cri: append envs from image config to empty slice to avoid env lost

[yadzhang]

Fix #5023

When call CreateContainer for multiple pods with the same image config but different envs in container spec at nearly the same time, they get image config from imagestore but the Envs slice in the image config is pointing to the same object. The Envs is json.Unmarshal from the content db, so the cap and len of the Envs slice maybe not equal.

So the operation for appending container env into the image env may cause the first few envs of the first container is overlapped by the second container (maybe from another pods) with some probability if the two container has the same image and created at the very near same time.

To resolve this, we can deepcopy image config directly after get image to avoid env or other field conflict.

[k8s-ci-robot]

Hi @yadzhang. Thanks for your PR.

I'm waiting for a containerd member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[theopenlab-ci]

Build succeeded.

• containerd-build-arm64 : SUCCESS in 6m 01s (non-voting)

[mxpv]

Could you please sign off your commits (try git commit -s) in order to pass CI checks?
https://github.com/containerd/project/blob/master/CONTRIBUTING.md#sign-your-work

[theopenlab-ci]

Build succeeded.

• containerd-build-arm64 : SUCCESS in 5m 53s (non-voting)

[yadzhang]

Could you please sign off your commits (try git commit -s) in order to pass CI checks?
https://github.com/containerd/project/blob/master/CONTRIBUTING.md#sign-your-work

Done, Thanks.

[ktock]

CI failure seems to related to #4924.

Exception 0xc0000420 0x0 0x0 0x7ff871002e0a
PC=0x7ff871002e0a
signal arrived during external code execution

[theopenlab-ci]

Build succeeded.

• containerd-build-arm64 : SUCCESS in 5m 50s (non-voting)

[fuweid]

LGTM

[fuweid]

time="2021-02-18T08:45:54Z" level=info msg="running tests against containerd" revision=66f2b3647c7a3d0618085dc4276a39ab6f426859 runtime=io.containerd.runc.v2 version=66f2b36
time="2021-02-18T08:45:54Z" level=info msg="start to pull seed image" image="docker.io/library/alpine:latest"
--- FAIL: TestContainerPids (0.11s)
    container_test.go:459: expected 2 process but received 1
FAIL

Not sure it is flaky case. rerun the CI.

[fuweid]

Hmm...

-- FAIL: TestSnapshotterSuite (0.77s)
    --- FAIL: TestSnapshotterSuite/DevMapperUsage (0.77s)
        snapshotter_test.go:141: assertion failed: expression is false: layer2Usage.Size < sizeBytes+256*dmsetup.SectorSize: 1179648 < 1179648
FAIL
FAIL	github.

[estesp]

LGTM

[mikebrow]

LGTM