Install the pinned release of containerd-runc-shim with cargo install
instead of building the tip of rust-extensions' main, so the Rust legs
run a known shim that does not change underneath the PR. The build no
longer runs inside rust-extensions, whose rust-toolchain.toml used to
pick the toolchain, so pin one here instead.
Building the shim takes a minute or two per Rust leg, and its inputs
are fixed by the pinned crate version, toolchain and runner image, so
keep the installed binary in the actions cache keyed on those and only
run cargo install, and install the toolchain, when it is missing.
CRI only types runtime options for io.containerd.runc.v2, so the Rust
shim got generic options and SystemdCgroup never reached it. Configure
it as the runc runtime's binary through runtime_path instead.
Signed-off-by: Maksym Pavlenko <pavlenko.maksym@gmail.com>
The Rust shim now sets up a PTY's stdin without blocking, so
TestContainerPTY runs again. The CRI suite had no way to leave tests
out; it takes a SKIP pattern now, like FOCUS, and the Rust legs use it
for the user namespace tests, which need idmapped mounts the shim does
not do yet. The checkpoint disable script is skipped for the Rust shim
as well: it has no Checkpoint RPC, so the script's second case, a
checkpoint that must succeed with enable_criu unset, cannot pass with
it. Its integration legs already run with -no-criu.
Signed-off-by: Maksym Pavlenko <pavlenko.maksym@gmail.com>
This reverts commit f078cebbd1.
Propagating State deadline errors causes Get to fail and List to omit
tasks when a shim is temporarily unresponsive, such as during slow
cleanup in Delete. A timeout does not mean the task no longer exists,
and omitting it makes container lifecycle management harder for clients
and CRI.
Restore the previous behavior of returning UNKNOWN on State timeouts,
so tasks remain visible and callers can reconcile their state.
Refs: https://github.com/containerd/containerd/pull/14380#pullrequestreview-5689176711
Signed-off-by: Wei Fu <fuweid89@gmail.com>
The runsc job runs on ubuntu-latest, which is moving to Ubuntu 26.04,
whose sudo (sudo-rs) does not support -E ("preserving the entire
environment is not supported, '-E' is ignored"). critest.sh then fails
on the unset TEST_RUNTIME, the only variable the step did not pass
explicitly.
Pass it on the sudo command line with the others and drop -E.
Signed-off-by: Maksym Pavlenko <pavlenko.maksym@gmail.com>
The `urfave_cli_no_docs` build tag was removed in urfave/cli v3, with doc
generation moved to a separate module.
Remove the obsolete tag and the special handling for gen-manpages, which is
no longer needed after the migration to v3.
updates f72829f36b.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Add the `grpcnotrace` build tag to exclude gRPC's legacy tracing integration
and reduce binary sizes.
This reduces the size of containerd by ~272 KiB, containerd-stress by ~448 KiB,
and ctr by ~512 KiB, saving ~1.2 MiB overall.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The test tarball from test/build.sh is built on the kubekins image and
run on other distros. A dynamic runc built on Debian trixie needs
GLIBC_2.38 and fails on AL2023 (kubernetes/kubernetes#142987).
Build with `make static` like the runc release binaries. EL has no
libseccomp-static, so the Fedora/EL VMs keep the dynamic build via
RUNC_DYNAMIC=1.
Signed-off-by: Davanum Srinivas <davanum@gmail.com>
Only the Windows listener and dialer take the unix:// scheme.
Assisted-by: OpenCode (claude-sonnet-5-5)
Signed-off-by: Eric Curtin <eric.curtin@docker.com>
This release includes 1 security fix following the security policy:
- crypto/x509: mitigation for security concerns with a specific Certificate Authority
We're blocking trust in a small set of intermediate certificates due to specific security concerns around their operation.
Verify will now filter out chains which contain these intermediates, preventing them from being returned to the caller.
We highly recommend immediately upgrading to this release.
This is CVE-2026-111943 and Go issue https://go.dev/issue/82345.
release notes: https://go.dev/doc/devel/release#go1.27.3
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
This change updates Microsoft/hcsshim to v0.15.0 and Microsoft/go-winio
to v0.6.4.
This moves containerd back to mainline and off of the internally tagged
release candidate versions.
Signed-off-by: Justin Terry <terryjustin@microsoft.com>
TestShutdownAfterCloseLeavesAReusedFdAlone writes a line into a pty and expects one read on the receiving FIFO to return "still here\r\n". With output post-processing on, the line discipline writes the bytes before the newline and the CR LF it translates the newline into as two separate writes, and the copier forwards each as it arrives, so a single read can return the first part alone. CI hit this on four matrix entries across three pull requests on the day the test merged.
Read the full expected line with io.ReadFull instead. A missing delivery still fails through the five second timeout.
Signed-off-by: Maksym Pavlenko <pavlenko.maksym@gmail.com>
Maksym Pavlenko