From 7df6bb0a67eff453df5a7b753704edb574d8f326 Mon Sep 17 00:00:00 2001 From: Maksym Pavlenko Date: Thu, 30 Jul 2026 15:38:50 -0700 Subject: [PATCH 1/2] erofs: allow multiple layer content cache directories The layer content cache was a single directory, so every source of pre-converted blobs had to be merged into one tree. A shared read-only fleet cache, a host-local cache, and a per-image warm cache could not coexist. Replace layer_content_cache with layer_content_caches, a list. Each directory is checked in order and the first hit is staged into the snapshot; a layer found in none of them falls back to the normal download-and-convert path. Cache directories are no longer required to exist at startup. A missing one is indistinguishable from an empty one at lookup time (both are simply a miss), and it may well be mounted after the daemon starts, so the only check left is that each path is absolute -- a relative one would be symlinked into the snapshot dir and dangle. Signed-off-by: Maksym Pavlenko --- cmd/ctr/commands/images/build_erofs_cache.go | 2 +- plugins/snapshots/erofs/erofs.go | 143 +++++++++---------- plugins/snapshots/erofs/erofs_linux_test.go | 86 +++++++++-- plugins/snapshots/erofs/plugin/plugin.go | 14 +- 4 files changed, 156 insertions(+), 89 deletions(-) diff --git a/cmd/ctr/commands/images/build_erofs_cache.go b/cmd/ctr/commands/images/build_erofs_cache.go index 95220f8b88102..1c1c7dff9d002 100644 --- a/cmd/ctr/commands/images/build_erofs_cache.go +++ b/cmd/ctr/commands/images/build_erofs_cache.go @@ -44,7 +44,7 @@ var buildErofsCacheCommand = &cli.Command{ Description: `Convert each layer of an already-pulled image into a directory of diffID-keyed erofs blobs (///.erofs, where is the first two characters of ) for the erofs -snapshotter's layer_content_cache. Layers are read from the content store; no +snapshotter's layer_content_caches. Layers are read from the content store; no converted image is produced. The directory can then be synced to the read-only location the fleet mounts. Requires mkfs.erofs. diff --git a/plugins/snapshots/erofs/erofs.go b/plugins/snapshots/erofs/erofs.go index 4892bb420f2cc..46352cd4c01a4 100644 --- a/plugins/snapshots/erofs/erofs.go +++ b/plugins/snapshots/erofs/erofs.go @@ -52,12 +52,13 @@ type SnapshotterConfig struct { remapIDs bool // dmverityMode controls dm-verity behavior: "auto" (use if .dmverity exists), "on" (require .dmverity), "off" (disable) dmverityMode string - // layerContentCache is a directory of pre-converted, diffID-keyed erofs - // layer blobs. When set and an unpacked layer's blob is present, the - // snapshotter stages the blob (as a symlink) into the active snapshot, - // skipping the download and tar->erofs conversion. Only parentless Prepares - // can be served. Empty disables the feature. - layerContentCache string + // layerContentCaches lists directories of pre-converted, diffID-keyed erofs + // layer blobs. Each is checked one by one; the first hit is staged into the + // snapshot (symlinked) instead of downloading and converting the layer. A + // directory that doesn't exist is treated as a cache miss. Layers missing + // from all of them are converted normally. Only parentless Prepares can be + // served. + layerContentCaches []string } // Opt is an option to configure the erofs snapshotter @@ -105,13 +106,13 @@ func WithRemapIDs() Opt { } } -// WithLayerContentCache configures a read-only directory of pre-converted, +// WithLayerContentCaches configures read-only directories of pre-converted, // diffID-keyed erofs layer blobs that the snapshotter sources layers from on -// pull instead of downloading and converting them. See the layerContentCache +// pull instead of downloading and converting them. See the layerContentCaches // field for details. -func WithLayerContentCache(path string) Opt { +func WithLayerContentCaches(paths ...string) Opt { return func(config *SnapshotterConfig) { - config.layerContentCache = path + config.layerContentCaches = paths } } @@ -122,16 +123,16 @@ type MetaStore interface { } type snapshotter struct { - root string - ms MetaStore - ovlOptions []string - enableFsverity bool - setImmutable bool - defaultWritable int64 - blockMode bool - remapIDs bool - dmverityMode string - layerContentCache string + root string + ms MetaStore + ovlOptions []string + enableFsverity bool + setImmutable bool + defaultWritable int64 + blockMode bool + remapIDs bool + dmverityMode string + layerContentCaches []string } // NewSnapshotter returns a Snapshotter which uses EROFS+OverlayFS. The layers @@ -177,13 +178,25 @@ func NewSnapshotter(root string, opts ...Opt) (snapshots.Snapshotter, error) { // so fsverity and IMMUTABLE_FL can't be applied without mutating that blob out // from under other snapshots. Reject them explicitly instead of silently // skipping; dm-verity is the cache's integrity mechanism. - if config.layerContentCache != "" { + if len(config.layerContentCaches) > 0 { if config.enableFsverity { - return nil, fmt.Errorf("enable_fsverity is incompatible with layer_content_cache; use dm-verity for cache integrity") + return nil, fmt.Errorf("enable_fsverity is incompatible with layer_content_caches; use dm-verity for cache integrity") } if config.setImmutable { - return nil, fmt.Errorf("set_immutable is incompatible with layer_content_cache") + return nil, fmt.Errorf("set_immutable is incompatible with layer_content_caches") } + + // A cache dir is symlinked into snapshots, so a relative one would resolve + // against the snapshot dir and dangle. The check is only lexical: dirs are + // not required to exist, as a missing one just yields a cache miss and may + // well be provisioned after startup. + for _, dir := range config.layerContentCaches { + if !filepath.IsAbs(dir) { + return nil, fmt.Errorf("layer_content_caches %q must be an absolute path", dir) + } + } + + log.L.WithField("dirs", config.layerContentCaches).Info("erofs layer content cache enabled") } // Check fsverity support if enabled @@ -202,24 +215,6 @@ func NewSnapshotter(root string, opts ...Opt) (snapshots.Snapshotter, error) { return nil, fmt.Errorf("setting IMMUTABLE_FL is only supported on Linux") } - // Resolve the cache dir to an absolute path so materialized layer blobs are - // absolute symlinks, independent of the process working directory, and verify - // it exists and is a directory so misconfiguration fails fast at startup. - if config.layerContentCache != "" { - abs, err := filepath.Abs(config.layerContentCache) - if err != nil { - return nil, fmt.Errorf("failed to resolve layer_content_cache path %q: %w", config.layerContentCache, err) - } - fi, err := os.Stat(abs) - if err != nil { - return nil, fmt.Errorf("failed to access layer_content_cache %q: %w", abs, err) - } - if !fi.IsDir() { - return nil, fmt.Errorf("layer_content_cache %q is not a directory", abs) - } - config.layerContentCache = abs - } - ms, err := storage.NewMetaStore(filepath.Join(root, "metadata.db")) if err != nil { return nil, err @@ -230,16 +225,16 @@ func NewSnapshotter(root string, opts ...Opt) (snapshots.Snapshotter, error) { } return &snapshotter{ - root: root, - ms: ms, - ovlOptions: config.ovlOptions, - enableFsverity: config.enableFsverity, - setImmutable: config.setImmutable, - defaultWritable: config.defaultSize, - blockMode: config.defaultSize > 0, - remapIDs: config.remapIDs, - dmverityMode: config.dmverityMode, - layerContentCache: config.layerContentCache, + root: root, + ms: ms, + ovlOptions: config.ovlOptions, + enableFsverity: config.enableFsverity, + setImmutable: config.setImmutable, + defaultWritable: config.defaultSize, + blockMode: config.defaultSize > 0, + remapIDs: config.remapIDs, + dmverityMode: config.dmverityMode, + layerContentCaches: config.layerContentCaches, }, nil } @@ -700,21 +695,17 @@ func (s *snapshotter) Prepare(ctx context.Context, key, parent string, opts ...s return s.createSnapshot(ctx, snapshots.KindActive, key, parent, opts) } -// cacheBlobPath returns the expected path of the cached erofs blob for a diffID. -func (s *snapshotter) cacheBlobPath(diffID digest.Digest) string { - return erofsutils.CacheBlobPath(s.layerContentCache, diffID) -} - // lookupCache returns the absolute path of the cached erofs blob that can serve -// the layer being prepared, or "" on a miss. It gates on: the cache being -// configured, the Prepare being an image-layer extraction (carries the -// snapshot.ref and diff-id labels), and the diffID blob being present. Misses -// (cache disabled, non-extraction Prepare, missing entries, unreadable cache dirs -// such as a FUSE mount being down, malformed labels) all return "" so pulls keep -// working. Any dm-verity sidecar is derived from the blob path (via -// dmverity.MetadataPath) when the blob is materialized (prepareDirectory). +// the layer being prepared, or "" on a miss. It gates on: at least one cache +// being configured, the Prepare being an image-layer extraction (carries the +// snapshot.ref and diff-id labels), and the diffID blob being present. Caches +// are checked one by one and the first hit wins. Every miss (cache disabled, +// non-extraction Prepare, absent or unreadable cache dir, missing entry, +// malformed labels) returns "" so pulls keep working. Any dm-verity sidecar is +// derived from the blob path (via dmverity.MetadataPath) when the blob is +// staged (prepareDirectory). func (s *snapshotter) lookupCache(ctx context.Context, opts ...snapshots.Opt) string { - if s.layerContentCache == "" { + if len(s.layerContentCaches) == 0 { return "" } @@ -737,18 +728,24 @@ func (s *snapshotter) lookupCache(ctx context.Context, opts ...snapshots.Opt) st return "" } - blob := s.cacheBlobPath(diffID) - if _, err := os.Stat(blob); err != nil { - if os.IsNotExist(err) { - log.G(ctx).WithField("blob", blob).Trace("erofs layer cache miss") - } else { - log.G(ctx).WithError(err).WithField("blob", blob). - Warn("erofs layer cache: failed to stat cache blob, treating as cache miss") + for _, dir := range s.layerContentCaches { + blob := erofsutils.CacheBlobPath(dir, diffID) + if _, err := os.Stat(blob); err != nil { + if !os.IsNotExist(err) { + // An unreadable cache (a down FUSE mount, a permission change since + // startup) shouldn't fail the pull or mask a hit in a later cache. + log.G(ctx).WithError(err).WithField("blob", blob). + Warn("erofs layer cache: failed to stat cache blob, skipping this cache") + } + continue } - return "" + // Absolute, since the configured dirs are validated as such: the hit is + // symlinked into the snapshot dir, where a relative target would dangle. + return blob } - return blob + log.G(ctx).WithField("diffID", diffID.String()).Trace("erofs layer cache miss") + return "" } func (s *snapshotter) View(ctx context.Context, key, parent string, opts ...snapshots.Opt) ([]mount.Mount, error) { diff --git a/plugins/snapshots/erofs/erofs_linux_test.go b/plugins/snapshots/erofs/erofs_linux_test.go index fa08c2a1287bc..ec9c15c6b752b 100644 --- a/plugins/snapshots/erofs/erofs_linux_test.go +++ b/plugins/snapshots/erofs/erofs_linux_test.go @@ -990,7 +990,7 @@ func TestCacheHit(t *testing.T) { diffID := digest.Digest(cacheTestDiffID) blob := writeCacheBlob(t, cacheDir, diffID, []byte("fake erofs blob")) - s := newCacheSnapshotter(t, WithLayerContentCache(cacheDir)) + s := newCacheSnapshotter(t, WithLayerContentCaches(cacheDir)) target := cacheTestChainID key := stageCacheHit(t, ctx, s, target, diffID) @@ -1031,7 +1031,7 @@ func TestCacheSidecar(t *testing.T) { require.NoError(t, os.WriteFile(dmverity.MetadataPath(blob), []byte(testDmverityMetadata), 0644)) // dmverity_mode defaults to "auto": use the sidecar if present. - s := newCacheSnapshotter(t, WithLayerContentCache(cacheDir)) + s := newCacheSnapshotter(t, WithLayerContentCaches(cacheDir)) target := cacheTestChainID key := stageCacheHit(t, ctx, s, target, diffID) @@ -1078,7 +1078,7 @@ func TestCacheMiss(t *testing.T) { }) t.Run("blob absent", func(t *testing.T) { - s := newCacheSnapshotter(t, WithLayerContentCache(t.TempDir())) + s := newCacheSnapshotter(t, WithLayerContentCaches(t.TempDir())) mounts, err := s.Prepare(ctx, "extract-1 "+target, "", extractionOpt(target, diffID)) assertFellThrough(t, s, mounts, err, false) }) @@ -1086,7 +1086,7 @@ func TestCacheMiss(t *testing.T) { t.Run("no extraction labels", func(t *testing.T) { cacheDir := t.TempDir() writeCacheBlob(t, cacheDir, diffID, []byte("blob")) - s := newCacheSnapshotter(t, WithLayerContentCache(cacheDir)) + s := newCacheSnapshotter(t, WithLayerContentCaches(cacheDir)) // A container-rootfs Prepare carries no snapshot.ref/diff-id labels. mounts, err := s.Prepare(ctx, "container-rootfs", "") require.NoError(t, err) @@ -1096,7 +1096,7 @@ func TestCacheMiss(t *testing.T) { t.Run("view is never short-circuited", func(t *testing.T) { cacheDir := t.TempDir() writeCacheBlob(t, cacheDir, diffID, []byte("blob")) - s := newCacheSnapshotter(t, WithLayerContentCache(cacheDir)) + s := newCacheSnapshotter(t, WithLayerContentCaches(cacheDir)) // Even with matching labels and a cached blob, a View must not commit. // It's read-only, but via the KindView roFlag in mounts(), not the cache. mounts, err := s.View(ctx, "view-1", "", extractionOpt(target, diffID)) @@ -1122,7 +1122,7 @@ func TestCacheParentedPrepare(t *testing.T) { writeCacheBlob(t, cacheDir, parentDiffID, []byte("fake parent blob")) writeCacheBlob(t, cacheDir, childDiffID, []byte("fake child blob")) - s := newCacheSnapshotter(t, WithLayerContentCache(cacheDir)) + s := newCacheSnapshotter(t, WithLayerContentCaches(cacheDir)) // The first layer has no parent, so it is served from the cache as usual. require.NoError(t, s.Commit(ctx, parentChain, stageCacheHit(t, ctx, s, parentChain, parentDiffID))) @@ -1152,7 +1152,7 @@ func TestCacheRemove(t *testing.T) { sidecar := dmverity.MetadataPath(blob) require.NoError(t, os.WriteFile(sidecar, []byte(testDmverityMetadata), 0644)) - s := newCacheSnapshotter(t, WithLayerContentCache(cacheDir)) + s := newCacheSnapshotter(t, WithLayerContentCaches(cacheDir)) target := cacheTestChainID key := stageCacheHit(t, ctx, s, target, diffID) @@ -1189,7 +1189,7 @@ func TestCacheDmverity(t *testing.T) { blob := writeCacheBlob(t, cacheDir, diffID, []byte("fake erofs blob")) require.NoError(t, os.WriteFile(dmverity.MetadataPath(blob), []byte(testDmverityMetadata), 0644)) - s := newCacheSnapshotter(t, WithLayerContentCache(cacheDir), WithDmverityMode("on")) + s := newCacheSnapshotter(t, WithLayerContentCaches(cacheDir), WithDmverityMode("on")) key := stageCacheHit(t, ctx, s, target, diffID) _, err := os.Stat(dmverity.MetadataPath(s.layerBlobPath(snapshotID(t, ctx, s, key)))) @@ -1200,7 +1200,7 @@ func TestCacheDmverity(t *testing.T) { cacheDir := t.TempDir() writeCacheBlob(t, cacheDir, diffID, []byte("fake erofs blob")) // no sidecar - s := newCacheSnapshotter(t, WithLayerContentCache(cacheDir), WithDmverityMode("on")) + s := newCacheSnapshotter(t, WithLayerContentCaches(cacheDir), WithDmverityMode("on")) // dmverity_mode=on requires a sidecar; a cache entry without one is a hard // error rather than a silent fallback. @@ -1211,3 +1211,71 @@ func TestCacheDmverity(t *testing.T) { assert.Error(t, err, "no snapshot should be committed on failure") }) } + +// TestCacheMultipleDirs covers the layer_content_caches search path: directories +// are searched in configured order, the first hit wins, later caches are reached +// when earlier ones lack the blob, and a miss in every cache falls through to a +// normal writable snapshot. +func TestCacheMultipleDirs(t *testing.T) { + ctx := namespaces.WithNamespace(context.Background(), "test") + diffID := digest.Digest(cacheTestDiffID) + target := cacheTestChainID + + // stagedBlob returns the cache blob the snapshot's layer.erofs symlink points + // at, i.e. which of the configured caches actually served the layer. + stagedBlob := func(t *testing.T, s *snapshotter, key string) string { + t.Helper() + dst, err := os.Readlink(s.layerBlobPath(snapshotID(t, ctx, s, key))) + require.NoError(t, err) + return dst + } + + t.Run("first cache with the blob wins", func(t *testing.T) { + first, second := t.TempDir(), t.TempDir() + // Both caches hold the diffID; the earlier one must be the one used. + firstBlob := writeCacheBlob(t, first, diffID, []byte("from first")) + writeCacheBlob(t, second, diffID, []byte("from second")) + + s := newCacheSnapshotter(t, WithLayerContentCaches(first, second)) + key := stageCacheHit(t, ctx, s, target, diffID) + assert.Equal(t, firstBlob, stagedBlob(t, s, key)) + }) + + t.Run("falls through to a later cache", func(t *testing.T) { + empty, populated := t.TempDir(), t.TempDir() + blob := writeCacheBlob(t, populated, diffID, []byte("from second")) + + s := newCacheSnapshotter(t, WithLayerContentCaches(empty, populated)) + key := stageCacheHit(t, ctx, s, target, diffID) + assert.Equal(t, blob, stagedBlob(t, s, key)) + }) + + t.Run("miss in every cache falls back to a writable snapshot", func(t *testing.T) { + s := newCacheSnapshotter(t, WithLayerContentCaches( + filepath.Join(t.TempDir(), "missing"), t.TempDir(), t.TempDir())) + + mounts, err := s.Prepare(ctx, "extract-1 "+target, "", extractionOpt(target, diffID)) + require.NoError(t, err) + require.NotEmpty(t, mounts) + for _, m := range mounts { + assert.False(t, m.ReadOnly(), "a miss in every cache must return writable mounts") + } + _, err = s.Stat(ctx, target) + assert.Error(t, err, "target chainID must not be committed on a miss") + }) +} + +// TestCacheDirMustBeAbsolute covers the one thing NewSnapshotter checks about a +// configured cache dir: it must be absolute, since a relative one would be +// symlinked into the snapshot dir and dangle. The empty string is covered by the +// same check, which otherwise resolves to the daemon's working directory. +func TestCacheDirMustBeAbsolute(t *testing.T) { + requireErofs(t) + + for _, dir := range []string{"relative-cache", "./cache", "", "a/b"} { + t.Run(fmt.Sprintf("%q", dir), func(t *testing.T) { + _, err := NewSnapshotter(t.TempDir(), WithLayerContentCaches(dir)) + assert.ErrorContains(t, err, "must be an absolute path") + }) + } +} diff --git a/plugins/snapshots/erofs/plugin/plugin.go b/plugins/snapshots/erofs/plugin/plugin.go index 0315e45564adc..008ddbd472d15 100644 --- a/plugins/snapshots/erofs/plugin/plugin.go +++ b/plugins/snapshots/erofs/plugin/plugin.go @@ -57,14 +57,16 @@ type Config struct { // Linux only DmverityMode string `toml:"dmverity_mode"` - // LayerContentCache is a directory of pre-converted, diffID-keyed erofs - // layer blobs. When set, layers already present in the cache are committed - // without being downloaded or converted. Empty disables the feature. + // LayerContentCaches lists directories of pre-converted, diffID-keyed erofs + // layer blobs. Each is checked one by one and the first hit is used instead + // of downloading and converting the layer; a directory that doesn't exist is + // treated as a cache miss. Layers missing from all of them are converted + // normally. // // Only layers prepared without a parent can be served from the cache. With // sequential unpacking that is the first layer alone, so getting hits for a // whole image needs max_concurrent_unpacks > 1, which is not the default. - LayerContentCache string `toml:"layer_content_cache"` + LayerContentCaches []string `toml:"layer_content_caches"` } func init() { @@ -110,8 +112,8 @@ func init() { opts = append(opts, erofs.WithDmverityMode(config.DmverityMode)) } - if config.LayerContentCache != "" { - opts = append(opts, erofs.WithLayerContentCache(config.LayerContentCache)) + if len(config.LayerContentCaches) > 0 { + opts = append(opts, erofs.WithLayerContentCaches(config.LayerContentCaches...)) } // Don't bother supporting overlay's slow_chown, only RemapIDs From a272df568584d45ccc559bd1019e748d604952cb Mon Sep 17 00:00:00 2001 From: Derek McGowan Date: Tue, 4 Aug 2026 19:43:54 -0700 Subject: [PATCH 2/2] Update api version to v1.12.0-beta.0 Signed-off-by: Derek McGowan --- go.mod | 4 +- go.sum | 2 + .../containerd/containerd/api/LICENSE | 191 ++++++++++++++++++ vendor/modules.txt | 3 +- 4 files changed, 195 insertions(+), 5 deletions(-) create mode 100644 vendor/github.com/containerd/containerd/api/LICENSE diff --git a/go.mod b/go.mod index 47453fd9b4e84..f4ecd005b11bb 100644 --- a/go.mod +++ b/go.mod @@ -12,7 +12,7 @@ require ( github.com/containerd/btrfs/v2 v2.0.0 github.com/containerd/cgroups/v3 v3.1.3 github.com/containerd/console v1.0.5 - github.com/containerd/containerd/api v1.11.0 + github.com/containerd/containerd/api v1.12.0-beta.0 github.com/containerd/continuity v0.5.0 github.com/containerd/errdefs v1.0.0 github.com/containerd/errdefs/pkg v0.3.0 @@ -164,5 +164,3 @@ require ( sigs.k8s.io/yaml v1.6.0 // indirect tags.cncf.io/container-device-interface/specs-go v1.1.0 // indirect ) - -replace github.com/containerd/containerd/api => ./api diff --git a/go.sum b/go.sum index 0025f43fd5845..53da3912c16dc 100644 --- a/go.sum +++ b/go.sum @@ -49,6 +49,8 @@ github.com/containerd/cgroups/v3 v3.1.3 h1:eUNflyMddm18+yrDmZPn3jI7C5hJ9ahABE5q6 github.com/containerd/cgroups/v3 v3.1.3/go.mod h1:PKZ2AcWmSBsY/tJUVhtS/rluX0b1uq1GmPO1ElCmbOw= github.com/containerd/console v1.0.5 h1:R0ymNeydRqH2DmakFNdmjR2k0t7UPuiOV/N/27/qqsc= github.com/containerd/console v1.0.5/go.mod h1:YynlIjWYF8myEu6sdkwKIvGQq+cOckRm6So2avqoYAk= +github.com/containerd/containerd/api v1.12.0-beta.0 h1:0eGYh95iM9nn8Fygpx+96LvYIuc5xOiHvwo5hrsvTlI= +github.com/containerd/containerd/api v1.12.0-beta.0/go.mod h1:/tQDq0fxPDGz9vrSpfhmFMfoR7s/uzvYMCY/qKygl9Y= github.com/containerd/continuity v0.5.0 h1:7a85HZpCSs+1Zps0Ee3DPSuAWY+0SJM1JNM51nlEVDg= github.com/containerd/continuity v0.5.0/go.mod h1:/lNJvtJKUQStBzpVQ1+rasXO1LAWtUQssk28EZvJ3nE= github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI= diff --git a/vendor/github.com/containerd/containerd/api/LICENSE b/vendor/github.com/containerd/containerd/api/LICENSE new file mode 100644 index 0000000000000..584149b6ee28c --- /dev/null +++ b/vendor/github.com/containerd/containerd/api/LICENSE @@ -0,0 +1,191 @@ + + Apache License + Version 2.0, January 2004 + https://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + Copyright The containerd Authors + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + https://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. diff --git a/vendor/modules.txt b/vendor/modules.txt index 4996f802a0c24..c7eed28f709f3 100644 --- a/vendor/modules.txt +++ b/vendor/modules.txt @@ -157,7 +157,7 @@ github.com/containerd/cgroups/v3/cgroup2/stats # github.com/containerd/console v1.0.5 ## explicit; go 1.13 github.com/containerd/console -# github.com/containerd/containerd/api v1.11.0 => ./api +# github.com/containerd/containerd/api v1.12.0-beta.0 ## explicit; go 1.25.0 github.com/containerd/containerd/api/events github.com/containerd/containerd/api/runtime/bootstrap/v1 @@ -1047,4 +1047,3 @@ tags.cncf.io/container-device-interface/pkg/parser # tags.cncf.io/container-device-interface/specs-go v1.1.0 ## explicit; go 1.19 tags.cncf.io/container-device-interface/specs-go -# github.com/containerd/containerd/api => ./api