fix: add --pull-image=false to containerd integration tests

Images are pre-pulled in setup() via ctr_pull_image, but pumba still
contacted the registry at runtime. When ghcr.io is slow, this causes
context canceled errors (flaky CI failures on tests 53-55). Match the
pattern used by all Docker integration tests.

Author: alexei-led

tests/containerd_combined.bats

@@ -31,12 +31,12 @@ teardown() {
 
 @test "Should apply netem then iptables on same container via containerd runtime" {
     # Apply netem delay
-    run sudo pumba --runtime containerd --containerd-namespace moby --log-level debug netem --interface dummy0 --duration 2s delay --time 100 test-combined-ctr
+    run sudo pumba --runtime containerd --containerd-namespace moby --log-level debug netem --interface dummy0 --pull-image=false --duration 2s delay --time 100 test-combined-ctr
     echo "Netem status: $status, output: $output"
     assert_success
 
     # Apply iptables loss on the same container
-    sudo pumba --runtime containerd --containerd-namespace moby --log-level debug iptables --interface lo --duration 30s loss --probability 1.0 test-combined-ctr &
+    sudo pumba --runtime containerd --containerd-namespace moby --log-level debug iptables --interface lo --pull-image=false --duration 30s loss --probability 1.0 test-combined-ctr &
     PUMBA_PID=$!
     sleep 2
 
@@ -52,12 +52,12 @@ teardown() {
 
 @test "Should apply rate limit with iptables protocol filter via containerd runtime" {
     # Apply rate limit
-    run sudo pumba --runtime containerd --containerd-namespace moby --log-level debug netem --interface dummy0 --duration 2s rate --rate 1mbit test-combined-ctr
+    run sudo pumba --runtime containerd --containerd-namespace moby --log-level debug netem --interface dummy0 --pull-image=false --duration 2s rate --rate 1mbit test-combined-ctr
     echo "Rate limit status: $status"
     assert_success
 
     # Apply iptables with protocol filter
-    sudo pumba --runtime containerd --containerd-namespace moby --log-level debug iptables --interface lo --protocol icmp --duration 30s loss --probability 0.5 test-combined-ctr &
+    sudo pumba --runtime containerd --containerd-namespace moby --log-level debug iptables --interface lo --pull-image=false --protocol icmp --duration 30s loss --probability 0.5 test-combined-ctr &
     PUMBA_PID=$!
     sleep 2
 
@@ -72,7 +72,7 @@ teardown() {
 }
 
 @test "Should apply netem with target IP filter via containerd runtime" {
-    sudo pumba --runtime containerd --containerd-namespace moby --log-level debug netem --interface dummy0 --target 8.8.8.8 --duration 30s delay --time 100 test-combined-ctr &
+    sudo pumba --runtime containerd --containerd-namespace moby --log-level debug netem --interface dummy0 --pull-image=false --target 8.8.8.8 --duration 30s delay --time 100 test-combined-ctr &
     PUMBA_PID=$!
     sleep 2
 
@@ -88,11 +88,11 @@ teardown() {
 
 @test "Should apply iptables nth mode in combined scenario via containerd runtime" {
     # Apply netem delay first
-    run sudo pumba --runtime containerd --containerd-namespace moby --log-level debug netem --interface dummy0 --duration 2s delay --time 50 test-combined-ctr
+    run sudo pumba --runtime containerd --containerd-namespace moby --log-level debug netem --interface dummy0 --pull-image=false --duration 2s delay --time 50 test-combined-ctr
     assert_success
 
     # Then iptables nth mode
-    sudo pumba --runtime containerd --containerd-namespace moby --log-level debug iptables --interface lo --duration 30s loss --mode nth --every 5 --packet 0 test-combined-ctr &
+    sudo pumba --runtime containerd --containerd-namespace moby --log-level debug iptables --interface lo --pull-image=false --duration 30s loss --mode nth --every 5 --packet 0 test-combined-ctr &
     PUMBA_PID=$!
     sleep 2
 

tests/containerd_netem.bats

@@ -36,7 +36,7 @@ teardown() {
     assert_success
 
     # Run pumba in BACKGROUND with long duration so we can inspect tc rules while active
-    sudo pumba --runtime containerd --containerd-namespace moby --log-level debug netem --interface dummy0 --duration 30s delay --time 100 test-netem-ctr &
+    sudo pumba --runtime containerd --containerd-namespace moby --log-level debug netem --interface dummy0 --pull-image=false --duration 30s delay --time 100 test-netem-ctr &
     PUMBA_PID=$!
     # Give pumba time to apply tc rules
     sleep 2
@@ -62,7 +62,7 @@ teardown() {
 
 @test "Should apply packet loss via containerd runtime" {
     # Run pumba in BACKGROUND with long duration
-    sudo pumba --runtime containerd --containerd-namespace moby --log-level debug netem --interface dummy0 --duration 30s loss --percent 50 test-netem-ctr &
+    sudo pumba --runtime containerd --containerd-namespace moby --log-level debug netem --interface dummy0 --pull-image=false --duration 30s loss --percent 50 test-netem-ctr &
     PUMBA_PID=$!
     sleep 2
 
@@ -86,7 +86,7 @@ teardown() {
 }
 
 @test "Should apply packet duplicate via containerd runtime" {
-    sudo pumba --runtime containerd --containerd-namespace moby --log-level debug netem --interface dummy0 --duration 30s duplicate --percent 50 test-netem-ctr &
+    sudo pumba --runtime containerd --containerd-namespace moby --log-level debug netem --interface dummy0 --pull-image=false --duration 30s duplicate --percent 50 test-netem-ctr &
     PUMBA_PID=$!
     sleep 2
 
@@ -108,7 +108,7 @@ teardown() {
 }
 
 @test "Should apply packet corruption via containerd runtime" {
-    sudo pumba --runtime containerd --containerd-namespace moby --log-level debug netem --interface dummy0 --duration 30s corrupt --percent 50 test-netem-ctr &
+    sudo pumba --runtime containerd --containerd-namespace moby --log-level debug netem --interface dummy0 --pull-image=false --duration 30s corrupt --percent 50 test-netem-ctr &
     PUMBA_PID=$!
     sleep 2
 
@@ -131,12 +131,12 @@ teardown() {
 
 @test "Should handle netem on non-existent container via containerd runtime" {
     # Pumba should handle gracefully — exit 0 (no matching containers found)
-    run sudo pumba --runtime containerd --containerd-namespace moby --log-level debug netem --interface dummy0 --duration 2s delay --time 100 nonexistent_container_12345
+    run sudo pumba --runtime containerd --containerd-namespace moby --log-level debug netem --interface dummy0 --pull-image=false --duration 2s delay --time 100 nonexistent_container_12345
     assert_success
 }
 
 @test "Should apply loss-state model via containerd runtime" {
-    sudo pumba --runtime containerd --containerd-namespace moby --log-level debug netem --interface dummy0 --duration 30s loss-state --p13 5 --p31 15 --p32 10 --p23 20 --p14 5 test-netem-ctr &
+    sudo pumba --runtime containerd --containerd-namespace moby --log-level debug netem --interface dummy0 --pull-image=false --duration 30s loss-state --p13 5 --p31 15 --p32 10 --p23 20 --p14 5 test-netem-ctr &
     PUMBA_PID=$!
     sleep 2
 
@@ -157,7 +157,7 @@ teardown() {
 }
 
 @test "Should apply loss-gemodel model via containerd runtime" {
-    sudo pumba --runtime containerd --containerd-namespace moby --log-level debug netem --interface dummy0 --duration 30s loss-gemodel --pg 5 --pb 20 --one-h 80 --one-k 10 test-netem-ctr &
+    sudo pumba --runtime containerd --containerd-namespace moby --log-level debug netem --interface dummy0 --pull-image=false --duration 30s loss-gemodel --pg 5 --pb 20 --one-h 80 --one-k 10 test-netem-ctr &
     PUMBA_PID=$!
     sleep 2
 
@@ -178,7 +178,7 @@ teardown() {
 }
 
 @test "Should apply delay with normal distribution via containerd runtime" {
-    sudo pumba --runtime containerd --containerd-namespace moby --log-level debug netem --interface dummy0 --duration 30s delay --time 100 --jitter 30 --distribution normal test-netem-ctr &
+    sudo pumba --runtime containerd --containerd-namespace moby --log-level debug netem --interface dummy0 --pull-image=false --duration 30s delay --time 100 --jitter 30 --distribution normal test-netem-ctr &
     PUMBA_PID=$!
     sleep 2
 
@@ -200,7 +200,7 @@ teardown() {
 }
 
 @test "Should apply rate limit with cell options via containerd runtime" {
-    sudo pumba --runtime containerd --containerd-namespace moby --log-level debug netem --interface dummy0 --duration 30s rate --rate 1mbit --packetoverhead 10 --cellsize 1500 --celloverhead 20 test-netem-ctr &
+    sudo pumba --runtime containerd --containerd-namespace moby --log-level debug netem --interface dummy0 --pull-image=false --duration 30s rate --rate 1mbit --packetoverhead 10 --cellsize 1500 --celloverhead 20 test-netem-ctr &
     PUMBA_PID=$!
     sleep 2
 
@@ -222,7 +222,7 @@ teardown() {
 }
 
 @test "Should apply rate limiting via containerd runtime" {
-    sudo pumba --runtime containerd --containerd-namespace moby --log-level debug netem --interface dummy0 --duration 30s rate --rate 100kbit test-netem-ctr &
+    sudo pumba --runtime containerd --containerd-namespace moby --log-level debug netem --interface dummy0 --pull-image=false --duration 30s rate --rate 100kbit test-netem-ctr &
     PUMBA_PID=$!
     sleep 2
 
@@ -244,7 +244,7 @@ teardown() {
 }
 
 @test "Should apply netem delay with egress port filter via containerd runtime" {
-    sudo pumba --runtime containerd --containerd-namespace moby --log-level debug netem --interface dummy0 --egress-port 80 --duration 30s delay --time 100 test-netem-ctr &
+    sudo pumba --runtime containerd --containerd-namespace moby --log-level debug netem --interface dummy0 --pull-image=false --egress-port 80 --duration 30s delay --time 100 test-netem-ctr &
     PUMBA_PID=$!
     sleep 2
 
@@ -262,7 +262,7 @@ teardown() {
 }
 
 @test "Should apply netem delay with ingress port filter via containerd runtime" {
-    sudo pumba --runtime containerd --containerd-namespace moby --log-level debug netem --interface dummy0 --ingress-port 443 --duration 30s delay --time 100 test-netem-ctr &
+    sudo pumba --runtime containerd --containerd-namespace moby --log-level debug netem --interface dummy0 --pull-image=false --ingress-port 443 --duration 30s delay --time 100 test-netem-ctr &
     PUMBA_PID=$!
     sleep 2
 

tests/containerd_sidecar.bats

@@ -10,8 +10,9 @@ setup() {
     require_containerd
     sudo ctr -n moby t kill -s SIGKILL test-sidecar-target >/dev/null 2>&1 || true
     sudo ctr -n moby c rm test-sidecar-target >/dev/null 2>&1 || true
-    # Use plain alpine — no tc tools installed
+    # Use plain alpine — no tc tools installed; pre-pull sidecar image too
     ctr_pull_image moby docker.io/library/alpine:latest
+    ctr_pull_image moby docker.io/nicolaka/netshoot:latest
     # Create with a dummy network interface for testing
     sudo ctr -n moby run -d --privileged docker.io/library/alpine:latest test-sidecar-target \
         sh -c "ip link add dummy0 type dummy && ip link set dummy0 up && sleep infinity" >/dev/null 2>&1
@@ -33,7 +34,7 @@ teardown() {
 @test "Should apply netem delay via sidecar container (tc-image)" {
     # Run pumba with --tc-image to use sidecar approach
     # The target container (alpine) does NOT have tc installed
-    sudo pumba --runtime containerd --containerd-namespace moby --log-level debug netem --interface dummy0 --tc-image docker.io/nicolaka/netshoot:latest --duration 30s delay --time 100 test-sidecar-target &
+    sudo pumba --runtime containerd --containerd-namespace moby --log-level debug netem --interface dummy0 --tc-image docker.io/nicolaka/netshoot:latest --pull-image=false --duration 30s delay --time 100 test-sidecar-target &
     PUMBA_PID=$!
     sleep 3