image: compatibility for criu checkpoint image

[zhuangqh]

Description

unable to get the image manifest from image which generated by ctr c checkpoint.

A typical image config from a simple criu checkpoint like this

{
    "annotations": {
      "io.containerd.checkpoint.runtime": "io.containerd.runc.v2",
      "io.containerd.checkpoint.snapshotter": "overlayfs",
      "org.opencontainers.image.ref.name": "docker.io/library/busybox:latest"
    },
    "manifests": [
      {
        "annotations": {
          "io.containerd.image.name": "docker.io/library/busybox:latest",
          "org.opencontainers.image.ref.name": "latest"
        },
        "digest": "sha256:984b8977727b8942903c11d40d7a4a30dc00bf2be15a4c7203973b4513662057",
        "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
        "size": 423
      },
      {
        "digest": "sha256:4f4fb700ef54461cfa02571ae0db9a0dc1e0cdb5577484a6d75e68dc38e8acc1",
        "mediaType": "application/vnd.oci.image.layer.v1.tar+gzip",
        "platform": {
          "architecture": "amd64",
          "os": "linux"
        },
        "size": 32
      },
      {
        "digest": "sha256:d7f251c810da3c56280787a40fde49c456ab40538ccf8b7fc77e3826b688a10a",
        "mediaType": "application/vnd.containerd.container.checkpoint.config.v1+proto",
        "platform": {
          "architecture": "amd64",
          "os": "linux"
        },
        "size": 9520
      },
      {
        "digest": "sha256:7d3151453569712d136c98a8cce017f677b6a39c5114c6f570c0ea2f5a4bce68",
        "mediaType": "application/vnd.containerd.container.checkpoint.options.v1+proto",
        "platform": {
          "architecture": "amd64",
          "os": "linux"
        },
        "size": 42
      }
    ],
    "schemaVersion": 2
  }

when you call image.Config(ctx), you got error "unexpected media type application/vnd.oci.image.layer.v1.tar+gzip for sha256:4f4fb700ef54461cfa02571ae0db9a0dc1e0cdb5577484a6d75e68dc38e8acc1"

https://github.com/containerd/containerd/blob/main/images/image.go#L232

Steps to reproduce the issue

1. create a simple busybox container
2. do checkpoint `ctr c checkpoint --rw --image --task $cid dev.com/myckpt:1
3. load image "dev.com/myckpt:1", and call image.Config(ctx)

Describe the results you received and expected

normally read the image manifest

What version of containerd are you using?

latest

Any other relevant information

No response

Show configuration if it is related to CRI plugin.

No response

[zhuangqh]

anybody can take a look 😂. Just install criu and reproduce it by checkpoint a container

[estesp]

This checkpoint image was designed long before the OCI took on trying to come up with general guidance on using the registry for artifact storage. Now that there is guidance, I think I would prefer that new checkpoints use the guidance provided by the OCI image spec before just slightly re-arranging the current model.

In my mind this would mean that there would be an artifact type for checkpointed container data, and, ideally, when the OCI v1.1 specs are released for distribution + image, the manifest for that checkpoint data would refer to the original image (of the container being checkpointed); that way there is a API-queryable path from checkpointed data to the original image, and there is no need to make a weird/mixed OCI index, if I understand the current model correctly.

There may be issues I'm not thinking of yet, but that's what comes to mind when I look back at this "checkpoint image format" we are creating today.