Update module github.com/containerd/containerd to v2#51839
Update module github.com/containerd/containerd to v2#51839renovate[bot] wants to merge 1 commit into
Conversation
renovate
Bot
added
changelog/no-changelog
ℹ️ Artifact update noticeFile name: go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
|
|
PRApprover will approve and merge this PR, FAQ, #dx-source-code-management 🛠️ PRApproval Status
➡️ Current phase: CI tests failed. Please fix the failing tests to continue. |
github-actions
Bot
added
the
short review
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6015cc9797
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| github.com/containerd/cgroups/v3 v3.1.3 | ||
| github.com/containerd/containerd v1.7.32 | ||
| github.com/containerd/containerd/api v1.9.0 | ||
| github.com/containerd/containerd/v2 v2.3.1 |
There was a problem hiding this comment.
This newly declares github.com/containerd/containerd/v2 at v2.3.1, but the existing replace github.com/containerd/containerd/v2 => ... v2.0.9 later in this same go.mod still forces every /v2 import to build with v2.0.9. In contexts that rely on this PR to pick up the v2.3.1 fixes, the build remains pinned to the older version; either update/remove the replace and resolve the runtime-spec pin conflict called out there, or keep the require at the actually selected version.
Useful? React with 👍 / 👎.
| github.com/aws/aws-sdk-go-v2/service/ssm v1.68.5 | ||
| github.com/aymerick/raymond v2.0.2+incompatible | ||
| github.com/bazelbuild/rules_go v0.60.0 | ||
| github.com/containerd/containerd v1.7.30 |
There was a problem hiding this comment.
The repo still has production imports of the old module path, e.g. comp/core/workloadmeta/collectors/internal/containerd and pkg/util/containerd import github.com/containerd/containerd/..., not /v2, so this added direct requirement makes those users resolve to v1.7.30 after the previous v1.7.32 requirement was removed. That silently drops the last two v1.7.x patch releases for existing containerd integrations instead of upgrading them; keep the v1 requirement at least at v1.7.32 unless all old-path imports are migrated.
Useful? React with 👍 / 👎.
github-actions
Bot
added
medium review
|
renovate
Bot
force-pushed
the
renovate/github.com-containerd-containerd-2.x
branch
4 times, most recently
from
84d54b8 to
8f685fc
Compare
Files inventory check summaryFile checks results against ancestor cdba151f: Results for datadog-agent_7.81.0~devel.git.544.8f685fc.pipeline.117227567-1_amd64.deb:No change detected |
Static quality checks✅ Please find below the results from static quality gates 32 successful checks with minimal change (< 2 KiB)
|
Regression DetectorRegression Detector ResultsMetrics dashboard Baseline: cdba151 Optimization Goals: ✅ No significant changes detected
|
| perf | experiment | goal | Δ mean % | Δ mean % CI | trials | links |
|---|---|---|---|---|---|---|
| ➖ | quality_gate_logs | % cpu utilization | +0.89 | [-0.14, +1.92] | 1 | Logs bounds checks dashboard |
| ➖ | quality_gate_metrics_logs | memory utilization | +0.17 | [-0.07, +0.41] | 1 | Logs bounds checks dashboard |
| ➖ | quality_gate_idle | memory utilization | +0.17 | [+0.11, +0.22] | 1 | Logs bounds checks dashboard |
| ➖ | quality_gate_idle_all_features | memory utilization | -0.03 | [-0.07, +0.01] | 1 | Logs bounds checks dashboard |
Bounds Checks: ✅ Passed
| perf | experiment | bounds_check_name | replicates_passed | observed_value | links |
|---|---|---|---|---|---|
| ✅ | quality_gate_idle | intake_connections | 10/10 | 3 ≤ 4 | bounds checks dashboard |
| ✅ | quality_gate_idle | memory_usage | 10/10 | 145.83MiB ≤ 147MiB | bounds checks dashboard |
| ✅ | quality_gate_idle | total_bytes_received | 10/10 | 731.95KiB ≤ 819.20KiB | bounds checks dashboard |
| ✅ | quality_gate_idle_all_features | intake_connections | 10/10 | 3 ≤ 4 | bounds checks dashboard |
| ✅ | quality_gate_idle_all_features | memory_usage | 10/10 | 478.80MiB ≤ 495MiB | bounds checks dashboard |
| ✅ | quality_gate_idle_all_features | total_bytes_received | 10/10 | 1.12MiB ≤ 1.25MiB | bounds checks dashboard |
| ✅ | quality_gate_logs | intake_connections | 10/10 | 3 ≤ 6 | bounds checks dashboard |
| ✅ | quality_gate_logs | memory_usage | 10/10 | 180.57MiB ≤ 195MiB | bounds checks dashboard |
| ✅ | quality_gate_logs | missed_bytes | 10/10 | 0B = 0B | bounds checks dashboard |
| ✅ | quality_gate_logs | total_bytes_received | 10/10 | 264.43MiB ≤ 292MiB | bounds checks dashboard |
| ✅ | quality_gate_metrics_logs | cpu_usage | 10/10 | 342.85 ≤ 2000 | bounds checks dashboard |
| ✅ | quality_gate_metrics_logs | intake_connections | 10/10 | 4 ≤ 6 | bounds checks dashboard |
| ✅ | quality_gate_metrics_logs | memory_usage | 10/10 | 370.39MiB ≤ 430MiB | bounds checks dashboard |
| ✅ | quality_gate_metrics_logs | missed_bytes | 10/10 | 0B = 0B | bounds checks dashboard |
| ✅ | quality_gate_metrics_logs | total_bytes_received | 10/10 | 0.94GiB ≤ 1.04GiB | bounds checks dashboard |
Explanation
Confidence level: 90.00%
Effect size tolerance: |Δ mean %| ≥ 5.00%
Performance changes are noted in the perf column of each table:
- ✅ = significantly better comparison variant performance
- ❌ = significantly worse comparison variant performance
- ➖ = no significant change in performance
A regression test is an A/B test of target performance in a repeatable rig, where "performance" is measured as "comparison variant minus baseline variant" for an optimization goal (e.g., ingress throughput). Due to intrinsic variability in measuring that goal, we can only estimate its mean value for each experiment; we report uncertainty in that value as a 90.00% confidence interval denoted "Δ mean % CI".
For each experiment, we decide whether a change in performance is a "regression" -- a change worth investigating further -- if all of the following criteria are true:
-
Its estimated |Δ mean %| ≥ 5.00%, indicating the change is big enough to merit a closer look.
-
Its 90.00% confidence interval "Δ mean % CI" does not contain zero, indicating that if our statistical model is accurate, there is at least a 90.00% chance there is a difference in performance between baseline and comparison variants.
-
Its configuration does not mark it "erratic".
Replicate Execution Details
We run multiple replicates for each experiment/variant. However, we allow replicates to be automatically retried if there are any failures, up to 8 times, at which point the replicate is marked dead and we are unable to run analysis for the entire experiment. We call each of these attempts at running replicates a replicate execution. This section lists all replicate executions that failed due to the target crashing or being oom killed.
Note: In the below tables we bucket failures by experiment, variant, and failure type. For each of these buckets we list out the replicate indexes that failed with an annotation signifying how many times said replicate failed with the given failure mode. In the below example the baseline variant of the experiment named experiment_with_failures had two replicates that failed by oom kills. Replicate 0, which failed 8 executions, and replicate 1 which failed 6 executions, all with the same failure mode.
| Experiment | Variant | Replicates | Failure | Logs | Debug Dashboard |
|---|---|---|---|---|---|
| experiment_with_failures | baseline | 0 (x8) 1 (x6) | Oom killed | Debug Dashboard |
The debug dashboard links will take you to a debugging dashboard specifically designed to investigate replicate execution failures.
❌ Retried Profiling Replicate Execution Failures (ddprof)
Note: Profiling replicas may still be executing. See the debug dashboard for up to date status.
| Experiment | Variant | Replicates | Failure | Debug Dashboard |
|---|---|---|---|---|
| quality_gate_idle | baseline | 10 | Oom killed | Debug Dashboard |
| quality_gate_idle | comparison | 10 | Oom killed | Debug Dashboard |
| quality_gate_idle_all_features | baseline | 10 | Oom killed | Debug Dashboard |
| quality_gate_idle_all_features | comparison | 10 | Oom killed | Debug Dashboard |
| quality_gate_logs | baseline | 10 | Oom killed | Debug Dashboard |
| quality_gate_logs | comparison | 10 | Oom killed | Debug Dashboard |
| quality_gate_metrics_logs | baseline | 10 | Oom killed | Debug Dashboard |
| quality_gate_metrics_logs | comparison | 10 | Oom killed | Debug Dashboard |
CI Pass/Fail Decision
✅ Passed. All Quality Gates passed.
- quality_gate_logs, bounds check missed_bytes: 10/10 replicas passed. Gate passed.
- quality_gate_logs, bounds check total_bytes_received: 10/10 replicas passed. Gate passed.
- quality_gate_logs, bounds check intake_connections: 10/10 replicas passed. Gate passed.
- quality_gate_logs, bounds check memory_usage: 10/10 replicas passed. Gate passed.
- quality_gate_idle_all_features, bounds check memory_usage: 10/10 replicas passed. Gate passed.
- quality_gate_idle_all_features, bounds check total_bytes_received: 10/10 replicas passed. Gate passed.
- quality_gate_idle_all_features, bounds check intake_connections: 10/10 replicas passed. Gate passed.
- quality_gate_metrics_logs, bounds check memory_usage: 10/10 replicas passed. Gate passed.
- quality_gate_metrics_logs, bounds check intake_connections: 10/10 replicas passed. Gate passed.
- quality_gate_metrics_logs, bounds check total_bytes_received: 10/10 replicas passed. Gate passed.
- quality_gate_metrics_logs, bounds check cpu_usage: 10/10 replicas passed. Gate passed.
- quality_gate_metrics_logs, bounds check missed_bytes: 10/10 replicas passed. Gate passed.
- quality_gate_idle, bounds check total_bytes_received: 10/10 replicas passed. Gate passed.
- quality_gate_idle, bounds check memory_usage: 10/10 replicas passed. Gate passed.
- quality_gate_idle, bounds check intake_connections: 10/10 replicas passed. Gate passed.
renovate
Bot
force-pushed
the
renovate/github.com-containerd-containerd-2.x
branch
10 times, most recently
from
ca5730a to
6ed7662
Compare
renovate
Bot
force-pushed
the
renovate/github.com-containerd-containerd-2.x
branch
3 times, most recently
from
d15c404 to
c37233e
Compare
renovate
Bot
force-pushed
the
renovate/github.com-containerd-containerd-2.x
branch
from
b10ca86 to
810e09c
Compare
This PR contains the following updates:
v1.7.32→v2.3.1Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
Release Notes
containerd/containerd (github.com/containerd/containerd)
v2.3.1: containerd 2.3.1Compare Source
Welcome to the v2.3.1 release of containerd!
The first patch release for containerd 2.3 contains various fixes and improvements.
Security Updates
Highlights
Image Storage
Runtime
Snapshotters
Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.
Contributors
Changes
24 commits
58af96519Prepare release notes for v2.3.18f0b3ca83Update api to v1.11.1a05ae7885oci: return explicit error for out-of-range USER valuesda7aef299Prepare release notes for api/v1.11.15282d4e09Wire task address and version fieldse44f5f9ecprotos: include task API address to CreateTaskRequest4d80a31bfseccomp: Block AF_ALG in default socket policy2ed0d97b6seccomp: Document socket rule scope and socketcall limitation3a88fdde0server: tolerate failed gRPC plugins when starting listeners2be0710b8overlay: disable "rebase" capability when running in UserNS3b199c22bUpdate Go to 1.26.31d601271afix: close boltdb on metadata and mount plugin closed666d2e42Refactor transfer unpack configuration setupccc3bd7b9Fix optional transfer differ setupDependency Changes
Previous release can be found at v2.3.0
Which file should I download?
containerd-<VERSION>-<OS>-<ARCH>.tar.gz: ✅Recommended. Dynamically linked with glibc 2.35 (Ubuntu 22.04).containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz: Statically linked. Expected to be used on Linux distributions that do not use glibc >= 2.35. Not position-independent.In addition to containerd, typically you will have to install runc
and CNI plugins from their official sites too.
See also the Getting Started documentation.
v2.3.0: containerd 2.3.0Compare Source
Welcome to the v2.3.0 release of containerd!
The third minor release of containerd 2.x focuses on continued stability alongside
new features and improvements. This is the third time-based release for containerd.
Starting with containerd 2.3, the project has moved to release cadence aligned with
the Kubernetes release schedule, with new minor releases about every 4 months. The
containerd 2.3 release is also the first annual LTS (Long Term Stable) release under
this new schedule, with support planned for at least two years. Direct upgrades
between sequential LTS releases (e.g., 1.7 to 2.3) will be tested and supported.
Highlights
Container Runtime Interface (CRI)
Image Distribution
Image Storage
Node Resource Interface (NRI)
Runtime
Snapshotters
ctr development tool
Breaking
Deprecations
Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.
Contributors
Dependency Changes
ad3df93d8f796a0ea5ed0->edf4cb35d4384ea7a43d2->9d38bb4a7a43d2->6f92a3bf2248ac5883c5enew4c0f3b2->28399d8cfa47c3->2d32026Previous release can be found at v2.2.0
Which file should I download?
containerd-<VERSION>-<OS>-<ARCH>.tar.gz: ✅Recommended. Dynamically linked with glibc 2.35 (Ubuntu 22.04).containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz: Statically linked. Expected to be used on Linux distributions that do not use glibc >= 2.35. Not position-independent.In addition to containerd, typically you will have to install runc
and CNI plugins from their official sites too.
See also the Getting Started documentation.
v2.2.4: containerd 2.2.4Compare Source
Welcome to the v2.2.4 release of containerd!
The fourth patch release for containerd 2.2 contains various fixes
and updates including security patches.
containerd
go-jose
Use mount manager during image volume processing to support snapshotters that require writable block volumes (e.g., EROFS) (#13242)
Fix handling of out-of-range USER values in OCI spec to avoid unexpected username/group lookups (#13448)
Apply hardening to block AF_ALG in default socket policy (#13408)
Fix bugs in sandbox service affecting sandbox creation configuration and event publishing (#13266)
Set AppArmor abi conditionally to support versions < 3.0 (#13275)
Disable overlay "rebase" capability when running in a user namespace to fix layer extraction failures (#13393)
Support both "volatile" and "fsync=volatile" mount options for volatile snapshotter (#13296)
Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.
21 commits
d20c6267boci: return explicit error for out-of-range USER valuesdb34dc4b4seccomp: Block AF_ALG in default socket policy214b141eeseccomp: Document socket rule scope and socketcall limitationc2b1856faupdate Go to 1.25.10, 1.26.363874d262overlay: disable "rebase" capability when running in UserNS2c7d48acfSupport both styles of volatile mount option80311db63chore: update go-jose for CVE-2026-34986caa29a741sandbox: forward Create fields, fix event topics5ab0a1206apparmor: Set abi conditionallyf9c34f7b1Parameterize K8s version in node-e2e workflow39dc2a475cri: use mount manager when image has volumesPrevious release can be found at v2.2.3
containerd-<VERSION>-<OS>-<ARCH>.tar.gz: ✅Recommended. Dynamically linked with glibc 2.35 (Ubuntu 22.04).containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz: Statically linked. Expected to be used on Linux distributions that do not use glibc >= 2.35. Not position-independent.In addition to containerd, typically you will have to install runc
and CNI plugins from their official sites too.
See also the Getting Started documentation.
v2.2.3: containerd 2.2.3Compare Source
Welcome to the v2.2.3 release of containerd!
The third patch release for containerd 2.2 contains various fixes
and updates including a security patch.
Security Updates
Highlights
Container Runtime Interface (CRI)
Go client
Image Distribution
Runtime
Snapshotters
Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.
Contributors
Changes
40 commits
8a0f4ed5dPrepare release notes for v2.2.331bd34a06update github.com/moby/spdystream v0.5.11336f6c45vendor: github.com/klauspost/compress v1.18.5409f75be8diff/walking: enable mount manager3f33146c1update runhcs to v0.14.18bd1b74e5vendor: github.com/Microsoft/hcsshim v0.14.1c6b0be8e1vendor: github.com/Microsoft/hcsshim v0.14.02ecde8cfeupdate to Go 1.25.9, 1.26.2be554f478Skip TestExportAndImportMultiLayer on s390x660de195bTweak mount info for overlayfs in case of parallel unpackbc9274a4bAdd integration test for issue 13030c387890b5Add integration test for privileged container cgroup mounts047a335a6Forward RUNC_FLAVOR env var down to integration tests9b2d72ee0Preserve host cgroup mount options for privileged containers5b66cd6a0Move cgroup namespace placement higher in spec builder584205c2f[release/2.2] update runc binary to v1.3.577c6886dfIgnore NOCHANGE errorfbed68b8fFix TOCTOU race bug in tar extractiona83510103cri: UpdatePodSandbox should return Unimplementedee4179e52fix(oci): apply absolute symlink resolution to /etc/groupfd061b848test(oci): use fstest and mock fs for better symlink coverage5d44d2c22fix(oci): handle absolute symlinks in rootfs user lookup00c776f07update to go1.25.8, test go1.26.1Dependency Changes
Previous release can be found at v2.2.2
Which file should I download?
containerd-<VERSION>-<OS>-<ARCH>.tar.gz: ✅Recommended. Dynamically linked with glibc 2.35 (Ubuntu 22.04).containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz: Statically linked. Expected to be used on Linux distributions that do not use glibc >= 2.35. Not position-independent.In addition to containerd, typically you will have to install runc
and CNI plugins from their official sites too.
See also the Getting Started documentation.
v2.2.2: containerd 2.2.2Compare Source
Welcome to the v2.2.2 release of containerd!
The second patch release for containerd 2.2 contains various fixes and improvements.
Highlights
Container Runtime Interface (CRI)
Runtime
ctr development tool
ctr image mountfailing with "no such device" (#12831)Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.
Contributors
Changes
48 commits
7e6ecf434Prepare release notes for v2.2.2a20dead7cset default config_path in plugin inita5f83d8c2cri: unpack images with per-layer labels for runtime-specific snapshotters68855cb0bci: modprobe xt_comment on almalinuxef7a8beb3core/mount: add test for getUnprivilegedMountFlags07b2cc07ecore/mount: fix getUnprivilegedMountFlags iterating over indices instead of values54101116fadd integration test for cni result nild44c4384eaddress commentf1835270bfix issue where cni del is never executed6c05047b4apparmor: explicitly set abi/3.05dbf1b915update golangci-lint to v2.9.0 with go1.26 support8ec695eberemove windows/arm from cross buildb9c22a6e3ci: build/test go1.26.009b876a81integration: Fix TestImageLoad() failure on CI172ba65b6cri: Fix image volumes with user namespacesb4240ef87update to go1.24.13, go1.25.794dbfaea7ci: bump go 1.24.12, 1.25.6e46a7a286set fetch-depth for containerd to 0 for version parsingctr image mountfailing with "no such device" (#12831)1d7908273core/mount/manager: fix bind mount missing rbind option3d509bcd3core/mount/manager: add tests for WithTemporary optioncb3ae2119fix: sanitize error before gRPC return to prevent credential leak in pod events533a2552ebuild(deps): bump google.golang.org/grpc from 1.77.0 to 1.78.0b120237fbbuild(deps): bump google.golang.org/grpc from 1.76.0 to 1.77.04be4e5156Fix nil pointer dereference in container spec memory metricsa76eb698acri: emit warning for concurrent CreateContainer3d2e188b1cri: Use the runtimeHandler parameter in PullImage633057382cri: move noisy CDI logs to debug level8a7409e2eReinstate image decryptionDependency Changes
a7a43d2->ab9386aa7a43d2->ab9386aPrevious release can be found at v2.2.1
Which file should I download?
containerd-<VERSION>-<OS>-<ARCH>.tar.gz: ✅Recommended. Dynamically linked with glibc 2.35 (Ubuntu 22.04).containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz: Statically linked. Expected to be used on Linux distributions that do not use glibc >= 2.35. Not position-independent.In addition to containerd, typically you will have to install runc
and CNI plugins from their official sites too.
See also the Getting Started documentation.
v2.2.1: containerd 2.2.1Compare Source
Welcome to the v2.2.1 release of containerd!
The first patch release for containerd 2.2 contains various fixes and improvements.
Highlights
Container Runtime Interface (CRI)
Image Distribution
Runtime
Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.
Contributors
Changes
53 commits
f6bae1f88Prepare release notes for v2.2.1c22cf5d49cri,nri: pass any linux security profile to plugins.d7532de75cri,nri: pass any linux RDT constraints to plugins.ef36e6181cri,nri: pass any linux net devices to plugins.d56faf426cri,nri: pass any linux scheduler attributes to plugins.e1824d261cri,nri: pass any linux I/O priority to plugins.01d5490aego.{mod,sum}: bump NRI deps to v0.11.0, re-vendor.58d23ab63pkg/tracing: HTTPStatusCodeAttributes: remove use of deprecated SemConv const05ccbb3a7cri/nri: short-circuit nil adjustment.c166a577d](https://redirect.github.com/containerd/containerd/commit/Configuration
📅 Schedule: (UTC)
* 0-4,22-23 * * 1-5)* * * * 0,6)🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.