nerdctl compose file map multiple ports (label key and value length (30968 bytes) greater than maximum size (4096 bytes))

[chawson]

Description

What is the problem you're trying to solve

when compose.yml file include follows code will get error:

compose.yaml: service part

mozi-zlm:
    image: nginx:1.27.4
    ports:
      - '32000-32200:32000-32200'
      - '32000-32200:32000-32200/udp'

nerdctl compose up -d received

Steps to reproduce the issue

Describe the results you received and expected

nerdctl compose file can map multiple ports and when compose failed can still create service

What version of nerdctl are you using?

Client:
Version: v2.0.2
OS/Arch: linux/amd64
Git commit: 1220ce7
buildctl:
Version: v0.18.1
GitCommit: eb68885955169461d72dc2b7e6d084100fcaba86

Are you using a variant of nerdctl? (e.g., Rancher Desktop)

None

Host information

Client:
Namespace: default
Debug Mode: false

Server:
Server Version: v2.0.1
Storage Driver: overlayfs
Logging Driver: json-file
Cgroup Driver: systemd
Cgroup Version: 2
Plugins:
Log: fluentd journald json-file none syslog
Storage: native overlayfs
Security Options:
apparmor
seccomp
Profile: builtin
cgroupns
Kernel Version: 6.14.0-061400rc5-generic
Operating System: Linux Mint 22.1
OSType: linux
Architecture: x86_64
CPUs: 6
Total Memory: 15.54GiB

[AkihiroSuda]

Please provide error logs

[chawson]

INFO

Running [/usr/local/bin/nerdctl run --cidfile=/tmp/compose-2273204707/cid -l=com.docker.compose.project=desktop -l=com.docker.compose.service=mozi-zlm -d --name=mozi-zlm --pull=never -l=wvp.app.zlm --net=mozi-net --hostname=mozi-zlm -p=32000:32000/tcp -p=32001:32001/tcp -p=32002:32002/tcp -p=32003:32003/tcp -p=32004:32004/tcp -p=32005:32005/tcp -p=32006:32006/tcp -p=32007:32007/tcp -p=32008:32008/tcp -p=32009:32009/tcp -p=32010:32010/tcp -p=32011:32011/tcp -p=32012:32012/tcp -p=32013:32013/tcp -p=32014:32014/tcp -p=32015:32015/tcp -p=32016:32016/tcp -p=32017:32017/tcp -p=32018:32018/tcp -p=32019:32019/tcp -p=32020:32020/tcp -p=32021:32021/tcp -p=32022:32022/tcp -p=32023:32023/tcp -p=32024:32024/tcp -p=32025:32025/tcp -p=32026:32026/tcp -p=32027:32027/tcp -p=32028:32028/tcp -p=32029:32029/tcp -p=32030:32030/tcp -p=32031:32031/tcp -p=32032:32032/tcp -p=32033:32033/tcp -p=32034:32034/tcp -p=32035:32035/tcp -p=32036:32036/tcp -p=32037:32037/tcp -p=32038:32038/tcp -p=32039:32039/tcp -p=32040:32040/tcp -p=32041:32041/tcp -p=32042:32042/tcp -p=32043:32043/tcp -p=32044:32044/tcp -p=32045:32045/tcp -p=32046:32046/tcp -p=32047:32047/tcp -p=32048:32048/tcp -p=32049:32049/tcp -p=32050:32050/tcp -p=32051:32051/tcp -p=32052:32052/tcp -p=32053:32053/tcp -p=32054:32054/tcp -p=32055:32055/tcp -p=32056:32056/tcp -p=32057:32057/tcp -p=32058:32058/tcp -p=32059:32059/tcp -p=32060:32060/tcp -p=32061:32061/tcp -p=32062:32062/tcp -p=32063:32063/tcp -p=32064:32064/tcp -p=32065:32065/tcp -p=32066:32066/tcp -p=32067:32067/tcp -p=32068:32068/tcp -p=32069:32069/tcp -p=32070:32070/tcp -p=32071:32071/tcp -p=32072:32072/tcp -p=32073:32073/tcp -p=32074:32074/tcp -p=32075:32075/tcp -p=32076:32076/tcp -p=32077:32077/tcp -p=32078:32078/tcp -p=32079:32079/tcp -p=32080:32080/tcp -p=32081:32081/tcp -p=32082:32082/tcp -p=32083:32083/tcp -p=32084:32084/tcp -p=32085:32085/tcp -p=32086:32086/tcp -p=32087:32087/tcp -p=32088:32088/tcp -p=32089:32089/tcp -p=32090:32090/tcp -p=32091:32091/tcp -p=32092:32092/tcp -p=32093:32093/tcp -p=32094:32094/tcp -p=32095:32095/tcp -p=32096:32096/tcp -p=32097:32097/tcp -p=32098:32098/tcp -p=32099:32099/tcp -p=32100:32100/tcp -p=32101:32101/tcp -p=32102:32102/tcp -p=32103:32103/tcp -p=32104:32104/tcp -p=32105:32105/tcp -p=32106:32106/tcp -p=32107:32107/tcp -p=32108:32108/tcp -p=32109:32109/tcp -p=32110:32110/tcp -p=32111:32111/tcp -p=32112:32112/tcp -p=32113:32113/tcp -p=32114:32114/tcp -p=32115:32115/tcp -p=32116:32116/tcp -p=32117:32117/tcp -p=32118:32118/tcp -p=32119:32119/tcp -p=32120:32120/tcp -p=32121:32121/tcp -p=32122:32122/tcp -p=32123:32123/tcp -p=32124:32124/tcp -p=32125:32125/tcp -p=32126:32126/tcp -p=32127:32127/tcp -p=32128:32128/tcp -p=32129:32129/tcp -p=32130:32130/tcp -p=32131:32131/tcp -p=32132:32132/tcp -p=32133:32133/tcp -p=32134:32134/tcp -p=32135:32135/tcp -p=32136:32136/tcp -p=32137:32137/tcp -p=32138:32138/tcp -p=32139:32139/tcp -p=32140:32140/tcp -p=32141:32141/tcp -p=32142:32142/tcp -p=32143:32143/tcp -p=32144:32144/tcp -p=32145:32145/tcp -p=32146:32146/tcp -p=32147:32147/tcp -p=32148:32148/tcp -p=32149:32149/tcp -p=32150:32150/tcp -p=32151:32151/tcp -p=32152:32152/tcp -p=32153:32153/tcp -p=32154:32154/tcp -p=32155:32155/tcp -p=32156:32156/tcp -p=32157:32157/tcp -p=32158:32158/tcp -p=32159:32159/tcp -p=32160:32160/tcp -p=32161:32161/tcp -p=32162:32162/tcp -p=32163:32163/tcp -p=32164:32164/tcp -p=32165:32165/tcp -p=32166:32166/tcp -p=32167:32167/tcp -p=32168:32168/tcp -p=32169:32169/tcp -p=32170:32170/tcp -p=32171:32171/tcp -p=32172:32172/tcp -p=32173:32173/tcp -p=32174:32174/tcp -p=32175:32175/tcp -p=32176:32176/tcp -p=32177:32177/tcp -p=32178:32178/tcp -p=32179:32179/tcp -p=32180:32180/tcp -p=32181:32181/tcp -p=32182:32182/tcp -p=32183:32183/tcp -p=32184:32184/tcp -p=32185:32185/tcp -p=32186:32186/tcp -p=32187:32187/tcp -p=32188:32188/tcp -p=32189:32189/tcp -p=32190:32190/tcp -p=32191:32191/tcp -p=32192:32192/tcp -p=32193:32193/tcp -p=32194:32194/tcp -p=32195:32195/tcp -p=32196:32196/tcp -p=32197:32197/tcp -p=32198:32198/tcp -p=32199:32199/tcp -p=32200:32200/tcp -p=32000:32000/udp -p=32001:32001/udp -p=32002:32002/udp -p=32003:32003/udp -p=32004:32004/udp -p=32005:32005/udp -p=32006:32006/udp -p=32007:32007/udp -p=32008:32008/udp -p=32009:32009/udp -p=32010:32010/udp -p=32011:32011/udp -p=32012:32012/udp -p=32013:32013/udp -p=32014:32014/udp -p=32015:32015/udp -p=32016:32016/udp -p=32017:32017/udp -p=32018:32018/udp -p=32019:32019/udp -p=32020:32020/udp -p=32021:32021/udp -p=32022:32022/udp -p=32023:32023/udp -p=32024:32024/udp -p=32025:32025/udp -p=32026:32026/udp -p=32027:32027/udp -p=32028:32028/udp -p=32029:32029/udp -p=32030:32030/udp -p=32031:32031/udp -p=32032:32032/udp -p=32033:32033/udp -p=32034:32034/udp -p=32035:32035/udp -p=32036:32036/udp -p=32037:32037/udp -p=32038:32038/udp -p=32039:32039/udp -p=32040:32040/udp -p=32041:32041/udp -p=32042:32042/udp -p=32043:32043/udp -p=32044:32044/udp -p=32045:32045/udp -p=32046:32046/udp -p=32047:32047/udp -p=32048:32048/udp -p=32049:32049/udp -p=32050:32050/udp -p=32051:32051/udp -p=32052:32052/udp -p=32053:32053/udp -p=32054:32054/udp -p=32055:32055/udp -p=32056:32056/udp -p=32057:32057/udp -p=32058:32058/udp -p=32059:32059/udp -p=32060:32060/udp -p=32061:32061/udp -p=32062:32062/udp -p=32063:32063/udp -p=32064:32064/udp -p=32065:32065/udp -p=32066:32066/udp -p=32067:32067/udp -p=32068:32068/udp -p=32069:32069/udp -p=32070:32070/udp -p=32071:32071/udp -p=32072:32072/udp -p=32073:32073/udp -p=32074:32074/udp -p=32075:32075/udp -p=32076:32076/udp -p=32077:32077/udp -p=32078:32078/udp -p=32079:32079/udp -p=32080:32080/udp -p=32081:32081/udp -p=32082:32082/udp -p=32083:32083/udp -p=32084:32084/udp -p=32085:32085/udp -p=32086:32086/udp -p=32087:32087/udp -p=32088:32088/udp -p=32089:32089/udp -p=32090:32090/udp -p=32091:32091/udp -p=32092:32092/udp -p=32093:32093/udp -p=32094:32094/udp -p=32095:32095/udp -p=32096:32096/udp -p=32097:32097/udp -p=32098:32098/udp -p=32099:32099/udp -p=32100:32100/udp -p=32101:32101/udp -p=32102:32102/udp -p=32103:32103/udp -p=32104:32104/udp -p=32105:32105/udp -p=32106:32106/udp -p=32107:32107/udp -p=32108:32108/udp -p=32109:32109/udp -p=32110:32110/udp -p=32111:32111/udp -p=32112:32112/udp -p=32113:32113/udp -p=32114:32114/udp -p=32115:32115/udp -p=32116:32116/udp -p=32117:32117/udp -p=32118:32118/udp -p=32119:32119/udp -p=32120:32120/udp -p=32121:32121/udp -p=32122:32122/udp -p=32123:32123/udp -p=32124:32124/udp -p=32125:32125/udp -p=32126:32126/udp -p=32127:32127/udp -p=32128:32128/udp -p=32129:32129/udp -p=32130:32130/udp -p=32131:32131/udp -p=32132:32132/udp -p=32133:32133/udp -p=32134:32134/udp -p=32135:32135/udp -p=32136:32136/udp -p=32137:32137/udp -p=32138:32138/udp -p=32139:32139/udp -p=32140:32140/udp -p=32141:32141/udp -p=32142:32142/udp -p=32143:32143/udp -p=32144:32144/udp -p=32145:32145/udp -p=32146:32146/udp -p=32147:32147/udp -p=32148:32148/udp -p=32149:32149/udp -p=32150:32150/udp -p=32151:32151/udp -p=32152:32152/udp -p=32153:32153/udp -p=32154:32154/udp -p=32155:32155/udp -p=32156:32156/udp -p=32157:32157/udp -p=32158:32158/udp -p=32159:32159/udp -p=32160:32160/udp -p=32161:32161/udp -p=32162:32162/udp -p=32163:32163/udp -p=32164:32164/udp -p=32165:32165/udp -p=32166:32166/udp -p=32167:32167/udp -p=32168:32168/udp -p=32169:32169/udp -p=32170:32170/udp -p=32171:32171/udp -p=32172:32172/udp -p=32173:32173/udp -p=32174:32174/udp -p=32175:32175/udp -p=32176:32176/udp -p=32177:32177/udp -p=32178:32178/udp -p=32179:32179/udp -p=32180:32180/udp -p=32181:32181/udp -p=32182:32182/udp -p=32183:32183/udp -p=32184:32184/udp -p=32185:32185/udp -p=32186:32186/udp -p=32187:32187/udp -p=32188:32188/udp -p=32189:32189/udp -p=32190:32190/udp -p=32191:32191/udp -p=32192:32192/udp -p=32193:32193/udp -p=32194:32194/udp -p=32195:32195/udp -p=32196:32196/udp -p=32197:32197/udp -p=32198:32198/udp -p=32199:32199/udp -p=32200:32200/udp --restart=always nginx:1.27.4]
FATA[0000] create container failed validation: containers.Labels: label key and value length (30968 bytes) greater than maximum size (4096 bytes), key: nerdctl/ports: invalid argument
FATA[0000] error while creating container mozi-zlm: error while creating container mozi-zlm: exit status 1

[haytok]

HI, @AkihiroSuda

I'll work on this issue, so could you assign this issue to me?

In my investigation at this time:

Each port mappings specified with the -p option is converted to cni.PortMapping object, which is then converted to json and then to string.

nerdctl/pkg/cmd/container/create.go

Line 841 in f860057

il.ports = opts.PortMappings

nerdctl/pkg/cmd/container/create.go

Lines 733 to 739 in f860057

	if len(internalLabels.ports) > 0 {
	portsJSON, err := json.Marshal(internalLabels.ports)
	if err != nil {
	return nil, err
	}
	m[labels.Ports] = string(portsJSON)
	}

The string is specified as a Label when the container is created (both nerdctl run and nerdctl compose up), but the following restriction on containerd side causes this issue's error.

• https://github.com/containerd/containerd/blob/a5b4a2aa2e723425fef4cb7811aa139ad99dc61a/pkg/labels/validate.go#L34-L38

Therefore, it would be a thought to modify it accordingly, including the following logic.

nerdctl/pkg/ocihook/ocihook.go

Lines 210 to 214 in f860057

	if portsJSON := o.state.Annotations[labels.Ports]; portsJSON != "" {
	if err := json.Unmarshal([]byte(portsJSON), &o.ports); err != nil {
	return nil, err
	}
	}