The new server plugin type allows services which have listeners to be
configured as plugins rather than defined directly in the global
configuration. This provides more configuration consistency and allows
containerd to be extended for new types of api handlers.
Signed-off-by: Derek McGowan <derek@mcg.dev>
klog has a long-standing bug where setting -logtostderr=true causes the
-stderrthreshold flag to be silently ignored. All log messages are sent
to stderr regardless of their severity.
klog v2.140.0 introduced two new flags that allow callers to opt into the
correct behavior:
-legacy_stderr_threshold_behavior=false
-stderrthreshold=INFO
Set them in the CRI plugin's setGLogLevel() function, right after
klog.InitFlags() and before any other flag configuration.
Reference: kubernetes/klog#212
Signed-off-by: Pierluigi Lenoci <pierluigi.lenoci@gmail.com>
If no snapshotter is specified and `os.features` contains "erofs",
unpacking should use the EROFS snapshotter and differ.
This enhances the usability of native EROFS container images.
Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
Ensure that the internal tracing plugin is initialized before the
NRI plugin. This ensures that NRI has access to the global
TracerProvider when it initializes its TTRPC interceptors.
Assisted-by: gemini-cli
Signed-off-by: Samuel Karp <samuelkarp@google.com>
move setting the config_path from default image config to plugin init.
only set the default value when both mirrors and config_path are empty,
in all other cases retain the existing behaviour
Co-authored-by: Samuel Karp <samuelkarp@google.com>
Signed-off-by: Akhil Mohan <akhilerm@gmail.com>
Signed-off-by: Samuel Karp <samuelkarp@google.com>
When users configure a snapshotter in the runtime config (e.g.,
`plugins."io.containerd.cri.v1.runtime".containerd.runtimes.kata.snapshotter`),
the CRI image service was not aware of this configuration. This caused
images to be pulled with the default snapshotter instead of the
runtime-specific one, because the image service's runtimePlatforms map
was not populated with these runtime-to-snapshotter mappings.
Let's make sure that during the CRI plugin init, we iterate over all the
configured runtimes, and propagate any snapshotter configuration to the
image service.
The issue was found while working on #12835.
Signed-off-by: Fabiano Fidêncio <ffidencio@nvidia.com>
When the local transfer plugin is instantiated, it loads verifiers
through `ic.GetByType()` which returns ErrPluginNotFound if no plugins
of the given type is available. This would happen if users explicitly
disabled the bindir plugin.
Users may wish to disable that plugin to prevent containerd from
executing arbitrary binaries on the host (e.g. when running rootless).
Currently, the only way to achieve that is to set bindir's param
`bin_dir` to the empty string but that seems more fragile than disabling
the plugin altogether.
The local transfer plugin is already checking if there are no plugins
available, and take action accordingly. Thus, not handling
`ErrPluginNotFound` seems to be an oversight.
Signed-off-by: Albin Kerouanton <albin.kerouanton@docker.com>
When a shim becomes unresponsive (e.g., stopped via SIGSTOP), ttrpc
communication times out with `context deadline exceeded`.
Currently, this error is not properly propagated, causing redundant API
calls and slow container listing by client sides.
Specifically, when executing the API to check the task state, it appears
that the `context deadline exceeded` error via ttrpc is not being handled
within `shimTask.State()` and `getProcessState()`.
As a result, when this error occurs, clients such as nerdctl cannot
recognize this error, and it is thought that the issue described below is
occurring:
- https://github.com/containerd/nerdctl/issues/4720
Therefore, this commit adds error handling to ensure timeouts are properly
handled by client sides.
Signed-off-by: Hayato Kiwata <dev@haytok.jp>
The layer blob immutable flag clearing logic was moved before
storage.Remove() call to ensure that immutable files can be properly
removed even if subsequent operations fail after storage.Remove().
The previous order had storage.Remove() called first, which meant if
any subsequent operations failed, there would be no opportunity to
remove the immutable flag on the layer blob files.
Signed-off-by: jinda.ljd <jinda.ljd@alibaba-inc.com>
The traditional mount() syscall has a PAGE_SIZE (typically 4KB) limit
for mount options. Use the new mount API (fsopen/fsconfig/fsmount/
move_mount) introduced in Linux 5.2 to bypass this limitation.
Fixed: #12662
Signed-off-by: ChengyuZhu6 <hudson@cyzhu.com>
Use the same approach for appending UUID arguments in GenerateTarIndexAndAppendTar
as done in ConvertTarErofs for consistency between the two modes.
Signed-off-by: Aadhar Agarwal <aadagarwal@microsoft.com>
Currently, fs-verity support detection fails on fresh containerd
installations because the content store root directory
(io.containerd.content.v1.content) doesn't exist yet. This directory
is only created when pulling images, causing checker to
always be false on new hosts.
The IsSupported() function attempts to create a temporary directory
within rootPath to test fs-verity support, but fails when rootPath
doesn't exist, returning an error that is silently ignored.
Fix this by ensuring the root directory exists before performing
the fs-verity support check in NewLabeledStore().
Signed-off-by: ningmingxiao <ning.mingxiao@zte.com.cn>
This disables the slow_chown feature (nobody in their right mind
is going to be choosing erofs and want to slowly chown each file),
indicates that we support idmaps if the kernel supports it, and makes
sure to chown the upperdir.
This is more or less exactly how the overlay snapshotter does things,
minus the slow_chown part (which has discussions about dropping
altogether at some point anyways).
Signed-off-by: Andrew Halaney <ahalaney@netflix.com>
In the CreateSandbox request, which is part of the Sandbox Controller, we ignored the `Annotations` parameter which could have been set by the caller via `WithAnnotations` option.
This commit rectifies the same and adds the Annotations parameter to the request.
Signed-off-by: Harsh Rawat <harshrawat@microsoft.com>
EROFS has supported a tiny metadata-only image to reference external
blobs since Linux 5.16. This eliminates the need to mount each EROFS
layer one by one and is also useful for VM-based containers (e.g.
nerdbox and Kata containers.)
Similar to LCOW/CimFS, `snapshots.UnpackKeyPrefix` is used to
trigger fsmerge generation (typically < 100 ms) on demand in Prepare().
In the future, we can also generate fsmeta in Commit() of the final
unpacking layer (by introducing an annotation to keep the chainID).
However, in the case of intermediate layer reuse, the Prepare() handling
will still be required.
```toml
[plugins."io.containerd.snapshotter.v1.erofs"]
max_unmerged_layers = 1 # enable fsmerge if image layers >= 2
```
Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
Use the erofs differ by default on darwin. This could be default for all
Unix platforms but limit the default changes to fix broken cases for backports.
Signed-off-by: Derek McGowan <derek@mcg.dev>
Non-Linux hosts are not expected to be able to directly mount erofs
snapshotters on the host system. Non-Linux hosts should use block mode
by default with a reasonably set default block size.
Signed-off-by: Derek McGowan <derek@mcg.dev>
Use the Linux default rather than the block size from the local macOS
system. The local macOS block size is not relevant as the erofs file
will not be mounted directly on macOS.
Signed-off-by: Derek McGowan <derek@mcg.dev>
- Create /var/lib/containerd with 0o700 (was: 0o711).
- Create config.TempDir with 0o700 (was: 0o711).
- Create /run/containerd/io.containerd.grpc.v1.cri with 0o700 (was: 0o755).
- Create /run/containerd/io.containerd.sandbox.controller.v1.shim with 0o700 (was: 0o711).
- Leave /run/containerd and /run/containerd/io.containerd.runtime.v2.task created with 0o711,
as required by userns-remapped containers.
/run/containerd/io.containerd.runtime.v2.task/<NS>/<ID> is created with:
- 0o700 for non-userns-remapped containers
- 0o710 for userns-remapped containers with the remapped root group as the owner group.
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
