To make task.Delete retriable, this patch caches the delete result in
memory after the shim successfully deletes the task. If a later shutdown
attempt fails, a subsequent Delete retry can complete cleanup and return the
cached exit information.
If containerd restarts after deleting the task, the in-memory cache is lost,
and containerd will publish TaskExit and TaskDelete events again to
subscribers. Currently, the exit status returned by shim-delete is always
137. In a follow-up, containerd-shim-runc-v2 should store the actual exit
status in the state directory, so that shim-delete can reuse it instead of
returning a hard-coded value.
Implements: #8981
Signed-off-by: Wei Fu <fuweid89@gmail.com>
Send a known trace context with the API call and assert that the
environment of the OCI hook runc executes carries it.
The shim propagates the context only when built with the shim_tracing
tag, so build the Linux integration job with it. The integration target
also has to pass the project build tags to the test compile, like the
other build targets already do.
Signed-off-by: Maksym Pavlenko <pavlenko.maksym@gmail.com>
TaskService.Shutdown may be invoked multiple times. A grouped shim
itself does not terminate while it still has active tasks. It terminates only
after receiving a Shutdown request when no active tasks remain.
The shim manager should invoke TaskService.Shutdown after deleting every task,
regardless of whether the task represents sandbox or not. This ensures that the
shim receives Shutdown when the last active task is deleted.
In CRI, the pause container uses oom_score_adj=-998, making it unlikely to be
OOM-killed. However, it may still exit or be killed before the other containers
in the sandbox. SandboxService.Shutdown and TaskService.Shutdown are independent
APIs. Sandbox service should make sure there is no active containers
before shutdown. So, for the task service, we should invoke Shutdown for
each task.
Removing the supportSandboxAPIVersion check does not change behavior for shims
using task API versions below v3. Those shims were already forced down the
non-sandboxed path and received Shutdown after every task deletion. The behavior
change applies only to sandboxed tasks using task API v3, which now receive
Shutdown after deletion as well.
Signed-off-by: Wei Fu <fuweid89@gmail.com>
Build the image for TestIssue13030 locally using pkg/archive,
instead of pulling the prebuilt ghcr.io/containerd/whiteout-test image.
The image is built by appending layers generated with archive.WriteDiff
on top of the busybox base image, served with the new
testutil.ServeImage helper on a localhost HTTP registry, and pulled
through the regular client.Pull path with WithPullUnpack. This removes
the need to publish the multi-arch whiteout-test image, so the
Dockerfile and Makefile added in PR 13704 are removed along with the
image list entry.
Assisted-by: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
The TestCRIImagePullTimeout test case "NoDataTransferred" flaked under
constrained networks because the test proxy mirror registry used a
blocking ReadAtLeast call to forward bytes to containerd.
This blocking wait (up to 4KB) meant the mirror registry server
completely stopped forwarding data during network slowness, triggering
containerd's aggressive 5-second progress timeout and canceling the
pull before it could reach its 3MB circuit-breaker limit.
This is resolved by changing the proxy's custom copy loop from
io.ReadAtLeast(src, buf, len(buf)) to standard src.Read(buf). This
streams network chunks to containerd immediately as they arrive,
preventing false timeout cancellations while maintaining correct
circuit-breaker byte tracking.
Assisted-by: Antigravity
Signed-off-by: Samuel Karp <samuelkarp@google.com>
In high-load CI environments,
TestFailFastWhenConnectShim/normal-unix-socket-v2 flaked with:
expected error connection refused, but got <nil>
at shim_dial_unix_test.go:134.
Diagnosis:
For normal Unix sockets (filesystem-backed, where
SetUnlinkOnClose(false) is called to keep the socket file), closing
the socket listener does not guarantee that subsequent dials
instantly fail with ECONNREFUSED in the OS kernel. Under high
parallel contention, the kernel-side transition of the socket file
structure to the refusing state is deferred for a brief window.
The test immediately dials the address after close, which
unexpectedly succeeds under load, flaking the test.
Reproduction:
We successfully reproduced the flake inside an almalinux/9 Vagrant VM
(running with nested virtualization inside a GCE VM) under parallel
load, where the test failed exactly on iteration 3 of the integration
suite loop.
Solution:
1. Remove manual listener.Close() and rely entirely on
ttrpcSrv.Shutdown(ctx) to close the listener, preventing double-close
races.
2. Use a 5-second timeout context for Shutdown to prevent CI hangs if a
connection leaks.
3. Implement a robust 2-second polling helper pollECONNREFUSED inside
the test that dials in a 10ms loop (using a 100ms dial timeout to avoid
blocking) until it receives syscall.ECONNREFUSED.
4. Assert require.NoError(t, pollECONNREFUSED(addr)) immediately after
Shutdown to ensure the OS has fully unlinked/closed the socket before
running the main assertions.
Tested:
Verified by executing 15 parallel integration test runs inside the
preserved AlmaLinux 9 Vagrant guest VM. All 15 runs passed
successfully (100% success rate).
Assisted-by: Antigravity
Signed-off-by: Samuel Karp <samuelkarp@google.com>
Switch the CRI integration layer from containerd's forked Kubernetes helpers
and clients to the upstream Kubernetes modules, and finalize the dependency
update to Kubernetes v0.36.0.
Replace the remaining internal helper copies with upstream packages:
- internal/cri/clock -> k8s.io/utils/clock
- internal/cri/executil -> upstream CRI exec helpers
- internal/cri/resourcequantity -> k8s.io/apimachinery/pkg/api/resource
- internal/cri/setutils -> k8s.io/apimachinery/pkg/util/sets
- internal/cri/types/labels.go -> internal/cri/labels
- integration/cri-api/pkg/apis/services.go -> k8s.io/cri-api/pkg/apis/services.go
Adopt the upstream CRI clients directly:
- add k8s.io/cri-client v0.36.0, k8s.io/cri-streaming v0.36.0, and
k8s.io/streaming v0.36.0 as direct dependencies
- promote k8s.io/utils to a direct dependency and pull in
k8s.io/component-base v0.36.0 indirectly
- keep integration/remote as a thin containerd adapter around cri-client,
because the integration tests still need the stream-shaped
GetContainerEvents RPC
Finalize the Kubernetes dependency update from v0.36.0-rc.0 to v0.36.0,
refresh vendor/, and drop the obsolete internal utility copies.
Also fix the protobuf MessageState mutex-copy vet failures exposed by the new
APIs and close the temporary integration CRI clients explicitly.
Signed-off-by: Davanum Srinivas <davanum@gmail.com>
Kernel 6.12.80+ returns 'fsync=volatile' instead of just 'volatile'
in mount options, which breaks containerd's exact string matching
checks.
Fixes this issue by adding support for 'fsync=volatile' in addition
to the existing 'volatile' check in RemoveVolatileOption and
addVolatileOptionOnImageVolumeMount.
Assisted-by: Antigravity
Signed-off-by: Chris Henzie <chrishenzie@gmail.com>
On export, if the image is by-digest without any tag,
set the org.opencontainers.image.ref.name as the full name.
This prevents setting this field with a leading non-alphanum,
which is incorrect OCI grammar. Fixes#10681.
Signed-off-by: Laura Lorenz <lauralorenz@google.com>
Ensure volume-copy-up and volume-ownership publish linux/s390x variants so integration tests can use these images on s390x without architecture-specific skips.
Signed-off-by: Jintao Zhang <zhangjintao9020@gmail.com>
The test image ghcr.io/containerd/volume-copy-up:2.1 does not include
a manifest for s390x, causing the test to fail with:
"no manifest found for platform: not found".
Signed-off-by: Ricardo Branco <rbranco@suse.de>
This change updates the Go version from 1.25.8 to 1.26.0 across the
repository, including CI configurations, build scripts, and development
environments.
It also fixes two linter issues discovered after upgrading the Go version:
- core/snapshots/storage/bolt.go: incorrect printf format for uint64
- plugins/transfer/plugin.go: incorrect printf format for int and unused variable
The golangci-lint version in script/setup/install-dev-tools is also updated to v2.9.0
to match CI.
Signed-off-by: Sergey Kanzhelev <S.Kanzhelev@live.com>
Updates crun version used by integration tests to 1.27 and enables the
test for cgroup mount options in
TestPrivilegedContainerCgroupMountOptions.
Assisted-by: Antigravity
Signed-off-by: Chris Henzie <chrishenzie@gmail.com>
Verifies that running a privileged container does not alter host cgroup
mount options (specifically nsdelegate and memory_recursiveprot).
Creates a privileged sandbox and container, starts it, and compares the
host's /sys/fs/cgroup mount options before and after execution to
guarantee safety.
Signed-off-by: Chris Henzie <chrishenzie@gmail.com>
The `go-cmp` library has issues with Go deadcode elimination:
```
github.com/google/go-cmp/cmp/internal/value.appendTypeName reachable from:
github.com/google/go-cmp/cmp.pathStep.String
type:github.com/google/go-cmp/cmp.pathStep
type:github.com/google/go-cmp/cmp.structField
type:*github.com/google/go-cmp/cmp.structField
type:github.com/google/go-cmp/cmp.StructField
go:itab.github.com/google/go-cmp/cmp.StructField,github.com/google/go-cmp/cmp.PathStep
github.com/google/go-cmp/cmp.Path.String
type:github.com/google/go-cmp/cmp.Path
type:github.com/google/go-cmp/cmp.state
type:*github.com/google/go-cmp/cmp.state
type:func(*github.com/google/go-cmp/cmp.state, reflect.Type, reflect.Value, reflect.Value) github.com/google/go-cmp/cmp.applicableOption
type:github.com/google/go-cmp/cmp.Option
github.com/google/go-cmp/cmp.flattenOptions
github.com/google/go-cmp/cmp.normalizeOption
github.com/google/go-cmp/cmp.FilterValues
github.com/containerd/containerd/v2/pkg/protobuf.init
github.com/containerd/containerd/v2/pkg/protobuf..inittask
go:main.inittasks
```
The `pkg/protobuf` is imported unconditionally is
`github.com/containerd/containerd` Go module is imported via init tasks,
so there is no way e.g. to use containerd client without triggering this
import.
It seems that within containerd itself this function is only used from
tests, so hiding it this way allows to import `containerd/client` while
keeping deadcode elimination.
Signed-off-by: Andrey Smirnov <andrey.smirnov@siderolabs.com>
Mike Brown