Buildkitd on the host - is this necessary?

[apostasie]

Generally speaking, but specifically in our test rig, we rely on buildkitd running on the host.

This comes with some issues when testing:

• buildkitd is started with a hardcoded namespace (nerdctl-test), which makes it impossible to namespace tests (eg: impossible to parallelize, as most of these tests require a clean house)
• it is hard or not really possible (again in testing) to change buildkitd settings

I am wondering if there is a strong reason for running buildkitd on the host, instead of running it in a container, on-demand, (possibly inside a nerdctl_protected_system namespace that users would not see) - be it during testing, or at runtime.

Maybe there are structural reasons to have it on the host?

[AkihiroSuda]

Maybe there are structural reasons to have it on the host?

Yes, for sharing the image store across containerd and buildkitd.
Otherwise FROM unpushed_image will be unbuildable.

[apostasie]

Can't we mount it inside the container?

[AkihiroSuda]

In theory it should work, but not officially supported by containerd and buildkitd.

[apostasie]

Fair.