Skip to content
Documentation
Guides
Running in a container

Running in a container

nem is published as a multi-arch container image at ghcr.io/vi-dev/nem on every tagged release.

Tags

TagNotes
vX.Y.Z, vX.Y, vX, latestRuns as root. NEM_HOME=/nem. Default.
vX.Y.Z-rootless, vX.Y-rootless, vX-rootless, latest-rootlessRuns as nem. NEM_HOME=/home/nem/.nem.

Floating tags (vX.Y, vX, latest, and their -rootless siblings) move only on stable releases; prereleases publish only the exact vX.Y.Z-rcN tag.

Sandbox requirement

nem requires bubblewrap (bwrap) at runtime for sandboxed package installs. Inside Docker this means the container must run with one of:

  • --privileged (simplest, used in most CI),
  • --cap-add SYS_ADMIN --security-opt apparmor=unconfined (least-privilege equivalent), or
  • a host kernel with unprivileged user namespaces enabled (sysctl kernel.unprivileged_userns_clone=1) when using the rootless variant.

Usage

Direct invocation:

docker run --rm --privileged ghcr.io/vi-dev/nem version

GitHub Actions:

jobs:
  build:
    runs-on: ubuntu-latest
    container:
      image: ghcr.io/vi-dev/nem:v1
      options: --privileged
    steps:
      - run: nem use --global kubectl@v1.34.1
      - run: kubectl version --client

As a base image:

FROM ghcr.io/vi-dev/nem:v1

RUN nem use --global kubectl@v1.34.1 helm@v3.16.0

ENTRYPOINT ["bash"]

Verifying signatures and attestations

nem images are signed with cosign keyless signatures, and include SLSA provenance attestations as well as SPDX SBOMs.

These can be verified with the following commands:

Image signature (cosign keyless):

cosign verify ghcr.io/vi-dev/nem:v1.2.3 \
  --certificate-identity-regexp='https://github.com/vi-dev/nem/.github/workflows/release.yml@.*' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com

SLSA build provenance:

gh attestation verify oci://ghcr.io/vi-dev/nem:v1.2.3 --repo vi-dev/nem

SPDX SBOM:

docker buildx imagetools inspect ghcr.io/vi-dev/nem:v1.2.3 \
  --format '{{ json .SBOM }}' | jq .

List everything attached to an image:

cosign tree ghcr.io/vi-dev/nem:v1.2.3
oras discover ghcr.io/vi-dev/nem:v1.2.3 --format tree
Sandboxed buildsTroubleshooting