dilim/containerd
1
0 Fork 0
mirror of https://github.com/containerd/containerd.git synced 2026-11-06 05:17:02 +00:00
Code Issues Packages Projects Releases Wiki Activity
17,231 Commits 31 Branches 333 Tags
bb5988d3d1da170491bbb83564976729d85c227e
Commit Graph
946 Commits
Author SHA1 Message Date
Maksym Pavlenko 051118d229 Merge pull request #14036 from mxpv/shim-telemetry 
Pass tracing context from shim to runc and hooks
 2026-08-27 18:35:45 +00:00
Maksym Pavlenko 0b4ed79573 integration: add e2e test to verify trace context propagation 
Send a known trace context with the API call and assert that the
environment of the OCI hook runc executes carries it.

The shim propagates the context only when built with the shim_tracing
tag, so build the Linux integration job with it. The integration target
also has to pass the project build tags to the test compile, like the
other build targets already do.

Signed-off-by: Maksym Pavlenko <pavlenko.maksym@gmail.com>
 2026-08-25 11:21:41 -07:00
Phil Estes 8d32443320 Update CI to include Go 1.27 
Go 1.27 has been released and we can re-enable matrix
building with min and max Go versions as well as move
most of CI jobs to use the latest Go 1.27. Leave install-go
action at 1.26.6.

Signed-off-by: Phil Estes <estesp@amazon.com>
 2026-08-25 10:03:38 -04:00
dependabot[bot] 0db88d7f83 build(deps): bump actions/attest-build-provenance from 4.1.1 to 4.2.2 
Bumps [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance) from 4.1.1 to 4.2.2.
- [Release notes](https://github.com/actions/attest-build-provenance/releases)
- [Changelog](https://github.com/actions/attest-build-provenance/blob/main/RELEASE.md)
- [Commits](https://github.com/actions/attest-build-provenance/compare/0f67c3f4856b2e3261c31976d6725780e5e4c373...4d101475d8b20a2381f78447822ac1eab6504dd8)

---
updated-dependencies:
- dependency-name: actions/attest-build-provenance
  dependency-version: 4.2.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-14 23:27:20 +00:00
Paweł Gronowski b665fde220 Update Go to 1.26.6 
This release includes 10 security fixes covering module checksum
verification, denial-of-service protections, parser crashes, XSS, and
IDNA hostname validation, most notably:

- CVE-2026-56865: prevent malicious GOPROXY servers from bypassing sumdb transparency-log verification: https://go.dev/issue/80744
- CVE-2026-56864: prevent malicious GOSUMDB servers from serving unauthenticated module content: https://go.dev/issue/80745
- CVE-2026-56859: add recursion limits for XML decoding: https://go.dev/issue/80481
- CVE-2026-56853: apply ReadHeaderTimeout during unencrypted HTTP/2 detection: https://go.dev/issue/80205
- CVE-2026-56860: prevent quadratic behavior in URL path resolution: https://go.dev/issue/80494
- CVE-2026-46600: prevent panics when parsing malformed SVCB/HTTPS DNS records: https://go.dev/issue/79795
- CVE-2026-56862: limit excessive TLS post-handshake messages: https://go.dev/issue/80528
- CVE-2026-56858: fix JavaScript regexp context tracking in html/template: https://go.dev/issue/80435
- CVE-2026-39821: reject invalid ASCII-only Punycode labels: https://go.dev/issue/78760
- CVE-2026-33818: add recursion limits for ASN.1 unmarshalling: https://go.dev/issue/80405

Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
 2026-08-13 22:13:25 +02:00
Maksym Pavlenko 35f120ed0a Merge pull request #13886 from containerd/dependabot/github_actions/docker-actions-dee7dd5463 
build(deps): bump docker/login-action from 4.4.0 to 4.6.0 in the docker-actions group across 1 directory
 2026-08-08 19:59:46 +00:00
Maksym Pavlenko c8bc0dd7c1 Merge pull request #13922 from containerd/dependabot/github_actions/codeql-actions-432e0d4de6 
build(deps): bump the codeql-actions group with 3 updates
 2026-08-08 19:59:19 +00:00
dependabot[bot] c013c7df4d build(deps): bump actions/stale from 10.4.0 to 11.0.0 
Bumps [actions/stale](https://github.com/actions/stale) from 10.4.0 to 11.0.0.
- [Release notes](https://github.com/actions/stale/releases)
- [Changelog](https://github.com/actions/stale/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/stale/compare/1e223db275d687790206a7acac4d1a11bd6fe629...4391f3da665fdf50b6810c1a66712fb9ba21aa93)

---
updated-dependencies:
- dependency-name: actions/stale
  dependency-version: 11.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-07 23:26:53 +00:00
dependabot[bot] cd9113b9d5 build(deps): bump the codeql-actions group with 3 updates 
Bumps the codeql-actions group with 3 updates: [github/codeql-action/init](https://github.com/github/codeql-action), [github/codeql-action/analyze](https://github.com/github/codeql-action) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action).


Updates `github/codeql-action/init` from 4.37.3 to 4.37.4
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81...f205ea1c3313d32999d8d6a48b4f6530d4437b38)

Updates `github/codeql-action/analyze` from 4.37.3 to 4.37.4
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81...f205ea1c3313d32999d8d6a48b4f6530d4437b38)

Updates `github/codeql-action/upload-sarif` from 4.37.3 to 4.37.4
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81...f205ea1c3313d32999d8d6a48b4f6530d4437b38)

---
updated-dependencies:
- dependency-name: github/codeql-action/init
  dependency-version: 4.37.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: codeql-actions
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.37.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: codeql-actions
- dependency-name: github/codeql-action/upload-sarif
  dependency-version: 4.37.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: codeql-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-07 23:26:33 +00:00
dependabot[bot] 3dd83f6774 build(deps): bump docker/login-action 
Bumps the docker-actions group with 1 update in the / directory: [docker/login-action](https://github.com/docker/login-action).


Updates `docker/login-action` from 4.4.0 to 4.6.0
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](https://github.com/docker/login-action/compare/af1e73f918a031802d376d3c8bbc3fe56130a9b0...dbcb813823bdd20940b903addbd779551569679f)

---
updated-dependencies:
- dependency-name: docker/login-action
  dependency-version: 4.5.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: docker-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-07 23:23:11 +00:00
dependabot[bot] 406c8dc44a build(deps): bump the codeql-actions group with 3 updates 
Bumps the codeql-actions group with 3 updates: [github/codeql-action/init](https://github.com/github/codeql-action), [github/codeql-action/analyze](https://github.com/github/codeql-action) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action).


Updates `github/codeql-action/init` from 4.37.2 to 4.37.3
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/e0647621c2984b5ed2f768cb892365bf2a616ad1...e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81)

Updates `github/codeql-action/analyze` from 4.37.2 to 4.37.3
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/e0647621c2984b5ed2f768cb892365bf2a616ad1...e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81)

Updates `github/codeql-action/upload-sarif` from 4.37.2 to 4.37.3
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/e0647621c2984b5ed2f768cb892365bf2a616ad1...e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81)

---
updated-dependencies:
- dependency-name: github/codeql-action/init
  dependency-version: 4.37.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: codeql-actions
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.37.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: codeql-actions
- dependency-name: github/codeql-action/upload-sarif
  dependency-version: 4.37.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: codeql-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-31 23:26:40 +00:00
Samuel Karp 56bc534e7e Merge pull request #13871 from samuelkarp/remove_deprecated_checkpoint_restore 
cri: remove restore in CreateContainer
 2026-07-31 15:50:29 +00:00
Samuel Karp 91be73ba62 cri: remove restore in CreateContainer 
Remove support for restoring checkpoint data during CreateContainer,
which was previously deprecated in v2.3.

Assisted-by: Antigravity
Signed-off-by: Samuel Karp <samuelkarp@google.com>
 2026-07-29 09:32:24 -07:00
Samuel Karp 565606decf workflows/stale: exempt priority and status labels 
Exclude priority/*, status/accepted, status/needs-major-release, and
status/roadmapped labels from being marked as stale and closed.

Assisted-by: Antigravity
Signed-off-by: Samuel Karp <samuelkarp@google.com>
 2026-07-28 11:29:53 -07:00
dependabot[bot] ef89efe0d0 build(deps): bump the codeql-actions group with 3 updates 
Bumps the codeql-actions group with 3 updates: [github/codeql-action/init](https://github.com/github/codeql-action), [github/codeql-action/analyze](https://github.com/github/codeql-action) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action).


Updates `github/codeql-action/init` from 4.36.2 to 4.37.2
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/8aad20d150bbac5944a9f9d289da16a4b0d87c1e...e0647621c2984b5ed2f768cb892365bf2a616ad1)

Updates `github/codeql-action/analyze` from 4.36.2 to 4.37.2
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/8aad20d150bbac5944a9f9d289da16a4b0d87c1e...e0647621c2984b5ed2f768cb892365bf2a616ad1)

Updates `github/codeql-action/upload-sarif` from 4.37.0 to 4.37.2
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/99df26d4f13ea111d4ec1a7dddef6063f76b97e9...e0647621c2984b5ed2f768cb892365bf2a616ad1)

---
updated-dependencies:
- dependency-name: github/codeql-action/init
  dependency-version: 4.37.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: codeql-actions
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.37.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: codeql-actions
- dependency-name: github/codeql-action/upload-sarif
  dependency-version: 4.37.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: codeql-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-28 00:15:56 +00:00
dependabot[bot] 4fa23707c8 build(deps): bump actions/checkout from 7.0.0 to 7.0.1 
Bumps [actions/checkout](https://github.com/actions/checkout) from 7.0.0 to 7.0.1.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0...3d3c42e5aac5ba805825da76410c181273ba90b1)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-24 23:24:34 +00:00
Maksym Pavlenko 5c620e984f Fix NET/network CI failure on Windows 
Signed-off-by: Maksym Pavlenko <pavlenko.maksym@gmail.com>
 2026-07-21 21:00:34 -07:00
Akihiro Suda 4b730651ee Merge pull request #13688 from containerd/dependabot/github_actions/actions/attest-build-provenance-4.1.1 
build(deps): bump actions/attest-build-provenance from 4.1.0 to 4.1.1
 2026-07-20 20:54:55 +00:00
Maksym Pavlenko 0ed30a42b9 Merge pull request #13810 from containerd/dependabot/github_actions/github/codeql-action/upload-sarif-4.37.0 
build(deps): bump github/codeql-action/upload-sarif from 4.36.2 to 4.37.0
 2026-07-19 06:06:54 +00:00
Maksym Pavlenko 956be807ee Merge pull request #13765 from containerd/dependabot/github_actions/docker/setup-buildx-action-4.2.0 
build(deps): bump docker/setup-buildx-action from 4.1.0 to 4.2.0
 2026-07-19 01:57:53 +00:00
Maksym Pavlenko 9a2d8419eb Merge pull request #13772 from containerd/dependabot/github_actions/docker/login-action-4.4.0 
build(deps): bump docker/login-action from 4.2.0 to 4.4.0
 2026-07-19 01:57:39 +00:00
dependabot[bot] a4b1e9a44b build(deps): bump actions/stale from 10.3.0 to 10.4.0 
Bumps [actions/stale](https://github.com/actions/stale) from 10.3.0 to 10.4.0.
- [Release notes](https://github.com/actions/stale/releases)
- [Changelog](https://github.com/actions/stale/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/stale/compare/eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899...1e223db275d687790206a7acac4d1a11bd6fe629)

---
updated-dependencies:
- dependency-name: actions/stale
  dependency-version: 10.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-17 23:27:04 +00:00
dependabot[bot] 624c8e85bd build(deps): bump github/codeql-action/upload-sarif 
Bumps [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) from 4.36.2 to 4.37.0.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/8aad20d150bbac5944a9f9d289da16a4b0d87c1e...99df26d4f13ea111d4ec1a7dddef6063f76b97e9)

---
updated-dependencies:
- dependency-name: github/codeql-action/upload-sarif
  dependency-version: 4.37.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-17 23:26:20 +00:00
Samuel Karp 4796c7b9d2 Merge pull request #13748 from mxpv/dev 
Run CI against dev branches
 2026-07-16 17:15:38 +00:00
Samuel Karp 1ab181cb64 Merge pull request #13780 from mxpv/stale 
Raise stale bot limits
 2026-07-15 08:04:44 +00:00
Maksym Pavlenko 12f6a4d585 Raise stale bot limits 
Signed-off-by: Maksym Pavlenko <pavlenko.maksym@gmail.com>
 2026-07-12 17:18:23 -07:00
dependabot[bot] a9bb893ecb build(deps): bump docker/login-action from 4.2.0 to 4.4.0 
Bumps [docker/login-action](https://github.com/docker/login-action) from 4.2.0 to 4.4.0.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](https://github.com/docker/login-action/compare/650006c6eb7dba73a995cc03b0b2d7f5ca915bee...af1e73f918a031802d376d3c8bbc3fe56130a9b0)

---
updated-dependencies:
- dependency-name: docker/login-action
  dependency-version: 4.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-10 23:25:37 +00:00
dependabot[bot] 51355849a7 build(deps): bump docker/setup-buildx-action from 4.1.0 to 4.2.0 
Bumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) from 4.1.0 to 4.2.0.
- [Release notes](https://github.com/docker/setup-buildx-action/releases)
- [Commits](https://github.com/docker/setup-buildx-action/compare/d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5...bb05f3f5519dd87d3ba754cc423b652a5edd6d2c)

---
updated-dependencies:
- dependency-name: docker/setup-buildx-action
  dependency-version: 4.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-10 23:22:41 +00:00
Maksym Pavlenko 6c438b0479 Run CI against dev branches 
Signed-off-by: Maksym Pavlenko <pavlenko.maksym@gmail.com>
 2026-07-09 10:20:18 -07:00
Akihiro Suda a42b09aaa6 CI: migrate Vagrant to Lima 
Vagrant is no longer well maintained: e.g., its apt repository does not
provide packages for Ubuntu 26.04 (hashicorp/vagrant#13811), and recent
Fedora boxes are no longer published to HashiCorp's registry, so the CI
had to download the box file manually from Fedora mirrors.

The test scripts in the Vagrantfile were split out to script/vm/*.sh .
The scripts depend on neither Vagrant nor Lima, and can be used with
other VM environments too.

Assisted-by: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 2026-07-08 21:09:27 +09:00
Samuel Karp cb66686cbb Merge pull request #13664 from samuelkarp/criu-check-fail-fast 
Disable checkpoint restore codepath when CRIU is not installed
 2026-07-08 06:10:01 +00:00
Chris Henzie 2b017f12b5 Update go to 1.26.5 
Includes security fixes to the crypto/tls and os packages.

Assisted-by: Antigravity
Signed-off-by: Chris Henzie <chrishenzie@gmail.com>
 2026-07-07 14:34:38 -07:00
徐晓伟 48c841fe2d feat: add loong64 (LoongArch) build support 
Add loong64 (LoongArch) architecture support to the build system and CI:

- Makefile.linux: add loong64 to architectures that don't use -buildmode=pie
  (consistent with other non-amd64 architectures like mips, ppc64)
- ci.yml: add linux/loong64 to crossbuild matrix with CGO_ENABLED=0
- RELEASES.md: add linux/loong64 as Tier 3 (Build-verified) platform

The linux/loong64 release build and nightly build entries are intentionally
excluded — the cross-compilation toolchain is not yet available in Ubuntu 22.04
apt repositories (no crossbuild-essential-loong64 package). The crossbuild CI
check uses CGO_ENABLED=0. Nightly and release builds will be re-enabled once
the upstream tonistiigi/xx base image provides the loong64 cross-compilation
toolchain.

Go has supported GOARCH=loong64 as a first-class port since Go 1.21.
The seccomp default profile already includes loong64 support (contrib/seccomp).

Tracked by: https://github.com/containerd/containerd/issues/13641

Signed-off-by: 徐晓伟 <xuxiaowei@xuxiaowei.com.cn>
 2026-07-07 01:43:14 +08:00
Phil Estes 072dbf625f Merge pull request #13687 from containerd/dependabot/github_actions/actions/cache-6.1.0 
build(deps): bump actions/cache from 5.0.5 to 6.1.0
 2026-07-06 14:47:39 +00:00
Maksym Pavlenko 4f9bae6776 Update stale PR policy 
Signed-off-by: Maksym Pavlenko <pavlenko.maksym@gmail.com>
 2026-07-02 15:44:54 -07:00
dependabot[bot] ee7e56cac7 build(deps): bump actions/cache from 5.0.5 to 6.1.0 
Bumps [actions/cache](https://github.com/actions/cache) from 5.0.5 to 6.1.0.
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](https://github.com/actions/cache/compare/27d5ce7f107fe9357f9df03efb73ab90386fccae...55cc8345863c7cc4c66a329aec7e433d2d1c52a9)

---
updated-dependencies:
- dependency-name: actions/cache
  dependency-version: 6.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-02 13:27:21 -04:00
Samuel Karp 84112c78c1 ci: pin fog-json to resolve gem conflict 
Vagrant 2.4.x bundles an embedded Ruby 3.3.0 runtime that loads the
default specification json-2.7.2 during initialization. When installing
vagrant-libvirt, RubyGems resolves the newly released fog-json 1.4.0,
which requires json (~> 2.19). Because json-2.7.2 is already active in
memory when Vagrant starts up, RubyGems raises a Gem::ConflictError.

To avoid this conflict, pin fog-json to version 1.2.0 before installing
vagrant-libvirt. Since CI caches /root/.vagrant.d across runs, also
uninstall fog-json first to remove any conflicting version left in cache
by a previous job.

Assisted-by: Antigravity
Signed-off-by: Samuel Karp <samuelkarp@google.com>
 2026-07-01 23:19:06 -07:00
Samuel Karp 81350a5d9a github/workflows: install criu in node-e2e 
The Kubernetes E2E CI workflow was failing on tests requiring container
checkpointing because criu was not installed on the GitHub Actions
runner.

Add a step to install criu via ppa:criu/ppa before building and
installing containerd, matching the existing setup in ci.yml.

Assisted-by: Antigravity
Signed-off-by: Samuel Karp <samuelkarp@google.com>
 2026-06-30 12:47:52 -07:00
Samuel Karp 06495733b2 cri: add enable_criu configuration option 
Add a new `enable_criu` configuration option under CRI plugin runtime
settings. When set to false, any checkpoint or restore request will fail
fast with an error indicating that CRIU support is disabled by
configuration. `enable_criu` currently defaults to true.

Add an integration test script to verify that setting `enable_criu` to
false in containerd configuration successfully disables checkpoint and
restore operations and fails fast.

Assisted-by: Antigravity
Signed-off-by: Samuel Karp <samuelkarp@google.com>
 2026-06-30 12:47:48 -07:00
dependabot[bot] 43866c6a3f build(deps): bump actions/attest-build-provenance from 4.1.0 to 4.1.1 
Bumps [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance) from 4.1.0 to 4.1.1.
- [Release notes](https://github.com/actions/attest-build-provenance/releases)
- [Changelog](https://github.com/actions/attest-build-provenance/blob/main/RELEASE.md)
- [Commits](https://github.com/actions/attest-build-provenance/compare/a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32...0f67c3f4856b2e3261c31976d6725780e5e4c373)

---
updated-dependencies:
- dependency-name: actions/attest-build-provenance
  dependency-version: 4.1.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-06-29 23:22:59 +00:00
Sebastiaan van Stijn 0f18307820 gha: quote some values 
Quote values to address CoPilot review comments

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-06-26 18:53:38 +02:00
Sebastiaan van Stijn 0274924d74 gha: remove uses of "read-all" permissions 
"read-all" is overly permissive as a default. Change it to contents: read
to align with other defaults.

Note that this does not actually impact the workflows, because the defaults
are overwritten in the actual check.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-06-26 18:53:37 +02:00
Sebastiaan van Stijn 072a34d648 gha: suppress zizmor warning for intentionally un-pinned workflows 
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-06-26 18:53:37 +02:00
Sebastiaan van Stijn 9f0bb640ce gha: apply zizmor fixes 
Results of automated fixes using;

    zizmor --fix=all --min-severity medium .

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-06-26 18:53:36 +02:00
Sebastiaan van Stijn 8722c46313 gha: buf-breaking: pin actions by sha 
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-06-26 18:49:57 +02:00
dependabot[bot] 38aaa269c7 build(deps): bump actions/checkout from 6 to 7 
Bumps [actions/checkout](https://github.com/actions/checkout) from 6 to 7.
- [Release notes](https://github.com/actions/checkout/releases)
- [Commits](https://github.com/actions/checkout/compare/v6...v7)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-06-23 17:22:48 +00:00
dependabot[bot] d568ae9cb5 build(deps): bump softprops/action-gh-release from 3.0.0 to 3.0.1 
Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 3.0.0 to 3.0.1.
- [Release notes](https://github.com/softprops/action-gh-release/releases)
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md)
- [Commits](https://github.com/softprops/action-gh-release/compare/b4309332981a82ec1c5618f44dd2e27cc8bfbfda...718ea10b132b3b2eba29c1007bb80653f286566b)

---
updated-dependencies:
- dependency-name: softprops/action-gh-release
  dependency-version: 3.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-06-22 23:23:04 +00:00
Akhil Mohan 3c37ceee46 update go to 1.26.4 
go1.26.4 includes security fixes to the crypto/x509, mime, and
net/textproto packages, as well as bug fixes to the compiler, the
runtime, the go fix command, and the crypto/fips140 package

Signed-off-by: Akhil Mohan <akhilerm@gmail.com>
 2026-06-11 20:37:57 +05:30
Akihiro Suda f58cda1274 Merge pull request #13555 from containerd/dependabot/github_actions/github/codeql-action-4.36.2 
build(deps): bump github/codeql-action from 4.36.0 to 4.36.2
 2026-06-11 23:22:47 +09:00
Samuel Karp 2454191ea6 Merge pull request #13562 from chrishenzie/fix-erofs-dmverity-tests 
Configure udevd children-max for root-test
 2026-06-10 02:32:14 +00:00