When a shim delete hits a timeout, currently the error message does not
indicate that the delete was killed rather than failed to complete.
Signed-off-by: Derek McGowan <derek@mcg.dev>
Describe layer_content_caches: what it replaces (a mkfs.erofs run per layer
on every node), how a hit is served, how multiple directories are searched,
and how to build a cache with ctr images build-erofs-cache. Call out that the
cached blob is symlinked rather than copied, so entries have to outlive the
snapshots referencing them, and that fsverity and IMMUTABLE_FL can't be used
alongside a cache.
Signed-off-by: Maksym Pavlenko <pavlenko.maksym@gmail.com>
The direct use was two lines in `internal/cri/nri/nri_api_linux.go` -- constructing a `generate.Generator{Config: spec}` solely to satisfy the `nrigen.UnderlyingGenerator` interface defined in `containerd/nri`. Since that interface already exists, we just need an implementation. Add `spec_generator.go` in the same package, implementing `UnderlyingGenerator` directly on `*rspec.Spec` with no external dependencies beyond `runtime-spec`.
Assisted-By: "claude my eyes right out"
Signed-off-by: Tianon Gravi <tianon.gravi@docker.com>
When a layer fails to prepare during parallel unpack we break out of the
launch loop but never return the error, so unpack() can report success and
label the image with a chainID that was never created. Keep the error and
return it once the already queued layers have been drained, so those still
commit as they would in sequential mode. Also end the layer's tracing span,
which leaked on this path.
Signed-off-by: Maksym Pavlenko <pavlenko.maksym@gmail.com>
The container_start_time_seconds metric was reporting nanoseconds
instead of Unix seconds. The CRI container status stores StartedAt
as nanoseconds (per the CRI API spec), but the metric name and help
text indicate seconds. Convert by dividing by time.Second.
Signed-off-by: Damien Grisonnet <dgrisonn@redhat.com>
The layer content cache was a single directory, so every source of
pre-converted blobs had to be merged into one tree. A shared read-only fleet
cache, a host-local cache, and a per-image warm cache could not coexist.
Replace layer_content_cache with layer_content_caches, a list. Each directory
is checked in order and the first hit is staged into the snapshot; a layer
found in none of them falls back to the normal download-and-convert path.
Cache directories are no longer required to exist at startup. A missing one is
indistinguishable from an empty one at lookup time (both are simply a miss),
and it may well be mounted after the daemon starts, so the only check left is
that each path is absolute -- a relative one would be symlinked into the
snapshot dir and dangle.
Signed-off-by: Maksym Pavlenko <pavlenko.maksym@gmail.com>
When collectContainerMetrics fails for a single container, the
goroutine was returning nil which exited the loop entirely. The
sandbox metrics, including pod-level network metrics and any
successfully collected container metrics, were never appended to
the response.
Replace return nil with continue so that individual container
failures only skip that container.
Signed-off-by: Damien Grisonnet <dgrisonn@redhat.com>
ctr resolves named users and groups for run and task exec in the
client process. Since EROFS fsview support moved behind registration,
the ctr application does not link the handler and falls back to a
temporary host mount.
Register the handler with the ctr application so EROFS snapshots can
be inspected directly. Non-EROFS mounts continue through the existing
handlers unchanged.
Signed-off-by: Chris Ayoub <cayoub@openai.com>
Replace the snapshots.ErrAlreadyStaged sentinel error with a
read-only-mounts signal: a snapshotter (e.g. erofs serving a layer
content cache hit) now returns Prepare mounts normally, with no
error, when the layer content is already staged into the active
snapshot. The unpacker's isStaged helper checks the last mount's
ReadOnly() to decide whether to skip fetch+apply and just commit.
Signed-off-by: Maksym Pavlenko <pavlenko.maksym@gmail.com>
The cache used to serve a hit by committing the layer during Prepare and
returning ErrAlreadyExists, which is incompatible with parallel unpacking:
the "rebase" capability defers the parent to Commit time, so a
commit-at-Prepare layer ends up parentless. The erofs snapshotter therefore
had to disable rebase whenever the cache was enabled, making every cache
*miss* fall back to a fully sequential (slower-than-cold) pull.
Introduce snapshots.ErrAlreadyStaged, returned from Prepare to mean "the
active snapshot's content is staged; skip the layer download and apply, but
still Commit it" (where the parent is applied). Unlike ErrAlreadyExists it
does not end the layer's lifecycle. The unpacker handles it by emitting a
status whose bottom half runs the normal serialized commit (rebasing the
parent in), and the metadata snapshotter threads it through Prepare like a
normal active snapshot. The erofs cache hit now stages the blob and returns
ErrAlreadyStaged instead of committing, so it can advertise "rebase"
unconditionally: hits skip download+conversion and misses stay parallel.
Also promote the "rebase" capability string to snapshots.RebaseCap (shared by
the unpacker, erofs, and overlay).
Follow up: fetch is range-based, so only a fully cached contiguous
prefix skips downloads; a miss in a lower layer still pulls everything above
it. Per-layer fetch-skip is left as a follow-up.
Signed-off-by: Maksym Pavlenko <pavlenko.maksym@gmail.com>
Add proof-of-concept (PoC) execution requirements against a running
daemon to the triage guide and threat model.
Assisted-by: Antigravity
Signed-off-by: Samuel Karp <samuelkarp@google.com>
Remove support for restoring checkpoint data during CreateContainer,
which was previously deprecated in v2.3.
Assisted-by: Antigravity
Signed-off-by: Samuel Karp <samuelkarp@google.com>
Drop internal/cri/seutil/seutil.go in favor of direct call to newly
introduced selinux.SetProcessKind.
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
Exclude priority/*, status/accepted, status/needs-major-release, and
status/roadmapped labels from being marked as stale and closed.
Assisted-by: Antigravity
Signed-off-by: Samuel Karp <samuelkarp@google.com>
