We scan this tool’s changelog a few times a day and keep the changes that would alter your agent’s next action: 18 since May 2026, each linked to its source.
nerdctlWhen a Compose service needs to mount an image, set its volume `type` to `image` and specify the image reference and mount target. Run `nerdctl compose up` to create and start the project.
services:
<SERVICE>:
volumes:
- type: image
source: <IMAGE_REFERENCE>
target: <CONTAINER_PATH>
# From the Compose project directory:
nerdctl compose upWhen running a container with read-only access to an image, use `nerdctl run` with `--mount type=image,src=<image>,target=<container-path>`. To mount a relative path within the image rootfs, add `image-subpath=<relative-path>`; the image filesystem is read-only.
nerdctl run --rm --mount type=image,src=<image>,target=<container-path> <container-image>When running a container, use `--expose` to declare ports or `--publish-all` (`-P`) to publish exposed ports. The v2.4.0 release note confirms both flags were added; the v2.4.0 command reference does not document their syntax or behavior.
When debugging containers with a specific label, follow the event stream with `nerdctl events --filter label=com.example.app=myapp`. Label filtering is available in nerdctl v2.4.0.
nerdctl events --filter label=com.example.app=myappWhen reviewing platforms declared by local images, run `nerdctl images --tree` to list each image with a row per declared platform.
nerdctl images --treeWhen creating a network with reserved auxiliary addresses, run `nerdctl network create` with one or more `--aux-address name=IP` pairs. Each IP is reserved and never assigned to a container; each pair is matched to the subnet containing its IP.
nerdctl network create --subnet=<CIDR> --aux-address=<name>=<IP> <NETWORK>When creating an IPv6-only network, disable IPv4 and enable IPv6; provide a valid IPv6 subnet.
nerdctl network create --ipv4=false --ipv6 --subnet <IPv6-CIDR> <network-name>When you need to list networks matching more than one name, run `nerdctl network ls` with repeated `--filter name=` values; nerdctl v2.4.0 combines them with OR.
nerdctl network ls --filter name=<name-1> --filter name=<name-2>When pushing every local tag for a repository, run `nerdctl push --all-tags <repository>`; the repository name must not include a tag.
nerdctl push --all-tags <repository>When testing IPv6 for a rootless container, set `CONTAINERD_ROOTLESS_ROOTLESSKIT_IPV6=true` and restart rootless containerd, then create an IPv6-capable CNI network with `nerdctl network create --ipv6 --subnet <v6-subnet> <network>`. IPv6 mainly affects outgoing connections with `slirp4netns` and `pasta`; `gvisor-tap-vsock` does not support IPv6, and the built-in port driver does not forward IPv6 ports.
Environment=CONTAINERD_ROOTLESS_ROOTLESSKIT_IPV6="true"