runtime/v2: remove the runtime-allow-mounts annotation

A shim declared the mount types it performs itself through a comma
separated string in the generic annotations map of its RuntimeInfo,
discovered by invoking the shim binary a second time with -info. The
values had to reproduce by hand the "<transform>/*" sentinel the mount
manager constructs internally, there was nowhere to put anything but a
name, and it was keyed by runtime name rather than shim instance, so it
could not reflect anything about the environment a particular shim is
running in.

Remove it along with loadShimInfo, shimInfo and the shimInfos cache,
and the runc.v2/runhcs.v1 shortcut that only existed to avoid paying
for it on the default runtimes. This is a breaking change targeted at
2.4; known usage is limited to Nerdbox, which can adopt the shim
capability protocol added in the following commits after this merges.

getRuntimeInfo itself stays: it is also used by PluginInfo and
validateRuntimeFeatures.

Signed-off-by: Derek McGowan <derek@mcg.dev>

core/runtime/v2/shim_manager.go

@@ -26,7 +26,6 @@ import (
 	"strings"
 	"sync"
 
-	apitypes "github.com/containerd/containerd/api/types"
 	"github.com/containerd/errdefs"
 	"github.com/containerd/log"
 	"github.com/containerd/plugin"
@@ -185,8 +184,6 @@ type ShimManager struct {
 	// runtimePaths is a cache of `runtime names` -> `resolved fs path`
 	runtimePaths sync.Map
 	sandboxStore sandbox.Store
-	// shimInfos is a cache of the shim info
-	shimInfos sync.Map
 }
 
 // ID of the shim manager
@@ -483,40 +480,3 @@ func (m *ShimManager) Delete(ctx context.Context, id string) error {
 
 	return err
 }
-
-type shimInfo struct {
-	handledMounts []string
-}
-
-func (m *ShimManager) loadShimInfo(ctx context.Context, shim string) (*shimInfo, error) {
-	if i, ok := m.shimInfos.Load(shim); ok {
-		return i.(*shimInfo), nil
-	}
-	// Avoid fetching info for default shims with known behavior
-	if shim == "io.containerd.runc.v2" || shim == "io.containerd.runhcs.v1" {
-		sinfo := &shimInfo{}
-		m.shimInfos.Store(shim, sinfo)
-		return sinfo, nil
-	}
-
-	rinfo, err := getRuntimeInfo(ctx, m, &apitypes.RuntimeRequest{RuntimePath: shim})
-	if err != nil {
-		return nil, err
-	}
-	sinfo := &shimInfo{}
-
-	if rinfo.Annotations != nil {
-		if v, ok := rinfo.Annotations[allowedMounts]; ok {
-			sinfo.handledMounts = strings.Split(v, ",")
-		}
-	}
-
-	fields := log.Fields{}
-	for k, v := range rinfo.Annotations {
-		fields[k] = v
-	}
-	log.G(ctx).WithFields(fields).WithField("shim", shim).Debug("loaded shim info")
-
-	m.shimInfos.Store(shim, sinfo)
-	return sinfo, nil
-}

core/runtime/v2/task_manager.go

@@ -46,13 +46,6 @@ import (
 	"github.com/containerd/containerd/v2/plugins/services/warning"
 )
 
-const (
-	// allowedMounts are the custom mount types allowed by the runtime. These
-	// types should not be handled by the mount manager.
-	// To include prepare mount types, use "/*" suffix, such as "format/*"
-	allowedMounts = "containerd.io/runtime-allow-mounts"
-)
-
 // TaskConfig for the runtime task manager
 type TaskConfig struct {
 	// Supported platforms
@@ -177,13 +170,6 @@ func (m *TaskManager) Create(ctx context.Context, taskID string, opts runtime.Cr
 			"containerd.io/gc.bref.container": taskID,
 		}),
 	}
-	if info, err := m.manager.loadShimInfo(ctx, opts.Runtime); err == nil {
-		for _, t := range info.handledMounts {
-			activateOpts = append(activateOpts, mount.WithAllowMountType(t))
-		}
-	} else {
-		log.G(ctx).WithError(err).WithField("runtime", opts.Runtime).Error("failed to load runtime info")
-	}
 
 	// Add options based on runtime
 	if ai, err := m.mounts.Activate(ctx, taskID, opts.Rootfs, activateOpts...); err == nil {