convert docker images to rootfs
Go to file
Motiejus Jakštys 9665574308 wip leave only rootfs 2021-05-24 00:11:58 +03:00
internal description 2021-05-24 00:11:58 +03:00
lxcconfig move to 2021-05-24 00:11:58 +03:00
rootfs move to 2021-05-24 00:11:58 +03:00
BUILD wip leave only rootfs 2021-05-24 00:11:58 +03:00 update README 2021-05-24 00:11:58 +03:00
main.go wip leave only rootfs 2021-05-24 00:11:58 +03:00
main_test.go wip leave only rootfs 2021-05-24 00:11:58 +03:00
rules.bzl split upt packages to dedicated directories 2021-05-24 00:11:58 +03:00


Converts a Docker image (a bunch of layers) to a flattened "rootfs" tarball.


Docker images became a popular way to distribute applications with their dependencies. However, Docker itself is not the best runtime environment. At least not for everyone.

Undocker bridges the gap between application images (in docker image format) and container runtimes: now you can run a Docker image with old-fashioned tools: lxc, systemd-nspawn or systemd itself.

Usage -- extract docker image

Download nginx docker image from docker hub and convert it to a rootfs:

skopeo copy docker:// docker-archive:busybox.tar
undocker rootfs busybox.tar - | tar -xv

Almost the same can be done with a combination of docker pull and docker save.

Usage -- systemd-nspawn example

Start with systemd-nspawn:

systemd-nspawn -D $PWD busybox httpd -vfp 8080

Usage -- plain old systemd

systemd-run \
  --wait --pty --collect --service-type=exec \
  -p PrivateUsers=true \
  -p DynamicUser=yes \
  -p ProtectProc=invisible \
  -p RootDirectory=$PWD \
  -- busybox httpd -vfp 8080

Good things like PrivateUsers, DynamicUser, ProtectProc and other systemd protections are available, just like to any systemd unit.

Notes & gotchas

unocker does not magically enable you to run containers from the internet. In fact, many will need significant tuning or not work at all. Thus you will still need to understand what are you running.


I will accept pull request for code (including tests) and documentation. I am unlikely to react to issue reports without a patch.