Skip to content

Commit 99721c2

Browse files
AkihiroSudaAkihiroSuda
committed
Disable the support for Schema 1 images
Schema 1 (`application/vnd.docker.distribution.manifest.v1+prettyjws`) has been officially deprecated since containerd v1.7 (PR 6884). We have planned to remove the support for Schema 1 in containerd v2.0, but this removal may still surprise some users. So, in containerd v2.0 we will just disable it by default. The support for Schema 1 can be still enabled by setting an environment variable `CONTAINERD_ENABLE_DEPRECATED_PULL_SCHEMA_1_IMAGE=1`, however, this workaround will be completely removed in containerd v2.1. Schema 2 was introduced in Docker 1.10 (Feb 2016), so most users should have been already using Schema 2 or OCI. Signed-off-by: Akihiro Suda <[email protected]>
1 parent f1a3c37 commit 99721c2

File tree

7 files changed

+50
-16
lines changed

7 files changed

+50
-16
lines changed

‎RELEASES.md

Lines changed: 14 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -396,18 +396,20 @@ against total impact.
396396

397397
The deprecated features are shown in the following table:
398398

399-
| Component | Deprecation release | Target release for removal | Recommendation |
400-
|----------------------------------------------------------------------------------|---------------------|----------------------------|------------------------------------------|
401-
| Runtime V1 API and implementation (`io.containerd.runtime.v1.linux`) | containerd v1.4 | containerd v2.0 ✅ | Use `io.containerd.runc.v2` |
402-
| Runc V1 implementation of Runtime V2 (`io.containerd.runc.v1`) | containerd v1.4 | containerd v2.0 ✅ | Use `io.containerd.runc.v2` |
403-
| Built-in `aufs` snapshotter | containerd v1.5 | containerd v2.0 ✅ | Use `overlayfs` snapshotter |
404-
| Container label `containerd.io/restart.logpath` | containerd v1.5 | containerd v2.0 ✅ | Use `containerd.io/restart.loguri` label |
405-
| `cri-containerd-*.tar.gz` release bundles | containerd v1.6 | containerd v2.0 ✅ | Use `containerd-*.tar.gz` bundles |
406-
| Pulling Schema 1 images (`application/vnd.docker.distribution.manifest.v1+json`) | containerd v1.7 | containerd v2.0 | Use Schema 2 or OCI images |
407-
| CRI `v1alpha2` | containerd v1.7 | containerd v2.0 ✅ | Use CRI `v1` |
408-
| Legacy CRI implementation of podsandbox support | containerd v2.0 | containerd v2.0 ✅ | |
409-
| Go-Plugin library (`*.so`) as containerd runtime plugin | containerd v2.0 | containerd v2.1 | Use external plugins (proxy or binary) |
410-
399+
| Component | Deprecation release | Target release for removal | Recommendation |
400+
|----------------------------------------------------------------------------------|---------------------|---------------------------------------|------------------------------------------|
401+
| Runtime V1 API and implementation (`io.containerd.runtime.v1.linux`) | containerd v1.4 | containerd v2.0 ✅ | Use `io.containerd.runc.v2` |
402+
| Runc V1 implementation of Runtime V2 (`io.containerd.runc.v1`) | containerd v1.4 | containerd v2.0 ✅ | Use `io.containerd.runc.v2` |
403+
| Built-in `aufs` snapshotter | containerd v1.5 | containerd v2.0 ✅ | Use `overlayfs` snapshotter |
404+
| Container label `containerd.io/restart.logpath` | containerd v1.5 | containerd v2.0 ✅ | Use `containerd.io/restart.loguri` label |
405+
| `cri-containerd-*.tar.gz` release bundles | containerd v1.6 | containerd v2.0 ✅ | Use `containerd-*.tar.gz` bundles |
406+
| Pulling Schema 1 images (`application/vnd.docker.distribution.manifest.v1+json`) | containerd v1.7 | containerd v2.1 (Disabled in v2.0 ✅) | Use Schema 2 or OCI images |
407+
| CRI `v1alpha2` | containerd v1.7 | containerd v2.0 ✅ | Use CRI `v1` |
408+
| Legacy CRI implementation of podsandbox support | containerd v2.0 | containerd v2.0 ✅ | |
409+
| Go-Plugin library (`*.so`) as containerd runtime plugin | containerd v2.0 | containerd v2.1 | Use external plugins (proxy or binary) |
410+
411+
- Pulling Schema 1 images has been disabled in containerd v2.0, but it still can be enabled by setting an environment variable `CONTAINERD_ENABLE_DEPRECATED_PULL_SCHEMA_1_IMAGE=1`
412+
until containerd v2.1. `ctr` users have to specify `--local` too (e.g., `ctr images pull --local`).
411413

412414
### Deprecated config properties
413415
The deprecated properties in [`config.toml`](./docs/cri/config.md) are shown in the following table:

‎client/pull.go

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -197,7 +197,10 @@ func (c *Client) fetch(ctx context.Context, rCtx *RemoteContext, ref string, lim
197197
)
198198

199199
if desc.MediaType == images.MediaTypeDockerSchema1Manifest && rCtx.ConvertSchema1 {
200-
schema1Converter := schema1.NewConverter(store, fetcher)
200+
schema1Converter, err := schema1.NewConverter(store, fetcher)
201+
if err != nil {
202+
return images.Image{}, fmt.Errorf("failed to get converter for %q: %w", ref, err)
203+
}
201204

202205
handler = images.Handlers(append(rCtx.BaseHandlers, schema1Converter)...)
203206

‎core/remotes/docker/schema1/converter.go

Lines changed: 20 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@ import (
2727
"errors"
2828
"fmt"
2929
"io"
30+
"os"
3031
"strconv"
3132
"strings"
3233
"sync"
@@ -36,6 +37,7 @@ import (
3637
"github.com/containerd/containerd/v2/core/images"
3738
"github.com/containerd/containerd/v2/core/remotes"
3839
"github.com/containerd/containerd/v2/pkg/archive/compression"
40+
"github.com/containerd/containerd/v2/pkg/deprecation"
3941
"github.com/containerd/containerd/v2/pkg/labels"
4042
"github.com/containerd/errdefs"
4143
"github.com/containerd/log"
@@ -67,14 +69,30 @@ type Converter struct {
6769
layerBlobs map[digest.Digest]ocispec.Descriptor
6870
}
6971

72+
var ErrDisabled = fmt.Errorf("Pulling Schema 1 images have been deprecated and disabled by default since containerd v2.0. "+
73+
"As a workaround you may set an environment variable `%s=1`, but this will be completely removed in containerd v2.1.",
74+
deprecation.EnvPullSchema1Image)
75+
7076
// NewConverter returns a new converter
71-
func NewConverter(contentStore content.Store, fetcher remotes.Fetcher) *Converter {
77+
func NewConverter(contentStore content.Store, fetcher remotes.Fetcher) (*Converter, error) {
78+
s := os.Getenv(deprecation.EnvPullSchema1Image)
79+
if s == "" {
80+
return nil, ErrDisabled
81+
}
82+
enable, err := strconv.ParseBool(s)
83+
if err != nil {
84+
return nil, fmt.Errorf("failed to parse `%s=%s`: %w", deprecation.EnvPullSchema1Image, s, err)
85+
}
86+
if !enable {
87+
return nil, ErrDisabled
88+
}
89+
log.L.Warn(ErrDisabled)
7290
return &Converter{
7391
contentStore: contentStore,
7492
fetcher: fetcher,
7593
blobMap: map[digest.Digest]blobState{},
7694
layerBlobs: map[digest.Digest]ocispec.Descriptor{},
77-
}
95+
}, nil
7896
}
7997

8098
// Handle fetching descriptors for a docker media type

‎integration/client/client_test.go

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,7 @@ import (
4040
"github.com/containerd/containerd/v2/defaults"
4141
imagelist "github.com/containerd/containerd/v2/integration/images"
4242
"github.com/containerd/containerd/v2/internal/testutil"
43+
"github.com/containerd/containerd/v2/pkg/deprecation"
4344
"github.com/containerd/containerd/v2/pkg/namespaces"
4445
"github.com/containerd/errdefs"
4546
"github.com/containerd/log"
@@ -422,6 +423,7 @@ func TestImagePullSomePlatforms(t *testing.T) {
422423
}
423424

424425
func TestImagePullSchema1(t *testing.T) {
426+
t.Setenv(deprecation.EnvPullSchema1Image, "1")
425427
client, err := newClient(t, address)
426428
if err != nil {
427429
t.Fatal(err)

‎integration/client/client_unix_test.go

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@ import (
2323

2424
. "github.com/containerd/containerd/v2/client"
2525
"github.com/containerd/containerd/v2/integration/images"
26+
"github.com/containerd/containerd/v2/pkg/deprecation"
2627
"github.com/containerd/platforms"
2728
)
2829

@@ -46,6 +47,7 @@ var (
4647
)
4748

4849
func TestImagePullSchema1WithEmptyLayers(t *testing.T) {
50+
t.Setenv(deprecation.EnvPullSchema1Image, "1")
4951
client, err := newClient(t, address)
5052
if err != nil {
5153
t.Fatal(err)

‎integration/containerd_image_test.go

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@ import (
2828
containerd "github.com/containerd/containerd/v2/client"
2929
"github.com/containerd/containerd/v2/integration/images"
3030
"github.com/containerd/containerd/v2/internal/cri/labels"
31+
"github.com/containerd/containerd/v2/pkg/deprecation"
3132
"github.com/containerd/containerd/v2/pkg/namespaces"
3233
"github.com/containerd/errdefs"
3334
"github.com/stretchr/testify/assert"
@@ -267,6 +268,7 @@ func TestContainerdSandboxImagePulledOutsideCRI(t *testing.T) {
267268
}
268269

269270
func TestContainerdImageWithDockerSchema1(t *testing.T) {
271+
t.Setenv(deprecation.EnvPullSchema1Image, "1")
270272
if goruntime.GOOS == "windows" {
271273
t.Skip("Skipped on Windows because the test image is not a multi-platform one.")
272274
}

‎pkg/deprecation/deprecation.go

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,8 +33,13 @@ const (
3333
CRIRegistryConfigs Warning = Prefix + "cri-registry-configs"
3434
)
3535

36+
const (
37+
EnvPrefix = "CONTAINERD_ENABLE_DEPRECATED_"
38+
EnvPullSchema1Image = EnvPrefix + "PULL_SCHEMA_1_IMAGE"
39+
)
40+
3641
var messages = map[Warning]string{
37-
PullSchema1Image: "Schema 1 images are deprecated since containerd v1.7 and removed in containerd v2.0. " +
42+
PullSchema1Image: "Schema 1 images are deprecated since containerd v1.7, disabled in containerd v2.0, and will be removed in containerd v2.1. " +
3843
`Since containerd v1.7.8, schema 1 images are identified by the "io.containerd.image/converted-docker-schema1" label.`,
3944
GoPluginLibrary: "Dynamically-linked Go plugins as containerd runtimes are deprecated since containerd v2.0 and removed in containerd v2.1.",
4045
CRIRegistryMirrors: "The `mirrors` property of `[plugins.\"io.containerd.grpc.v1.cri\".registry]` is deprecated since containerd v1.5 and will be removed in containerd v2.0." +

0 commit comments

Comments
 (0)