cri: use mount manager when image has volumes

When a container image has a volumes attribute, currently the mount manager is not used here. This leads to issues with the EROFS snapshotter, notably that rwlayer.img is not present when the snapshotter is configured to create a writable block volume.

This change implements mount manager as part of the image volumes processing, so that mount manager mounts are correctly processes before calling mount.All

Fixes: #12834
Signed-off-by: Champ-Goblem <cameron@northflank.com>

internal/cri/opts/container.go

@@ -81,6 +81,18 @@ func WithVolumes(volumeMounts map[string]string, platform imagespec.Platform) co
 		// the case here.
 		mounts = mount.RemoveIDMapOption(mounts)
 
+		mm := client.MountManager()
+		activationKey := fmt.Sprintf("cri-volume-%s", c.SnapshotKey)
+		var needsDeactivation bool
+
+		info, err := mm.Activate(ctx, activationKey, mounts)
+		if err == nil {
+			mounts = info.System
+			needsDeactivation = true
+		} else if !errdefs.IsNotImplemented(err) {
+			return fmt.Errorf("failed to activate mounts: %w", err)
+		}
+
 		root, err := os.MkdirTemp("", "ctd-volume")
 		if err != nil {
 			return err
@@ -101,6 +113,15 @@ func WithVolumes(volumeMounts map[string]string, platform imagespec.Platform) co
 					err = uerr
 				}
 			}
+			// If we used mount manager, deactivate to cleanup transformers
+			if needsDeactivation {
+				if derr := mm.Deactivate(ctx, activationKey); derr != nil {
+					log.G(ctx).WithError(derr).Errorf("Failed to deactivate mount manager %q", activationKey)
+					if err == nil {
+						err = derr
+					}
+				}
+			}
 		}()
 
 		for host, volume := range volumeMounts {