dilim/containerd
1
0 Fork 0
mirror of https://github.com/containerd/containerd.git synced 2026-11-06 13:27:16 +00:00
Code Issues Packages Projects Releases Wiki Activity
17,231 Commits 31 Branches 333 Tags
bb5988d3d1da170491bbb83564976729d85c227e
Commit Graph
25 Commits
Author SHA1 Message Date
Eshaan Mathur 203578e2eb cri,nri: record resolved image name and digest in container metadata 
- Populate the NRI container's Image field from the image identity recorded in the container metadata at creation, so plugins can identify and verify the container's image by digest. The following fields have been added:

- name: The image reference (ex. registry.k8s.io/pause:3.10)
- digest: Digest the image reference resolves to. Based on the image reference, it is a digest of one of:
  - image index
    - OCI: application/vnd.oci.image.index.v1+json
    - Docker: application/vnd.docker.distribution.manifest.list.v2+json
  - manifest
    - OCI: application/vnd.oci.image.manifest.v1+json
    - Docker: application/vnd.docker.distribution.manifest.v2+json
- config_digest: The image configuration digest
  - OCI: application/vnd.oci.image.config.v1+json
  - Docker: application/vnd.docker.container.image.v1+json

Signed-off-by: Eshaan Mathur <eshaanm25@gmail.com>
 2026-08-19 11:24:59 -05:00
Krisztian Litkey bf0111a9cc nri,deprecation: emit warnings for old NRI plugins. 
Signed-off-by: Krisztian Litkey <krisztian.litkey@intel.com>
 2026-08-07 10:39:30 -05:00
Chris Henzie 5e907d7777 Implement NRI metrics adaptation layer 
Add metrics for NRI plugin invocations, latency, adjustments, and active
count. Map NRI Metrics adaptation layer to containerd's Prometheus
metrics system via docker/go-metrics for observability.

Categorize plugin invocation errors into `deadline_exceeded`,
`canceled`, and dynamic gRPC status code dimensions to assist
troubleshooting.

Assisted-by: Antigravity
Signed-off-by: Chris Henzie <chrishenzie@gmail.com>
 2026-04-28 16:04:03 -07:00
Krisztian Litkey b0bd04b046 cri,nri: pass container user (uid, gids) to plugins. 
Signed-off-by: Krisztian Litkey <krisztian.litkey@intel.com>
 2026-01-13 07:59:37 -06:00
Krisztian Litkey cfec4b30a7 cri,nri: pass seccomp policy to plugins. 
Signed-off-by: Krisztian Litkey <krisztian.litkey@intel.com>
 2026-01-12 09:59:58 -06:00
Krisztian Litkey 7b85525cfe cri,nri: pass any POSIX rlimits to plugins. 
Signed-off-by: Krisztian Litkey <krisztian.litkey@intel.com>
 2026-01-11 18:16:50 +02:00
Krisztian Litkey 695c91324a cri,nri: pass extended container status to NRI. 
Pass more complete container status information to NRI, including
exit code, and timestamps for container creation, start, and exit
events.

Signed-off-by: Krisztian Litkey <krisztian.litkey@intel.com>
 2026-01-10 10:50:07 +02:00
Maksym Pavlenko 04366a910a Merge pull request #12767 from klihub/devel/main/nri-input/cdi-devices 
cri,nri: pass injected CDI devices to plugins.
 2026-01-09 23:30:48 +00:00
Derek McGowan 8e2aa0b9e8 Merge pull request #12766 from klihub/devel/main/nri-input/sysctl 
cri,nri: pass linux sysctl to plugins.
 2026-01-09 22:44:41 +00:00
Krisztian Litkey 98a2e88767 cri,nri: pass injected CDI devices to plugins. 
Signed-off-by: Krisztian Litkey <krisztian.litkey@intel.com>
 2026-01-09 15:19:32 -06:00
Krisztian Litkey 250388dcd9 cri,nri: pass linux sysctl to plugins. 
Signed-off-by: Krisztian Litkey <krisztian.litkey@intel.com>
 2026-01-09 14:37:52 +02:00
Chris Henzie ffd3691c92 Implement UpdatePodSandboxResources CRI API handler 
Signed-off-by: Chris Henzie <chrishenzie@google.com>
 2026-01-07 09:44:46 -08:00
Krisztian Litkey 6936558df9 cri,nri: pass any linux security profile to plugins. 
Signed-off-by: Krisztian Litkey <krisztian.litkey@intel.com>
 2025-12-17 15:34:03 +02:00
Krisztian Litkey f202a6989c cri,nri: pass any linux RDT constraints to plugins. 
Signed-off-by: Krisztian Litkey <krisztian.litkey@intel.com>
 2025-12-17 15:34:03 +02:00
Krisztian Litkey eb616d8cab cri,nri: pass any linux net devices to plugins. 
Signed-off-by: Krisztian Litkey <krisztian.litkey@intel.com>
 2025-12-17 15:33:58 +02:00
Krisztian Litkey 239f69aa02 cri,nri: pass any linux scheduler attributes to plugins. 
Signed-off-by: Krisztian Litkey <krisztian.litkey@intel.com>
 2025-12-17 15:33:58 +02:00
Krisztian Litkey 8e143b2eaa cri,nri: pass any linux I/O priority to plugins. 
Signed-off-by: Krisztian Litkey <krisztian.litkey@intel.com>
 2025-12-17 15:33:53 +02:00
Krisztian Litkey cb9fda2e7b nri: add configuration for the default validator. 
Add configuration for the default built-in validator plugin.

Signed-off-by: Krisztian Litkey <krisztian.litkey@intel.com>
 2025-08-20 14:30:09 +03:00
Krisztian Litkey f75323f890 nri: enable otel traces in NRI. 
Set up NRI for producing otel trace spans.

Signed-off-by: Krisztian Litkey <krisztian.litkey@intel.com>
 2025-07-10 21:40:33 +03:00
ningmingxiao 405a952c65 add name in package version 
Signed-off-by: ningmingxiao <ning.mingxiao@zte.com.cn>
 2025-03-10 20:01:20 +08:00
Krisztian Litkey 6a01ad3e16 cri,nri: block NRI plugin sync. during event processing. 
Block the synchronization of registering NRI plugins during
CRI events to avoid the plugin ending up in an inconsistent
starting state after initial sync (missing pods, containers
or missed events for some pods or containers).

Signed-off-by: Krisztian Litkey <krisztian.litkey@intel.com>
 2025-02-13 14:37:20 +02:00
Antonio Ojea bc056a5c60 nri: report pod ips to the nri plugins 
Signed-off-by: Antonio Ojea <aojea@google.com>
 2024-11-01 19:53:04 +00:00
Danny Canter b41bb6df73 Avoid potential reallocs by pre-sizing some slices 
There's a couple spots where we know exactly how large
the destination buffer should be, so pre-size these to
avoid any reallocs to a higher capacity.

Signed-off-by: Danny Canter <danny@dcantah.dev>
 2024-07-19 13:05:49 -07:00
Samuel Karp 10aec359a0 cri: ensure NRI API never has nil CRI 
A nil CRIImplementation field can cause a nil pointer dereference and
panic during startup recovery.

Prior to this change, the nri.API struct would have a nil cri
(CRIImplementation) field after nri.NewAPI until nri.Register was
called.  Register is called mid-way through initialization of the CRI
plugin, but recovery for containers occurs prior to that.  Container
recovery includes establishing new exit monitors for existing containers
that were discovered.  When a container exits, NRI plugins are given the
opportunity to be notified about the lifecycle event, and this is done
by accessing that CRIImplementation field inside the nri.API.  If a
container exits prior to nri.Register being called, access to the
CRIImplementation field can cause a panic.

Here's the call-path:

* The CRI plugin starts running
  [here](https://github.com/containerd/containerd/blob/ae71819c4f5e67bb4d5ae76a6b735f29cc25774e/pkg/cri/server/service.go#L222)
* It then [calls into](https://github.com/containerd/containerd/blob/ae71819c4f5e67bb4d5ae76a6b735f29cc25774e/pkg/cri/server/service.go#L227)
  `recover()` to recover state from previous runs of containerd
* `recover()` then attempts to recover all containers through
  [`loadContainer()`](https://github.com/containerd/containerd/blob/ae7d74b9e21bd08260586db104a1fe04af754545/internal/cri/server/restart.go#L175)
* When `loadContainer()` finds a container that is still running, it waits
  for the task (internal containerd object) to exit and sets up
  [exit monitoring](https://github.com/containerd/containerd/blob/ae7d74b9e21bd08260586db104a1fe04af754545/internal/cri/server/restart.go#L391)
* Any exit that then happens must be
  [handled](https://github.com/containerd/containerd/blob/ae7d74b9e21bd08260586db104a1fe04af754545/internal/cri/server/events.go#L145)
* Handling an exit includes
  [deleting the Task](https://github.com/containerd/containerd/blob/ae7d74b9e21bd08260586db104a1fe04af754545/internal/cri/server/events.go#L188)
  and specifying [`nri.WithContainerExit`](https://github.com/containerd/containerd/blob/ae7d74b9e21bd08260586db104a1fe04af754545/internal/cri/nri/nri_api_linux.go#L348)
  to [notify](https://github.com/containerd/containerd/blob/ae7d74b9e21bd08260586db104a1fe04af754545/internal/cri/nri/nri_api_linux.go#L356)
  any subscribed NRI plugins
* NRI plugins need to know information about the pod (not just the sandbox),
  so before a plugin is notified the NRI API package
  [queries the Sandbox Store](https://github.com/containerd/containerd/blob/ae7d74b9e21bd08260586db104a1fe04af754545/internal/cri/nri/nri_api_linux.go#L232)
  through the CRI implementation
* The `cri` implementation member field in the `nri.API` struct is set as part of the
  [`Register()`](https://github.com/containerd/containerd/blob/ae7d74b9e21bd08260586db104a1fe04af754545/internal/cri/nri/nri_api_linux.go#L66) method
* The `nri.Register()` method is only called
  [much further down in the CRI `Run()` method](https://github.com/containerd/containerd/blob/ae71819c4f5e67bb4d5ae76a6b735f29cc25774e/pkg/cri/server/service.go#L279)

Signed-off-by: Samuel Karp <samuelkarp@google.com>
 2024-06-28 15:32:11 -07:00
Derek McGowan 9128ee0a91 Move nri packages to plugin and internal 
NRI is still newer and mostly used by CRI plugin. Keep the package in
internal to allow for interfaces as the project matures.

Signed-off-by: Derek McGowan <derek@mcg.dev>
 2024-02-29 21:37:36 -08:00