Skip to content

Commit 1b9aeb7

Browse files
KCSeshKCSesh
committed
packages: add containerd-2.1
Signed-off-by: Kyle Sessions <[email protected]>
1 parent 656b86b commit 1b9aeb7

18 files changed

+800
-0
lines changed

‎Cargo.lock‎

Lines changed: 8 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎Cargo.toml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ members = [
1616
"packages/conntrack-tools",
1717
"packages/containerd-1.7",
1818
"packages/containerd-2.0",
19+
"packages/containerd-2.1",
1920
"packages/coreutils",
2021
"packages/libcryptsetup",
2122
"packages/dbus-broker",

‎kits/bottlerocket-core-kit/Cargo.toml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@ cni-plugins = { path = "../../packages/cni-plugins" }
2626
conntrack-tools = { path = "../../packages/conntrack-tools" }
2727
containerd-1_7 = { path = "../../packages/containerd-1.7" }
2828
containerd-2_0 = { path = "../../packages/containerd-2.0" }
29+
containerd-2_1 = { path = "../../packages/containerd-2.1" }
2930
coreutils = { path = "../../packages/coreutils" }
3031
dbus-broker = { path = "../../packages/dbus-broker" }
3132
docker-cli = { path = "../../packages/docker-cli" }

‎packages/containerd-2.1/1001-Revert-Don-t-allow-io_uring-related-syscalls-in-the-.patch‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
From f6f4f959862cad73cc44d07b088f449ae6c69066 Mon Sep 17 00:00:00 2001
2+
From: Henry Wang <[email protected]>
3+
Date: Thu, 10 Apr 2025 20:50:50 +0000
4+
Subject: [PATCH] Revert "Don't allow io_uring related syscalls in the
5+
RuntimeDefault seccomp profile."
6+
7+
This reverts commit a48ddf4a208b24eadea82f0eac62e236f2acf004.
8+
---
9+
contrib/seccomp/seccomp_default.go | 3 +++
10+
contrib/seccomp/seccomp_default_test.go | 36 -------------------------
11+
2 files changed, 3 insertions(+), 36 deletions(-)
12+
delete mode 100644 contrib/seccomp/seccomp_default_test.go
13+
14+
diff --git a/contrib/seccomp/seccomp_default.go b/contrib/seccomp/seccomp_default.go
15+
index 55d673fcb..1135f2391 100644
16+
--- a/contrib/seccomp/seccomp_default.go
17+
+++ b/contrib/seccomp/seccomp_default.go
18+
@@ -188,6 +188,9 @@ func DefaultProfile(sp *specs.Spec) *specs.LinuxSeccomp {
19+
"ioprio_set",
20+
"io_setup",
21+
"io_submit",
22+
+ "io_uring_enter",
23+
+ "io_uring_register",
24+
+ "io_uring_setup",
25+
"ipc",
26+
"kill",
27+
"landlock_add_rule",
28+
diff --git a/contrib/seccomp/seccomp_default_test.go b/contrib/seccomp/seccomp_default_test.go
29+
deleted file mode 100644
30+
index 53e386809..000000000
31+
--- a/contrib/seccomp/seccomp_default_test.go
32+
+++ /dev/null
33+
@@ -1,36 +0,0 @@
34+
-package seccomp
35+
-
36+
-import (
37+
- "testing"
38+
-
39+
- "github.com/opencontainers/runtime-spec/specs-go"
40+
-)
41+
-
42+
-func TestIOUringIsNotAllowed(t *testing.T) {
43+
-
44+
- disallowed := map[string]bool{
45+
- "io_uring_enter": true,
46+
- "io_uring_register": true,
47+
- "io_uring_setup": true,
48+
- }
49+
-
50+
- got := DefaultProfile(&specs.Spec{
51+
- Process: &specs.Process{
52+
- Capabilities: &specs.LinuxCapabilities{
53+
- Bounding: []string{},
54+
- },
55+
- },
56+
- })
57+
-
58+
- for _, config := range got.Syscalls {
59+
- if config.Action != specs.ActAllow {
60+
- continue
61+
- }
62+
-
63+
- for _, name := range config.Names {
64+
- if disallowed[name] {
65+
- t.Errorf("found disallowed io_uring related syscalls")
66+
- }
67+
- }
68+
- }
69+
-}
70+
--
71+
2.45.0
72+

‎packages/containerd-2.1/Cargo.toml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
[package]
2+
name = "containerd-2_1"
3+
version = "0.1.0"
4+
edition = "2021"
5+
publish = false
6+
build = "../build.rs"
7+
8+
[lib]
9+
path = "../packages.rs"
10+
11+
[package.metadata.build-package]
12+
package-name = "containerd-2.1"
13+
releases-url = "https://github.com/containerd/containerd/releases"
14+
15+
[[package.metadata.build-package.external-files]]
16+
url = "https://github.com/containerd/containerd/archive/v2.1.4/containerd-2.1.4.tar.gz"
17+
sha512 = "a9f84784e917621ee5ea38ad20b8106e642fbf463a00d319b73a1a8e4d1fdd5be2fba0789b6a5d31107ef239d3713eced99ce979d4b2764714271a63c0936c15"
18+
19+
[build-dependencies]
20+
glibc = { path = "../glibc" }

‎packages/containerd-2.1/clarify.toml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
[clarify."sigs.k8s.io/yaml"]
2+
expression = "MIT AND BSD-3-Clause"
3+
license-files = [
4+
{ path = "LICENSE", hash = 0x617d80bc },
5+
{ path = "goyaml.v2/LICENSE", hash = 0xe569d630 },
6+
{ path = "goyaml.v2/LICENSE.libyaml", hash = 0xa2e4ce3 },
7+
{ path = "goyaml.v2/NOTICE", hash = 0x49bceeb9 }
8+
9+
]
10+
11+
[clarify."github.com/grpc-ecosystem/go-grpc-middleware/v2"]
12+
expression = "Apache-2.0"
13+
license-files = [
14+
{ path = "COPYRIGHT", hash = 0x4bba7b1 },
15+
{ path = "LICENSE", hash = 0x6a39c900 }
16+
]

‎packages/containerd-2.1/containerd-2.1.spec‎

Lines changed: 179 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,179 @@
1+
%global goproject github.com/containerd
2+
%global gorepo containerd
3+
%global goimport %{goproject}/%{gorepo}
4+
5+
%global gover 2.1.4
6+
%global rpmver %{gover}
7+
%global gitrev 75cb2b7193e4e490e9fbdc236c0e811ccaba3376
8+
9+
%global package_priority_epoch 0
10+
%global _dwz_low_mem_die_limit 0
11+
12+
Name: %{_cross_os}%{gorepo}-2.1
13+
Version: %{rpmver}
14+
Release: 1%{?dist}
15+
Summary: An industry-standard container runtime
16+
License: Apache-2.0
17+
URL: https://%{goimport}
18+
Source0: https://%{goimport}/archive/v%{gover}/%{gorepo}-%{gover}.tar.gz
19+
Source1: containerd.service
20+
Source2: containerd-config-toml_k8s_containerd_sock
21+
Source3: containerd-config-toml_basic
22+
Source4: containerd-config-toml_k8s_nvidia_containerd_sock
23+
Source5: containerd-tmpfiles.conf
24+
Source6: containerd-cri-base-json
25+
Source7: snapshotter-toml
26+
27+
# Mount for writing containerd configuration
28+
Source100: etc-containerd.mount
29+
30+
# Create container storage mount point.
31+
Source110: prepare-var-lib-containerd.service
32+
33+
# Drop-ins to disable igzip or pigz if the other implementation is preferred.
34+
Source200: containerd-disable-igzip.conf
35+
Source201: containerd-disable-pigz.conf
36+
37+
Source1000: clarify.toml
38+
39+
# Patch to support moving from containerd-1.7 to 2.x
40+
Patch1001: 1001-Revert-Don-t-allow-io_uring-related-syscalls-in-the-.patch
41+
42+
BuildRequires: git
43+
BuildRequires: %{_cross_os}glibc-devel
44+
Requires: %{_cross_os}runc
45+
Requires: %{name}(optimized-gunzip)
46+
Requires: %{name}(binaries)
47+
48+
Provides: %{_cross_os}%{gorepo} = %{package_priority_epoch}:
49+
Conflicts: %{_cross_os}%{gorepo}
50+
51+
%description
52+
%{summary}.
53+
54+
%package bin
55+
Summary: An industry-standard container runtime's binaries
56+
Provides: %{name}(binaries)
57+
Requires: (%{_cross_os}image-feature(no-fips) and %{name})
58+
Conflicts: (%{_cross_os}image-feature(fips) or %{name}-fips-bin)
59+
60+
%description bin
61+
%{summary}.
62+
63+
%package fips-bin
64+
Summary: An industry-standard container runtime's binaries, FIPS edition
65+
Provides: %{name}(binaries)
66+
Requires: (%{_cross_os}image-feature(fips) and %{name})
67+
Conflicts: (%{_cross_os}image-feature(no-fips) or %{name}-bin)
68+
69+
%description fips-bin
70+
%{summary}.
71+
72+
%package pigz
73+
Summary: Prefer pigz for gzip decompression
74+
Requires: %{_cross_os}pigz
75+
Requires: %{name}
76+
Provides: %{_cross_os}%{gorepo}-pigz = %{package_priority_epoch}:
77+
Conflicts: %{name}-igzip
78+
Provides: %{name}(optimized-gunzip) = 1:
79+
80+
%description pigz
81+
%{summary}.
82+
83+
%package igzip
84+
Summary: Prefer igzip for gzip decompression
85+
Requires: %{_cross_os}igzip
86+
Requires: %{name}
87+
Provides: %{_cross_os}%{gorepo}-igzip = %{package_priority_epoch}:
88+
Conflicts: %{name}-pigz
89+
%if "%{_cross_arch}" == "x86_64"
90+
Provides: %{name}(optimized-gunzip) = 2:
91+
%else
92+
Provides: %{name}(optimized-gunzip) = 0:
93+
%endif
94+
95+
%description igzip
96+
%{summary}.
97+
98+
%prep
99+
%autosetup -Sgit -n %{gorepo}-%{gover} -p1
100+
101+
%build
102+
%set_cross_go_flags
103+
104+
export BUILDTAGS="no_btrfs selinux"
105+
export LD_VERSION="-X github.com/containerd/containerd/v2/version.Version=%{gover}+bottlerocket"
106+
export LD_REVISION="-X github.com/containerd/containerd/v2/version.Revision=%{gitrev}"
107+
108+
declare -a BUILD_ARGS
109+
BUILD_ARGS=(
110+
-tags="${BUILDTAGS}"
111+
-ldflags="${GOLDFLAGS} ${LD_VERSION} ${LD_REVISION}"
112+
)
113+
114+
for bin in \
115+
containerd \
116+
containerd-shim-runc-v2 \
117+
ctr ;
118+
do
119+
go build "${BUILD_ARGS[@]}" -o ${bin} ./cmd/${bin}
120+
gofips build "${BUILD_ARGS[@]}" -o fips/${bin} ./cmd/${bin}
121+
done
122+
123+
%install
124+
install -d %{buildroot}{%{_cross_bindir},%{_cross_fips_bindir}}
125+
for bin in \
126+
containerd \
127+
containerd-shim-runc-v2 \
128+
ctr ;
129+
do
130+
install -p -m 0755 ${bin} %{buildroot}%{_cross_bindir}
131+
install -p -m 0755 fips/${bin} %{buildroot}%{_cross_fips_bindir}
132+
done
133+
134+
install -d %{buildroot}%{_cross_unitdir}
135+
install -p -m 0644 %{S:1} %{S:100} %{S:110} %{buildroot}%{_cross_unitdir}
136+
137+
install -d %{buildroot}%{_cross_templatedir}
138+
install -d %{buildroot}%{_cross_factorydir}%{_cross_sysconfdir}/containerd
139+
install -p -m 0644 %{S:2} %{S:3} %{S:4} %{S:6} %{S:7} %{buildroot}%{_cross_templatedir}
140+
141+
install -d %{buildroot}%{_cross_tmpfilesdir}
142+
install -p -m 0644 %{S:5} %{buildroot}%{_cross_tmpfilesdir}/containerd.conf
143+
144+
install -d %{buildroot}%{_cross_unitdir}/containerd.service.d
145+
install -p -m 0644 %{S:200} %{buildroot}%{_cross_unitdir}/containerd.service.d/005-disable-igzip.conf
146+
install -p -m 0644 %{S:201} %{buildroot}%{_cross_unitdir}/containerd.service.d/005-disable-pigz.conf
147+
148+
%cross_scan_attribution --clarify %{S:1000} go-vendor vendor
149+
150+
%files
151+
%license LICENSE NOTICE
152+
%{_cross_attribution_file}
153+
%{_cross_attribution_vendor_dir}
154+
%{_cross_unitdir}/containerd.service
155+
%{_cross_unitdir}/etc-containerd.mount
156+
%{_cross_unitdir}/prepare-var-lib-containerd.service
157+
%dir %{_cross_factorydir}%{_cross_sysconfdir}/containerd
158+
%{_cross_templatedir}/containerd-config-toml*
159+
%{_cross_templatedir}/containerd-cri-base-json
160+
%{_cross_templatedir}/snapshotter-toml
161+
%{_cross_tmpfilesdir}/containerd.conf
162+
163+
%files bin
164+
%{_cross_bindir}/containerd
165+
%{_cross_bindir}/containerd-shim-runc-v2
166+
%{_cross_bindir}/ctr
167+
168+
%files fips-bin
169+
%{_cross_fips_bindir}/containerd
170+
%{_cross_fips_bindir}/containerd-shim-runc-v2
171+
%{_cross_fips_bindir}/ctr
172+
173+
%files pigz
174+
%{_cross_unitdir}/containerd.service.d/005-disable-igzip.conf
175+
176+
%files igzip
177+
%{_cross_unitdir}/containerd.service.d/005-disable-pigz.conf
178+
179+
%changelog

‎packages/containerd-2.1/containerd-config-toml_basic‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
+++
2+
version = 3
3+
root = "/var/lib/containerd"
4+
state = "/run/containerd"
5+
disabled_plugins = [
6+
"io.containerd.internal.v1.opt",
7+
"io.containerd.internal.v1.tracing",
8+
"io.containerd.snapshotter.v1.blockfile",
9+
"io.containerd.snapshotter.v1.devmapper",
10+
"io.containerd.snapshotter.v1.native",
11+
"io.containerd.snapshotter.v1.zfs",
12+
"io.containerd.grpc.v1.cri",
13+
"io.containerd.tracing.processor.v1.otlp",
14+
]
15+
16+
[grpc]
17+
address = "/run/containerd/containerd.sock"

0 commit comments

Comments
 (0)