Skip the OOMKilled test when running with systemd cgroups, regardless of the
user-provided ginkgo skip list, to avoid this known issue.
```
critest '--ginkgo.skip=should prefer new apparmor field|should support apparmor field|should support deprecated apparmor_profile field|should support unsafe sysctls|should support safe sysctls|should allow privilege escalation when false'
Jan 23 08:55:25 c48dfdc00254 bash[130]: Summarizing 1 Failure:
Jan 23 08:55:25 c48dfdc00254 bash[130]: [FAIL] [k8s.io] Container OOM runtime should output OOMKilled reason [It] should terminate with exitCode 137 and reason OOMKilled
Jan 23 08:55:25 c48dfdc00254 bash[130]:
sigs.k8s.io/cri-tools/pkg/validate/container_linux.go:165
```
REF: https://github.com/containerd/containerd/actions/runs/21280114724/job/61248062856
Signed-off-by: Wei Fu <fuweid89@gmail.com>
Change the mkfs.erofs command logging to Debug level in both
ConvertTarErofs and GenerateTarIndexAndAppendTar. This keeps
Info level quiet as intended per project conventions while
still making the commands visible for debugging.
Signed-off-by: Aadhar Agarwal <aadagarwal@microsoft.com>
buf will generate the protobuf text file which can be used for viewing
all protobuf changes in one file and quickly diffing changes.
Signed-off-by: Derek McGowan <derek@mcg.dev>
The CRI ImageId field was added in kubernetes/kubernetes#123508 to provide a unique image identifier on the node, separate from ImageRef which contains the manifest list digest for multi-arch images.
Previously, ImageId was not populated, leaving it empty in the CRI response. This change populates ImageId with the platform-specific image config digest (stored in container.ImageRef during container creation).
The ImageRef field continues to return the manifest list digest for backwards compatibility.
Signed-off-by: Avinesh Singh <Avinesh.Singh@deshaw.com>
The layer blob immutable flag clearing logic was moved before
storage.Remove() call to ensure that immutable files can be properly
removed even if subsequent operations fail after storage.Remove().
The previous order had storage.Remove() called first, which meant if
any subsequent operations failed, there would be no opportunity to
remove the immutable flag on the layer blob files.
Signed-off-by: jinda.ljd <jinda.ljd@alibaba-inc.com>
PR #12491 fixed credential leaks in containerd logs but the gRPC error
returned to kubelet still contained sensitive information. This was
visible in Kubernetes pod events via `kubectl describe pod`.
The issue was that SanitizeError was called inside the defer block,
but errgrpc.ToGRPC(err) was evaluated before the defer ran, so the
gRPC message contained the original unsanitized error.
Move SanitizeError before the return statement so both the logged
error and the gRPC error are sanitized.
Ref: #5453
Signed-off-by: Aadhar Agarwal <aadagarwal@microsoft.com>
The traditional mount() syscall has a PAGE_SIZE (typically 4KB) limit
for mount options. Use the new mount API (fsopen/fsconfig/fsmount/
move_mount) introduced in Linux 5.2 to bypass this limitation.
Fixed: #12662
Signed-off-by: ChengyuZhu6 <hudson@cyzhu.com>
Use the same approach for appending UUID arguments in GenerateTarIndexAndAppendTar
as done in ConvertTarErofs for consistency between the two modes.
Signed-off-by: Aadhar Agarwal <aadagarwal@microsoft.com>
