Skip to content

containerd 1.2.0

Compare
Choose a tag to compare
@dmcgowan dmcgowan released this 25 Oct 00:05
v1.2.0
c444666

Welcome to the v1.2.0 release of containerd!

The third major release of containerd brings both a mix of boring and
exciting changes. While fixing many bugs and continuing support for the
containerd 1.0 API, new APIs and interfaces have been added to allow
containerd to be more extensible and cover more use cases.

New V2 Runtime

A new v2 runtime has been added with a stable gRPC interface for managing
containers through external shims.

This allows runtime authors to easily integrate with containerd over a stable
API.

Various runtimes can be selected on a per container basis using the WithRuntime opt
or to test via ctr ctr run --runtime io.containerd.runc.v1.

Documentation

Updated CRI Plugin

Containerd 1.2 is validated against Kubernetes v1.11 and v1.12, but it is also compatible with Kubernetes v1.10.

To use containerd 1.2 with Kubernetes v1.10, be sure to run the stream server on an address accessible to the apiserver. A simple way is to set stream_server_address="" in the [plugins.cri] section of containerd.toml, so that cri plugin will automatically select a routable node address.

Kubernetes Runtime Class

Kubernetes Runtime Class introduced in Kubernetes 1.12 is supported.

Users can:

  • Configure alternative runtime handlers with the config option plugins.cri.containerd.runtimes.runtime_handler_name, e.g. plugins.cri.containerd.runtimes.kata. (config.md)
  • Use the alternative runtime handler in Kubernetes by creating RuntimeClass for the runtime handler, and specifying RuntimeClassName in the pod spec. (doc)

The plugins.cri.containerd.untrusted_workload_runtime config option and io.kubernetes.cri.untrusted-workload pod annotation are still functional, but start being deprecated. It is recommended to migrate to the RuntimeClass api.

Other Features

  • Supported ProcMount option introduced in Kubernetes 1.12.
  • Added a new config option plugins.cri.registry.auths for user to config default credentials for specific registries. (doc)
  • Added a new config option plugins.cri.x509_key_pair_streaming for user to config a valid certificate for the stream server. (config.md)
  • Added a runtime options field for shim v2 runtime. Use the options field to config runtime specific options, e.g. NoPivotRoot and SystemdCgroup for runtime type io.containerd.runc.v1. (See config.md)

Notable Changes

  • cri plugin can see images pulled/imported into containerd by ctr images pull and ctr images import.
  • CNI config is now dynamically reloaded when changed.
  • IPv4 address is guaranteed to be selected, when there are both IPv4 and IPv6 addresses for a pod.
  • Privileged untrusted workload is allowed, the workload will get privilege inside the sandbox.
  • cri plugin stream server serves on http://localhost:0 by default. This is to work with the kubelet streaming proxy introduced in Kubernetes 1.11.
  • Fixed an issue that a container can't be stopped when container processes are accidentally moved out of the container cgroups.
  • cluster/health-monitor.sh in the release tarball will be deprecated next release. Please use Kubernetes health-monitor.sh instead.

New Proxy Plugins

A new proxy plugin configuration has been added to allow external snapshotters
be connected to containerd using gRPC.

Documentation

Managed /opt directory

A new Install method on the containerd client allows users to publish host level
binaries using standard container build tooling and container distribution tooling
to download containerd related binaries on their systems.

This can be used for v2 runtime authors to get their runtime shims on an existing
containerd system. It can also be used to install runc and other related tools.

> ctr content fetch docker.io/crosbymichael/runc:latest
> ctr install docker.io/crosbymichael/runc:latest

Documentation

Garbage Collection

Add support for cleaning up leases and content ingests to garbage collections.

Add expiration label to clean up temporary resources.

Image Importer

The image importer has been updated to support output from docker save. Users
of the ctr tool should take note of the usage change to ctr images import.
We continue to recommend not building tooling on top of the ctr tool.

API Changes

This release features a couple additions to the API. Clients may make use of
these new API features but should be able to handle cases when those features
are not implemented on the server. The Go client handles this automatically.

  • Add ListStream method to containers API. This allows listing a larger
    number of containers without hitting message size limts.
  • Add Sync flag to Delete in leases API. Setting this option will ensure
    a garbage collection completes before the removal call is returned. This can
    be used to guarantee unreferenced objects are removed from disk after a lease.

Other Improvements

Improved multi-arch image support using more precise matching and ranking

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

Contributors

  • Michael Crosby
  • Lantao Liu
  • Derek McGowan
  • Phil Estes
  • Justin Terry
  • Akihiro Suda
  • Kir Kolyshkin
  • Abhinandan Prativadi
  • Stephen J Day
  • Kenfe-Mickaël Laventure
  • Evan Hazlett
  • Sebastiaan van Stijn
  • Andrei Vagin
  • Brian Goff
  • Lifubang
  • Wei Fu
  • John Howard
  • Samuel Karp
  • Ace-Tang
  • Darren Stahl
  • Ian Campbell
  • Michael Wan
  • Wei Fu
  • Claudia Beresford
  • JulienBalestra
  • Maksym Pavlenko
  • Mike Brown
  • Xuean Yan
  • Felix Abecassis
  • Gábor Lipták
  • Ivan Markin
  • Jian Liao
  • Jie Zhang
  • Luc Perkins
  • Mathieu Champlon
  • Tim Allclair
  • Tom Godkin
  • Tõnis Tiigi
  • Vincent Demeester
  • Xiaodong Zhang
  • Yanqiang Miao
  • Yongxin Li
  • Yu-Ju Hong
  • Alban Crequy
  • Aleksa Sarai
  • Alexander Gerasiov
  • Andrew Osheroff
  • Arnaud Rebillout
  • Bin Du
  • Bingshen Wang
  • Danail Branekov
  • Daniel, Dao Quang Minh
  • Dave Henderson
  • Eric Ernst
  • Filipe Brandenburger
  • Frank Yang
  • Harshal Patil
  • Jiri Appl
  • Justin Cormack
  • Kevin Xu
  • Lihua Tang
  • Lu Jingxiao
  • Madhan Raj Mookkandy
  • Michael Fraenkel
  • Nikos Anastopoulos
  • Oliver Stenbom
  • Parav Pandit
  • Ricardo Aravena
  • Rolf Neugebauer
  • Rui Cao
  • Starnop
  • Sudeesh John
  • Tobias Klauser
  • Xiaoxi He
  • Luc Perkins

Changes

Changes from containerd/aufs

Changes from containerd/cgroups

  • 5e61083 Merge pull request #50 from jingxiaolu/master
  • 0d1587c Add interface AddTask to control groups. So that we can set tasks when we need.
  • 07683a6 Merge pull request #45 from anastop/master
  • 15ef4c3 Add Update method for the cpuset controller
  • c755602 Merge pull request #41 from estesp/update-travis-go
  • 0a357bb Update Go versions for travis
  • 5539584 Fix incorrect use of OCI runtime specs-go cgroup dev types
  • bf7d89f Merge pull request #40 from containerd/license
  • f1d9380 Add license to files
  • 78a98a6 Merge pull request #39 from paravmellanox/master
  • ccd26c4 Add support for rdma cgroup

Changes from containerd/console

  • c12b1e7 Merge pull request #29 from crosbymichael/win
  • 7a61819 Update read write on windows console
  • 8894ab3 Revert "Fix reading from and writing to console on windows"
  • b3d113c Use stdout for windows console
  • 4d8a41f Merge pull request #27 from gerasiov/master
  • 5d1b48d console_linux: Fix race: lock Cond before Signal.
  • 9a57d21 Merge pull request #28 from crosbymichael/travis
  • 058dd74 Update travis file for 1.10
  • 9290d21 Merge pull request #25 from mat007/support-read-write-windows
  • a7ba593 Fix reading from and writing to console on windows
  • 6fe6f36 Fix some typos in comments

Changes from containerd/continuity

  • bd77b46 Merge pull request #136 from AkihiroSuda/sync-testutil-2
  • 4fd7ce4 split testutil/loopback_linux.go to another pkg
  • 98c57b8 Merge pull request #130 from estesp/travis-project
  • 7f53d41 Merge pull request #134 from dmcgowan/remove-unnecessary-fs-root-check
  • 18a1c09 Remove unreachable block in fs path cleanup
  • 508d86a Merge pull request #123 from kolyshkin/path-error
  • f192d1b Add common project validation scripts
  • aae7d98 Merge pull request #127 from AkihiroSuda/sync-testutil
  • f04dbc0 Merge pull request #133 from kolyshkin/context
  • 508ef95 travis CI: rm go 1.8
  • 3448067 Switch from x/net/context to context
  • c2ac4ec Merge pull request #129 from estesp/fileheaders
  • cc3f87e Merge pull request #131 from estesp/fixup-vendor
  • d1610d5 Fixup vendor/ with latest run of vndr
  • f9cc5ee Add fileheaders with ltag tool
  • f768f56 testutil: sync with containerd
  • f44b615 Merge pull request #124 from HusterWan/zr/expose-func
  • 4469d34 feature: expose atomicWriterFile function as AtomicWriteFile
  • f5b895a driver/{Mknod,Mkfifo,Lchmod}: return PathError
  • c7c5070 Merge pull request #121 from kolyshkin/xattr
  • a408b7b sysx/xattr: unify implementation
  • 363bb7e vendor: bump golang.org/x/sys to 77b0e4315053
  • 0e47603 sysx: add README
  • 0377f7d Merge pull request #120 from kolyshkin/lchmod-linux-go111
  • 6d0b394 context.Apply: no need to skip chmod on symlinks
  • 94af800 Lchmod(): fix for Linux/Go 1.11
  • 9ab0ec6 Lchmod(): simplify and optimize
  • 2b69c16 sysx.Fchmodat(): remove
  • d2ce1bc sysx/xattr_darwin.go: rm duplicate Fchmodat def
  • 246e490 Merge pull request #111 from cpuguy83/disk_usage_cancellation
  • ab18c4f Merge pull request #115 from cpuguy83/update_travis
  • d3c2351 Merge pull request #113 from darstahl/ResolveRoot
  • a60600a Merge pull request #117 from dmcgowan/fix-create-file-reader-creation
  • 7d784df Fix bug in multiple calls to file applier
  • 2d3749b Merge pull request #116 from dmcgowan/random-file-test
  • a3fa14c Update TestCopyWithLargeFile
  • 7333bda Merge pull request #114 from cpuguy83/fix_copy_file_range_usage
  • afba265 Fix copy_file_range usage for files > 2GB
  • 7f1a8b2 Make sure travis tests on latest go version.
  • 5633c24 Stop resolving symlink in containWithRoot
  • 7a71e24 Fix vet failure
  • 8100e75 Resolve context root to follow symlinks as root directories
  • c6cef34 Merge pull request #106 from cpuguy83/export_copy_file
  • a88ec15 Merge pull request #108 from tklauser/xattr-sys-unix
  • 6cde904 Support cancellation via context in DiskUsage.
  • d59f454 Export copyFile
  • 6268e28 sysx: use xattr functions from x/sys/unix

Changes from containerd/cri

  • f9137149 Merge pull request #951 from Random-Liu/cherrypick-#949-release-1.2
  • 02501807 Add integration test.
  • bb6d2726 Update go-cni to 40bcf8ec8acd7372be1d77031d585d5d8e561c90.
  • 986f7540 Teardown pod network even if the network namespace is closed
  • 4f939fcb Merge pull request #947 from Random-Liu/cherrypick-#943-release-1.2
  • 49d77ddd Support runtime specific configurations.
  • a97094d4 Merge pull request #945 from Random-Liu/cherrypick-#944-release-1.2
  • 2cd14194 Use Authorizer.
  • 5a547640 Update containerd to 15f19d7.
  • 8506fe83 Merge pull request #939 from Random-Liu/cherrypick-#938-release-1.2
  • f6db6132 Update test based on new CRI.
  • 97fcaf90 Update kubernetes to v1.12.0.
  • 33624c19 Merge pull request #933 from Random-Liu/cherrypick-#926-release-1.2
  • 84a720ee Add integration test
  • 18ecffc9 Manage unmanaged images in k8s.io namespace
  • e5b175d6 Merge pull request #931 from Random-Liu/cherrypick-#924-release-1.2
  • dd67e74e Update containerd to f88d3e5.
  • bf62320e Add timeout for container/sandbox recover and event monitor.
  • 79645ed3 Merge pull request #929 from Random-Liu/cherrypick-#928-release-1.2
  • f888b2f4 Update critools version.
  • 9f39e328 Merge pull request #919 from Random-Liu/update-cri-tools
  • 3de8c8bf Update cri-tools to 98eea54af789ae13edce79cba101fb9ac8e7b241.
  • 31a960fb Merge pull request #918 from Random-Liu/show-runtime-handler-in-sandbox-info
  • 46b8f429 Merge pull request #912 from Random-Liu/add-hostname-env-integration-test
  • [4b45e16a](containerd/cri@4b45e16...
Read more