Skip to content
This repository has been archived by the owner on Mar 9, 2022. It is now read-only.

Update containerd to a6a0c8b6e36415a151d93d096c1c0af9e0bd7977. #1309

Merged
merged 2 commits into from
Oct 10, 2019
Merged

Update containerd to a6a0c8b6e36415a151d93d096c1c0af9e0bd7977. #1309

merged 2 commits into from
Oct 10, 2019

Conversation

Random-Liu
Copy link
Member

We've got more test coverage in the cri repo.

Let's update containerd to include containerd/containerd#3711, so that we get more test coverage before cherrypicking it.

Signed-off-by: Lantao Liu [email protected]

mikebrow
mikebrow approved these changes Oct 4, 2019
View reviewed changes
Copy link
Member

@mikebrow mikebrow left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

jterry75
jterry75 approved these changes Oct 4, 2019
View reviewed changes
Copy link
Contributor

@jterry75 jterry75 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@jterry75
Copy link
Contributor

jterry75 commented Oct 4, 2019

@Random-Liu - Is there a general strategy for updating this? Or said differently, is there a future where cri moves into containerd to avoid this need?

@Random-Liu
Copy link
Member Author

Random-Liu commented Oct 4, 2019 •
edited
Loading

One test pod got killed with exit status 137, I guess it is OOM kill.

Triggered rerun.

Is there a general strategy for updating this? Or said differently, is there a future where cri moves into containerd to avoid this need?

Moving the CRI plugin into containerd/containerd shouldn't be too hard. The annoying part is to update all the test/release scripts and infrastructure.

For example, do we want a 1hour windows CRI validation presubmit test in the containerd repo? I guess not... We could probably have it only run on CRI changes, but updating all the test infra still requires some effort.

@Random-Liu
Copy link
Member Author

Random-Liu commented Oct 5, 2019 •
edited
Loading

The PR includes 2 test changes:

  1. Tolerant not found error in restart test. There is a race condition that containerd event monitor may delete the pod sandbox before the test after it is killed. The state call is faster now, which somehow exposed this race.
  2. The unknown state restart test is removed. I really don't want to remove it. However, after the runc state fix, getting container state doesn't need runc anymore, the original way to move runc around to produce a container in unknown state doesn't work any more... And I think very hard, but really can't find a way to create a container in unknown state in the test.... Thus I have to remove it.

mikebrow
mikebrow approved these changes Oct 7, 2019
View reviewed changes
Copy link
Member

@mikebrow mikebrow left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM
see nit for a todo comment or issue looking for help

integration/restart_test.go
// The test requires:
// 1) The runtime is runc;
// 2) runc is in PATH;
func TestUnknownStateAfterContainerdRestart(t *testing.T) {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

maybe a todo or issue to develop an integration test for unknownstate

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

#1310

@Random-Liu Random-Liu mentioned this pull request Oct 7, 2019
Closed
@Random-Liu
Copy link
Member Author

/test pull-cri-containerd-verify

This was referenced Oct 8, 2019
Closed
Merged
@Random-Liu
Copy link
Member Author

Updated containerd again to include containerd/containerd#3730 for the test.

@Random-Liu
Copy link
Member Author

/test pull-cri-containerd-verify

@Random-Liu Random-Liu changed the title Update containerd to 38a0013c70944d09876f96854c3bbcb9984e39d3. Update containerd to a6a0c8b6e36415a151d93d096c1c0af9e0bd7977. Oct 10, 2019
@Random-Liu
Copy link
Member Author

Apply LGTM based on LGTMs above.

@Random-Liu Random-Liu merged commit 815f3e7 into containerd:master Oct 10, 2019
@Random-Liu Random-Liu deleted the update-containerd branch October 10, 2019 22:15
@thaJeztah thaJeztah mentioned this pull request Nov 8, 2019
Merged
@thaJeztah thaJeztah mentioned this pull request Nov 8, 2019
Merged
dmcgowan pushed a commit to thaJeztah/containerd that referenced this pull request Nov 19, 2019
@thaJeztah @dmcgowan
Prepare v1.3.1 release
d512382 
* Update the runc vendor to v1.0.0-rc9 which includes an additional mitigation for [CVE-2019-16884](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16884).
    - More details on the runc CVE in [opencontainers/runc#2128](opencontainers/runc#2128), and the additional mitigations in [opencontainers/runc#2130](opencontainers/runc#2130).
* Add local-fs.target to service file to fix corrupt image after unexpected host reboot. Reported in [containerd#3671](containerd#3671), and fixed by [containerd#3745](containerd#3745).
* Fix large output of processes with TTY getting occasionally truncated. Reported in [containerd#3738](containerd#3738) and fixed by [containerd#3754](containerd#3754).
* Fix direct unpack when running in user namespace. Reported in [containerd#3762](containerd#3762), and fixed by [containerd#3779](containerd#3779).
* Update Golang runtime to 1.12.13, which includes security fixes to the `crypto/dsa` package made in Go 1.12.11 ([CVE-2019-17596](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17596)), and fixes to the go command, `runtime`, `syscall` and `net` packages (Go 1.12.12).
* Add Windows process shim installer [containerd#3792](containerd#3792)

* CRI fixes:
    - Fix shim delete error code to avoid unnecessary retries in the CRI plugin. Discovered in [containerd/cri#1309](containerd/cri#1309), and fixed by [containerd#3733](containerd#3733) and [containerd#3740](containerd#3740).

Signed-off-by: Sebastiaan van Stijn <[email protected]>
dmcgowan pushed a commit to thaJeztah/containerd that referenced this pull request Nov 20, 2019
@thaJeztah @dmcgowan
Prepare v1.2.11 release
1b4aebd 
* Update the runc vendor to v1.0.0-rc9 which includes an additional mitigation for
  [CVE-2019-16884](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16884).
    - More details on the runc CVE in [opencontainers/runc#2128](opencontainers/runc#2128),
      and the additional mitigations in [opencontainers/runc#2130](opencontainers/runc#2130).
* Add local-fs.target to service file to fix corrupt image after unexpected host reboot.
  Reported in [containerd#3671](containerd#3671),
  and fixed by [containerd#3746](containerd#3746).
* Update Golang runtime to 1.12.13, which includes security fixes to the `crypto/dsa`
  package made in Go 1.12.11 ([CVE-2019-17596](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17596)),
  and fixes to the go command, `runtime`, `syscall` and `net` packages (Go 1.12.12).

* CRI fixes:
    - Fix shim delete error code to avoid unnecessary retries in the CRI plugin.
      Discovered in [containerd/cri#1309](containerd/cri#1309),
      and fixed by [containerd#3732](containerd#3732)
      and [containerd#3739](containerd#3739).

Signed-off-by: Sebastiaan van Stijn <[email protected]>
thaJeztah added a commit to thaJeztah/docker that referenced this pull request Nov 28, 2019
@thaJeztah
[19.03] Update containerd binary to v1.2.11
cfcf25b 
full diff: containerd/containerd@v1.2.10...v1.2.11

The eleventh patch release for containerd 1.2 includes an updated runc with
an additional fix for CVE-2019-16884 and a Golang update.

Notable Updates
-----------------------

- Update the runc vendor to v1.0.0-rc9 which includes an additional mitigation
  for CVE-2019-16884.
  More details on the runc CVE in opencontainers/runc#2128, and the additional
  mitigations in opencontainers/runc#2130.
- Add local-fs.target to service file to fix corrupt image after unexpected host
  reboot. Reported in containerd/containerd#3671, and fixed by containerd/containerd#3746.
- Update Golang runtime to 1.12.13, which includes security fixes to the crypto/dsa
  package made in Go 1.12.11 (CVE-2019-17596), and fixes to the go command, runtime,
  syscall and net packages (Go 1.12.12).

CRI fixes:
-----------------------

- Fix shim delete error code to avoid unnecessary retries in the CRI plugin. Discovered
  in containerd/cri#1309, and fixed by containerd/containerd#3732 and containerd/containerd#3739.

Signed-off-by: Sebastiaan van Stijn <[email protected]>
@thaJeztah thaJeztah mentioned this pull request Nov 28, 2019
Merged
docker-jenkins pushed a commit to docker-archive/docker-ce that referenced this pull request Jan 16, 2020
@thaJeztah
[19.03] Update containerd binary to v1.2.11
67f4391 
full diff: containerd/containerd@v1.2.10...v1.2.11

The eleventh patch release for containerd 1.2 includes an updated runc with
an additional fix for CVE-2019-16884 and a Golang update.

Notable Updates
-----------------------

- Update the runc vendor to v1.0.0-rc9 which includes an additional mitigation
  for CVE-2019-16884.
  More details on the runc CVE in opencontainers/runc#2128, and the additional
  mitigations in opencontainers/runc#2130.
- Add local-fs.target to service file to fix corrupt image after unexpected host
  reboot. Reported in containerd/containerd#3671, and fixed by containerd/containerd#3746.
- Update Golang runtime to 1.12.13, which includes security fixes to the crypto/dsa
  package made in Go 1.12.11 (CVE-2019-17596), and fixes to the go command, runtime,
  syscall and net packages (Go 1.12.12).

CRI fixes:
-----------------------

- Fix shim delete error code to avoid unnecessary retries in the CRI plugin. Discovered
  in containerd/cri#1309, and fixed by containerd/containerd#3732 and containerd/containerd#3739.

Signed-off-by: Sebastiaan van Stijn <[email protected]>
Upstream-commit: cfcf25bb5409eb0c3a9c257b225f2b8890142030
Component: engine
This was referenced Jan 30, 2020
Merged
Merged
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Reviewers

@mikebrow mikebrow mikebrow approved these changes

@jterry75 jterry75 jterry75 approved these changes

Assignees

@mikebrow mikebrow

Labels
lgtm size/XXL
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@Random-Liu @jterry75 @mikebrow @k8s-ci-robot