Deprecate cgroup v1

For issue 12443

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>

RELEASES.md

@@ -475,9 +475,11 @@ The deprecated features are shown in the following table:
 | Go-Plugin library (`*.so`) as containerd runtime plugin                          | containerd v2.0     | containerd v2.1 ✅                    | Use external plugins (proxy or binary)   |
 | CNI `bin_dir` in CRI runtime config (`plugins.'io.containerd.cri.v1.runtime'.cni.bin_dir`) | containerd v2.1     | containerd v2.3                       | Change `bin_dir` to `bin_dirs` in the same section which supports a list of directories  |
 | NRI v0.1.0 plugin support                                                        | containerd v2.2     | containerd v2.3                       | Use the v010-adapter NRI plugin, or update v0.1.0 plugins to use the current NRI API |
+| cgroup v1 support                                                                | containerd v2.2     | (May 2029)                            | Use cgroup v2                           |
 
 - Pulling Schema 1 images has been disabled in containerd v2.0, but it still can be enabled by setting an environment variable `CONTAINERD_ENABLE_DEPRECATED_PULL_SCHEMA_1_IMAGE=1`
   until containerd v2.1. `ctr` users have to specify `--local` too (e.g., `ctr images pull --local`). Users of CRI clients (such as Kubernetes and `crictl`) have to specify this environment variable on the containerd daemon (usually in the systemd unit).
+- The latest release in May 2029 may not necessarily support cgroup v1, but there will be at least one maintained branch with the support for cgroup v1.
 
 ### Deprecated config properties
 The deprecated properties in [`config.toml`](./docs/cri/config.md) are shown in the following table:

core/runtime/v2/task_manager.go

@@ -41,6 +41,7 @@ import (
 	"github.com/containerd/containerd/v2/pkg/protobuf/proto"
 	"github.com/containerd/containerd/v2/pkg/timeout"
 	"github.com/containerd/containerd/v2/plugins"
+	"github.com/containerd/containerd/v2/plugins/services/warning"
 )
 
 const (
@@ -63,6 +64,7 @@ func init() {
 		Requires: []plugin.Type{
 			plugins.ShimPlugin,
 			plugins.MountManagerPlugin,
+			plugins.WarningPlugin,
 		},
 		Config: &TaskConfig{
 			Platforms: defaultPlatforms(),
@@ -98,6 +100,14 @@ func init() {
 			if err := shimManager.LoadExistingShims(ic.Context, state, root); err != nil {
 				return nil, fmt.Errorf("failed to load existing shims for task manager")
 			}
+
+			warningsI, err := ic.GetSingle(plugins.WarningPlugin)
+			if err != nil {
+				return nil, err
+			}
+			warnings := warningsI.(warning.Service)
+			emitPlatformWarnings(ic.Context, warnings)
+
 			return &TaskManager{
 				root:    root,
 				state:   state,

core/runtime/v2/task_manager_linux.go

@@ -0,0 +1,31 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package v2
+
+import (
+	"context"
+
+	"github.com/containerd/cgroups/v3"
+	"github.com/containerd/containerd/v2/pkg/deprecation"
+	"github.com/containerd/containerd/v2/plugins/services/warning"
+)
+
+func emitPlatformWarnings(ctx context.Context, warnings warning.Service) {
+	if cgroups.Mode() != cgroups.Unified {
+		warnings.Emit(ctx, deprecation.CgroupV1)
+	}
+}

core/runtime/v2/task_manager_others.go

@@ -0,0 +1,29 @@
+//go:build !linux
+
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package v2
+
+import (
+	"context"
+
+	"github.com/containerd/containerd/v2/plugins/services/warning"
+)
+
+func emitPlatformWarnings(ctx context.Context, warnings warning.Service) {
+	// NOP
+}

pkg/deprecation/deprecation.go

@@ -35,6 +35,8 @@ const (
 	TracingServiceConfig Warning = Prefix + "tracing-service-config"
 	// NRIV010Plugin is a warning for the use of NRI 0.1.0-style plugins
 	NRIV010Plugin Warning = Prefix + "nri-v010-plugin"
+	// CgroupV1 is a warning for the use of cgroup v1
+	CgroupV1 Warning = Prefix + "cgroup-v1"
 )
 
 const (
@@ -56,6 +58,7 @@ var messages = map[Warning]string{
 	TracingServiceConfig: "The `tracing` property of `[plugins.\"io.containerd.internal.v1\".tracing]` is deprecated since containerd v1.6 and will be removed in containerd v2.3." +
 		"Use OTEL environment variables instead: https://opentelemetry.io/docs/specs/otel/configuration/sdk-environment-variables/",
 	NRIV010Plugin: "NRI 0.1.0-style plugins are deprecated since containerd 2.2 and should only be used through the v010-adapter plugin.",
+	CgroupV1:      "The support for cgroup v1 is deprecated since containerd v2.2 and will be removed by no later than May 2029. Upgrade the host to use cgroup v2.",
 }
 
 // Valid checks whether a given Warning is valid