Merge pull request #13 from dperny/bump-release-v1.6-m

Merge upstream v1.6.32 into release/v1.6-m

.github/actions/install-go/action.yml

@@ -3,7 +3,7 @@ description: "Reusable action to install Go, so there is one place to bump Go ve
 inputs:
   go-version:
     required: true
-    default: "1.21.8"
+    default: "1.21.10"
     description: "Go version to install"
 
 runs:

.github/workflows/ci.yml

@@ -217,7 +217,7 @@ jobs:
     strategy:
       matrix:
         os: [ubuntu-20.04, actuated-arm64-4cpu-16gb, macos-12, windows-2019, windows-2022]
-        go-version: ["1.21.8", "1.22.1"]
+        go-version: ["1.21.10", "1.22.3"]
     steps:
       - name: Install dependencies
         if: matrix.os == 'ubuntu-20.04' || matrix.os == 'actuated-arm64-4cpu-16gb'

.github/workflows/release.yml

@@ -13,7 +13,7 @@ on:
 name: Containerd Release
 
 env:
-  GO_VERSION: "1.21.8"
+  GO_VERSION: "1.21.10"
 
 permissions:  # added using https://github.com/step-security/secure-workflows
   contents: read

.mailmap

@@ -146,6 +146,7 @@ Zhongming Chang<[email protected]>
 Zhoulin Xie <[email protected]>
 Zhoulin Xie <[email protected]> <[email protected]>
 zounengren <[email protected]> <[email protected]>
+张钰 <[email protected]>
 张潇 <[email protected]>
 Kazuyoshi Kato <[email protected]> <[email protected]>
 Andrey Epifanov <[email protected]> <[email protected]>

RELEASES.md

@@ -343,3 +343,4 @@ The deprecated features are shown in the following table:
 | config.toml `version = 1`                                            | containerd v1.5     | containerd v2.0            | Use config.toml `version = 2`     |
 | Built-in `aufs` snapshotter                                          | containerd v1.5     | containerd v2.0            | Use `overlayfs` snapshotter       |
 | `cri-containerd-*.tar.gz` release bundles                            | containerd v1.6     | containerd v2.0            | Use `containerd-*.tar.gz` bundles |
+| config.toml OTEL configuration                                       | containerd v1.6.29  | containerd v2.0            | Use OTEL/OTLP env variables       |

Vagrantfile

@@ -95,7 +95,7 @@ EOF
   config.vm.provision "install-golang", type: "shell", run: "once" do |sh|
     sh.upload_path = "/tmp/vagrant-install-golang"
     sh.env = {
-        'GO_VERSION': ENV['GO_VERSION'] || "1.21.8",
+        'GO_VERSION': ENV['GO_VERSION'] || "1.21.10",
     }
     sh.inline = <<~SHELL
         #!/usr/bin/env bash

cmd/ctr/commands/resolver.go

@@ -148,6 +148,11 @@ func resolverDefaultTLS(clicontext *cli.Context) (*tls.Config, error) {
 		config.Certificates = []tls.Certificate{keyPair}
 	}
 
+	// If nothing was set, return nil rather than empty config
+	if !config.InsecureSkipVerify && config.RootCAs == nil && config.Certificates == nil {
+		return nil, nil
+	}
+
 	return config, nil
 }
 

contrib/Dockerfile.test

@@ -10,7 +10,7 @@
 #
 # docker build -t containerd-test --build-arg RUNC_VERSION=v1.0.0-rc94 -f Dockerfile.test ../
 
-ARG GOLANG_VERSION=1.21.8
+ARG GOLANG_VERSION=1.21.10
 ARG GOLANG_IMAGE=golang
 
 FROM ${GOLANG_IMAGE}:${GOLANG_VERSION} AS golang

contrib/apparmor/template.go

@@ -57,6 +57,10 @@ profile {{.Name}} flags=(attach_disconnected,mediate_deleted) {
 {{if ge .Version 208096}}
   # Host (privileged) processes may send signals to container processes.
   signal (receive) peer=unconfined,
+  # runc may send signals to container processes.
+  signal (receive) peer=runc,
+  # crun may send signals to container processes.
+  signal (receive) peer=crun,
   # Manager may send signals to container processes.
   signal (receive) peer={{.DaemonProfile}},
   # Container processes may send signals amongst themselves.

gc/scheduler/scheduler.go

@@ -246,6 +246,7 @@ func schedule(d time.Duration) (<-chan time.Time, *time.Time) {
 }
 
 func (s *gcScheduler) run(ctx context.Context) {
+	const minimumGCTime = float64(5 * time.Millisecond)
 	var (
 		schedC <-chan time.Time
 
@@ -341,6 +342,11 @@ func (s *gcScheduler) run(ctx context.Context) {
 			// runtime in between gc to reach the pause threshold.
 			// Pause threshold is always 0.0 < threshold <= 0.5
 			avg := float64(gcTime) / float64(collections)
+			// Enforce that avg is no less than minimumGCTime
+			// to prevent immediate rescheduling
+			if avg < minimumGCTime {
+				avg = minimumGCTime
+			}
 			interval = time.Duration(avg/s.pauseThreshold - avg)
 		}
 

go.mod

@@ -5,8 +5,8 @@ go 1.19
 require (
 	dario.cat/mergo v1.0.0
 	github.com/AdaLogics/go-fuzz-headers v0.0.0-20210715213245-6c3934b029d8
-	github.com/Microsoft/go-winio v0.5.2
-	github.com/Microsoft/hcsshim v0.9.10
+	github.com/Microsoft/go-winio v0.5.3
+	github.com/Microsoft/hcsshim v0.9.11
 	github.com/containerd/aufs v1.0.0
 	github.com/containerd/btrfs v1.0.0
 	github.com/containerd/cgroups v1.0.4
@@ -15,7 +15,7 @@ require (
 	github.com/containerd/fifo v1.0.0
 	github.com/containerd/go-cni v1.1.6
 	github.com/containerd/go-runc v1.0.0
-	github.com/containerd/imgcrypt v1.1.4
+	github.com/containerd/imgcrypt v1.1.8
 	github.com/containerd/log v0.1.0
 	github.com/containerd/nri v0.1.1
 	github.com/containerd/ttrpc v1.1.2
@@ -45,7 +45,7 @@ require (
 	github.com/moby/sys/symlink v0.2.0
 	github.com/moby/sys/user v0.1.0
 	github.com/opencontainers/go-digest v1.0.0
-	github.com/opencontainers/image-spec v1.1.0-rc2.0.20221005185240-3a7f492d3f1b
+	github.com/opencontainers/image-spec v1.1.0
 	github.com/opencontainers/runtime-spec v1.0.3-0.20210326190908-1c3f411f0417
 	github.com/opencontainers/selinux v1.10.1
 	github.com/pelletier/go-toml v1.9.5
@@ -79,15 +79,15 @@ require (
 )
 
 require (
-	cloud.google.com/go/compute/metadata v0.2.3 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/blang/semver v3.5.1+incompatible // indirect
 	github.com/cenkalti/backoff/v4 v4.1.2 // indirect
 	github.com/cespare/xxhash/v2 v2.2.0 // indirect
 	github.com/cilium/ebpf v0.7.0 // indirect
-	github.com/containers/ocicrypt v1.1.3 // indirect
+	github.com/containers/ocicrypt v1.1.10 // indirect
 	github.com/cpuguy83/go-md2man/v2 v2.0.0 // indirect
 	github.com/emicklei/go-restful v2.16.0+incompatible // indirect
+	github.com/go-jose/go-jose/v3 v3.0.3 // indirect
 	github.com/go-logr/logr v1.3.0 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/godbus/dbus/v5 v5.0.6 // indirect
@@ -111,7 +111,7 @@ require (
 	github.com/russross/blackfriday/v2 v2.0.1 // indirect
 	github.com/shurcooL/sanitized_anchor_name v1.0.0 // indirect
 	github.com/spf13/pflag v1.0.5 // indirect
-	github.com/stefanberger/go-pkcs11uri v0.0.0-20201008174630-78d3cae3a980 // indirect
+	github.com/stefanberger/go-pkcs11uri v0.0.0-20230803200340-78284954bff6 // indirect
 	github.com/vishvananda/netns v0.0.0-20210104183010-2eb08e3e575f // indirect
 	go.mozilla.org/pkcs7 v0.0.0-20200128120323-432b2356ecb1 // indirect
 	go.opencensus.io v0.24.0 // indirect
@@ -126,7 +126,6 @@ require (
 	google.golang.org/appengine v1.6.7 // indirect
 	google.golang.org/genproto v0.0.0-20230822172742-b8732ec3820d // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
-	gopkg.in/square/go-jose.v2 v2.5.1 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 	sigs.k8s.io/structured-merge-diff/v4 v4.1.2 // indirect