containerd

TEST build order

Signed-off-by: Ciprian Hacman <ciprian@hakman.dev>

containerd

Unset CC and CGO_ENABLED when building cri-containerd tar

Signed-off-by: Ciprian Hacman <ciprian@hakman.dev>

containerd

Check release build

Signed-off-by: Ciprian Hacman <ciprian@hakman.dev>

containerd

Check release build

Signed-off-by: Ciprian Hacman <ciprian@hakman.dev>

containerd 1.5.0-rc.2

Welcome to the v1.5.0-rc.2 release of containerd!
This is a pre-release of containerd

The sixth major release of containerd includes many stability improvements
and code organization changes to make contribution easier and make future
features cleaner to develop. This includes bringing CRI development into the
main containerd repository and switching to Go modules. This release also
brings support for the Node Resource Interface (NRI).

Highlights

Project Organization

• Merge containerd/cri codebased into containerd/containerd #4593
• Move to Go modules #4760
• Remove selinux build tag #4849
• Add json log format output option for daemon log #4803

Snapshots

• Add configurable overlayfs path #4505
• Separate overlay implementation from plugin #4506
• Native snapshotter configuration and plugin separation #4517
• Devmapper snapshotter configuration and plugin separation #4573
• AUFS snapshotter configuration and plugin separation #4533
• ZFS snapshotter configuration and plugin separation #4534
• Pass custom snapshot labels when creating snapshot #4630 #4635
• Add platform check for snapshotter support when unpacking #3927
• Handle loopback mounts #4902
• Support userxattr mount option for overlay in user namespace #5076
• ZFS snapshotter implementation of usage #5243

Distribution

• Improve registry response errors #4523
• Improve image pull performance over HTTP 1.1 #4653
• Registry configuration package #4138
• Add support for layers compressed with zstd #4809
• Allow arm64 to fallback to arm (v8, v7, v6, v5) 4932

Runtime

• Add annotations to containerd task update API #4647
• Add logging binary support when terminal is true #4502
• Runtime support on FreeBSD #5375

Windows

• Optimize LCOW snapshotter use of scratch layers #4643

CRI

• Add NRI injection points cri#1552
• Add support for registry host directory configuration #4978
• Update privileged containers to use current capabilities instead of known capabilities #5017
• Add pod annotations to CNI call #5026
• Enable ocicrypt by default #5135

Impactful Client Updates

This release has changes which may affect projects which import containerd.

Switch to Go modules

containerd and all containerd sub-repositories are now using Go modules. This
should help make importing easier for handling transitive dependencies. As of
this release, containerd still does not guarantee client library compatibility
for 1.x versions, although best effort is made to minimize impact from changes
to exported Go packages.

CRI plugin moved to main repository

With the CRI plugin moving into the main repository, imports under github.com/containerd/cri/
can now be found github.com/containerd/containerd/pkg/cri/.
There are no changes required for end users of CRI.

Library changes

oci

The WithAllCapabilities has been removed and replaced with WithAllCurrentCapabilities
and WithAllKnownCapabilities. WithAllKnownCapabilities has similar
functionality to the previous WithAllCapabilities with added support for newer
capabilities. WithAllCurrentCapabilities can be used to give privileged
containers the same set of permissions as the calling process, preventing errors
when privileged containers attempt to get more permissions than given to the
caller.

Configuration changes

New registry.config_path for CRI plugin

registry.config_path specifies a directory to look for registry hosts
configuration. When resolving an image name during pull operations, the CRI
plugin will look in the <registry.config_path>/<image hostname>/ directory
for host configuration. An optional hosts.toml file in that directory may be
used to configure which hosts will be used for the pull operation as well
host-specific configurations. Updates under that directory do not require
restarting the containerd daemon.

Enable registry.config_path in the containerd configuration file.

[plugins."io.containerd.grpc.v1.cri".registry]
   config_path = "/etc/containerd/certs.d"

Configure registry hosts, such as /etc/containerd/certs.d/docker.io/hosts.toml
for any image under the docker.io namespace (any image on Docker Hub).

server = "https://registry-1.docker.io"    # Exclude this to not use upstream

[host."https://public-mirror.example.com"]
  capabilities = ["pull"]                  # Requires less trust, won't resolve tag to digest from this host
[host."https://docker-mirror.internal"]
  capabilities = ["pull", "resolve"]
  ca = "docker-mirror.crt"                 # Or absolute path /etc/containerd/certs.d/docker.io/docker-mirror.crt

If no hosts.toml configuration exists in the host directory, it will fallback
to check certificate files based on Docker's certificate file
pattern (".crt" files for CA certificates and ".cert"/".key" files for client
certificates).

Deprecation of registry.mirrors and registry.configs in CRI plugin

Mirroring and TLS can now be configured using the new registry.config_path
option. Existing configurations may be migrated to new host directory
configuration. These fields are only deprecated with no planned removal,
however, these configurations cannot be used while registry.config_path is
defined.

Version 1 schema is deprecated

Version 2 of the containerd configuration toml is recommended format and the
default. Starting this version, a deprecation warning will be logged when
version 1 is used.

To check version, see the version value in the containerd toml configuration.

version=2

See the changelog for complete list of changes

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

Contributors

• Lantao Liu
• Mike Brown
• Phil Estes
• Sebastiaan van Stijn
• Derek McGowan
• Akihiro Suda
• Maksym Pavlenko
• Michael Crosby
• Wei Fu
• Abhinandan Prativadi
• Davanum Srinivas
• Stefan Berger
• Shengjing Zhu
• Xuean Yan
• Yanqiang Miao
• Samuel Karp
• Brandon Lum
• Brian Goff
• Kazuyoshi Kato
• Justin Terry
• Paul "TBBle" Hampson
• Iceber Gu
• Ian Campbell
• Kohei Tokunaga
• Shiming Zhang
• Daniel Canter
• Kevin Parsons
• Kir Kolyshkin
• Siddharth Yadav
• Antonio Ojea
• Tianon Gravi
• Tõnis Tiigi
• Jose Carlos Venegas Munoz
• Li Yuxuan
• heartlock
• Alakesh Haloi
• Jacob Blain Christen
• Jian Zeng
• Johannes M. Scheuermann
• Julien Balestra
• Kathryn Baldauf
• Rui Chen
• Tobias Klauser
• Xianglin Gao
• Zhoulin Xie
• Aditi Sharma
• Akshat Kumar
• Aldo Culquicondor
• Amr Mahdi
• Christopher M. Luciano
• Cory Bennett
• Crazykev
• Haiyan Meng
• Hajime Tazaki
• Ilya Dmitrichenko
• Martin Hickey
• Stephen J Day
• Tim Allclair
• Wade Lee
• Yu-Ju Hong
• pacoxu
• Aaron Crickenberger
• Avi Deitcher
• Benjamin Elder
• Boris Popovschi
• Byonggon Chun
• Daniel Nephin
• Ed Bartosh
• Evan Hazlett
• George Goh
• Hui Zhu
• James Jackson
• James Sturtevant
• Jintao Zhang
• Junior Santos
• Leonardo Taccari
• Lorenz Brun
• Mohammad Asif Siddiqui
• Peng Tao
• Vlad Ungureanu
• Yohei Ueda
• Zhenhao Zhang
• Zhiyu Li
• Aaron Lehmann
• Abhishek Kulkarni
• Ace-Tang
• AdamKorcz
• Alban Crequy
• Aleksa Sarai
• Alex Price
• Amit Barve
• Andrei Dobre
• Angela Li
• Antoine Huret
• Archana Shinde
• Ashray Jain
• Bingshen Wang
• Bowen Yan
• Brian Pursley
• Chethan Suresh
• Chris Fregly
• Cong Liu
• Cyrill Troxler
• Darren Shepherd
• Dave Syer
• Deep Debroy
• Didier Durand
• Emmanuel Ramos
• Eric Ernst
• Erik Wilson
• Evan
• Fabiano Fidêncio
• Fabricio Voznika
• Filipe Brandenburger
• Fupan Li
• Gaurav Singh
• Georgi Sabev
• Giuseppe Capizzi
• Giuseppe Scrivano
• Gsealy Jiao
• Guangwen Feng
• Guanjun Gong
• Harshal Patil
• Hector Fernandez
• Henrik Schmidt
• HsuanChi (Austin) Kuo
• Hu Shuai
• Ivan Milchev
• Jakob
• Jamie Zhuang
• Jason Hall
• Jeremy Edwards
• Jeremy Williams
• Jess Frazelle
• Jian Qiu
• Joe Borg
• Jordan Hatcher
• Joris De Winne
• Jun Lin Chen
• Justin Cormack
• Kenta Tada
• Laszlo Janosi
• Li Ning
• Liu Hua
• Madhan Raj Mookkandy
• Madhav Jivrajani
• Maksim An
• Malepati Bala Siva Sai Akhil
• Mauricio Vásquez
• Michael Hamrah
• Morgan Bauer
• Moritz Johner
• Muhammad Kaisar Arkhan
• Nikhita Raghunath
• Nishchay Kumar
• Nitesh Konkar
• Odin Ugedal
• Pavel Tikhomirov
• Philip Marin
  *...

containerd 1.5.0-rc.1

Welcome to the v1.5.0-rc.1 release of containerd!
This is a pre-release of containerd

The sixth major release of containerd includes many stability improvements
and code organization changes to make contribution easier and make future
features cleaner to develop. This includes bringing CRI development into the
main containerd repository and switching to Go modules. This release also
brings support for the Node Resource Interface (NRI).

Highlights

Project Organization

• Merge containerd/cri codebased into containerd/containerd #4593
• Move to Go modules #4760
• Remove selinux build tag #4849
• Add json log format output option for daemon log #4803

Snapshots

• Add configurable overlayfs path #4505
• Separate overlay implementation from plugin #4506
• Native snapshotter configuration and plugin separation #4517
• Devmapper snapshotter configuration and plugin separation #4573
• AUFS snapshotter configuration and plugin separation #4533
• ZFS snapshotter configuration and plugin separation #4534
• Pass custom snapshot labels when creating snapshot #4630 #4635
• Add platform check for snapshotter support when unpacking #3927
• Handle loopback mounts #4902
• Support userxattr mount option for overlay in user namespace #5076
• ZFS snapshotter implementation of usage #5243

Distribution

• Improve registry response errors #4523
• Improve image pull performance over HTTP 1.1 #4653
• Registry configuration package #4138
• Add support for layers compressed with zstd #4809
• Allow arm64 to fallback to arm (v8, v7, v6, v5) 4932

Runtime

• Add annotations to containerd task update API #4647
• Add logging binary support when terminal is true #4502

Windows

• Optimize LCOW snapshotter use of scratch layers #4643

CRI

• Add NRI injection points cri#1552
• Add support for registry host directory configuration #4978
• Update privileged containers to use current capabilities instead of known capabilities #5017
• Add pod annotations to CNI call #5026
• Enable ocicrypt by default #5135

Impactful Client Updates

This release has changes which may affect projects which import containerd.

Switch to Go modules

containerd and all containerd sub-repositories are now using Go modules. This
should help make importing easier for handling transitive dependencies. As of
this release, containerd still does not guarantee client library compatibility
for 1.x versions, although best effort is made to minimize impact from changes
to exported Go packages.

CRI plugin moved to main repository

With the CRI plugin moving into the main repository, imports under github.com/containerd/cri/
can now be found github.com/containerd/containerd/pkg/cri/.
There are no changes required for end users of CRI.

Library changes

oci

The WithAllCapabilities has been removed and replaced with WithAllCurrentCapabilities
and WithAllKnownCapabilities. WithAllKnownCapabilities has similar
functionality to the previous WithAllCapabilities with added support for newer
capabilities. WithAllCurrentCapabilities can be used to give privileged
containers the same set of permissions as the calling process, preventing errors
when privileged containers attempt to get more permissions than given to the
caller.

Configuration changes

New registry.config_path for CRI plugin

registry.config_path specifies a directory to look for registry hosts
configuration. When resolving an image name during pull operations, the CRI
plugin will look in the <registry.config_path>/<image hostname>/ directory
for host configuration. An optional hosts.toml file in that directory may be
used to configure which hosts will be used for the pull operation as well
host-specific configurations. Updates under that directory do not require
restarting the containerd daemon.

Enable registry.config_path in the containerd configuration file.

[plugins."io.containerd.grpc.v1.cri".registry]
   config_path = "/etc/containerd/certs.d"

Configure registry hosts, such as /etc/containerd/certs.d/docker.io/hosts.toml
for any image under the docker.io namespace (any image on Docker Hub).

server = "https://registry-1.docker.io"    # Exclude this to not use upstream

[host."https://public-mirror.example.com"]
  capabilities = ["pull"]                  # Requires less trust, won't resolve tag to digest from this host
[host."https://docker-mirror.internal"]
  capabilities = ["pull", "resolve"]
  ca = "docker-mirror.crt"                 # Or absolute path /etc/containerd/certs.d/docker.io/docker-mirror.crt

If no hosts.toml configuration exists in the host directory, it will fallback
to check certificate files based on Docker's certificate file
pattern (".crt" files for CA certificates and ".cert"/".key" files for client
certificates).

Deprecation of registry.mirrors and registry.configs in CRI plugin

Mirroring and TLS can now be configured using the new registry.config_path
option. Existing configurations may be migrated to new host directory
configuration. These fields are only deprecated with no planned removal,
however, these configurations cannot be used while registry.config_path is
defined.

Version 1 schema is deprecated

Version 2 of the containerd configuration toml is recommended format and the
default. Starting this version, a deprecation warning will be logged when
version 1 is used.

To check version, see the version value in the containerd toml configuration.

version=2

See the changelog for complete list of changes

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

Contributors

• Lantao Liu
• Mike Brown
• Phil Estes
• Sebastiaan van Stijn
• Derek McGowan
• Akihiro Suda
• Michael Crosby
• Maksym Pavlenko
• Wei Fu
• Abhinandan Prativadi
• Davanum Srinivas
• Shengjing Zhu
• Stefan Berger
• Xuean Yan
• Yanqiang Miao
• Brandon Lum
• Justin Terry
• Kazuyoshi Kato
• Brian Goff
• Samuel Karp
• Paul "TBBle" Hampson
• Ian Campbell
• Iceber Gu
• Kohei Tokunaga
• Daniel Canter
• Shiming Zhang
• Kevin Parsons
• Siddharth Yadav
• Antonio Ojea
• Tianon Gravi
• Tõnis Tiigi
• Jose Carlos Venegas Munoz
• Kir Kolyshkin
• Li Yuxuan
• heartlock
• Alakesh Haloi
• Jian Zeng
• Johannes M. Scheuermann
• Julien Balestra
• Kathryn Baldauf
• Rui Chen
• Tobias Klauser
• Xianglin Gao
• Zhoulin Xie
• Aditi Sharma
• Akshat Kumar
• Aldo Culquicondor
• Amr Mahdi
• Christopher M. Luciano
• Cory Bennett
• Crazykev
• Haiyan Meng
• Hajime Tazaki
• Ilya Dmitrichenko
• Jacob Blain Christen
• Martin Hickey
• Stephen J Day
• Tim Allclair
• Wade Lee
• Yu-Ju Hong
• pacoxu
• Aaron Crickenberger
• Avi Deitcher
• Benjamin Elder
• Boris Popovschi
• Byonggon Chun
• Daniel Nephin
• Ed Bartosh
• Evan Hazlett
• George Goh
• Hui Zhu
• James Jackson
• James Sturtevant
• Jintao Zhang
• Junior Santos
• Leonardo Taccari
• Lorenz Brun
• Mohammad Asif Siddiqui
• Peng Tao
• Vlad Ungureanu
• Yohei Ueda
• Zhenhao Zhang
• Aaron Lehmann
• Abhishek Kulkarni
• Ace-Tang
• AdamKorcz
• Alban Crequy
• Aleksa Sarai
• Alex Price
• Amit Barve
• Andrei Dobre
• Angela Li
• Antoine Huret
• Archana Shinde
• Ashray Jain
• Bingshen Wang
• Bowen Yan
• Brian Pursley
• Chethan Suresh
• Chris Fregly
• Cong Liu
• Cyrill Troxler
• Darren Shepherd
• Dave Syer
• Deep Debroy
• Didier Durand
• Emmanuel Ramos
• Eric Ernst
• Erik Wilson
• Evan
• Fabiano Fidêncio
• Fabricio Voznika
• Filipe Brandenburger
• Fupan Li
• Gaurav Singh
• Georgi Sabev
• Giuseppe Capizzi
• Giuseppe Scrivano
• Gsealy Jiao
• Guangwen Feng
• Guanjun Gong
• Harshal Patil
• Hector Fernandez
• Henrik Schmidt
• HsuanChi (Austin) Kuo
• Hu Shuai
• Ivan Milchev
• Jakob
• Jamie Zhuang
• Jason Hall
• Jeremy Edwards
• Jeremy Williams
• Jess Frazelle
• Jian Qiu
• Joe Borg
• Jordan Hatcher
• Joris De Winne
• Jun Lin Chen
• Justin Cormack
• Kenta Tada
• Laszlo Janosi
• Li Ning
• Liu Hua
• Madhan Raj Mookkandy
• Madhav Jivrajani
• Maksim An
• Malepati Bala Siva Sai Akhil
• Mauricio Vásquez
• Michael Hamrah
• Morgan Bauer
• Moritz Johner
• Muhammad Kaisar Arkhan
• Nikhita Raghunath
• Nishchay Kumar
• Nitesh Konkar
• Odin Ugedal
• Pavel Tikhomirov
• Philip Marin
• Prashant Bhutani
• Qian Xiao
• Ricardo Aravena
• Robin Winkelewski
• Roy Yang
• Samarth Shah
• Sascha G...

containerd

Release artifacts for ARM64

Signed-off-by: Ciprian Hacman <ciprian@hakman.dev>

containerd

Release artifacts for ARM64

Signed-off-by: Ciprian Hacman <ciprian@hakman.dev>

containerd

Release artifacts for ARM64

Signed-off-by: Ciprian Hacman <ciprian@hakman.dev>

containerd

Release artifacts for Linux ARM64

Signed-off-by: Ciprian Hacman <ciprian@hakman.dev>