[pull] main from containerd:main - #58
Open
pull[bot] wants to merge 223 commits into
Open
Conversation
When drain_exec_sync_io_timeout is 0 and a child process holds the pipe, drainExecSyncIO blocks forever even after the client disconnects. Add ctx.Done() to the select to allow cancellation, and use a deferred context for Process.Delete cleanup when the original context is already canceled. Signed-off-by: Guannan Wang <wgnbuaa@gmail.com>
According to the OCI distribution spec registries may include informational warnings in HTTP Warning headers: - https://github.com/opencontainers/distribution-spec/blob/e612a6e1e1bc717f9fa7e1feb4f05c8b6568754a/spec.md#warnings - https://www.rfc-editor.org/rfc/rfc7234#section-5.5 This change implements support for handling these warnings and propagating them to the resolver. This patch adds a new, optional WarningHandler interface field to ResolverOptions that allows callers to receive and process warnings sent by registries via HTTP Warning headers with warn-code 299. Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Signed-off-by: Oleh Konko <security@1seal.org>
Switch away from deprecated functionality. Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
Drop internal/cri/seutil/seutil.go in favor of direct call to newly introduced selinux.SetProcessKind. Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
Bumps the codeql-actions group with 3 updates: [github/codeql-action/init](https://github.com/github/codeql-action), [github/codeql-action/analyze](https://github.com/github/codeql-action) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action). Updates `github/codeql-action/init` from 4.37.2 to 4.37.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@e064762...e4fba86) Updates `github/codeql-action/analyze` from 4.37.2 to 4.37.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@e064762...e4fba86) Updates `github/codeql-action/upload-sarif` from 4.37.2 to 4.37.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@e064762...e4fba86) --- updated-dependencies: - dependency-name: github/codeql-action/init dependency-version: 4.37.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: codeql-actions - dependency-name: github/codeql-action/analyze dependency-version: 4.37.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: codeql-actions - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.37.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: codeql-actions ... Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Derek McGowan <derek@mcg.dev>
The layer content cache was a single directory, so every source of pre-converted blobs had to be merged into one tree. A shared read-only fleet cache, a host-local cache, and a per-image warm cache could not coexist. Replace layer_content_cache with layer_content_caches, a list. Each directory is checked in order and the first hit is staged into the snapshot; a layer found in none of them falls back to the normal download-and-convert path. Cache directories are no longer required to exist at startup. A missing one is indistinguishable from an empty one at lookup time (both are simply a miss), and it may well be mounted after the daemon starts, so the only check left is that each path is absolute -- a relative one would be symlinked into the snapshot dir and dangle. Signed-off-by: Maksym Pavlenko <pavlenko.maksym@gmail.com>
The container_start_time_seconds metric was reporting nanoseconds instead of Unix seconds. The CRI container status stores StartedAt as nanoseconds (per the CRI API spec), but the metric name and help text indicate seconds. Convert by dividing by time.Second. Signed-off-by: Damien Grisonnet <dgrisonn@redhat.com>
Prepare release notes for api/v1.12.0-beta.0
Signed-off-by: Derek McGowan <derek@mcg.dev>
…odeql-actions-6947902d1c build(deps): bump the codeql-actions group with 3 updates
Update api version to v1.12.0-beta.0
erofs: allow multiple cache directories
When a layer fails to prepare during parallel unpack we break out of the launch loop but never return the error, so unpack() can report success and label the image with a chainID that was never created. Keep the error and return it once the already queued layers have been drained, so those still commit as they would in sequential mode. Also end the layer's tracing span, which leaked on this path. Signed-off-by: Maksym Pavlenko <pavlenko.maksym@gmail.com>
bump selinux to v1.15.1, use SetProcessKind
remotes/docker: Propagate registry warnings to the resolver
cri: fix container_start_time_seconds unit conversion
unpack: don't drop topHalf errors in parallel mode
The direct use was two lines in `internal/cri/nri/nri_api_linux.go` -- constructing a `generate.Generator{Config: spec}` solely to satisfy the `nrigen.UnderlyingGenerator` interface defined in `containerd/nri`. Since that interface already exists, we just need an implementation. Add `spec_generator.go` in the same package, implementing `UnderlyingGenerator` directly on `*rspec.Spec` with no external dependencies beyond `runtime-spec`.
Assisted-By: "claude my eyes right out"
Signed-off-by: Tianon Gravi <tianon.gravi@docker.com>
Signed-off-by: Cindy Li <xinhuil@netflix.com>
Describe layer_content_caches: what it replaces (a mkfs.erofs run per layer on every node), how a hit is served, how multiple directories are searched, and how to build a cache with ctr images build-erofs-cache. Call out that the cached blob is symlinked rather than copied, so entries have to outlive the snapshots referencing them, and that fsverity and IMMUTABLE_FL can't be used alongside a cache. Signed-off-by: Maksym Pavlenko <pavlenko.maksym@gmail.com>
Wrap the four long paragraphs at 80 columns to match the rest of the file. No text changes. Signed-off-by: Maksym Pavlenko <pavlenko.maksym@gmail.com>
docs: update erofs docs
Signed-off-by: HirazawaUi <695097494plus@gmail.com>
When a shim delete hits a timeout, currently the error message does not indicate that the delete was killed rather than failed to complete. Signed-off-by: Derek McGowan <derek@mcg.dev>
…tNetwork Set the default of runtimeFeatures.UserNamespacesHostNetwork to true
Remove dependency on `github.com/opencontainers/runtime-tools`
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
For Go1.27 support Staticcheck analyzes only the files selected for the current OS. On macOS, unsupported-platform stubs always return errors, so SA4023 mistakes valid shared error checks for constant comparisons. The Linux and Windows implementations can still return nil. Exclude SA4023 only at the affected cross-platform call sites, keeping the check active elsewhere. Also use a single-line pipe wrapper return because Go 1.26 and Go 1.27 gofmt disagree on the multiline indentation. Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Fix data races and a deadlock in the byte stream helpers
runtime: invoke shim.Delete when connection is closed
full diff: golang/crypto@v0.55.0...v0.56.0 We have tagged version v0.56.0 of golang.org/x/crypto in order to address the following security issues: - ssh: prevent DoS on deadlocked established channel Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking. Thanks to Will Mortensen for reporting this issue. This is CVE-2026-56855 and Go issue https://go.dev/issue/81317. - ssh: prevent DoS on deadlocked undecided channel Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection. Thanks to Will Mortensen for reporting this issue. This is CVE-2026-78662 and Go issue https://go.dev/issue/81316. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
gha: Update golangci-lint to v2.13.2
Update Go 1.26.8 and 1.27.1
Signed-off-by: Maksym Pavlenko <pavlenko.maksym@gmail.com>
The UpdateSandboxRequest and UpdateSandboxResponse messages have been present since the Sandbox API was introduced, but no RPC ever used them, and controllerLocal.Update was an unconditional no-op. A shim therefore had no way to learn about an update of the sandbox metadata object, a CRI pod level resource resize for example. Add the missing UpdateSandbox RPC and extend UpdateSandboxRequest with the sandbox object and the updated fieldpaths, mirroring the daemon side ControllerUpdateRequest, which is what Controller.Update carries. The pre-existing resources and annotations fields are kept but marked deprecated, containerd has no input to populate them from. controllerLocal.Update now calls the new RPC. Implementing it is optional: shims that don't support updates answer with a ttrpc Unimplemented error, which maps to errdefs.ErrNotImplemented and is already tolerated by the CRI caller in UpdatePodSandboxResources. next.txtpb additionally picks up unrelated churn, the committed descriptor set does not match what the pinned buf version produces. Signed-off-by: Maksym Pavlenko <pavlenko.maksym@gmail.com>
Signed-off-by: Maksym Pavlenko <pavlenko.maksym@gmail.com>
Signed-off-by: Maksym Pavlenko <pavlenko.maksym@gmail.com>
full diff: cncf-tags/container-device-interface@73444d1...v1.1.1 Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
vendor: bump go-cni v1.1.14 and containernetworking/cni v1.3.1
vendor: tags.cncf.io/container-device-interface v1.1.1
vendor: golang.org/x/crypto v0.56.0
sandbox: wire Controller.Update through to the shim
Bumps [azure/login](https://github.com/azure/login) from 3.0.1 to 3.0.2. - [Release notes](https://github.com/azure/login/releases) - [Commits](Azure/login@f5d393a...7ddb5af) --- updated-dependencies: - dependency-name: azure/login dependency-version: 3.0.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
pkg/tracing: deprecate Logrushook in favor of log/otel.Logrushook
Fixed security issues - cipher/cbc_hmac: don't panic on empty ciphertext - cipher/cbc_hmac: don't panic on invalid key - json: limit stack depth - jwt: reject out-of-range NumericDate values - Check alg against pubkey curve during verify. - Reject malformed Ed25519 JWKs - jws: choose verification key per-signature Changed - Verify OpaqueSigner's Public() return is public - jws: skip signature on ErrJWKSKidNotFound - Handle JWE JSON without protected header - jws: don't strip internal whitespace before parsing JSON - jws: fewer calls to OpaqueSigner.Public() - Return a specific error when parsing empty string - Reject typed nil at Verify time full diff: go-jose/go-jose@v4.1.4...v4.1.5 Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
…zure/login-3.0.2 build(deps): bump azure/login from 3.0.1 to 3.0.2
Signed-off-by: Mike Brown <brownwm@us.ibm.com>
…-gc-remove Revert "metadata: bound snapshotter Remove during garbage collection"
vendor: github.com/go-jose/go-jose/v4 v4.1.5 (security)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot] (v2.0.0-alpha.4)
Can you help keep this open source service alive? 💖 Please sponsor : )