Merge pull request #138 from containerd/dependabot/go_modules/github.com/containerd/containerd/v2-2.1.1

Bump github.com/containerd/containerd/v2 from 2.1.0 to 2.1.1

.github/dependabot.yml

@@ -0,0 +1,11 @@
+version: 2
+updates:
+  - package-ecosystem: "gomod"
+    directory: "/"
+    schedule:
+      interval: "daily"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "daily"

.github/workflows/main.yml

@@ -2,40 +2,63 @@ name: CI
 on:
   workflow_dispatch:
   pull_request:
+  push:
     branches:
       - master
 jobs:
   project:
     name: Project Checks
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-22.04
     timeout-minutes: 20
     steps:
-    - uses: actions/setup-go@v2
+    - uses: actions/setup-go@v5
       with:
-        go-version: 1.16.x
-    - uses: actions/checkout@v2
+        go-version: 1.24.x
+    - uses: actions/checkout@v4
       with:
         path: src/github.com/containerd/fuse-overlayfs-snapshotter
         fetch-depth: 25
-    - uses: containerd/project-checks@v1
+    - uses: containerd/project-checks@v1.2.2
       with:
         working-directory: src/github.com/containerd/fuse-overlayfs-snapshotter
 
+  linters:
+    name: Linters
+    permissions:
+      contents: read # for actions/checkout to fetch code
+      pull-requests: read # for golangci/golangci-lint-action to fetch pull requests
+    runs-on: ubuntu-22.04
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          path: src/github.com/containerd/fuse-overlayfs-snapshotter
+      - uses: actions/setup-go@v5
+        with:
+          go-version: 1.24.x
+      - uses: golangci/golangci-lint-action@v8
+        with:
+          working-directory: src/github.com/containerd/fuse-overlayfs-snapshotter
+
   test:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-22.04
     timeout-minutes: 30
     strategy:
       fail-fast: false
       matrix:
-        fuse-overlayfs: [v1.0.0, v1.6, main]
+        fuse-overlayfs: [v1.0.0, v1.13, main]
     env:
       FUSEOVERLAYFS_COMMIT: "${{ matrix.fuse-overlayfs }}"
     steps:
-    - uses: actions/checkout@master
+    - uses: actions/checkout@v4
     - run: make test
+
   cross:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-22.04
     timeout-minutes: 30
     steps:
-    - uses: actions/checkout@master
+    - uses: actions/setup-go@v5
+      with:
+        go-version: 1.24.x
+    - uses: actions/checkout@v4
     - run: make artifacts

.github/workflows/release.yml

@@ -8,13 +8,19 @@ env:
   GO111MODULE: on
 jobs:
   release:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-22.04
     timeout-minutes: 20
+    # The maximum access is "read" for PRs from public forked repos
+    # https://docs.github.com/en/actions/security-guides/automatic-token-authentication#permissions-for-the-github_token
+    permissions:
+      contents: write  # for releases
+      id-token: write  # for provenances
+      attestations: write  # for provenances
     steps:
-    - uses: actions/setup-go@v2
+    - uses: actions/setup-go@v5
       with:
-        go-version: 1.16.x
-    - uses: actions/checkout@v2
+        go-version: 1.24.x
+    - uses: actions/checkout@v4
       with:
         path: go/src/github.com/containerd/fuse-overlayfs-snapshotter
     - name: "Compile binaries"
@@ -31,11 +37,8 @@ jobs:
     - name: "Prepare the release note"
       working-directory:  go/src/github.com/containerd/fuse-overlayfs-snapshotter
       run: |
-        tag="${GITHUB_REF##*/}"
         shasha=$(sha256sum _output/SHA256SUMS | awk '{print $1}')
         cat <<-EOF | tee /tmp/release-note.txt
-        ${tag}
-
         (To be documented)
         - - -
         The binaries were built automatically on GitHub Actions.
@@ -43,12 +46,13 @@ jobs:
 
         The sha256sum of the SHA256SUMS file itself is \`${shasha}\` .
         EOF
+    - uses: actions/attest-build-provenance@v2
+      with:
+        subject-path: go/src/github.com/containerd/fuse-overlayfs-snapshotter/_output/*
     - name: "Create release"
       working-directory:  go/src/github.com/containerd/fuse-overlayfs-snapshotter
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       run: |
         tag="${GITHUB_REF##*/}"
-        asset_flags=()
-        for f in _output/*; do asset_flags+=("-a" "$f"); done
-        hub release create "${asset_flags[@]}" -F /tmp/release-note.txt --draft "${tag}"
+        gh release create -F /tmp/release-note.txt --draft --title "${tag}" "${tag}" _output/*

.golangci.yml

@@ -0,0 +1,39 @@
+version: "2"
+linters:
+  enable:
+    - copyloopvar
+    - depguard
+    - gosec
+    - misspell
+    - nolintlint
+    - unconvert
+  disable:
+    - errcheck
+    - revive
+  settings:
+    depguard:
+      rules:
+        main:
+          deny:
+            - pkg: io/ioutil
+              desc: use "io" or "os" instead
+  exclusions:
+    generated: lax
+    presets:
+      - comments
+      - common-false-positives
+      - legacy
+      - std-error-handling
+    paths:
+      - third_party$
+      - builtin$
+      - examples$
+formatters:
+  enable:
+    - gofmt
+  exclusions:
+    generated: lax
+    paths:
+      - third_party$
+      - builtin$
+      - examples$

Dockerfile

@@ -12,19 +12,19 @@
 #   See the License for the specific language governing permissions and
 #   limitations under the License.
 
-ARG FUSEOVERLAYFS_COMMIT=master
-ARG ROOTLESSKIT_COMMIT=v0.14.0
-ARG SHADOW_COMMIT=4.8.1
+ARG FUSEOVERLAYFS_COMMIT=main
+ARG ROOTLESSKIT_COMMIT=v1.1.0
 
-ARG GO_VERSION=1.16
-ARG DEBIAN_VERSION=10
-ARG ALPINE_VERSION=3.13
+ARG GO_VERSION=1.24
+ARG DEBIAN_VERSION=11
+ARG ALPINE_VERSION=3.18
 
 FROM golang:${GO_VERSION}-alpine AS containerd-fuse-overlayfs-test
 COPY . /go/src/github.com/containerd/fuse-overlayfs-snapshotter
 WORKDIR  /go/src/github.com/containerd/fuse-overlayfs-snapshotter
 ENV CGO_ENABLED=0
 ENV GO111MODULE=on
+RUN go build ./...
 RUN mkdir /out && go test -c -o /out/containerd-fuse-overlayfs.test
 
 # from https://github.com/containers/fuse-overlayfs/blob/53c17dab78b43de1cd121bf9260b20b76371bbaf/Dockerfile.static.ubuntu
@@ -49,22 +49,11 @@ RUN git pull && git checkout ${ROOTLESSKIT_COMMIT}
 ENV CGO_ENABLED=0
 RUN mkdir /out && go build -o /out/rootlesskit github.com/rootless-containers/rootlesskit/cmd/rootlesskit 
 
-FROM alpine:${ALPINE_VERSION} AS idmap
-RUN apk add --no-cache autoconf automake build-base byacc gettext gettext-dev gcc git libcap-dev libtool libxslt
-RUN git clone https://github.com/shadow-maint/shadow.git
-WORKDIR shadow
-ARG SHADOW_COMMIT
-RUN git pull && git checkout ${SHADOW_COMMIT}
-RUN ./autogen.sh --disable-nls --disable-man --without-audit --without-selinux --without-acl --without-attr --without-tcb --without-nscd && \
-   make && mkdir -p /out && cp src/newuidmap src/newgidmap /out
-
 FROM alpine:${ALPINE_VERSION}
 COPY --from=containerd-fuse-overlayfs-test /out/containerd-fuse-overlayfs.test /usr/local/bin
 COPY --from=rootlesskit /out/rootlesskit /usr/local/bin
 COPY --from=fuse-overlayfs /out/fuse-overlayfs /usr/local/bin
-COPY --from=idmap /out/newuidmap /usr/bin/newuidmap
-COPY --from=idmap /out/newgidmap /usr/bin/newgidmap
-RUN apk add --no-cache fuse3 libcap && \
+RUN apk add --no-cache fuse3 libcap shadow-uidmap && \
     setcap CAP_SETUID=ep /usr/bin/newuidmap && \
     setcap CAP_SETGID=ep /usr/bin/newgidmap && \
     adduser -D -u 1000 testuser && \

Makefile

@@ -12,52 +12,97 @@
 #   See the License for the specific language governing permissions and
 #   limitations under the License.
 
+# Deliverables path
 DESTDIR ?= /usr/local
+BINDIR ?= $(DESTDIR)/bin
 
-VERSION=$(shell git describe --match 'v[0-9]*' --dirty='.m' --always --tags)
-VERSION_TRIMMED := $(VERSION:v%=%)
-REVISION=$(shell git rev-parse HEAD)$(shell if ! git diff --no-ext-diff --quiet --exit-code; then echo .m; fi)
-
-PKG_MAIN := github.com/containerd/fuse-overlayfs-snapshotter/cmd/containerd-fuse-overlayfs-grpc
-PKG_VERSION := github.com/containerd/fuse-overlayfs-snapshotter/cmd/containerd-fuse-overlayfs-grpc/version
-
+# Tools path
+ECHO ?= echo
+DOCKER ?= docker
 GO ?= go
+MKDIR ?= mkdir
+TAR ?= tar
+INSTALL ?= install
+GIT ?= git
+
+TARGET_BIN=containerd-fuse-overlayfs-grpc
+
+VERSION ?= $(shell $(GIT) describe --match 'v[0-9]*' --dirty='.m' --always --tags)
+VERSION_TRIMMED := $(VERSION:v%=%)
+REVISION ?= $(shell $(GIT) rev-parse HEAD)$(shell if ! $(GIT) diff --no-ext-diff --quiet --exit-code; then $(ECHO) .m; fi)
+
+PKG_MAIN := github.com/containerd/fuse-overlayfs-snapshotter/v2/cmd/$(TARGET_BIN)
+PKG_VERSION := github.com/containerd/fuse-overlayfs-snapshotter/v2/cmd/$(TARGET_BIN)/version
+
 export GO_BUILD=GO111MODULE=on CGO_ENABLED=0 $(GO) build -ldflags "-s -w -X $(PKG_VERSION).Version=$(VERSION) -X $(PKG_VERSION).Revision=$(REVISION)"
 
-bin/containerd-fuse-overlayfs-grpc:
+bin/$(TARGET_BIN):
 	$(GO_BUILD) -o $@ $(PKG_MAIN)
 
+all: binaries
+
+help:
+	@$(ECHO) "Usage: make <target>"
+	@$(ECHO)
+	@$(ECHO) " * 'install'   - Install binaries to system locations."
+	@$(ECHO) " * 'uninstall' - Uninstall binaries from system."
+	@$(ECHO) " * 'binaries'  - Build $(TARGET_BIN)."
+	@$(ECHO) " * 'test'      - Run tests."
+	@$(ECHO) " * 'clean'     - Clean artifacts."
+	@$(ECHO) " * 'help'      - Show this help message."
+
+binaries: bin/$(TARGET_BIN)
+
+$(TARGET_BIN):
+	$(GO_BUILD) -o $(CURDIR)/bin/$@ $(PKG_MAIN)
+
+binaries: $(TARGET_BIN)
+
 install:
-	install bin/containerd-fuse-overlayfs-grpc $(DESTDIR)/bin
+	$(INSTALL) -D -m 755 $(CURDIR)/bin/$(TARGET_BIN) $(BINDIR)/$(TARGET_BIN)
 
 uninstall:
-	rm -f $(DESTDIR)/bin/containerd-fuse-overlayfs-grpc
+	$(RM) $(BINDIR)/$(TARGET_BIN)
 
 clean:
-	rm -rf bin
+	$(RM) -r $(CURDIR)/bin $(CURDIR)/_output
+
+TEST_DOCKER_IMG_TAG=containerd-fuse-overlayfs-test
 
 test:
-	DOCKER_BUILDKIT=1 docker build -t containerd-fuse-overlayfs-test --build-arg FUSEOVERLAYFS_COMMIT=${FUSEOVERLAYFS_COMMIT} .
-	docker run --rm containerd-fuse-overlayfs-test fuse-overlayfs -V
-	docker run --rm --security-opt seccomp=unconfined --security-opt apparmor=unconfined --device /dev/fuse containerd-fuse-overlayfs-test
-	docker rmi containerd-fuse-overlayfs-test
+	DOCKER_BUILDKIT=1 $(DOCKER) build -t $(TEST_DOCKER_IMG_TAG) --build-arg FUSEOVERLAYFS_COMMIT=${FUSEOVERLAYFS_COMMIT} .
+	$(DOCKER) run --rm $(TEST_DOCKER_IMG_TAG) fuse-overlayfs -V
+	$(DOCKER) run --rm --security-opt seccomp=unconfined --security-opt apparmor=unconfined --device /dev/fuse $(TEST_DOCKER_IMG_TAG)
+	$(DOCKER) rmi $(TEST_DOCKER_IMG_TAG)
 
 _test:
-	go test -exec rootlesskit -test.v -test.root
+	$(GO) test -exec rootlesskit -test.v -test.root
 
 TAR_FLAGS=--transform 's/.*\///g' --owner=0 --group=0
 
-artifacts: clean
-	mkdir -p _output
-	GOOS=linux GOARCH=amd64       make
-	tar $(TAR_FLAGS) -czvf _output/containerd-fuse-overlayfs-$(VERSION_TRIMMED)-linux-amd64.tar.gz  bin/*
-	GOOS=linux GOARCH=arm64       make
-	tar $(TAR_FLAGS) -czvf _output/containerd-fuse-overlayfs-$(VERSION_TRIMMED)-linux-arm64.tar.gz  bin/*
-	GOOS=linux GOARCH=arm GOARM=7 make
-	tar $(TAR_FLAGS) -czvf _output/containerd-fuse-overlayfs-$(VERSION_TRIMMED)-linux-arm-v7.tar.gz bin/*
-	GOOS=linux GOARCH=ppc64le     make
-	tar $(TAR_FLAGS) -czvf _output/containerd-fuse-overlayfs-$(VERSION_TRIMMED)-linux-ppc64le.tar.gz  bin/*
-	GOOS=linux GOARCH=s390x       make
-	tar $(TAR_FLAGS) -czvf _output/containerd-fuse-overlayfs-$(VERSION_TRIMMED)-linux-s390x.tar.gz  bin/*
+ARTIFACT_NAME=containerd-fuse-overlayfs-$(VERSION_TRIMMED)
 
-.PHONY: bin/containerd-fuse-overlayfs-grpc install uninstall clean test _test artifacts
+artifacts: clean
+	$(MKDIR) -p _output
+	GOOS=linux GOARCH=amd64 make -B
+	$(TAR) $(TAR_FLAGS) -czvf _output/$(ARTIFACT_NAME)-linux-amd64.tar.gz $(CURDIR)/bin/*
+	GOOS=linux GOARCH=arm64 make -B
+	$(TAR) $(TAR_FLAGS) -czvf _output/$(ARTIFACT_NAME)-linux-arm64.tar.gz $(CURDIR)/bin/*
+	GOOS=linux GOARCH=arm GOARM=7 make -B
+	$(TAR) $(TAR_FLAGS) -czvf _output/$(ARTIFACT_NAME)-linux-arm-v7.tar.gz $(CURDIR)/bin/*
+	GOOS=linux GOARCH=ppc64le make -B
+	$(TAR) $(TAR_FLAGS) -czvf _output/$(ARTIFACT_NAME)-linux-ppc64le.tar.gz $(CURDIR)/bin/*
+	GOOS=linux GOARCH=s390x make -B
+	$(TAR) $(TAR_FLAGS) -czvf _output/$(ARTIFACT_NAME)-linux-s390x.tar.gz $(CURDIR)/bin/*
+	GOOS=linux GOARCH=riscv64 make -B
+	$(TAR) $(TAR_FLAGS) -czvf _output/$(ARTIFACT_NAME)-linux-riscv64.tar.gz $(CURDIR)/bin/*
+
+.PHONY: \
+	$(TARGET_BIN) \
+	install \
+	uninstall \
+	clean \
+	test \
+	_test \
+	artifacts \
+	help

README.md

@@ -5,8 +5,6 @@ Unlike `overlayfs`, `fuse-overlayfs` can be used as a non-root user on almost al
 You do NOT need this `fuse-overlayfs` plugin on the following environments, because they support the real `overlayfs` for non-root users:
 - [kernel >= 5.11](https://github.com/torvalds/linux/commit/459c7c565ac36ba09ffbf24231147f408fde4203)
 - [Ubuntu kernel, since circa 2015](https://kernel.ubuntu.com/git/ubuntu/ubuntu-bionic.git/commit/fs/overlayfs?id=3b7da90f28fe1ed4b79ef2d994c81efbc58f1144)
-- [Debian 10 kernel](https://salsa.debian.org/kernel-team/linux/blob/283390e7feb21b47779b48e0c8eb0cc409d2c815/debian/patches/debian/overlayfs-permit-mounts-in-userns.patch)
-  - Debian 10 needs `sudo modprobe overlay permit_mounts_in_userns=1`. Future release of Debian with kernel >= 5.11 will not need this `modprobe` hack.
 
 fuse-overlayfs-snapshotter is a **non-core** sub-project of containerd.
 
@@ -25,7 +23,7 @@ Choose 1 if you don't mind recompiling containerd, otherwise choose 2.
 
 ### Option 1: Embed `fuse-overlayfs` plugin into the containerd binary
 
-Create `builtins_fuseoverlayfs_linux.go` under [`$GOPATH/src/github.com/containerd/containerd/cmd/containerd`](https://github.com/containerd/containerd/tree/master/cmd/containerd)
+Create `builtins_fuseoverlayfs_linux.go` under [`$GOPATH/src/github.com/containerd/containerd/cmd/containerd/builtins`](https://github.com/containerd/containerd/tree/master/cmd/containerd/builtins)
 with the following content, and recompile the containerd binary:
 
 ```go
@@ -47,7 +45,7 @@ with the following content, and recompile the containerd binary:
 
 package main
 
-import _ "github.com/containerd/fuse-overlayfs-snapshotter/plugin"
+import _ "github.com/containerd/fuse-overlayfs-snapshotter/v2/plugin"
 ```
 
 No extra configuration is needed.

check.go

@@ -1,3 +1,4 @@
+//go:build linux
 // +build linux
 
 /*
@@ -20,20 +21,18 @@ package fuseoverlayfs
 
 import (
 	"fmt"
-	"io/ioutil"
 	"os"
 	"os/exec"
 	"path/filepath"
 
-	"github.com/containerd/containerd/log"
-	"github.com/containerd/containerd/mount"
-	"github.com/pkg/errors"
+	"github.com/containerd/containerd/v2/core/mount"
+	"github.com/containerd/log"
 )
 
 // supportsReadonlyMultipleLowerDir checks if read-only multiple lowerdirs can be mounted with fuse-overlayfs.
 // https://github.com/containers/fuse-overlayfs/pull/133
 func supportsReadonlyMultipleLowerDir(d string) error {
-	td, err := ioutil.TempDir(d, "fuseoverlayfs-check")
+	td, err := os.MkdirTemp(d, "fuseoverlayfs-check")
 	if err != nil {
 		return err
 	}
@@ -57,7 +56,7 @@ func supportsReadonlyMultipleLowerDir(d string) error {
 	}
 	dest := filepath.Join(td, "merged")
 	if err := m.Mount(dest); err != nil {
-		return errors.Wrapf(err, "failed to mount fuse-overlayfs (%+v) on %s", m, dest)
+		return fmt.Errorf("failed to mount fuse-overlayfs (%+v) on %s: %w", m, dest, err)
 	}
 	if err := mount.UnmountAll(dest, 0); err != nil {
 		log.L.WithError(err).Warnf("Failed to unmount check directory %v", dest)
@@ -70,13 +69,13 @@ func supportsReadonlyMultipleLowerDir(d string) error {
 // this snapshotter as a library.
 func Supported(root string) error {
 	if _, err := exec.LookPath(fuseoverlayfsBinary); err != nil {
-		return errors.Wrapf(err, "%s not installed", fuseoverlayfsBinary)
+		return fmt.Errorf("%s not installed: %w", fuseoverlayfsBinary, err)
 	}
 	if err := os.MkdirAll(root, 0700); err != nil {
 		return err
 	}
 	if err := supportsReadonlyMultipleLowerDir(root); err != nil {
-		return errors.Wrap(err, "fuse-overlayfs not functional, make sure running with kernel >= 4.18")
+		return fmt.Errorf("fuse-overlayfs not functional, make sure running with kernel >= 4.18: %w", err)
 	}
 	return nil
 }

cmd/containerd-fuse-overlayfs-grpc/main.go

@@ -22,20 +22,18 @@ import (
 	"os"
 	"path/filepath"
 
-	sddaemon "github.com/coreos/go-systemd/v22/daemon"
-	"github.com/sirupsen/logrus"
-	"google.golang.org/grpc"
-
 	snapshotsapi "github.com/containerd/containerd/api/services/snapshots/v1"
-	"github.com/containerd/containerd/contrib/snapshotservice"
-
-	fuseoverlayfs "github.com/containerd/fuse-overlayfs-snapshotter"
-	"github.com/containerd/fuse-overlayfs-snapshotter/cmd/containerd-fuse-overlayfs-grpc/version"
+	"github.com/containerd/containerd/v2/contrib/snapshotservice"
+	fuseoverlayfs "github.com/containerd/fuse-overlayfs-snapshotter/v2"
+	"github.com/containerd/fuse-overlayfs-snapshotter/v2/cmd/containerd-fuse-overlayfs-grpc/version"
+	"github.com/containerd/log"
+	sddaemon "github.com/coreos/go-systemd/v22/daemon"
+	"google.golang.org/grpc"
 )
 
 // main is from https://github.com/containerd/containerd/blob/b9fad5e310fafb453def5f1e7094f4c36a9806d2/PLUGINS.md
 func main() {
-	logrus.Infof("containerd-fuse-overlayfs-grpc Version=%q Revision=%q", version.Version, version.Revision)
+	log.L.Infof("containerd-fuse-overlayfs-grpc Version=%q Revision=%q", version.Version, version.Revision)
 	// Provide a unix address to listen to, this will be the `address`
 	// in the `proxy_plugin` configuration.
 	// The root will be used to store the snapshots.

fuseoverlayfs.go

@@ -1,3 +1,4 @@
+//go:build linux
 // +build linux
 
 /*
@@ -21,18 +22,16 @@ package fuseoverlayfs
 import (
 	"context"
 	"fmt"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"strings"
 	"syscall"
 
-	"github.com/containerd/containerd/log"
-	"github.com/containerd/containerd/mount"
-	"github.com/containerd/containerd/snapshots"
-	"github.com/containerd/containerd/snapshots/storage"
+	"github.com/containerd/containerd/v2/core/mount"
+	"github.com/containerd/containerd/v2/core/snapshots"
+	"github.com/containerd/containerd/v2/core/snapshots/storage"
 	"github.com/containerd/continuity/fs"
-	"github.com/pkg/errors"
+	"github.com/containerd/log"
 )
 
 const (
@@ -183,10 +182,13 @@ func (o *snapshotter) Mounts(ctx context.Context, key string) ([]mount.Mount, er
 		return nil, err
 	}
 	s, err := storage.GetSnapshot(ctx, key)
+	if err != nil {
+		return nil, err
+	}
 	_, info, _, err := storage.GetInfo(ctx, key)
 	t.Rollback()
 	if err != nil {
-		return nil, errors.Wrap(err, "failed to get active mount")
+		return nil, fmt.Errorf("failed to get active mount: %w", err)
 	}
 	return o.mounts(s, info), nil
 }
@@ -217,7 +219,7 @@ func (o *snapshotter) Commit(ctx context.Context, name, key string, opts ...snap
 	}
 
 	if _, err = storage.CommitActive(ctx, key, name, snapshots.Usage(usage), opts...); err != nil {
-		return errors.Wrap(err, "failed to commit snapshot")
+		return fmt.Errorf("failed to commit snapshot: %w", err)
 	}
 	return t.Commit()
 }
@@ -240,14 +242,14 @@ func (o *snapshotter) Remove(ctx context.Context, key string) (err error) {
 
 	_, _, err = storage.Remove(ctx, key)
 	if err != nil {
-		return errors.Wrap(err, "failed to remove")
+		return fmt.Errorf("failed to remove: %w", err)
 	}
 
 	if !o.asyncRemove {
 		var removals []string
 		removals, err = o.getCleanupDirectories(ctx, t)
 		if err != nil {
-			return errors.Wrap(err, "unable to get directories for removal")
+			return fmt.Errorf("unable to get directories for removal: %w", err)
 		}
 
 		// Remove directories after the transaction is closed, failures must not
@@ -353,7 +355,7 @@ func (o *snapshotter) createSnapshot(ctx context.Context, kind snapshots.Kind, k
 			if path != "" {
 				if err1 := os.RemoveAll(path); err1 != nil {
 					log.G(ctx).WithError(err1).WithField("path", path).Error("failed to reclaim snapshot directory, directory may need removal")
-					err = errors.Wrapf(err, "failed to remove path: %v", err1)
+					err = fmt.Errorf("failed to remove path: %v: %w", err1, err)
 				}
 			}
 		}
@@ -365,7 +367,7 @@ func (o *snapshotter) createSnapshot(ctx context.Context, kind snapshots.Kind, k
 		if rerr := t.Rollback(); rerr != nil {
 			log.G(ctx).WithError(rerr).Warn("failed to rollback transaction")
 		}
-		return nil, errors.Wrap(err, "failed to create prepare snapshot dir")
+		return nil, fmt.Errorf("failed to create prepare snapshot dir: %w", err)
 	}
 	rollback := true
 	defer func() {
@@ -378,13 +380,13 @@ func (o *snapshotter) createSnapshot(ctx context.Context, kind snapshots.Kind, k
 
 	s, err := storage.CreateSnapshot(ctx, kind, key, parent, opts...)
 	if err != nil {
-		return nil, errors.Wrap(err, "failed to create snapshot")
+		return nil, fmt.Errorf("failed to create snapshot: %w", err)
 	}
 
 	if len(s.ParentIDs) > 0 {
 		st, err := os.Stat(o.upperPath(s.ParentIDs[0]))
 		if err != nil {
-			return nil, errors.Wrap(err, "failed to stat parent")
+			return nil, fmt.Errorf("failed to stat parent: %w", err)
 		}
 
 		stat := st.Sys().(*syscall.Stat_t)
@@ -393,13 +395,13 @@ func (o *snapshotter) createSnapshot(ctx context.Context, kind snapshots.Kind, k
 			if rerr := t.Rollback(); rerr != nil {
 				log.G(ctx).WithError(rerr).Warn("failed to rollback transaction")
 			}
-			return nil, errors.Wrap(err, "failed to chown")
+			return nil, fmt.Errorf("failed to chown: %w", err)
 		}
 	}
 
 	path = filepath.Join(snapshotDir, s.ID)
 	if err = os.Rename(td, path); err != nil {
-		return nil, errors.Wrap(err, "failed to rename")
+		return nil, fmt.Errorf("failed to rename: %w", err)
 	}
 	td = ""
 
@@ -407,16 +409,16 @@ func (o *snapshotter) createSnapshot(ctx context.Context, kind snapshots.Kind, k
 
 	rollback = false
 	if err = t.Commit(); err != nil {
-		return nil, errors.Wrap(err, "commit failed")
+		return nil, fmt.Errorf("commit failed: %w", err)
 	}
 
 	return o.mounts(s, info), nil
 }
 
 func (o *snapshotter) prepareDirectory(ctx context.Context, snapshotDir string, kind snapshots.Kind) (string, error) {
-	td, err := ioutil.TempDir(snapshotDir, "new-")
+	td, err := os.MkdirTemp(snapshotDir, "new-")
 	if err != nil {
-		return "", errors.Wrap(err, "failed to create temp dir")
+		return "", fmt.Errorf("failed to create temp dir: %w", err)
 	}
 
 	if err := os.Mkdir(filepath.Join(td, "fs"), 0755); err != nil {
@@ -479,10 +481,10 @@ func (o *snapshotter) mounts(s storage.Snapshot, info snapshots.Info) []mount.Mo
 
 	options = append(options, fmt.Sprintf("lowerdir=%s", strings.Join(parentPaths, ":")))
 	if mapping, ok := info.Labels["containerd.io/snapshot/uidmapping"]; ok {
-		options = append(options, fmt.Sprintf("uidmapping=%s", mapping))
+		options = append(options, fmt.Sprintf("uidmapping=%s", convertIDMappingOption(mapping)))
 	}
 	if mapping, ok := info.Labels["containerd.io/snapshot/gidmapping"]; ok {
-		options = append(options, fmt.Sprintf("gidmapping=%s", mapping))
+		options = append(options, fmt.Sprintf("gidmapping=%s", convertIDMappingOption(mapping)))
 	}
 	return []mount.Mount{
 		{
@@ -506,3 +508,10 @@ func (o *snapshotter) workPath(id string) string {
 func (o *snapshotter) Close() error {
 	return o.ms.Close()
 }
+
+// fuseIDMappingOption converts mapping entries joined with ',' to ':'
+// This is expected by the fuse-overlayfs program:
+// https://github.com/containers/fuse-overlayfs/blob/main/fuse-overlayfs.1.md
+func convertIDMappingOption(label string) string {
+	return strings.ReplaceAll(label, ",", ":")
+}

fuseoverlayfs_test.go

@@ -1,3 +1,4 @@
+//go:build linux
 // +build linux
 
 /*
@@ -21,13 +22,11 @@ package fuseoverlayfs
 import (
 	"context"
 	_ "crypto/sha256"
-	"io/ioutil"
-	"os"
 	"testing"
 
-	"github.com/containerd/containerd/pkg/testutil"
-	"github.com/containerd/containerd/snapshots"
-	"github.com/containerd/containerd/snapshots/testsuite"
+	"github.com/containerd/containerd/v2/core/snapshots"
+	"github.com/containerd/containerd/v2/core/snapshots/testsuite"
+	"github.com/containerd/containerd/v2/pkg/testutil"
 )
 
 func newSnapshotter(ctx context.Context, root string) (snapshots.Snapshotter, func() error, error) {
@@ -41,11 +40,7 @@ func newSnapshotter(ctx context.Context, root string) (snapshots.Snapshotter, fu
 
 func TestFUSEOverlayFS(t *testing.T) {
 	testutil.RequiresRoot(t)
-	td, err := ioutil.TempDir("", "fuseoverlayfs-test")
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer os.RemoveAll(td)
+	td := t.TempDir()
 	if err := Supported(td); err != nil {
 		t.Skipf("fuse-overlayfs not supported: %v", err)
 	}

go.mod

@@ -1,15 +1,45 @@
-module github.com/containerd/fuse-overlayfs-snapshotter
+module github.com/containerd/fuse-overlayfs-snapshotter/v2
 
-go 1.16
+go 1.23.0
 
 require (
-	github.com/containerd/containerd v1.5.2
-	github.com/containerd/continuity v0.1.0
-	github.com/coreos/go-systemd/v22 v22.1.0
-	github.com/pkg/errors v0.9.1
-	github.com/sirupsen/logrus v1.7.0
-	google.golang.org/grpc v1.33.2
+	github.com/containerd/containerd/api v1.9.0
+	github.com/containerd/containerd/v2 v2.1.1
+	github.com/containerd/continuity v0.4.5
+	github.com/containerd/log v0.1.0
+	github.com/containerd/platforms v1.0.0-rc.1
+	github.com/containerd/plugin v1.0.0
+	github.com/coreos/go-systemd/v22 v22.5.0
+	google.golang.org/grpc v1.72.1
 )
 
-// replace grpc to match https://github.com/containerd/containerd/blob/v1.5.2/go.mod
-replace google.golang.org/grpc => google.golang.org/grpc v1.27.1
+require (
+	github.com/Microsoft/go-winio v0.6.2 // indirect
+	github.com/Microsoft/hcsshim v0.13.0 // indirect
+	github.com/containerd/cgroups/v3 v3.0.5 // indirect
+	github.com/containerd/errdefs v1.0.0 // indirect
+	github.com/containerd/errdefs/pkg v0.3.0 // indirect
+	github.com/containerd/ttrpc v1.2.7 // indirect
+	github.com/containerd/typeurl/v2 v2.2.3 // indirect
+	github.com/davecgh/go-spew v1.1.1 // indirect
+	github.com/gogo/protobuf v1.3.2 // indirect
+	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
+	github.com/google/go-cmp v0.7.0 // indirect
+	github.com/moby/sys/mountinfo v0.7.2 // indirect
+	github.com/moby/sys/userns v0.1.0 // indirect
+	github.com/opencontainers/go-digest v1.0.0 // indirect
+	github.com/opencontainers/image-spec v1.1.1 // indirect
+	github.com/pkg/errors v0.9.1 // indirect
+	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
+	github.com/sirupsen/logrus v1.9.3 // indirect
+	github.com/stretchr/testify v1.10.0 // indirect
+	go.etcd.io/bbolt v1.4.0 // indirect
+	go.opencensus.io v0.24.0 // indirect
+	golang.org/x/net v0.38.0 // indirect
+	golang.org/x/sync v0.14.0 // indirect
+	golang.org/x/sys v0.33.0 // indirect
+	golang.org/x/text v0.23.0 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20250218202821-56aae31c358a // indirect
+	google.golang.org/protobuf v1.36.6 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
+)

plugin/plugin.go

@@ -1,3 +1,4 @@
+//go:build linux
 // +build linux
 
 /*
@@ -21,9 +22,11 @@ package fuseoverlayfs
 import (
 	"errors"
 
-	"github.com/containerd/containerd/platforms"
-	"github.com/containerd/containerd/plugin"
-	fuseoverlayfs "github.com/containerd/fuse-overlayfs-snapshotter"
+	"github.com/containerd/containerd/v2/plugins"
+	fuseoverlayfs "github.com/containerd/fuse-overlayfs-snapshotter/v2"
+	"github.com/containerd/platforms"
+	"github.com/containerd/plugin"
+	"github.com/containerd/plugin/registry"
 )
 
 // Config represents configuration for the fuse-overlayfs plugin.
@@ -33,8 +36,8 @@ type Config struct {
 }
 
 func init() {
-	plugin.Register(&plugin.Registration{
-		Type:   plugin.SnapshotPlugin,
+	registry.Register(&plugin.Registration{
+		Type:   plugins.SnapshotPlugin,
 		ID:     "fuse-overlayfs",
 		Config: &Config{},
 		InitFn: func(ic *plugin.InitContext) (interface{}, error) {
@@ -45,7 +48,7 @@ func init() {
 				return nil, errors.New("invalid fuse-overlayfs configuration")
 			}
 
-			root := ic.Root
+			root := ic.Properties[plugins.PropertyRootDir]
 			if config.RootPath != "" {
 				root = config.RootPath
 			}