fix: drop unpacked layers from containerd image store

See containerd/cri#1543

Fixes #4274

Fix is applied on two levels:

* for Talos-initiated pulls, update API call
* for Kubernetes-initiated pulls, update CRI plugin config

Comparison of `/var` usage before/after, as reported by
`talosctl mounts` (in GiB):

|              | before | after |
|--------------|:------:|------:|
| controlplane |  1.98  |  1.74 |
| worker       |  1.17  |  1.01 |

It's hard to measure effect on pulls to system containerd, like
`installer` image, as it's ephemeral, but it should also reduce space
usage in `tmpfs`.

Also fixes output of `talosctl mounts`.

Signed-off-by: Andrey Smirnov <andrey.smirnov@talos-systems.com>

hack/cri-containerd.toml

@@ -10,3 +10,4 @@ format = "json"
 
 [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc]
     runtime_type = "io.containerd.runc.v2"
+    discard_unpacked_layers = true

internal/pkg/containers/image/image.go

@@ -12,6 +12,7 @@ import (
 
 	"github.com/containerd/containerd"
 	"github.com/containerd/containerd/errdefs"
+	"github.com/containerd/containerd/images"
 	"github.com/talos-systems/go-retry/retry"
 
 	containerdrunner "github.com/talos-systems/talos/internal/app/machined/pkg/system/runner/containerd"
@@ -71,7 +72,13 @@ func Pull(ctx context.Context, reg config.Registries, client *containerd.Client,
 	resolver := NewResolver(reg)
 
 	err = retry.Exponential(PullTimeout, retry.WithUnits(PullRetryInterval), retry.WithErrorLogging(true)).Retry(func() error {
-		if img, err = client.Pull(ctx, ref, containerd.WithPullUnpack, containerd.WithResolver(resolver)); err != nil {
+		if img, err = client.Pull(
+			ctx,
+			ref,
+			containerd.WithPullUnpack,
+			containerd.WithResolver(resolver),
+			containerd.WithChildLabelMap(images.ChildGCLabelsFilterLayers),
+		); err != nil {
 			err = fmt.Errorf("failed to pull image %q: %w", ref, err)
 
 			if errdefs.IsNotFound(err) || errdefs.IsCanceled(err) {

pkg/cli/formatters.go

@@ -57,7 +57,7 @@ func RenderMounts(resp *machine.MountsResponse, output io.Writer, remotePeer *pe
 			if defaultNode != "" {
 				format = "%s\t" + format
 
-				args = append([]interface{}{node}, args)
+				args = append([]interface{}{node}, args...)
 			}
 
 			fmt.Fprintf(w, format, args...)