Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Sign up
Appearance settings

iso: bump to containerd/nerdctl 2.x #21409

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
nirs wants to merge 6 commits into kubernetes:master
base: master
Choose a base branch
Loading
from nirs:containerd2
Open

Conversation

Copy link
Contributor

@nirs nirs commented Aug 24, 2025
edited
Loading

This is #21368 with the following changes:

  • Rebase on master
  • Fix whitespace in hash files
  • Unify containerd-bin makefiles
  • Update contained-bin Config.in
  • Remove containerd.conf.d directory
  • Add missing _AARCH64 to variable names
  • Bump nerdctl to 2.1.3 (it must be upgraded with containerd)

Must be merged together with #21643

Fixes #20497

Copy link
Contributor

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

@k8s-ci-robot k8s-ci-robot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Aug 24, 2025
Copy link
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: nirs
Once this PR has been reviewed and has the lgtm label, please assign spowelljr for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Aug 24, 2025
Copy link
Contributor Author

nirs commented Aug 24, 2025

/ok-to-build-iso

2 similar comments
Copy link
Contributor Author

nirs commented Aug 24, 2025

/ok-to-build-iso

Copy link
Contributor Author

nirs commented Aug 24, 2025

/ok-to-build-iso

Copy link
Contributor Author

nirs commented Aug 24, 2025

/ok-to-build-iso

@nirs nirs marked this pull request as ready for review August 24, 2025 19:06
@k8s-ci-robot k8s-ci-robot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Aug 24, 2025
Copy link
Member

medyagh commented Aug 25, 2025
edited
Loading

Copy link
Member

medyagh commented Aug 25, 2025

/ok-to-build-iso

Copy link
Collaborator

Hi @nirs, we have updated your PR with the reference to newly built ISO. Pull the changes locally if you want to test with them or update your PR further.

@nirs nirs marked this pull request as draft August 26, 2025 21:56
@k8s-ci-robot k8s-ci-robot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Aug 26, 2025
Copy link
Contributor Author

@nirs nirs left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The config.toml does not help with #21408 and may break code configuring containerd using sed(!?). We need to replace the configuration code with proper toml parsing but for now we can keep the existing config.

Copy link
Member

medyagh commented Aug 28, 2025

/ok-to-test

@k8s-ci-robot k8s-ci-robot added the ok-to-test Indicates a non-member PR verified by an org member that is safe to test. label Aug 28, 2025

This comment has been minimized.

@nirs nirs force-pushed the containerd2 branch 2 times, most recently from d56d7f2 to 0d79fb4 Compare August 31, 2025 21:49
Copy link
Contributor Author

nirs commented Aug 31, 2025

/ok-to-build-iso

Copy link
Contributor Author

nirs commented Sep 26, 2025

/ok-to-build-iso

@nirs nirs marked this pull request as ready for review September 26, 2025 21:11
@k8s-ci-robot k8s-ci-robot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Sep 26, 2025

This comment has been minimized.

This comment has been minimized.

Copy link
Contributor Author

nirs commented Sep 30, 2025

Copy link
Contributor Author

nirs commented Sep 30, 2025

/ok-to-build-iso

This comment has been minimized.

This comment has been minimized.

Copy link
Collaborator

Hi @nirs, we have updated your PR with the reference to newly built ISO. Pull the changes locally if you want to test with them or update your PR further.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

ComradeProgrammer and others added 6 commits October 14, 2025 21:07
- Fix Makefile title in aarch64
- Unify whitespaec in *.mk files
- Remove extra space between the hash and the tarball name
- Remove empty line at the end hash file
Based on crictl-bin Config.in.
Containerd supports a simple and poorly documented drop-in configuration
files using the imports option. If this option is set:
 imports = ["/etc/containerd/conf.d/*.toml"]
Then toml files under /etc/containerd/conf.d/ are loaded and merged with
the config read from /etc/containerd/config.toml.
Unlike systemd drop-in files, you cannot override single option by
adding drop-in configuration file. To override a single option you must
set all options in the section, and the entire section is replaced by
the drop-in file.
We never used this feature since our config contains:
 # imports
And we don't configure this dynamically. Our config on the host is:
 $ grep conf.d /etc/containerd/config.toml
 conf_dir = "/etc/cni/net.d"
However we were creating:
 /etc/containerd/containerd.conf.d/
This path does not make sense (repeating containerd twice) and files in
this directory are ignored.
Finally this directory was created in CONFIGURE_CMDS instead of
INSTALL_CMDS. Now that we install a binary we should not have any
configure commands.
Since we never had a working conf.d directory we can safely remove it.
This is the reason for the strange failure when build the x86_64 iso,
about no hash for arm64 tarball. I seems that package for different
architectures must have a different names to avoid confusing buildroot.
The name was broken by mistake when updating to containerd 2.1.4.
With this change iso build works for both aarch64 and x86_64.
For containerd 2.1.4, the recommended nerdctl version is 2.1.3 or higher.
Here's why this is the recommended version and where you can find it:
- Version alignment: Major releases of containerd are often paired with
 a corresponding nerdctl release to ensure compatibility with new
 features and breaking changes. nerdctl 2.1.x is specifically developed
 and tested for the containerd 2.1.x release cycle.
- Release verification: The official nerdctl release page on GitHub
 explicitly states the intended compatibility. For instance, the
 release notes for nerdctl 2.1.3 confirm it is expected to be used with
 containerd 2.1.
- Feature support: nerdctl 2.1.x includes updates that support the
 latest features and architectural changes in containerd 2.1, such as
 UserNS-Remap mode.
(From Google AI Mode)
Generated using:
 make update-nerdctl-version
and removing the kicbase change, since nerdctl 2.1.3 does not work with
containerd 1.7 consumed from Ubuntu. It will be updated when we switch
to newer version of Ubuntu or Debian.
Copy link
Contributor

@nirs: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
pull-minikube-integration 2aa028e link true /test pull-minikube-integration

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

Copy link

kvm2 driver with docker runtime

┌────────────────┬──────────┬────────────────────────┐
│ COMMAND │ MINIKUBE │ MINIKUBE ( PR 21409 ) │
├────────────────┼──────────┼────────────────────────┤
│ minikube start │ 41.1s │ 43.1s │
│ enable ingress │ 15.9s │ 15.8s │
└────────────────┴──────────┴────────────────────────┘

Times for minikube start: 41.3s 42.0s 41.8s 40.6s 39.9s
Times for minikube (PR 21409) start: 45.1s 40.6s 43.3s 40.7s 45.7s

Times for minikube (PR 21409) ingress: 15.8s 15.8s 15.8s 15.8s 15.8s
Times for minikube ingress: 15.8s 15.8s 15.8s 16.3s 15.8s

docker driver with docker runtime

┌────────────────┬──────────┬────────────────────────┐
│ COMMAND │ MINIKUBE │ MINIKUBE ( PR 21409 ) │
├────────────────┼──────────┼────────────────────────┤
│ minikube start │ 23.4s │ 22.5s │
│ enable ingress │ 11.2s │ 12.4s │
└────────────────┴──────────┴────────────────────────┘

Times for minikube ingress: 10.6s 10.6s 10.6s 11.6s 12.7s
Times for minikube (PR 21409) ingress: 13.6s 13.6s 11.7s 12.6s 10.7s

Times for minikube start: 22.1s 23.6s 22.2s 24.3s 24.9s
Times for minikube (PR 21409) start: 23.4s 22.5s 22.0s 21.9s 22.7s

docker driver with containerd runtime

┌────────────────┬──────────┬────────────────────────┐
│ COMMAND │ MINIKUBE │ MINIKUBE ( PR 21409 ) │
├────────────────┼──────────┼────────────────────────┤
│ minikube start │ 20.9s │ 20.1s │
│ enable ingress │ 20.3s │ 21.1s │
└────────────────┴──────────┴────────────────────────┘

Times for minikube start: 18.8s 20.5s 21.1s 20.7s 23.3s
Times for minikube (PR 21409) start: 21.1s 20.5s 19.4s 18.7s 20.9s

Times for minikube ingress: 20.1s 22.1s 20.1s 19.1s 20.2s
Times for minikube (PR 21409) ingress: 22.1s 20.1s 23.1s 20.1s 20.1s

Copy link

Here are the number of top 10 failed tests in each environments with lowest flake rate.

Environment Test Name Flake Rate
KVM_Linux_containerd (1 failed) TestFunctional/parallel/DashboardCmd(gopogh) 0.00% (chart)
KVM_Linux_crio (6 failed) TestFunctional/parallel/ImageCommands/ImageListShort(gopogh) 2.50% (chart)
KVM_Linux_crio (6 failed) TestStartStop/group/embed-certs/serial/UserAppExistsAfterStop(gopogh) 12.50% (chart)
KVM_Linux_crio (6 failed) TestStartStop/group/embed-certs/serial/AddonExistsAfterStop(gopogh) 12.50% (chart)

Besides the following environments also have failed tests:

  • Docker_Linux_crio_arm64: 42 failed (gopogh)

  • Docker_Linux_crio: 56 failed (gopogh)

To see the flake rates of all tests by environment, click here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ComradeProgrammer ComradeProgrammer Awaiting requested review from ComradeProgrammer

@prezha prezha Awaiting requested review from prezha

@medyagh medyagh Awaiting requested review from medyagh

Assignees

No one assigned

Labels

cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. ok-to-test Indicates a non-member PR verified by an org member that is safe to test. size/L Denotes a PR that changes 100-499 lines, ignoring generated files.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Bump to Containerd 2

AltStyle によって変換されたページ (->オリジナル) /