Bump github.com/containerd/containerd from 1.5.9 to 1.6.0 (#1948)

Bumps [github.com/containerd/containerd](https://github.com/containerd/containerd) from 1.5.9 to 1.6.0.
- [Release notes](https://github.com/containerd/containerd/releases)
- [Changelog](https://github.com/containerd/containerd/blob/main/RELEASES.md)
- [Commits](https://github.com/containerd/containerd/compare/v1.5.9...v1.6.0)

---
updated-dependencies:
- dependency-name: github.com/containerd/containerd
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

vendor/github.com/containerd/cgroups/rdma.go

@@ -67,6 +67,7 @@ func (p *rdmaController) Create(path string, resources *specs.LinuxResources) er
 
 	for device, limit := range resources.Rdma {
 		if device != "" && (limit.HcaHandles != nil || limit.HcaObjects != nil) {
+			limit := limit
 			return retryingWriteFile(
 				filepath.Join(p.Path(path), "rdma.max"),
 				[]byte(createCmdString(device, &limit)),

vendor/github.com/containerd/cgroups/v2/manager.go

@@ -560,6 +560,22 @@ func (c *Manager) freeze(path string, state State) error {
 	}
 }
 
+func (c *Manager) isCgroupEmpty() bool {
+	// In case of any error we return true so that we exit and don't leak resources
+	out := make(map[string]interface{})
+	if err := readKVStatsFile(c.path, "cgroup.events", out); err != nil {
+		return true
+	}
+	if v, ok := out["populated"]; ok {
+		populated, ok := v.(uint64)
+		if !ok {
+			return true
+		}
+		return populated == 0
+	}
+	return true
+}
+
 // MemoryEventFD returns inotify file descriptor and 'memory.events' inotify watch descriptor
 func (c *Manager) MemoryEventFD() (int, uint32, error) {
 	fpath := filepath.Join(c.path, "memory.events")
@@ -568,9 +584,15 @@ func (c *Manager) MemoryEventFD() (int, uint32, error) {
 		return 0, 0, errors.New("failed to create inotify fd")
 	}
 	wd, err := syscall.InotifyAddWatch(fd, fpath, unix.IN_MODIFY)
-	if wd < 0 {
+	if err != nil {
 		syscall.Close(fd)
-		return 0, 0, fmt.Errorf("failed to add inotify watch for %q", fpath)
+		return 0, 0, fmt.Errorf("failed to add inotify watch for %q: %w", fpath, err)
+	}
+	// monitor to detect process exit/cgroup deletion
+	evpath := filepath.Join(c.path, "cgroup.events")
+	if _, err = syscall.InotifyAddWatch(fd, evpath, unix.IN_MODIFY); err != nil {
+		syscall.Close(fd)
+		return 0, 0, fmt.Errorf("failed to add inotify watch for %q: %w", evpath, err)
 	}
 
 	return fd, uint32(wd), nil
@@ -578,22 +600,56 @@ func (c *Manager) MemoryEventFD() (int, uint32, error) {
 
 func (c *Manager) EventChan() (<-chan Event, <-chan error) {
 	ec := make(chan Event)
-	errCh := make(chan error)
+	errCh := make(chan error, 1)
 	go c.waitForEvents(ec, errCh)
 
-	return ec, nil
+	return ec, errCh
+}
+
+func parseMemoryEvents(out map[string]interface{}) (Event, error) {
+	e := Event{}
+	if v, ok := out["high"]; ok {
+		e.High, ok = v.(uint64)
+		if !ok {
+			return Event{}, fmt.Errorf("cannot convert high to uint64: %+v", v)
+		}
+	}
+	if v, ok := out["low"]; ok {
+		e.Low, ok = v.(uint64)
+		if !ok {
+			return Event{}, fmt.Errorf("cannot convert low to uint64: %+v", v)
+		}
+	}
+	if v, ok := out["max"]; ok {
+		e.Max, ok = v.(uint64)
+		if !ok {
+			return Event{}, fmt.Errorf("cannot convert max to uint64: %+v", v)
+		}
+	}
+	if v, ok := out["oom"]; ok {
+		e.OOM, ok = v.(uint64)
+		if !ok {
+			return Event{}, fmt.Errorf("cannot convert oom to uint64: %+v", v)
+		}
+	}
+	if v, ok := out["oom_kill"]; ok {
+		e.OOMKill, ok = v.(uint64)
+		if !ok {
+			return Event{}, fmt.Errorf("cannot convert oom_kill to uint64: %+v", v)
+		}
+	}
+	return e, nil
 }
 
 func (c *Manager) waitForEvents(ec chan<- Event, errCh chan<- error) {
-	fd, wd, err := c.MemoryEventFD()
-
-	defer syscall.InotifyRmWatch(fd, wd)
-	defer syscall.Close(fd)
+	defer close(errCh)
 
+	fd, _, err := c.MemoryEventFD()
 	if err != nil {
 		errCh <- err
 		return
 	}
+	defer syscall.Close(fd)
 
 	for {
 		buffer := make([]byte, syscall.SizeofInotifyEvent*10)
@@ -604,48 +660,22 @@ func (c *Manager) waitForEvents(ec chan<- Event, errCh chan<- error) {
 		}
 		if bytesRead >= syscall.SizeofInotifyEvent {
 			out := make(map[string]interface{})
-			if err := readKVStatsFile(c.path, "memory.events", out); err == nil {
-				e := Event{}
-				if v, ok := out["high"]; ok {
-					e.High, ok = v.(uint64)
-					if !ok {
-						errCh <- fmt.Errorf("cannot convert high to uint64: %+v", v)
-						return
-					}
+			if err := readKVStatsFile(c.path, "memory.events", out); err != nil {
+				// When cgroup is deleted read may return -ENODEV instead of -ENOENT from open.
+				if _, statErr := os.Lstat(filepath.Join(c.path, "memory.events")); !os.IsNotExist(statErr) {
+					errCh <- err
 				}
-				if v, ok := out["low"]; ok {
-					e.Low, ok = v.(uint64)
-					if !ok {
-						errCh <- fmt.Errorf("cannot convert low to uint64: %+v", v)
-						return
-					}
-				}
-				if v, ok := out["max"]; ok {
-					e.Max, ok = v.(uint64)
-					if !ok {
-						errCh <- fmt.Errorf("cannot convert max to uint64: %+v", v)
-						return
-					}
-				}
-				if v, ok := out["oom"]; ok {
-					e.OOM, ok = v.(uint64)
-					if !ok {
-						errCh <- fmt.Errorf("cannot convert oom to uint64: %+v", v)
-						return
-					}
-				}
-				if v, ok := out["oom_kill"]; ok {
-					e.OOMKill, ok = v.(uint64)
-					if !ok {
-						errCh <- fmt.Errorf("cannot convert oom_kill to uint64: %+v", v)
-						return
-					}
-				}
-				ec <- e
-			} else {
+				return
+			}
+			e, err := parseMemoryEvents(out)
+			if err != nil {
 				errCh <- err
 				return
 			}
+			ec <- e
+			if c.isCgroupEmpty() {
+				return
+			}
 		}
 	}
 }
@@ -658,7 +688,7 @@ func setDevices(path string, devices []specs.LinuxDeviceCgroup) error {
 	if err != nil {
 		return err
 	}
-	dirFD, err := unix.Open(path, unix.O_DIRECTORY|unix.O_RDONLY, 0600)
+	dirFD, err := unix.Open(path, unix.O_DIRECTORY|unix.O_RDONLY|unix.O_CLOEXEC, 0600)
 	if err != nil {
 		return fmt.Errorf("cannot get dir FD for %s", path)
 	}

vendor/github.com/containerd/containerd/cio/io_unix.go

@@ -1,3 +1,4 @@
+//go:build !windows
 // +build !windows
 
 /*
@@ -20,15 +21,14 @@ package cio
 
 import (
 	"context"
+	"fmt"
 	"io"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"sync"
 	"syscall"
 
 	"github.com/containerd/fifo"
-	"github.com/pkg/errors"
 )
 
 // NewFIFOSetInDir returns a new FIFOSet with paths in a temporary directory under root
@@ -38,7 +38,7 @@ func NewFIFOSetInDir(root, id string, terminal bool) (*FIFOSet, error) {
 			return nil, err
 		}
 	}
-	dir, err := ioutil.TempDir(root, "")
+	dir, err := os.MkdirTemp(root, "")
 	if err != nil {
 		return nil, err
 	}
@@ -112,7 +112,7 @@ func openFifos(ctx context.Context, fifos *FIFOSet) (f pipes, retErr error) {
 
 	if fifos.Stdin != "" {
 		if f.Stdin, retErr = fifo.OpenFifo(ctx, fifos.Stdin, syscall.O_WRONLY|syscall.O_CREAT|syscall.O_NONBLOCK, 0700); retErr != nil {
-			return f, errors.Wrapf(retErr, "failed to open stdin fifo")
+			return f, fmt.Errorf("failed to open stdin fifo: %w", retErr)
 		}
 		defer func() {
 			if retErr != nil && f.Stdin != nil {
@@ -122,7 +122,7 @@ func openFifos(ctx context.Context, fifos *FIFOSet) (f pipes, retErr error) {
 	}
 	if fifos.Stdout != "" {
 		if f.Stdout, retErr = fifo.OpenFifo(ctx, fifos.Stdout, syscall.O_RDONLY|syscall.O_CREAT|syscall.O_NONBLOCK, 0700); retErr != nil {
-			return f, errors.Wrapf(retErr, "failed to open stdout fifo")
+			return f, fmt.Errorf("failed to open stdout fifo: %w", retErr)
 		}
 		defer func() {
 			if retErr != nil && f.Stdout != nil {
@@ -132,7 +132,7 @@ func openFifos(ctx context.Context, fifos *FIFOSet) (f pipes, retErr error) {
 	}
 	if !fifos.Terminal && fifos.Stderr != "" {
 		if f.Stderr, retErr = fifo.OpenFifo(ctx, fifos.Stderr, syscall.O_RDONLY|syscall.O_CREAT|syscall.O_NONBLOCK, 0700); retErr != nil {
-			return f, errors.Wrapf(retErr, "failed to open stderr fifo")
+			return f, fmt.Errorf("failed to open stderr fifo: %w", retErr)
 		}
 	}
 	return f, nil

vendor/github.com/containerd/containerd/cio/io_windows.go

@@ -23,7 +23,6 @@ import (
 
 	winio "github.com/Microsoft/go-winio"
 	"github.com/containerd/containerd/log"
-	"github.com/pkg/errors"
 )
 
 const pipeRoot = `\\.\pipe`
@@ -54,7 +53,7 @@ func copyIO(fifos *FIFOSet, ioset *Streams) (_ *cio, retErr error) {
 	if fifos.Stdin != "" {
 		l, err := winio.ListenPipe(fifos.Stdin, nil)
 		if err != nil {
-			return nil, errors.Wrapf(err, "failed to create stdin pipe %s", fifos.Stdin)
+			return nil, fmt.Errorf("failed to create stdin pipe %s: %w", fifos.Stdin, err)
 		}
 		cios.closers = append(cios.closers, l)
 
@@ -77,7 +76,7 @@ func copyIO(fifos *FIFOSet, ioset *Streams) (_ *cio, retErr error) {
 	if fifos.Stdout != "" {
 		l, err := winio.ListenPipe(fifos.Stdout, nil)
 		if err != nil {
-			return nil, errors.Wrapf(err, "failed to create stdout pipe %s", fifos.Stdout)
+			return nil, fmt.Errorf("failed to create stdout pipe %s: %w", fifos.Stdout, err)
 		}
 		cios.closers = append(cios.closers, l)
 
@@ -100,7 +99,7 @@ func copyIO(fifos *FIFOSet, ioset *Streams) (_ *cio, retErr error) {
 	if fifos.Stderr != "" {
 		l, err := winio.ListenPipe(fifos.Stderr, nil)
 		if err != nil {
-			return nil, errors.Wrapf(err, "failed to create stderr pipe %s", fifos.Stderr)
+			return nil, fmt.Errorf("failed to create stderr pipe %s: %w", fifos.Stderr, err)
 		}
 		cios.closers = append(cios.closers, l)
 

vendor/github.com/containerd/containerd/defaults/defaults_darwin.go

@@ -0,0 +1,37 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package defaults
+
+const (
+	// DefaultRootDir is the default location used by containerd to store
+	// persistent data
+	DefaultRootDir = "/var/lib/containerd"
+	// DefaultStateDir is the default location used by containerd to store
+	// transient data
+	DefaultStateDir = "/var/run/containerd"
+	// DefaultAddress is the default unix socket address
+	DefaultAddress = "/var/run/containerd/containerd.sock"
+	// DefaultDebugAddress is the default unix socket address for pprof data
+	DefaultDebugAddress = "/var/run/containerd/debug.sock"
+	// DefaultFIFODir is the default location used by client-side cio library
+	// to store FIFOs.
+	DefaultFIFODir = "/var/run/containerd/fifo"
+	// DefaultRuntime would be a multiple of choices, thus empty
+	DefaultRuntime = ""
+	// DefaultConfigDir is the default location for config files.
+	DefaultConfigDir = "/etc/containerd"
+)

vendor/github.com/containerd/containerd/defaults/defaults_unix.go

@@ -1,4 +1,5 @@
-// +build !windows
+//go:build !windows && !darwin
+// +build !windows,!darwin
 
 /*
    Copyright The containerd Authors.

vendor/github.com/containerd/containerd/defaults/defaults_windows.go

@@ -1,5 +1,3 @@
-// +build windows
-
 /*
    Copyright The containerd Authors.
 

vendor/github.com/containerd/containerd/errdefs/errors.go

@@ -17,7 +17,7 @@
 // Package errdefs defines the common errors used throughout containerd
 // packages.
 //
-// Use with errors.Wrap and error.Wrapf to add context to an error.
+// Use with fmt.Errorf to add context to an error.
 //
 // To detect an error class, use the IsXXX functions to tell whether an error
 // is of a certain type.
@@ -28,8 +28,7 @@ package errdefs
 
 import (
 	"context"
-
-	"github.com/pkg/errors"
+	"errors"
 )
 
 // Definitions of common error types used throughout containerd. All containerd

vendor/github.com/containerd/containerd/errdefs/grpc.go

@@ -18,9 +18,9 @@ package errdefs
 
 import (
 	"context"
+	"fmt"
 	"strings"
 
-	"github.com/pkg/errors"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
 )
@@ -68,9 +68,9 @@ func ToGRPC(err error) error {
 // ToGRPCf maps the error to grpc error codes, assembling the formatting string
 // and combining it with the target error string.
 //
-// This is equivalent to errors.ToGRPC(errors.Wrapf(err, format, args...))
+// This is equivalent to errdefs.ToGRPC(fmt.Errorf("%s: %w", fmt.Sprintf(format, args...), err))
 func ToGRPCf(err error, format string, args ...interface{}) error {
-	return ToGRPC(errors.Wrapf(err, format, args...))
+	return ToGRPC(fmt.Errorf("%s: %w", fmt.Sprintf(format, args...), err))
 }
 
 // FromGRPC returns the underlying error from a grpc service based on the grpc error code
@@ -104,9 +104,9 @@ func FromGRPC(err error) error {
 
 	msg := rebaseMessage(cls, err)
 	if msg != "" {
-		err = errors.Wrap(cls, msg)
+		err = fmt.Errorf("%s: %w", msg, cls)
 	} else {
-		err = errors.WithStack(cls)
+		err = cls
 	}
 
 	return err

vendor/github.com/containerd/containerd/log/context.go

@@ -52,7 +52,8 @@ const (
 // WithLogger returns a new context with the provided logger. Use in
 // combination with logger.WithField(s) for great effect.
 func WithLogger(ctx context.Context, logger *logrus.Entry) context.Context {
-	return context.WithValue(ctx, loggerKey{}, logger)
+	e := logger.WithContext(ctx)
+	return context.WithValue(ctx, loggerKey{}, e)
 }
 
 // GetLogger retrieves the current logger from the context. If no logger is
@@ -61,7 +62,7 @@ func GetLogger(ctx context.Context) *logrus.Entry {
 	logger := ctx.Value(loggerKey{})
 
 	if logger == nil {
-		return L
+		return L.WithContext(ctx)
 	}
 
 	return logger.(*logrus.Entry)

vendor/github.com/containerd/containerd/pkg/userns/userns_unsupported.go

@@ -1,3 +1,4 @@
+//go:build !linux
 // +build !linux
 
 /*

vendor/github.com/containerd/containerd/platforms/compare.go

@@ -38,12 +38,22 @@ func platformVector(platform specs.Platform) []specs.Platform {
 
 	switch platform.Architecture {
 	case "amd64":
+		if amd64Version, err := strconv.Atoi(strings.TrimPrefix(platform.Variant, "v")); err == nil && amd64Version > 1 {
+			for amd64Version--; amd64Version >= 1; amd64Version-- {
+				vector = append(vector, specs.Platform{
+					Architecture: platform.Architecture,
+					OS:           platform.OS,
+					OSVersion:    platform.OSVersion,
+					OSFeatures:   platform.OSFeatures,
+					Variant:      "v" + strconv.Itoa(amd64Version),
+				})
+			}
+		}
 		vector = append(vector, specs.Platform{
 			Architecture: "386",
 			OS:           platform.OS,
 			OSVersion:    platform.OSVersion,
 			OSFeatures:   platform.OSFeatures,
-			Variant:      platform.Variant,
 		})
 	case "arm":
 		if armVersion, err := strconv.Atoi(strings.TrimPrefix(platform.Variant, "v")); err == nil && armVersion > 5 {

vendor/github.com/containerd/containerd/platforms/cpuinfo.go

@@ -18,6 +18,7 @@ package platforms
 
 import (
 	"bufio"
+	"fmt"
 	"os"
 	"runtime"
 	"strings"
@@ -25,7 +26,6 @@ import (
 
 	"github.com/containerd/containerd/errdefs"
 	"github.com/containerd/containerd/log"
-	"github.com/pkg/errors"
 )
 
 // Present the ARM instruction set architecture, eg: v7, v8
@@ -48,7 +48,7 @@ func cpuVariant() string {
 // by ourselves. We can just parse these information from /proc/cpuinfo
 func getCPUInfo(pattern string) (info string, err error) {
 	if !isLinuxOS(runtime.GOOS) {
-		return "", errors.Wrapf(errdefs.ErrNotImplemented, "getCPUInfo for OS %s", runtime.GOOS)
+		return "", fmt.Errorf("getCPUInfo for OS %s: %w", runtime.GOOS, errdefs.ErrNotImplemented)
 	}
 
 	cpuinfo, err := os.Open("/proc/cpuinfo")
@@ -75,7 +75,7 @@ func getCPUInfo(pattern string) (info string, err error) {
 		return "", err
 	}
 
-	return "", errors.Wrapf(errdefs.ErrNotFound, "getCPUInfo for pattern: %s", pattern)
+	return "", fmt.Errorf("getCPUInfo for pattern: %s: %w", pattern, errdefs.ErrNotFound)
 }
 
 func getCPUVariant() string {

vendor/github.com/containerd/containerd/platforms/database.go

@@ -38,7 +38,7 @@ func isLinuxOS(os string) bool {
 // The OS value should be normalized before calling this function.
 func isKnownOS(os string) bool {
 	switch os {
-	case "aix", "android", "darwin", "dragonfly", "freebsd", "hurd", "illumos", "js", "linux", "nacl", "netbsd", "openbsd", "plan9", "solaris", "windows", "zos":
+	case "aix", "android", "darwin", "dragonfly", "freebsd", "hurd", "illumos", "ios", "js", "linux", "nacl", "netbsd", "openbsd", "plan9", "solaris", "windows", "zos":
 		return true
 	}
 	return false
@@ -60,7 +60,7 @@ func isArmArch(arch string) bool {
 // The arch value should be normalized before being passed to this function.
 func isKnownArch(arch string) bool {
 	switch arch {
-	case "386", "amd64", "amd64p32", "arm", "armbe", "arm64", "arm64be", "ppc64", "ppc64le", "mips", "mipsle", "mips64", "mips64le", "mips64p32", "mips64p32le", "ppc", "riscv", "riscv64", "s390", "s390x", "sparc", "sparc64", "wasm":
+	case "386", "amd64", "amd64p32", "arm", "armbe", "arm64", "arm64be", "ppc64", "ppc64le", "loong64", "mips", "mipsle", "mips64", "mips64le", "mips64p32", "mips64p32le", "ppc", "riscv", "riscv64", "s390", "s390x", "sparc", "sparc64", "wasm":
 		return true
 	}
 	return false
@@ -86,9 +86,11 @@ func normalizeArch(arch, variant string) (string, string) {
 	case "i386":
 		arch = "386"
 		variant = ""
-	case "x86_64", "x86-64":
+	case "x86_64", "x86-64", "amd64":
 		arch = "amd64"
-		variant = ""
+		if variant == "v1" {
+			variant = ""
+		}
 	case "aarch64", "arm64":
 		arch = "arm64"
 		switch variant {

vendor/github.com/containerd/containerd/platforms/defaults.go

@@ -16,27 +16,11 @@
 
 package platforms
 
-import (
-	"runtime"
-
-	specs "github.com/opencontainers/image-spec/specs-go/v1"
-)
-
 // DefaultString returns the default string specifier for the platform.
 func DefaultString() string {
 	return Format(DefaultSpec())
 }
 
-// DefaultSpec returns the current platform's default platform specification.
-func DefaultSpec() specs.Platform {
-	return specs.Platform{
-		OS:           runtime.GOOS,
-		Architecture: runtime.GOARCH,
-		// The Variant field will be empty if arch != ARM.
-		Variant: cpuVariant(),
-	}
-}
-
 // DefaultStrict returns strict form of Default.
 func DefaultStrict() MatchComparer {
 	return OnlyStrict(DefaultSpec())

vendor/github.com/containerd/containerd/platforms/defaults_darwin.go

@@ -0,0 +1,45 @@
+//go:build darwin
+// +build darwin
+
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package platforms
+
+import (
+	"runtime"
+
+	specs "github.com/opencontainers/image-spec/specs-go/v1"
+)
+
+// DefaultSpec returns the current platform's default platform specification.
+func DefaultSpec() specs.Platform {
+	return specs.Platform{
+		OS:           runtime.GOOS,
+		Architecture: runtime.GOARCH,
+		// The Variant field will be empty if arch != ARM.
+		Variant: cpuVariant(),
+	}
+}
+
+// Default returns the default matcher for the platform.
+func Default() MatchComparer {
+	return Ordered(DefaultSpec(), specs.Platform{
+		// darwin runtime also supports Linux binary via runu/LKL
+		OS:           "linux",
+		Architecture: runtime.GOARCH,
+	})
+}

vendor/github.com/containerd/containerd/platforms/defaults_unix.go

@@ -1,4 +1,5 @@
-// +build !windows
+//go:build !windows && !darwin
+// +build !windows,!darwin
 
 /*
    Copyright The containerd Authors.
@@ -18,6 +19,22 @@
 
 package platforms
 
+import (
+	"runtime"
+
+	specs "github.com/opencontainers/image-spec/specs-go/v1"
+)
+
+// DefaultSpec returns the current platform's default platform specification.
+func DefaultSpec() specs.Platform {
+	return specs.Platform{
+		OS:           runtime.GOOS,
+		Architecture: runtime.GOARCH,
+		// The Variant field will be empty if arch != ARM.
+		Variant: cpuVariant(),
+	}
+}
+
 // Default returns the default matcher for the platform.
 func Default() MatchComparer {
 	return Only(DefaultSpec())

vendor/github.com/containerd/containerd/platforms/defaults_windows.go

@@ -1,5 +1,3 @@
-// +build windows
-
 /*
    Copyright The containerd Authors.
 
@@ -29,6 +27,18 @@ import (
 	"golang.org/x/sys/windows"
 )
 
+// DefaultSpec returns the current platform's default platform specification.
+func DefaultSpec() specs.Platform {
+	major, minor, build := windows.RtlGetNtVersionNumbers()
+	return specs.Platform{
+		OS:           runtime.GOOS,
+		Architecture: runtime.GOARCH,
+		OSVersion:    fmt.Sprintf("%d.%d.%d", major, minor, build),
+		// The Variant field will be empty if arch != ARM.
+		Variant: cpuVariant(),
+	}
+}
+
 type matchComparer struct {
 	defaults        Matcher
 	osVersionPrefix string

vendor/github.com/containerd/containerd/platforms/platforms.go

@@ -107,6 +107,8 @@
 package platforms
 
 import (
+	"fmt"
+	"path"
 	"regexp"
 	"runtime"
 	"strconv"
@@ -114,7 +116,6 @@ import (
 
 	"github.com/containerd/containerd/errdefs"
 	specs "github.com/opencontainers/image-spec/specs-go/v1"
-	"github.com/pkg/errors"
 )
 
 var (
@@ -166,14 +167,14 @@ func (m *matcher) String() string {
 func Parse(specifier string) (specs.Platform, error) {
 	if strings.Contains(specifier, "*") {
 		// TODO(stevvooe): need to work out exact wildcard handling
-		return specs.Platform{}, errors.Wrapf(errdefs.ErrInvalidArgument, "%q: wildcards not yet supported", specifier)
+		return specs.Platform{}, fmt.Errorf("%q: wildcards not yet supported: %w", specifier, errdefs.ErrInvalidArgument)
 	}
 
 	parts := strings.Split(specifier, "/")
 
 	for _, part := range parts {
 		if !specifierRe.MatchString(part) {
-			return specs.Platform{}, errors.Wrapf(errdefs.ErrInvalidArgument, "%q is an invalid component of %q: platform specifier component must match %q", part, specifier, specifierRe.String())
+			return specs.Platform{}, fmt.Errorf("%q is an invalid component of %q: platform specifier component must match %q: %w", part, specifier, specifierRe.String(), errdefs.ErrInvalidArgument)
 		}
 	}
 
@@ -205,7 +206,7 @@ func Parse(specifier string) (specs.Platform, error) {
 			return p, nil
 		}
 
-		return specs.Platform{}, errors.Wrapf(errdefs.ErrInvalidArgument, "%q: unknown operating system or architecture", specifier)
+		return specs.Platform{}, fmt.Errorf("%q: unknown operating system or architecture: %w", specifier, errdefs.ErrInvalidArgument)
 	case 2:
 		// In this case, we treat as a regular os/arch pair. We don't care
 		// about whether or not we know of the platform.
@@ -227,7 +228,7 @@ func Parse(specifier string) (specs.Platform, error) {
 		return p, nil
 	}
 
-	return specs.Platform{}, errors.Wrapf(errdefs.ErrInvalidArgument, "%q: cannot parse platform specifier", specifier)
+	return specs.Platform{}, fmt.Errorf("%q: cannot parse platform specifier: %w", specifier, errdefs.ErrInvalidArgument)
 }
 
 // MustParse is like Parses but panics if the specifier cannot be parsed.
@@ -246,20 +247,7 @@ func Format(platform specs.Platform) string {
 		return "unknown"
 	}
 
-	return joinNotEmpty(platform.OS, platform.Architecture, platform.Variant)
-}
-
-func joinNotEmpty(s ...string) string {
-	var ss []string
-	for _, s := range s {
-		if s == "" {
-			continue
-		}
-
-		ss = append(ss, s)
-	}
-
-	return strings.Join(ss, "/")
+	return path.Join(platform.OS, platform.Architecture, platform.Variant)
 }
 
 // Normalize validates and translate the platform to the canonical value.
@@ -269,10 +257,5 @@ func joinNotEmpty(s ...string) string {
 func Normalize(platform specs.Platform) specs.Platform {
 	platform.OS = normalizeOS(platform.OS)
 	platform.Architecture, platform.Variant = normalizeArch(platform.Architecture, platform.Variant)
-
-	// these fields are deprecated, remove them
-	platform.OSFeatures = nil
-	platform.OSVersion = ""
-
 	return platform
 }

vendor/github.com/containerd/containerd/sys/epoll.go

@@ -1,3 +1,4 @@
+//go:build linux
 // +build linux
 
 /*

vendor/github.com/containerd/containerd/sys/fds.go

@@ -1,3 +1,4 @@
+//go:build !windows && !darwin
 // +build !windows,!darwin
 
 /*
@@ -19,14 +20,14 @@
 package sys
 
 import (
-	"io/ioutil"
+	"os"
 	"path/filepath"
 	"strconv"
 )
 
 // GetOpenFds returns the number of open fds for the process provided by pid
 func GetOpenFds(pid int) (int, error) {
-	dirs, err := ioutil.ReadDir(filepath.Join("/proc", strconv.Itoa(pid), "fd"))
+	dirs, err := os.ReadDir(filepath.Join("/proc", strconv.Itoa(pid), "fd"))
 	if err != nil {
 		return -1, err
 	}

vendor/github.com/containerd/containerd/sys/filesys_unix.go

@@ -1,3 +1,4 @@
+//go:build !windows
 // +build !windows
 
 /*

vendor/github.com/containerd/containerd/sys/filesys_windows.go

@@ -1,5 +1,3 @@
-// +build windows
-
 /*
    Copyright The containerd Authors.
 
@@ -19,6 +17,7 @@
 package sys
 
 import (
+	"fmt"
 	"os"
 	"path/filepath"
 	"regexp"
@@ -29,7 +28,6 @@ import (
 	"unsafe"
 
 	"github.com/Microsoft/hcsshim"
-	"github.com/pkg/errors"
 	"golang.org/x/sys/windows"
 )
 
@@ -270,7 +268,7 @@ func ForceRemoveAll(path string) error {
 	snapshotDir := filepath.Join(path, snapshotPlugin, "snapshots")
 	if stat, err := os.Stat(snapshotDir); err == nil && stat.IsDir() {
 		if err := cleanupWCOWLayers(snapshotDir); err != nil {
-			return errors.Wrapf(err, "failed to cleanup WCOW layers in %s", snapshotDir)
+			return fmt.Errorf("failed to cleanup WCOW layers in %s: %w", snapshotDir, err)
 		}
 	}
 
@@ -280,12 +278,22 @@ func ForceRemoveAll(path string) error {
 func cleanupWCOWLayers(root string) error {
 	// See snapshots/windows/windows.go getSnapshotDir()
 	var layerNums []int
+	var rmLayerNums []int
 	if err := filepath.Walk(root, func(path string, info os.FileInfo, err error) error {
 		if path != root && info.IsDir() {
-			if layerNum, err := strconv.Atoi(filepath.Base(path)); err == nil {
-				layerNums = append(layerNums, layerNum)
+			name := filepath.Base(path)
+			if strings.HasPrefix(name, "rm-") {
+				layerNum, err := strconv.Atoi(strings.TrimPrefix(name, "rm-"))
+				if err != nil {
+					return err
+				}
+				rmLayerNums = append(rmLayerNums, layerNum)
 			} else {
-				return err
+				layerNum, err := strconv.Atoi(name)
+				if err != nil {
+					return err
+				}
+				layerNums = append(layerNums, layerNum)
 			}
 			return filepath.SkipDir
 		}
@@ -295,8 +303,14 @@ func cleanupWCOWLayers(root string) error {
 		return err
 	}
 
-	sort.Sort(sort.Reverse(sort.IntSlice(layerNums)))
+	sort.Sort(sort.Reverse(sort.IntSlice(rmLayerNums)))
+	for _, rmLayerNum := range rmLayerNums {
+		if err := cleanupWCOWLayer(filepath.Join(root, "rm-"+strconv.Itoa(rmLayerNum))); err != nil {
+			return err
+		}
+	}
 
+	sort.Sort(sort.Reverse(sort.IntSlice(layerNums)))
 	for _, layerNum := range layerNums {
 		if err := cleanupWCOWLayer(filepath.Join(root, strconv.Itoa(layerNum))); err != nil {
 			return err
@@ -311,19 +325,20 @@ func cleanupWCOWLayer(layerPath string) error {
 		HomeDir: filepath.Dir(layerPath),
 	}
 
-	// ERROR_DEV_NOT_EXIST is returned if the layer is not currently prepared.
+	// ERROR_DEV_NOT_EXIST is returned if the layer is not currently prepared or activated.
+	// ERROR_FLT_INSTANCE_NOT_FOUND is returned if the layer is currently activated but not prepared.
 	if err := hcsshim.UnprepareLayer(info, filepath.Base(layerPath)); err != nil {
-		if hcserror, ok := err.(*hcsshim.HcsError); !ok || hcserror.Err != windows.ERROR_DEV_NOT_EXIST {
-			return errors.Wrapf(err, "failed to unprepare %s", layerPath)
+		if hcserror, ok := err.(*hcsshim.HcsError); !ok || (hcserror.Err != windows.ERROR_DEV_NOT_EXIST && hcserror.Err != syscall.Errno(windows.ERROR_FLT_INSTANCE_NOT_FOUND)) {
+			return fmt.Errorf("failed to unprepare %s: %w", layerPath, err)
 		}
 	}
 
 	if err := hcsshim.DeactivateLayer(info, filepath.Base(layerPath)); err != nil {
-		return errors.Wrapf(err, "failed to deactivate %s", layerPath)
+		return fmt.Errorf("failed to deactivate %s: %w", layerPath, err)
 	}
 
 	if err := hcsshim.DestroyLayer(info, filepath.Base(layerPath)); err != nil {
-		return errors.Wrapf(err, "failed to destroy %s", layerPath)
+		return fmt.Errorf("failed to destroy %s: %w", layerPath, err)
 	}
 
 	return nil

vendor/github.com/containerd/containerd/sys/mount_linux.go

@@ -1,145 +0,0 @@
-/*
-   Copyright The containerd Authors.
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
-*/
-
-package sys
-
-import (
-	"runtime"
-	"syscall"
-	"unsafe"
-
-	"github.com/containerd/containerd/log"
-	"github.com/pkg/errors"
-	"golang.org/x/sys/unix"
-)
-
-// FMountat performs mount from the provided directory.
-func FMountat(dirfd uintptr, source, target, fstype string, flags uintptr, data string) error {
-	var (
-		sourceP, targetP, fstypeP, dataP *byte
-		pid                              uintptr
-		err                              error
-		errno, status                    syscall.Errno
-	)
-
-	sourceP, err = syscall.BytePtrFromString(source)
-	if err != nil {
-		return err
-	}
-
-	targetP, err = syscall.BytePtrFromString(target)
-	if err != nil {
-		return err
-	}
-
-	fstypeP, err = syscall.BytePtrFromString(fstype)
-	if err != nil {
-		return err
-	}
-
-	if data != "" {
-		dataP, err = syscall.BytePtrFromString(data)
-		if err != nil {
-			return err
-		}
-	}
-
-	runtime.LockOSThread()
-	defer runtime.UnlockOSThread()
-
-	var pipefds [2]int
-	if err := syscall.Pipe2(pipefds[:], syscall.O_CLOEXEC); err != nil {
-		return errors.Wrap(err, "failed to open pipe")
-	}
-
-	defer func() {
-		// close both ends of the pipe in a deferred function, since open file
-		// descriptor table is shared with child
-		syscall.Close(pipefds[0])
-		syscall.Close(pipefds[1])
-	}()
-
-	pid, errno = forkAndMountat(dirfd,
-		uintptr(unsafe.Pointer(sourceP)),
-		uintptr(unsafe.Pointer(targetP)),
-		uintptr(unsafe.Pointer(fstypeP)),
-		flags,
-		uintptr(unsafe.Pointer(dataP)),
-		pipefds[1],
-	)
-
-	if errno != 0 {
-		return errors.Wrap(errno, "failed to fork thread")
-	}
-
-	defer func() {
-		_, err := unix.Wait4(int(pid), nil, 0, nil)
-		for err == syscall.EINTR {
-			_, err = unix.Wait4(int(pid), nil, 0, nil)
-		}
-
-		if err != nil {
-			log.L.WithError(err).Debugf("failed to find pid=%d process", pid)
-		}
-	}()
-
-	_, _, errno = syscall.RawSyscall(syscall.SYS_READ,
-		uintptr(pipefds[0]),
-		uintptr(unsafe.Pointer(&status)),
-		unsafe.Sizeof(status))
-	if errno != 0 {
-		return errors.Wrap(errno, "failed to read pipe")
-	}
-
-	if status != 0 {
-		return errors.Wrap(status, "failed to mount")
-	}
-
-	return nil
-}
-
-// forkAndMountat will fork thread, change working dir and mount.
-//
-// precondition: the runtime OS thread must be locked.
-func forkAndMountat(dirfd uintptr, source, target, fstype, flags, data uintptr, pipefd int) (pid uintptr, errno syscall.Errno) {
-
-	// block signal during clone
-	beforeFork()
-
-	// the cloned thread shares the open file descriptor, but the thread
-	// never be reused by runtime.
-	pid, _, errno = syscall.RawSyscall6(syscall.SYS_CLONE, uintptr(syscall.SIGCHLD)|syscall.CLONE_FILES, 0, 0, 0, 0, 0)
-	if errno != 0 || pid != 0 {
-		// restore all signals
-		afterFork()
-		return
-	}
-
-	// restore all signals
-	afterForkInChild()
-
-	// change working dir
-	_, _, errno = syscall.RawSyscall(syscall.SYS_FCHDIR, dirfd, 0, 0)
-	if errno != 0 {
-		goto childerr
-	}
-	_, _, errno = syscall.RawSyscall6(syscall.SYS_MOUNT, source, target, fstype, flags, data, 0)
-
-childerr:
-	_, _, errno = syscall.RawSyscall(syscall.SYS_WRITE, uintptr(pipefd), uintptr(unsafe.Pointer(&errno)), unsafe.Sizeof(errno))
-	syscall.RawSyscall(syscall.SYS_EXIT, uintptr(errno), 0, 0)
-	panic("unreachable")
-}

vendor/github.com/containerd/containerd/sys/oom_linux.go

@@ -18,7 +18,6 @@ package sys
 
 import (
 	"fmt"
-	"io/ioutil"
 	"os"
 	"strconv"
 	"strings"
@@ -69,7 +68,7 @@ func SetOOMScore(pid, score int) error {
 // no oom score is set, or a sore is set to 0.
 func GetOOMScoreAdj(pid int) (int, error) {
 	path := fmt.Sprintf("/proc/%d/oom_score_adj", pid)
-	data, err := ioutil.ReadFile(path)
+	data, err := os.ReadFile(path)
 	if err != nil {
 		return 0, err
 	}

vendor/github.com/containerd/containerd/sys/oom_unsupported.go

@@ -1,3 +1,4 @@
+//go:build !linux
 // +build !linux
 
 /*

vendor/github.com/containerd/containerd/sys/socket_unix.go

@@ -1,3 +1,4 @@
+//go:build !windows
 // +build !windows
 
 /*
@@ -19,11 +20,11 @@
 package sys
 
 import (
+	"fmt"
 	"net"
 	"os"
 	"path/filepath"
 
-	"github.com/pkg/errors"
 	"golang.org/x/sys/unix"
 )
 
@@ -31,7 +32,7 @@ import (
 func CreateUnixSocket(path string) (net.Listener, error) {
 	// BSDs have a 104 limit
 	if len(path) > 104 {
-		return nil, errors.Errorf("%q: unix socket path too long (> 104)", path)
+		return nil, fmt.Errorf("%q: unix socket path too long (> 104)", path)
 	}
 	if err := os.MkdirAll(filepath.Dir(path), 0660); err != nil {
 		return nil, err

vendor/github.com/containerd/containerd/sys/socket_windows.go

@@ -1,5 +1,3 @@
-// +build windows
-
 /*
    Copyright The containerd Authors.
 

vendor/github.com/containerd/containerd/sys/stat_bsd.go

@@ -1,44 +0,0 @@
-// +build darwin freebsd netbsd
-
-/*
-   Copyright The containerd Authors.
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
-*/
-
-package sys
-
-import (
-	"syscall"
-	"time"
-)
-
-// StatAtime returns the access time from a stat struct
-func StatAtime(st *syscall.Stat_t) syscall.Timespec {
-	return st.Atimespec
-}
-
-// StatCtime returns the created time from a stat struct
-func StatCtime(st *syscall.Stat_t) syscall.Timespec {
-	return st.Ctimespec
-}
-
-// StatMtime returns the modified time from a stat struct
-func StatMtime(st *syscall.Stat_t) syscall.Timespec {
-	return st.Mtimespec
-}
-
-// StatATimeAsTime returns the access time as a time.Time
-func StatATimeAsTime(st *syscall.Stat_t) time.Time {
-	return time.Unix(int64(st.Atimespec.Sec), int64(st.Atimespec.Nsec)) // nolint: unconvert
-}

vendor/github.com/containerd/containerd/sys/stat_openbsd.go

@@ -1,45 +0,0 @@
-// +build openbsd
-
-/*
-   Copyright The containerd Authors.
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
-*/
-
-package sys
-
-import (
-	"syscall"
-	"time"
-)
-
-// StatAtime returns the Atim
-func StatAtime(st *syscall.Stat_t) syscall.Timespec {
-	return st.Atim
-}
-
-// StatCtime returns the Ctim
-func StatCtime(st *syscall.Stat_t) syscall.Timespec {
-	return st.Ctim
-}
-
-// StatMtime returns the Mtim
-func StatMtime(st *syscall.Stat_t) syscall.Timespec {
-	return st.Mtim
-}
-
-// StatATimeAsTime returns st.Atim as a time.Time
-func StatATimeAsTime(st *syscall.Stat_t) time.Time {
-	// The int64 conversions ensure the line compiles for 32-bit systems as well.
-	return time.Unix(int64(st.Atim.Sec), int64(st.Atim.Nsec)) // nolint: unconvert
-}

vendor/github.com/containerd/containerd/sys/stat_unix.go

@@ -1,44 +0,0 @@
-// +build linux solaris
-
-/*
-   Copyright The containerd Authors.
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
-*/
-
-package sys
-
-import (
-	"syscall"
-	"time"
-)
-
-// StatAtime returns the Atim
-func StatAtime(st *syscall.Stat_t) syscall.Timespec {
-	return st.Atim
-}
-
-// StatCtime returns the Ctim
-func StatCtime(st *syscall.Stat_t) syscall.Timespec {
-	return st.Ctim
-}
-
-// StatMtime returns the Mtim
-func StatMtime(st *syscall.Stat_t) syscall.Timespec {
-	return st.Mtim
-}
-
-// StatATimeAsTime returns st.Atim as a time.Time
-func StatATimeAsTime(st *syscall.Stat_t) time.Time {
-	return time.Unix(int64(st.Atim.Sec), int64(st.Atim.Nsec)) // nolint: unconvert
-}

vendor/github.com/containerd/containerd/sys/subprocess_unsafe_linux.go

@@ -1,30 +0,0 @@
-/*
-   Copyright The containerd Authors.
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
-*/
-
-package sys
-
-import (
-	_ "unsafe" // required for go:linkname.
-)
-
-//go:linkname beforeFork syscall.runtime_BeforeFork
-func beforeFork()
-
-//go:linkname afterFork syscall.runtime_AfterFork
-func afterFork()
-
-//go:linkname afterForkInChild syscall.runtime_AfterForkInChild
-func afterForkInChild()

vendor/github.com/containerd/containerd/sys/subprocess_unsafe_linux.s

@@ -1,15 +0,0 @@
-/*
-   Copyright The containerd Authors.
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
-*/