Merge pull request #138 from containerd/dependabot/go_modules/github.com/containerd/containerd/v2-2.1.1

Bump github.com/containerd/containerd/v2 from 2.1.0 to 2.1.1

.github/dependabot.yml

@@ -0,0 +1,11 @@
+version: 2
+updates:
+  - package-ecosystem: "gomod"
+    directory: "/"
+    schedule:
+      interval: "daily"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "daily"

.github/workflows/main.yml

@@ -11,36 +11,54 @@ jobs:
     runs-on: ubuntu-22.04
     timeout-minutes: 20
     steps:
-    - uses: actions/setup-go@v4
+    - uses: actions/setup-go@v5
       with:
-        go-version: 1.20.x
-    - uses: actions/checkout@v3
+        go-version: 1.24.x
+    - uses: actions/checkout@v4
       with:
         path: src/github.com/containerd/fuse-overlayfs-snapshotter
         fetch-depth: 25
-    - uses: containerd/project-checks@v1.1.0
+    - uses: containerd/project-checks@v1.2.2
       with:
         working-directory: src/github.com/containerd/fuse-overlayfs-snapshotter
 
+  linters:
+    name: Linters
+    permissions:
+      contents: read # for actions/checkout to fetch code
+      pull-requests: read # for golangci/golangci-lint-action to fetch pull requests
+    runs-on: ubuntu-22.04
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          path: src/github.com/containerd/fuse-overlayfs-snapshotter
+      - uses: actions/setup-go@v5
+        with:
+          go-version: 1.24.x
+      - uses: golangci/golangci-lint-action@v8
+        with:
+          working-directory: src/github.com/containerd/fuse-overlayfs-snapshotter
+
   test:
     runs-on: ubuntu-22.04
     timeout-minutes: 30
     strategy:
       fail-fast: false
       matrix:
-        fuse-overlayfs: [v1.0.0, v1.11, main]
+        fuse-overlayfs: [v1.0.0, v1.13, main]
     env:
       FUSEOVERLAYFS_COMMIT: "${{ matrix.fuse-overlayfs }}"
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
     - run: make test
 
   cross:
     runs-on: ubuntu-22.04
     timeout-minutes: 30
     steps:
-    - uses: actions/setup-go@v4
+    - uses: actions/setup-go@v5
       with:
-        go-version: 1.20.x
-    - uses: actions/checkout@v3
+        go-version: 1.24.x
+    - uses: actions/checkout@v4
     - run: make artifacts

.github/workflows/release.yml

@@ -10,11 +10,17 @@ jobs:
   release:
     runs-on: ubuntu-22.04
     timeout-minutes: 20
+    # The maximum access is "read" for PRs from public forked repos
+    # https://docs.github.com/en/actions/security-guides/automatic-token-authentication#permissions-for-the-github_token
+    permissions:
+      contents: write  # for releases
+      id-token: write  # for provenances
+      attestations: write  # for provenances
     steps:
-    - uses: actions/setup-go@v4
+    - uses: actions/setup-go@v5
       with:
-        go-version: 1.20.x
-    - uses: actions/checkout@v3
+        go-version: 1.24.x
+    - uses: actions/checkout@v4
       with:
         path: go/src/github.com/containerd/fuse-overlayfs-snapshotter
     - name: "Compile binaries"
@@ -31,11 +37,8 @@ jobs:
     - name: "Prepare the release note"
       working-directory:  go/src/github.com/containerd/fuse-overlayfs-snapshotter
       run: |
-        tag="${GITHUB_REF##*/}"
         shasha=$(sha256sum _output/SHA256SUMS | awk '{print $1}')
         cat <<-EOF | tee /tmp/release-note.txt
-        ${tag}
-
         (To be documented)
         - - -
         The binaries were built automatically on GitHub Actions.
@@ -43,12 +46,13 @@ jobs:
 
         The sha256sum of the SHA256SUMS file itself is \`${shasha}\` .
         EOF
+    - uses: actions/attest-build-provenance@v2
+      with:
+        subject-path: go/src/github.com/containerd/fuse-overlayfs-snapshotter/_output/*
     - name: "Create release"
       working-directory:  go/src/github.com/containerd/fuse-overlayfs-snapshotter
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       run: |
         tag="${GITHUB_REF##*/}"
-        asset_flags=()
-        for f in _output/*; do asset_flags+=("-a" "$f"); done
-        hub release create "${asset_flags[@]}" -F /tmp/release-note.txt --draft "${tag}"
+        gh release create -F /tmp/release-note.txt --draft --title "${tag}" "${tag}" _output/*

.golangci.yml

@@ -0,0 +1,39 @@
+version: "2"
+linters:
+  enable:
+    - copyloopvar
+    - depguard
+    - gosec
+    - misspell
+    - nolintlint
+    - unconvert
+  disable:
+    - errcheck
+    - revive
+  settings:
+    depguard:
+      rules:
+        main:
+          deny:
+            - pkg: io/ioutil
+              desc: use "io" or "os" instead
+  exclusions:
+    generated: lax
+    presets:
+      - comments
+      - common-false-positives
+      - legacy
+      - std-error-handling
+    paths:
+      - third_party$
+      - builtin$
+      - examples$
+formatters:
+  enable:
+    - gofmt
+  exclusions:
+    generated: lax
+    paths:
+      - third_party$
+      - builtin$
+      - examples$

Dockerfile

@@ -15,7 +15,7 @@
 ARG FUSEOVERLAYFS_COMMIT=main
 ARG ROOTLESSKIT_COMMIT=v1.1.0
 
-ARG GO_VERSION=1.20
+ARG GO_VERSION=1.24
 ARG DEBIAN_VERSION=11
 ARG ALPINE_VERSION=3.18
 
@@ -24,6 +24,7 @@ COPY . /go/src/github.com/containerd/fuse-overlayfs-snapshotter
 WORKDIR  /go/src/github.com/containerd/fuse-overlayfs-snapshotter
 ENV CGO_ENABLED=0
 ENV GO111MODULE=on
+RUN go build ./...
 RUN mkdir /out && go test -c -o /out/containerd-fuse-overlayfs.test
 
 # from https://github.com/containers/fuse-overlayfs/blob/53c17dab78b43de1cd121bf9260b20b76371bbaf/Dockerfile.static.ubuntu

Makefile

@@ -31,8 +31,8 @@ VERSION ?= $(shell $(GIT) describe --match 'v[0-9]*' --dirty='.m' --always --tag
 VERSION_TRIMMED := $(VERSION:v%=%)
 REVISION ?= $(shell $(GIT) rev-parse HEAD)$(shell if ! $(GIT) diff --no-ext-diff --quiet --exit-code; then $(ECHO) .m; fi)
 
-PKG_MAIN := github.com/containerd/fuse-overlayfs-snapshotter/cmd/$(TARGET_BIN)
-PKG_VERSION := github.com/containerd/fuse-overlayfs-snapshotter/cmd/$(TARGET_BIN)/version
+PKG_MAIN := github.com/containerd/fuse-overlayfs-snapshotter/v2/cmd/$(TARGET_BIN)
+PKG_VERSION := github.com/containerd/fuse-overlayfs-snapshotter/v2/cmd/$(TARGET_BIN)/version
 
 export GO_BUILD=GO111MODULE=on CGO_ENABLED=0 $(GO) build -ldflags "-s -w -X $(PKG_VERSION).Version=$(VERSION) -X $(PKG_VERSION).Revision=$(REVISION)"
 

README.md

@@ -23,7 +23,7 @@ Choose 1 if you don't mind recompiling containerd, otherwise choose 2.
 
 ### Option 1: Embed `fuse-overlayfs` plugin into the containerd binary
 
-Create `builtins_fuseoverlayfs_linux.go` under [`$GOPATH/src/github.com/containerd/containerd/cmd/containerd`](https://github.com/containerd/containerd/tree/master/cmd/containerd)
+Create `builtins_fuseoverlayfs_linux.go` under [`$GOPATH/src/github.com/containerd/containerd/cmd/containerd/builtins`](https://github.com/containerd/containerd/tree/master/cmd/containerd/builtins)
 with the following content, and recompile the containerd binary:
 
 ```go
@@ -45,7 +45,7 @@ with the following content, and recompile the containerd binary:
 
 package main
 
-import _ "github.com/containerd/fuse-overlayfs-snapshotter/plugin"
+import _ "github.com/containerd/fuse-overlayfs-snapshotter/v2/plugin"
 ```
 
 No extra configuration is needed.

check.go

@@ -21,19 +21,18 @@ package fuseoverlayfs
 
 import (
 	"fmt"
-	"io/ioutil"
 	"os"
 	"os/exec"
 	"path/filepath"
 
-	"github.com/containerd/containerd/log"
-	"github.com/containerd/containerd/mount"
+	"github.com/containerd/containerd/v2/core/mount"
+	"github.com/containerd/log"
 )
 
 // supportsReadonlyMultipleLowerDir checks if read-only multiple lowerdirs can be mounted with fuse-overlayfs.
 // https://github.com/containers/fuse-overlayfs/pull/133
 func supportsReadonlyMultipleLowerDir(d string) error {
-	td, err := ioutil.TempDir(d, "fuseoverlayfs-check")
+	td, err := os.MkdirTemp(d, "fuseoverlayfs-check")
 	if err != nil {
 		return err
 	}

cmd/containerd-fuse-overlayfs-grpc/main.go

@@ -22,20 +22,18 @@ import (
 	"os"
 	"path/filepath"
 
-	sddaemon "github.com/coreos/go-systemd/v22/daemon"
-	"github.com/sirupsen/logrus"
-	"google.golang.org/grpc"
-
 	snapshotsapi "github.com/containerd/containerd/api/services/snapshots/v1"
-	"github.com/containerd/containerd/contrib/snapshotservice"
-
-	fuseoverlayfs "github.com/containerd/fuse-overlayfs-snapshotter"
-	"github.com/containerd/fuse-overlayfs-snapshotter/cmd/containerd-fuse-overlayfs-grpc/version"
+	"github.com/containerd/containerd/v2/contrib/snapshotservice"
+	fuseoverlayfs "github.com/containerd/fuse-overlayfs-snapshotter/v2"
+	"github.com/containerd/fuse-overlayfs-snapshotter/v2/cmd/containerd-fuse-overlayfs-grpc/version"
+	"github.com/containerd/log"
+	sddaemon "github.com/coreos/go-systemd/v22/daemon"
+	"google.golang.org/grpc"
 )
 
 // main is from https://github.com/containerd/containerd/blob/b9fad5e310fafb453def5f1e7094f4c36a9806d2/PLUGINS.md
 func main() {
-	logrus.Infof("containerd-fuse-overlayfs-grpc Version=%q Revision=%q", version.Version, version.Revision)
+	log.L.Infof("containerd-fuse-overlayfs-grpc Version=%q Revision=%q", version.Version, version.Revision)
 	// Provide a unix address to listen to, this will be the `address`
 	// in the `proxy_plugin` configuration.
 	// The root will be used to store the snapshots.

fuseoverlayfs.go

@@ -22,17 +22,16 @@ package fuseoverlayfs
 import (
 	"context"
 	"fmt"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"strings"
 	"syscall"
 
-	"github.com/containerd/containerd/log"
-	"github.com/containerd/containerd/mount"
-	"github.com/containerd/containerd/snapshots"
-	"github.com/containerd/containerd/snapshots/storage"
+	"github.com/containerd/containerd/v2/core/mount"
+	"github.com/containerd/containerd/v2/core/snapshots"
+	"github.com/containerd/containerd/v2/core/snapshots/storage"
 	"github.com/containerd/continuity/fs"
+	"github.com/containerd/log"
 )
 
 const (
@@ -183,6 +182,9 @@ func (o *snapshotter) Mounts(ctx context.Context, key string) ([]mount.Mount, er
 		return nil, err
 	}
 	s, err := storage.GetSnapshot(ctx, key)
+	if err != nil {
+		return nil, err
+	}
 	_, info, _, err := storage.GetInfo(ctx, key)
 	t.Rollback()
 	if err != nil {
@@ -414,7 +416,7 @@ func (o *snapshotter) createSnapshot(ctx context.Context, kind snapshots.Kind, k
 }
 
 func (o *snapshotter) prepareDirectory(ctx context.Context, snapshotDir string, kind snapshots.Kind) (string, error) {
-	td, err := ioutil.TempDir(snapshotDir, "new-")
+	td, err := os.MkdirTemp(snapshotDir, "new-")
 	if err != nil {
 		return "", fmt.Errorf("failed to create temp dir: %w", err)
 	}
@@ -479,10 +481,10 @@ func (o *snapshotter) mounts(s storage.Snapshot, info snapshots.Info) []mount.Mo
 
 	options = append(options, fmt.Sprintf("lowerdir=%s", strings.Join(parentPaths, ":")))
 	if mapping, ok := info.Labels["containerd.io/snapshot/uidmapping"]; ok {
-		options = append(options, fmt.Sprintf("uidmapping=%s", mapping))
+		options = append(options, fmt.Sprintf("uidmapping=%s", convertIDMappingOption(mapping)))
 	}
 	if mapping, ok := info.Labels["containerd.io/snapshot/gidmapping"]; ok {
-		options = append(options, fmt.Sprintf("gidmapping=%s", mapping))
+		options = append(options, fmt.Sprintf("gidmapping=%s", convertIDMappingOption(mapping)))
 	}
 	return []mount.Mount{
 		{
@@ -506,3 +508,10 @@ func (o *snapshotter) workPath(id string) string {
 func (o *snapshotter) Close() error {
 	return o.ms.Close()
 }
+
+// fuseIDMappingOption converts mapping entries joined with ',' to ':'
+// This is expected by the fuse-overlayfs program:
+// https://github.com/containers/fuse-overlayfs/blob/main/fuse-overlayfs.1.md
+func convertIDMappingOption(label string) string {
+	return strings.ReplaceAll(label, ",", ":")
+}

fuseoverlayfs_test.go

@@ -22,13 +22,11 @@ package fuseoverlayfs
 import (
 	"context"
 	_ "crypto/sha256"
-	"io/ioutil"
-	"os"
 	"testing"
 
-	"github.com/containerd/containerd/pkg/testutil"
-	"github.com/containerd/containerd/snapshots"
-	"github.com/containerd/containerd/snapshots/testsuite"
+	"github.com/containerd/containerd/v2/core/snapshots"
+	"github.com/containerd/containerd/v2/core/snapshots/testsuite"
+	"github.com/containerd/containerd/v2/pkg/testutil"
 )
 
 func newSnapshotter(ctx context.Context, root string) (snapshots.Snapshotter, func() error, error) {
@@ -42,11 +40,7 @@ func newSnapshotter(ctx context.Context, root string) (snapshots.Snapshotter, fu
 
 func TestFUSEOverlayFS(t *testing.T) {
 	testutil.RequiresRoot(t)
-	td, err := ioutil.TempDir("", "fuseoverlayfs-test")
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer os.RemoveAll(td)
+	td := t.TempDir()
 	if err := Supported(td); err != nil {
 		t.Skipf("fuse-overlayfs not supported: %v", err)
 	}

go.mod

@@ -1,43 +1,45 @@
-module github.com/containerd/fuse-overlayfs-snapshotter
+module github.com/containerd/fuse-overlayfs-snapshotter/v2
 
-go 1.19
-
-// The test suite from containerd v1.7.x is not compatible with fuse-overlayfs:
-// https://github.com/containerd/fuse-overlayfs-snapshotter/pull/53#issuecomment-1543442048
-// Expected to be fixed in v1.7.2 (https://github.com/containerd/containerd/pull/8507)
+go 1.23.0
 
 require (
-	github.com/containerd/containerd v1.6.21
-	github.com/containerd/continuity v0.3.0
+	github.com/containerd/containerd/api v1.9.0
+	github.com/containerd/containerd/v2 v2.1.1
+	github.com/containerd/continuity v0.4.5
+	github.com/containerd/log v0.1.0
+	github.com/containerd/platforms v1.0.0-rc.1
+	github.com/containerd/plugin v1.0.0
 	github.com/coreos/go-systemd/v22 v22.5.0
-	github.com/sirupsen/logrus v1.9.0
-	google.golang.org/grpc v1.55.0
+	google.golang.org/grpc v1.72.1
 )
 
 require (
-	github.com/Microsoft/go-winio v0.6.1 // indirect
-	github.com/Microsoft/hcsshim v0.9.9 // indirect
-	github.com/containerd/cgroups v1.1.0 // indirect
-	github.com/containerd/ttrpc v1.2.2 // indirect
-	github.com/containerd/typeurl v1.0.2 // indirect
-	github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c // indirect
+	github.com/Microsoft/go-winio v0.6.2 // indirect
+	github.com/Microsoft/hcsshim v0.13.0 // indirect
+	github.com/containerd/cgroups/v3 v3.0.5 // indirect
+	github.com/containerd/errdefs v1.0.0 // indirect
+	github.com/containerd/errdefs/pkg v0.3.0 // indirect
+	github.com/containerd/ttrpc v1.2.7 // indirect
+	github.com/containerd/typeurl/v2 v2.2.3 // indirect
+	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
-	github.com/golang/protobuf v1.5.3 // indirect
-	github.com/google/go-cmp v0.5.9 // indirect
-	github.com/moby/sys/mountinfo v0.6.2 // indirect
+	github.com/google/go-cmp v0.7.0 // indirect
+	github.com/moby/sys/mountinfo v0.7.2 // indirect
+	github.com/moby/sys/userns v0.1.0 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
-	github.com/opencontainers/image-spec v1.1.0-rc3 // indirect
+	github.com/opencontainers/image-spec v1.1.1 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
-	go.etcd.io/bbolt v1.3.7 // indirect
+	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
+	github.com/sirupsen/logrus v1.9.3 // indirect
+	github.com/stretchr/testify v1.10.0 // indirect
+	go.etcd.io/bbolt v1.4.0 // indirect
 	go.opencensus.io v0.24.0 // indirect
-	golang.org/x/mod v0.10.0 // indirect
-	golang.org/x/net v0.10.0 // indirect
-	golang.org/x/sync v0.2.0 // indirect
-	golang.org/x/sys v0.8.0 // indirect
-	golang.org/x/text v0.9.0 // indirect
-	golang.org/x/tools v0.9.1 // indirect
-	google.golang.org/genproto v0.0.0-20230410155749-daa745c078e1 // indirect
-	google.golang.org/protobuf v1.30.0 // indirect
-	gotest.tools/v3 v3.4.0 // indirect
+	golang.org/x/net v0.38.0 // indirect
+	golang.org/x/sync v0.14.0 // indirect
+	golang.org/x/sys v0.33.0 // indirect
+	golang.org/x/text v0.23.0 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20250218202821-56aae31c358a // indirect
+	google.golang.org/protobuf v1.36.6 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
 )

plugin/plugin.go

@@ -22,9 +22,11 @@ package fuseoverlayfs
 import (
 	"errors"
 
-	"github.com/containerd/containerd/platforms"
-	"github.com/containerd/containerd/plugin"
-	fuseoverlayfs "github.com/containerd/fuse-overlayfs-snapshotter"
+	"github.com/containerd/containerd/v2/plugins"
+	fuseoverlayfs "github.com/containerd/fuse-overlayfs-snapshotter/v2"
+	"github.com/containerd/platforms"
+	"github.com/containerd/plugin"
+	"github.com/containerd/plugin/registry"
 )
 
 // Config represents configuration for the fuse-overlayfs plugin.
@@ -34,8 +36,8 @@ type Config struct {
 }
 
 func init() {
-	plugin.Register(&plugin.Registration{
-		Type:   plugin.SnapshotPlugin,
+	registry.Register(&plugin.Registration{
+		Type:   plugins.SnapshotPlugin,
 		ID:     "fuse-overlayfs",
 		Config: &Config{},
 		InitFn: func(ic *plugin.InitContext) (interface{}, error) {
@@ -46,7 +48,7 @@ func init() {
 				return nil, errors.New("invalid fuse-overlayfs configuration")
 			}
 
-			root := ic.Root
+			root := ic.Properties[plugins.PropertyRootDir]
 			if config.RootPath != "" {
 				root = config.RootPath
 			}