Skip to content
This repository has been archived by the owner. It is now read-only.
containerd and CNI provider for OpenFaaS
Go Makefile
Branch: master
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Type Name Latest commit message Commit time
Failed to load latest commit information.
config Move all config parsing to a separate package Jan 2, 2020
.DEREK.yml Create .DEREK.yml Dec 21, 2019
.gitignore Document how to enable basic auth Jan 3, 2020


Build Status

OpenFaaS provider for containerd - single node / edge workloads

What's the use-case?

OpenFaaS providers can be built for any backend, even for an in-memory datastore. Some users could benefit from a lightweight, single-node execution environment. Using containerd and bypassing Kubernetes or Docker should reduce the start-time for functions and allow for running in resource-constrained environments.


  • Fast cold-start
  • containerd features available such as pause/snapshot
  • Super lightweight
  • Basic service-discovery and inter-service communication through /etc/hosts and bridge


  • No clustering (yet)


Proof of concept.

This project implements the faas-provider SDK.


faas-provider conceptual architecture

See other examples:


  • Deploy container specified via PUT to /system/functions
  • Serve HTTP traffic from deployed container via /function/NAME
  • List running containers via GET on /system/functions
  • Clean-up containers on exit
  • Give configuration for running faas-containerd / OpenFaaS gateway and Prometheus via systemd unit files or similar

An update - Jan 2020

faas-containerd is now part of the faasd project, which adds additional orchestration to bring the whole OpenFaaS experience and ecosystem to containerd.

See my tutorial on how to get started with faasd. It is written for RPi users, but faasd is designed to be portable and also runs on x86_64 and ARM64:


Test it out

You need a Linux computer, VM, or bare-metal cloud host.

Get some build dependencies

I used Ubuntu 18.04 LTS on using the c1.small.x86 host. You can use to get an Ubuntu host on any OS - Windows, MacOS, or Linux.

sudo apt update && \
  sudo apt install -qy runc \
  	bridge-utils \
	tmux git \
  	build-essential \
	libbtrfs-dev libseccomp-dev

Install Go 1.12 (x86_64)

curl -SLsf > go.tgz
sudo rm -rf /usr/local/go/
sudo mkdir -p /usr/local/go/
sudo tar -xvf go.tgz -C /usr/local/go/ --strip-components=1

export GOPATH=$HOME/go/
export PATH=$PATH:/usr/local/go/bin/

go version

Or on Raspberry Pi (armhf)

curl -SLsf > go.tgz
sudo rm -rf /usr/local/go/
sudo mkdir -p /usr/local/go/
sudo tar -xvf go.tgz -C /usr/local/go/ --strip-components=1

export GOPATH=$HOME/go/
export PATH=$PATH:/usr/local/go/bin/

go version

Get containerd

  • Install containerd (or build from source)

Note: This can only be run on x86_64

export VER=1.3.2
curl -sLSf$VER/containerd-$VER.linux-amd64.tar.gz > /tmp/containerd.tar.gz \
  && sudo tar -xvf /tmp/containerd.tar.gz -C /usr/local/bin/ --strip-components=1

containerd -version
  • Or clone / build / install containerd from source:
export GOPATH=$HOME/go/
mkdir -p $GOPATH/src/
cd $GOPATH/src/
git clone
cd containerd
git fetch origin --tags
git checkout v1.3.2

sudo make install

containerd --version

Kill any old containerd version:

# Kill any old version
sudo killall containerd
sudo systemctl disable containerd

Start containerd in a new terminal:

sudo containerd &

CNI Plugins

Install the CNI plugins like this:

export CNI_VERSION=v0.8.2
  • For PC run export ARCH=amd64
  • For RPi/armhf run export ARCH=arm
  • For arm64 run export ARCH=arm64

Then run:

mkdir -p /opt/cni/bin
curl -sSL${CNI_VERSION}/cni-plugins-linux-${ARCH}-${CNI_VERSION}.tgz | tar -xz -C /opt/cni/bin

Check it worked:

/opt/cni/bin/bridge --help

CNI bridge plugin v0.8.2

Enable forwarding

This is required to allow containers in containerd to access the Internet via your computer's primary network interface.

sudo /sbin/sysctl -w net.ipv4.conf.all.forwarding=1

Make the setting permanent:

echo "net.ipv4.conf.all.forwarding=1" | sudo tee -a /etc/sysctl.conf

Build and run faas-containerd

  • Get a binary

     # For x86_64
     sudo curl -fSLs "" \
       -o "/usr/local/bin/faas-containerd" \
       && sudo chmod a+x "/usr/local/bin/faas-containerd"
     # armhf
     sudo curl -fSLs "" \
       -o "/usr/local/bin/faas-containerd" \
       && sudo chmod a+x "/usr/local/bin/faas-containerd"
     # arm64
     sudo curl -fSLs "" \
       -o "/usr/local/bin/faas-containerd" \
       && sudo chmod a+x "/usr/local/bin/faas-containerd"
     # run faas-containerd
     sudo service_timeout=1m ./faas-containerd
  • Or build from source

     export GOPATH=$HOME/go/
     mkdir -p $GOPATH/src/
     cd $GOPATH/src/
     git clone
     cd faas-containerd
     go build && sudo service_timeout=1m ./faas-containerd

Listens on port TCP/8081

Test out your faas-containerd

Get the OpenFaaS CLI:

curl -sLfS | sudo sh

Deploy a function with a server

faas store deploy figlet -g --update=true --replace=false

Deploy a ping function with a server

faas-cli deploy --image alexellis2/ping:0.1 \
  -g --update=true --replace=false --name ping

Deploy nodeinfo function with a server

faas-cli store deploy nodeinfo \
  -g --update=true --replace=false

Try to list functions:

faas-cli list -g

Get a function's status:

faas-cli describe nodeinfo -g

Try to invoke a function:

echo "-c 1" | faas-cli invoke ping -g

echo "verbose" | faas-cli invoke nodeinfo -g

List containers with ctr:

sudo ctr --namespace openfaas-fn container list

Delete container, snapshot and task:

sudo ctr --namespace openfaas-fn task kill figlet
sudo ctr --namespace openfaas-fn task delete figlet
sudo ctr --namespace openfaas-fn container delete figlet
sudo ctr --namespace openfaas-fn snapshot remove figlet-snapshot

Enable Basic Auth

Basic auth requires three things: a username file, a password file, and an env variable.

First, create the username and password, make sure to pick a secure password for production deployments:

echo admin >> basic-auth-user
echo localdev >> basic-auth-password

Then set the basic_auth and secret_mount_path env variables when starting faas-containerd:

service_timeout=1m basic_auth=true secret_mount_path=`pwd` sudo ./bin/faas-containerd

The default value for secret_mount_path is /run/secrets/.

Once it is running, you can quickly verify that auth is being enforced by using the CLI:

$ faas-cli list -g
Unauthorized access, run "faas-cli login" to setup authentication for this server

Now login:

cat basic-auth-password | faas-cli login -g --tls-no-verify -u admin --password-stdin

You can now deploy and invoke a function as before:

faas-cli deploy --image alexellis2/ping:0.1 \
  -g --update=true --replace=false --name ping
echo "-c 1" | faas-cli invoke ping -g

The auth is saved in ~/.openfaas/config.yml.




You can’t perform that action at this time.