Build the image for TestIssue13030 locally using pkg/archive,
instead of pulling the prebuilt ghcr.io/containerd/whiteout-test image.
The image is built by appending layers generated with archive.WriteDiff
on top of the busybox base image, served with the new
testutil.ServeImage helper on a localhost HTTP registry, and pulled
through the regular client.Pull path with WithPullUnpack. This removes
the need to publish the multi-arch whiteout-test image, so the
Dockerfile and Makefile added in PR 13704 are removed along with the
image list entry.
Assisted-by: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
The TestCRIImagePullTimeout test case "NoDataTransferred" flaked under
constrained networks because the test proxy mirror registry used a
blocking ReadAtLeast call to forward bytes to containerd.
This blocking wait (up to 4KB) meant the mirror registry server
completely stopped forwarding data during network slowness, triggering
containerd's aggressive 5-second progress timeout and canceling the
pull before it could reach its 3MB circuit-breaker limit.
This is resolved by changing the proxy's custom copy loop from
io.ReadAtLeast(src, buf, len(buf)) to standard src.Read(buf). This
streams network chunks to containerd immediately as they arrive,
preventing false timeout cancellations while maintaining correct
circuit-breaker byte tracking.
Assisted-by: Antigravity
Signed-off-by: Samuel Karp <samuelkarp@google.com>
In high-load CI environments,
TestFailFastWhenConnectShim/normal-unix-socket-v2 flaked with:
expected error connection refused, but got <nil>
at shim_dial_unix_test.go:134.
Diagnosis:
For normal Unix sockets (filesystem-backed, where
SetUnlinkOnClose(false) is called to keep the socket file), closing
the socket listener does not guarantee that subsequent dials
instantly fail with ECONNREFUSED in the OS kernel. Under high
parallel contention, the kernel-side transition of the socket file
structure to the refusing state is deferred for a brief window.
The test immediately dials the address after close, which
unexpectedly succeeds under load, flaking the test.
Reproduction:
We successfully reproduced the flake inside an almalinux/9 Vagrant VM
(running with nested virtualization inside a GCE VM) under parallel
load, where the test failed exactly on iteration 3 of the integration
suite loop.
Solution:
1. Remove manual listener.Close() and rely entirely on
ttrpcSrv.Shutdown(ctx) to close the listener, preventing double-close
races.
2. Use a 5-second timeout context for Shutdown to prevent CI hangs if a
connection leaks.
3. Implement a robust 2-second polling helper pollECONNREFUSED inside
the test that dials in a 10ms loop (using a 100ms dial timeout to avoid
blocking) until it receives syscall.ECONNREFUSED.
4. Assert require.NoError(t, pollECONNREFUSED(addr)) immediately after
Shutdown to ensure the OS has fully unlinked/closed the socket before
running the main assertions.
Tested:
Verified by executing 15 parallel integration test runs inside the
preserved AlmaLinux 9 Vagrant guest VM. All 15 runs passed
successfully (100% success rate).
Assisted-by: Antigravity
Signed-off-by: Samuel Karp <samuelkarp@google.com>
Switch the CRI integration layer from containerd's forked Kubernetes helpers
and clients to the upstream Kubernetes modules, and finalize the dependency
update to Kubernetes v0.36.0.
Replace the remaining internal helper copies with upstream packages:
- internal/cri/clock -> k8s.io/utils/clock
- internal/cri/executil -> upstream CRI exec helpers
- internal/cri/resourcequantity -> k8s.io/apimachinery/pkg/api/resource
- internal/cri/setutils -> k8s.io/apimachinery/pkg/util/sets
- internal/cri/types/labels.go -> internal/cri/labels
- integration/cri-api/pkg/apis/services.go -> k8s.io/cri-api/pkg/apis/services.go
Adopt the upstream CRI clients directly:
- add k8s.io/cri-client v0.36.0, k8s.io/cri-streaming v0.36.0, and
k8s.io/streaming v0.36.0 as direct dependencies
- promote k8s.io/utils to a direct dependency and pull in
k8s.io/component-base v0.36.0 indirectly
- keep integration/remote as a thin containerd adapter around cri-client,
because the integration tests still need the stream-shaped
GetContainerEvents RPC
Finalize the Kubernetes dependency update from v0.36.0-rc.0 to v0.36.0,
refresh vendor/, and drop the obsolete internal utility copies.
Also fix the protobuf MessageState mutex-copy vet failures exposed by the new
APIs and close the temporary integration CRI clients explicitly.
Signed-off-by: Davanum Srinivas <davanum@gmail.com>
Kernel 6.12.80+ returns 'fsync=volatile' instead of just 'volatile'
in mount options, which breaks containerd's exact string matching
checks.
Fixes this issue by adding support for 'fsync=volatile' in addition
to the existing 'volatile' check in RemoveVolatileOption and
addVolatileOptionOnImageVolumeMount.
Assisted-by: Antigravity
Signed-off-by: Chris Henzie <chrishenzie@gmail.com>
On export, if the image is by-digest without any tag,
set the org.opencontainers.image.ref.name as the full name.
This prevents setting this field with a leading non-alphanum,
which is incorrect OCI grammar. Fixes#10681.
Signed-off-by: Laura Lorenz <lauralorenz@google.com>
Uses the definition of valid grammar for this field
from the OCI image annotations spec:
e72ae99d5f/annotations.md (pre-defined-annotation-keys)
On this commit the test will fail per the bug #10681
`manifest annotation org.opencontainers.image.ref.name
="@sha256:7b3ccabffc97de872a30dfd234fd972a66d247c8cfc69b0550f276481852627c"
does not match required grammar`
Signed-off-by: Laura Lorenz <lauralorenz@google.com>
Ensure volume-copy-up and volume-ownership publish linux/s390x variants so integration tests can use these images on s390x without architecture-specific skips.
Signed-off-by: Jintao Zhang <zhangjintao9020@gmail.com>
The test image ghcr.io/containerd/volume-copy-up:2.1 does not include
a manifest for s390x, causing the test to fail with:
"no manifest found for platform: not found".
Signed-off-by: Ricardo Branco <rbranco@suse.de>
This change updates the Go version from 1.25.8 to 1.26.0 across the
repository, including CI configurations, build scripts, and development
environments.
It also fixes two linter issues discovered after upgrading the Go version:
- core/snapshots/storage/bolt.go: incorrect printf format for uint64
- plugins/transfer/plugin.go: incorrect printf format for int and unused variable
The golangci-lint version in script/setup/install-dev-tools is also updated to v2.9.0
to match CI.
Signed-off-by: Sergey Kanzhelev <S.Kanzhelev@live.com>
Updates crun version used by integration tests to 1.27 and enables the
test for cgroup mount options in
TestPrivilegedContainerCgroupMountOptions.
Assisted-by: Antigravity
Signed-off-by: Chris Henzie <chrishenzie@gmail.com>
Verifies that running a privileged container does not alter host cgroup
mount options (specifically nsdelegate and memory_recursiveprot).
Creates a privileged sandbox and container, starts it, and compares the
host's /sys/fs/cgroup mount options before and after execution to
guarantee safety.
Signed-off-by: Chris Henzie <chrishenzie@gmail.com>
The `go-cmp` library has issues with Go deadcode elimination:
```
github.com/google/go-cmp/cmp/internal/value.appendTypeName reachable from:
github.com/google/go-cmp/cmp.pathStep.String
type:github.com/google/go-cmp/cmp.pathStep
type:github.com/google/go-cmp/cmp.structField
type:*github.com/google/go-cmp/cmp.structField
type:github.com/google/go-cmp/cmp.StructField
go:itab.github.com/google/go-cmp/cmp.StructField,github.com/google/go-cmp/cmp.PathStep
github.com/google/go-cmp/cmp.Path.String
type:github.com/google/go-cmp/cmp.Path
type:github.com/google/go-cmp/cmp.state
type:*github.com/google/go-cmp/cmp.state
type:func(*github.com/google/go-cmp/cmp.state, reflect.Type, reflect.Value, reflect.Value) github.com/google/go-cmp/cmp.applicableOption
type:github.com/google/go-cmp/cmp.Option
github.com/google/go-cmp/cmp.flattenOptions
github.com/google/go-cmp/cmp.normalizeOption
github.com/google/go-cmp/cmp.FilterValues
github.com/containerd/containerd/v2/pkg/protobuf.init
github.com/containerd/containerd/v2/pkg/protobuf..inittask
go:main.inittasks
```
The `pkg/protobuf` is imported unconditionally is
`github.com/containerd/containerd` Go module is imported via init tasks,
so there is no way e.g. to use containerd client without triggering this
import.
It seems that within containerd itself this function is only used from
tests, so hiding it this way allows to import `containerd/client` while
keeping deadcode elimination.
Signed-off-by: Andrey Smirnov <andrey.smirnov@siderolabs.com>
Remote/proxy snapshotters like nydus need per-layer annotations on each
snapshot (cri.image-ref, cri.layer-digest, cri.manifest-digest,
cri.image-layers) so they can lazily fetch content inside the guest VM.
During a normal PullImage, these annotations are set by
AppendInfoHandlerWrapper and flow through the core/unpack.Unpacker to
each layer's Prepare/Commit call.
However, when an image is already present for one snapshotter (e.g.,
overlayfs) and needs to be used with a different one (e.g., nydus for
Kata), no pull occurs. The image must be unpacked into the target
snapshotter with the correct per-layer labels.
Replace the image.Unpack() fallback in customopts.WithNewSnapshot with
unpackImage, which leverages the existing core/unpack.Unpacker and wraps
the image handler with AppendInfoHandlerWrapper when snapshot annotations
are enabled (!DisableSnapshotAnnotations). This reuses the same unpack
machinery as PullImage, including retry handling, parallel layer
support, and deduplication.
Signed-off-by: Fabiano Fidêncio <ffidencio@nvidia.com>
In some spots we can get away with only reading a subset of the cgroup
stats we are today. It would be reaaally nice for container stats in
the cri plugin, but they're requested via the task API and we have no
way to signify we only want a subset through this surface yet. We can
still get some benefit in the stats collector and the existing sandbox
stats where we only need mem and cpu.
Signed-off-by: Danny Canter <danny@dcantah.dev>
