion- License: Apache-2.0
- Architecture: x86_64
- Source Package: nerdctl
- normalized package name match
- Matched by: Nerdctl
pacman95%
nerdctl 2.3.5-1
Docker-compatible CLI for containerd
https://github.com/containerd/nerdctl
sudo pacman -S nerdctl- License: Apache-2.0
- Architecture: x86_64
- 2 dependencies
- 5 optional deps
- normalized package name match
- Matched by: Nerdctl
zypper95%
nerdctl 2.3.5-1.2
Docker-compatible CLI for containerd
https://github.com/containerd/nerdctl
sudo zypper install nerdctl- License: Apache-2.0
- Category: Unspecified
- Architecture: x86_64
- Source Package: nerdctl
- 8 dependencies
- 1 provides
- normalized package name match
- Matched by: Nerdctl
Scoop95%
main/nerdctl
scoop install main/nerdctl- normalized package name match
- Matched by: Nerdctl
source trail
Generated from repository data
This page is generated by av-web from the private package SQLite artifact built by scripts/generate-pkg-sqlite.py.
Combined YAML source
View the package source record on GitHub.
Used sources
- Geiger risk classifier
- cross-ecosystem install command graph
- curated configuration and credential file locations
- curated package history
- external package-manager database matches
- pkg.so package database
- pkgdb category and tag curation