Return an error wrapping ErrResourceExhausted when the walk exceeds
10,000 references. Preserve duplicate visits and count every reference
toward the limit across recursive calls and roots.
Assisted-by: Claude Code
Signed-off-by: Chris Henzie <chrishenzie@gmail.com>
Traverse breadth-first, one level at a time. Acquire the limiter before
starting each handler goroutine. Default to 32 concurrent handlers when
no limiter is provided. Children wait until every handler in the current
level finishes.
Preserve duplicate visits and return an error wrapping
ErrResourceExhausted when the traversal exceeds 10,000 references.
Count children as handlers return them to bound the descriptors retained
for the next level.
Assisted-by: Claude Code
Signed-off-by: Chris Henzie <chrishenzie@gmail.com>
Give coding agents an entry point to the contribution, build, and
subsystem documentation. Require security findings to meet the
documented scope and evidence requirements before calling them
vulnerabilities.
Link CLAUDE.md to AGENTS.md so both filenames provide the same guidance.
Assisted-by: Claude Code
Signed-off-by: Chris Henzie <chrishenzie@gmail.com>
make test can succeed while skipping tests that require root. Explain
how to enable those tests and where to find CRI test prerequisites.
Add pull request expectations for documentation, testing, and CI
follow-up.
Assisted-by: Claude Code
Signed-off-by: Chris Henzie <chrishenzie@gmail.com>
An index can carry more than one manifest that shares a config. A config
lists uncompressed layer digests, so packaging the same layers with
different compression (which `podman manifest push --add-compression`
does) produces manifests with identical configs and the same config
digest.
Right now, when the unpacker visits a manifest, it stores its layers in
a map keyed by its config's digest, so they can be unpacked later once
the config descriptor is visited. Because that map holds only one
manifest's layers per digest, when more than one manifest shares a
config, only the last visited manifest's layers are stored (and
unpacked), and the others' layers are never fetched. Image pulls still
report success, but a later export or push of the image fails with
NotFound.
Fix this by changing the map to store the layers for all manifests
pointing at a specific config (instead of just one manifest). This means
manifests sharing the same config result in more than one set of layers
being stored for the same config digest. Because manifests that share a
config unpack to the same snapshot chain, we only need to unpack the
first manifest's layers, and fetch the others (so their blobs reach the
content store). Unpack skips fetching a layer whose snapshot already
exists, so once a second manifest shares the config, the first
manifest's layers are also fetched explicitly; a config named by a
single manifest keeps that skip. Note that for indexes with more than
one config-sharing manifest, this will now result in additional download
time and storage for those layers.
Don't store anything for a manifest with no layers; an empty slice
reaching the unpack would fail the pull.
Assisted-by: Claude Code
Signed-off-by: Chris Henzie <chrishenzie@gmail.com>
Go can report context deadline exceeded when a duration-based fuzz limit
expires (https://go.dev/issue/75804).
Use a 50,000-execution limit based on the roughly 47,000 executions
FuzzImageStore completed in 30 seconds in CI. This keeps work stable
across runners and avoids the duration issue.
Assisted-by: Codex
Signed-off-by: Chris Henzie <chrishenzie@gmail.com>
Adds a nil guard to GetIPs on criPodSandbox before accessing promoted
struct fields on the embedded Sandbox pointer.
During pod sandbox teardown or race conditions during container exit
events, nriPodSandbox can return a criPodSandbox instance where the
embedded Sandbox pointer is nil.
Assisted-by: Antigravity
Signed-off-by: Chris Henzie <chrishenzie@gmail.com>
GHA runners occasionally experience I/O constraints during root-test
test execution. While concurrent tests rapidly allocate loopback
devices, background udev probing stalls. This quickly exhausts
systemd-udevd's default worker pool ceiling (20 children max), stalling
netlink uevent processing so device-mapper device nodes are never
created for subsequent dm-verity test execution.
Logging cgroups v2 pids.peak telemetry confirmed peak in-flight udev
workers accumulate to 325 during test execution. Raising the
children-max limit to 500 provides comfortable buffer room so udevd
freely spawns worker processes without entering event lockup or causing
test timeouts.
Assisted-by: Antigravity
Signed-off-by: Chris Henzie <chrishenzie@gmail.com>
openUserFile now stats the opened file, refuses anything that is not a
regular file, and wraps the returned fs.File so reads are capped at
maxUserFileBytes (10 MiB). All callers of openUserFile read either
etc/passwd or etc/group; both are regular files on real systems, well
under the cap.
The cap and the regular-file check together bound parser memory use
when reading user-database files of unexpected shape or size.
Adds tests for the cap and for the non-regular file rejection. The cap
test covers three boundary points: a small pad (trailing entry parsed),
a pad placing the entry's last byte exactly on the cap (still parsed),
and a pad past the cap (read returns an "exceeds" error).
Assisted-by: Antigravity
Signed-off-by: Chris Henzie <chrishenzie@gmail.com>
Add metrics for NRI plugin invocations, latency, adjustments, and active
count. Map NRI Metrics adaptation layer to containerd's Prometheus
metrics system via docker/go-metrics for observability.
Categorize plugin invocation errors into `deadline_exceeded`,
`canceled`, and dynamic gRPC status code dimensions to assist
troubleshooting.
Assisted-by: Antigravity
Signed-off-by: Chris Henzie <chrishenzie@gmail.com>
Kernel 6.12.80+ returns 'fsync=volatile' instead of just 'volatile'
in mount options, which breaks containerd's exact string matching
checks.
Fixes this issue by adding support for 'fsync=volatile' in addition
to the existing 'volatile' check in RemoveVolatileOption and
addVolatileOptionOnImageVolumeMount.
Assisted-by: Antigravity
Signed-off-by: Chris Henzie <chrishenzie@gmail.com>
Add inputs to workflow_call in node-e2e.yml to allow specifying
Kubernetes branch or tag to test against. Update checkout step
to use this input, defaulting to master.
This enables testing containerd against specific Kubernetes release
branches, which is required for verifying compatibility with extended
support windows for Kubernetes distros that require them.
Signed-off-by: Chris Henzie <chrishenzie@gmail.com>
Assisted-by: Antigravity
Updates crun version used by integration tests to 1.27 and enables the
test for cgroup mount options in
TestPrivilegedContainerCgroupMountOptions.
Assisted-by: Antigravity
Signed-off-by: Chris Henzie <chrishenzie@gmail.com>
Integrates CRI container resource updates with core Sandbox API plugin.
Delegates payload to out-of-tree controllers via UpdateSandbox API.
Gracefully tolerates ErrNotImplemented to preserve backwards
compatibility for legacy sandboxers.
Assisted-by: Antigravity
Signed-off-by: Chris Henzie <chrishenzie@gmail.com>
Verifies that running a privileged container does not alter host cgroup
mount options (specifically nsdelegate and memory_recursiveprot).
Creates a privileged sandbox and container, starts it, and compares the
host's /sys/fs/cgroup mount options before and after execution to
guarantee safety.
Signed-off-by: Chris Henzie <chrishenzie@gmail.com>
Update Vagrantfile and cri-integration test runner to forward
RUNC_FLAVOR to the test environment.
Allows integration tests to conditionally skip testing certain cgroup
mount setups when running against other runtimes that may not support
them yet.
Signed-off-by: Chris Henzie <chrishenzie@gmail.com>
Privileged containers don't have a cgroup namespace and share the host's
cgroup namespace. Mounting cgroup2 inside these containers can
inadvertently alter the host's cgroup2 VFS superblock mount options
because they are shared.
To prevent this, update WithMounts to read the host's /sys/fs/cgroup
mount options and explicitly propagate nsdelegate and
memory_recursiveprot into the container's mount spec. This avoids
stripping them on the host when they are not in the hardcoded default
set.
Signed-off-by: Chris Henzie <chrishenzie@gmail.com>
Moves cgroup namespace addition logic higher in buildLinuxSpec so it
runs before any custom spec adjusters (such as WithMounts).
This is necessary because subsequent spec adjusters may want to inspect
the set of namespaces to make decisions (e.g., configuring mount options
based on whether or not they are shared with the host).
Signed-off-by: Chris Henzie <chrishenzie@gmail.com>
Introduces changes to make pod sandbox updates persistent across
restarts.
This is achieved by:
- Storing the updated Overhead and Resources as an extension on the core
sandbox object and in the in-memory sandbox status store.
- Modifying the sandbox recovery logic to read this extension on startup
(this is not working in recovery unit tests yet and needs fixing).
- Updating the PodSandboxStatus CRI handler to include updated resources
from the sandbox status store.
Signed-off-by: Chris Henzie <chrishenzie@google.com>
The deprecated registry configuration fields `Mirrors`, `Configs`, and
`Auths` are still required for authentication with private and mirrored
registries.
The intended replacements, such as `ImagePullSecrets`, do not yet fully
address all use cases, particularly with registry mirrors. Additionally,
the v3 configuration using `hosts.toml` has limitations that prevent a
smooth migration for all users.
To avoid breaking existing workflows and allow for a smoother
transition, we should defer removal of the deprecated fields to 2.3.
Signed-off-by: Chris Henzie <chrishenzie@google.com>
The Kubernetes Node E2E workflow has proven to be stable. To ensure
these tests pass before merging, this change integrates the workflow
into the required CI checks.
Signed-off-by: Chris Henzie <chrishenzie@google.com>
Extend the LTS support window for the 1.7 release branch to September
2026. The footnote asterisk is escaped to ensure correct rendering on
the hugo site.
This change reflects the decision made during the community meeting,
where @chrishenzie and @samuelkarp volunteered to provide extended
support beyond the standard two-year LTS period. The existing support
from @containerd/committers remains in place until March 2026.
Signed-off-by: Chris Henzie <chrishenzie@google.com>
This was producing different metric names which can break metric
collection. Reverting to the previous "cri" subsystem so metrics are
consistent across 1.X and 2.X.
Signed-off-by: Chris Henzie <chrishenzie@google.com>
This test produces zombies when PID 1 does not properly reap child
processes. Modifies the test to ignore these processes in the meantime.
Signed-off-by: Chris Henzie <chrishenzie@google.com>
Chris Henzie