If fsmerge is enabled and no write is needed, it can return an overlay
mount with a single lowerdir, which is illegal for overlayfs.
For example, it can cause the following Nerdctl error:
: I'm not sure why ctr works, but the issue is real.
```bash
$ nerdctl run --runtime io.containerd.kata.v2 --snapshotter=erofs -it --rm nginx:latest /bin/bash
FATA[0000] failed to mount {Type:overlay Source:overlay Target: Options:[lowerdir=/run/containerd/
io.containerd.mount-manager.v1.bolt/t/7/1]} on "/tmp/initialC2039543827": mount source: "overlay",
target: "/tmp/initialC2039543827", fstype: overlay, flags: 0, data: "lowerdir=/run/containerd/io.
containerd.mount-manager.v1.bolt/t/7/1", err: invalid argument
```
Switch to using a bind mount instead.
Fixes: 9a7500a974 ("Add support for EROFS fsmerge feature")
Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
Although EROFS has native compression support (and each filesystem can
contain multiple compression algorithms), in many cases, people only
consider using zstd compression when transporting on the wire in order
to reduce the pulling time but maintain the optimal runtime performance.
Only `+zstd` is considered: it has skippable frames which will be used
for the seekable EROFS implementation in future containerd versions.
Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
The default walking applier performs a real temporary mount for
unpacking, but the mount manager failed to adapt to the walking
differ.
This fixes the EROFS snapshotter together with the default walking
differ, otherwise it reports:
```
ctr: apply layer error for "[]": failed to extract layer sha256:[]:
failed to mount /var/lib/containerd/tmpmounts/containerd-mount3992073457:
internal mount option "X-containerd.mkfs.fs=ext4" was not consumed by
the mount manager
```
Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
klog has a long-standing bug where setting -logtostderr=true causes the
-stderrthreshold flag to be silently ignored. All log messages are sent
to stderr regardless of their severity.
klog v2.140.0 introduced two new flags that allow callers to opt into the
correct behavior:
-legacy_stderr_threshold_behavior=false
-stderrthreshold=INFO
Set them in the CRI plugin's setGLogLevel() function, right after
klog.InitFlags() and before any other flag configuration.
Reference: kubernetes/klog#212
Signed-off-by: Pierluigi Lenoci <pierluigi.lenoci@gmail.com>
If no snapshotter is specified and `os.features` contains "erofs",
unpacking should use the EROFS snapshotter and differ.
This enhances the usability of native EROFS container images.
Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
Ensure that the internal tracing plugin is initialized before the
NRI plugin. This ensures that NRI has access to the global
TracerProvider when it initializes its TTRPC interceptors.
Assisted-by: gemini-cli
Signed-off-by: Samuel Karp <samuelkarp@google.com>
move setting the config_path from default image config to plugin init.
only set the default value when both mirrors and config_path are empty,
in all other cases retain the existing behaviour
Co-authored-by: Samuel Karp <samuelkarp@google.com>
Signed-off-by: Akhil Mohan <akhilerm@gmail.com>
Signed-off-by: Samuel Karp <samuelkarp@google.com>
When users configure a snapshotter in the runtime config (e.g.,
`plugins."io.containerd.cri.v1.runtime".containerd.runtimes.kata.snapshotter`),
the CRI image service was not aware of this configuration. This caused
images to be pulled with the default snapshotter instead of the
runtime-specific one, because the image service's runtimePlatforms map
was not populated with these runtime-to-snapshotter mappings.
Let's make sure that during the CRI plugin init, we iterate over all the
configured runtimes, and propagate any snapshotter configuration to the
image service.
The issue was found while working on #12835.
Signed-off-by: Fabiano Fidêncio <ffidencio@nvidia.com>
When the local transfer plugin is instantiated, it loads verifiers
through `ic.GetByType()` which returns ErrPluginNotFound if no plugins
of the given type is available. This would happen if users explicitly
disabled the bindir plugin.
Users may wish to disable that plugin to prevent containerd from
executing arbitrary binaries on the host (e.g. when running rootless).
Currently, the only way to achieve that is to set bindir's param
`bin_dir` to the empty string but that seems more fragile than disabling
the plugin altogether.
The local transfer plugin is already checking if there are no plugins
available, and take action accordingly. Thus, not handling
`ErrPluginNotFound` seems to be an oversight.
Signed-off-by: Albin Kerouanton <albin.kerouanton@docker.com>
When a shim becomes unresponsive (e.g., stopped via SIGSTOP), ttrpc
communication times out with `context deadline exceeded`.
Currently, this error is not properly propagated, causing redundant API
calls and slow container listing by client sides.
Specifically, when executing the API to check the task state, it appears
that the `context deadline exceeded` error via ttrpc is not being handled
within `shimTask.State()` and `getProcessState()`.
As a result, when this error occurs, clients such as nerdctl cannot
recognize this error, and it is thought that the issue described below is
occurring:
- https://github.com/containerd/nerdctl/issues/4720
Therefore, this commit adds error handling to ensure timeouts are properly
handled by client sides.
Signed-off-by: Hayato Kiwata <dev@haytok.jp>
The layer blob immutable flag clearing logic was moved before
storage.Remove() call to ensure that immutable files can be properly
removed even if subsequent operations fail after storage.Remove().
The previous order had storage.Remove() called first, which meant if
any subsequent operations failed, there would be no opportunity to
remove the immutable flag on the layer blob files.
Signed-off-by: jinda.ljd <jinda.ljd@alibaba-inc.com>
The traditional mount() syscall has a PAGE_SIZE (typically 4KB) limit
for mount options. Use the new mount API (fsopen/fsconfig/fsmount/
move_mount) introduced in Linux 5.2 to bypass this limitation.
Fixed: #12662
Signed-off-by: ChengyuZhu6 <hudson@cyzhu.com>
Use the same approach for appending UUID arguments in GenerateTarIndexAndAppendTar
as done in ConvertTarErofs for consistency between the two modes.
Signed-off-by: Aadhar Agarwal <aadagarwal@microsoft.com>
Currently, fs-verity support detection fails on fresh containerd
installations because the content store root directory
(io.containerd.content.v1.content) doesn't exist yet. This directory
is only created when pulling images, causing checker to
always be false on new hosts.
The IsSupported() function attempts to create a temporary directory
within rootPath to test fs-verity support, but fails when rootPath
doesn't exist, returning an error that is silently ignored.
Fix this by ensuring the root directory exists before performing
the fs-verity support check in NewLabeledStore().
Signed-off-by: ningmingxiao <ning.mingxiao@zte.com.cn>
This disables the slow_chown feature (nobody in their right mind
is going to be choosing erofs and want to slowly chown each file),
indicates that we support idmaps if the kernel supports it, and makes
sure to chown the upperdir.
This is more or less exactly how the overlay snapshotter does things,
minus the slow_chown part (which has discussions about dropping
altogether at some point anyways).
Signed-off-by: Andrew Halaney <ahalaney@netflix.com>
In the CreateSandbox request, which is part of the Sandbox Controller, we ignored the `Annotations` parameter which could have been set by the caller via `WithAnnotations` option.
This commit rectifies the same and adds the Annotations parameter to the request.
Signed-off-by: Harsh Rawat <harshrawat@microsoft.com>
EROFS has supported a tiny metadata-only image to reference external
blobs since Linux 5.16. This eliminates the need to mount each EROFS
layer one by one and is also useful for VM-based containers (e.g.
nerdbox and Kata containers.)
Similar to LCOW/CimFS, `snapshots.UnpackKeyPrefix` is used to
trigger fsmerge generation (typically < 100 ms) on demand in Prepare().
In the future, we can also generate fsmeta in Commit() of the final
unpacking layer (by introducing an annotation to keep the chainID).
However, in the case of intermediate layer reuse, the Prepare() handling
will still be required.
```toml
[plugins."io.containerd.snapshotter.v1.erofs"]
max_unmerged_layers = 1 # enable fsmerge if image layers >= 2
```
Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
