[pull] main from containerd:main - #307
Open
pull[bot] wants to merge 1459 commits into
Open
Conversation
…ork-base-test-to-tigron test: refactor container_run_network_base_test.go to use Tigron
…t-linux-test-to-tigron test: refactor container_run_mount_linux_test.go to use Tigron
Read-only bind and volume mounts (`-v src:dst:ro`, `--mount ...,readonly`) are now made recursively read-only when the kernel (>= 5.12) and the OCI runtime (runc >= 1.1, crun >= 1.8.6) support the "rro" mount option, following Docker v25 (moby/moby#45278). The behavior is customizable with the `bind-recursive` option of `--mount` (docker/cli#4316): - `enabled` (default): recursive bind; recursively read-only when supported - `disabled`: non-recursive bind - `writable`: submounts of a read-only mount are kept writable (Docker v24 behavior) - `readonly`: force recursively read-only, or raise an error The boolean aliases of `bind-recursive` (unreleased) are removed, following docker/cli#4671. Whether the OCI runtime supports RRO mounts is detected by running `$RUNTIME features`, with the result cached in the XDG cache directory (e.g., ~/.cache/nerdctl/oci-runtime-features), invalidated when the runtime binary is modified. The old `rro` option of `-v` and `--mount`, introduced in nerdctl v0.14 ahead of Docker, is now deprecated in favor of the Docker v25 form: `--mount type=bind,src=...,dst=...,readonly,bind-propagation=rprivate,bind-recursive=readonly`. It now raises an error (instead of silently degrading to plain "ro") when RRO mounts are not supported. `nerdctl cp` now recognizes the "rro" mount option when refusing to copy into a read-only location. Fix issue 2651 Assisted-by: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
mount: support the Docker v25 form of recursive read-only (RRO) mounts
feat: label-based filtering added to `nerdctl events`
…range network create: match each --ip-range to its subnet for dual-stack
Docker's network create takes --ipv4 (default on) so that --ipv4=false together with --ipv6 yields an IPv6-only network. nerdctl had no equivalent: generateIPAM always appended a default IPv4 range when no v4 subnet was given, so every bridge network ended up with IPv4. Add the flag and carry it as a positive IPv4 option, matching the existing IPv6 field and docker's EnableIPv4. When IPv4 is off, skip the default v4 range, switch the host-local default route to ::/0, and reject an IPv4 subnet. Require at least one address family (docker's "IPv4 or IPv6 must be enabled"), and require an explicit IPv6 subnet since nerdctl does not auto-allocate one. Reject the combination on Windows where IPv6-only is unsupported. Part of #5012. Signed-off-by: Mayur Das <mayur.das@neevcloud.com>
Signed-off-by: Daniel Benjamin <benjamindaniel706@gmail.com>
Bumps [github.com/containerd/containerd/v2](https://github.com/containerd/containerd) from 2.3.2 to 2.3.3. - [Release notes](https://github.com/containerd/containerd/releases) - [Changelog](https://github.com/containerd/containerd/blob/main/RELEASES.md) - [Commits](containerd/containerd@v2.3.2...v2.3.3) --- updated-dependencies: - dependency-name: github.com/containerd/containerd/v2 dependency-version: 2.3.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [github.com/rootless-containers/rootlesskit/v3](https://github.com/rootless-containers/rootlesskit) from 3.0.1 to 3.0.2. - [Release notes](https://github.com/rootless-containers/rootlesskit/releases) - [Commits](rootless-containers/rootlesskit@v3.0.1...v3.0.2) --- updated-dependencies: - dependency-name: github.com/rootless-containers/rootlesskit/v3 dependency-version: 3.0.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
….com/rootless-containers/rootlesskit/v3-3.0.2 build(deps): bump github.com/rootless-containers/rootlesskit/v3 from 3.0.1 to 3.0.2
….com/containerd/containerd/v2-2.3.3 build(deps): bump github.com/containerd/containerd/v2 from 2.3.2 to 2.3.3
Signed-off-by: Mujib Ahasan <ahasanmujib8@gmail.com> test case added Signed-off-by: Mujib Ahasan <ahasanmujib8@gmail.com>
update containerd (2.3.3)
update RootlessKit (3.0.2)
Signed-off-by: akshitguptaa <akshitguptaa29@gmail.com>
Signed-off-by: akshitguptaa <akshitguptaa29@gmail.com>
feat(network): add --ipv4 to allow IPv6-only networks
feat(run): add support for `--expose` and `--publish-all`
fix: hide internal alias flags from help output
rootless: enable IPv6 in RootlessKit network namespace
Signed-off-by: s3onghyun <s3onghyun@users.noreply.github.com>
Add raw and zstd EROFS conversion support with containerd's EROFS converter. Fixes: #4861 Signed-off-by: Chengyu Zhu <hudson@cyzhu.com>
save: add --quiet/-q to suppress progress output
When the container side is a single port and the host side is a range (e.g. `-p 3000-3001:8080`), nerdctl now treats the range as a pool and binds the container port to the first free host port in it, using getUsedPorts to skip ports already in use, matching Docker's behavior. Previously the extra host ports were silently dropped. Genuine range/range mismatches of unequal length are still rejected. The host IP is validated and normalized once, and the pool test occupies the first port of a range and asserts the free successor is chosen, so it fails without this change (Linux-only; skipped in rootless). Signed-off-by: s3onghyun <s3onghyun@users.noreply.github.com>
Signed-off-by: Daniel Benjamin <benjamindaniel706@gmail.com>
The `--cpus` flag was incorrectly assigning opts.CpusetCpus to the CPU Cpus (cpuset) field. Persist the converted quota and period instead, matching how --cpu-quota and --cpu-period are applied. test: run update --cpus subtest against Docker The test-wide require.Not(nerdtest.Docker) prevented the --cpus subtest from running. Moved the docker skipping down to the subtests that need it so the --cpus subtest will run. The cpus subtest also is changed to verify against the container cgroup files but now requires cgroup v2. Closes #5066 Signed-off-by: Kevin Maris <kevin@kmaris.net>
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
….com/compose-spec/compose-go/v2-2.15.0 build(deps): bump github.com/compose-spec/compose-go/v2 from 2.14.0 to 2.15.0
….com/containerd/log-0.2.0 build(deps): bump github.com/containerd/log from 0.1.0 to 0.2.0
update RootlessKit (3.2.0-beta.0)
gomodjail v2 moves the focus from the dynamic (seccomp) mode to a static analysis gate: `gomodjail analyze` fails if a module annotated `gomodjail:confined` in go.mod can reach a denied capability (filesystem, network, process execution, raw syscalls, OS state modification, or cgo). - Dockerfile: bump GOMODJAIL_VERSION to v2.0.1. `gomodjail pack` is unchanged in v2, so the packed `nerdctl.gomodjail` binary (dynamic mode) keeps working as before. - Makefile: add `lint-gomodjail` / `lint-gomodjail-all` (part of `make lint`) and `fix-gomodjail` (part of `make fix`), and install gomodjail in `install-dev-tools`. The gate is only enforced for linux/amd64 and linux/arm64: these are the only platforms the packed binary is built for, and the only ones the dynamic mode supports. The verdicts are platform-dependent, hence both architectures are analyzed. - CI: add the `gomodjail` job to the lint workflow. - go.mod: `gomodjail fix` downgraded the annotation of the 39 modules that fail the gate to `gomodjail:unconfined`, so that the decision stays visible and reviewable. 57 modules remain confined (24 ok, 33 warnings, 0 violations). The inline annotations are also reformatted to `// gomodjail:...`, the style `gomodjail fix` writes, so that future fixes do not leave go.mod in two styles. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
Signed-off-by: Immanuel Tikhonov <pchpr.00@list.ru>
gomodjail: update to v2.0.1, enforce static analysis in CI
fix(login): accept equivalent registry hosts in auth creds callback
Assisted-by: Claude Opus 5 <noreply@anthropic.com> Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
Assisted-by: Claude Opus 5 <noreply@anthropic.com> Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
Assisted-by: Claude Opus 5 <noreply@anthropic.com> Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
Assisted-by: Claude Opus 5 <noreply@anthropic.com> Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
Assisted-by: Claude Opus 5 <noreply@anthropic.com> Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
Assisted-by: Claude Opus 5 <noreply@anthropic.com> Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
Assisted-by: Claude Opus 5 <noreply@anthropic.com> Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
Assisted-by: Claude Opus 5 <noreply@anthropic.com> Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
Aligns the Windows CI with the containerd version pinned in the Dockerfile. Assisted-by: Claude Opus 5 <noreply@anthropic.com> Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
Assisted-by: Claude Opus 5 <noreply@anthropic.com> Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
Assisted-by: Claude Opus 5 <noreply@anthropic.com> Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
Assisted-by: Claude Opus 5 <noreply@anthropic.com> Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
Some rules and linters are disabled to silence the errors introduced in this release of golangci-lint. The gofumpt `extra-rules` setting is deprecated in favor of the `extra` map; it is spelled out here as the three rules it used to imply, and the reformatting the new gofumpt wants in mod/tigron is applied. Assisted-by: Claude Opus 5 <noreply@anthropic.com> Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
Assisted-by: Claude Opus 5 <noreply@anthropic.com> Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
The pinned commit is the v1.2.2 tag, not an arbitrary main commit. Assisted-by: Claude Opus 5 <noreply@anthropic.com> Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
Move back to upstream google/go-licenses: the fork existed only to carry a dependency bump for Go 1.25 compatibility, and upstream v2.0.1 has since picked that up. Verified to report the same results as the fork on both modules. Assisted-by: Claude Opus 5 <noreply@anthropic.com> Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
The pinned commit is the v0.3.0 tag, not an arbitrary main commit. Assisted-by: Claude Opus 5 <noreply@anthropic.com> Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
update BuildKit (0.33.0), imgcrypt (2.0.3), fuse-overlayfs (1.18), and CI deps
Makefile: fix lint-licenses failing on MPL-2.0 (filepath-securejoin) (#5199)
fix: match ps --filter keys exactly instead of by prefix
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot] (v2.0.0-alpha.1)
Can you help keep this open source service alive? 💖 Please sponsor : )