Google-Bug-Id: 508657842
Signed-off-by: Samuel Karp <[email protected]>
(cherry picked from commit 0c0918f)
Signed-off-by: Samuel Karp <[email protected]>

Image config labels are copied onto the container by both the CRI
plugin (BuildLabels) and the client's WithImageConfigLabels option
used by `ctr run`. Labels in the containerd.io/* namespace are
interpreted by containerd itself and labels in the io.cri-containerd*
namespace are interpreted by the CRI plugin. An image config is not a
trusted source for labels in either namespace.

Skip labels in both reserved namespaces when copying labels from an
image config to a container, and warn about each label skipped: an
image that tries to set them may be attempting to alter containerd
behavior. Oversized image labels are already skipped this way by
the CRI plugin.

Labels set explicitly by clients, for example via `ctr run --label`
or in the CRI request, are unaffected.

Verified with the CRI plugin and with `ctr run` against an image
whose config carries labels like these: the labels are no longer
present on the created container and a warning is logged for each.

Assisted-by: Claude Code
Signed-off-by: Ben Cressey <[email protected]>
Signed-off-by: Samuel Karp <[email protected]>
(cherry picked from commit 0ec1af4)
Signed-off-by: Akihiro Suda <[email protected]>
Signed-off-by: Samuel Karp <[email protected]>

Filter out any annotations on the checkpointed container matching
`cdi.k8s.io/` or exactly `cdi.k8s.io` during restore to prevent
unauthorized device restoration. When an annotation is denied, a warning
log is generated.

Tested by:
* Unit tests for exact matching, prefix boundaries, and metadata merging
* Complete CRI integration and checkpoint restore suite

Assisted-by: Antigravity
Signed-off-by: Samuel Karp <[email protected]>
(cherry picked from commit 861ffc1)
Signed-off-by: Chris Henzie <[email protected]>

The CRI checkpoint restore path unpacked checkpoint archive/OCI image content
directly into the container's persistent state directory and read files such as
container.log back from it with a symlink-following copy. Checkpoint content is
externally provided, so make restore more defensive about what it unpacks and
how it reads those files back.

Behavior changes:

- Only unpack regular files and directories from the checkpoint archive.

- Unpack checkpoint content into a dedicated <state>/ctrd-restore
  subdirectory created fresh rather than into the state dir itself, so
  checkpoint content cannot collide with containerd's own files (e.g.
  the "status" blob). Restore and cleanup operate on that subdir;
  cleanup is now a single RemoveAll of it.

Signed-off-by: Brian Goff <[email protected]>
(cherry picked from commit 8196411)
Signed-off-by: Brian Goff <[email protected]>

Signed-off-by: Samuel Karp <[email protected]>