Introduces changes to make pod sandbox updates persistent across
restarts.
This is achieved by:
- Storing the updated Overhead and Resources as an extension on the core
sandbox object and in the in-memory sandbox status store.
- Modifying the sandbox recovery logic to read this extension on startup
(this is not working in recovery unit tests yet and needs fixing).
- Updating the PodSandboxStatus CRI handler to include updated resources
from the sandbox status store.
Signed-off-by: Chris Henzie <chrishenzie@google.com>
The test was validated locally by running 100 pods for 100 rounds without
observing any failures. Due to limited resources in the CI environment,
the test parameters were reduced to 8 pods and 10 rounds.
```bash
FOCUS=TestOOMEventMonitor CGROUP_DRIVER=cgroupfs taskset -c 0,1 make cri-integration | tee /tmp/log
```
Signed-off-by: Wei Fu <fuweid89@gmail.com>
The OOM handling code is intended to live under pkg/oom/v2. However, the
cgroupv2 package still needs further refinement, such as exporting the
cgroup path and allowing callers to query specific stats instead of
returning all of them.
Until that work is complete, introduce the OOM package as experimental
and place it under containerd-shim-runc-v2.
Signed-off-by: Wei Fu <fuweid89@gmail.com>
Error strings should not be capitalized (unless beginning with proper
nouns or acronyms) or end with punctuation, per Go style guide and
staticcheck ST1005.
This change lowercases the first letter of error messages in fmt.Errorf
calls throughout the codebase, while preserving uppercase for acronyms
at the start of error strings (e.g., NRI, RDT, CDI, UID, GID, VHD, FUSE).
Also fixes typo 'faild' -> 'failed' in resolver_test.go.
Changes:
- core/metadata: target.Digest, target.Size, target.MediaType
- core/remotes/docker: fetcher.Seek, fetcherByDigest
- integration: various test error messages
- internal/cri/server: containerConfig
- plugins/snapshots: erofs
Fixes#12011
Signed-off-by: Aadhar Agarwal <aadagarwal@microsoft.com>
- add k8s 1.35 into support matrix
- remove k8s 1.31 as its EOL in Nov 2025
- 2.0 is removed from the supported list as it was EOL when 1.35
released
Co-authored-by: Mike Brown <brownwm@us.ibm.com>
Signed-off-by: Akhil Mohan <akhilerm@gmail.com>
In the CreateSandbox request, which is part of the Sandbox Controller, we ignored the `Annotations` parameter which could have been set by the caller via `WithAnnotations` option.
This commit rectifies the same and adds the Annotations parameter to the request.
Signed-off-by: Harsh Rawat <harshrawat@microsoft.com>
EROFS has supported a tiny metadata-only image to reference external
blobs since Linux 5.16. This eliminates the need to mount each EROFS
layer one by one and is also useful for VM-based containers (e.g.
nerdbox and Kata containers.)
Similar to LCOW/CimFS, `snapshots.UnpackKeyPrefix` is used to
trigger fsmerge generation (typically < 100 ms) on demand in Prepare().
In the future, we can also generate fsmeta in Commit() of the final
unpacking layer (by introducing an annotation to keep the chainID).
However, in the case of intermediate layer reuse, the Prepare() handling
will still be required.
```toml
[plugins."io.containerd.snapshotter.v1.erofs"]
max_unmerged_layers = 1 # enable fsmerge if image layers >= 2
```
Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
The runtimeHandler parameter was added to PullImage() but never used.
Instead, the code relied on an experimental annotation
(io.containerd.cri.runtime-handler) passed in the pod sandbox config.
This annotation was a workaround because CRI's PullImageRequest didn't
include the runtime handler. However, since cri-api v0.29.0, the runtime
handler is available in the API and passed as a parameter to PullImage().
For backward compatibility with CRI clients that don't yet pass the
runtime handler parameter, we fall back to the annotation if the
parameter is empty. The annotation-based fallback is deprecated and
will be removed in containerd 2.5.
Signed-off-by: Wedson Almeida Filho <walmeida@microsoft.com>
Signed-off-by: Fabiano Fidêncio <ffidencio@nvidia.com>
WithCDI currently emits logs at Info level for every container even when
len(Config.CDIDevices) == 0. Move these to Debug level.
Signed-off-by: Samuel Karp <samuelkarp@google.com>
