github/containerd
4
0
Fork 0
Code Issues Pull Requests Packages Projects Releases 2 Wiki Activity
12,725 Commits 3 Branches 4 Tags
fe17f65159fa8244e652be75fcdd59a2f38e3351
Commit Graph

735 Commits

Author SHA1 Message Date
Fu Wei
fe17f65159 Merge pull request #8287 from kinvolk/rata/userns-stateless-idmap 
Add support for userns in stateless and stateful pods with idmap mounts (KEP-127, k8s >= 1.27)
 2023-09-14 18:14:02 +08:00
Rodrigo Campos
2e13d39546 pkg/process: Only use idmap mounts if runc supports it 
runc, as mandated by the runtime-spec, ignores unknown fields in the
config.json. This is unfortunate for cases where we _must_ enable that
feature or fail.

For example, if we want to start a container with user namespaces and
volumes, using the uidMappings/gidMappings field is needed so the
UID/GIDs in the volume don't end up with garbage. However, if we don't
fail when runc will ignore these fields (because they are unknown to
runc), we will just start a container without using the mappings and the
UID/GIDs the container will persist to volumes the hostUID/GID, that can
change if the container is re-scheduled by Kubernetes.

This will end up in volumes having "garbage" and unmapped UIDs that the
container can no longer change. So, let's avoid this entirely by just
checking that runc supports idmap mounts if the container we are about
to create needs them.

Please note that the "runc features" subcommand is only run when we are
using idmap mounts. If idmap mounts are not used, the subcommand is not
run and therefore this should not affect containers that don't use idmap
mounts in any way.

Signed-off-by: Rodrigo Campos <rodrigoca@microsoft.com>
 2023-09-13 16:44:54 +02:00
Rodrigo Campos
fce1b95076 go.mod: Update runtime spec to include features.MountExtensions 
Future patches will use that field.

Signed-off-by: Rodrigo Campos <rodrigoca@microsoft.com>
 2023-09-13 16:44:54 +02:00
Rodrigo Campos
e832605a80 integration: Simplify WithVolumeMount() 
Signed-off-by: Rodrigo Campos <rodrigoca@microsoft.com>
 2023-09-13 16:44:54 +02:00
Rodrigo Campos
24aa808fe2 integration: Add userns test with volumes 
Signed-off-by: Rodrigo Campos <rodrigoca@microsoft.com>
 2023-09-13 16:44:54 +02:00
Phil Estes
0f52935a53 Merge pull request #9088 from samuelkarp/nri 
vendor: update github.com/containerd/nri@v0.4.0
 2023-09-13 10:26:02 -04:00
Samuel Karp
39804bc3f0 Merge pull request #8909 from liggitt/fieldmask 2023-09-13 00:33:44 -07:00
Samuel Karp
9656b8c0d0 nri: update mock plugin handlers 
Signed-off-by: Samuel Karp <samuelkarp@google.com>
 2023-09-12 17:51:27 -07:00
Samuel Karp
6f9de91efc vendor: update github.com/containerd/nri@v0.4.0 
Signed-off-by: Samuel Karp <samuelkarp@google.com>
 2023-09-12 16:41:05 -07:00
Sebastiaan van Stijn
05093d7c07 vendor: github.com/cncf-tags/container-device-interface v0.6.1 
Removes uses of the github.com/opencontainers/runc/libcontainer/devices
package.

full diff: https://github.com/cncf-tags/container-device-interface/compare/v0.6.0...v0.6.1

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2023-09-08 13:53:43 +02:00
Jordan Liggitt
55b2df560f go.mod: github.com/grpc-ecosystem/grpc-gateway/v2 v2.16.2 
Signed-off-by: Jordan Liggitt <liggitt@google.com>
 2023-09-07 16:53:10 -04:00
Derek McGowan
b11439fc4b Merge pull request #9034 from thaJeztah/replace_reference 
replace reference/docker for github.com/distribution/reference v0.5.0
 2023-09-05 06:52:29 -07:00
Akihiro Suda
0ee2433c94 Merge pull request #5890 from artqzn/idmapped_mounts 
RFC: Initial support of idmapped mount points
 2023-09-05 20:41:05 +09:00
Akihiro Suda
e30a40eb65 Merge pull request #9016 from djdongjin/remove-most-logrus 
Remove most logrus import
 2023-09-05 16:09:12 +09:00
Ilya Hanov
9d01ed1c32 integration: add test for idmapped mounts 
Signed-off-by: Alexey Perevalov <alexey.perevalov@huawei.com>
Signed-off-by: Ilya Hanov <ilya.hanov@huawei-partners.com>
 2023-09-05 01:23:30 +03:00
Sebastiaan van Stijn
9bc6441c21 vendor: github.com/google/uuid v1.3.1 
Contains some performance improvements:

full diff: https://github.com/google/uuid/compare/v1.3.0...v1.3.1

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2023-09-01 11:49:50 +02:00
Sebastiaan van Stijn
4923470902 replace reference/docker for github.com/distribution/reference v0.5.0 
The reference/docker package was a fork of github.com/distribution/distribution,
which could not easily be used as a direct dependency, as it brought many other
dependencies with it.

The "reference' package has now moved to a separate repository, which means
we can replace the local fork, and use the upstream implementation again.

The new module was extracted from the distribution repository at commit:
b9b19409cf

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2023-08-31 15:54:50 +02:00
Kirtana Ashok
fd5d92a7f5 Update hcsshim tag versioning to v0.12.0-rc.0 
hcsshim tags v0.10.* is deprecated, so using the new
v0.12.0-rc.* versioning for hcsshim tags on containerd/main

Signed-off-by: Kirtana Ashok <kiashok@microsoft.com>
 2023-08-29 17:41:20 -07:00
Jin Dong
fc45365fa1 Remove most logrus 
Signed-off-by: Jin Dong <jin.dong@databricks.com>
 2023-08-26 14:31:53 -04:00
Akihiro Suda
490905be6f go.mod: github.com/containerd/continuity v0.4.2 
https://github.com/containerd/continuity/compare/1e0d26eb2381...v0.4.2

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 2023-08-25 16:39:55 +09:00
Akihiro Suda
f48bbef193 Merge pull request #8994 from mxpv/cri 
Use sandboxed CRI by default
 2023-08-24 13:42:58 +09:00
Maksym Pavlenko
c3f3cad287 Use sandboxed CRI by default 
Signed-off-by: Maksym Pavlenko <pavlenko.maksym@gmail.com>
 2023-08-23 08:50:40 -07:00
Sebastiaan van Stijn
b76cd4d9fd replace some fmt.Sprintfs with strconv 
Teeny-tiny optimizations:

    BenchmarkSprintf-10       37735996    32.31  ns/op  0 B/op  0 allocs/op
    BenchmarkItoa-10         591945836     2.031 ns/op  0 B/op  0 allocs/op
    BenchmarkFormatUint-10   593701444     2.014 ns/op  0 B/op  0 allocs/op

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2023-08-23 16:43:02 +02:00
James Sturtevant
8399a4ee71 Remove temporary replace 
Signed-off-by: James Sturtevant <jstur@microsoft.com>
 2023-08-21 16:29:18 +00:00
Derek McGowan
465c04c289 Merge pull request #8946 from lengrongfu/feat/bump-client-go 
bump client-go v0.26.4
 2023-08-18 16:35:24 -07:00
Samuel Karp
3b32d3c6f2 Merge pull request #8922 from lengrongfu/feat/sync-image-action 
feat: replace mcr.microsoft.com registry to ghcr.io/containerd registry
 2023-08-17 00:59:46 -07:00
Fu Wei
ba852faf41 Merge pull request #8954 from fuweid/fix-shim-leak 2023-08-17 08:16:20 +08:00
Akihiro Suda
f35d1f08ec go.mod: github.com/opencontainers/runc v1.1.9 
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 2023-08-11 21:25:29 +09:00
Wei Fu
601699a184 integration: add ShouldRetryShutdown case based on #7496 
Since the moby/moby can't handle duplicate exit event well, it's hard
for containerd to retry shutdown if there is error, like context
canceled.

In order to prevent from regression like #4769, I add skipped
integration case as TODO item and we should rethink about how to handle
the task/shim lifecycle.

Signed-off-by: Wei Fu <fuweid89@gmail.com>
 2023-08-11 17:43:51 +08:00
Wei Fu
5bdd9ca938 integration: add case to reproduce #7496 
Signed-off-by: Wei Fu <fuweid89@gmail.com>
 2023-08-11 17:41:04 +08:00
rongfu.leng
b451fa96a6 bump client-go v0.26.4 
Signed-off-by: rongfu.leng <rongfu.leng@daocloud.io>
 2023-08-11 00:30:03 +08:00
Kirtana Ashok
e7e5619fed Update hcsshim tag to v0.10.0 
Signed-off-by: Kirtana Ashok <kiashok@microsoft.com>
 2023-08-09 11:55:54 -07:00
rongfu.leng
4f3c8c4687 replace mcr.microsoft.com registry to ghcr.io/containerd registry 
Signed-off-by: rongfu.leng <rongfu.leng@daocloud.io>
 2023-08-06 21:14:07 +08:00
Fu Wei
2b2195c36b Merge pull request #8722 from marquiz/devel/cgroup-driver-autoconfig 
cri: implement RuntimeConfig rpc
 2023-08-04 16:09:34 +08:00
Rodrigo Campos
2d64ab8d79 cri: Don't use rel path for image volumes 
Runc 1.1 throws a warning when using rel destination paths, and runc 1.2
is planning to thow an error (i.e. won't start the container).

Let's just make this an abs path in the only place it might not be: the
mounts created due to `VOLUME` directives in the Dockerfile.

Signed-off-by: Rodrigo Campos <rodrigoca@microsoft.com>
 2023-07-31 12:33:54 +02:00
Iceber Gu
7f7ba31b64 cri: fix using the pinned label to pin image 
Signed-off-by: Iceber Gu <wei.cai-nat@daocloud.io>
 2023-07-26 12:26:00 +08:00
Markus Lehtonen
850b2e1bf3 go.mod: update cri-api to v1.28.0-beta.0 
Required to support upcoming Kubernetes (v1.28) features.

Signed-off-by: Markus Lehtonen <markus.lehtonen@intel.com>
 2023-07-24 14:49:14 +03:00
Akihiro Suda
bc96b9039a go.mod: github.com/AdamKorcz/go-118-fuzz-build v0.0.0-20230306123547-8075edf89bb0 
5330a85ea6...8075edf89b

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 2023-07-23 03:08:01 +09:00
Akihiro Suda
da27408854 go.mod: google.golang.org/genproto v0.0.0-20230720185612-659f7aaaa771 
ccb25ca9f1...659f7aaaa7

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 2023-07-23 03:08:01 +09:00
Akihiro Suda
73dc13ad62 go.mod: github.com/urfave/cli/compare v1.22.14 
https://github.com/urfave/cli/compare/v1.22.13...v1.22.14

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 2023-07-23 03:08:00 +09:00
Akihiro Suda
1c4fc568b1 go.mod: github.com/prometheus/client_golang/compare v1.16.0 
https://github.com/prometheus/client_golang/compare/v1.14.0...v1.16.0

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 2023-07-23 03:08:00 +09:00
Akihiro Suda
68abb525a5 go.mod: github.com/minio/sha256-simd v1.0.1 
https://github.com/minio/sha256-simd/compare/v1.0.0...v1.0.1

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 2023-07-23 03:08:00 +09:00
Akihiro Suda
1f2216cc78 go.mod: github.com/klauspost/compress v1.16.7 
https://github.com/imdario/mergo/compare/v0.3.13...v1.0.0

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 2023-07-23 03:08:00 +09:00
Akihiro Suda
3c6ab04203 go.mod: dario.cat/mergo v1.0.0 
https://github.com/imdario/mergo/compare/v0.3.13...v1.0.0

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 2023-07-23 03:08:00 +09:00
Akihiro Suda
4bda0a69e2 go.mod: github.com/grpc-ecosystem/go-grpc-middleware v1.4.0 
https://github.com/grpc-ecosystem/go-grpc-middleware/compare/v1.3.0...v1.4.0

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 2023-07-23 03:07:59 +09:00
Akihiro Suda
0f033b6125 go.mod: github.com/emicklei/go-restful/v3 v3.10.2 
https://github.com/emicklei/go-restful/compare/v3.10.1...v3.10.2

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 2023-07-23 03:07:59 +09:00
Akihiro Suda
90e050298c go.mod: github.com/containernetworking/plugin v1.3.0 
https://github.com/containernetworking/plugins/compare/v1.2.0...v1.3.0

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 2023-07-23 03:07:59 +09:00
Akihiro Suda
0498acefb9 go.mod: github.com/.../container-device-interface v0.6.0 
https://github.com/container-orchestrated-devices/container-device-interface/compare/v0.5.4...v0.6.0

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 2023-07-23 03:07:59 +09:00
Akihiro Suda
74b8cb850a go.mod: github.com/opencontainers/runc v1.1.8 
https://github.com/opencontainers/runc/compare/v1.1.7...v1.1.8

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 2023-07-23 03:07:59 +09:00
Akihiro Suda
895dd2e93b go.mod: github.com/opencontainers/image-spec v1.1.0-rc4 
https://github.com/opencontainers/image-spec/compare/v1.1.0-rc3...v1.1.0-rc4

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 2023-07-23 03:07:58 +09:00