# commit to be tagged for new release commit = "HEAD" project_name = "containerd" github_repo = "containerd/containerd" # previous release previous = "v1.0.0" pre_release = true preface = """\ `containerd` provides a daemon for managing running containers. 1.1 is the second major release for `containerd` with added support for CRI, the Kubernetes [Container Runtime Interface](https://github.com/kubernetes/community/blob/master/contributors/devel/container-runtime-interface.md). CRI is a new plugin which allows connecting the containerd daemon directly to a Kubernetes kubelet to be used as the container runtime. The CRI GRPC interface listens on the same socket as the containerd GRPC interface and runs in the same process. In addition to all of the stability and bug fixes backported to 1.0, 1.1 includes... - CRI plugin - ZFS, AUFS, and native snapshotter - Improvements to the `ctr` tool - Better support for multiple platforms - Cross namespace content sharing - Better mount cleanup - Support for disabling plugins - TCP debug address for remote debugging - Update to Go 1.10 - Improvements to the garbage collector ## CRI Plugin This release of `cri` is a native plugin of `containerd`. It is built into `containerd` v1.1 and CRI services are enabled by default. You can now use Kubernetes, with `containerd` directly, without having to use the intermediate `cri-containerd` daemon. The `cri-containerd` daemon is end-of-life. *Note: Please [drain your node](https://kubernetes.io/docs/tasks/administer-cluster/safely-drain-node/) before upgrading from older versions of `cri-containerd` to `containerd` v1.1.* You can [use a containerd config file to configure the `cri` plugin](https://github.com/containerd/cri/blob/v1.0/docs/config.md). ### Untrusted Workload Runtime To run an untrusted pod on a runtime for untrusted workload, such as [Kata Containers](https://katacontainers.io/) or [Clear Containers](https://clearlinux.org/containers), you can: 1. Configure a runtime for untrusted workload [with the config option `plugins.cri.containerd.untrusted_workload_runtime`](https://github.com/containerd/cri/blob/v1.0.0/docs/config.md). 2. Create an untrusted pod by setting the annotation `io.kubernetes.cri.untrusted-workload` to `"true"`, for example: ```yaml apiVersion: v1 kind: Pod metadata: name: nginx annotations: io.kubernetes.cri.untrusted-workload: "true" spec: containers: - name: nginx image: nginx ``` By default, `cri` will run pods with the default runtime. However, if a pod has the `io.kubernetes.cri.untrusted-workload` annotation, the `cri` plugin will run the pod with the runtime for untrusted workloads. Unless configured otherwise, the default runtime is set to [runc](https://github.com/opencontainers/runc). ### Container Runtime Interface v1alpha2 The supported CRI (Container Runtime Interface) version for Kubernetes v1.10 is now `v1alpha2.` This release of `containerd/cri` has been updated to use CRI `v1alpha2`, so **it only works with Kubernetes v1.10+.** New CRI features added in `v1alpha2` are all supported: * Container log rotation: Kubelet rotates container logs. * Shared pid namespace: Support sharing pid namespace inside a pod. ### Registry Mirror You can now setup registry configurations with the config option `plugins.cri.registry`. Currently only the `mirrors` option is supported. With it, you can specify registry mirrors and secure/insecure connections. ([doc](https://github.com/containerd/cri/blob/v1.0.0/docs/registry.md)) ### End-To-End Test In terms of testing, we've passed: * ALL CRI validation tests * ALL node e2e tests * ALL e2e tests The containerd test coverage on GCE is equivalent with Docker now. All the test results are public: https://prow.k8s.io/?repo=containerd%2Fcontainerd. ### Performance We significantly improved pod start latency and cpu/memory usage of `cri` plugin this release. The continuous benchmark result is published on http://node-perf-dash.k8s.io/. Job `ci-kubernetes-node-kubelet-benchmark` is for Docker 17.03, and `ci-cri-containerd-node-e2e-benchmark` is for containerd with `cri` plugin. All metrics of containerd are either better or comparable with Docker 17.03. ## Try It Out If you would like to try containerd, please download the binaries included on this release. If you are using Docker, this version of containerd will be used in the next major release of Docker. To set up containerd with Kubernetes... * For a production quality cluster on GCE brought up with `kube-up.sh`, see [here](https://github.com/containerd/cri/blob/v1.0.0/docs/kube-up.md). * For a multi-node cluster installer and bring up steps using ansible and kubeadm, see [here](https://github.com/containerd/cri/blob/v1.0.0/contrib/ansible/README.md). * For creating a cluster from scratch on Google Cloud, see [Kubernetes the Hard Way](https://github.com/kelseyhightower/kubernetes-the-hard-way). * For a custom installation from release tarball, see [here](https://github.com/containerd/cri/blob/v1.0.0/docs/installation.md). * To install using LinuxKit on a local VM, see [here](https://github.com/linuxkit/linuxkit/tree/master/projects/kubernetes). ## Support The [_support horizon_](https://github.com/containerd/containerd/blob/main/RELEASES.md#support-horizon) for containerd has been updated to include the 1.1 release. With the addition of the CRI plugin, we are expanding the support horizon for 1.1 to include the entire lifespan of Kubernetes 1.10. The containerd 1.1 release train will be considered an active branch with new patches until April 23, 2019 at the earliest, when 1.2 is released, or until Kubernetes 1.10 reaches end of life. The 1.1 containerd API is completely compatible with 1.0, any client using 1.0 can safely upgrade to 1.1 without any incompatibilies. The CRI interface included with the CRI plugin is only supported for Kubernetes 1.10. The CRI interface is still considered alpha and will only be supported for Kubernetes 1.10. The CRI plugin in containerd 1.1 will also only be supported for Kubernetes 1.10. """ # notable prs to include in the release notes, 1234 is the pr number [notes] [breaking]