dilim/containerd
1
0 Fork 0
mirror of https://github.com/containerd/containerd.git synced 2026-11-06 21:37:23 +00:00
Code Issues Packages Projects Releases Wiki Activity
14,465 Commits 31 Branches 333 Tags
api/v1.8.0
Commit Graph
174 Commits
Author SHA1 Message Date
Sebastiaan van Stijn 4594f5cac1 services/snapshots: include name of snapshotter in debug logs 
- combine consecutive "WithField" calls to "WithFields", as multiple
  calls is known to be expensive.
- include a "snapshotter" field in logs to allow correlating actions
  with specific snapshotters.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2024-10-31 18:00:38 +01:00
Tonis Tiigi 3cc2343de0 local: avoid writing to content root on readonly store 
A contentstore can be created on top of readonly path and
should not fail unless there is an attempt to write into it.

Currently this fails because new ingest directory is created
always, meaning for example that you can't create a store to
read blobs from OCI layout without it contaminating the OCI
layout files.

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2024-10-24 18:03:09 -07:00
Derek McGowan 8c98e18a91 Merge pull request #10867 from namespacelabs/main 
Lock store writer per digest and writer.
 2024-10-24 13:55:07 +00:00
Niklas Gehlen 2535b187a6 Scope writer locks to each writer. 
Signed-off-by: Niklas Gehlen <niklas@namespacelabs.com>
 2024-10-23 20:40:08 +02:00
Derek McGowan 2f24aa00a5 Update errdefs to 0.3.0 
Uses the new github.com/containerd/errdefs/pkg module which is intended
to hold less stable utility functions separately from the stable
github.com/containerd/errdefs error types.

Includes temporary update to hcsshim until a release is cut there

Signed-off-by: Derek McGowan <derek@mcg.dev>
 2024-10-18 16:04:54 -07:00
Abel Feng fc5086a74d cri: remove sandbox controller from client 
cri will call sandbox controller from the sandboxService, remove the
dependency of client.

Signed-off-by: Abel Feng <fshb1988@gmail.com>
 2024-10-16 17:37:07 +08:00
Abel Feng e4df672ab8 sandbox: add sandbox controller v2 
Signed-off-by: Abel Feng <fshb1988@gmail.com>
 2024-10-16 17:37:05 +08:00
Brian Goff b85909cd4c shim: Move pprof server to plugin 
Makes the pprof server a plugin and also gates by the `shim_tracing`
build tag (like otel is).
With this change, `net/http` is no longer a dependency in the shim.

Signed-off-by: Brian Goff <cpuguy83@gmail.com>
 2024-10-03 00:12:50 +00:00
Brian Goff 64d29ebe5b snapshots: core: Remove dependency on api types 
Core should not have a dependency on API types.
This was causing a transative dependency on grpc when importing the core
snapshots package.

Signed-off-by: Brian Goff <cpuguy83@gmail.com>
 2024-10-02 01:46:19 +00:00
Phil Estes 192679b059 Merge pull request #10659 from djdongjin/remove-duplicated-sandbox-conversion 
Remove duplicated sandbox <-> proto conversion functions
 2024-09-05 14:57:17 +00:00
Jin Dong 3d7955bf78 remove duplicated descriptor from/to proto 
Signed-off-by: Jin Dong <djdongjin95@gmail.com>
 2024-08-31 12:01:33 -07:00
Jin Dong 93d6f0f921 remove duplicated sandbox to proto func 
Signed-off-by: Jin Dong <djdongjin95@gmail.com>
 2024-08-31 11:20:32 -07:00
Jin Dong 9c34005724 reduce ptypes.Empty creation by defining it in as a var 
Signed-off-by: Jin Dong <djdongjin95@gmail.com>
 2024-08-29 17:27:47 -07:00
Derek McGowan 50b06182f8 Register local content plugin from separate package 
Update the local content plugin to register itself in a consistent way
as other plugins. This also allows the separate package to define its
own configuration more cleanly.

Signed-off-by: Derek McGowan <derek@mcg.dev>
 2024-08-22 11:18:30 -07:00
Akhil Mohan ebc47359ea use format string when using printf like commands 
As per https://github.com/golang/go/issues/60529, printf like commands with
non-constant format strings and no args give an error in govet

Signed-off-by: Akhil Mohan <akhilerm@gmail.com>
 2024-08-14 17:04:53 +05:30
Sebastiaan van Stijn 9776047243 migrate to github.com/moby/sys/userns 
Commit 8437c567d8 migrated the use of the
userns package to the github.com/moby/sys/user module.

After further discussion with maintainers, it was decided to move the
userns package to a separate module, as it has no direct relation with
"user" operations (other than having "user" in its name).

This patch migrates our code to use the new module.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2024-08-08 12:48:54 +02:00
ningmingxiao 0e4f2108b5 support to syncfs after pull by using diff plugin 
Signed-off-by: ningmingxiao <ning.mingxiao@zte.com.cn>
 2024-08-02 11:47:42 +08:00
Sebastiaan van Stijn 8437c567d8 pkg/userns: deprecate and migrate to github.com/moby/sys/user/userns 
The userns package in libcontainer was integrated into the moby/sys/user
module at commit [3778ae603c706494fd1e2c2faf83b406e38d687d][1].

This patch deprecates the containerd fork of that package, and adds it as
an alias for the moby/sys/user/userns package.

[1]: https://github.com/opencontainers/runc/commit/3778ae603c706494fd1e2c2faf83b406e38d687d

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2024-07-26 09:47:50 +02:00
Samuel Karp 0dcc51aedf introspection: regenerate UUID if state is empty 
The /var/lib/containerd/io.containerd.grpc.v1.introspection/uuid file
stores a UUID to identify the particular containerd daemon responding to
requests.  The file should either exist with a UUID, or not exist.
However, it has been observed that the file can be truncated with 0
bytes, which will then fail to be parsed as a valid UUID.

As a defensive practice, detect a 0-length file and overwrite with a new
UUID rather than failing.

Fixes: https://github.com/containerd/containerd/issues/10491
Signed-off-by: Samuel Karp <samuelkarp@google.com>
 2024-07-25 11:02:54 -07:00
Akhil Mohan 300fd770a0 use typeurl funcs for marshalling anypb.Any 
Signed-off-by: Akhil Mohan <akhilerm@gmail.com>
 2024-07-10 22:26:27 +05:30
Fu Wei 3b2a14bb4c Merge pull request #10407 from dmcgowan/fsverity-internal 
Move fsverity package to internal
 2024-07-01 21:31:55 +00:00
Samuel Karp ebcbbe5643 Merge pull request #10401 from samuelkarp/nri-panic 
cri: ensure NRI API never has nil CRI
 2024-07-01 16:37:46 +00:00
Derek McGowan 23170e20df Move fsverity package to internal 
This functionality is not directly related to containerd and could move
to external package at some point.

Signed-off-by: Derek McGowan <derek@mcg.dev>
 2024-07-01 09:21:24 -07:00
Fu Wei f5f11658c5 Merge pull request #9903 from abel-von/add-update-resource-only 
sandbox: Add Update API for sandbox controller
 2024-07-01 15:16:21 +00:00
Akihiro Suda 7103e381f1 Merge pull request #10007 from Jenkins-J/fsverity-content-verification 
Fsverity content verification
 2024-06-29 06:32:17 +00:00
Samuel Karp 10aec359a0 cri: ensure NRI API never has nil CRI 
A nil CRIImplementation field can cause a nil pointer dereference and
panic during startup recovery.

Prior to this change, the nri.API struct would have a nil cri
(CRIImplementation) field after nri.NewAPI until nri.Register was
called.  Register is called mid-way through initialization of the CRI
plugin, but recovery for containers occurs prior to that.  Container
recovery includes establishing new exit monitors for existing containers
that were discovered.  When a container exits, NRI plugins are given the
opportunity to be notified about the lifecycle event, and this is done
by accessing that CRIImplementation field inside the nri.API.  If a
container exits prior to nri.Register being called, access to the
CRIImplementation field can cause a panic.

Here's the call-path:

* The CRI plugin starts running
  [here](https://github.com/containerd/containerd/blob/ae71819c4f5e67bb4d5ae76a6b735f29cc25774e/pkg/cri/server/service.go#L222)
* It then [calls into](https://github.com/containerd/containerd/blob/ae71819c4f5e67bb4d5ae76a6b735f29cc25774e/pkg/cri/server/service.go#L227)
  `recover()` to recover state from previous runs of containerd
* `recover()` then attempts to recover all containers through
  [`loadContainer()`](https://github.com/containerd/containerd/blob/ae7d74b9e21bd08260586db104a1fe04af754545/internal/cri/server/restart.go#L175)
* When `loadContainer()` finds a container that is still running, it waits
  for the task (internal containerd object) to exit and sets up
  [exit monitoring](https://github.com/containerd/containerd/blob/ae7d74b9e21bd08260586db104a1fe04af754545/internal/cri/server/restart.go#L391)
* Any exit that then happens must be
  [handled](https://github.com/containerd/containerd/blob/ae7d74b9e21bd08260586db104a1fe04af754545/internal/cri/server/events.go#L145)
* Handling an exit includes
  [deleting the Task](https://github.com/containerd/containerd/blob/ae7d74b9e21bd08260586db104a1fe04af754545/internal/cri/server/events.go#L188)
  and specifying [`nri.WithContainerExit`](https://github.com/containerd/containerd/blob/ae7d74b9e21bd08260586db104a1fe04af754545/internal/cri/nri/nri_api_linux.go#L348)
  to [notify](https://github.com/containerd/containerd/blob/ae7d74b9e21bd08260586db104a1fe04af754545/internal/cri/nri/nri_api_linux.go#L356)
  any subscribed NRI plugins
* NRI plugins need to know information about the pod (not just the sandbox),
  so before a plugin is notified the NRI API package
  [queries the Sandbox Store](https://github.com/containerd/containerd/blob/ae7d74b9e21bd08260586db104a1fe04af754545/internal/cri/nri/nri_api_linux.go#L232)
  through the CRI implementation
* The `cri` implementation member field in the `nri.API` struct is set as part of the
  [`Register()`](https://github.com/containerd/containerd/blob/ae7d74b9e21bd08260586db104a1fe04af754545/internal/cri/nri/nri_api_linux.go#L66) method
* The `nri.Register()` method is only called
  [much further down in the CRI `Run()` method](https://github.com/containerd/containerd/blob/ae71819c4f5e67bb4d5ae76a6b735f29cc25774e/pkg/cri/server/service.go#L279)

Signed-off-by: Samuel Karp <samuelkarp@google.com>
 2024-06-28 15:32:11 -07:00
James Jenkins ef98c71985 Implement fsverity functionality 
Implement calls to the fsverity kernel module, allowing containerd to
enable fsverity on blob data in the content store. This causes fsverity
to veirfy the integrity of blob data when the blob is read.

Signed-off-by: James Jenkins <James.Jenkins@ibm.com>
 2024-06-28 09:50:44 -04:00
Akhil Mohan 624aa49d4b increase xfs base image size to 300Mb 
from xfsprogs 5.19.0, minimum size of xfs volume has to be 300MB

Ref: https://git.kernel.org/pub/scm/fs/xfs/xfsprogs-dev.git/commit/?id=6e0ed3d19c54603f0f7d628ea04b550151d8a262
Signed-off-by: Akhil Mohan <akhilerm@gmail.com>
 2024-06-19 00:07:27 +05:30
Abel Feng 15887d7efc sandbox: add update api for controller 
Signed-off-by: Abel Feng <fshb1988@gmail.com>
 2024-06-14 02:31:51 +00:00
Derek McGowan 5d6a94a54c Merge pull request #10243 from dmcgowan/update-shim-manager-config 
Cleanup shim manager configuration
 2024-06-03 17:22:36 +00:00
Maksym Pavlenko 6383a1ce76 Merge pull request #10258 from bzsuni/bz/update/pause 
update pause image to 3.10
 2024-05-28 18:01:23 +00:00
Sebastiaan van Stijn 446e63579c remove uses of platforms.Platform alias 
Commit 3c8469a782 removed uses of the api
types.Platform type from public interfaces, instead using the type from
the OCI image spec.

For convenience, it also introduced an alias in the platforms package.
While this alias allows packages that already import containerd's
platforms package (now a separate module), it may also cause confusion
(it's not clear that it's an alias for the OCI type), and for packages
that do not depend on containerd's platforms package / module may now
be resulting in an extra dependency.

Let's remove the use of this alias, and instead use the OCI type directly.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2024-05-28 14:56:30 +02:00
bzsuni 22f2af40c0 update pause image to 3.10 
Signed-off-by: bzsuni <bingzhe.sun@daocloud.io>
 2024-05-25 08:17:46 +08:00
Derek McGowan ca59fb0b41 Cleanup shim manager configuration 
Keep platforms configuration on task manager and add environment config
for shims.

Signed-off-by: Derek McGowan <derek@mcg.dev>
 2024-05-22 11:06:53 -07:00
Fu Wei 857dc6f89e Merge pull request #10162 from dmcgowan/cleanup-local-transfer 
Cleanup local transfer interface
 2024-05-03 10:40:46 +00:00
Derek McGowan fe01cad201 Cleanup local transfer interface 
Signed-off-by: Derek McGowan <derek@mcg.dev>
 2024-05-02 15:45:49 -07:00
Derek McGowan 2ac2b9c909 Make api a Go sub-module 
Allow the api to stay at the same v1 go package name and keep using a
1.x version number. This indicates the API is still at 1.x and allows
sharing proto types with containerd 1.6 and 1.7 releases.

Signed-off-by: Derek McGowan <derek@mcg.dev>
 2024-05-02 11:03:00 -07:00
Derek McGowan e1b94c0e7d Move protobuf package under pkg 
Signed-off-by: Derek McGowan <derek@mcg.dev>
 2024-05-02 10:52:03 -07:00
Derek McGowan 4a45507772 Move runc options to api directory 
Signed-off-by: Derek McGowan <derek@mcg.dev>
 2024-05-02 10:52:00 -07:00
Fu Wei a91b05d99c Merge pull request #9736 from abel-von/sandbox-task-0201 
sandbox: Store bootstrap parameters in sandbox metadata and shim get them from sandbox metadata rather than other shim's bootstrap.json file.
 2024-05-02 15:35:29 +00:00
Maksym Pavlenko 2ec82c4703 Merge pull request #10128 from xinyangge-db/lockless_sync 
Perform file sync outside of lock on Commit
 2024-05-01 21:46:43 +00:00
Abel Feng de38490ed6 sandbox: merge address and protocol to one url 
Signed-off-by: Abel Feng <fshb1988@gmail.com>
 2024-04-30 15:28:00 +08:00
Abel Feng c3b306240e add task api endpoint in task create options 
Signed-off-by: Abel Feng <fshb1988@gmail.com>
 2024-04-30 15:22:44 +08:00
Abel Feng b1fefccc78 sandbox: store endpoint in cri sandboxStore 
Signed-off-by: Abel Feng <fshb1988@gmail.com>
 2024-04-30 15:20:03 +08:00
Maksym Pavlenko 7feb1f327d Merge pull request #9853 from abel-von/make-shim-independent 
sandbox: make an independent shim plugin
 2024-04-29 21:07:21 +00:00
Sebastiaan van Stijn 8a8c3e2215 pkg/cri/server/base: log CRI config as embedded JSON 
Use the JSON-encoded representation of the config used, which allows
users to reconstruct a (valid) config file from the logs, which may be
more useful for debugging purposes than the internal (Go) representation.

Before this:

    INFO[2023-12-07T15:33:39.914626385Z] starting cri plugin                           config="{PluginConfig:{ContainerdConfig:{Snapshotter:overlayfs DefaultRuntimeName:runc Runtimes:map[runc:{Type:io.containerd.runc.v2 Path: PodAnnotations:[] ContainerAnnotations:[] Options:map[BinaryName: CriuImagePath: CriuWorkPath: IoGid:0 IoUid:0 NoNewKeyring:false Root: ShimCgroup:] PrivilegedWithoutHostDevices:false PrivilegedWithoutHostDevicesAllDevicesAllowed:false BaseRuntimeSpec: NetworkPluginConfDir: NetworkPluginMaxConfNum:0 Snapshotter: Sandboxer:podsandbox}] DisableSnapshotAnnotations:true DiscardUnpackedLayers:false IgnoreBlockIONotEnabledErrors:false IgnoreRdtNotEnabledErrors:false} CniConfig:{NetworkPluginBinDir:/opt/cni/bin NetworkPluginConfDir:/etc/cni/net.d NetworkPluginMaxConfNum:1 NetworkPluginSetupSerially:false NetworkPluginConfTemplate: IPPreference:} Registry:{ConfigPath: Mirrors:map[] Configs:map[] Auths:map[] Headers:map[]} ImageDecryption:{KeyModel:node} DisableTCPService:true StreamServerAddress:127.0.0.1 StreamServerPort:0 StreamIdleTimeout:4h0m0s EnableSelinux:false SelinuxCategoryRange:1024 SandboxImage:registry.k8s.io/pause:3.9 StatsCollectPeriod:10 EnableTLSStreaming:false X509KeyPairStreaming:{TLSCertFile: TLSKeyFile:} MaxContainerLogLineSize:16384 DisableCgroup:false DisableApparmor:false RestrictOOMScoreAdj:false MaxConcurrentDownloads:3 DisableProcMount:false UnsetSeccompProfile: TolerateMissingHugetlbController:true DisableHugetlbController:true DeviceOwnershipFromSecurityContext:false IgnoreImageDefinedVolumes:false NetNSMountsUnderStateDir:false EnableUnprivilegedPorts:true EnableUnprivilegedICMP:true EnableCDI:false CDISpecDirs:[/etc/cdi /var/run/cdi] ImagePullProgressTimeout:5m0s DrainExecSyncIOTimeout:0s} ContainerdRootDir:/var/lib/docker/containerd/daemon ContainerdEndpoint:/var/run/docker/containerd/containerd.sock RootDir:/var/lib/docker/containerd/daemon/io.containerd.grpc.v1.cri StateDir:/var/run/docker/containerd/daemon/io.containerd.grpc.v1.cri}"

After this:

    INFO[2023-12-07T15:27:15.862946138Z] starting cri plugin                           config="{\"containerd\":{\"snapshotter\":\"overlayfs\",\"defaultRuntimeName\":\"runc\",\"runtimes\":{\"runc\":{\"runtimeType\":\"io.containerd.runc.v2\",\"runtimePath\":\"\",\"PodAnnotations\":null,\"ContainerAnnotations\":null,\"options\":{\"BinaryName\":\"\",\"CriuImagePath\":\"\",\"CriuWorkPath\":\"\",\"IoGid\":0,\"IoUid\":0,\"NoNewKeyring\":false,\"Root\":\"\",\"ShimCgroup\":\"\"},\"privileged_without_host_devices\":false,\"privileged_without_host_devices_all_devices_allowed\":false,\"baseRuntimeSpec\":\"\",\"cniConfDir\":\"\",\"cniMaxConfNum\":0,\"snapshotter\":\"\",\"sandboxer\":\"podsandbox\"}},\"disableSnapshotAnnotations\":true,\"discardUnpackedLayers\":false,\"ignoreBlockIONotEnabledErrors\":false,\"ignoreRdtNotEnabledErrors\":false},\"cni\":{\"binDir\":\"/opt/cni/bin\",\"confDir\":\"/etc/cni/net.d\",\"maxConfNum\":1,\"setupSerially\":false,\"confTemplate\":\"\",\"ipPref\":\"\"},\"registry\":{\"configPath\":\"\",\"mirrors\":null,\"configs\":null,\"auths\":null,\"headers\":null},\"imageDecryption\":{\"keyModel\":\"node\"},\"disableTCPService\":true,\"streamServerAddress\":\"127.0.0.1\",\"streamServerPort\":\"0\",\"streamIdleTimeout\":\"4h0m0s\",\"enableSelinux\":false,\"selinuxCategoryRange\":1024,\"sandboxImage\":\"registry.k8s.io/pause:3.9\",\"statsCollectPeriod\":10,\"enableTLSStreaming\":false,\"x509KeyPairStreaming\":{\"tlsCertFile\":\"\",\"tlsKeyFile\":\"\"},\"maxContainerLogSize\":16384,\"disableCgroup\":false,\"disableApparmor\":false,\"restrictOOMScoreAdj\":false,\"maxConcurrentDownloads\":3,\"disableProcMount\":false,\"unsetSeccompProfile\":\"\",\"tolerateMissingHugetlbController\":true,\"disableHugetlbController\":true,\"device_ownership_from_security_context\":false,\"ignoreImageDefinedVolumes\":false,\"netnsMountsUnderStateDir\":false,\"enableUnprivilegedPorts\":true,\"enableUnprivilegedICMP\":true,\"enableCDI\":false,\"cdiSpecDirs\":[\"/etc/cdi\",\"/var/run/cdi\"],\"imagePullProgressTimeout\":\"5m0s\",\"drainExecSyncIOTimeout\":\"0s\",\"containerdRootDir\":\"/var/lib/docker/containerd/daemon\",\"containerdEndpoint\":\"/var/run/docker/containerd/containerd.sock\",\"rootDir\":\"/var/lib/docker/containerd/daemon/io.containerd.grpc.v1.cri\",\"stateDir\":\"/var/run/docker/containerd/daemon/io.containerd.grpc.v1.cri\"}"

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2024-04-29 13:10:54 +02:00
Sebastiaan van Stijn f62edda5a2 pkg/cri/server/base: use structured log for CRI plugin startup 
Log the config as a field instead of as part of the log message.

Before this:

    INFO[2023-12-07T14:58:43.515360429Z] loading plugin                                id=io.containerd.tracing.processor.v1.otlp type=io.containerd.tracing.processor.v1
    INFO[2023-12-07T14:58:43.515787512Z] loading plugin                                id=io.containerd.internal.v1.tracing type=io.containerd.internal.v1
    INFO[2023-12-07T14:58:43.515974429Z] loading plugin                                id=io.containerd.internal.v1.cri type=io.containerd.internal.v1
    INFO[2023-12-07T14:58:43.516037887Z] Start cri plugin with config {PluginConfig:{ContainerdConfig:{Snapshotter:overlayfs DefaultRuntimeName:runc Runtimes:map[runc:{Type:io.containerd.runc.v2 Path: PodAnnotations:[] ContainerAnnotations:[] Options:map[BinaryName: CriuImagePath: CriuWorkPath: IoGid:0 IoUid:0 NoNewKeyring:false Root: ShimCgroup:] PrivilegedWithoutHostDevices:false PrivilegedWithoutHostDevicesAllDevicesAllowed:false BaseRuntimeSpec: NetworkPluginConfDir: NetworkPluginMaxConfNum:0 Snapshotter: Sandboxer:podsandbox}] DisableSnapshotAnnotations:true DiscardUnpackedLayers:false IgnoreBlockIONotEnabledErrors:false IgnoreRdtNotEnabledErrors:false} CniConfig:{NetworkPluginBinDir:/opt/cni/bin NetworkPluginConfDir:/etc/cni/net.d NetworkPluginMaxConfNum:1 NetworkPluginSetupSerially:false NetworkPluginConfTemplate: IPPreference:} Registry:{ConfigPath: Mirrors:map[] Configs:map[] Auths:map[] Headers:map[]} ImageDecryption:{KeyModel:node} DisableTCPService:true StreamServerAddress:127.0.0.1 StreamServerPort:0 StreamIdleTimeout:4h0m0s EnableSelinux:false SelinuxCategoryRange:1024 SandboxImage:registry.k8s.io/pause:3.9 StatsCollectPeriod:10 EnableTLSStreaming:false X509KeyPairStreaming:{TLSCertFile: TLSKeyFile:} MaxContainerLogLineSize:16384 DisableCgroup:false DisableApparmor:false RestrictOOMScoreAdj:false MaxConcurrentDownloads:3 DisableProcMount:false UnsetSeccompProfile: TolerateMissingHugetlbController:true DisableHugetlbController:true DeviceOwnershipFromSecurityContext:false IgnoreImageDefinedVolumes:false NetNSMountsUnderStateDir:false EnableUnprivilegedPorts:true EnableUnprivilegedICMP:true EnableCDI:false CDISpecDirs:[/etc/cdi /var/run/cdi] ImagePullProgressTimeout:5m0s DrainExecSyncIOTimeout:0s} ContainerdRootDir:/var/lib/docker/containerd/daemon ContainerdEndpoint:/var/run/docker/containerd/containerd.sock RootDir:/var/lib/docker/containerd/daemon/io.containerd.grpc.v1.cri StateDir:/var/run/docker/containerd/daemon/io.containerd.grpc.v1.cri}

After this:

    INFO[2023-12-07T15:33:39.914112719Z] loading plugin                                id=io.containerd.tracing.processor.v1.otlp type=io.containerd.tracing.processor.v1
    INFO[2023-12-07T15:33:39.914526135Z] loading plugin                                id=io.containerd.internal.v1.tracing type=io.containerd.internal.v1
    INFO[2023-12-07T15:33:39.914580427Z] loading plugin                                id=io.containerd.internal.v1.cri type=io.containerd.internal.v1
    INFO[2023-12-07T15:33:39.914626385Z] starting cri plugin                           config="{PluginConfig:{ContainerdConfig:{Snapshotter:overlayfs DefaultRuntimeName:runc Runtimes:map[runc:{Type:io.containerd.runc.v2 Path: PodAnnotations:[] ContainerAnnotations:[] Options:map[BinaryName: CriuImagePath: CriuWorkPath: IoGid:0 IoUid:0 NoNewKeyring:false Root: ShimCgroup:] PrivilegedWithoutHostDevices:false PrivilegedWithoutHostDevicesAllDevicesAllowed:false BaseRuntimeSpec: NetworkPluginConfDir: NetworkPluginMaxConfNum:0 Snapshotter: Sandboxer:podsandbox}] DisableSnapshotAnnotations:true DiscardUnpackedLayers:false IgnoreBlockIONotEnabledErrors:false IgnoreRdtNotEnabledErrors:false} CniConfig:{NetworkPluginBinDir:/opt/cni/bin NetworkPluginConfDir:/etc/cni/net.d NetworkPluginMaxConfNum:1 NetworkPluginSetupSerially:false NetworkPluginConfTemplate: IPPreference:} Registry:{ConfigPath: Mirrors:map[] Configs:map[] Auths:map[] Headers:map[]} ImageDecryption:{KeyModel:node} DisableTCPService:true StreamServerAddress:127.0.0.1 StreamServerPort:0 StreamIdleTimeout:4h0m0s EnableSelinux:false SelinuxCategoryRange:1024 SandboxImage:registry.k8s.io/pause:3.9 StatsCollectPeriod:10 EnableTLSStreaming:false X509KeyPairStreaming:{TLSCertFile: TLSKeyFile:} MaxContainerLogLineSize:16384 DisableCgroup:false DisableApparmor:false RestrictOOMScoreAdj:false MaxConcurrentDownloads:3 DisableProcMount:false UnsetSeccompProfile: TolerateMissingHugetlbController:true DisableHugetlbController:true DeviceOwnershipFromSecurityContext:false IgnoreImageDefinedVolumes:false NetNSMountsUnderStateDir:false EnableUnprivilegedPorts:true EnableUnprivilegedICMP:true EnableCDI:false CDISpecDirs:[/etc/cdi /var/run/cdi] ImagePullProgressTimeout:5m0s DrainExecSyncIOTimeout:0s} ContainerdRootDir:/var/lib/docker/containerd/daemon ContainerdEndpoint:/var/run/docker/containerd/containerd.sock RootDir:/var/lib/docker/containerd/daemon/io.containerd.grpc.v1.cri StateDir:/var/run/docker/containerd/daemon/io.containerd.grpc.v1.cri}"

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2024-04-29 13:10:51 +02:00
Xinyang Ge 4167416754 Perform file sync outside of lock on Commit 
Signed-off-by: Xinyang Ge <xinyang.ge@databricks.com>
 2024-04-26 05:42:01 -07:00
Abel Feng a12acedfad sandbox: make a independent shim plugin 
Signed-off-by: Abel Feng <fshb1988@gmail.com>
 2024-04-24 14:27:20 +08:00
Shuaiyi Zhang e461a59ae6 fix migrateConfig for io.containerd.cri.v1.images 
Signed-off-by: Shuaiyi Zhang <zhang_syi@qq.com>
 2024-04-23 12:59:50 +00:00