Go can report context deadline exceeded when a duration-based fuzz limit
expires (https://go.dev/issue/75804).
Use a 50,000-execution limit based on the roughly 47,000 executions
FuzzImageStore completed in 30 seconds in CI. This keeps work stable
across runners and avoids the duration issue.
Assisted-by: Codex
Signed-off-by: Chris Henzie <chrishenzie@gmail.com>
Vagrant is no longer well maintained: e.g., its apt repository does not
provide packages for Ubuntu 26.04 (hashicorp/vagrant#13811), and recent
Fedora boxes are no longer published to HashiCorp's registry, so the CI
had to download the box file manually from Fedora mirrors.
The test scripts in the Vagrantfile were split out to script/vm/*.sh .
The scripts depend on neither Vagrant nor Lima, and can be used with
other VM environments too.
Assisted-by: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
When a registry returns 403 Forbidden on a HEAD request (e.g., manifest
resolve or push existence check), the diagnostic error body is lost
because HEAD responses carry no body per HTTP spec. This leaves users
with an opaque "403 Forbidden" message and no actionable guidance.
Add a follow-up GET on HEAD 403 to retrieve the registry's OCI error
body. The existing unexpectedResponseErr machinery already parses the
body into structured errors — it just needs the body to be present. The
fallback lives in a shared withGETErrorBody helper used by both the
pusher and resolver: it only enriches when the GET also returns 403, and
preserves the original HEAD request's method and status while borrowing
just the body, so the resulting error's status and body stay consistent.
Scoped to 403 only because it is rare (CMK key disabled, IP firewall,
RBAC misconfiguration) and its body is highly diagnostic, while other
status codes either already use GET or have bodies that add no value.
Fixes#8969
Signed-off-by: Andrew Au <cshung@gmail.com>
Add loong64 (LoongArch) architecture support to the build system and CI:
- Makefile.linux: add loong64 to architectures that don't use -buildmode=pie
(consistent with other non-amd64 architectures like mips, ppc64)
- ci.yml: add linux/loong64 to crossbuild matrix with CGO_ENABLED=0
- RELEASES.md: add linux/loong64 as Tier 3 (Build-verified) platform
The linux/loong64 release build and nightly build entries are intentionally
excluded — the cross-compilation toolchain is not yet available in Ubuntu 22.04
apt repositories (no crossbuild-essential-loong64 package). The crossbuild CI
check uses CGO_ENABLED=0. Nightly and release builds will be re-enabled once
the upstream tonistiigi/xx base image provides the loong64 cross-compilation
toolchain.
Go has supported GOARCH=loong64 as a first-class port since Go 1.21.
The seccomp default profile already includes loong64 support (contrib/seccomp).
Tracked by: https://github.com/containerd/containerd/issues/13641
Signed-off-by: 徐晓伟 <xuxiaowei@xuxiaowei.com.cn>
Disable stat usage since we never consume the data.
This can reduce unnecessary contention during transactions.
Signed-off-by: Wei Fu <fuweid89@gmail.com>
The package was moved to a separate module; update the links to
make it easier to discover the current version of upstream.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Vagrant 2.4.x bundles an embedded Ruby 3.3.0 runtime that loads the
default specification json-2.7.2 during initialization. When installing
vagrant-libvirt, RubyGems resolves the newly released fog-json 1.4.0,
which requires json (~> 2.19). Because json-2.7.2 is already active in
memory when Vagrant starts up, RubyGems raises a Gem::ConflictError.
To avoid this conflict, pin fog-json to version 1.2.0 before installing
vagrant-libvirt. Since CI caches /root/.vagrant.d across runs, also
uninstall fog-json first to remove any conflicting version left in cache
by a previous job.
Assisted-by: Antigravity
Signed-off-by: Samuel Karp <samuelkarp@google.com>
The Kubernetes E2E CI workflow was failing on tests requiring container
checkpointing because criu was not installed on the GitHub Actions
runner.
Add a step to install criu via ppa:criu/ppa before building and
installing containerd, matching the existing setup in ci.yml.
Assisted-by: Antigravity
Signed-off-by: Samuel Karp <samuelkarp@google.com>
Add a new `enable_criu` configuration option under CRI plugin runtime
settings. When set to false, any checkpoint or restore request will fail
fast with an error indicating that CRIU support is disabled by
configuration. `enable_criu` currently defaults to true.
Add an integration test script to verify that setting `enable_criu` to
false in containerd configuration successfully disables checkpoint and
restore operations and fails fast.
Assisted-by: Antigravity
Signed-off-by: Samuel Karp <samuelkarp@google.com>
Perform an early validation check on both container checkpoint and
restore paths to fail-fast if the CRIU binary is missing or is older
than the minimum required version (3.16.0).
To support runtime-configured environments, the validation respects the
custom PATH from the shim manager environment if configured, skipping
any relative paths to avoid incorrect daemon-relative resolution. If not
configured, it falls back to a standard system PATH lookup. The check
result is cached using sync.Once to prevent redundant process spawning.
Assisted-by: Antigravity
Signed-off-by: Samuel Karp <samuelkarp@google.com>
Adds a nil guard to GetIPs on criPodSandbox before accessing promoted
struct fields on the embedded Sandbox pointer.
During pod sandbox teardown or race conditions during container exit
events, nriPodSandbox can return a criPodSandbox instance where the
embedded Sandbox pointer is nil.
Assisted-by: Antigravity
Signed-off-by: Chris Henzie <chrishenzie@gmail.com>
