Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix deadlock when writing to pipe blocks #168

Merged
merged 1 commit into from
May 13, 2024
Merged

Fix deadlock when writing to pipe blocks #168

merged 1 commit into from
May 13, 2024

Conversation

kevpar
Copy link
Member

@kevpar kevpar commented May 11, 2024 •
edited
Loading

Swap to calling send, which handles taking sendLock for us rather than doing it directly in createStream. This means that streamLock is now released before taking sendLock.

Taking sendLock before releasing streamLock means that if a goroutine blocks writing to the pipe, it can make another goroutine get stuck trying to take sendLock, and therefore streamLock will be kept locked as well. This can lead to the receiver goroutine no longer being able to read responses from the pipe, since it needs to take streamLock when processing a response. This ultimately leads to a complete deadlock of the client.

It is reasonable for a server to block writes to the pipe if the client is not reading responses fast enough. So we can't expect writes to never block.

I have repro'd the hang with a simple ttrpc client and server. The client spins up 100 goroutines that spam the server with requests constantly. After a few seconds of running I can see it hang. I have set the buffer size for the pipe to 0 to more easily repro, but it would still be possible to hit with a larger buffer size (just may take a higher volume of requests or larger payloads).

I also validated that I no longer see the hang with this fix, by leaving the test client/server running for a few minutes. Obviously not 100% conclusive, but before I could get a hang within several seconds of running.

@kevpar kevpar force-pushed the deadlock branch 2 times, most recently from f06ddee to f0e2206 Compare May 11, 2024 05:10
@kevpar kevpar mentioned this pull request May 11, 2024
Closed
cpuguy83
cpuguy83 approved these changes May 11, 2024
View reviewed changes
Copy link
Member

@cpuguy83 cpuguy83 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

The old behavior does indeed look fishy as generally locks need to be taken and released in order.
I guess the main thing here is the message may send out of order now.
I don't think that should matter.

@cpuguy83
Copy link
Member

CI appears to have hung, however.

@kiashok
Copy link

kiashok commented May 13, 2024

@dmcgowan could you take a look? This deadlock seems to be happening quite a bit offlate for some customers.

@dmcgowan
Copy link
Member

it can make another goroutine get stuck trying to take sendLock

Where is the other sendLock hung at? The stream creation ordering must still be preserved and unlocking streamlock before the send lock opens up the possibility of a protocol error sending out of order stream creates. While that is unlikely, it must be protected and would probably be even more difficult to reproduce.

@kevpar
Copy link
Member Author

kevpar commented May 13, 2024 •
edited
Loading

it can make another goroutine get stuck trying to take sendLock

Where is the other sendLock hung at? The stream creation ordering must still be preserved and unlocking streamlock before the send lock opens up the possibility of a protocol error sending out of order stream creates. While that is unlikely, it must be protected and would probably be even more difficult to reproduce.

Goroutine 1 is holding sendLock and is blocked sending a request on the pipe (https://github.com/containerd/ttrpc/blob/main/client.go#L409).
Goroutine 2 is holding streamLock and is blocked trying to take sendLock (https://github.com/containerd/ttrpc/blob/main/client.go#L405).
Goroutine 3 is the client's receiver goroutine, and is blocked trying to take streamLock as part of processing an incoming response (https://github.com/containerd/ttrpc/blob/main/client.go#L424).

I put more info here too: #72 (comment)

What is the reason that stream IDs need to be sent over the wire in order? Could we relax that constraint?

@dmcgowan
Copy link
Member

Its seems in that case, goroutine 3 should be able to proceed if we managed the locking better. Goroutine 1 and 2 are correctly blocking each other.

I think putting the back pressure on the client would be good, but we definitely shouldn't have any contention between requests and response in the client. I think if we broke up streamLock from an rwmutex into two mutexes it would be cleaner. The first mutex (or could just be any synced map) around access to s.streams, then the second mutex only on createStream to protect the stream id ordering. Its good to avoid RWMutex anyway, but in this case a single RWMutex doesn't seem correct and it covering too much.

What is the reason that stream IDs need to be sent over the wire in order? Could we relax that constraint?

This design we borrowed from spdy/http2 which has pretty solid reasoning behind it. It keeps the stream ids unique without worrying about clashing or tracking a large map of active or previously seen identifiers. This make the implementation easy and fast, you only need a single incrementing integer.

@kevpar
Copy link
Member Author

kevpar commented May 13, 2024

I think putting the back pressure on the client would be good, but we definitely shouldn't have any contention between requests and response in the client. I think if we broke up streamLock from an rwmutex into two mutexes it would be cleaner. The first mutex (or could just be any synced map) around access to s.streams, then the second mutex only on createStream to protect the stream id ordering. Its good to avoid RWMutex anyway, but in this case a single RWMutex doesn't seem correct and it covering too much.

I think it works to just take sendLock before we take streamLock in createStream and hold it for the entire function. I just pushed a change that does this, can you take a look?

I'm still reviewing it to make sure it doesn't seem like it will break anything else, but this appears good as streamLock is the only contention between sending and receiving, and it's never held across any blocking calls. Taking sendLock at the start of createStream should ensure we still send new stream IDs in correct order.

We could also swap from streamLock + map to a sync.Map. I'm fine either way.

@dmcgowan
Copy link
Member

Even better!

We can leave the stream lock alone in this PR but switching to sync.Mutex + map or sync.Map is probably better than using RWMutex.

@kevpar
Copy link
Member Author

kevpar commented May 13, 2024

Sounds great! I will fix up the commit description to be accurate, and look over a bit more for any concerns. Otherwise I think this should be good.

@kevpar
client: Fix deadlock when writing to pipe blocks
1b4f6f8 
Use sendLock to guard the entire stream allocation + write to wire
operation, and streamLock to only guard access to the underlying stream
map. This ensures the following:
- We uphold the constraint that new stream IDs on the wire are always
  increasing, because whoever holds sendLock will be ensured to get the
  next stream ID and be the next to write to the wire.
- Locks are always released in LIFO order. This prevents deadlocks.

Taking sendLock before releasing streamLock means that if a goroutine
blocks writing to the pipe, it can make another goroutine get stuck
trying to take sendLock, and therefore streamLock will be kept locked as
well. This can lead to the receiver goroutine no longer being able to
read responses from the pipe, since it needs to take streamLock when
processing a response. This ultimately leads to a complete deadlock of
the client.

It is reasonable for a server to block writes to the pipe if the client
is not reading responses fast enough. So we can't expect writes to never
block.

I have repro'd the hang with a simple ttrpc client and server. The
client spins up 100 goroutines that spam the server with requests
constantly. After a few seconds of running I can see it hang. I have set
the buffer size for the pipe to 0 to more easily repro, but it would
still be possible to hit with a larger buffer size (just may take a
higher volume of requests or larger payloads).

I also validated that I no longer see the hang with this fix, by leaving
the test client/server running for a few minutes. Obviously not 100%
conclusive, but before I could get a hang within several seconds of
running.

Signed-off-by: Kevin Parsons <[email protected]>
@kevpar
Copy link
Member Author

kevpar commented May 13, 2024

It's possible adding another mutex (to have separate mutexes for "write to the wire" and "allocate stream + write to the wire") would reduce contention slightly, since (*stream).send would only need to the take first mutex. However, stream allocation should be very fast since there are no blocking calls, and I'm not sure if it's worth the extra code complexity of adding another mutex into the mix.

@kevpar kevpar merged commit ef57342 into containerd:main May 13, 2024
11 checks passed
@kevpar
Copy link
Member Author

kevpar commented May 13, 2024

Thanks for the quick review!

@dmcgowan dmcgowan changed the title client: Fix deadlock when writing to pipe blocks Fix deadlock when writing to pipe blocks May 15, 2024
@dmcgowan dmcgowan mentioned this pull request May 16, 2024
Merged
@jsturtevant jsturtevant mentioned this pull request May 30, 2024
Closed
@dmcgowan dmcgowan mentioned this pull request Jun 13, 2024
Merged
@ben-childs-docusign ben-childs-docusign mentioned this pull request Jul 22, 2024
Closed
@AkihiroSuda AkihiroSuda mentioned this pull request Aug 15, 2024
Closed
@dmcgowan dmcgowan mentioned this pull request Aug 27, 2024
Merged
@dmcgowan dmcgowan mentioned this pull request Sep 30, 2024
Merged
Mengkzhaoyun pushed a commit to open-beagle/containerd that referenced this pull request Oct 11, 2024
Merge tag 'v2.0.0-rc.5' into release-v2.0
c737fe2 
containerd 2.0.0-rc.5

Welcome to the v2.0.0-rc.5 release of containerd!
*This is a pre-release of containerd*

The first major release of containerd 2.x focuses on the continued stability of
containerd's core feature set with an easy upgrade from containerd 1.x. This
release includes the stabilization of new features added in the last 1.x release
as well as the removal of features which were deprecated in 1.x. The goal is to
support the vast community of containerd users well into the future along with
their ever increasing deployment footprints and variety of use cases.

* Add Update API for sandbox controller ([#9903](containerd/containerd#9903))
* Configure otel from env instead of config.toml ([#8970](containerd/containerd#8970))
* Enable NRI by default ([#9744](containerd/containerd#9744))
* Add PluginInfo to introspection API ([#9442](containerd/containerd#9442))
* Remove overlayfs volatile option on temp mounts ([#9555](containerd/containerd#9555))
* Expose usage of deprecated features ([#9258](containerd/containerd#9258))
* Use Intel ISA-L's igzip if available ([#9200](containerd/containerd#9200))
* Introduce top level config migration ([#9223](containerd/containerd#9223))
* Add image delete target ([#8989](containerd/containerd#8989))
* Remove `LimitNOFILE` from `containerd.service` ([#8924](containerd/containerd#8924))
* Add support for image expiration during garbage collection ([#9022](containerd/containerd#9022))
* Reduce the contention between ref lock and boltdb lock in content store ([#8792](containerd/containerd#8792))
* Remove "containerd.io/restart.logpath" label ([#8264](containerd/containerd#8264))
* Remove `aufs` snapshotter ([#8263](containerd/containerd#8263))
* Fix deadlock during NRI plugin registration ([containerd/nri#79](containerd/nri#79))
* Fix deadlock when writing to pipe blocks ([containerd/ttrpc#168](containerd/ttrpc#168))

* Generate attestation for artifacts during release ([#10543](containerd/containerd#10543))

* Use 'UserSpecifiedImage' from CRI to set the image-name annotation ([#10747](containerd/containerd#10747))
* Add support to set loopback to up ([#10238](containerd/containerd#10238))
* Add support for multiple subscribers to CRI container events ([#9661](containerd/containerd#9661))
* Enable CDI by default ([#9621](containerd/containerd#9621))
* Remove non-sandboxed CRI implementation ([#9228](containerd/containerd#9228))
* Add support for userns in stateless and stateful pods with idmap mounts (KEP-127, k8s >= 1.27) ([#8287](containerd/containerd#8287))
* Use sandboxed CRI by default ([#8994](containerd/containerd#8994))
* Implement RuntimeConfig CRI call ([#8722](containerd/containerd#8722))
* Add support for user namespaces (KEP-127) ([#8803](containerd/containerd#8803))
* Remove CRI v1alpha2 ([#8276](containerd/containerd#8276))

* Add api Go module and move all protos under api ([#10151](containerd/containerd#10151))
* Move packages based on contributing guide ([#9365](containerd/containerd#9365))
* Generalize plugin library ([#9214](containerd/containerd#9214))
* Use github.com/containerd/log ([#9086](containerd/containerd#9086))

* Support to syncfs after pull by using diff plugin ([#10284](containerd/containerd#10284))
* Skip "unknown" in image platform listing ([#10257](containerd/containerd#10257))
* Update unpacker to fetch all provided content ([#10202](containerd/containerd#10202))
* Enable Transfer service API to support plain HTTP ([#10024](containerd/containerd#10024))
* Enable Transfer service to use registry configuration directory ([#9908](containerd/containerd#9908))
* Disable the support for Schema 1 images ([#9765](containerd/containerd#9765))
* Update Transfer service to add OCI descriptors to Progress structure ([#9630](containerd/containerd#9630))
* Update import and export to allow references to missing content  ([#9554](containerd/containerd#9554))
* Add option to perform syncfs after pull ([#9401](containerd/containerd#9401))
* Add image verifier transfer service plugin system based on a binary directory ([#8493](containerd/containerd#8493))

* Implement  RuntimeStatus.features.supplemental_groups_policy from KEP-3619 ([#10410](containerd/containerd#10410))
* Add pprof to runc-shim ([#10242](containerd/containerd#10242))
* Provide runtime options in plugin info ([#10251](containerd/containerd#10251))
* Store bootstrap parameters in sandbox metadata ([#9736](containerd/containerd#9736))
* Update apparmor to allow confined runc to kill containers ([#10123](containerd/containerd#10123))
* Support vsock connection to task api ([#9738](containerd/containerd#9738))
* Update RuntimeDefault seccomp profile to disallow io_uring related syscalls ([#9320](containerd/containerd#9320))
* Switch runc shim to task service v3 and fix restore ([#9233](containerd/containerd#9233))
* Add sandboxer configuration and move sandbox controllers to plugins ([#8268](containerd/containerd#8268))
* Add annotations to CreateSandbox request ([#8960](containerd/containerd#8960))
* Add SandboxMetrics ([#8680](containerd/containerd#8680))
* Publish sandbox events ([#8602](containerd/containerd#8602))
* Remove the CriuPath field from runc's options ([#8279](containerd/containerd#8279))
* Remove `io.containerd.runtime.v1.linux` and `io.containerd.runc.v1` ([#8262](containerd/containerd#8262))

* [medium] RAPL accessible to a container [GHSA-7ww5-4wqc-m92c](GHSA-7ww5-4wqc-m92c)

* Remove `disable_cgroup` from CRI config ([#10594](containerd/containerd#10594))
* Disable the support for Schema 1 images ([#9765](containerd/containerd#9765))
* Update RuntimeDefault seccomp profile to disallow io_uring related syscalls ([#9320](containerd/containerd#9320))
* Move client to subpackage ([#9316](containerd/containerd#9316))
* Remove `LimitNOFILE` from `containerd.service` ([#8924](containerd/containerd#8924))
* Remove CRI v1alpha2 ([#8276](containerd/containerd#8276))
* Remove `io.containerd.runtime.v1.linux` and `io.containerd.runc.v1` ([#8262](containerd/containerd#8262))
* Remove "containerd.io/restart.logpath" label ([#8264](containerd/containerd#8264))
* Remove `aufs` snapshotter ([#8263](containerd/containerd#8263))

* Update warnings for deprecated CRI config fields ([#10509](containerd/containerd#10509))
* Add type alias for event Envelope ([#10279](containerd/containerd#10279))
* Postpone removal of deprecated CRI config properties ([#9966](containerd/containerd#9966))
* Deprecate go-plugin configuration option ([#9238](containerd/containerd#9238))
* CNI conf_template in CRI is no longer deprecated ([#8637](containerd/containerd#8637))

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

* Derek McGowan
* Akihiro Suda
* Maksym Pavlenko
* Wei Fu
* Phil Estes
* Sebastiaan van Stijn
* Samuel Karp
* Stefan Berger
* Kazuyoshi Kato
* Rodrigo Campos
* Danny Canter
* Abel Feng
* Akhil Mohan
* Kirtana Ashok
* Gabriel Adrian Samfira
* Austin Vazquez
* Iceber Gu
* Krisztian Litkey
* Kohei Tokunaga
* Mike Brown
* Jin Dong
* Bjorn Neergaard
* Justin Chadwell
* rongfu.leng
* James Sturtevant
* Davanum Srinivas
* Paul "TBBle" Hampson
* Henry Wang
* Brian Goff
* Enrico Weigelt
* Laura Brehm
* Marat Radchenko
* Paweł Gronowski
* Shingo Omura
* Hsing-Yu (David) Chen
* Ilya Hanov
* Cardy.Tang
* Swagat Bora
* Aditi Sharma
* Amit Barve
* Bryant Biggs
* Evan Lezar
* James Jenkins
* Jordan Liggitt
* Kay Yan
* Markus Lehtonen
* Nashwan Azhari
* Shuaiyi Zhang
* Vinayak Goyal
* helen
* Alexandru Matei
* Anthony Nandaa
* Avi Deitcher
* Charity Kathure
* Cory Snider
* Ed Bartosh
* Etienne Champetier
* Kevin Parsons
* Michael Zappa
* Milas Bowman
* ningmingxiao
* yanggang
* zounengren
* Aditya Ramani
* Adrian Reber
* Amir M. Ghazanfari
* Artem Khramov
* Brad Davidson
* Chen Yiyang
* Christian Muehlhaeuser
* Djordje Lukic
* Edgar Lee
* Eric Lin
* Ethan Lowman
* Jiang Liu
* June Rhodes
* Kern Walster
* Lucas Rattz
* Mahamed Ali
* Maksim An
* Michael Crosby
* Peteris Rudzusiks
* Sam Edwards
* Samruddhi Khandale
* Sascha Grunert
* Steve Griffith
* Tony Fang
* VERNOU Cédric
* Vishal Reddy Gurrala
* hang.jiang
* harshitasao
* jerryzhuang
* lengrongfu
* roman-kiselenko
* zhanluxianshen
* Aaron Lehmann
* Adrien Delorme
* Alex Couture-Beil
* Alex Ellis
* Alex Rodriguez
* Angelos Kolaitis
* Antonio Huete Jimenez
* Arash Haghighat
* Ben Foster
* Bin Tang
* Bin Xin
* BinBin He
* Brennan Kinney
* Changqing Li
* ChengenH
* ChengyuZhu6
* Christian Stewart
* Colin O'Dell
* Craig Ingram
* Daisy Rong
* David Porter
* Derek Nola
* Eng Zer Jun
* Erikson Tung
* Fabiano Fidêncio
* Fahed Dorgaa
* Gary McDonald
* Iain Macdonald
* James Lakin
* Jan Dubois
* Jaroslav Jindrak
* Javier Maestro
* Jian Wang
* Jiongchi Yu
* Julien Balestra
* Kir Kolyshkin
* Kirill A. Korinsky
* Konstantin Khlebnikov
* Mauri de Souza Meneguzzo
* Pan Yibo
* Paul Meyer
* Qasim Sarfraz
* Qiutong Song
* Reinhard Tartler
* Robbie Buxton
* Robert-André Mauchin
* Ruihua Wen
* Sameer
* Shengjing Zhu
* Shiming Zhang
* Shukui Yang
* Talon
* Tariq Ibrahim
* Tianon Gravi
* Tim Hockin
* TinaMor
* Tobias Klauser
* Tomáš Virtus
* Tõnis Tiigi
* Wang Xinwen
* William Chen
* Xinyang Ge
* Yibo Zhuang
* Yury Gargay
* Zechun Chen
* Zhang Tianyang
* Zoe
* baijia
* bo.jiang
* bzsuni
* charles-chenzz
* chschumacher1994
* guangli.bao
* guangwu
* jinda.ljd
* krglosse
* pigletfly
* rokkiter
* wangxiang
* zhangpeng
* zhaojizhuang
* 吴小白
* 张钰
* 沈陵
* 谭九鼎

* **dario.cat/mergo**                                                              v1.0.1 **_new_**
* **github.com/AdaLogics/go-fuzz-headers**                                         1f10f66a31bf -> ced1acdcaa24
* **github.com/AdamKorcz/go-118-fuzz-build**                                       5330a85ea652 -> 8075edf89bb0
* **github.com/Microsoft/go-winio**                                                v0.6.0 -> v0.6.2
* **github.com/Microsoft/hcsshim**                                                 v0.10.0-rc.7 -> v0.12.6
* **github.com/cenkalti/backoff/v4**                                               v4.2.0 -> v4.3.0
* **github.com/cespare/xxhash/v2**                                                 v2.2.0 -> v2.3.0
* **github.com/checkpoint-restore/checkpointctl**                                  v1.2.1 **_new_**
* **github.com/checkpoint-restore/go-criu/v7**                                     v7.2.0 **_new_**
* **github.com/cilium/ebpf**                                                       v0.9.1 -> v0.11.0
* **github.com/containerd/cgroups/v3**                                             v3.0.1 -> v3.0.3
* **github.com/containerd/console**                                                v1.0.3 -> v1.0.4
* **github.com/containerd/containerd/api**                                         v1.8.0-rc.3 **_new_**
* **github.com/containerd/continuity**                                             v0.3.0 -> v0.4.3
* **github.com/containerd/errdefs**                                                v0.1.0 **_new_**
* **github.com/containerd/go-cni**                                                 v1.1.9 -> v1.1.10
* **github.com/containerd/go-runc**                                                v1.0.0 -> v1.1.0
* **github.com/containerd/imgcrypt**                                               v1.1.7 -> v1.2.0-rc1
* **github.com/containerd/log**                                                    v0.1.0 **_new_**
* **github.com/containerd/nri**                                                    v0.3.0 -> v0.6.1
* **github.com/containerd/otelttrpc**                                              ea5083fda723 **_new_**
* **github.com/containerd/platforms**                                              v0.2.1 **_new_**
* **github.com/containerd/plugin**                                                 v0.1.0 **_new_**
* **github.com/containerd/ttrpc**                                                  v1.2.1 -> v1.2.5
* **github.com/containerd/typeurl/v2**                                             v2.1.0 -> v2.2.0
* **github.com/containernetworking/cni**                                           v1.1.2 -> v1.2.3
* **github.com/containernetworking/plugins**                                       v1.2.0 -> v1.5.1
* **github.com/containers/ocicrypt**                                               v1.1.6 -> v1.2.0
* **github.com/cpuguy83/go-md2man/v2**                                             v2.0.2 -> v2.0.4
* **github.com/davecgh/go-spew**                                                   v1.1.1 -> d8f796af33cc
* **github.com/distribution/reference**                                            v0.6.0 **_new_**
* **github.com/emicklei/go-restful/v3**                                            v3.10.1 -> v3.11.0
* **github.com/felixge/httpsnoop**                                                 v1.0.4 **_new_**
* **github.com/fsnotify/fsnotify**                                                 v1.6.0 -> v1.7.0
* **github.com/fxamacker/cbor/v2**                                                 v2.7.0 **_new_**
* **github.com/go-jose/go-jose/v4**                                                v4.0.2 **_new_**
* **github.com/go-logr/logr**                                                      v1.2.3 -> v1.4.2
* **github.com/golang/protobuf**                                                   v1.5.2 -> v1.5.4
* **github.com/google/go-cmp**                                                     v0.5.9 -> v0.6.0
* **github.com/google/uuid**                                                       v1.3.0 -> v1.6.0
* **github.com/gorilla/websocket**                                                 v1.5.0 **_new_**
* **github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus**            v1.0.1 **_new_**
* **github.com/grpc-ecosystem/go-grpc-middleware/v2**                              v2.1.0 **_new_**
* **github.com/grpc-ecosystem/grpc-gateway/v2**                                    v2.7.0 -> v2.22.0
* **github.com/intel/goresctrl**                                                   v0.3.0 -> v0.7.0
* **github.com/klauspost/compress**                                                v1.16.0 -> v1.17.10
* **github.com/mdlayher/socket**                                                   v0.4.1 **_new_**
* **github.com/mdlayher/vsock**                                                    v1.2.1 **_new_**
* **github.com/moby/spdystream**                                                   v0.2.0 -> v0.4.0
* **github.com/moby/sys/mountinfo**                                                v0.6.2 -> v0.7.2
* **github.com/moby/sys/sequential**                                               v0.5.0 -> v0.6.0
* **github.com/moby/sys/signal**                                                   v0.7.0 -> v0.7.1
* **github.com/moby/sys/symlink**                                                  v0.2.0 -> v0.3.0
* **github.com/moby/sys/user**                                                     v0.3.0 **_new_**
* **github.com/moby/sys/userns**                                                   v0.1.0 **_new_**
* **github.com/munnerz/goautoneg**                                                 a7dc8b61c822 **_new_**
* **github.com/mxk/go-flowrate**                                                   cca7078d478f **_new_**
* **github.com/opencontainers/image-spec**                                         3a7f492d3f1b -> v1.1.0
* **github.com/opencontainers/runtime-spec**                                       v1.1.0-rc.1 -> v1.2.0
* **github.com/opencontainers/runtime-tools**                                      946c877fa809 -> 2e043c6bd626
* **github.com/pelletier/go-toml/v2**                                              v2.2.3 **_new_**
* **github.com/pmezard/go-difflib**                                                v1.0.0 -> 5d4384ee4fb2
* **github.com/prometheus/client_golang**                                          v1.14.0 -> v1.20.4
* **github.com/prometheus/client_model**                                           v0.3.0 -> v0.6.1
* **github.com/prometheus/common**                                                 v0.37.0 -> v0.55.0
* **github.com/prometheus/procfs**                                                 v0.8.0 -> v0.15.1
* **github.com/sirupsen/logrus**                                                   v1.9.0 -> v1.9.3
* **github.com/stretchr/testify**                                                  v1.8.2 -> v1.9.0
* **github.com/urfave/cli/v2**                                                     v2.27.4 **_new_**
* **github.com/vishvananda/netlink**                                               v1.2.1-beta.2 -> v1.3.0
* **github.com/vishvananda/netns**                                                 2eb08e3e575f -> v0.0.4
* **github.com/x448/float16**                                                      v0.8.4 **_new_**
* **github.com/xrash/smetrics**                                                    686a1a2994c1 **_new_**
* **go.etcd.io/bbolt**                                                             v1.3.7 -> v1.3.11
* **go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc**  v0.40.0 -> v0.55.0
* **go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp**                v0.55.0 **_new_**
* **go.opentelemetry.io/otel**                                                     v1.14.0 -> v1.30.0
* **go.opentelemetry.io/otel/exporters/otlp/otlptrace**                            v1.14.0 -> v1.30.0
* **go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc**              v1.14.0 -> v1.30.0
* **go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp**              v1.14.0 -> v1.30.0
* **go.opentelemetry.io/otel/metric**                                              v0.37.0 -> v1.30.0
* **go.opentelemetry.io/otel/sdk**                                                 v1.14.0 -> v1.30.0
* **go.opentelemetry.io/otel/trace**                                               v1.14.0 -> v1.30.0
* **go.opentelemetry.io/proto/otlp**                                               v0.19.0 -> v1.3.1
* **golang.org/x/crypto**                                                          v0.1.0 -> v0.27.0
* **golang.org/x/exp**                                                             aacd6d4b4611 **_new_**
* **golang.org/x/mod**                                                             v0.7.0 -> v0.21.0
* **golang.org/x/net**                                                             v0.7.0 -> v0.29.0
* **golang.org/x/oauth2**                                                          v0.4.0 -> v0.22.0
* **golang.org/x/sync**                                                            v0.1.0 -> v0.8.0
* **golang.org/x/sys**                                                             v0.6.0 -> v0.25.0
* **golang.org/x/term**                                                            v0.5.0 -> v0.24.0
* **golang.org/x/text**                                                            v0.7.0 -> v0.18.0
* **golang.org/x/time**                                                            90d013bbcef8 -> v0.3.0
* **google.golang.org/genproto/googleapis/api**                                    8af14fe29dc1 **_new_**
* **google.golang.org/genproto/googleapis/rpc**                                    8af14fe29dc1 **_new_**
* **google.golang.org/grpc**                                                       v1.53.0 -> v1.67.0
* **google.golang.org/protobuf**                                                   v1.28.1 -> v1.34.2
* **k8s.io/api**                                                                   v0.26.2 -> v0.31.1
* **k8s.io/apimachinery**                                                          v0.26.2 -> v0.31.1
* **k8s.io/apiserver**                                                             v0.26.2 -> v0.31.1
* **k8s.io/client-go**                                                             v0.26.2 -> v0.31.1
* **k8s.io/component-base**                                                        v0.26.2 -> v0.31.1
* **k8s.io/cri-api**                                                               v0.26.2 -> v0.32.0-alpha.0
* **k8s.io/klog/v2**                                                               v2.90.1 -> v2.130.1
* **k8s.io/kubelet**                                                               v0.31.1 **_new_**
* **k8s.io/utils**                                                                 a5ecb0141aa5 -> 18e509b52bc8
* **sigs.k8s.io/json**                                                             f223a00ba0e2 -> bc3834ca7abd
* **sigs.k8s.io/structured-merge-diff/v4**                                         v4.2.3 -> v4.4.1
* **sigs.k8s.io/yaml**                                                             v1.3.0 -> v1.4.0
* **tags.cncf.io/container-device-interface**                                      v0.8.0 **_new_**
* **tags.cncf.io/container-device-interface/specs-go**                             v0.8.0 **_new_**

Previous release can be found at [v1.7.0](https://github.com/containerd/containerd/releases/tag/v1.7.0)
* `containerd-<VERSION>-<OS>-<ARCH>.tar.gz`:         ✅Recommended. Dynamically linked with glibc 2.31 (Ubuntu 20.04).
* `containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz`:  Statically linked. Expected to be used on non-glibc Linux distributions. Not position-independent.

In addition to containerd, typically you will have to install [runc](https://github.com/opencontainers/runc/releases)
and [CNI plugins](https://github.com/containernetworking/plugins/releases) from their official sites too.

See also the [Getting Started](https://github.com/containerd/containerd/blob/main/docs/getting-started.md) documentation.
kiashok added a commit to kiashok/containerd-containerd that referenced this pull request Oct 23, 2024
@kiashok
Merge tag 'v2.0.0-rc.5' into dev/kiashok/update-2.0-rc5
cf261aa 
containerd 2.0.0-rc.5

Welcome to the v2.0.0-rc.5 release of containerd!
*This is a pre-release of containerd*

The first major release of containerd 2.x focuses on the continued stability of
containerd's core feature set with an easy upgrade from containerd 1.x. This
release includes the stabilization of new features added in the last 1.x release
as well as the removal of features which were deprecated in 1.x. The goal is to
support the vast community of containerd users well into the future along with
their ever increasing deployment footprints and variety of use cases.

* Add Update API for sandbox controller ([containerd#9903](containerd#9903))
* Configure otel from env instead of config.toml ([containerd#8970](containerd#8970))
* Enable NRI by default ([containerd#9744](containerd#9744))
* Add PluginInfo to introspection API ([containerd#9442](containerd#9442))
* Remove overlayfs volatile option on temp mounts ([containerd#9555](containerd#9555))
* Expose usage of deprecated features ([containerd#9258](containerd#9258))
* Use Intel ISA-L's igzip if available ([containerd#9200](containerd#9200))
* Introduce top level config migration ([containerd#9223](containerd#9223))
* Add image delete target ([containerd#8989](containerd#8989))
* Remove `LimitNOFILE` from `containerd.service` ([containerd#8924](containerd#8924))
* Add support for image expiration during garbage collection ([containerd#9022](containerd#9022))
* Reduce the contention between ref lock and boltdb lock in content store ([containerd#8792](containerd#8792))
* Remove "containerd.io/restart.logpath" label ([containerd#8264](containerd#8264))
* Remove `aufs` snapshotter ([containerd#8263](containerd#8263))
* Fix deadlock during NRI plugin registration ([containerd/nri#79](containerd/nri#79))
* Fix deadlock when writing to pipe blocks ([containerd/ttrpc#168](containerd/ttrpc#168))

* Generate attestation for artifacts during release ([containerd#10543](containerd#10543))

* Use 'UserSpecifiedImage' from CRI to set the image-name annotation ([containerd#10747](containerd#10747))
* Add support to set loopback to up ([containerd#10238](containerd#10238))
* Add support for multiple subscribers to CRI container events ([containerd#9661](containerd#9661))
* Enable CDI by default ([containerd#9621](containerd#9621))
* Remove non-sandboxed CRI implementation ([containerd#9228](containerd#9228))
* Add support for userns in stateless and stateful pods with idmap mounts (KEP-127, k8s >= 1.27) ([containerd#8287](containerd#8287))
* Use sandboxed CRI by default ([containerd#8994](containerd#8994))
* Implement RuntimeConfig CRI call ([containerd#8722](containerd#8722))
* Add support for user namespaces (KEP-127) ([containerd#8803](containerd#8803))
* Remove CRI v1alpha2 ([containerd#8276](containerd#8276))

* Add api Go module and move all protos under api ([containerd#10151](containerd#10151))
* Move packages based on contributing guide ([containerd#9365](containerd#9365))
* Generalize plugin library ([containerd#9214](containerd#9214))
* Use github.com/containerd/log ([containerd#9086](containerd#9086))

* Support to syncfs after pull by using diff plugin ([containerd#10284](containerd#10284))
* Skip "unknown" in image platform listing ([containerd#10257](containerd#10257))
* Update unpacker to fetch all provided content ([containerd#10202](containerd#10202))
* Enable Transfer service API to support plain HTTP ([containerd#10024](containerd#10024))
* Enable Transfer service to use registry configuration directory ([containerd#9908](containerd#9908))
* Disable the support for Schema 1 images ([containerd#9765](containerd#9765))
* Update Transfer service to add OCI descriptors to Progress structure ([containerd#9630](containerd#9630))
* Update import and export to allow references to missing content  ([containerd#9554](containerd#9554))
* Add option to perform syncfs after pull ([containerd#9401](containerd#9401))
* Add image verifier transfer service plugin system based on a binary directory ([containerd#8493](containerd#8493))

* Implement  RuntimeStatus.features.supplemental_groups_policy from KEP-3619 ([containerd#10410](containerd#10410))
* Add pprof to runc-shim ([containerd#10242](containerd#10242))
* Provide runtime options in plugin info ([containerd#10251](containerd#10251))
* Store bootstrap parameters in sandbox metadata ([containerd#9736](containerd#9736))
* Update apparmor to allow confined runc to kill containers ([containerd#10123](containerd#10123))
* Support vsock connection to task api ([containerd#9738](containerd#9738))
* Update RuntimeDefault seccomp profile to disallow io_uring related syscalls ([containerd#9320](containerd#9320))
* Switch runc shim to task service v3 and fix restore ([containerd#9233](containerd#9233))
* Add sandboxer configuration and move sandbox controllers to plugins ([containerd#8268](containerd#8268))
* Add annotations to CreateSandbox request ([containerd#8960](containerd#8960))
* Add SandboxMetrics ([containerd#8680](containerd#8680))
* Publish sandbox events ([containerd#8602](containerd#8602))
* Remove the CriuPath field from runc's options ([containerd#8279](containerd#8279))
* Remove `io.containerd.runtime.v1.linux` and `io.containerd.runc.v1` ([containerd#8262](containerd#8262))

* [medium] RAPL accessible to a container [GHSA-7ww5-4wqc-m92c](GHSA-7ww5-4wqc-m92c)

* Remove `disable_cgroup` from CRI config ([containerd#10594](containerd#10594))
* Disable the support for Schema 1 images ([containerd#9765](containerd#9765))
* Update RuntimeDefault seccomp profile to disallow io_uring related syscalls ([containerd#9320](containerd#9320))
* Move client to subpackage ([containerd#9316](containerd#9316))
* Remove `LimitNOFILE` from `containerd.service` ([containerd#8924](containerd#8924))
* Remove CRI v1alpha2 ([containerd#8276](containerd#8276))
* Remove `io.containerd.runtime.v1.linux` and `io.containerd.runc.v1` ([containerd#8262](containerd#8262))
* Remove "containerd.io/restart.logpath" label ([containerd#8264](containerd#8264))
* Remove `aufs` snapshotter ([containerd#8263](containerd#8263))

* Update warnings for deprecated CRI config fields ([containerd#10509](containerd#10509))
* Add type alias for event Envelope ([containerd#10279](containerd#10279))
* Postpone removal of deprecated CRI config properties ([containerd#9966](containerd#9966))
* Deprecate go-plugin configuration option ([containerd#9238](containerd#9238))
* CNI conf_template in CRI is no longer deprecated ([containerd#8637](containerd#8637))

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

* Derek McGowan
* Akihiro Suda
* Maksym Pavlenko
* Wei Fu
* Phil Estes
* Sebastiaan van Stijn
* Samuel Karp
* Stefan Berger
* Kazuyoshi Kato
* Rodrigo Campos
* Danny Canter
* Abel Feng
* Akhil Mohan
* Kirtana Ashok
* Gabriel Adrian Samfira
* Austin Vazquez
* Iceber Gu
* Krisztian Litkey
* Kohei Tokunaga
* Mike Brown
* Jin Dong
* Bjorn Neergaard
* Justin Chadwell
* rongfu.leng
* James Sturtevant
* Davanum Srinivas
* Paul "TBBle" Hampson
* Henry Wang
* Brian Goff
* Enrico Weigelt
* Laura Brehm
* Marat Radchenko
* Paweł Gronowski
* Shingo Omura
* Hsing-Yu (David) Chen
* Ilya Hanov
* Cardy.Tang
* Swagat Bora
* Aditi Sharma
* Amit Barve
* Bryant Biggs
* Evan Lezar
* James Jenkins
* Jordan Liggitt
* Kay Yan
* Markus Lehtonen
* Nashwan Azhari
* Shuaiyi Zhang
* Vinayak Goyal
* helen
* Alexandru Matei
* Anthony Nandaa
* Avi Deitcher
* Charity Kathure
* Cory Snider
* Ed Bartosh
* Etienne Champetier
* Kevin Parsons
* Michael Zappa
* Milas Bowman
* ningmingxiao
* yanggang
* zounengren
* Aditya Ramani
* Adrian Reber
* Amir M. Ghazanfari
* Artem Khramov
* Brad Davidson
* Chen Yiyang
* Christian Muehlhaeuser
* Djordje Lukic
* Edgar Lee
* Eric Lin
* Ethan Lowman
* Jiang Liu
* June Rhodes
* Kern Walster
* Lucas Rattz
* Mahamed Ali
* Maksim An
* Michael Crosby
* Peteris Rudzusiks
* Sam Edwards
* Samruddhi Khandale
* Sascha Grunert
* Steve Griffith
* Tony Fang
* VERNOU Cédric
* Vishal Reddy Gurrala
* hang.jiang
* harshitasao
* jerryzhuang
* lengrongfu
* roman-kiselenko
* zhanluxianshen
* Aaron Lehmann
* Adrien Delorme
* Alex Couture-Beil
* Alex Ellis
* Alex Rodriguez
* Angelos Kolaitis
* Antonio Huete Jimenez
* Arash Haghighat
* Ben Foster
* Bin Tang
* Bin Xin
* BinBin He
* Brennan Kinney
* Changqing Li
* ChengenH
* ChengyuZhu6
* Christian Stewart
* Colin O'Dell
* Craig Ingram
* Daisy Rong
* David Porter
* Derek Nola
* Eng Zer Jun
* Erikson Tung
* Fabiano Fidêncio
* Fahed Dorgaa
* Gary McDonald
* Iain Macdonald
* James Lakin
* Jan Dubois
* Jaroslav Jindrak
* Javier Maestro
* Jian Wang
* Jiongchi Yu
* Julien Balestra
* Kir Kolyshkin
* Kirill A. Korinsky
* Konstantin Khlebnikov
* Mauri de Souza Meneguzzo
* Pan Yibo
* Paul Meyer
* Qasim Sarfraz
* Qiutong Song
* Reinhard Tartler
* Robbie Buxton
* Robert-André Mauchin
* Ruihua Wen
* Sameer
* Shengjing Zhu
* Shiming Zhang
* Shukui Yang
* Talon
* Tariq Ibrahim
* Tianon Gravi
* Tim Hockin
* TinaMor
* Tobias Klauser
* Tomáš Virtus
* Tõnis Tiigi
* Wang Xinwen
* William Chen
* Xinyang Ge
* Yibo Zhuang
* Yury Gargay
* Zechun Chen
* Zhang Tianyang
* Zoe
* baijia
* bo.jiang
* bzsuni
* charles-chenzz
* chschumacher1994
* guangli.bao
* guangwu
* jinda.ljd
* krglosse
* pigletfly
* rokkiter
* wangxiang
* zhangpeng
* zhaojizhuang
* 吴小白
* 张钰
* 沈陵
* 谭九鼎

* **dario.cat/mergo**                                                              v1.0.1 **_new_**
* **github.com/AdaLogics/go-fuzz-headers**                                         1f10f66a31bf -> ced1acdcaa24
* **github.com/AdamKorcz/go-118-fuzz-build**                                       5330a85ea652 -> 8075edf89bb0
* **github.com/Microsoft/go-winio**                                                v0.6.0 -> v0.6.2
* **github.com/Microsoft/hcsshim**                                                 v0.10.0-rc.7 -> v0.12.6
* **github.com/cenkalti/backoff/v4**                                               v4.2.0 -> v4.3.0
* **github.com/cespare/xxhash/v2**                                                 v2.2.0 -> v2.3.0
* **github.com/checkpoint-restore/checkpointctl**                                  v1.2.1 **_new_**
* **github.com/checkpoint-restore/go-criu/v7**                                     v7.2.0 **_new_**
* **github.com/cilium/ebpf**                                                       v0.9.1 -> v0.11.0
* **github.com/containerd/cgroups/v3**                                             v3.0.1 -> v3.0.3
* **github.com/containerd/console**                                                v1.0.3 -> v1.0.4
* **github.com/containerd/containerd/api**                                         v1.8.0-rc.3 **_new_**
* **github.com/containerd/continuity**                                             v0.3.0 -> v0.4.3
* **github.com/containerd/errdefs**                                                v0.1.0 **_new_**
* **github.com/containerd/go-cni**                                                 v1.1.9 -> v1.1.10
* **github.com/containerd/go-runc**                                                v1.0.0 -> v1.1.0
* **github.com/containerd/imgcrypt**                                               v1.1.7 -> v1.2.0-rc1
* **github.com/containerd/log**                                                    v0.1.0 **_new_**
* **github.com/containerd/nri**                                                    v0.3.0 -> v0.6.1
* **github.com/containerd/otelttrpc**                                              ea5083fda723 **_new_**
* **github.com/containerd/platforms**                                              v0.2.1 **_new_**
* **github.com/containerd/plugin**                                                 v0.1.0 **_new_**
* **github.com/containerd/ttrpc**                                                  v1.2.1 -> v1.2.5
* **github.com/containerd/typeurl/v2**                                             v2.1.0 -> v2.2.0
* **github.com/containernetworking/cni**                                           v1.1.2 -> v1.2.3
* **github.com/containernetworking/plugins**                                       v1.2.0 -> v1.5.1
* **github.com/containers/ocicrypt**                                               v1.1.6 -> v1.2.0
* **github.com/cpuguy83/go-md2man/v2**                                             v2.0.2 -> v2.0.4
* **github.com/davecgh/go-spew**                                                   v1.1.1 -> d8f796af33cc
* **github.com/distribution/reference**                                            v0.6.0 **_new_**
* **github.com/emicklei/go-restful/v3**                                            v3.10.1 -> v3.11.0
* **github.com/felixge/httpsnoop**                                                 v1.0.4 **_new_**
* **github.com/fsnotify/fsnotify**                                                 v1.6.0 -> v1.7.0
* **github.com/fxamacker/cbor/v2**                                                 v2.7.0 **_new_**
* **github.com/go-jose/go-jose/v4**                                                v4.0.2 **_new_**
* **github.com/go-logr/logr**                                                      v1.2.3 -> v1.4.2
* **github.com/golang/protobuf**                                                   v1.5.2 -> v1.5.4
* **github.com/google/go-cmp**                                                     v0.5.9 -> v0.6.0
* **github.com/google/uuid**                                                       v1.3.0 -> v1.6.0
* **github.com/gorilla/websocket**                                                 v1.5.0 **_new_**
* **github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus**            v1.0.1 **_new_**
* **github.com/grpc-ecosystem/go-grpc-middleware/v2**                              v2.1.0 **_new_**
* **github.com/grpc-ecosystem/grpc-gateway/v2**                                    v2.7.0 -> v2.22.0
* **github.com/intel/goresctrl**                                                   v0.3.0 -> v0.7.0
* **github.com/klauspost/compress**                                                v1.16.0 -> v1.17.10
* **github.com/mdlayher/socket**                                                   v0.4.1 **_new_**
* **github.com/mdlayher/vsock**                                                    v1.2.1 **_new_**
* **github.com/moby/spdystream**                                                   v0.2.0 -> v0.4.0
* **github.com/moby/sys/mountinfo**                                                v0.6.2 -> v0.7.2
* **github.com/moby/sys/sequential**                                               v0.5.0 -> v0.6.0
* **github.com/moby/sys/signal**                                                   v0.7.0 -> v0.7.1
* **github.com/moby/sys/symlink**                                                  v0.2.0 -> v0.3.0
* **github.com/moby/sys/user**                                                     v0.3.0 **_new_**
* **github.com/moby/sys/userns**                                                   v0.1.0 **_new_**
* **github.com/munnerz/goautoneg**                                                 a7dc8b61c822 **_new_**
* **github.com/mxk/go-flowrate**                                                   cca7078d478f **_new_**
* **github.com/opencontainers/image-spec**                                         3a7f492d3f1b -> v1.1.0
* **github.com/opencontainers/runtime-spec**                                       v1.1.0-rc.1 -> v1.2.0
* **github.com/opencontainers/runtime-tools**                                      946c877fa809 -> 2e043c6bd626
* **github.com/pelletier/go-toml/v2**                                              v2.2.3 **_new_**
* **github.com/pmezard/go-difflib**                                                v1.0.0 -> 5d4384ee4fb2
* **github.com/prometheus/client_golang**                                          v1.14.0 -> v1.20.4
* **github.com/prometheus/client_model**                                           v0.3.0 -> v0.6.1
* **github.com/prometheus/common**                                                 v0.37.0 -> v0.55.0
* **github.com/prometheus/procfs**                                                 v0.8.0 -> v0.15.1
* **github.com/sirupsen/logrus**                                                   v1.9.0 -> v1.9.3
* **github.com/stretchr/testify**                                                  v1.8.2 -> v1.9.0
* **github.com/urfave/cli/v2**                                                     v2.27.4 **_new_**
* **github.com/vishvananda/netlink**                                               v1.2.1-beta.2 -> v1.3.0
* **github.com/vishvananda/netns**                                                 2eb08e3e575f -> v0.0.4
* **github.com/x448/float16**                                                      v0.8.4 **_new_**
* **github.com/xrash/smetrics**                                                    686a1a2994c1 **_new_**
* **go.etcd.io/bbolt**                                                             v1.3.7 -> v1.3.11
* **go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc**  v0.40.0 -> v0.55.0
* **go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp**                v0.55.0 **_new_**
* **go.opentelemetry.io/otel**                                                     v1.14.0 -> v1.30.0
* **go.opentelemetry.io/otel/exporters/otlp/otlptrace**                            v1.14.0 -> v1.30.0
* **go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc**              v1.14.0 -> v1.30.0
* **go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp**              v1.14.0 -> v1.30.0
* **go.opentelemetry.io/otel/metric**                                              v0.37.0 -> v1.30.0
* **go.opentelemetry.io/otel/sdk**                                                 v1.14.0 -> v1.30.0
* **go.opentelemetry.io/otel/trace**                                               v1.14.0 -> v1.30.0
* **go.opentelemetry.io/proto/otlp**                                               v0.19.0 -> v1.3.1
* **golang.org/x/crypto**                                                          v0.1.0 -> v0.27.0
* **golang.org/x/exp**                                                             aacd6d4b4611 **_new_**
* **golang.org/x/mod**                                                             v0.7.0 -> v0.21.0
* **golang.org/x/net**                                                             v0.7.0 -> v0.29.0
* **golang.org/x/oauth2**                                                          v0.4.0 -> v0.22.0
* **golang.org/x/sync**                                                            v0.1.0 -> v0.8.0
* **golang.org/x/sys**                                                             v0.6.0 -> v0.25.0
* **golang.org/x/term**                                                            v0.5.0 -> v0.24.0
* **golang.org/x/text**                                                            v0.7.0 -> v0.18.0
* **golang.org/x/time**                                                            90d013bbcef8 -> v0.3.0
* **google.golang.org/genproto/googleapis/api**                                    8af14fe29dc1 **_new_**
* **google.golang.org/genproto/googleapis/rpc**                                    8af14fe29dc1 **_new_**
* **google.golang.org/grpc**                                                       v1.53.0 -> v1.67.0
* **google.golang.org/protobuf**                                                   v1.28.1 -> v1.34.2
* **k8s.io/api**                                                                   v0.26.2 -> v0.31.1
* **k8s.io/apimachinery**                                                          v0.26.2 -> v0.31.1
* **k8s.io/apiserver**                                                             v0.26.2 -> v0.31.1
* **k8s.io/client-go**                                                             v0.26.2 -> v0.31.1
* **k8s.io/component-base**                                                        v0.26.2 -> v0.31.1
* **k8s.io/cri-api**                                                               v0.26.2 -> v0.32.0-alpha.0
* **k8s.io/klog/v2**                                                               v2.90.1 -> v2.130.1
* **k8s.io/kubelet**                                                               v0.31.1 **_new_**
* **k8s.io/utils**                                                                 a5ecb0141aa5 -> 18e509b52bc8
* **sigs.k8s.io/json**                                                             f223a00ba0e2 -> bc3834ca7abd
* **sigs.k8s.io/structured-merge-diff/v4**                                         v4.2.3 -> v4.4.1
* **sigs.k8s.io/yaml**                                                             v1.3.0 -> v1.4.0
* **tags.cncf.io/container-device-interface**                                      v0.8.0 **_new_**
* **tags.cncf.io/container-device-interface/specs-go**                             v0.8.0 **_new_**

Previous release can be found at [v1.7.0](https://github.com/containerd/containerd/releases/tag/v1.7.0)
* `containerd-<VERSION>-<OS>-<ARCH>.tar.gz`:         ✅Recommended. Dynamically linked with glibc 2.31 (Ubuntu 20.04).
* `containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz`:  Statically linked. Expected to be used on non-glibc Linux distributions. Not position-independent.

In addition to containerd, typically you will have to install [runc](https://github.com/opencontainers/runc/releases)
and [CNI plugins](https://github.com/containernetworking/plugins/releases) from their official sites too.

See also the [Getting Started](https://github.com/containerd/containerd/blob/main/docs/getting-started.md) documentation.
@dmcgowan dmcgowan mentioned this pull request Oct 23, 2024
Merged
@dmcgowan dmcgowan mentioned this pull request Nov 4, 2024
Merged
@github-actions github-actions bot mentioned this pull request Nov 10, 2024
Open
Mengkzhaoyun pushed a commit to open-beagle/containerd that referenced this pull request Nov 11, 2024
Merge tag 'v2.0.0' into release-v2.0
2f44e98 
containerd 2.0.0

Welcome to the v2.0.0 release of containerd!

The first major release of containerd 2.x focuses on the continued stability of
containerd's core feature set with an easy upgrade from containerd 1.x. This
release includes the stabilization of new features added in the last 1.x release
as well as the removal of features which were deprecated in 1.x. The goal is to
support the vast community of containerd users well into the future along with
their ever increasing deployment footprints and variety of use cases.

See [containerd 2.0](https://github.com/containerd/containerd/blob/main/docs/containerd-2.0.md) documentation for details on what is new and has changed in this release.

* Allow sections of Plugins to be merged, and not overwritten as entire sections. ([#9982](containerd/containerd#9982))
* Add Update API for sandbox controller ([#9903](containerd/containerd#9903))
* Configure otel from env instead of config.toml ([#8970](containerd/containerd#8970))
* Enable NRI by default ([#9744](containerd/containerd#9744))
* Add PluginInfo to introspection API ([#9442](containerd/containerd#9442))
* Remove overlayfs volatile option on temp mounts ([#9555](containerd/containerd#9555))
* Expose usage of deprecated features ([#9258](containerd/containerd#9258))
* Use Intel ISA-L's igzip if available ([#9200](containerd/containerd#9200))
* Introduce top level config migration ([#9223](containerd/containerd#9223))
* Add image delete target ([#8989](containerd/containerd#8989))
* Remove `LimitNOFILE` from `containerd.service` ([#8924](containerd/containerd#8924))
* Add support for image expiration during garbage collection ([#9022](containerd/containerd#9022))
* Reduce the contention between ref lock and boltdb lock in content store ([#8792](containerd/containerd#8792))
* Remove "containerd.io/restart.logpath" label ([#8264](containerd/containerd#8264))
* Remove `aufs` snapshotter ([#8263](containerd/containerd#8263))
* Fix deadlock during NRI plugin registration ([containerd/nri#79](containerd/nri#79))
* Support arm64/v9 and minor variants ([containerd/platforms#8](containerd/platforms#8))
* Fix deadlock when writing to pipe blocks ([containerd/ttrpc#168](containerd/ttrpc#168))

* Generate attestation for artifacts during release ([#10543](containerd/containerd#10543))
* Remove `cri-containerd-*.tar.gz` release bundles ([#9096](containerd/containerd#9096))

* Use 'UserSpecifiedImage' from CRI to set the image-name annotation ([#10747](containerd/containerd#10747))
* Fine-grained SupplementalGroups control ([#9737](containerd/containerd#9737))
* Add support to set loopback to up ([#10238](containerd/containerd#10238))
* KEP-3857: Recursive Read-only (RRO) mounts ([#9787](containerd/containerd#9787))
* Add support for multiple subscribers to CRI container events ([#9661](containerd/containerd#9661))
* Enable CDI by default ([#9621](containerd/containerd#9621))
* Remove non-sandboxed CRI implementation ([#9228](containerd/containerd#9228))
* Add support for userns in stateless and stateful pods with idmap mounts (KEP-127, k8s >= 1.27) ([#8287](containerd/containerd#8287))
* Use sandboxed CRI by default ([#8994](containerd/containerd#8994))
* Implement RuntimeConfig CRI call ([#8722](containerd/containerd#8722))
* Add support for user namespaces (KEP-127) ([#8803](containerd/containerd#8803))
* Remove CRI v1alpha2 ([#8276](containerd/containerd#8276))

* Add api Go module and move all protos under api ([#10151](containerd/containerd#10151))
* Move packages based on contributing guide ([#9365](containerd/containerd#9365))
* Generalize plugin library ([#9214](containerd/containerd#9214))
* Use github.com/containerd/log ([#9086](containerd/containerd#9086))

* Support to syncfs after pull by using diff plugin ([#10284](containerd/containerd#10284))
* Skip "unknown" in image platform listing ([#10257](containerd/containerd#10257))
* Update unpacker to fetch all provided content ([#10202](containerd/containerd#10202))
* Enable Transfer service API to support plain HTTP ([#10024](containerd/containerd#10024))
* Enable Transfer service to use registry configuration directory ([#9908](containerd/containerd#9908))
* Disable the support for Schema 1 images ([#9765](containerd/containerd#9765))
* Update Transfer service to add OCI descriptors to Progress structure ([#9630](containerd/containerd#9630))
* Update import and export to allow references to missing content  ([#9554](containerd/containerd#9554))
* Add option to perform syncfs after pull ([#9401](containerd/containerd#9401))
* Add image verifier transfer service plugin system based on a binary directory ([#8493](containerd/containerd#8493))

* Implement  RuntimeStatus.features.supplemental_groups_policy from KEP-3619 ([#10410](containerd/containerd#10410))
* Add pprof to runc-shim ([#10242](containerd/containerd#10242))
* Provide runtime options in plugin info ([#10251](containerd/containerd#10251))
* Store bootstrap parameters in sandbox metadata ([#9736](containerd/containerd#9736))
* Update apparmor to allow confined runc to kill containers ([#10123](containerd/containerd#10123))
* Support vsock connection to task api ([#9738](containerd/containerd#9738))
* Update RuntimeDefault seccomp profile to disallow io_uring related syscalls ([#9320](containerd/containerd#9320))
* Switch runc shim to task service v3 and fix restore ([#9233](containerd/containerd#9233))
* Add sandboxer configuration and move sandbox controllers to plugins ([#8268](containerd/containerd#8268))
* Add annotations to CreateSandbox request ([#8960](containerd/containerd#8960))
* Add SandboxMetrics ([#8680](containerd/containerd#8680))
* Publish sandbox events ([#8602](containerd/containerd#8602))
* Remove the CriuPath field from runc's options ([#8279](containerd/containerd#8279))
* Remove `io.containerd.runtime.v1.linux` and `io.containerd.runc.v1` ([#8262](containerd/containerd#8262))

* [medium] RAPL accessible to a container [GHSA-7ww5-4wqc-m92c](GHSA-7ww5-4wqc-m92c)

* Remove `disable_cgroup` from CRI config ([#10594](containerd/containerd#10594))
* Disable the support for Schema 1 images ([#9765](containerd/containerd#9765))
* Update RuntimeDefault seccomp profile to disallow io_uring related syscalls ([#9320](containerd/containerd#9320))
* Move client to subpackage ([#9316](containerd/containerd#9316))
* Remove `LimitNOFILE` from `containerd.service` ([#8924](containerd/containerd#8924))
* Remove CRI v1alpha2 ([#8276](containerd/containerd#8276))
* Remove `io.containerd.runtime.v1.linux` and `io.containerd.runc.v1` ([#8262](containerd/containerd#8262))
* Remove "containerd.io/restart.logpath" label ([#8264](containerd/containerd#8264))
* Remove `aufs` snapshotter ([#8263](containerd/containerd#8263))

* Update warnings for deprecated CRI config fields ([#10509](containerd/containerd#10509))
* Add type alias for event Envelope ([#10279](containerd/containerd#10279))
* Postpone removal of deprecated CRI config properties ([#9966](containerd/containerd#9966))
* Deprecate go-plugin configuration option ([#9238](containerd/containerd#9238))
* CNI conf_template in CRI is no longer deprecated ([#8637](containerd/containerd#8637))

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

* Derek McGowan
* Akihiro Suda
* Maksym Pavlenko
* Wei Fu
* Phil Estes
* Sebastiaan van Stijn
* Samuel Karp
* Krisztian Litkey
* Kazuyoshi Kato
* Austin Vazquez
* Rodrigo Campos
* Danny Canter
* Abel Feng
* Mike Brown
* Kirtana Ashok
* Akhil Mohan
* Iceber Gu
* Gabriel Adrian Samfira
* Jin Dong
* Kohei Tokunaga
* Bjorn Neergaard
* Brian Goff
* Justin Chadwell
* rongfu.leng
* James Sturtevant
* Davanum Srinivas
* Paul "TBBle" Hampson
* Henry Wang
* Enrico Weigelt
* Laura Brehm
* Marat Radchenko
* Paweł Gronowski
* Shingo Omura
* Hsing-Yu (David) Chen
* Ilya Hanov
* Cardy.Tang
* Swagat Bora
* Aditi Sharma
* Amit Barve
* Bryant Biggs
* Evan Lezar
* James Jenkins
* Jordan Liggitt
* Kay Yan
* Markus Lehtonen
* Nashwan Azhari
* Shuaiyi Zhang
* Vinayak Goyal
* helen
* Alexandru Matei
* Anthony Nandaa
* Avi Deitcher
* Charity Kathure
* Cory Snider
* Ed Bartosh
* Etienne Champetier
* Kevin Parsons
* Michael Zappa
* Milas Bowman
* lengrongfu
* ningmingxiao
* yanggang
* zounengren
* Aditya Ramani
* Adrian Reber
* Amir M. Ghazanfari
* Antonio Ojea
* Artem Khramov
* Brad Davidson
* Chen Yiyang
* Chongyi Zheng
* Christian Muehlhaeuser
* Djordje Lukic
* Edgar Lee
* Eric Lin
* Ethan Lowman
* Jiang Liu
* June Rhodes
* Kern Walster
* Lei Jitang
* Lucas Rattz
* Mahamed Ali
* Maksim An
* Michael Crosby
* Peteris Rudzusiks
* Ray Burgemeestre
* Sam Edwards
* Samruddhi Khandale
* Sascha Grunert
* Steve Griffith
* Tony Fang
* Tõnis Tiigi
* VERNOU Cédric
* Vishal Reddy Gurrala
* Xiaojin Zhang
* Yang Yang
* hang.jiang
* harshitasao
* jerryzhuang
* roman-kiselenko
* zhanluxianshen
* Aaron Lehmann
* AbdelrahmanElawady
* Adrien Delorme
* Alex Couture-Beil
* Alex Ellis
* Alex Rodriguez
* Angelos Kolaitis
* Antonio Huete Jimenez
* Antti Kervinen
* Arash Haghighat
* Arkin Modi
* Ben Foster
* Benjamin Peterson
* Bin Tang
* Bin Xin
* BinBin He
* Brennan Kinney
* Changqing Li
* ChengenH
* ChengyuZhu6
* Christian Stewart
* Colin O'Dell
* Craig Ingram
* Daisy Rong
* David Porter
* David Son
* Derek Nola
* Eng Zer Jun
* Erikson Tung
* Fabiano Fidêncio
* Fahed Dorgaa
* Gabriela Cervantes
* Gary McDonald
* Iain Macdonald
* James Lakin
* Jan Dubois
* Jaroslav Jindrak
* Javier Maestro
* Jian Wang
* Jiongchi Yu
* Julien Balestra
* Kir Kolyshkin
* Kirill A. Korinsky
* Konstantin Khlebnikov
* Lei Liu
* Matteo Pulcini
* Mauri de Souza Meneguzzo
* Mike Baynton
* Niklas Gehlen
* Pan Yibo
* Paul Meyer
* Qasim Sarfraz
* Qiutong Song
* Reinhard Tartler
* Robbie Buxton
* Robert-André Mauchin
* Ruihua Wen
* Saket Jajoo
* Sameer
* Shengjing Zhu
* Shiming Zhang
* Shukui Yang
* StepSecurity Bot
* Talon
* Tariq Ibrahim
* Tianon Gravi
* Tim Hockin
* TinaMor
* Tobias Klauser
* Tomáš Virtus
* Wang Xinwen
* William Chen
* Xinyang Ge
* Yibo Zhuang
* Yuhang Wei
* Yury Gargay
* Zechun Chen
* Zhang Tianyang
* Zoe
* baijia
* bo.jiang
* bzsuni
* charles-chenzz
* chschumacher1994
* cormick
* guangli.bao
* guangwu
* jinda.ljd
* jingtao.liang
* krglosse
* pigletfly
* rokkiter
* wangxiang
* zhangpeng
* zhaojizhuang
* 吴小白
* 张钰
* 沈陵
* 谭九鼎

* **dario.cat/mergo**                                                              v1.0.1 **_new_**
* **github.com/AdaLogics/go-fuzz-headers**                                         1f10f66a31bf -> e8a1dd7889d6
* **github.com/AdamKorcz/go-118-fuzz-build**                                       5330a85ea652 -> 2b5cbb29f3e2
* **github.com/Microsoft/go-winio**                                                v0.6.0 -> v0.6.2
* **github.com/Microsoft/hcsshim**                                                 v0.10.0-rc.7 -> v0.12.9
* **github.com/cenkalti/backoff/v4**                                               v4.2.0 -> v4.3.0
* **github.com/cespare/xxhash/v2**                                                 v2.2.0 -> v2.3.0
* **github.com/checkpoint-restore/checkpointctl**                                  v1.3.0 **_new_**
* **github.com/checkpoint-restore/go-criu/v7**                                     v7.2.0 **_new_**
* **github.com/cilium/ebpf**                                                       v0.9.1 -> v0.11.0
* **github.com/containerd/cgroups/v3**                                             v3.0.1 -> v3.0.3
* **github.com/containerd/console**                                                v1.0.3 -> v1.0.4
* **github.com/containerd/containerd/api**                                         v1.8.0 **_new_**
* **github.com/containerd/continuity**                                             v0.3.0 -> v0.4.4
* **github.com/containerd/errdefs**                                                v1.0.0 **_new_**
* **github.com/containerd/errdefs/pkg**                                            v0.3.0 **_new_**
* **github.com/containerd/go-cni**                                                 v1.1.9 -> v1.1.10
* **github.com/containerd/go-runc**                                                v1.0.0 -> v1.1.0
* **github.com/containerd/imgcrypt/v2**                                            v2.0.0-rc.1 **_new_**
* **github.com/containerd/log**                                                    v0.1.0 **_new_**
* **github.com/containerd/nri**                                                    v0.3.0 -> v0.8.0
* **github.com/containerd/otelttrpc**                                              ea5083fda723 **_new_**
* **github.com/containerd/platforms**                                              v1.0.0-rc.0 **_new_**
* **github.com/containerd/plugin**                                                 v1.0.0 **_new_**
* **github.com/containerd/ttrpc**                                                  v1.2.1 -> v1.2.6
* **github.com/containerd/typeurl/v2**                                             v2.1.0 -> v2.2.2
* **github.com/containerd/zfs/v2**                                                 v2.0.0-rc.0 **_new_**
* **github.com/containernetworking/cni**                                           v1.1.2 -> v1.2.3
* **github.com/containernetworking/plugins**                                       v1.2.0 -> v1.5.1
* **github.com/containers/ocicrypt**                                               v1.1.6 -> v1.2.0
* **github.com/cpuguy83/go-md2man/v2**                                             v2.0.2 -> v2.0.5
* **github.com/davecgh/go-spew**                                                   v1.1.1 -> d8f796af33cc
* **github.com/distribution/reference**                                            v0.6.0 **_new_**
* **github.com/emicklei/go-restful/v3**                                            v3.10.1 -> v3.11.0
* **github.com/felixge/httpsnoop**                                                 v1.0.4 **_new_**
* **github.com/fsnotify/fsnotify**                                                 v1.6.0 -> v1.7.0
* **github.com/fxamacker/cbor/v2**                                                 v2.7.0 **_new_**
* **github.com/go-jose/go-jose/v4**                                                v4.0.4 **_new_**
* **github.com/go-logr/logr**                                                      v1.2.3 -> v1.4.2
* **github.com/golang/protobuf**                                                   v1.5.2 -> v1.5.4
* **github.com/google/go-cmp**                                                     v0.5.9 -> v0.6.0
* **github.com/google/uuid**                                                       v1.3.0 -> v1.6.0
* **github.com/gorilla/websocket**                                                 v1.5.0 **_new_**
* **github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus**            v1.0.1 **_new_**
* **github.com/grpc-ecosystem/go-grpc-middleware/v2**                              v2.1.0 **_new_**
* **github.com/grpc-ecosystem/grpc-gateway/v2**                                    v2.7.0 -> v2.22.0
* **github.com/intel/goresctrl**                                                   v0.3.0 -> v0.8.0
* **github.com/klauspost/compress**                                                v1.16.0 -> v1.17.11
* **github.com/mdlayher/socket**                                                   v0.4.1 **_new_**
* **github.com/mdlayher/vsock**                                                    v1.2.1 **_new_**
* **github.com/mistifyio/go-zfs/v3**                                               v3.0.1 **_new_**
* **github.com/moby/spdystream**                                                   v0.2.0 -> v0.4.0
* **github.com/moby/sys/mountinfo**                                                v0.6.2 -> v0.7.2
* **github.com/moby/sys/sequential**                                               v0.5.0 -> v0.6.0
* **github.com/moby/sys/signal**                                                   v0.7.0 -> v0.7.1
* **github.com/moby/sys/symlink**                                                  v0.2.0 -> v0.3.0
* **github.com/moby/sys/user**                                                     v0.3.0 **_new_**
* **github.com/moby/sys/userns**                                                   v0.1.0 **_new_**
* **github.com/munnerz/goautoneg**                                                 a7dc8b61c822 **_new_**
* **github.com/mxk/go-flowrate**                                                   cca7078d478f **_new_**
* **github.com/opencontainers/image-spec**                                         3a7f492d3f1b -> v1.1.0
* **github.com/opencontainers/runtime-spec**                                       v1.1.0-rc.1 -> v1.2.0
* **github.com/opencontainers/runtime-tools**                                      946c877fa809 -> 2e043c6bd626
* **github.com/opencontainers/selinux**                                            v1.11.0 -> v1.11.1
* **github.com/pelletier/go-toml/v2**                                              v2.2.3 **_new_**
* **github.com/pmezard/go-difflib**                                                v1.0.0 -> 5d4384ee4fb2
* **github.com/prometheus/client_golang**                                          v1.14.0 -> v1.20.5
* **github.com/prometheus/client_model**                                           v0.3.0 -> v0.6.1
* **github.com/prometheus/common**                                                 v0.37.0 -> v0.55.0
* **github.com/prometheus/procfs**                                                 v0.8.0 -> v0.15.1
* **github.com/sirupsen/logrus**                                                   v1.9.0 -> v1.9.3
* **github.com/stefanberger/go-pkcs11uri**                                         78d3cae3a980 -> 78284954bff6
* **github.com/stretchr/testify**                                                  v1.8.2 -> v1.9.0
* **github.com/urfave/cli/v2**                                                     v2.27.5 **_new_**
* **github.com/vishvananda/netlink**                                               v1.2.1-beta.2 -> v1.3.0
* **github.com/vishvananda/netns**                                                 2eb08e3e575f -> v0.0.4
* **github.com/x448/float16**                                                      v0.8.4 **_new_**
* **github.com/xrash/smetrics**                                                    686a1a2994c1 **_new_**
* **go.etcd.io/bbolt**                                                             v1.3.7 -> v1.3.11
* **go.mozilla.org/pkcs7**                                                         432b2356ecb1 -> v0.9.0
* **go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc**  v0.40.0 -> v0.56.0
* **go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp**                v0.56.0 **_new_**
* **go.opentelemetry.io/otel**                                                     v1.14.0 -> v1.31.0
* **go.opentelemetry.io/otel/exporters/otlp/otlptrace**                            v1.14.0 -> v1.31.0
* **go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc**              v1.14.0 -> v1.31.0
* **go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp**              v1.14.0 -> v1.31.0
* **go.opentelemetry.io/otel/metric**                                              v0.37.0 -> v1.31.0
* **go.opentelemetry.io/otel/sdk**                                                 v1.14.0 -> v1.31.0
* **go.opentelemetry.io/otel/trace**                                               v1.14.0 -> v1.31.0
* **go.opentelemetry.io/proto/otlp**                                               v0.19.0 -> v1.3.1
* **golang.org/x/crypto**                                                          v0.1.0 -> v0.28.0
* **golang.org/x/exp**                                                             aacd6d4b4611 **_new_**
* **golang.org/x/mod**                                                             v0.7.0 -> v0.21.0
* **golang.org/x/net**                                                             v0.7.0 -> v0.30.0
* **golang.org/x/oauth2**                                                          v0.4.0 -> v0.22.0
* **golang.org/x/sync**                                                            v0.1.0 -> v0.8.0
* **golang.org/x/sys**                                                             v0.6.0 -> v0.26.0
* **golang.org/x/term**                                                            v0.5.0 -> v0.25.0
* **golang.org/x/text**                                                            v0.7.0 -> v0.19.0
* **golang.org/x/time**                                                            90d013bbcef8 -> v0.3.0
* **google.golang.org/genproto/googleapis/api**                                    5fefd90f89a9 **_new_**
* **google.golang.org/genproto/googleapis/rpc**                                    324edc3d5d38 **_new_**
* **google.golang.org/grpc**                                                       v1.53.0 -> v1.67.1
* **google.golang.org/protobuf**                                                   v1.28.1 -> v1.35.1
* **k8s.io/api**                                                                   v0.26.2 -> v0.31.2
* **k8s.io/apimachinery**                                                          v0.26.2 -> v0.31.2
* **k8s.io/apiserver**                                                             v0.26.2 -> v0.31.2
* **k8s.io/client-go**                                                             v0.26.2 -> v0.31.2
* **k8s.io/component-base**                                                        v0.26.2 -> v0.31.2
* **k8s.io/cri-api**                                                               v0.26.2 -> v0.31.2
* **k8s.io/klog/v2**                                                               v2.90.1 -> v2.130.1
* **k8s.io/kubelet**                                                               v0.31.2 **_new_**
* **k8s.io/utils**                                                                 a5ecb0141aa5 -> 18e509b52bc8
* **sigs.k8s.io/json**                                                             f223a00ba0e2 -> bc3834ca7abd
* **sigs.k8s.io/structured-merge-diff/v4**                                         v4.2.3 -> v4.4.1
* **sigs.k8s.io/yaml**                                                             v1.3.0 -> v1.4.0
* **tags.cncf.io/container-device-interface**                                      v0.8.0 **_new_**
* **tags.cncf.io/container-device-interface/specs-go**                             v0.8.0 **_new_**

Previous release can be found at [v1.7.0](https://github.com/containerd/containerd/releases/tag/v1.7.0)
* `containerd-<VERSION>-<OS>-<ARCH>.tar.gz`:         ✅Recommended. Dynamically linked with glibc 2.31 (Ubuntu 20.04).
* `containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz`:  Statically linked. Expected to be used on non-glibc Linux distributions. Not position-independent.

In addition to containerd, typically you will have to install [runc](https://github.com/opencontainers/runc/releases)
and [CNI plugins](https://github.com/containernetworking/plugins/releases) from their official sites too.

See also the [Getting Started](https://github.com/containerd/containerd/blob/main/docs/getting-started.md) documentation.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@kiashok kiashok kiashok approved these changes

@cpuguy83 cpuguy83 cpuguy83 approved these changes

@dmcgowan dmcgowan dmcgowan approved these changes

Assignees
No one assigned
Labels
impact/changelog
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@kevpar @cpuguy83 @kiashok @dmcgowan