Go 1.26 adds support for passing Windows file flags via os.OpenFile,
eliminating the need to call windows.CreateFile directly.
github.com/moby/sys/sequential v0.7.0 uses this functionality when
compiled with go1.26, but provides fallbacks for older Go versions.
Given that containerd has go1.26 as a minimum requirement, we can
remove github.com/moby/sys/sequential as an intermediate, and implement
the code locally.
ref:
- 9d2fc630f5
- https://go-review.googlesource.com/c/go/+/699415
- https://go-review.googlesource.com/c/go/+/724621
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This test verifies the maximum file-size constraints that were added in
[containerd7b05ec4]. However, github.com/moby/sys@v0.4.1 adds similar
constraints, including a constraint on line-length (1M): [moby/sys@2c56c3d]
that may hit before the file-size limit is reached if the data does not
contain newlines.
This patch updates the test to use data that includes newlines to make
sure it's testing the file-size constraints, not line-limit constraints.
[containerd7b05ec4]: 7b05ec421d
[moby/sys@2c56c3d]: 2c56c3d5d0
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Introduce a platform support policy for containerd to make support
commitments explicit. Platforms are organized into three tiers:
- Tier 1: Supported (built, tested in CI, gates merges)
- Tier 2: Released, best-effort (built, published, no CI testing)
- Tier 3: Build-verified (compiled in CI, not published)
This policy defines the requirements for each tier, outlines the
process for requesting changes, and describes the demotion policy.
Assisted-by: Claude Code:claude-opus-4-8
Assisted-by: Antigravity
Signed-off-by: Samuel Karp <samuelkarp@google.com>
Address review feedback on the previous commit:
- Use MiB/s (binary, 1024^2) consistently. The divisor was already
1024*1024; the constant name (mbToByte) and the Help/comment text
mislabeled the unit.
- Keep image_pulling_throughput for backwards compatibility but mark
it Deprecated. Its prom.DefBuckets top out at 10 MiB/s, which
saturates almost immediately on modern hardware.
- Add image_pulling_throughput_mibps with buckets covering 0.1 MiB/s
through 4000 MiB/s (~31 Gbps), enough for 10G+ NICs. Above that,
disk write throughput becomes the bottleneck rather than the
network, so finer buckets aren't worth the cardinality.
- Both metrics observe the same value (fetched bytes / pull duration,
cached layers excluded; fully-cached pulls skipped). Only the
buckets and deprecation status differ.
Signed-off-by: Ahmet Alp Balkan <ahmet@linkedin.com>
The image_pulling_throughput histogram divided the full image size (all
layers plus config) by wall-clock pull duration. Layers already present
in the content store were counted in the numerator, so the reported
MB/s came out way higher than what was actually fetched. Fully-cached
pulls were the worst case: they "pulled" in milliseconds but reported
the full image size, showing up as huge outliers in the histogram.
Both pull paths (local client.Pull and the transfer service) already
maintain a totalBytesRead counter in pullRequestReporter for progress
and timeout checks. Cached blobs never trigger a fetch, so the counter
naturally excludes them. Plumb that value out of both helpers and use
it in place of image.Size(ctx). Fully-cached pulls (bytesPulled == 0)
are not observed, so they don't produce near-infinite samples.
Also updates the metric's Help text to say the denominator is the
end-to-end pull duration including layer extraction and snapshotter
unpack, not just network transfer.
Addresses #13244
Signed-off-by: Ahmet Alp Balkan <ahmet@linkedin.com>
`populateDefaultUnixSpec` uses `filepath.Join` to generate the default
`CgroupsPath`. On Windows, this produces invalid paths as path elems are
joined with backslash. Switch to `path.Join` instead.
Signed-off-by: Albin Kerouanton <albin.kerouanton@docker.com>
Before this fix, CreateContainer would proceed even if the sandbox
had already stopped or was in an unknown state. This could result in
containers being created in an unusable sandbox, leading to confusing
errors downstream.
StartContainer already guards with the same check:
if sandbox.Status.Get().State != sandboxstore.StateReady {
return nil, fmt.Errorf("sandbox container %q is not running", ...)
}
Apply the identical guard in CreateContainer, immediately after the
sandbox state is known, so that callers receive a clear error instead
of a partial container object.
Fixes#13599
Signed-off-by: crawfordxx <crawfordxx@users.noreply.github.com>
Extend the garbage-collection framework so a collectible resource can emit
forward references during graph traversal, in addition to the existing
back-reference mechanism.
A CollectionContext may now implement the optional collectionWithReferences
interface:
References(ctx context.Context, node gc.Node, fn func(gc.Node))
When the GC visits a node whose resource type was registered by an external
collector, gcContext.references consults the per-type References
implementation after the built-in core resource types are handled.
This is the forward-reference analogue of collectionWithBackRefs. Whereas
ActiveWithBackRefs must enumerate every edge up front and the gcContext
holds all of them in its backRefs map for the entire collection, References
is invoked on demand for a single node. A collector whose resources fan
out to many other nodes can therefore emit those edges without retaining
them in memory for the gc context.
This commit is intentionally a no-op: no plugin registers a collector that
uses collectionWithReferences yet. It is isolated here so that concurrent
development efforts that depend on this interface can be proposed and
reviewed upstream independently.
Signed-off-by: Derek McGowan <derek@mcg.dev>
Force a 4K block size on all platforms rather than only on darwin.
An explicit caller-supplied -b is still respected.
Signed-off-by: Chris Crone <christopher.crone@docker.com>
CRImportCheckpoint built the combined environment (image env followed by
the CRI container env) into a local slice, then re-appended that slice to
imageConfig.Env, duplicating every image environment variable on the
restored container. Assign the combined slice directly instead.
Fixes#13611
Signed-off-by: Aman Raj <aman.yug@gmail.com>
