Requirements
Kubernetes, node, and registry requirements for running canette.
This page is a work in progress.
Kubernetes
- Kubernetes 1.27+
- Gateway API CRDs installed
- A Gateway API implementation (Traefik, Cilium, Kong, nginx, etc.)
Node requirements for builds
canette builds images using BuildKit. By default it runs in rootless mode, which requires user namespace support on each build node. If your nodes cannot meet these requirements, see rooted mode below.
Rootless mode (default)
| Distribution | Requirement |
|---|---|
| Ubuntu 24.04+ | kernel.apparmor_restrict_unprivileged_userns=0 |
| RHEL / CentOS | user.max_user_namespaces=28633 |
| All | Kernel ≥ 4.18 (5.11+ recommended for native overlayfs) |
Rooted mode fallback
Some node configurations cannot support rootless BuildKit:
- EKS Bottlerocket — uses SELinux enforcing mode; the SELinux policy blocks the mount namespace operations that rootlesskit requires, even when user namespaces are available at the kernel level.
- Clusters running with the
RestrictedPod Security Standard in the build namespace. - Nodes with kernel < 4.18 or
user.max_user_namespaces=0that cannot be reconfigured.
In these cases, set buildkit.rootless: false in your Helm values. This runs buildkitd as root with privileged: true, which bypasses the user namespace requirement entirely:
buildkit:
rootless: falseNo node-level configuration is needed in rooted mode. The privileged: true container gets the spc_t SELinux label on SELinux nodes, which bypasses policy restrictions.
Rooted mode is less secure than rootless — the buildkitd pod runs with full host privileges. Ensure the {system}-build namespace has appropriate RBAC and network policies, and that the buildkitd pod is not reachable from outside the cluster.
Container registry
canette pushes built images to a registry you provide. Options:
- In-cluster — a plain
registry:2deployment (no auth, for testing) - External — any OCI-compatible registry (GHCR, ECR, GCR, Docker Hub, etc.)
Resource recommendations
| Component | CPU request | Memory request |
|---|---|---|
canette-api | 100m | 128Mi |
canette-ui | 50m | 64Mi |
canette-builder | 100m | 128Mi |
canette-controller | 100m | 128Mi |
canette-logstreamer | 50m | 64Mi |
buildkitd | 500m | 512Mi |
registry | 50m | 64Mi |
| Per build job | 250m | 256Mi |