Morgan Helton

You’re probably familiar with containers and OCI images, and you’ve probably heard of Nix—usually from that somebody who really, really likes it. This talk explains how containerd assembles containers from OCI images, then contrasts that with how Nix builds reproducible artifacts that can be composed into a complete execution environment. With that foundation, we’ll walk through a few practical ways to use Nix-built components as container filesystems in Kubernetes—ranging from assembling a rootfs from a closure to generating OCI images to running Nix-based environments directly in containers. The goal is to give attendees a clear mental model of both systems and the spectrum of techniques that connect them.

This talk explores how to deploy workloads on Kubernetes using Nix without going through conventional OCI image builds. We'll start with a quick look at how containerd actually creates a container—interpreting metadata, preparing a rootfs, assembling a runtime spec. Once you understand that pipeline, it becomes clear that other methods of providing that rootfs are possible beyond unpacking image layers: assembling it directly from Nix store paths, mounting Nix closures as volumes, or modifying the container filesystem at creation time. This talk will explore some of those methods and their varying tradeoffs.