Merge tag 'v1.6.21' into release-4.13

containerd 1.6.21

Welcome to the v1.6.21 release of containerd!

The twenty-first patch release for containerd 1.6 contains various fixes and updates.

* **update runc binary to v1.1.7 ([containerd#8450](containerd#8450))
* **Remove entry for container from container store on error ([containerd#8456](containerd#8456))
* **oci: partially restore comment on read-only mounts for uid/gid uses ([containerd#8403](containerd#8403))
* **windows: Add ArgsEscaped support for CRI ([containerd#8247](containerd#8247))
* **oci: Use WithReadonlyTempMount when adding users/groups ([containerd#8357](containerd#8357))
* **archive: consistently respect value of WithSkipDockerManifest ([containerd#8345](containerd#8345))

See the changelog for complete list of changes

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

* Derek McGowan
* Sebastiaan van Stijn
* Iceber Gu
* Kirtana Ashok
* Justin Chadwell
* Phil Estes
* Akihiro Suda
* Djordje Lukic
* Kazuyoshi Kato
* Mike Brown
* Wei Fu
* kiashok

<details><summary>26 commits</summary>
<p>

* [release/1.6] Prepare release notes for v1.6.21  ([containerd#8463](containerd#8463))
  * [`9226c362a`](containerd@9226c36) Add release notes for v1.6.21
* [release/1.6] update go to go1.19.9 ([containerd#8469](containerd#8469))
  * [`39566aade`](containerd@39566aa) [release/1.6] update go to go1.19.9
* [release/1.6] fix the task setting the runtime path ([containerd#8454](containerd#8454))
  * [`e8840f688`](containerd@e8840f6) skip TestContainerStartWithAbsRuntimePath if the runtime is v1
  * [`75ab094de`](containerd@75ab094) integration: add container start test using abs runtime path
  * [`f49254f0b`](containerd@f49254f) WithRuntimePath uses the TaskInfo.RuntimePath field
* [release/1.6 backport] update runc binary to v1.1.7 ([containerd#8450](containerd#8450))
  * [`ccb51ff26`](containerd@ccb51ff) update runc binary to v1.1.7
* [release/1.6] Remove entry for container from container store on error ([containerd#8456](containerd#8456))
  * [`95d31551d`](containerd@95d3155) Remove entry for container from container store on error
* [release/1.6 backport] oci: partially restore comment on read-only mounts for uid/gid uses ([containerd#8403](containerd#8403))
  * [`c33eb574d`](containerd@c33eb57) oci: partially restore comment on read-only mounts for uid/gid uses
* [release/1.6 ] Add ArgsEscaped support for CRI ([containerd#8247](containerd#8247))
  * [`bc2e01303`](containerd@bc2e013) Fix argsEscaped tests
  * [`8b81d5acc`](containerd@8b81d5a) Add ArgsEscaped support for CRI
* [release/1.6 backport] update runc binary to v1.1.6 ([containerd#8385](containerd#8385))
  * [`57d953482`](containerd@57d9534) update runc binary to v1.1.6
* [release/1.6 backport] oci: Use WithReadonlyTempMount when adding users/groups ([containerd#8357](containerd#8357))
  * [`fb5e663d0`](containerd@fb5e663) oci: Use WithReadonlyTempMount when adding users/groups
* [release/1.6] update go to go1.19.8 ([containerd#8353](containerd#8353))
  * [`26efb8fd5`](containerd@26efb8f) [release/1.6] update go to go1.19.8
* [release/1.6] archive: consistently respect value of WithSkipDockerManifest ([containerd#8345](containerd#8345))
  * [`ec13b497e`](containerd@ec13b49) export: add test for WithSkipDockerManifest
  * [`d1f3771c4`](containerd@d1f3771) archive: consistently respect value of WithSkipDockerManifest
</p>
</details>

This release has no dependency changes

Previous release can be found at [v1.6.20](https://github.com/containerd/containerd/releases/tag/v1.6.20)

Author: aravindhp

.github/workflows/build-test-images.yml

@@ -41,7 +41,7 @@ jobs:
     steps:
       - uses: actions/setup-go@v3
         with:
-          go-version: '1.19.6'
+          go-version: '1.19.9'
 
       - uses: actions/checkout@v3
         with:

.github/workflows/ci.yml

@@ -12,7 +12,7 @@ on:
 env:
   # Go version we currently use to build containerd across all CI.
   # Note: don't forget to update `Binaries` step, as it contains the matrix of all supported Go versions.
-  GO_VERSION: '1.19.6'
+  GO_VERSION: '1.19.9'
 
 permissions:  # added using https://github.com/step-security/secure-workflows
   contents: read
@@ -47,7 +47,7 @@ jobs:
       - uses: actions/checkout@v3
       - uses: golangci/golangci-lint-action@v3
         with:
-          version: v1.49.0
+          version: v1.50.1
           skip-cache: true
           args: --timeout=5m
 
@@ -233,7 +233,7 @@ jobs:
     strategy:
       matrix:
         os: [ubuntu-20.04, macos-12, windows-2019, windows-2022]
-        go-version: ["1.17.13", "1.19.6"]
+        go-version: ["1.17.13", "1.19.9"]
     steps:
       - name: Install dependencies
         if: matrix.os == 'ubuntu-20.04'

.github/workflows/codeql.yml

@@ -33,7 +33,7 @@ jobs:
 
     - uses: actions/setup-go@v3
       with:
-        go-version: 1.19.6
+        go-version: 1.19.9
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL

.github/workflows/images.yml

@@ -26,7 +26,7 @@ jobs:
     steps:
       - uses: actions/setup-go@v3
         with:
-          go-version: '1.19.6'
+          go-version: '1.19.9'
 
       - uses: actions/checkout@v3
         with:

.github/workflows/nightly.yml

@@ -7,7 +7,7 @@ on:
       - '.github/workflows/nightly.yml'
 
 env:
-  GO_VERSION: '1.19.6'
+  GO_VERSION: '1.19.9'
 
 permissions:  # added using https://github.com/step-security/secure-workflows
   contents: read

.github/workflows/release.yml

@@ -6,7 +6,7 @@ on:
 name: Containerd Release
 
 env:
-  GO_VERSION: '1.19.6'
+  GO_VERSION: '1.19.9'
 
 permissions:  # added using https://github.com/step-security/secure-workflows
   contents: read

.github/workflows/windows-periodic.yml

@@ -162,7 +162,11 @@ jobs:
 
       - name: RunIntegrationTests
         run: |
-          ssh -i $HOME/.ssh/id_rsa ${{ env.SSH_OPTS }} azureuser@${{ env.VM_PUB_IP }} "sh.exe -c 'cd /c/containerd && (make integration | tee /c/Logs/integration.log)'"
+          ssh -i $HOME/.ssh/id_rsa ${{ env.SSH_OPTS }} azureuser@${{ env.VM_PUB_IP }} "sh.exe -s" << EOF
+            cd /c/containerd
+            export EXTRA_TESTFLAGS="-timeout=20m"
+            make integration | tee /c/Logs/integration.log
+          EOF
           ssh -i $HOME/.ssh/id_rsa ${{ env.SSH_OPTS }} azureuser@${{ env.VM_PUB_IP }} "sh.exe -c 'cat /c/Logs/integration.log | go-junit-report.exe > /c/Logs/junit_00.xml'"
 
       - name: PrepareRepoList
@@ -185,7 +189,6 @@ jobs:
            ssh -i $HOME/.ssh/id_rsa ${{ env.SSH_OPTS }} azureuser@${{ env.VM_PUB_IP }} "sh.exe -s" <<EOF
              cd c:/containerd
              ./script/setup/install-cni-windows
-             mkdir /c/tmp
              export TEST_IMAGE_LIST=c:/repolist.toml
              make cri-integration | tee c:/Logs/cri-integration.log
            EOF

.golangci.yml

@@ -1,27 +1,55 @@
 linters:
   enable:
-    - structcheck
-    - varcheck
-    - staticcheck
-    - unconvert
+    - exportloopref # Checks for pointers to enclosing loop variables
     - gofmt
     - goimports
-    - revive
+    - gosec
     - ineffassign
-    - vet
-    - unused
     - misspell
+    - nolintlint
+    - revive
+    - staticcheck
+    - tenv # Detects using os.Setenv instead of t.Setenv since Go 1.17
+    - unconvert
+    - unused
+    - vet
+    - dupword # Checks for duplicate words in the source code
   disable:
     - errcheck
 
 issues:
   include:
     - EXC0002
+  max-issues-per-linter: 0
+  max-same-issues: 0
+
+  # Only using / doesn't work due to https://github.com/golangci/golangci-lint/issues/1398.
+  exclude-rules:
+    - path: 'archive[\\/]tarheader[\\/]'
+      # conversion is necessary on Linux, unnecessary on macOS
+      text: "unnecessary conversion"
+
+linters-settings:
+  gosec:
+    # The following issues surfaced when `gosec` linter
+    # was enabled. They are temporarily excluded to unblock
+    # the existing workflow, but still to be addressed by
+    # future works.
+    excludes:
+      - G204
+      - G305
+      - G306
+      - G402
+      - G404
 
 run:
   timeout: 8m
   skip-dirs:
     - api
+    - cluster
     - design
     - docs
     - docs/man
+    - releases
+    - reports
+    - test # e2e scripts

Vagrantfile

@@ -93,7 +93,7 @@ EOF
   config.vm.provision "install-golang", type: "shell", run: "once" do |sh|
     sh.upload_path = "/tmp/vagrant-install-golang"
     sh.env = {
-        'GO_VERSION': ENV['GO_VERSION'] || "1.19.6",
+        'GO_VERSION': ENV['GO_VERSION'] || "1.19.9",
     }
     sh.inline = <<~SHELL
         #!/usr/bin/env bash