Signed-off-by: Shingo Omura <everpeace@gmail.com>

Debian has started building packages with usernamespaces
to disable network access and similar isolation features. The
containerd package executes a unit test that fails in that
scenario, see https://bugs.debian.org/1070411

The code contains a conditional on whether it is running in
usernamepsace. This commit expands the unit test to cover
this behavior; it was previously untested.

The easiest way to reproduce this issue is to prefix the test
invocaiton with 'unshare -nr go test [...]'

Signed-off-by: Reinhard Tartler <siretart@gmail.com>

vendor: github.com/containerd/platforms v0.2.1

…g-x-ba92570477

build(deps): bump the golang-x group with 2 updates

Since Go 1.20, math/rand does not need explicit seeding:
https://go.dev/doc/go1.20#minor_library_changes

Go <= 1.19 is no longer supported due to EOL.

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>

Remove pkg/seed

Allow running test in usernamespace

Signed-off-by: Derek McGowan <derek@mcg.dev>

full diff: opencontainers/runc@v1.1.12...v1.1.13

Release notes:

* If building with Go 1.22.x, make sure to use 1.22.4 or a later version.

* Support go 1.22.4+.
* runc list: fix race with runc delete.
* Fix set nofile rlimit error.
* libct/cg/fs: fix setting rt_period vs rt_runtime.
* Fix a debug msg for user ns in nsexec.
* script/*: fix gpg usage wrt keyboxd.
* CI fixes and misc backports.
* Fix codespell warnings.

* Silence security false positives from golang/net.
* libcontainer: allow containers to make apps think fips is enabled/disabled for testing.
* allow overriding VERSION value in Makefile.
* Vagrantfile.fedora: bump Fedora to 39.
* ci/cirrus: rm centos stream 8.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

Now that we're on runc v1.1.13, we no longer need to pin the
go version fo runc to go1.21

This reverts commit fef78c1.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

…licy

KEP-3619: Fine-grained SupplementalGroups control

Signed-off-by: Kern Walster <walster@amazon.com>

Signed-off-by: harshitasao <harshitasao@gmail.com>

update runc binary to v1.1.13

Bumps the k8s group with 4 updates in the / directory: [k8s.io/apimachinery](https://github.com/kubernetes/apimachinery), [k8s.io/client-go](https://github.com/kubernetes/client-go), [k8s.io/component-base](https://github.com/kubernetes/component-base) and [k8s.io/kubelet](https://github.com/kubernetes/kubelet).


Updates `k8s.io/apimachinery` from 0.30.0 to 0.30.2
- [Commits](kubernetes/apimachinery@v0.30.0...v0.30.2)

Updates `k8s.io/client-go` from 0.30.0 to 0.30.2
- [Changelog](https://github.com/kubernetes/client-go/blob/master/CHANGELOG.md)
- [Commits](kubernetes/client-go@v0.30.0...v0.30.2)

Updates `k8s.io/component-base` from 0.30.0 to 0.30.2
- [Commits](kubernetes/component-base@v0.30.0...v0.30.2)

Updates `k8s.io/kubelet` from 0.30.0 to 0.30.2
- [Commits](kubernetes/kubelet@v0.30.0...v0.30.2)

---
updated-dependencies:
- dependency-name: k8s.io/apimachinery
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: k8s
- dependency-name: k8s.io/client-go
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: k8s
- dependency-name: k8s.io/component-base
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: k8s
- dependency-name: k8s.io/kubelet
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: k8s
...

Signed-off-by: dependabot[bot] <support@github.com>

Signed-off-by: Abel Feng <fshb1988@gmail.com>

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

While the hook is intended to be used with logrus, we don't need to have
the direct import; use the aliases provided by the containerd/log module
instead.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

Check span.IsRecording first, as it's a more lightweight check than
span.SpanContext().IsValid()

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

Prepare v2.0.0-rc.3 release

Race detector complains about concurrent access such as with Dispatch on
push.

Signed-off-by: Derek McGowan <derek@mcg.dev>

pkg/tracing: remove direct use of logrus, and fix some linting issues

The ParentIDs array in the Snapshot type is populated in the reverse order i.e the
immediate parent is at the 0th index and the oldest parent is at the last index. It can be
seen here:
https://github.com/containerd/containerd/blob/main/core/snapshots/storage/bolt.go#L492
When applying these layers, the parent layer at the last index should be applied first and
the parent layer at the 0th index should be applied last. However, the comment above the
Snapshot type says the exact opposite thing.  This commit fixes that comment.

Signed-off-by: Amit Barve <ambarve@microsoft.com>

Allow proxy plugins to have capabilities

auth: add span to FetchToken helpers

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

Adds a mutex to protect fallback host

Remove some logrus imports

…19d883663

build(deps): bump the k8s group across 1 directory with 4 updates

Signed-off-by: Derek McGowan <derek@mcg.dev>

Bumps the k8s group with 1 update: [k8s.io/klog/v2](https://github.com/kubernetes/klog).


Updates `k8s.io/klog/v2` from 2.120.1 to 2.130.0
- [Release notes](https://github.com/kubernetes/klog/releases)
- [Changelog](https://github.com/kubernetes/klog/blob/main/RELEASE.md)
- [Commits](kubernetes/klog@v2.120.1...v2.130.0)

---
updated-dependencies:
- dependency-name: k8s.io/klog/v2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: k8s
...

Signed-off-by: dependabot[bot] <support@github.com>

Bumps [github.com/checkpoint-restore/checkpointctl](https://github.com/checkpoint-restore/checkpointctl) from 1.2.0 to 1.2.1.
- [Release notes](https://github.com/checkpoint-restore/checkpointctl/releases)
- [Commits](checkpoint-restore/checkpointctl@v1.2.0...v1.2.1)

---
updated-dependencies:
- dependency-name: github.com/checkpoint-restore/checkpointctl
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Bumps [github.com/klauspost/compress](https://github.com/klauspost/compress) from 1.17.8 to 1.17.9.
- [Release notes](https://github.com/klauspost/compress/releases)
- [Changelog](https://github.com/klauspost/compress/blob/master/.goreleaser.yml)
- [Commits](klauspost/compress@v1.17.8...v1.17.9)

---
updated-dependencies:
- dependency-name: github.com/klauspost/compress
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Reduce scope of permissions in stale workflow

Signed-off-by: Akhil Mohan <akhilerm@gmail.com>

from xfsprogs 5.19.0, minimum size of xfs volume has to be 300MB

Ref: https://git.kernel.org/pub/scm/fs/xfs/xfsprogs-dev.git/commit/?id=6e0ed3d19c54603f0f7d628ea04b550151d8a262
Signed-off-by: Akhil Mohan <akhilerm@gmail.com>

Signed-off-by: Akhil Mohan <akhilerm@gmail.com>

Signed-off-by: Akhil Mohan <akhilerm@gmail.com>

use ovmf 2022.02-3ubuntu0.22.04.2 so that the OVMF_CODE.fd which vagrant
looks for is still available

Signed-off-by: Akhil Mohan <akhilerm@gmail.com>

Unfortunately, this is a rather large diff, but perhaps worth a one-time
"rip off the bandaid" for v2. This patch removes the use of "gocontext"
as alias for stdLib's "context", and uses "cliContext" for uses of
cli.context.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

update all runners except the binary building job to ubuntu-24.04

Signed-off-by: Akhil Mohan <akhilerm@gmail.com>

The godoc should properly show the formatting of the database
structure and sections explaining it.

Signed-off-by: Derek McGowan <derek@mcg.dev>

Update the dependency and the indirect golang.org/x/net version to align
with containerd itself, and to prevent a vulnerability being detected.

We should keep the versions <= versions used by containerd 1.7 to prevent
forcing users of containerd 1.7 in combination with the latest version
of the API module from having to update all their dependencies, but
this update should likely be fine (and aligns with 1.7).

Before this:

    Scanning your code and 254 packages across 15 dependent modules for known vulnerabilities...

    === Symbol Results ===

    Vulnerability #1: GO-2024-2687
        HTTP/2 CONTINUATION flood in net/http
      More info: https://pkg.go.dev/vuln/GO-2024-2687
      Module: golang.org/x/net
        Found in: golang.org/x/net@v0.21.0
        Fixed in: golang.org/x/net@v0.23.0
        Example traces found:
          #1: events/task_fieldpath.pb.go:85:20: events.TaskIO.Field calls fmt.Sprint, which eventually calls http2.ConnectionError.Error
          #2: events/task_fieldpath.pb.go:85:20: events.TaskIO.Field calls fmt.Sprint, which eventually calls http2.ErrCode.String
          #3: events/task_fieldpath.pb.go:85:20: events.TaskIO.Field calls fmt.Sprint, which eventually calls http2.FrameHeader.String
          #4: events/task_fieldpath.pb.go:85:20: events.TaskIO.Field calls fmt.Sprint, which eventually calls http2.FrameType.String
          #5: events/task_fieldpath.pb.go:85:20: events.TaskIO.Field calls fmt.Sprint, which eventually calls http2.Setting.String
          #6: events/task_fieldpath.pb.go:85:20: events.TaskIO.Field calls fmt.Sprint, which eventually calls http2.SettingID.String
          #7: events/task_fieldpath.pb.go:85:20: events.TaskIO.Field calls fmt.Sprint, which eventually calls http2.StreamError.Error
          #8: services/content/v1/content_ttrpc.pb.go:272:35: content.ttrpccontentClient.Write calls ttrpc.Client.NewStream, which eventually calls http2.chunkWriter.Write
          #9: events/task_fieldpath.pb.go:85:20: events.TaskIO.Field calls fmt.Sprint, which eventually calls http2.connError.Error
          #10: events/task_fieldpath.pb.go:85:20: events.TaskIO.Field calls fmt.Sprint, which eventually calls http2.duplicatePseudoHeaderError.Error
          #11: events/task_fieldpath.pb.go:85:20: events.TaskIO.Field calls fmt.Sprint, which eventually calls http2.headerFieldNameError.Error
          #12: events/task_fieldpath.pb.go:85:20: events.TaskIO.Field calls fmt.Sprint, which eventually calls http2.headerFieldValueError.Error
          #13: events/task_fieldpath.pb.go:85:20: events.TaskIO.Field calls fmt.Sprint, which eventually calls http2.pseudoHeaderError.Error
          #14: events/task_fieldpath.pb.go:85:20: events.TaskIO.Field calls fmt.Sprint, which eventually calls http2.writeData.String

    Your code is affected by 1 vulnerability from 1 module.
    This scan also found 0 vulnerabilities in packages you import and 3
    vulnerabilities in modules you require, but your code doesn't appear to call
    these vulnerabilities.
    Use '-show verbose' for more details.

After this:

    govulncheck ./...
    Scanning your code and 251 packages across 13 dependent modules for known vulnerabilities...

    === Symbol Results ===

    No vulnerabilities found.

    Your code is affected by 0 vulnerabilities.
    This scan also found 0 vulnerabilities in packages you import and 3
    vulnerabilities in modules you require, but your code doesn't appear to call
    these vulnerabilities.
    Use '-show verbose' for more details.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

full diff: containerd/ttrpc@v1.2.4...v1.2.5

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

Cleanup metadata godoc

cmd: don't alias context package, and use cliContext for cli.Context

Signed-off-by: Henry Wang <henwang@amazon.com>

vendor: github.com/containerd/ttrpc v1.2.5

Bumps [github.com/containernetworking/cni](https://github.com/containernetworking/cni) from 1.2.0 to 1.2.1.
- [Release notes](https://github.com/containernetworking/cni/releases)
- [Commits](containernetworking/cni@v1.2.0...v1.2.1)

---
updated-dependencies:
- dependency-name: github.com/containernetworking/cni
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

api: update github.com/containerd/ttrpc v1.2.5 to be aligned with containerd

ci: enable ubuntu-24 runners

…b02c00507

build(deps): bump k8s.io/klog/v2 from 2.120.1 to 2.130.0 in the k8s group

Bumps google.golang.org/protobuf from 1.34.1 to 1.34.2.

---
updated-dependencies:
- dependency-name: google.golang.org/protobuf
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

…b.com/containernetworking/cni-1.2.1

build(deps): bump github.com/containernetworking/cni from 1.2.0 to 1.2.1

Bumps [github.com/containernetworking/plugins](https://github.com/containernetworking/plugins) from 1.4.1 to 1.5.1.
- [Release notes](https://github.com/containernetworking/plugins/releases)
- [Commits](containernetworking/plugins@v1.4.1...v1.5.1)

---
updated-dependencies:
- dependency-name: github.com/containernetworking/plugins
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Bumps the k8s group with 1 update: [k8s.io/klog/v2](https://github.com/kubernetes/klog).


Updates `k8s.io/klog/v2` from 2.130.0 to 2.130.1
- [Release notes](https://github.com/kubernetes/klog/releases)
- [Changelog](https://github.com/kubernetes/klog/blob/main/RELEASE.md)
- [Commits](kubernetes/klog@v2.130.0...v2.130.1)

---
updated-dependencies:
- dependency-name: k8s.io/klog/v2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: k8s
...

Signed-off-by: dependabot[bot] <support@github.com>

…b.com/containernetworking/plugins-1.5.1

build(deps): bump github.com/containernetworking/plugins from 1.4.1 to 1.5.1

The boltdb instance in metadata is only used for getting transactions
and can also be overriden via the context to have a wider control of the
transaction boundary. Using the transactor interface allows callers of
metadata to have more control of the transaction lifecycle.

Since boltdb must be fsync'ed on commit, operations which perform many
database operations can be costly and slow. While providing transactor
via context can be used to group together operations, it does not
provide a way to manage the commit fsyncs more globally.

Signed-off-by: Derek McGowan <derek@mcg.dev>

Bumps [github.com/containerd/go-cni](https://github.com/containerd/go-cni) from 1.1.9 to 1.1.10.
- [Release notes](https://github.com/containerd/go-cni/releases)
- [Commits](containerd/go-cni@v1.1.9...v1.1.10)

---
updated-dependencies:
- dependency-name: github.com/containerd/go-cni
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Bumps [github.com/containernetworking/cni](https://github.com/containernetworking/cni) from 1.2.1 to 1.2.2.
- [Release notes](https://github.com/containernetworking/cni/releases)
- [Commits](containernetworking/cni@v1.2.1...v1.2.2)

---
updated-dependencies:
- dependency-name: github.com/containernetworking/cni
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

…e.golang.org/protobuf-1.34.2

build(deps): bump google.golang.org/protobuf from 1.34.1 to 1.34.2

Add pprof to runc-shim

Use the transactor interface in metadata

…b.com/containernetworking/cni-1.2.2

build(deps): bump github.com/containernetworking/cni from 1.2.1 to 1.2.2

…b.com/containerd/go-cni-1.1.10

build(deps): bump github.com/containerd/go-cni from 1.1.9 to 1.1.10

…351cbf957

build(deps): bump k8s.io/klog/v2 from 2.130.0 to 2.130.1 in the k8s group

…b.com/checkpoint-restore/checkpointctl-1.2.1

build(deps): bump github.com/checkpoint-restore/checkpointctl from 1.2.0 to 1.2.1

…b.com/klauspost/compress-1.17.9

build(deps): bump github.com/klauspost/compress from 1.17.8 to 1.17.9

…intf

These were straight concatenations of strings; reduce some allocations by
removing fmt.Sprintf for this.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

Before / After:

    BenchmarkSplitObject-10        2785656    428.1 ns/op     416 B/op    13 allocs/op
    BenchmarkSplitObjectNew-10    13510520     88.2 ns/op       0 B/op     0 allocs/op

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

The behavior of this function is quite counter-intuitive, as it preserves
the delimiter in the result. This function should probably have been an
internal function, as its use for external consumers would be very limited,
but let's at least document the (surprising) behavior for those that are
considering to use it.

It appears that BuildKit is currently the only (publicly visible) external
consumer of this function; I am planning to inline its functionality in
Spec.Digest() and to deprecate this function so that it can be removed.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

Inline the relevant code from SplitObject, as we're only interested
in the digest portion.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

pkg/reference: reduce allocations and improve GoDoc

The behavior of this function is quite counter-intuitive, as it preserves
the delimiter in the result, and its use for external consumers would be
very limited.

Spec.Digest no longer uses this function, and it appears that BuildKit is
currently the only (publicly visible) external consumer of it.

This patch deprecates the function.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

Implement calls to the fsverity kernel module, allowing containerd to
enable fsverity on blob data in the content store. This causes fsverity
to veirfy the integrity of blob data when the blob is read.

Signed-off-by: James Jenkins <James.Jenkins@ibm.com>

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

A nil CRIImplementation field can cause a nil pointer dereference and
panic during startup recovery.

Prior to this change, the nri.API struct would have a nil cri
(CRIImplementation) field after nri.NewAPI until nri.Register was
called.  Register is called mid-way through initialization of the CRI
plugin, but recovery for containers occurs prior to that.  Container
recovery includes establishing new exit monitors for existing containers
that were discovered.  When a container exits, NRI plugins are given the
opportunity to be notified about the lifecycle event, and this is done
by accessing that CRIImplementation field inside the nri.API.  If a
container exits prior to nri.Register being called, access to the
CRIImplementation field can cause a panic.

Here's the call-path:

* The CRI plugin starts running
  [here](https://github.com/containerd/containerd/blob/ae71819c4f5e67bb4d5ae76a6b735f29cc25774e/pkg/cri/server/service.go#L222)
* It then [calls into](https://github.com/containerd/containerd/blob/ae71819c4f5e67bb4d5ae76a6b735f29cc25774e/pkg/cri/server/service.go#L227)
  `recover()` to recover state from previous runs of containerd
* `recover()` then attempts to recover all containers through
  [`loadContainer()`](https://github.com/containerd/containerd/blob/ae7d74b9e21bd08260586db104a1fe04af754545/internal/cri/server/restart.go#L175)
* When `loadContainer()` finds a container that is still running, it waits
  for the task (internal containerd object) to exit and sets up
  [exit monitoring](https://github.com/containerd/containerd/blob/ae7d74b9e21bd08260586db104a1fe04af754545/internal/cri/server/restart.go#L391)
* Any exit that then happens must be
  [handled](https://github.com/containerd/containerd/blob/ae7d74b9e21bd08260586db104a1fe04af754545/internal/cri/server/events.go#L145)
* Handling an exit includes
  [deleting the Task](https://github.com/containerd/containerd/blob/ae7d74b9e21bd08260586db104a1fe04af754545/internal/cri/server/events.go#L188)
  and specifying [`nri.WithContainerExit`](https://github.com/containerd/containerd/blob/ae7d74b9e21bd08260586db104a1fe04af754545/internal/cri/nri/nri_api_linux.go#L348)
  to [notify](https://github.com/containerd/containerd/blob/ae7d74b9e21bd08260586db104a1fe04af754545/internal/cri/nri/nri_api_linux.go#L356)
  any subscribed NRI plugins
* NRI plugins need to know information about the pod (not just the sandbox),
  so before a plugin is notified the NRI API package
  [queries the Sandbox Store](https://github.com/containerd/containerd/blob/ae7d74b9e21bd08260586db104a1fe04af754545/internal/cri/nri/nri_api_linux.go#L232)
  through the CRI implementation
* The `cri` implementation member field in the `nri.API` struct is set as part of the
  [`Register()`](https://github.com/containerd/containerd/blob/ae7d74b9e21bd08260586db104a1fe04af754545/internal/cri/nri/nri_api_linux.go#L66) method
* The `nri.Register()` method is only called
  [much further down in the CRI `Run()` method](https://github.com/containerd/containerd/blob/ae71819c4f5e67bb4d5ae76a6b735f29cc25774e/pkg/cri/server/service.go#L279)

Signed-off-by: Samuel Karp <samuelkarp@google.com>

commit 149ca68 updated the hcsshim
module to v0.12.4, but did not add a commit to also update the runhcs
binary version.

full diff: microsoft/hcsshim@v0.12.3...v0.12.4

These versions are decoupled since 15b13fb
to allow updating the binary version without updating the module, in cases
where the module doesn't require updates.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

pkg/reference: deprecate SplitObject, and remove for v2.0

Fsverity content verification

sandbox: Add Update API for sandbox controller

update runhcs binary to v0.12.4

This reduces latency of calling ListPodSandboxStats() by avoiding calling
shim API Task().

Signed-off-by: Eric Lin <linxiulei@gmail.com>

This functionality is not directly related to containerd and could move
to external package at some point.

Signed-off-by: Derek McGowan <derek@mcg.dev>

cri: ensure NRI API never has nil CRI

Move fsverity package to internal

cri: get pid count from container metrics