[pull] main from containerd:main

.devcontainer/Dockerfile

@@ -0,0 +1,42 @@
+#   Copyright The containerd Authors.
+
+#   Licensed under the Apache License, Version 2.0 (the "License");
+#   you may not use this file except in compliance with the License.
+#   You may obtain a copy of the License at
+
+#       http://www.apache.org/licenses/LICENSE-2.0
+
+#   Unless required by applicable law or agreed to in writing, software
+#   distributed under the License is distributed on an "AS IS" BASIS,
+#   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#   See the License for the specific language governing permissions and
+#   limitations under the License.
+
+# For details, see https://github.com/devcontainers/images/tree/main/src/base-ubuntu
+FROM mcr.microsoft.com/devcontainers/base:1-ubuntu-22.04
+
+RUN apt-get update && export DEBIAN_FRONTEND=noninteractive \
+    && apt-get -y install --no-install-recommends \
+        gperf \
+        dmsetup \
+        bc \
+        software-properties-common \
+        libseccomp-dev \
+        xfsprogs \
+        lsof \
+        iptables \
+        autoconf \
+        automake \
+        g++ \
+        libtool \
+        acl \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN add-apt-repository -y ppa:criu/ppa \
+    && apt-get update \
+    && apt-get install -y criu \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN setfacl -PRdm u::rwx,g::rx,o::rx /tmp
+
+COPY .devcontainer/welcome-message.txt /usr/local/etc/vscode-dev-containers/first-run-notice.txt

.devcontainer/devcontainer.json

@@ -0,0 +1,32 @@
+// For format details, see https://aka.ms/devcontainer.json.
+{
+	"name": "containerd",
+	"build": {
+		"context": "..",
+		"dockerfile": "Dockerfile"
+	},
+	"workspaceFolder": "/go/src/github.com/containerd/containerd",
+	"workspaceMount": "source=${localWorkspaceFolder},target=/go/src/github.com/containerd/containerd,type=bind,consistency=cached",
+
+	// Features to add to the dev container. More info: https://containers.dev/features.
+	"features": {
+		"ghcr.io/devcontainers/features/docker-in-docker:2": {},
+		"ghcr.io/devcontainers/features/go:1": {
+			"version": "1.25.7"
+		}
+	},
+
+	"onCreateCommand": "sudo PATH=$PATH bash .devcontainer/setup.sh",
+	"postAttachCommand": {
+		"Runs all non-integration tests that do not require `root` privileges": "make test",
+		"Runs non-integration tests which require `root`": "sudo PATH=$PATH  make root-test"
+	},
+
+	"remoteUser": "root",
+	"runArgs": [
+		"--ipc=host",
+		"--volume=/dev:/dev",
+		"--volume=/run/udev:/run/udev",
+		"--privileged"
+	]
+}

.devcontainer/setup.sh

@@ -0,0 +1,28 @@
+#!/bin/bash
+
+#   Copyright The containerd Authors.
+
+#   Licensed under the Apache License, Version 2.0 (the "License");
+#   you may not use this file except in compliance with the License.
+#   You may obtain a copy of the License at
+
+#       http://www.apache.org/licenses/LICENSE-2.0
+
+#   Unless required by applicable law or agreed to in writing, software
+#   distributed under the License is distributed on an "AS IS" BASIS,
+#   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#   See the License for the specific language governing permissions and
+#   limitations under the License.
+
+set -eux
+
+script/setup/install-seccomp
+script/setup/install-runc
+script/setup/install-cni $(grep containernetworking/plugins go.mod | awk '{print $2}')
+script/setup/install-critools
+script/setup/install-failpoint-binaries
+script/setup/install-gotestsum
+script/setup/install-teststat
+
+make binaries GO_BUILD_FLAGS="-mod=vendor"
+sudo -E PATH=$PATH make install

.devcontainer/welcome-message.txt

@@ -0,0 +1,7 @@
+👋 Welcome to "containerd" in GitHub Codespaces!
+
+🛠️  Your environment is fully setup with all the required software.
+
+🔍 To explore VS Code to its fullest, search using the Command Palette (Cmd/Ctrl + Shift + P or F1).
+
+ℹ️  Look at https://github.com/containerd/project/blob/main/CONTRIBUTING.md for contribution guidelines.

.github/ISSUE_TEMPLATE/cri_kep.yaml

@@ -0,0 +1,57 @@
+name: SIG-Node Integration
+description: Tracking issue for SIG-Node integration work (including KEPs)
+title: "[SIG-Node]: <KEP-number - Short Description>"
+labels:
+  - kind/feature
+  - area/cri
+assignees:
+  - mikebrow
+  - fuweid
+  - samuelkarp
+body:
+  - type: textarea
+    attributes:
+      label: KEP/SIG-Node References
+      description: |
+        example:
+          - **KEP**: #
+          - **stage**: alpha|beta w/gate off|beta w/gate on|ga
+          - **KEP-Issue**: link
+          - **KEP-PR**: link
+          - **K8s-Release**: version where the KEP stage is scheduled to release or has released
+          - **KEP-Owner: id(s) SIG-Node member(s) that own the KEP of reference
+          - **SIG-Node member liaison: containerd maintainer(s) ensuring interop with sig-node
+          - **KEP-Shepherd: containerd owner assigned to this issue
+      value: |
+          - KEP(s):
+          - stage:
+          - KEP Issue:
+          - KEP PR:
+          - K8s-Release:
+          - KEP-Owner:
+          - SIG-Node member liason:
+          - KEP-Shepherd:
+    validations:
+      required: false
+
+  - type: textarea
+    attributes:
+      label: What is the SIG-Node problem you are trying to solve
+      description: |
+        A clear and concise description of the reason for the change(s) required in containerd.
+    validations:
+      required: true
+
+  - type: textarea
+    attributes:
+      label: Describe the solution you would like
+      description: |
+        A clear and concise description of design considerations that should be made when making the change(s).
+    validations:
+      required: true
+
+  - type: textarea
+    attributes:
+      label: Additional context
+      description: |
+        Add any other context about the needed change here.

.github/actions/install-go/action.yml

@@ -0,0 +1,16 @@
+name: "Setup Go"
+description: "Reusable action to install Go, so there is one place to bump Go versions"
+inputs:
+  go-version:
+    required: true
+    default: "1.25.7"
+    description: "Go version to install"
+
+runs:
+  using: composite
+  steps:
+    - name: "Setup Go"
+      uses: actions/setup-go@v5
+      with:
+        go-version: ${{ inputs.go-version }}
+        cache: false # see actions/setup-go#368

.github/dependabot.yml

@@ -0,0 +1,25 @@
+version: 2
+updates:
+  - package-ecosystem: "gomod"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+    groups:
+      golang-x:
+        patterns:
+          - "golang.org/x/*"
+      k8s:
+        patterns:
+          - "k8s.io/*"
+      moby-sys:
+        patterns:
+          - "github.com/moby/sys/*"
+      otel:
+        patterns:
+          - "go.opentelemetry.io/*"
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10

.github/workflows/api-release.yml

@@ -0,0 +1,80 @@
+on:
+  push:
+    tags:
+      - "api/v*" # Push events to matching api/v*, i.e. api/v1.0, api/v20.15.10
+
+name: API Release
+
+env:
+  GO_VERSION: "1.25.7"
+
+permissions: # added using https://github.com/step-security/secure-workflows
+  contents: read
+
+jobs:
+  check:
+    name: Check Signed Tag
+    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/api/v')
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    outputs:
+      stringver: ${{ steps.contentrel.outputs.stringver }}
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          ref: ${{ github.ref }}
+          path: src/github.com/containerd/containerd
+
+      - name: Check signature
+        run: |
+          releasever=${{ github.ref }}
+          releasever="${releasever#refs/tags/}"
+          TAGCHECK=$(git tag -v ${releasever} 2>&1 >/dev/null) ||
+          echo "${TAGCHECK}" | grep -q "error" && {
+              echo "::error::tag ${releasever} is not a signed tag. Failing release process."
+              exit 1
+          } || {
+              echo "Tag ${releasever} is signed."
+              exit 0
+          }
+        working-directory: src/github.com/containerd/containerd
+
+      - name: Release content
+        id: contentrel
+        run: |
+          RELEASEVER=${{ github.ref }}
+          echo "stringver=${RELEASEVER#refs/tags/api/v}" >> $GITHUB_OUTPUT
+          git tag -l ${RELEASEVER#refs/tags/} -n20000 | tail -n +3 | cut -c 5- >release-notes.md
+        working-directory: src/github.com/containerd/containerd
+
+      - name: Save release notes
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        with:
+          name: containerd-release-notes
+          path: src/github.com/containerd/containerd/release-notes.md
+
+  release:
+    name: Create containerd Release
+    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/api/v')
+    permissions:
+      contents: write
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    needs: [check]
+    steps:
+      - name: Download release notes
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
+        with:
+          path: builds
+      - name: Create Release
+        uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2.5.0
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          fail_on_unmatched_files: true
+          name: containerd API ${{ needs.check.outputs.stringver }}
+          draft: false
+          make_latest: false
+          prerelease: ${{ contains(github.ref, 'beta') || contains(github.ref, 'rc') }}
+          body_path: ./builds/release-notes.md