The grpc, grpc-tcp, and ttrpc server plugins enumerated their services
through ic.GetByType, which short-circuits on the first plugin whose
Instance() returned an error. A single failed gRPC plugin (e.g. CRI
under rootless, which cannot watch /etc/cni/net.d) therefore prevented
the server plugins from initialising, leaving /run/containerd/containerd.sock
uncreated.
Iterate the plugin set directly and skip plugins that failed to
initialise, restoring the pre-c15ec2485 behaviour where the listener
is still created and only the failed services are missing.
Fixes: c15ec2485 ("Add server plugins for grpc and ttrpc")
Fixes: https://github.com/containerd/containerd/issues/13362
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
Currently the metadata may be generated after a snapshot is committed,
causing a difference in the overlayfs mount that may cause ESTALE errors.
The committed snapshot must be immutable and should always return the
same set of mounts after commit, even if configuration is changed.
This setting may be added back later to be performed before commit,
either as part of the unpack or as a step before commit. This is getting
pulled out from the upcoming release.
Signed-off-by: Derek McGowan <derek@mcg.dev>
When migrating v3 [grpc] config to the v4 server plugin config, only
emit fields that were actually set in the legacy config. This prevents
a sparse imported [grpc] section, such as one only setting
max_send_message_size, from generating address = "" and overwriting the
address migrated from the root config.
Add table-driven coverage for sparse legacy grpc imports, including
address preservation, imported address override, and default address
retention when no imported config specifies address.
Signed-off-by: Wei Fu <fuweid89@gmail.com>
Add metrics for NRI plugin invocations, latency, adjustments, and active
count. Map NRI Metrics adaptation layer to containerd's Prometheus
metrics system via docker/go-metrics for observability.
Categorize plugin invocation errors into `deadline_exceeded`,
`canceled`, and dynamic gRPC status code dimensions to assist
troubleshooting.
Assisted-by: Antigravity
Signed-off-by: Chris Henzie <chrishenzie@gmail.com>
This file is ignored by github.com/containerd/nri/.gitignore, but
required for building. The NRI repo does need to change, but until that
we can force-include the file.
Signed-off-by: Samuel Karp <samuelkarp@google.com>
Update the EROFS snapshotter to pass the dm-verity metadata path
through the `X-containerd.dmverity` mount option. Previously, the
system relied on implicit mode detection; providing the explicit
path allows downstream components (such as Kata Containers mount
handlers) to reliably locate and read `.dmverity` files.
Correspondingly, update the EROFS mount handler to parse and utilize
this explicit metadata path for dm-verity device initialization.
This enables the runtime to retrieve root hashes and other necessary
metadata directly, ensuring robust layer integrity verification.
Signed-off-by: Alex Lyn <alex.lyn@antgroup.com>
We need enhance MetadataPath() with checking the layerBlobPath's
suffix to ensure it doesn't end with .dmverity.
And add a unit test asserting that MetadataPath("...dmverity")
returns the path unchanged to lock in the new behavior.
Signed-off-by: Alex Lyn <alex.lyn@antgroup.com>
