Add and Read containerd Image Labels Using ctr
Premium Challenge
Upgrade your membership to unlock this and all other premium materials.
Every image that containerd stores has a record in containerd's metadata database, and ctr image label attaches key-value labels to this record.
In this challenge, you will add a label to an image and read a label that someone else has set.
Three images are already pulled into containerd's default namespace on the machine.
Do not confuse containerd labels with OCI image labels.
The OCI image labels come from the LABEL instruction of a Dockerfile or the --label flag of docker build.
They are part of the image config, so they travel with the image to every registry and machine,
and changing one produces a new image with a new ImageID and a new digest.
The containerd labels exist only in containerd's metadata database on this machine, in one containerd namespace.
They can change at any time without touching the image, and they never leave the machine with ctr image push or ctr image export.
These labels are used for bookkeeping by containerd itself and by its clients.
For example, on Kubernetes nodes, the CRI plugin of containerd marks the images it manages with io.cri-containerd.image=managed.
It also labels the sandbox (pause) image with io.cri-containerd.pinned=pinned, and the kubelet never garbage-collects a pinned image.
Add a label
Add the keep=true label to the ghcr.io/iximiuz/labs/nginx:alpine image.
Note the image digest in the DIGEST column of sudo ctr image ls before you add the label, and check it again afterward.
The digest stays the same because the label is stored in containerd's record of the image, outside the image itself.
Hint 1
The built-in help of ctr image label shows how to pass a label to it.
Like every ctr command, it needs sudo to talk to containerd.
Read a label
Someone has already added an owner label to one of the other images.
Find the value of this label.
Hint 2
The ctr image ls command prints the containerd labels of every image in its LABELS column.
Hint 3
The ctr image inspect command prints the labels of a single image record at the top of its output.
The OCI labels of the image are not there.
To read those, take the Read OCI Image Labels Using ctr challenge.