github/containerd
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases 2 Wiki Activity
12,912 Commits 3 Branches 2 Tags 112 MiB
dc7dba9c20
Commit Graph

774 Commits

Author SHA1 Message Date
Derek McGowan
b11439fc4b
Merge pull request #9034 from thaJeztah/replace_reference 
replace reference/docker for github.com/distribution/reference v0.5.0
 2023-09-05 06:52:29 -07:00
Akihiro Suda
0ee2433c94
Merge pull request #5890 from artqzn/idmapped_mounts 
RFC: Initial support of idmapped mount points
 2023-09-05 20:41:05 +09:00
Akihiro Suda
e30a40eb65
Merge pull request #9016 from djdongjin/remove-most-logrus 
Remove most logrus import
 2023-09-05 16:09:12 +09:00
Ilya Hanov
9d01ed1c32 integration: add test for idmapped mounts 
Signed-off-by: Alexey Perevalov <alexey.perevalov@huawei.com>
Signed-off-by: Ilya Hanov <ilya.hanov@huawei-partners.com>
 2023-09-05 01:23:30 +03:00
Sebastiaan van Stijn
9bc6441c21
vendor: github.com/google/uuid v1.3.1 
Contains some performance improvements:

full diff: https://github.com/google/uuid/compare/v1.3.0...v1.3.1

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2023-09-01 11:49:50 +02:00
Sebastiaan van Stijn
4923470902
replace reference/docker for github.com/distribution/reference v0.5.0 
The reference/docker package was a fork of github.com/distribution/distribution,
which could not easily be used as a direct dependency, as it brought many other
dependencies with it.

The "reference' package has now moved to a separate repository, which means
we can replace the local fork, and use the upstream implementation again.

The new module was extracted from the distribution repository at commit:
b9b19409cf

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2023-08-31 15:54:50 +02:00
Kirtana Ashok
fd5d92a7f5 Update hcsshim tag versioning to v0.12.0-rc.0 
hcsshim tags v0.10.* is deprecated, so using the new
v0.12.0-rc.* versioning for hcsshim tags on containerd/main

Signed-off-by: Kirtana Ashok <kiashok@microsoft.com>
 2023-08-29 17:41:20 -07:00
Jin Dong
fc45365fa1 Remove most logrus 
Signed-off-by: Jin Dong <jin.dong@databricks.com>
 2023-08-26 14:31:53 -04:00
Akihiro Suda
490905be6f
go.mod: github.com/containerd/continuity v0.4.2 
https://github.com/containerd/continuity/compare/1e0d26eb2381...v0.4.2

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 2023-08-25 16:39:55 +09:00
Akihiro Suda
f48bbef193
Merge pull request #8994 from mxpv/cri 
Use sandboxed CRI by default
 2023-08-24 13:42:58 +09:00
Maksym Pavlenko
c3f3cad287
Use sandboxed CRI by default 
Signed-off-by: Maksym Pavlenko <pavlenko.maksym@gmail.com>
 2023-08-23 08:50:40 -07:00
Sebastiaan van Stijn
b76cd4d9fd
replace some fmt.Sprintfs with strconv 
Teeny-tiny optimizations:

    BenchmarkSprintf-10       37735996    32.31  ns/op  0 B/op  0 allocs/op
    BenchmarkItoa-10         591945836     2.031 ns/op  0 B/op  0 allocs/op
    BenchmarkFormatUint-10   593701444     2.014 ns/op  0 B/op  0 allocs/op

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2023-08-23 16:43:02 +02:00
James Sturtevant
8399a4ee71 Remove temporary replace 
Signed-off-by: James Sturtevant <jstur@microsoft.com>
 2023-08-21 16:29:18 +00:00
Derek McGowan
465c04c289
Merge pull request #8946 from lengrongfu/feat/bump-client-go 
bump client-go v0.26.4
 2023-08-18 16:35:24 -07:00
Samuel Karp
3b32d3c6f2
Merge pull request #8922 from lengrongfu/feat/sync-image-action 
feat: replace mcr.microsoft.com registry to ghcr.io/containerd registry
 2023-08-17 00:59:46 -07:00
Fu Wei
ba852faf41
Merge pull request #8954 from fuweid/fix-shim-leak 2023-08-17 08:16:20 +08:00
Akihiro Suda
f35d1f08ec
go.mod: github.com/opencontainers/runc v1.1.9 
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 2023-08-11 21:25:29 +09:00
Wei Fu
601699a184 integration: add ShouldRetryShutdown case based on #7496 
Since the moby/moby can't handle duplicate exit event well, it's hard
for containerd to retry shutdown if there is error, like context
canceled.

In order to prevent from regression like #4769, I add skipped
integration case as TODO item and we should rethink about how to handle
the task/shim lifecycle.

Signed-off-by: Wei Fu <fuweid89@gmail.com>
 2023-08-11 17:43:51 +08:00
Wei Fu
5bdd9ca938 integration: add case to reproduce #7496 
Signed-off-by: Wei Fu <fuweid89@gmail.com>
 2023-08-11 17:41:04 +08:00
rongfu.leng
b451fa96a6 bump client-go v0.26.4 
Signed-off-by: rongfu.leng <rongfu.leng@daocloud.io>
 2023-08-11 00:30:03 +08:00
Kirtana Ashok
e7e5619fed Update hcsshim tag to v0.10.0 
Signed-off-by: Kirtana Ashok <kiashok@microsoft.com>
 2023-08-09 11:55:54 -07:00
rongfu.leng
4f3c8c4687 replace mcr.microsoft.com registry to ghcr.io/containerd registry 
Signed-off-by: rongfu.leng <rongfu.leng@daocloud.io>
 2023-08-06 21:14:07 +08:00
Fu Wei
2b2195c36b
Merge pull request #8722 from marquiz/devel/cgroup-driver-autoconfig 
cri: implement RuntimeConfig rpc
 2023-08-04 16:09:34 +08:00
Rodrigo Campos
2d64ab8d79 cri: Don't use rel path for image volumes 
Runc 1.1 throws a warning when using rel destination paths, and runc 1.2
is planning to thow an error (i.e. won't start the container).

Let's just make this an abs path in the only place it might not be: the
mounts created due to `VOLUME` directives in the Dockerfile.

Signed-off-by: Rodrigo Campos <rodrigoca@microsoft.com>
 2023-07-31 12:33:54 +02:00
Iceber Gu
7f7ba31b64 cri: fix using the pinned label to pin image 
Signed-off-by: Iceber Gu <wei.cai-nat@daocloud.io>
 2023-07-26 12:26:00 +08:00
Markus Lehtonen
850b2e1bf3 go.mod: update cri-api to v1.28.0-beta.0 
Required to support upcoming Kubernetes (v1.28) features.

Signed-off-by: Markus Lehtonen <markus.lehtonen@intel.com>
 2023-07-24 14:49:14 +03:00
Akihiro Suda
bc96b9039a
go.mod: github.com/AdamKorcz/go-118-fuzz-build v0.0.0-20230306123547-8075edf89bb0 
5330a85ea6...8075edf89b

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 2023-07-23 03:08:01 +09:00
Akihiro Suda
da27408854
go.mod: google.golang.org/genproto v0.0.0-20230720185612-659f7aaaa771 
ccb25ca9f1...659f7aaaa7

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 2023-07-23 03:08:01 +09:00
Akihiro Suda
73dc13ad62
go.mod: github.com/urfave/cli/compare v1.22.14 
https://github.com/urfave/cli/compare/v1.22.13...v1.22.14

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 2023-07-23 03:08:00 +09:00
Akihiro Suda
1c4fc568b1
go.mod: github.com/prometheus/client_golang/compare v1.16.0 
https://github.com/prometheus/client_golang/compare/v1.14.0...v1.16.0

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 2023-07-23 03:08:00 +09:00
Akihiro Suda
68abb525a5
go.mod: github.com/minio/sha256-simd v1.0.1 
https://github.com/minio/sha256-simd/compare/v1.0.0...v1.0.1

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 2023-07-23 03:08:00 +09:00
Akihiro Suda
1f2216cc78
go.mod: github.com/klauspost/compress v1.16.7 
https://github.com/imdario/mergo/compare/v0.3.13...v1.0.0

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 2023-07-23 03:08:00 +09:00
Akihiro Suda
3c6ab04203
go.mod: dario.cat/mergo v1.0.0 
https://github.com/imdario/mergo/compare/v0.3.13...v1.0.0

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 2023-07-23 03:08:00 +09:00
Akihiro Suda
4bda0a69e2
go.mod: github.com/grpc-ecosystem/go-grpc-middleware v1.4.0 
https://github.com/grpc-ecosystem/go-grpc-middleware/compare/v1.3.0...v1.4.0

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 2023-07-23 03:07:59 +09:00
Akihiro Suda
0f033b6125
go.mod: github.com/emicklei/go-restful/v3 v3.10.2 
https://github.com/emicklei/go-restful/compare/v3.10.1...v3.10.2

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 2023-07-23 03:07:59 +09:00
Akihiro Suda
90e050298c
go.mod: github.com/containernetworking/plugin v1.3.0 
https://github.com/containernetworking/plugins/compare/v1.2.0...v1.3.0

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 2023-07-23 03:07:59 +09:00
Akihiro Suda
0498acefb9
go.mod: github.com/.../container-device-interface v0.6.0 
https://github.com/container-orchestrated-devices/container-device-interface/compare/v0.5.4...v0.6.0

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 2023-07-23 03:07:59 +09:00
Akihiro Suda
74b8cb850a
go.mod: github.com/opencontainers/runc v1.1.8 
https://github.com/opencontainers/runc/compare/v1.1.7...v1.1.8

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 2023-07-23 03:07:59 +09:00
Akihiro Suda
895dd2e93b
go.mod: github.com/opencontainers/image-spec v1.1.0-rc4 
https://github.com/opencontainers/image-spec/compare/v1.1.0-rc3...v1.1.0-rc4

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 2023-07-23 03:07:58 +09:00
Akihiro Suda
235a4452df
go.mod: github.com/opencontainers/runtime-spec v1.1.0 
https://github.com/opencontainers/runtime-spec/compare/v1.1.0-rc.2...v1.1.0

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 2023-07-23 03:07:58 +09:00
Maksym Pavlenko
8dcc06d14a
Merge pull request #8747 from Iceber/shim_ttrpc_service 
shim: change ttrpcService and ttrpcServerOptioner to exported interfaces
 2023-07-18 17:12:22 -07:00
Kirtana Ashok
56d80f81a2 Update hcsshim tag to v0.10.0-rc.9 
Signed-off-by: Kirtana Ashok <kiashok@microsoft.com>
 2023-07-17 10:28:47 -07:00
Phil Estes
a94918b591
Merge pull request #8803 from kinvolk/rata/userns-sbserver 
cri/sbserver: Add support for user namespaces (KEP-127)
 2023-07-17 10:57:01 -04:00
Phil Estes
34b1653e95
Merge pull request #8780 from slonopotamus/uncopypaste-read-spec 
Uncopypaste parsing of OCI Bundle spec file
 2023-07-11 09:53:00 -04:00
Rodrigo Campos
48cdf1fe2c integration: Enable userns tests for sbserver 
Now we ported support to sbserver, let's enable the e2e tests there too.

Signed-off-by: Rodrigo Campos <rodrigoca@microsoft.com>
 2023-07-11 15:15:25 +02:00
Marat Radchenko
9e34b8b441 Uncopypaste parsing of OCI Bundle spec file 
Signed-off-by: Marat Radchenko <marat@slonopotamus.org>
 2023-07-11 14:41:15 +03:00
Sebastiaan van Stijn
05fef52b68
vendor: github.com/containerd/zfs v1.1.0 
- update github.com/mistifyio/go-zfs dependency to github.com/mistifyio/go-zfs/v3,
  which contains various bugfixes, and adds go module support (which required a major
  version update): https://github.com/mistifyio/go-zfs/compare/f784269be439...v3.0.1
- remove github.com/pkg/errors dependency
- various minor cleanups/fixes

Full diff: https://github.com/containerd/zfs/compare/v1.0.0...v1.1.0

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2023-07-06 11:56:07 +02:00
Iceber Gu
00e5ae2118 shim: change ttrpcService and ttrpcServerOptioner to exported interfaces 
Signed-off-by: Iceber Gu <wei.cai-nat@daocloud.io>
 2023-07-06 00:36:43 +08:00
Fu Wei
fec3191abc
Merge pull request #8755 from dcantah/withbytesbuffers-chg 
integration/client: Rework withBytesBuffers
 2023-07-04 10:04:10 +08:00
Danny Canter
d6dbc4040b go.mod: Update cgroups to 3.0.2 
This brings in a ton of great improvements, most notably for the containerd
daemon is performance improvements for cgroups1 and 2 for gathering stats,
as well as some fixes for enabling controllers and deleting v1 cgroups.

Signed-off-by: Danny Canter <danny@dcantah.dev>
 2023-06-29 12:14:59 -07:00
Danny Canter
e85352183e integration/client: Rework withBytesBuffers 
All of the tests using this didn't need stdin/err (one of them not even
stdout), so we can just leave them "empty" and change to a withStdout
naming to make it more obvious.

Signed-off-by: Danny Canter <danny@dcantah.dev>
 2023-06-27 23:47:14 -07:00
Kazuyoshi Kato
9b4ed8acc2
Merge pull request #8696 from fuweid/deflaky-blockfile 
chore: deflake the blockfile testsuite
 2023-06-26 09:54:33 -07:00
Danny Canter
f82d9b7991 Integration: Align empty IO func on Windows 
I think NullIO is fine on Windows now. We have it as an option in ctr
and it's used for the pod sandbox container in CRI. Lets see if CI agrees..

Signed-off-by: Danny Canter <danny@dcantah.dev>
 2023-06-22 20:05:34 -07:00
Wei Fu
59b0b39af0 vendor: update github.com/containerd/continuity 
Pin it with 1e0d26eb2381594984ee80989c9c229dbd930d9f

Signed-off-by: Wei Fu <fuweid89@gmail.com>
 2023-06-17 08:36:45 +08:00
Phil Estes
38b0f970f0
No more nondistributable layers in MS registry 
Microsoft announced the removal of nondistributable layers from their
images today. This makes the convert test fail since it assumes the
first layer is nondistributable on Windows during the test.

Signed-off-by: Phil Estes <estesp@amazon.com>
 2023-06-13 16:34:44 -04:00
Derek McGowan
dd5e9f6538
Merge pull request #7944 from adisky/new-pinned-image 
CRI Pinned image support
 2023-06-10 22:29:34 -07:00
Derek McGowan
98b7dfb870
Merge pull request #8673 from thaJeztah/no_any 
avoid "any" as variable name
 2023-06-10 20:44:30 -07:00
Sebastiaan van Stijn
4bb709c018
avoid "any" as variable name 
Avoid shadowing / confusion with Go's "any" built-in type.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2023-06-10 13:49:06 +02:00
Sebastiaan van Stijn
577696f608
replace some basic uses of fmt.Sprintf() 
Really tiny gains here, and doesn't significantly impact readability:

    BenchmarkSprintf
    BenchmarkSprintf-10    11528700     91.59 ns/op   32 B/op  1 allocs/op
    BenchmarkConcat
    BenchmarkConcat-10    100000000     11.76 ns/op    0 B/op  0 allocs/op

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2023-06-10 13:24:43 +02:00
Derek McGowan
ee2c8b79bf
Merge pull request #8664 from laurazard/timeout-integration-test-shim-oomscore 
integration/client: add timeout to `TestShimOOMScore`
 2023-06-09 11:49:48 -07:00
Laura Brehm
df280942a7
integration/client: add timeout to TestShimOOMScore 
Signed-off-by: Laura Brehm <laurabrehm@hey.com>
 2023-06-09 10:10:42 +01:00
Kazuyoshi Kato
326cd0623e
Merge pull request #8362 from gabriel-samfira/fix-non-c-volume 
Fix non C volumes on Windows
 2023-06-08 21:07:23 -07:00
Brian Goff
104b9ef9eb Update x/sys to 0.8.0 
Signed-off-by: Brian Goff <cpuguy83@gmail.com>
 2023-06-03 16:14:38 +00:00
Aditi Sharma
fe4f8bd884 Pinned image support 
Signed-off-by: Aditi Sharma <adi.sky17@gmail.com>
 2023-06-02 09:57:22 +05:30
Kazuyoshi Kato
73645b1dfe
Merge pull request #8588 from lengrongfu/feat/cleanup_config_tls 
Cleanup DEPRECATED TLS config
 2023-05-31 18:50:54 -07:00
Derek McGowan
2a60fe5a60
Remove events from init context 
Events from the init context have been replaced by the events plugin

Signed-off-by: Derek McGowan <derek@mcg.dev>
 2023-05-31 09:35:03 -07:00
Evan Lezar
d3887b2e62 Support CDI devices in ctr --device flag 
This change adds support for CDI devices to the ctr --device flag.
If a fully-qualified CDI device name is specified, this is injected
into the OCI specification before creating the container.

Note that the CDI specifications and the devices that they represent
are local and mirror the behaviour of linux devices in the ctr command.

Signed-off-by: Evan Lezar <elezar@nvidia.com>
 2023-05-31 16:14:01 +02:00
rongfu.leng
d2b7a1e293 cleanup DEPRECATED TLS config 
Signed-off-by: rongfu.leng <rongfu.leng@daocloud.io>
 2023-05-31 09:37:41 +08:00
rongfu.leng
9287711b7a upgrade registry.k8s.io/pause version 
Signed-off-by: rongfu.leng <rongfu.leng@daocloud.io>
 2023-05-28 07:59:10 +08:00
Gabriel Adrian Samfira
b9dfd29b73 Update tests to use volume-copy-up:2.2 
Signed-off-by: Gabriel Adrian Samfira <gsamfira@cloudbasesolutions.com>
 2023-05-26 07:33:06 +00:00
Phil Estes
579b5596c5 Update volume-ownership image with latest hashes 
Fixes test which requires static content to match a GHCR-located image which was recently updated.

Signed-off-by: Phil Estes <estesp@amazon.com>
 2023-05-25 11:13:57 -04:00
Gabriel Adrian Samfira
79709a2058 disable provenance 
Signed-off-by: Gabriel Adrian Samfira <gsamfira@cloudbasesolutions.com>
 2023-05-19 00:01:05 +03:00
Derek McGowan
44eb8f3466
Merge pull request #8524 from gabriel-samfira/update-volume-copy-up 
Update volume-copy-up
 2023-05-17 09:28:40 -07:00
Gabriel Adrian Samfira
f8907ab872
Update volume-copy-up 
Add new test cases for volumes on both Linux and Windows. These new
volumes will be used to test that we don't accidentally mangle volume
paths on Linux and that non-C volume mounts work properly when defined
in an image on Windows.

Signed-off-by: Gabriel Adrian Samfira <gsamfira@cloudbasesolutions.com>
 2023-05-17 14:20:37 +03:00
Akihiro Suda
811456b314
go.mod: github.com/containerd/continuity v0.4.0 
https://github.com/containerd/continuity/compare/72c70feb3081...v0.4.0

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 2023-05-17 19:50:20 +09:00
Akihiro Suda
6f715ab101
go.mod: github.com/containerd/go-runc v1.1.0 
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 2023-05-17 13:45:37 +09:00
Samuel Karp
c60ba138b6
Merge pull request #8502 from mstmdev/fix-typos 2023-05-16 08:41:02 -07:00
mstmdev
cdaa4025e9 Fix some typos 
Signed-off-by: Pan Yibo <mstmdev@gmail.com>
 2023-05-16 10:12:50 +08:00
Akihiro Suda
2eeb4b6238
Merge pull request #8373 from Iceber/shim_run 
runtime/shim: rename RunManager to Run and remove `runc/v2/services` package
 2023-05-12 00:46:46 +09:00
Phil Estes
43bbffba37
Merge pull request #8500 from AkihiroSuda/runtime-spec-v1.1.0-rc.2 
go.mod: github.com/opencontainers/runtime-spec v1.1.0-rc.2
 2023-05-09 10:42:53 -07:00
Akihiro Suda
4347fc8bc2
go.mod: github.com/opencontainers/image-spec v1.1.0-rc3 
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 2023-05-09 23:35:58 +09:00
Derek McGowan
718250b6ba
Update ttrpc to v1.2.2 
Signed-off-by: Derek McGowan <derek@mcg.dev>
 2023-05-09 13:08:46 -07:00
Akihiro Suda
5e054ee631
go.mod: github.com/opencontainers/runtime-spec v1.1.0-rc.2 
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 2023-05-09 22:26:37 +09:00
Iceber Gu
ecb693ec74 bump typeurl to v2.1.1 
Signed-off-by: Iceber Gu <wei.cai-nat@daocloud.io>
 2023-05-09 13:23:02 +08:00
Sebastiaan van Stijn
0ba0664742
vendor: github.com/opencontainers/runc v1.1.7 
release notes: https://github.com/opencontainers/runc/releases/tag/v1.1.7
full diff: https://github.com/opencontainers/runc/compare/v1.1.6...v1.1.7

This is the seventh patch release in the 1.1.z release of runc, and is
the last planned release of the 1.1.z series. It contains a fix for
cgroup device rules with systemd when handling device rules for devices
that don't exist (though for devices whose drivers don't correctly
register themselves in the kernel -- such as the NVIDIA devices -- the
full fix only works with systemd v240+).

- When used with systemd v240+, systemd cgroup drivers no longer skip
  DeviceAllow rules if the device does not exist (a regression introduced
  in runc 1.1.3). This fix also reverts the workaround added in runc 1.1.5,
  removing an extra warning emitted by runc run/start.
- The source code now has a new file, runc.keyring, which contains the keys
  used to sign runc releases.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2023-04-27 12:00:23 +02:00
Sebastiaan van Stijn
cbd10e41a6
vendor: github.com/opencontainers/runc v1.1.6 
release notes: https://github.com/opencontainers/runc/releases/tag/v1.1.6
full diff: opencontainers/runc@v1.1.5...v1.1.6

This is the sixth patch release in the 1.1.z series of runc, which fixes
a series of cgroup-related issues.

Note that this release can no longer be built from sources using Go
1.16. Using a latest maintained Go 1.20.x or Go 1.19.x release is
recommended. Go 1.17 can still be used.

- systemd cgroup v1 and v2 drivers were deliberately ignoring UnitExist error
  from systemd while trying to create a systemd unit, which in some scenarios
  may result in a container not being added to the proper systemd unit and
  cgroup.
- systemd cgroup v2 driver was incorrectly translating cpuset range from spec's
  resources.cpu.cpus to systemd unit property (AllowedCPUs) in case of more
  than 8 CPUs, resulting in the wrong AllowedCPUs setting.
- systemd cgroup v1 driver was prefixing container's cgroup path with the path
  of PID 1 cgroup, resulting in inability to place PID 1 in a non-root cgroup.
- runc run/start may return "permission denied" error when starting a rootless
  container when the file to be executed does not have executable bit set for
  the user, not taking the CAP_DAC_OVERRIDE capability into account. This is
  a regression in runc 1.1.4, as well as in Go 1.20 and 1.20.1
- cgroup v1 drivers are now aware of misc controller.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2023-04-27 11:59:14 +02:00
Rodrigo Campos
92b93e376a cri: Vendor v0.27.1 
As requested by Akihiro Suda here:
	https://github.com/containerd/containerd/pull/8211#discussion_r1171041922

This just bumps the tag name to the k8s final release. There are no
changes other than the tag name, though.

Signed-off-by: Rodrigo Campos <rodrigoca@microsoft.com>
 2023-04-24 16:11:42 +02:00
Sebastiaan van Stijn
f238167408
go.mod: add comment explaining go-fuzz-headers replace rule 
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2023-04-15 13:03:12 +02:00
Sebastiaan van Stijn
ec9e74ed92
go.mod: remove replace for github.com/opencontainers/runtime-tools 
The replace rule was actually downgrading the package by one commit;
946c877fa8...2e043c6bd6

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2023-04-15 13:01:24 +02:00
Sebastiaan van Stijn
6c40cf3051
go.mod: integration: use non-pre-release of containerd 
The actual version is replaced, so only "optics"

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2023-04-15 12:50:51 +02:00
Sebastiaan van Stijn
92d1e9bee0
go.mod: integration: move indirect dependencies to the right group 
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2023-04-15 12:45:06 +02:00
Kazuyoshi Kato
ffc70c45c4
Merge pull request #8359 from kiashok/argsEscapedTestFix 
Fix argsEscaped tests
 2023-04-14 13:08:51 -07:00
Iceber Gu
b71f4b7518 runtime/shim: rename RunManager to Run 
Signed-off-by: Iceber Gu <wei.cai-nat@daocloud.io>
 2023-04-14 11:42:21 +08:00
Rodrigo Campos
85afda6f52 cri: Vendor v0.27.0-beta.0 for mounts uid/gid mappings 
We will use this in future commits to see if the kubelet requested idmap
mounts for volumes, that we don't yet support.

Signed-off-by: Rodrigo Campos <rodrigoca@microsoft.com>
 2023-04-11 17:31:27 +02:00
Kirtana Ashok
e0b817ec15 Fix argsEscaped tests 
- Rename test name
- Add a tag to the container image used in the tests instead of the latest tag
- Add a 5 second delay between container start and stop to ensure that the
  container is fully initialized

Signed-off-by: Kirtana Ashok <Kirtana.Ashok@microsoft.com>
 2023-04-07 13:25:03 -07:00
Gabriel Adrian Samfira
4012c1b853 Remove escalated privileges 
Signed-off-by: Gabriel Adrian Samfira <gsamfira@cloudbasesolutions.com>
 2023-03-31 06:17:35 -07:00
Gabriel Adrian Samfira
54f8abe553 Use DefaultSnapshotter 
Signed-off-by: Gabriel Adrian Samfira <gsamfira@cloudbasesolutions.com>
 2023-03-31 06:17:35 -07:00
Gabriel Adrian Samfira
47dd3dcffb use t.Fatal if we cannot enable process privileges 
Signed-off-by: Gabriel Adrian Samfira <gsamfira@cloudbasesolutions.com>
 2023-03-31 06:17:35 -07:00
Gabriel Adrian Samfira
e31bef15fa Update continuity 
Signed-off-by: Gabriel Adrian Samfira <gsamfira@cloudbasesolutions.com>
 2023-03-31 06:17:32 -07:00
Gabriel Adrian Samfira
95687a9324 Fix go.mod, simplify boolean logic, add logging 
Signed-off-by: Gabriel Adrian Samfira <gsamfira@cloudbasesolutions.com>
 2023-03-31 06:16:56 -07:00