containix/v0.1.0

containix v0.1.0

The first release of containix — a containerd shim that runs Nix flakes directly as Kubernetes pods, no container images required. Reference a flake in a pod annotation; the shim resolves it, fetches the closure from your binary cache, assembles a rootfs from Nix store paths, and hands off to runc.

⚠️ Experimental. The API will change before v1 — pin to this tag, not a branch. Not recommended for production yet.

How it works

A pod opts in via runtimeClassName: containix and carries the flake reference as an annotation. If the flake's default package declares meta.mainProgram, that's the only annotation you need:

metadata:
  annotations:
    containix.dev/flake: "github:org/app"   # meta.mainProgram becomes the entrypoint
spec:
  runtimeClassName: containix

Annotations

Annotation	Default	Purpose
containix.dev/flake	— (required)	Flake reference to resolve (nixpkgs#hello, github:org/repo).
containix.dev/entrypoint	meta.mainProgram	Override the executable; relative → flake store path, absolute → literal.
containix.dev/timeout	2m	Max time for build + closure resolution (Go duration, capped at 30m).

Artifacts

• Prebuilt containerd-shim-containix-v1 binaries for linux/amd64 and linux/arm64.
• Also consumable as a Nix flake: github:atmask/containix (package + nixosModules.default).

Requirements (per node)

containerd, a Nix daemon, a binary cache for cold starts, a pullable stub image (ghcr.io/atmask/containix-empty), plus a RuntimeClass and CRI annotation passthrough. Full setup in the Kubernetes guide.

Validated

End-to-end on NixOS (aarch64), containerd 2.x — system containerd via ctr and single-node k3s via kubectl.

Known limitations

• Self-contained binaries only (no /bin/sh shell-outs or FHS layout yet).
• No interactive tooling in-container (kubectl exec lands without sh/ls).
• NixOS-first; non-NixOS and managed clusters require manual node prep.

Docs: README · Kubernetes guide · Architecture