From a42b09aaa6719d5956b72fd6a2c6c164970bece2 Mon Sep 17 00:00:00 2001 From: Akihiro Suda Date: Wed, 8 Jul 2026 08:35:38 +0900 Subject: [PATCH 1/2] CI: migrate Vagrant to Lima Vagrant is no longer well maintained: e.g., its apt repository does not provide packages for Ubuntu 26.04 (hashicorp/vagrant#13811), and recent Fedora boxes are no longer published to HashiCorp's registry, so the CI had to download the box file manually from Fedora mirrors. The test scripts in the Vagrantfile were split out to script/vm/*.sh . The scripts depend on neither Vagrant nor Lima, and can be used with other VM environments too. Assisted-by: Claude Fable 5 Signed-off-by: Akihiro Suda --- .github/workflows/ci.yml | 85 ++--- .../workflows/release/Dockerfile.dockerignore | 1 - .gitignore | 1 - Vagrantfile | 348 ------------------ script/resize-vagrant-root.sh | 43 --- script/vm/README.md | 40 ++ script/vm/provision.sh | 118 ++++++ script/vm/test-cri-integration.sh | 49 +++ script/vm/test-cri.sh | 72 ++++ script/vm/test-integration.sh | 40 ++ 10 files changed, 354 insertions(+), 443 deletions(-) delete mode 100644 Vagrantfile delete mode 100755 script/resize-vagrant-root.sh create mode 100644 script/vm/README.md create mode 100755 script/vm/provision.sh create mode 100755 script/vm/test-cri-integration.sh create mode 100755 script/vm/test-cri.sh create mode 100755 script/vm/test-integration.sh diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index e8e2c11e7a85e..d059608ec6ddc 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -598,8 +598,8 @@ jobs: ${{github.workspace}}/report/*.xml ${{github.workspace}}/report/*.log - integration-vagrant: - name: Vagrant integration + integration-vm: + name: VM integration if: github.event_name != 'merge_group' runs-on: ubuntu-latest timeout-minutes: 60 @@ -609,44 +609,42 @@ jobs: fail-fast: false matrix: include: - - box: fedora/44-cloud-base + - template: fedora-44 cgroup_driver: cgroupfs runc: runc - - box: fedora/44-cloud-base + - template: fedora-44 cgroup_driver: systemd runc: runc - - box: fedora/44-cloud-base + - template: fedora-44 cgroup_driver: cgroupfs runc: crun - - box: fedora/44-cloud-base + - template: fedora-44 cgroup_driver: systemd runc: crun # We have to keep EL8 to test old glibc, cgroup, kernel, etc. - # The image was changed from rockylinux/8 to almalinux/8, - # as the former one no longer works: - # https://github.com/containerd/containerd/pull/10297 - - box: almalinux/8 + - template: almalinux-8 cgroup_driver: cgroupfs runc: runc - - box: almalinux/8 + - template: almalinux-8 cgroup_driver: systemd runc: runc - - box: almalinux/9 + - template: almalinux-9 cgroup_driver: cgroupfs runc: runc - - box: almalinux/9 + - template: almalinux-9 cgroup_driver: systemd runc: runc - - box: almalinux/10 + - template: almalinux-10 cgroup_driver: cgroupfs runc: runc - - box: almalinux/10 + - template: almalinux-10 cgroup_driver: systemd runc: runc env: - BOX: ${{ matrix.box }} + LIMA_TEMPLATE: ${{ matrix.template }} CGROUP_DRIVER: ${{ matrix.cgroup_driver }} RUNC_FLAVOR: ${{ matrix.runc }} + LIMA_WORKDIR: /go/src/github.com/containerd/containerd steps: - name: Show the host info run: | @@ -658,49 +656,36 @@ jobs: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false + - uses: lima-vm/lima-actions/setup@55627e31b78637bf254a8b2a14da8ea7d12564e5 # v1.1.0 + id: lima-actions-setup - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: - path: /root/.vagrant.d - key: vagrant-${{ matrix.box }} - - name: Set up vagrant - run: | - # Canonical's Vagrant 2.2.19 dpkg cannot download Fedora 38 image: https://bugs.launchpad.net/vagrant/+bug/2017828 - # So we have to install Vagrant >= 2.3.1 from the upstream: https://github.com/opencontainers/runc/blob/v1.1.8/.cirrus.yml#L41-L49 - curl -fsSL https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp-archive-keyring.gpg - echo "deb [signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list - sudo sed -i 's/^Types: deb$/Types: deb deb-src/' /etc/apt/sources.list.d/ubuntu.sources - sudo apt-get update - sudo apt-get install -y libvirt-daemon libvirt-daemon-system vagrant ovmf - # https://github.com/vagrant-libvirt/vagrant-libvirt/issues/1725#issuecomment-1454058646 - sudo cp /usr/share/OVMF/OVMF_VARS_4M.fd /var/lib/libvirt/qemu/nvram/ - sudo systemctl enable --now libvirtd - sudo apt-get build-dep -y ruby-libvirt - sudo apt-get install -y --no-install-recommends libxslt-dev libxml2-dev libvirt-dev ruby-bundler ruby-dev zlib1g-dev - sudo env VAGRANT_DISABLE_STRICT_DEPENDENCY_ENFORCEMENT=1 vagrant plugin uninstall fog-json || true - sudo env VAGRANT_DISABLE_STRICT_DEPENDENCY_ENFORCEMENT=1 vagrant plugin install fog-json --plugin-version 1.2.0 - sudo env VAGRANT_DISABLE_STRICT_DEPENDENCY_ENFORCEMENT=1 vagrant plugin install vagrant-libvirt + path: ~/.cache/lima + key: lima-${{ steps.lima-actions-setup.outputs.version }}-${{ matrix.template }} - name: Boot VM + # --plain keeps the guest pristine (no guest agent, no mounts, no port forwards) + run: limactl start --plain --name=default --cpus=2 --memory=4 --disk=60 "template:$LIMA_TEMPLATE" + - name: Copy the source code to the VM + env: + # $LIMA_WORKDIR does not exist yet + LIMA_WORKDIR: / run: | - if [ "$BOX" = "fedora/44-cloud-base" ]; then - # fedora/41-cloud-base seems the last version available in https://portal.cloud.hashicorp.com/vagrant/discover/fedora - # Download the box file with curl (with retry) to handle flaky Fedora mirrors - curl -fL --retry 5 --retry-delay 5 --retry-all-errors \ - --connect-timeout 30 --max-time 600 \ - -o /tmp/fedora.box \ - https://download.fedoraproject.org/pub/fedora/linux/releases/44/Cloud/x86_64/images/Fedora-Cloud-Base-Vagrant-libvirt-44-1.7.x86_64.vagrant.libvirt.box - sudo vagrant box add fedora/44-cloud-base /tmp/fedora.box - rm -f /tmp/fedora.box - fi - sudo BOX=$BOX RUNC_FLAVOR=$RUNC_FLAVOR vagrant up --no-tty + limactl cp -r . default:containerd + lima bash -c 'sudo mkdir -p /go/src/github.com/containerd && sudo mv ~/containerd /go/src/github.com/containerd/containerd' + - name: Provision the VM + run: lima sudo RUNC_FLAVOR="$RUNC_FLAVOR" script/vm/provision.sh - name: test-integration - run: sudo BOX=$BOX RUNC_FLAVOR=$RUNC_FLAVOR vagrant up --provision-with=selinux,install-runc,install-gotestsum,test-integration + run: lima sudo RUNC_FLAVOR="$RUNC_FLAVOR" script/vm/test-integration.sh - name: test-cri-integration - run: sudo BOX=$BOX CGROUP_DRIVER=$CGROUP_DRIVER RUNC_FLAVOR=$RUNC_FLAVOR vagrant up --provision-with=selinux,install-runc,install-gotestsum,test-cri-integration + run: lima sudo CGROUP_DRIVER="$CGROUP_DRIVER" RUNC_FLAVOR="$RUNC_FLAVOR" script/vm/test-cri-integration.sh - name: test-cri - run: sudo BOX=$BOX CGROUP_DRIVER=$CGROUP_DRIVER RUNC_FLAVOR=$RUNC_FLAVOR vagrant up --provision-with=selinux,install-runc,install-gotestsum,test-cri + run: lima sudo CGROUP_DRIVER="$CGROUP_DRIVER" script/vm/test-cri.sh - name: dump-dmesg if: always() - run: sudo BOX=$BOX vagrant ssh -c "sudo dmesg -T -f kern" + env: + # $LIMA_WORKDIR may not exist if an earlier step failed + LIMA_WORKDIR: / + run: lima sudo dmesg -T -f kern tests-cri-in-userns: name: "CRI-in-UserNS" diff --git a/.github/workflows/release/Dockerfile.dockerignore b/.github/workflows/release/Dockerfile.dockerignore index c553fed57faad..e632a4040f5e7 100644 --- a/.github/workflows/release/Dockerfile.dockerignore +++ b/.github/workflows/release/Dockerfile.dockerignore @@ -16,4 +16,3 @@ _site/ releases/*.tar.gz releases/*.tar.gz.sha256sum _output/ -.vagrant/ diff --git a/.gitignore b/.gitignore index 934bd67f11e8a..31bea7327fb15 100644 --- a/.gitignore +++ b/.gitignore @@ -11,4 +11,3 @@ _site/ releases/*.tar.gz releases/*.tar.gz.sha256sum _output/ -.vagrant/ diff --git a/Vagrantfile b/Vagrantfile deleted file mode 100644 index 68b276738d3e3..0000000000000 --- a/Vagrantfile +++ /dev/null @@ -1,348 +0,0 @@ -# -*- mode: ruby -*- -# vi: set ft=ruby : - -# Copyright The containerd Authors. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at - -# http://www.apache.org/licenses/LICENSE-2.0 - -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -# Vagrantfile for Fedora and EL -Vagrant.configure("2") do |config| - config.vm.box = ENV["BOX"] ? ENV["BOX"].split("@")[0] : "fedora/44-cloud-base" - # BOX_VERSION is deprecated. Use "BOX=@". - config.vm.box_version = ENV["BOX_VERSION"] || (ENV["BOX"].split("@")[1] if ENV["BOX"]) - - memory = 4096 - cpus = 2 - disk_size = 60 - config.vm.provider :virtualbox do |v, o| - v.memory = memory - v.cpus = cpus - # Needs env var VAGRANT_EXPERIMENTAL="disks" - o.vm.disk :disk, size: "#{disk_size}GB", primary: true - v.customize ["modifyvm", :id, "--firmware", "efi"] - end - config.vm.provider :libvirt do |v| - v.memory = memory - v.cpus = cpus - v.machine_virtual_size = disk_size - # https://github.com/vagrant-libvirt/vagrant-libvirt/issues/1725#issuecomment-1454058646 - # Needs `sudo cp /usr/share/OVMF/OVMF_VARS_4M.fd /var/lib/libvirt/qemu/nvram/` - v.loader = '/usr/share/OVMF/OVMF_CODE_4M.fd' - v.nvram = '/var/lib/libvirt/qemu/nvram/OVMF_VARS_4M.fd' - end - - config.vm.synced_folder ".", "/vagrant", type: "rsync" - - config.vm.provision 'shell', path: 'script/resize-vagrant-root.sh' - - # Disabled by default. To run: - # vagrant up --provision-with=upgrade-packages - # To upgrade only specific packages: - # UPGRADE_PACKAGES=selinux vagrant up --provision-with=upgrade-packages - # - config.vm.provision "upgrade-packages", type: "shell", run: "never" do |sh| - sh.upload_path = "/tmp/vagrant-upgrade-packages" - sh.env = { - 'UPGRADE_PACKAGES': ENV['UPGRADE_PACKAGES'], - } - sh.inline = <<~SHELL - #!/usr/bin/env bash - set -eux -o pipefail - dnf -y upgrade --refresh ${UPGRADE_PACKAGES} - SHELL - end - - # To re-run, installing CNI from RPM: - # INSTALL_PACKAGES="containernetworking-plugins" vagrant up --provision-with=install-packages - # - config.vm.provision "install-packages", type: "shell", run: "once" do |sh| - sh.upload_path = "/tmp/vagrant-install-packages" - sh.env = { - 'INSTALL_PACKAGES': ENV['INSTALL_PACKAGES'], - } - sh.inline = <<~SHELL - #!/usr/bin/env bash - set -eux -o pipefail - dnf -y makecache --refresh - dnf -y install \ - container-selinux \ - curl \ - gcc \ - git \ - iptables \ - libseccomp-devel \ - libselinux-devel \ - lsof \ - make \ - strace \ - kernel-modules-extra-$(uname -r) \ - ${INSTALL_PACKAGES} - modprobe xt_comment - SHELL - end - - # EL does not have /usr/local/{bin,sbin} in the PATH by default - config.vm.provision "setup-etc-environment", type: "shell", run: "once" do |sh| - sh.upload_path = "/tmp/vagrant-setup-etc-environment" - sh.inline = <<~SHELL - #!/usr/bin/env bash - set -eux -o pipefail - cat >> /etc/environment <> /etc/profile.d/sh.local < /tmp/containerd.log - cat /tmp/containerd.log - systemctl stop containerd - } - selinux=$(getenforce) - if [[ $selinux == Enforcing ]]; then - setenforce 0 - fi - systemctl enable --now ${GOPATH}/src/github.com/containerd/containerd/containerd.service - if [[ $selinux == Enforcing ]]; then - setenforce 1 - fi - trap cleanup EXIT - ctr version - - skip_tests=( - 'HostIpc is true' - ) - if [[ $CGROUP_DRIVER == "systemd" ]]; then - skip_tests+=("should terminate with exitCode 137 and reason OOMKilled") - fi - skip_test_args=$(IFS='|'; echo "${skip_tests[*]}") - critest --parallel=$[$(nproc)+2] --ginkgo.skip="${skip_test_args}" --report-dir="${REPORT_DIR}" - SHELL - end - -end diff --git a/script/resize-vagrant-root.sh b/script/resize-vagrant-root.sh deleted file mode 100755 index 11df94226f7ab..0000000000000 --- a/script/resize-vagrant-root.sh +++ /dev/null @@ -1,43 +0,0 @@ -#!/usr/bin/env bash - -# Copyright The containerd Authors. - -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at - -# http://www.apache.org/licenses/LICENSE-2.0 - -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -set -eu -o pipefail - -# Rocky Linux doesn't have growpart by default. -(growpart -h > /dev/null) || dnf -y install cloud-utils-growpart - -df_line=$(df -T / | grep '^/dev/') -if [[ "$df_line" =~ ^/dev/([a-z]+)([0-9+]) ]]; then - dev="${BASH_REMATCH[1]}" - part="${BASH_REMATCH[2]}" - # growpart prints "NOCHANGE" when the partition is already at max size - out=$(growpart "/dev/$dev" "$part" 2>&1) || grep -q "^NOCHANGE:" <<< "$out" - - fstype=$(echo "$df_line" | awk '{print $2}') - if [[ "$fstype" = 'btrfs' ]]; then - btrfs filesystem resize max / - elif [[ "$fstype" = 'xfs' ]]; then - xfs_growfs -d / - else - echo "Unknown filesystem: $df_line" - exit 1 - fi -elif [[ "$df_line" =~ ^/dev/mapper/ ]]; then - echo "TODO: support device mapper: $df_line" -else - echo "Failed to parse: $df_line" - exit 1 -fi diff --git a/script/vm/README.md b/script/vm/README.md new file mode 100644 index 0000000000000..d04c7c98bc285 --- /dev/null +++ b/script/vm/README.md @@ -0,0 +1,40 @@ +# VM scripts + +The scripts in this directory run the containerd integration tests inside a +virtual machine (Fedora or an EL distribution, with SELinux Enforcing by +default). They are used by the `integration-vm` job in +`.github/workflows/ci.yml`, but do not depend on [Lima](https://lima-vm.io) +and can be used with other VM environments too. + +## Local usage with Lima + +```bash +# Boot a plain VM. template:almalinux-8, -9, and -10 are tested too. +# --plain keeps the guest pristine (no guest agent, no mounts, no port forwards). +limactl start --plain --name=default --cpus=2 --memory=4 --disk=60 template:fedora-44 + +# Copy the source tree into the guest. +limactl cp -r . default:containerd +lima bash -c 'sudo mkdir -p /go/src/github.com/containerd && sudo mv ~/containerd /go/src/github.com/containerd/containerd' + +export LIMA_WORKDIR=/go/src/github.com/containerd/containerd + +# Provision the guest (packages, Go, runc, CNI plugins, cri-tools, containerd, ...). +lima sudo script/vm/provision.sh + +# Run the test suites. +lima sudo script/vm/test-integration.sh +lima sudo CGROUP_DRIVER=systemd script/vm/test-cri-integration.sh +lima sudo CGROUP_DRIVER=systemd script/vm/test-cri.sh + +# Clean up. +limactl delete -f default +``` + +## Environment variables + +- `provision.sh`: `GO_VERSION`, `RUNC_FLAVOR` (`runc` or `crun`), `SELINUX` + (`Enforcing`, `Permissive`, or `Disabled`), `INSTALL_PACKAGES` +- `test-integration.sh`: `RUNC_FLAVOR` +- `test-cri-integration.sh`: `CGROUP_DRIVER` (empty or `systemd`), `RUNC_FLAVOR` +- `test-cri.sh`: `CGROUP_DRIVER` (empty or `systemd`), `REPORT_DIR` diff --git a/script/vm/provision.sh b/script/vm/provision.sh new file mode 100755 index 0000000000000..aee720f650427 --- /dev/null +++ b/script/vm/provision.sh @@ -0,0 +1,118 @@ +#!/usr/bin/env bash + +# Copyright The containerd Authors. + +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at + +# http://www.apache.org/licenses/LICENSE-2.0 + +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# +# Provisions a virtual machine for running the containerd integration +# tests. Expects Fedora or an EL distribution as the guest OS. +# +# The containerd source tree has to be copied into the guest beforehand, +# and this script has to be executed as the root user inside the guest. +# See README.md in this directory for the usage. +# +set -eux -o pipefail + +if [[ "$(id -u)" != "0" ]]; then + echo "must be executed as the root user" >&2 + exit 1 +fi + +script_dir="$(cd -- "$(dirname -- "$0")" > /dev/null 2>&1; pwd -P)" +containerd_dir="$(cd -- "${script_dir}/../.." > /dev/null 2>&1; pwd -P)" + +: "${GO_VERSION:=1.26.5}" +: "${RUNC_FLAVOR:=runc}" +: "${SELINUX:=Enforcing}" +: "${INSTALL_PACKAGES:=}" + +export GOPATH="${GOPATH:-/go}" +export PATH="/usr/local/go/bin:${GOPATH}/bin:/usr/local/bin:/usr/local/sbin:${PATH}" + +# Install the packages +dnf -y makecache --refresh +# shellcheck disable=SC2086 +dnf -y install \ + container-selinux \ + curl \ + gcc \ + git \ + iptables \ + libseccomp-devel \ + libselinux-devel \ + lsof \ + make \ + strace \ + which \ + "kernel-modules-extra-$(uname -r)" \ + ${INSTALL_PACKAGES} +modprobe xt_comment + +# Install Go +GOARCH="$(uname -m | sed -e 's/x86_64/amd64/' -e 's/aarch64/arm64/')" +curl -fsSL "https://dl.google.com/go/go${GO_VERSION}.linux-${GOARCH}.tar.gz" | tar Cxz /usr/local + +# The source tree is copied from the host: it may be owned by a non-root user, +# and may be labeled with the SELinux context of the directory it was copied to +git config --system --add safe.directory "${containerd_dir}" +if type -p restorecon > /dev/null; then + restorecon -R "${containerd_dir}" +fi + +# Set up $GOPATH/src/github.com/containerd/containerd +mkdir -p "${GOPATH}/src/github.com/containerd" +if [[ "${containerd_dir}" != "${GOPATH}/src/github.com/containerd/containerd" ]]; then + ln -fnsv "${containerd_dir}" "${GOPATH}/src/github.com/containerd/containerd" +fi + +cd "${containerd_dir}" + +# Install runc (pass RUNC_FLAVOR=crun to install crun as runc) +RUNC_FLAVOR="${RUNC_FLAVOR}" script/setup/install-runc +type runc +runc --version +# "type -ap" may print the same file under multiple names, e.g., on +# distros where /usr/local/sbin is merged into /usr/local/bin +type -ap runc | sort -u | xargs chcon -v -t container_runtime_exec_t + +# Install CNI plugins +script/setup/install-cni +CNI_BINARIES="bridge dhcp flannel host-device host-local ipvlan loopback macvlan portmap ptp tuning vlan" +# shellcheck disable=SC2086 +PATH="/opt/cni/bin:${PATH}" type ${CNI_BINARIES} || true + +# Install cri-tools +GOBIN=/usr/local/bin script/setup/install-critools +type crictl critest +critest --version + +# Install containerd +make BUILDTAGS="seccomp selinux no_btrfs no_devmapper no_zfs" binaries install +type containerd +containerd --version +chcon -v -t container_runtime_exec_t /usr/local/bin/{containerd,containerd-shim*} + +# Install gotestsum +script/setup/install-gotestsum +cp "${GOPATH}/bin/gotestsum" /usr/local/bin/ + +# Install failpoint binaries +script/setup/install-failpoint-binaries +type -ap containerd-shim-runc-fp-v1 | sort -u | xargs chcon -v -t container_runtime_exec_t +containerd-shim-runc-fp-v1 -v + +# Configure SELinux (pass SELINUX=Disabled or SELINUX=Permissive to weaken it) +# and establish /etc/containerd/config.toml +SELINUX="${SELINUX}" script/setup/config-selinux +script/setup/config-containerd diff --git a/script/vm/test-cri-integration.sh b/script/vm/test-cri-integration.sh new file mode 100755 index 0000000000000..56e5c45982ac7 --- /dev/null +++ b/script/vm/test-cri-integration.sh @@ -0,0 +1,49 @@ +#!/usr/bin/env bash + +# Copyright The containerd Authors. + +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at + +# http://www.apache.org/licenses/LICENSE-2.0 + +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# +# Runs the CRI integration tests inside a virtual machine +# provisioned with provision.sh. +# +set -eux -o pipefail + +if [[ "$(id -u)" != "0" ]]; then + echo "must be executed as the root user" >&2 + exit 1 +fi + +script_dir="$(cd -- "$(dirname -- "$0")" > /dev/null 2>&1; pwd -P)" +containerd_dir="$(cd -- "${script_dir}/../.." > /dev/null 2>&1; pwd -P)" + +export CGROUP_DRIVER="${CGROUP_DRIVER:-}" +export RUNC_FLAVOR="${RUNC_FLAVOR:-runc}" +export GOTEST="${GOTEST:-go test}" +export GITHUB_WORKSPACE="${GITHUB_WORKSPACE:-}" + +export GOPATH="${GOPATH:-/go}" +export PATH="/usr/local/go/bin:${GOPATH}/bin:/usr/local/bin:/usr/local/sbin:${PATH}" + +cleanup() { + rm -rf /var/lib/containerd* /run/containerd* /tmp/containerd* /tmp/test* /tmp/failpoint* /tmp/nri* +} + +cleanup +cd "${containerd_dir}" +# cri-integration.sh executes containerd from ./bin, not from $PATH . +make BUILDTAGS="seccomp selinux no_btrfs no_devmapper no_zfs" binaries bin/cri-integration.test +chcon -v -t container_runtime_exec_t ./bin/{containerd,containerd-shim*} +CONTAINERD_RUNTIME=io.containerd.runc.v2 ./script/test/cri-integration.sh +cleanup diff --git a/script/vm/test-cri.sh b/script/vm/test-cri.sh new file mode 100755 index 0000000000000..ae5fec33764de --- /dev/null +++ b/script/vm/test-cri.sh @@ -0,0 +1,72 @@ +#!/usr/bin/env bash + +# Copyright The containerd Authors. + +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at + +# http://www.apache.org/licenses/LICENSE-2.0 + +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# +# Runs critest against containerd (running as a systemd unit) inside a +# virtual machine provisioned with provision.sh. +# +set -eux -o pipefail + +if [[ "$(id -u)" != "0" ]]; then + echo "must be executed as the root user" >&2 + exit 1 +fi + +script_dir="$(cd -- "$(dirname -- "$0")" > /dev/null 2>&1; pwd -P)" +containerd_dir="$(cd -- "${script_dir}/../.." > /dev/null 2>&1; pwd -P)" + +: "${CGROUP_DRIVER:=}" +: "${REPORT_DIR:=}" + +export GOPATH="${GOPATH:-/go}" +export PATH="/usr/local/go/bin:${GOPATH}/bin:/usr/local/bin:/usr/local/sbin:${PATH}" + +systemctl disable --now containerd || true +rm -rf /var/lib/containerd /run/containerd + +cleanup() { + journalctl -u containerd > /tmp/containerd.log + cat /tmp/containerd.log + systemctl stop containerd +} + +selinux=$(getenforce) +if [[ $selinux == Enforcing ]]; then + setenforce 0 +fi +systemctl enable --now "${containerd_dir}/containerd.service" +if [[ $selinux == Enforcing ]]; then + setenforce 1 +fi +trap cleanup EXIT +ctr version + +skip_tests=( + 'HostIpc is true' +) +if [[ $CGROUP_DRIVER == "systemd" ]]; then + skip_tests+=("should terminate with exitCode 137 and reason OOMKilled") +fi +skip_test_args=$( + IFS='|' + echo "${skip_tests[*]}" +) +critest_args=(--parallel=$(($(nproc) + 2)) --ginkgo.skip="${skip_test_args}") +if [[ -n $REPORT_DIR ]]; then + mkdir -p "${REPORT_DIR}" + critest_args+=(--report-dir="${REPORT_DIR}") +fi +critest "${critest_args[@]}" diff --git a/script/vm/test-integration.sh b/script/vm/test-integration.sh new file mode 100755 index 0000000000000..60bc92a09b400 --- /dev/null +++ b/script/vm/test-integration.sh @@ -0,0 +1,40 @@ +#!/usr/bin/env bash + +# Copyright The containerd Authors. + +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at + +# http://www.apache.org/licenses/LICENSE-2.0 + +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# +# Runs the containerd integration tests inside a virtual machine +# provisioned with provision.sh. +# +set -eux -o pipefail + +if [[ "$(id -u)" != "0" ]]; then + echo "must be executed as the root user" >&2 + exit 1 +fi + +script_dir="$(cd -- "$(dirname -- "$0")" > /dev/null 2>&1; pwd -P)" +containerd_dir="$(cd -- "${script_dir}/../.." > /dev/null 2>&1; pwd -P)" + +: "${RUNC_FLAVOR:=runc}" +export GOTEST="${GOTEST:-go test}" + +export GOPATH="${GOPATH:-/go}" +export PATH="/usr/local/go/bin:${GOPATH}/bin:/usr/local/bin:/usr/local/sbin:${PATH}" + +rm -rf /var/lib/containerd-test /run/containerd-test +cd "${containerd_dir}" +go test -v -count=1 -race ./core/metrics/cgroups +make integration EXTRA_TESTFLAGS="-timeout 15m -no-criu -test.v" TEST_RUNTIME=io.containerd.runc.v2 RUNC_FLAVOR="${RUNC_FLAVOR}" From 617944babe00b8d7df7db31fca7b3bd913bd6e0b Mon Sep 17 00:00:00 2001 From: Wei Fu Date: Wed, 8 Jul 2026 15:02:01 -0400 Subject: [PATCH 2/2] RELEASES.md: mark 2.1 EOL and update latest 1.7/2.0/2.1/2.2/2.3 tags Signed-off-by: Wei Fu --- RELEASES.md | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-) diff --git a/RELEASES.md b/RELEASES.md index b5d7f971c8fe3..5dee8118d202c 100644 --- a/RELEASES.md +++ b/RELEASES.md @@ -136,20 +136,18 @@ to all committers. | [1.3](https://github.com/containerd/containerd/releases/tag/v1.3.10) | End of Life | September 26, 2019 | March 4, 2021 | | | [1.4](https://github.com/containerd/containerd/releases/tag/v1.4.13) | End of Life | August 17, 2020 | March 3, 2022 | | | [1.5](https://github.com/containerd/containerd/releases/tag/v1.5.18) | End of Life | May 3, 2021 | February 28, 2023 | | -| [1.6](https://github.com/containerd/containerd/releases/tag/v1.6.39) | End of Life | February 15, 2022 | August 23, 2025 | @containerd/committers | -| [1.7](https://github.com/containerd/containerd/releases/tag/v1.7.0) | LTS | March 10, 2023 | September 2026* | [@samuelkarp](https://github.com/samuelkarp), [@chrishenzie](https://github.com/chrishenzie) | -| [2.0](https://github.com/containerd/containerd/releases/tag/v2.0.7) | LTS | November 5, 2024 | March, 2027** | [@samuelkarp](https://github.com/samuelkarp), [@chrishenzie](https://github.com/chrishenzie) | -| [2.1](https://github.com/containerd/containerd/releases/tag/v2.1.7) | Active | May 7, 2025 | July 3, 2026*** | [@cpuguy83](https://github.com/cpuguy83), [@fuweid](https://github.com/fuweid) | -| [2.2](https://github.com/containerd/containerd/releases/tag/v2.2.0) | Active | November 5, 2025 | November 6, 2026 | @containerd/committers | -| [2.3](https://github.com/containerd/containerd/releases/tag/v2.3.0) | LTS | April 30, 2026 | April 30, 2028 | @containerd/committers | +| [1.6](https://github.com/containerd/containerd/releases/tag/v1.6.39) | End of Life | February 15, 2022 | August 23, 2025 | | +| [1.7](https://github.com/containerd/containerd/releases/tag/v1.7.33) | LTS | March 10, 2023 | September 2026* | [@samuelkarp](https://github.com/samuelkarp), [@chrishenzie](https://github.com/chrishenzie) | +| [2.0](https://github.com/containerd/containerd/releases/tag/v2.0.10) | LTS | November 5, 2024 | March, 2027** | [@samuelkarp](https://github.com/samuelkarp), [@chrishenzie](https://github.com/chrishenzie) | +| [2.1](https://github.com/containerd/containerd/releases/tag/v2.1.9) | End of Life | May 7, 2025 | July 3, 2026 | | +| [2.2](https://github.com/containerd/containerd/releases/tag/v2.2.5) | Active | November 5, 2025 | November 6, 2026 | @containerd/committers | +| [2.3](https://github.com/containerd/containerd/releases/tag/v2.3.2) | LTS | April 30, 2026 | April 30, 2028 | @containerd/committers | | [2.4](https://github.com/containerd/containerd/milestone/51) | _Future_ | August 26, 2026 (_tentative_) | April 26, 2027 (_tentative_) | @containerd/committers | \* Support for the 1.7 release branch was provided by @containerd/committers until March 10, 2026. Extended support through September 2026 is provided by [@samuelkarp](https://github.com/samuelkarp) and [@chrishenzie](https://github.com/chrishenzie). This extended support is focused on usage with Kubernetes 1.32, 1.31, and 1.30 via [Google Kubernetes Engine](https://cloud.google.com/kubernetes-engine). Changes may not be accepted if they are not needed for this usage. \*\* Support for the 2.0 release branch was provided by @containerd/committers until November 7, 2025. Extended support through March 2027 is provided by [@samuelkarp](https://github.com/samuelkarp) and [@chrishenzie](https://github.com/chrishenzie). This extended support is focused on usage with Kuberentes 1.33 via [Google Kubernetes Engine](https://cloud.google.com/kubernetes-engine). Changes may not be accepted if they are not needed for this usage. -\*\*\* Support for the 2.1 release branch was provided by @containerd/committers until May 5, 2026. Extended support through July 3, 2026 is provided by [@cpuguy83](https://github.com/cpuguy83) and [@fuweid](https://github.com/fuweid). This extended support is focused on usage with Kubernetes 1.33 via [Azure Kubernetes Service](https://azure.microsoft.com/en-us/products/kubernetes-service). Changes may not be accepted if they are not needed for this usage. - ### Kubernetes Support The Kubernetes version matrix represents the versions of containerd which are