Merge pull request #576 from ginglis13/soci-configure-k8s-containerd

Configure soci-snapshotter for containerd and kubernetes

Author: ginglis13

packages/containerd-1.7/1003-config-change-Plugins-type-from-toml.Tree-to-interfa.patch

@@ -0,0 +1,55 @@
+From dd3763194ff68b597bc8079ab21ffa60489e0c0b Mon Sep 17 00:00:00 2001
+From: Gavin Inglis <[email protected]>
+Date: Tue, 22 Jul 2025 23:49:53 +0000
+Subject: [PATCH] config: change Plugins type from toml.Tree to interface{}
+
+In order to bring 2.0 config parsing parity to containerd-1.7 in terms
+of merge behavior, the type of Plugins must be made a generic
+interface{} and unmarshalling adjust accordingly. This tree structure
+resulted in higher level nodes being affected by changes to children and
+leaves and reset to their defaults.
+
+Signed-off-by: Gavin Inglis <[email protected]>
+---
+ services/server/config/config.go | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/services/server/config/config.go b/services/server/config/config.go
+index e3fac1d82..1c663d99a 100644
+--- a/services/server/config/config.go
++++ b/services/server/config/config.go
+@@ -18,6 +18,7 @@ package config
+ 
+ import (
+ 	"fmt"
++	"io"
+ 	"path/filepath"
+ 	"strings"
+ 
+@@ -58,7 +59,7 @@ type Config struct {
+ 	// required plugin doesn't exist or fails to be initialized or started.
+ 	RequiredPlugins []string `toml:"required_plugins"`
+ 	// Plugins provides plugin specific configuration for the initialization of a plugin
+-	Plugins map[string]toml.Tree `toml:"plugins"`
++	Plugins map[string]interface{} `toml:"plugins"`
+ 	// OOMScore adjust the containerd's oom score
+ 	OOMScore int `toml:"oom_score"`
+ 	// Cgroup specifies cgroup information for the containerd daemon process
+@@ -187,7 +188,13 @@ func (c *Config) Decode(p *plugin.Registration) (interface{}, error) {
+ 	if !ok {
+ 		return p.Config, nil
+ 	}
+-	if err := data.Unmarshal(p.Config); err != nil {
++	r, w := io.Pipe()
++	go func() {
++		err := toml.NewEncoder(w).Encode(data)
++		w.CloseWithError(err)
++	}()
++
++	if err := toml.NewDecoder(r).Decode(p.Config); err != nil {
+ 		return nil, err
+ 	}
+ 	return p.Config, nil
+-- 
+2.47.1
+

packages/containerd-1.7/1004-Allow-sections-of-Plugins-to-be-merged-and-not-overw.patch

@@ -0,0 +1,31 @@
+From a21e379b69916558c1771b086a4a17b0a58f7cc1 Mon Sep 17 00:00:00 2001
+From: Ray Burgemeestre <[email protected]>
+Date: Thu, 21 Mar 2024 12:00:24 +0100
+Subject: [PATCH] Allow sections of Plugins to be merged, and not overwritten
+ as entire sections.
+
+See for rationale the Pull Request description. Added unit test to
+demonstrate the difference of this change.
+
+Signed-off-by: Ray Burgemeestre <[email protected]>
+Signed-off-by: Gavin Inglis <[email protected]>
+---
+ services/server/config/config.go      |  4 --
+ services/server/config/config_test.go | 73 +++++++++++++++++++++
+ 2 files changed, 73 insertions(+), 4 deletions(-)
+
+diff --git a/services/server/config/config.go b/services/server/config/config.go
+index c77f165e4..24687b873 100644
+--- a/services/server/config/config.go
++++ b/services/server/config/config.go
+@@ -412,10 +412,6 @@ func mergeConfig(to, from *Config) error {
+ 	}
+ 
+ 	// Replace entire sections instead of merging map's values.
+-	for k, v := range from.Plugins {
+-		to.Plugins[k] = v
+-	}
+-
+ 	for k, v := range from.StreamProcessors {
+ 		to.StreamProcessors[k] = v
+ 	}

packages/containerd-1.7/containerd-1.7.spec

@@ -23,6 +23,7 @@ Source3: containerd-config-toml_basic
 Source4: containerd-config-toml_k8s_nvidia_containerd_sock
 Source5: containerd-tmpfiles.conf
 Source6: containerd-cri-base-json
+Source7: snapshotter-toml
 
 # Mount for writing containerd configuration
 Source100: etc-containerd.mount
@@ -39,6 +40,10 @@ Source1000: clarify.toml
 # Backport of upstream patches for igzip support.
 Patch1001: 1001-Use-Intel-ISA-L-s-igzip-if-available.patch
 Patch1002: 1002-Skip-exec.LookPath-if-a-specific-gzip-implementation.patch
+# Patch to modify type of Plugins for config merge behavior.
+Patch1003: 1003-config-change-Plugins-type-from-toml.Tree-to-interfa.patch
+# Backport of upstream patch for config merge behavior.
+Patch1004: 1004-Allow-sections-of-Plugins-to-be-merged-and-not-overw.patch
 
 BuildRequires: git
 BuildRequires: %{_cross_os}glibc-devel
@@ -141,7 +146,7 @@ install -p -m 0644 %{S:1} %{S:100} %{S:110} %{buildroot}%{_cross_unitdir}
 
 install -d %{buildroot}%{_cross_templatedir}
 install -d %{buildroot}%{_cross_factorydir}%{_cross_sysconfdir}/containerd
-install -p -m 0644 %{S:2} %{S:3} %{S:4} %{S:6} %{buildroot}%{_cross_templatedir}
+install -p -m 0644 %{S:2} %{S:3} %{S:4} %{S:6} %{S:7} %{buildroot}%{_cross_templatedir}
 
 install -d %{buildroot}%{_cross_tmpfilesdir}
 install -p -m 0644 %{S:5} %{buildroot}%{_cross_tmpfilesdir}/containerd.conf
@@ -162,6 +167,7 @@ install -p -m 0644 %{S:201} %{buildroot}%{_cross_unitdir}/containerd.service.d/0
 %dir %{_cross_factorydir}%{_cross_sysconfdir}/containerd
 %{_cross_templatedir}/containerd-config-toml*
 %{_cross_templatedir}/containerd-cri-base-json
+%{_cross_templatedir}/snapshotter-toml
 %{_cross_tmpfilesdir}/containerd.conf
 
 %files bin

packages/containerd-1.7/containerd-config-toml_k8s_containerd_sock

@@ -15,6 +15,8 @@ disabled_plugins = [
     "io.containerd.snapshotter.v1.zfs",
 ]
 
+imports = ["/etc/containerd/config.d/*.toml"]
+
 [grpc]
 address = "/run/containerd/containerd.sock"
 

packages/containerd-1.7/containerd-config-toml_k8s_nvidia_containerd_sock

@@ -15,6 +15,8 @@ disabled_plugins = [
     "io.containerd.snapshotter.v1.zfs",
 ]
 
+imports = ["/etc/containerd/config.d/*.toml"]
+
 [grpc]
 address = "/run/containerd/containerd.sock"
 

packages/containerd-1.7/containerd-tmpfiles.conf

@@ -1 +1,2 @@
 d /etc/cni/net.d - - - -
+d /etc/containerd/config.d - - - -

packages/containerd-1.7/snapshotter-toml

@@ -0,0 +1,20 @@
+[required-extensions]
+container-runtime = "v1"
+std = { version = "v1" }
++++
+{{#if settings.container-runtime.snapshotter}}
+{{#if (eq settings.container-runtime.snapshotter "soci" )}}
+[plugins."io.containerd.grpc.v1.cri".containerd]
+snapshotter = "soci"
+disable_snapshot_annotations = false
+# Plug soci snapshotter into containerd
+[proxy_plugins.soci]
+type = "snapshot"
+address = "/run/soci-snapshotter/soci-snapshotter.sock"
+[proxy_plugins.soci.exports]
+root = "/var/lib/soci-snapshotter"
+{{else}}
+[plugins."io.containerd.grpc.v1.cri".containerd]
+snapshotter = "overlayfs"
+{{/if}}
+{{/if}}

packages/containerd-2.0/containerd-2.0.spec

@@ -23,6 +23,7 @@ Source3: containerd-config-toml_basic
 Source4: containerd-config-toml_k8s_nvidia_containerd_sock
 Source5: containerd-tmpfiles.conf
 Source6: containerd-cri-base-json
+Source7: snapshotter-toml
 
 # Mount for writing containerd configuration
 Source100: etc-containerd.mount
@@ -136,7 +137,7 @@ install -p -m 0644 %{S:1} %{S:100} %{S:110} %{buildroot}%{_cross_unitdir}
 
 install -d %{buildroot}%{_cross_templatedir}
 install -d %{buildroot}%{_cross_factorydir}%{_cross_sysconfdir}/containerd
-install -p -m 0644 %{S:2} %{S:3} %{S:4} %{S:6} %{buildroot}%{_cross_templatedir}
+install -p -m 0644 %{S:2} %{S:3} %{S:4} %{S:6} %{S:7} %{buildroot}%{_cross_templatedir}
 
 install -d %{buildroot}%{_cross_tmpfilesdir}
 install -p -m 0644 %{S:5} %{buildroot}%{_cross_tmpfilesdir}/containerd.conf
@@ -157,6 +158,7 @@ install -p -m 0644 %{S:201} %{buildroot}%{_cross_unitdir}/containerd.service.d/0
 %dir %{_cross_factorydir}%{_cross_sysconfdir}/containerd
 %{_cross_templatedir}/containerd-config-toml*
 %{_cross_templatedir}/containerd-cri-base-json
+%{_cross_templatedir}/snapshotter-toml
 %{_cross_tmpfilesdir}/containerd.conf
 
 %files bin

packages/containerd-2.0/containerd-config-toml_k8s_containerd_sock

@@ -14,6 +14,8 @@ disabled_plugins = [
     "io.containerd.snapshotter.v1.zfs",
 ]
 
+imports = ["/etc/containerd/config.d/*.toml"]
+
 [grpc]
 address = "/run/containerd/containerd.sock"
 

packages/containerd-2.0/containerd-config-toml_k8s_nvidia_containerd_sock

@@ -14,6 +14,8 @@ disabled_plugins = [
     "io.containerd.snapshotter.v1.zfs",
 ]
 
+imports = ["/etc/containerd/config.d/*.toml"]
+
 [grpc]
 address = "/run/containerd/containerd.sock"