Move cri server packages under pkg/cri

Organizes the cri related server packages under pkg/cri

Signed-off-by: Derek McGowan <derek@mcg.dev>

pkg/cri/store/container/container.go

@@ -0,0 +1,177 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package container
+
+import (
+	"sync"
+
+	"github.com/containerd/containerd"
+	"github.com/containerd/containerd/pkg/cri/store/label"
+	"github.com/docker/docker/pkg/truncindex"
+	runtime "k8s.io/cri-api/pkg/apis/runtime/v1alpha2"
+
+	cio "github.com/containerd/containerd/pkg/cri/io"
+	"github.com/containerd/containerd/pkg/cri/store"
+)
+
+// Container contains all resources associated with the container. All methods to
+// mutate the internal state are thread-safe.
+type Container struct {
+	// Metadata is the metadata of the container, it is **immutable** after created.
+	Metadata
+	// Status stores the status of the container.
+	Status StatusStorage
+	// Container is the containerd container client.
+	Container containerd.Container
+	// Container IO.
+	// IO could only be nil when the container is in unknown state.
+	IO *cio.ContainerIO
+	// StopCh is used to propagate the stop information of the container.
+	*store.StopCh
+}
+
+// Opts sets specific information to newly created Container.
+type Opts func(*Container) error
+
+// WithContainer adds the containerd Container to the internal data store.
+func WithContainer(cntr containerd.Container) Opts {
+	return func(c *Container) error {
+		c.Container = cntr
+		return nil
+	}
+}
+
+// WithContainerIO adds IO into the container.
+func WithContainerIO(io *cio.ContainerIO) Opts {
+	return func(c *Container) error {
+		c.IO = io
+		return nil
+	}
+}
+
+// WithStatus adds status to the container.
+func WithStatus(status Status, root string) Opts {
+	return func(c *Container) error {
+		s, err := StoreStatus(root, c.ID, status)
+		if err != nil {
+			return err
+		}
+		c.Status = s
+		if s.Get().State() == runtime.ContainerState_CONTAINER_EXITED {
+			c.Stop()
+		}
+		return nil
+	}
+}
+
+// NewContainer creates an internally used container type.
+func NewContainer(metadata Metadata, opts ...Opts) (Container, error) {
+	c := Container{
+		Metadata: metadata,
+		StopCh:   store.NewStopCh(),
+	}
+	for _, o := range opts {
+		if err := o(&c); err != nil {
+			return Container{}, err
+		}
+	}
+	return c, nil
+}
+
+// Delete deletes checkpoint for the container.
+func (c *Container) Delete() error {
+	return c.Status.Delete()
+}
+
+// Store stores all Containers.
+type Store struct {
+	lock       sync.RWMutex
+	containers map[string]Container
+	idIndex    *truncindex.TruncIndex
+	labels     *label.Store
+}
+
+// NewStore creates a container store.
+func NewStore(labels *label.Store) *Store {
+	return &Store{
+		containers: make(map[string]Container),
+		idIndex:    truncindex.NewTruncIndex([]string{}),
+		labels:     labels,
+	}
+}
+
+// Add a container into the store. Returns store.ErrAlreadyExist if the
+// container already exists.
+func (s *Store) Add(c Container) error {
+	s.lock.Lock()
+	defer s.lock.Unlock()
+	if _, ok := s.containers[c.ID]; ok {
+		return store.ErrAlreadyExist
+	}
+	if err := s.labels.Reserve(c.ProcessLabel); err != nil {
+		return err
+	}
+	if err := s.idIndex.Add(c.ID); err != nil {
+		return err
+	}
+	s.containers[c.ID] = c
+	return nil
+}
+
+// Get returns the container with specified id. Returns store.ErrNotExist
+// if the container doesn't exist.
+func (s *Store) Get(id string) (Container, error) {
+	s.lock.RLock()
+	defer s.lock.RUnlock()
+	id, err := s.idIndex.Get(id)
+	if err != nil {
+		if err == truncindex.ErrNotExist {
+			err = store.ErrNotExist
+		}
+		return Container{}, err
+	}
+	if c, ok := s.containers[id]; ok {
+		return c, nil
+	}
+	return Container{}, store.ErrNotExist
+}
+
+// List lists all containers.
+func (s *Store) List() []Container {
+	s.lock.RLock()
+	defer s.lock.RUnlock()
+	var containers []Container
+	for _, c := range s.containers {
+		containers = append(containers, c)
+	}
+	return containers
+}
+
+// Delete deletes the container from store with specified id.
+func (s *Store) Delete(id string) {
+	s.lock.Lock()
+	defer s.lock.Unlock()
+	id, err := s.idIndex.Get(id)
+	if err != nil {
+		// Note: The idIndex.Delete and delete doesn't handle truncated index.
+		// So we need to return if there are error.
+		return
+	}
+	s.labels.Release(s.containers[id].ProcessLabel)
+	s.idIndex.Delete(id) // nolint: errcheck
+	delete(s.containers, id)
+}

pkg/cri/store/container/container_test.go

@@ -0,0 +1,247 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package container
+
+import (
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/containerd/containerd/pkg/cri/store/label"
+	"github.com/opencontainers/selinux/go-selinux"
+	assertlib "github.com/stretchr/testify/assert"
+	runtime "k8s.io/cri-api/pkg/apis/runtime/v1alpha2"
+
+	cio "github.com/containerd/containerd/pkg/cri/io"
+	"github.com/containerd/containerd/pkg/cri/store"
+)
+
+func TestContainerStore(t *testing.T) {
+	metadatas := map[string]Metadata{
+		"1": {
+			ID:        "1",
+			Name:      "Container-1",
+			SandboxID: "Sandbox-1",
+			Config: &runtime.ContainerConfig{
+				Metadata: &runtime.ContainerMetadata{
+					Name:    "TestPod-1",
+					Attempt: 1,
+				},
+			},
+			ImageRef:     "TestImage-1",
+			StopSignal:   "SIGTERM",
+			LogPath:      "/test/log/path/1",
+			ProcessLabel: "junk:junk:junk:c1,c2",
+		},
+		"2abcd": {
+			ID:        "2abcd",
+			Name:      "Container-2abcd",
+			SandboxID: "Sandbox-2abcd",
+			Config: &runtime.ContainerConfig{
+				Metadata: &runtime.ContainerMetadata{
+					Name:    "TestPod-2abcd",
+					Attempt: 2,
+				},
+			},
+			StopSignal:   "SIGTERM",
+			ImageRef:     "TestImage-2",
+			LogPath:      "/test/log/path/2",
+			ProcessLabel: "junk:junk:junk:c1,c2",
+		},
+		"4a333": {
+			ID:        "4a333",
+			Name:      "Container-4a333",
+			SandboxID: "Sandbox-4a333",
+			Config: &runtime.ContainerConfig{
+				Metadata: &runtime.ContainerMetadata{
+					Name:    "TestPod-4a333",
+					Attempt: 3,
+				},
+			},
+			StopSignal:   "SIGTERM",
+			ImageRef:     "TestImage-3",
+			LogPath:      "/test/log/path/3",
+			ProcessLabel: "junk:junk:junk:c1,c3",
+		},
+		"4abcd": {
+			ID:        "4abcd",
+			Name:      "Container-4abcd",
+			SandboxID: "Sandbox-4abcd",
+			Config: &runtime.ContainerConfig{
+				Metadata: &runtime.ContainerMetadata{
+					Name:    "TestPod-4abcd",
+					Attempt: 1,
+				},
+			},
+			StopSignal:   "SIGTERM",
+			ImageRef:     "TestImage-4abcd",
+			ProcessLabel: "junk:junk:junk:c1,c4",
+		},
+	}
+	statuses := map[string]Status{
+		"1": {
+			Pid:        1,
+			CreatedAt:  time.Now().UnixNano(),
+			StartedAt:  time.Now().UnixNano(),
+			FinishedAt: time.Now().UnixNano(),
+			ExitCode:   1,
+			Reason:     "TestReason-1",
+			Message:    "TestMessage-1",
+		},
+		"2abcd": {
+			Pid:        2,
+			CreatedAt:  time.Now().UnixNano(),
+			StartedAt:  time.Now().UnixNano(),
+			FinishedAt: time.Now().UnixNano(),
+			ExitCode:   2,
+			Reason:     "TestReason-2abcd",
+			Message:    "TestMessage-2abcd",
+		},
+		"4a333": {
+			Pid:        3,
+			CreatedAt:  time.Now().UnixNano(),
+			StartedAt:  time.Now().UnixNano(),
+			FinishedAt: time.Now().UnixNano(),
+			ExitCode:   3,
+			Reason:     "TestReason-4a333",
+			Message:    "TestMessage-4a333",
+			Starting:   true,
+		},
+		"4abcd": {
+			Pid:        4,
+			CreatedAt:  time.Now().UnixNano(),
+			StartedAt:  time.Now().UnixNano(),
+			FinishedAt: time.Now().UnixNano(),
+			ExitCode:   4,
+			Reason:     "TestReason-4abcd",
+			Message:    "TestMessage-4abcd",
+			Removing:   true,
+		},
+	}
+	assert := assertlib.New(t)
+	containers := map[string]Container{}
+	for id := range metadatas {
+		container, err := NewContainer(
+			metadatas[id],
+			WithFakeStatus(statuses[id]),
+		)
+		assert.NoError(err)
+		containers[id] = container
+	}
+
+	s := NewStore(label.NewStore())
+	reserved := map[string]bool{}
+	s.labels.Reserver = func(label string) {
+		reserved[strings.SplitN(label, ":", 4)[3]] = true
+	}
+	s.labels.Releaser = func(label string) {
+		reserved[strings.SplitN(label, ":", 4)[3]] = false
+	}
+
+	t.Logf("should be able to add container")
+	for _, c := range containers {
+		assert.NoError(s.Add(c))
+	}
+
+	t.Logf("should be able to get container")
+	genTruncIndex := func(normalName string) string { return normalName[:(len(normalName)+1)/2] }
+	for id, c := range containers {
+		got, err := s.Get(genTruncIndex(id))
+		assert.NoError(err)
+		assert.Equal(c, got)
+	}
+
+	t.Logf("should be able to list containers")
+	cs := s.List()
+	assert.Len(cs, len(containers))
+
+	if selinux.GetEnabled() {
+		t.Logf("should have reserved labels (requires -tag selinux)")
+		assert.Equal(map[string]bool{
+			"c1,c2": true,
+			"c1,c3": true,
+			"c1,c4": true,
+		}, reserved)
+	}
+
+	cntrNum := len(containers)
+	for testID, v := range containers {
+		truncID := genTruncIndex(testID)
+
+		t.Logf("add should return already exists error for duplicated container")
+		assert.Equal(store.ErrAlreadyExist, s.Add(v))
+
+		t.Logf("should be able to delete container")
+		s.Delete(truncID)
+		cntrNum--
+		cs = s.List()
+		assert.Len(cs, cntrNum)
+
+		t.Logf("get should return not exist error after deletion")
+		c, err := s.Get(truncID)
+		assert.Equal(Container{}, c)
+		assert.Equal(store.ErrNotExist, err)
+	}
+
+	if selinux.GetEnabled() {
+		t.Logf("should have released all labels (requires -tag selinux)")
+		assert.Equal(map[string]bool{
+			"c1,c2": false,
+			"c1,c3": false,
+			"c1,c4": false,
+		}, reserved)
+	}
+}
+
+func TestWithContainerIO(t *testing.T) {
+	meta := Metadata{
+		ID:        "1",
+		Name:      "Container-1",
+		SandboxID: "Sandbox-1",
+		Config: &runtime.ContainerConfig{
+			Metadata: &runtime.ContainerMetadata{
+				Name:    "TestPod-1",
+				Attempt: 1,
+			},
+		},
+		ImageRef:   "TestImage-1",
+		StopSignal: "SIGTERM",
+		LogPath:    "/test/log/path",
+	}
+	status := Status{
+		Pid:        1,
+		CreatedAt:  time.Now().UnixNano(),
+		StartedAt:  time.Now().UnixNano(),
+		FinishedAt: time.Now().UnixNano(),
+		ExitCode:   1,
+		Reason:     "TestReason-1",
+		Message:    "TestMessage-1",
+	}
+	assert := assertlib.New(t)
+
+	c, err := NewContainer(meta, WithFakeStatus(status))
+	assert.NoError(err)
+	assert.Nil(c.IO)
+
+	c, err = NewContainer(
+		meta,
+		WithFakeStatus(status),
+		WithContainerIO(&cio.ContainerIO{}),
+	)
+	assert.NoError(err)
+	assert.NotNil(c.IO)
+}

pkg/cri/store/container/fake_status.go

@@ -0,0 +1,62 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package container
+
+import "sync"
+
+// WithFakeStatus adds fake status to the container.
+func WithFakeStatus(status Status) Opts {
+	return func(c *Container) error {
+		c.Status = &fakeStatusStorage{status: status}
+		if status.FinishedAt != 0 {
+			// Fake the TaskExit event
+			c.Stop()
+		}
+		return nil
+	}
+}
+
+// fakeStatusStorage is a fake status storage for testing.
+type fakeStatusStorage struct {
+	sync.RWMutex
+	status Status
+}
+
+func (f *fakeStatusStorage) Get() Status {
+	f.RLock()
+	defer f.RUnlock()
+	return f.status
+}
+
+func (f *fakeStatusStorage) UpdateSync(u UpdateFunc) error {
+	return f.Update(u)
+}
+
+func (f *fakeStatusStorage) Update(u UpdateFunc) error {
+	f.Lock()
+	defer f.Unlock()
+	newStatus, err := u(f.status)
+	if err != nil {
+		return err
+	}
+	f.status = newStatus
+	return nil
+}
+
+func (f *fakeStatusStorage) Delete() error {
+	return nil
+}

pkg/cri/store/container/metadata.go

@@ -0,0 +1,89 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package container
+
+import (
+	"encoding/json"
+
+	"github.com/pkg/errors"
+	runtime "k8s.io/cri-api/pkg/apis/runtime/v1alpha2"
+)
+
+// NOTE(random-liu):
+// 1) Metadata is immutable after created.
+// 2) Metadata is checkpointed as containerd container label.
+
+// metadataVersion is current version of container metadata.
+const metadataVersion = "v1" // nolint
+
+// versionedMetadata is the internal versioned container metadata.
+// nolint
+type versionedMetadata struct {
+	// Version indicates the version of the versioned container metadata.
+	Version string
+	// Metadata's type is metadataInternal. If not there will be a recursive call in MarshalJSON.
+	Metadata metadataInternal
+}
+
+// metadataInternal is for internal use.
+type metadataInternal Metadata
+
+// Metadata is the unversioned container metadata.
+type Metadata struct {
+	// ID is the container id.
+	ID string
+	// Name is the container name.
+	Name string
+	// SandboxID is the sandbox id the container belongs to.
+	SandboxID string
+	// Config is the CRI container config.
+	// NOTE(random-liu): Resource limits are updatable, the source
+	// of truth for resource limits are in containerd.
+	Config *runtime.ContainerConfig
+	// ImageRef is the reference of image used by the container.
+	ImageRef string
+	// LogPath is the container log path.
+	LogPath string
+	// StopSignal is the system call signal that will be sent to the container to exit.
+	// TODO(random-liu): Add integration test for stop signal.
+	StopSignal string
+	// ProcessLabel is the SELinux process label for the container
+	ProcessLabel string
+}
+
+// MarshalJSON encodes Metadata into bytes in json format.
+func (c *Metadata) MarshalJSON() ([]byte, error) {
+	return json.Marshal(&versionedMetadata{
+		Version:  metadataVersion,
+		Metadata: metadataInternal(*c),
+	})
+}
+
+// UnmarshalJSON decodes Metadata from bytes.
+func (c *Metadata) UnmarshalJSON(data []byte) error {
+	versioned := &versionedMetadata{}
+	if err := json.Unmarshal(data, versioned); err != nil {
+		return err
+	}
+	// Handle old version after upgrade.
+	switch versioned.Version {
+	case metadataVersion:
+		*c = Metadata(versioned.Metadata)
+		return nil
+	}
+	return errors.Errorf("unsupported version: %q", versioned.Version)
+}

pkg/cri/store/container/metadata_test.go

@@ -0,0 +1,81 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package container
+
+import (
+	"encoding/json"
+	"testing"
+
+	assertlib "github.com/stretchr/testify/assert"
+	runtime "k8s.io/cri-api/pkg/apis/runtime/v1alpha2"
+)
+
+func TestMetadataMarshalUnmarshal(t *testing.T) {
+	meta := &Metadata{
+		ID:        "test-id",
+		Name:      "test-name",
+		SandboxID: "test-sandbox-id",
+		Config: &runtime.ContainerConfig{
+			Metadata: &runtime.ContainerMetadata{
+				Name:    "test-name",
+				Attempt: 1,
+			},
+		},
+		ImageRef: "test-image-ref",
+		LogPath:  "/test/log/path",
+	}
+
+	assert := assertlib.New(t)
+	newMeta := &Metadata{}
+	newVerMeta := &versionedMetadata{}
+
+	t.Logf("should be able to do json.marshal")
+	data, err := json.Marshal(meta)
+	assert.NoError(err)
+	data1, err := json.Marshal(&versionedMetadata{
+		Version:  metadataVersion,
+		Metadata: metadataInternal(*meta),
+	})
+	assert.NoError(err)
+	assert.Equal(data, data1)
+
+	t.Logf("should be able to do MarshalJSON")
+	data, err = meta.MarshalJSON()
+	assert.NoError(err)
+	assert.NoError(newMeta.UnmarshalJSON(data))
+	assert.Equal(meta, newMeta)
+
+	t.Logf("should be able to do MarshalJSON and json.Unmarshal")
+	data, err = meta.MarshalJSON()
+	assert.NoError(err)
+	assert.NoError(json.Unmarshal(data, newVerMeta))
+	assert.Equal(meta, (*Metadata)(&newVerMeta.Metadata))
+
+	t.Logf("should be able to do json.Marshal and UnmarshalJSON")
+	data, err = json.Marshal(meta)
+	assert.NoError(err)
+	assert.NoError(newMeta.UnmarshalJSON(data))
+	assert.Equal(meta, newMeta)
+
+	t.Logf("should json.Unmarshal fail for unsupported version")
+	unsupported, err := json.Marshal(&versionedMetadata{
+		Version:  "random-test-version",
+		Metadata: metadataInternal(*meta),
+	})
+	assert.NoError(err)
+	assert.Error(json.Unmarshal(unsupported, &newMeta))
+}

pkg/cri/store/container/status.go

@@ -0,0 +1,247 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package container
+
+import (
+	"encoding/json"
+	"io/ioutil"
+	"os"
+	"path/filepath"
+	"sync"
+
+	"github.com/containerd/continuity"
+	"github.com/pkg/errors"
+	runtime "k8s.io/cri-api/pkg/apis/runtime/v1alpha2"
+)
+
+// The container state machine in the CRI plugin:
+//
+//                         +              +
+//                         |              |
+//                         | Create       | Load
+//                         |              |
+//                    +----v----+         |
+//                    |         |         |
+//                    | CREATED <---------+-----------+
+//                    |         |         |           |
+//                    +----+-----         |           |
+//                         |              |           |
+//                         | Start        |           |
+//                         |              |           |
+//                    +----v----+         |           |
+//   Exec    +--------+         |         |           |
+//  Attach   |        | RUNNING <---------+           |
+// LogReopen +-------->         |         |           |
+//                    +----+----+         |           |
+//                         |              |           |
+//                         | Stop/Exit    |           |
+//                         |              |           |
+//                    +----v----+         |           |
+//                    |         <---------+      +----v----+
+//                    |  EXITED |                |         |
+//                    |         <----------------+ UNKNOWN |
+//                    +----+----+       Stop     |         |
+//                         |                     +---------+
+//                         | Remove
+//                         v
+//                      DELETED
+
+// statusVersion is current version of container status.
+const statusVersion = "v1" // nolint
+
+// versionedStatus is the internal used versioned container status.
+// nolint
+type versionedStatus struct {
+	// Version indicates the version of the versioned container status.
+	Version string
+	Status
+}
+
+// Status is the status of a container.
+type Status struct {
+	// Pid is the init process id of the container.
+	Pid uint32
+	// CreatedAt is the created timestamp.
+	CreatedAt int64
+	// StartedAt is the started timestamp.
+	StartedAt int64
+	// FinishedAt is the finished timestamp.
+	FinishedAt int64
+	// ExitCode is the container exit code.
+	ExitCode int32
+	// CamelCase string explaining why container is in its current state.
+	Reason string
+	// Human-readable message indicating details about why container is in its
+	// current state.
+	Message string
+	// Starting indicates that the container is in starting state.
+	// This field doesn't need to be checkpointed.
+	Starting bool `json:"-"`
+	// Removing indicates that the container is in removing state.
+	// This field doesn't need to be checkpointed.
+	Removing bool `json:"-"`
+	// Unknown indicates that the container status is not fully loaded.
+	// This field doesn't need to be checkpointed.
+	Unknown bool `json:"-"`
+}
+
+// State returns current state of the container based on the container status.
+func (s Status) State() runtime.ContainerState {
+	if s.Unknown {
+		return runtime.ContainerState_CONTAINER_UNKNOWN
+	}
+	if s.FinishedAt != 0 {
+		return runtime.ContainerState_CONTAINER_EXITED
+	}
+	if s.StartedAt != 0 {
+		return runtime.ContainerState_CONTAINER_RUNNING
+	}
+	if s.CreatedAt != 0 {
+		return runtime.ContainerState_CONTAINER_CREATED
+	}
+	return runtime.ContainerState_CONTAINER_UNKNOWN
+}
+
+// encode encodes Status into bytes in json format.
+func (s *Status) encode() ([]byte, error) {
+	return json.Marshal(&versionedStatus{
+		Version: statusVersion,
+		Status:  *s,
+	})
+}
+
+// decode decodes Status from bytes.
+func (s *Status) decode(data []byte) error {
+	versioned := &versionedStatus{}
+	if err := json.Unmarshal(data, versioned); err != nil {
+		return err
+	}
+	// Handle old version after upgrade.
+	switch versioned.Version {
+	case statusVersion:
+		*s = versioned.Status
+		return nil
+	}
+	return errors.New("unsupported version")
+}
+
+// UpdateFunc is function used to update the container status. If there
+// is an error, the update will be rolled back.
+type UpdateFunc func(Status) (Status, error)
+
+// StatusStorage manages the container status with a storage backend.
+type StatusStorage interface {
+	// Get a container status.
+	Get() Status
+	// UpdateSync updates the container status and the on disk checkpoint.
+	// Note that the update MUST be applied in one transaction.
+	UpdateSync(UpdateFunc) error
+	// Update the container status. Note that the update MUST be applied
+	// in one transaction.
+	Update(UpdateFunc) error
+	// Delete the container status.
+	// Note:
+	// * Delete should be idempotent.
+	// * The status must be deleted in one trasaction.
+	Delete() error
+}
+
+// StoreStatus creates the storage containing the passed in container status with the
+// specified id.
+// The status MUST be created in one transaction.
+func StoreStatus(root, id string, status Status) (StatusStorage, error) {
+	data, err := status.encode()
+	if err != nil {
+		return nil, errors.Wrap(err, "failed to encode status")
+	}
+	path := filepath.Join(root, "status")
+	if err := continuity.AtomicWriteFile(path, data, 0600); err != nil {
+		return nil, errors.Wrapf(err, "failed to checkpoint status to %q", path)
+	}
+	return &statusStorage{
+		path:   path,
+		status: status,
+	}, nil
+}
+
+// LoadStatus loads container status from checkpoint. There shouldn't be threads
+// writing to the file during loading.
+func LoadStatus(root, id string) (Status, error) {
+	path := filepath.Join(root, "status")
+	data, err := ioutil.ReadFile(path)
+	if err != nil {
+		return Status{}, errors.Wrapf(err, "failed to read status from %q", path)
+	}
+	var status Status
+	if err := status.decode(data); err != nil {
+		return Status{}, errors.Wrapf(err, "failed to decode status %q", data)
+	}
+	return status, nil
+}
+
+type statusStorage struct {
+	sync.RWMutex
+	path   string
+	status Status
+}
+
+// Get a copy of container status.
+func (s *statusStorage) Get() Status {
+	s.RLock()
+	defer s.RUnlock()
+	return s.status
+}
+
+// UpdateSync updates the container status and the on disk checkpoint.
+func (s *statusStorage) UpdateSync(u UpdateFunc) error {
+	s.Lock()
+	defer s.Unlock()
+	newStatus, err := u(s.status)
+	if err != nil {
+		return err
+	}
+	data, err := newStatus.encode()
+	if err != nil {
+		return errors.Wrap(err, "failed to encode status")
+	}
+	if err := continuity.AtomicWriteFile(s.path, data, 0600); err != nil {
+		return errors.Wrapf(err, "failed to checkpoint status to %q", s.path)
+	}
+	s.status = newStatus
+	return nil
+}
+
+// Update the container status.
+func (s *statusStorage) Update(u UpdateFunc) error {
+	s.Lock()
+	defer s.Unlock()
+	newStatus, err := u(s.status)
+	if err != nil {
+		return err
+	}
+	s.status = newStatus
+	return nil
+}
+
+// Delete deletes the container status from disk atomically.
+func (s *statusStorage) Delete() error {
+	temp := filepath.Dir(s.path) + ".del-" + filepath.Base(s.path)
+	if err := os.Rename(s.path, temp); err != nil && !os.IsNotExist(err) {
+		return err
+	}
+	return os.RemoveAll(temp)
+}

pkg/cri/store/container/status_test.go

@@ -0,0 +1,195 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package container
+
+import (
+	"encoding/json"
+	"errors"
+	"io/ioutil"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	assertlib "github.com/stretchr/testify/assert"
+	requirelib "github.com/stretchr/testify/require"
+	runtime "k8s.io/cri-api/pkg/apis/runtime/v1alpha2"
+)
+
+func TestContainerState(t *testing.T) {
+	for c, test := range map[string]struct {
+		status Status
+		state  runtime.ContainerState
+	}{
+		"unknown state": {
+			status: Status{
+				Unknown: true,
+			},
+			state: runtime.ContainerState_CONTAINER_UNKNOWN,
+		},
+		"unknown state because there is no timestamp set": {
+			status: Status{},
+			state:  runtime.ContainerState_CONTAINER_UNKNOWN,
+		},
+		"created state": {
+			status: Status{
+				CreatedAt: time.Now().UnixNano(),
+			},
+			state: runtime.ContainerState_CONTAINER_CREATED,
+		},
+		"running state": {
+			status: Status{
+				CreatedAt: time.Now().UnixNano(),
+				StartedAt: time.Now().UnixNano(),
+			},
+			state: runtime.ContainerState_CONTAINER_RUNNING,
+		},
+		"exited state": {
+			status: Status{
+				CreatedAt:  time.Now().UnixNano(),
+				FinishedAt: time.Now().UnixNano(),
+			},
+			state: runtime.ContainerState_CONTAINER_EXITED,
+		},
+	} {
+		t.Logf("TestCase %q", c)
+		assertlib.Equal(t, test.state, test.status.State())
+	}
+}
+
+func TestStatusEncodeDecode(t *testing.T) {
+	s := &Status{
+		Pid:        1234,
+		CreatedAt:  time.Now().UnixNano(),
+		StartedAt:  time.Now().UnixNano(),
+		FinishedAt: time.Now().UnixNano(),
+		ExitCode:   1,
+		Reason:     "test-reason",
+		Message:    "test-message",
+		Removing:   true,
+		Starting:   true,
+		Unknown:    true,
+	}
+	assert := assertlib.New(t)
+	data, err := s.encode()
+	assert.NoError(err)
+	newS := &Status{}
+	assert.NoError(newS.decode(data))
+	s.Removing = false // Removing should not be encoded.
+	s.Starting = false // Starting should not be encoded.
+	s.Unknown = false  // Unknown should not be encoded.
+	assert.Equal(s, newS)
+
+	unsupported, err := json.Marshal(&versionedStatus{
+		Version: "random-test-version",
+		Status:  *s,
+	})
+	assert.NoError(err)
+	assert.Error(newS.decode(unsupported))
+}
+
+func TestStatus(t *testing.T) {
+	testID := "test-id"
+	testStatus := Status{
+		CreatedAt: time.Now().UnixNano(),
+	}
+	updateStatus := Status{
+		CreatedAt: time.Now().UnixNano(),
+		StartedAt: time.Now().UnixNano(),
+	}
+	updateErr := errors.New("update error")
+	assert := assertlib.New(t)
+	require := requirelib.New(t)
+
+	tempDir, err := ioutil.TempDir(os.TempDir(), "status-test")
+	require.NoError(err)
+	defer os.RemoveAll(tempDir)
+	statusFile := filepath.Join(tempDir, "status")
+
+	t.Logf("simple store and get")
+	s, err := StoreStatus(tempDir, testID, testStatus)
+	assert.NoError(err)
+	old := s.Get()
+	assert.Equal(testStatus, old)
+	_, err = os.Stat(statusFile)
+	assert.NoError(err)
+	loaded, err := LoadStatus(tempDir, testID)
+	require.NoError(err)
+	assert.Equal(testStatus, loaded)
+
+	t.Logf("failed update should not take effect")
+	err = s.Update(func(o Status) (Status, error) {
+		o = updateStatus
+		return o, updateErr
+	})
+	assert.Equal(updateErr, err)
+	assert.Equal(testStatus, s.Get())
+	loaded, err = LoadStatus(tempDir, testID)
+	require.NoError(err)
+	assert.Equal(testStatus, loaded)
+
+	t.Logf("successful update should take effect but not checkpoint")
+	err = s.Update(func(o Status) (Status, error) {
+		o = updateStatus
+		return o, nil
+	})
+	assert.NoError(err)
+	assert.Equal(updateStatus, s.Get())
+	loaded, err = LoadStatus(tempDir, testID)
+	require.NoError(err)
+	assert.Equal(testStatus, loaded)
+	// Recover status.
+	assert.NoError(s.Update(func(o Status) (Status, error) {
+		o = testStatus
+		return o, nil
+	}))
+
+	t.Logf("failed update sync should not take effect")
+	err = s.UpdateSync(func(o Status) (Status, error) {
+		o = updateStatus
+		return o, updateErr
+	})
+	assert.Equal(updateErr, err)
+	assert.Equal(testStatus, s.Get())
+	loaded, err = LoadStatus(tempDir, testID)
+	require.NoError(err)
+	assert.Equal(testStatus, loaded)
+
+	t.Logf("successful update sync should take effect and checkpoint")
+	err = s.UpdateSync(func(o Status) (Status, error) {
+		o = updateStatus
+		return o, nil
+	})
+	assert.NoError(err)
+	assert.Equal(updateStatus, s.Get())
+	loaded, err = LoadStatus(tempDir, testID)
+	require.NoError(err)
+	assert.Equal(updateStatus, loaded)
+
+	t.Logf("successful update should not affect existing snapshot")
+	assert.Equal(testStatus, old)
+
+	t.Logf("delete status")
+	assert.NoError(s.Delete())
+	_, err = LoadStatus(tempDir, testID)
+	assert.Error(err)
+	_, err = os.Stat(statusFile)
+	assert.True(os.IsNotExist(err))
+
+	t.Logf("delete status should be idempotent")
+	assert.NoError(s.Delete())
+}