sandwich is a command-line tool that creates a self-contained, rootless container environment in a local subsystem directory. It downloads and configures nerdctl, containerd, and other tools, allowing you to build and run containers without needing root or modifying system-wide services.

• Rootless by Default: Runs containerd and buildkitd as user services.
• Self-Contained: All tools and data reside under ./subsystem.
• Zero-Dependency Install: Automatically downloads required binaries.
• Simple Cleanup: clean removes everything, optionally preserving downloads.
• Flexible Builds: Build images from local folders, archives, or remote URLs.
• Subsystem Tools: Use subsystem to invoke tools like nerdctl within your environment.
• Image Management: List and remove container images by tag.

Ensure the following tools are installed:

• bash (version 4+)
• curl
• tar
• unzip (optional, for .zip archives)
• systemd (for user services)

Note: On macOS or WSL2, systemctl --user may not work. You’ll need to configure rootless services manually.

Save the script as sandwich.

chmod +x sandwich

./sandwich initialize

This command:

• Sets up subsystem/ directory structure
• Installs nerdctl, containerd, slirp4netns, and CNI plugins
• Configures rootless services
• Prepares the system to run or build containers

Usage: ./sandwich <command> [options/args...]

Commands:
  initialize                  Download tools and configure rootless services.
  clean [-p true|false]       Remove the subsystem directory.
                              Use -p or --preserve to retain downloads.
  run [CMD...] [-t TAG]       Run a command in a container using the specified image tag.
  build [SRC] [-t TAG]        Build image from rootfs dir, archive, or URL.
  from-image IMAGE [-t TAG]   Pull a registry image and tag it.
  subsystem CMD [ARGS...]     Run a binary from subsystem (e.g., nerdctl).
  list-images                 List all installed container images.
  remove-image TAG            Remove a container image by tag.
  help                        Show this help message.

./sandwich initialize

./sandwich run

./sandwich run echo "Hello from my container!"

mkdir -p myapp/bin
echo -e '#!/bin/sh\necho Hello!' > myapp/bin/hello
chmod +x myapp/bin/hello

./sandwich build ./myapp -t myapp:1.0

./sandwich build https://example.com/myrootfs.tar.gz -t webserver:latest

./sandwich from-image registry.fedoraproject.org/fedora-minimal:42 -t fedora:latest

./sandwich subsystem nerdctl images

./sandwich list-images

./sandwich remove-image myapp:1.0

# Remove all subsystem files and downloads
./sandwich clean -p false

# Remove only subsystem files, keep downloads
./sandwich clean

This project is licensed under the GNU General Public License v3.0. See LICENSE or the script header for details.

Let me know if you’d like this written as a README.md file or integrated with CLI doc generators.