Although EROFS has native compression support (and each filesystem can
contain multiple compression algorithms), in many cases, people only
consider using zstd compression when transporting on the wire in order
to reduce the pulling time but maintain the optimal runtime performance.
Only `+zstd` is considered: it has skippable frames which will be used
for the seekable EROFS implementation in future containerd versions.
Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
If no snapshotter is specified, container run selects the default
snapshotter.
However, if `os.features` is set, we should always call
`checkSnapshotterSupport()`. This ensures containerd clients
report a clear error:
```
ctr: snapshotter overlayfs does not support platform
{amd64 linux [erofs] } for image sha256:[]
```
instead of the confusing layer extraction error:
```
ctr: apply layer error for "": failed to extract layer sha256:[]:
failed to get stream processor for application/vnd.erofs.layer.v1:
no processor for media-type
```
Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
If no snapshotter is specified and `os.features` contains "erofs",
unpacking should use the EROFS snapshotter and differ.
This enhances the usability of native EROFS container images.
Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
This change updates the Go version from 1.25.8 to 1.26.0 across the
repository, including CI configurations, build scripts, and development
environments.
It also fixes two linter issues discovered after upgrading the Go version:
- core/snapshots/storage/bolt.go: incorrect printf format for uint64
- plugins/transfer/plugin.go: incorrect printf format for int and unused variable
The golangci-lint version in script/setup/install-dev-tools is also updated to v2.9.0
to match CI.
Signed-off-by: Sergey Kanzhelev <S.Kanzhelev@live.com>
Updates crun version used by integration tests to 1.27 and enables the
test for cgroup mount options in
TestPrivilegedContainerCgroupMountOptions.
Assisted-by: Antigravity
Signed-off-by: Chris Henzie <chrishenzie@gmail.com>
Mirror cAdvisor's instantaneous CPU rate behavior for CRI stats.
Compute UsageNanoCores from the latest two samples only, and leave the field unset when there is not yet enough data to calculate an instantaneous rate. This avoids publishing an authoritative zero before a valid rate exists while keeping containerd aligned with cAdvisor semantics.
Signed-off-by: Davanum Srinivas <davanum@gmail.com>
Scary warnings were printed for any mediaType that wasn't mapped;
INFO[2026-03-10T11:39:45.677430346Z] Docker daemon commit=83bca51 containerd-snapshotter=true storage-driver=overlayfs version=29.3.0
...
INFO[2026-03-10T11:39:45.689383471Z] API listen on /var/run/docker.sock
WARN[2026-03-10T11:40:32.382484965Z] reference for unknown type: application/vnd.oci.empty.v1+json digest="sha256:44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a" mediatype=application/vnd.oci.empty.v1+json size=2
WARN[2026-03-10T11:40:32.445406215Z] reference for unknown type: application/vnd.oci.empty.v1+json
WARN[2026-03-10T11:40:32.695256132Z] reference for unknown type: application/vnd.dev.sigstore.bundle.v0.3+json digest="sha256:7e8cf55036d9be9d6a0d720a2e78468401cc0e01946dbbcb1cd7622ae854a0a3" mediatype=application/vnd.dev.sigstore.bundle.v0.3+json size=10491
WARN[2026-03-10T11:40:32.695314215Z] reference for unknown type: application/vnd.oci.empty.v1+json digest="sha256:44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a" mediatype=application/vnd.oci.empty.v1+json size=2
WARN[2026-03-10T11:40:32.745608673Z] reference for unknown type: application/vnd.dev.sigstore.bundle.v0.3+json
WARN[2026-03-10T11:40:32.745629632Z] reference for unknown type: application/vnd.oci.empty.v1+json
WARN[2026-03-10T11:40:32.845403049Z] reference for unknown type: application/vnd.dev.sigstore.bundle.v0.3+json
WARN[2026-03-10T11:40:32.945182007Z] reference for unknown type: application/vnd.dev.sigstore.bundle.v0.3+json
INFO[2026-03-10T11:40:34.714635924Z] image pulled digest="sha256:37539dd4d60fc70968d164d3850d903a2c56f6402214a1953fbf9fcb81ada731" remote="docker.io/moby/buildkit:latest
These cases are not actionable by the user, and not critical, so let's change
them to a debug-message, but add more context. Also update the GoDoc for this
function to better cover its functionality.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
When running hostNetwork containers with the shim sandboxer, the spec
passed to NewBundle is never initialized to a typed nil and is instead a
bare golang nil. Fix this by guarding the dereference to avoid crashing
when such a container is created.
Signed-off-by: Fletcher Woodruff <fwood@amazon.com>
The `push` function below assumes that digest and mediatypes are
populated and set. If they aren't, then the requests made are malformed,
attempting to invoke `HEAD /blobs/` (instead of `HEAD /blobs/<digest>`).
Additionally, if we *were* to move past this point, we'd then populate
an empty digest in the query parameter, and even provide invalid HTTP
mediatypes.
However, the `WithDescriptor` `WriterOpt` specifically notes that "Write
does not require any field of desc to be set". It's very easy for the
caller to read this as an optional field, to skip it, and then get
confusing HTTP errors from inside the `push` function.
We can avoid this by explicitly validating that the descriptor is valid
and provide early feedback.
Signed-off-by: Justin Chadwell <me@jedevc.com>
Integrates CRI container resource updates with core Sandbox API plugin.
Delegates payload to out-of-tree controllers via UpdateSandbox API.
Gracefully tolerates ErrNotImplemented to preserve backwards
compatibility for legacy sandboxers.
Assisted-by: Antigravity
Signed-off-by: Chris Henzie <chrishenzie@gmail.com>
Introduce functional options to NewLogrusHook to allow optional Trace ID
injection into log fields. This enables log-trace correlation via the
[debug] config without breaking existing external consumers of
pkg/tracing.
Signed-off-by: Hasan Siddiqui <hasiddiqui@google.com>
