[pull] main from containerd:main - #58
Open
pull[bot] wants to merge 106 commits into
Open
Conversation
According to the OCI distribution spec registries may include informational warnings in HTTP Warning headers: - https://github.com/opencontainers/distribution-spec/blob/e612a6e1e1bc717f9fa7e1feb4f05c8b6568754a/spec.md#warnings - https://www.rfc-editor.org/rfc/rfc7234#section-5.5 This change implements support for handling these warnings and propagating them to the resolver. This patch adds a new, optional WarningHandler interface field to ResolverOptions that allows callers to receive and process warnings sent by registries via HTTP Warning headers with warn-code 299. Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Switch away from deprecated functionality. Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
Drop internal/cri/seutil/seutil.go in favor of direct call to newly introduced selinux.SetProcessKind. Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
Bumps the codeql-actions group with 3 updates: [github/codeql-action/init](https://github.com/github/codeql-action), [github/codeql-action/analyze](https://github.com/github/codeql-action) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action). Updates `github/codeql-action/init` from 4.37.2 to 4.37.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@e064762...e4fba86) Updates `github/codeql-action/analyze` from 4.37.2 to 4.37.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@e064762...e4fba86) Updates `github/codeql-action/upload-sarif` from 4.37.2 to 4.37.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@e064762...e4fba86) --- updated-dependencies: - dependency-name: github/codeql-action/init dependency-version: 4.37.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: codeql-actions - dependency-name: github/codeql-action/analyze dependency-version: 4.37.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: codeql-actions - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.37.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: codeql-actions ... Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Derek McGowan <derek@mcg.dev>
The layer content cache was a single directory, so every source of pre-converted blobs had to be merged into one tree. A shared read-only fleet cache, a host-local cache, and a per-image warm cache could not coexist. Replace layer_content_cache with layer_content_caches, a list. Each directory is checked in order and the first hit is staged into the snapshot; a layer found in none of them falls back to the normal download-and-convert path. Cache directories are no longer required to exist at startup. A missing one is indistinguishable from an empty one at lookup time (both are simply a miss), and it may well be mounted after the daemon starts, so the only check left is that each path is absolute -- a relative one would be symlinked into the snapshot dir and dangle. Signed-off-by: Maksym Pavlenko <pavlenko.maksym@gmail.com>
The container_start_time_seconds metric was reporting nanoseconds instead of Unix seconds. The CRI container status stores StartedAt as nanoseconds (per the CRI API spec), but the metric name and help text indicate seconds. Convert by dividing by time.Second. Signed-off-by: Damien Grisonnet <dgrisonn@redhat.com>
Prepare release notes for api/v1.12.0-beta.0
Signed-off-by: Derek McGowan <derek@mcg.dev>
…odeql-actions-6947902d1c build(deps): bump the codeql-actions group with 3 updates
Update api version to v1.12.0-beta.0
erofs: allow multiple cache directories
When a layer fails to prepare during parallel unpack we break out of the launch loop but never return the error, so unpack() can report success and label the image with a chainID that was never created. Keep the error and return it once the already queued layers have been drained, so those still commit as they would in sequential mode. Also end the layer's tracing span, which leaked on this path. Signed-off-by: Maksym Pavlenko <pavlenko.maksym@gmail.com>
bump selinux to v1.15.1, use SetProcessKind
remotes/docker: Propagate registry warnings to the resolver
cri: fix container_start_time_seconds unit conversion
unpack: don't drop topHalf errors in parallel mode
The direct use was two lines in `internal/cri/nri/nri_api_linux.go` -- constructing a `generate.Generator{Config: spec}` solely to satisfy the `nrigen.UnderlyingGenerator` interface defined in `containerd/nri`. Since that interface already exists, we just need an implementation. Add `spec_generator.go` in the same package, implementing `UnderlyingGenerator` directly on `*rspec.Spec` with no external dependencies beyond `runtime-spec`.
Assisted-By: "claude my eyes right out"
Signed-off-by: Tianon Gravi <tianon.gravi@docker.com>
Signed-off-by: Cindy Li <xinhuil@netflix.com>
Describe layer_content_caches: what it replaces (a mkfs.erofs run per layer on every node), how a hit is served, how multiple directories are searched, and how to build a cache with ctr images build-erofs-cache. Call out that the cached blob is symlinked rather than copied, so entries have to outlive the snapshots referencing them, and that fsverity and IMMUTABLE_FL can't be used alongside a cache. Signed-off-by: Maksym Pavlenko <pavlenko.maksym@gmail.com>
Wrap the four long paragraphs at 80 columns to match the rest of the file. No text changes. Signed-off-by: Maksym Pavlenko <pavlenko.maksym@gmail.com>
docs: update erofs docs
Signed-off-by: HirazawaUi <695097494plus@gmail.com>
When a shim delete hits a timeout, currently the error message does not indicate that the delete was killed rather than failed to complete. Signed-off-by: Derek McGowan <derek@mcg.dev>
…tNetwork Set the default of runtimeFeatures.UserNamespacesHostNetwork to true
Remove dependency on `github.com/opencontainers/runtime-tools`
Signed-off-by: Krisztian Litkey <krisztian.litkey@intel.com>
Add more context to the shim delete error
…b.com/klauspost/compress-1.19.2 build(deps): bump github.com/klauspost/compress from 1.19.1 to 1.19.2
Signed-off-by: Mike Brown <brownwm@us.ibm.com>
full diff: stretchr/testify@v1.11.1...v1.12.1 Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
script/setup: update critools to v1.36.0
shim: use PublisherOpts when creating new publisher
…-check Revert "add check on version of drop in configs"
pkg/oci: resolve rootfs symlinks for user lookup
Most of this package is unused, except for the ExtractPodBandwidthResources utility. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
internal/cri/bandwidth: remove dead code
stdlib can now handle this, without the need of the fakeclock utility. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- Fix WS2022 compat on hosts past the latest LTSC full diff: containerd/platforms@v1.0.0-rc.4...v1.0.0-rc.5 Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
pkg/shim: Report bootstrap API mismatch on startup
internal/cri/server/events: use testing/synctest
vendor: github.com/stretchr/testify v1.12.1
vendor: github.com/containerd/platforms v1.0.0-rc.5
Notable changes: - Add bidirectional `log/slog` integration with a Logrus hook and `slog.Handler`. - Add minimal, composable logging interfaces for individual log levels. - Fix reentrant logging deadlocks and improve concurrency safety around formatters, hooks, and entries. - Fix generic `Log`, `Logf`, `Logln`, and `LogFn` methods unexpectedly panicking at `PanicLevel`. - Allow `Entry.Caller` to be set explicitly and preserved across derived entries. - Improve `TextFormatter` performance and reduce allocations significantly. - Improve common Logger and Entry hot paths and caller-reporting performance. - Update `TextFormatter` handling for `[]byte`, debug/trace colors, and Windows ANSI terminals. - Raise the minimum supported Go version to Go 1.23. - Deprecate `Entry.HasCaller` and `MutexWrap`. release-notes: https://github.com/sirupsen/logrus/releases/tag/v1.10.0 full diff: sirupsen/logrus@v1.9.4...v1.10.0 Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
vendor: github.com/sirupsen/logrus v1.10.1
k8s.io/utils/exec.CodeExitError was the only remaining direct use of k8s.io/utils. Replace it with a local error type implementing the same interface. The streaming server uses this interface to distinguish commands terminating with a non-zero exit status from errors executing the command, and to propagate the exit status to the client. Add a FIXME to define this error contract in k8s.io/cri-streaming, where it is consumed, instead of requiring runtime implementations to implicitly match k8s.io/utils/exec.ExitError. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
internal/cri/server: remove remaining uses of k8s.io/utils
…ctions/attest-build-provenance-4.2.2 build(deps): bump actions/attest-build-provenance from 4.1.1 to 4.2.2
update to current main to remove some transitive dependencies Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Signed-off-by: Maksym Pavlenko <pavlenko.maksym@gmail.com>
Bumps the moby-sys group with 1 update: [github.com/moby/sys/userns](https://github.com/moby/sys). Updates `github.com/moby/sys/userns` from 0.1.0 to 0.2.0 - [Release notes](https://github.com/moby/sys/releases) - [Commits](moby/sys@user/v0.1.0...user/v0.2.0) --- updated-dependencies: - dependency-name: github.com/moby/sys/userns dependency-version: 0.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: moby-sys ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [github.com/checkpoint-restore/checkpointctl](https://github.com/checkpoint-restore/checkpointctl) from 1.5.0 to 1.6.0. - [Release notes](https://github.com/checkpoint-restore/checkpointctl/releases) - [Commits](checkpoint-restore/checkpointctl@v1.5.0...v1.6.0) --- updated-dependencies: - dependency-name: github.com/checkpoint-restore/checkpointctl dependency-version: 1.6.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
vendor: tags.cncf.io/container-device-interface 05ae4b5bb730
Bumps the k8s group with 2 updates in the / directory: [k8s.io/cri-api](https://github.com/kubernetes/cri-api) and [k8s.io/streaming](https://github.com/kubernetes/streaming). Updates `k8s.io/cri-api` from 0.36.3 to 0.36.4 - [Commits](kubernetes/cri-api@v0.36.3...v0.36.4) Updates `k8s.io/streaming` from 0.36.3 to 0.36.4 - [Commits](kubernetes/streaming@v0.36.3...v0.36.4) --- updated-dependencies: - dependency-name: k8s.io/cri-api dependency-version: 0.36.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: k8s - dependency-name: k8s.io/streaming dependency-version: 0.36.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: k8s ... Signed-off-by: dependabot[bot] <support@github.com>
Bump go-runc to 1.2.0
…7273d1033 build(deps): bump the k8s group across 1 directory with 2 updates
…sys-599fb6b3f3 build(deps): bump github.com/moby/sys/userns from 0.1.0 to 0.2.0 in the moby-sys group
…b.com/checkpoint-restore/checkpointctl-1.6.0 build(deps): bump github.com/checkpoint-restore/checkpointctl from 1.5.0 to 1.6.0
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
19 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot] (v2.0.0-alpha.4)
Can you help keep this open source service alive? 💖 Please sponsor : )