ci: run critest through the sandboxed shim

critest.sh takes SANDBOXER, the sandbox controller of the runtime handler
(podsandbox by default; shim adds disable_pause_image_pull, since a
Sandbox API shim needs no pause image). The Linux integration job runs the
critest suite a second time on the runc.v2 legs, with TEST_RUNTIME_PATH
pointing at containerd-shim-sandboxed-runc-v2 and the shim sandboxer. The
one spec that needs a shared pod PID namespace is skipped by name until
that lands; the user namespace specs skip themselves, since the handler
does not advertise user namespaces.

Signed-off-by: Maksym Pavlenko <pavlenko.maksym@gmail.com>

.github/workflows/ci.yml

@@ -607,6 +607,28 @@ jobs:
           env
           sudo -E PATH=$PATH ./script/critest.sh "${{github.workspace}}/report"
 
+      # Experimental: the same critest suite through the pause-less sandbox
+      # shim (containerd-shim-sandboxed-runc-v2 selected with runtime_path,
+      # with the shim sandboxer). Specs that need what the shim does not
+      # support yet are skipped by their full name; the list shrinks as the
+      # features land:
+      #  - "runtime should support PodPID": a shared pod PID namespace needs
+      #    a durable PID 1 (sandbox-init).
+      # The user namespace specs skip themselves: the handler does not
+      # advertise user namespaces until the shim supports them.
+      # The sandboxed shim is a Go shim: it runs on the runc.v2 legs only.
+      - if: matrix.runtime == 'io.containerd.runc.v2'
+        name: cri-tools critest (sandbox shim)
+        env:
+          TEST_RUNTIME: ${{ matrix.runtime }}
+          TEST_RUNTIME_PATH: /usr/local/bin/containerd-shim-sandboxed-runc-v2
+          SANDBOXER: shim
+          CGROUP_DRIVER: ${{ matrix.cgroup_driver }}
+          SKIP_TEST: "NamespaceOption runtime should support PodPID"
+        run: |
+          env
+          sudo -E PATH=$PATH ./script/critest.sh "${{github.workspace}}/report-sandbox-shim"
+
       # The Rust shim does not implement checkpoint yet.
       - if: matrix.os != 'ubuntu-24.04-arm' && matrix.runtime != 'io.containerd.runc.v2-rs'
         name: Checkpoint/Restore Disable via CRI
@@ -641,6 +663,8 @@ jobs:
             *-gotest.json
             ${{github.workspace}}/report/*.xml
             ${{github.workspace}}/report/*.log
+            ${{github.workspace}}/report-sandbox-shim/*.xml
+            ${{github.workspace}}/report-sandbox-shim/*.log
 
   integration-vm:
     name: VM integration

script/critest.sh

@@ -50,6 +50,17 @@ function cleanup() {
 trap cleanup EXIT
 
 mkdir -p ${BDIR}/{root,state}
+
+# SANDBOXER is the sandbox controller of the runtime handler: "podsandbox"
+# (the pause container, the default) or "shim" (the Sandbox API of the shim,
+# which needs no pause image).
+SANDBOXER="${SANDBOXER:-podsandbox}"
+SANDBOX_CONFIG="sandboxer = \"${SANDBOXER}\""
+if [ "${SANDBOXER}" = "shim" ]; then
+  SANDBOX_CONFIG="${SANDBOX_CONFIG}
+disable_pause_image_pull = true"
+fi
+
 containerd_config="${CONTAINERD_CONFIG_FILE:-${BDIR}/config.toml}"
 if [[ -z "${CONTAINERD_CONFIG_FILE:-}" ]]; then
   cat > "${containerd_config}" <<EOF
@@ -57,6 +68,7 @@ version = 2
 [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc]
 runtime_type = "${TEST_RUNTIME}"
 runtime_path = "${TEST_RUNTIME_PATH:-}"
+${SANDBOX_CONFIG}
 [plugins."io.containerd.snapshotter.v1.overlayfs"]
 # slow_chown is needed to avoid an error with kernel < 5.19:
 # > "snapshotter \"overlayfs\" doesn't support idmap mounts on this host,