A shim that performs some mount types or transformations itself, so that
containerd's mount manager does not perform them on its behalf, had no
way to say so other than a comma separated string in the generic
annotations map of its RuntimeInfo.
Add a containerd.types.MountCapabilities extension a shim can attach to
its BootstrapResult, naming the mount types and transforms it handles.
Detail lives in an extension rather than fields of BootstrapResult so
that containerd can ignore an extension whose type it does not
recognize, letting a shim advertise unconditionally.
Presence of the extension is enough: it is not gated behind a
Capability enum value, since with no other consumer of that field an
enum value here would only ever duplicate what the extension's
presence already says, while still permitting states with no single
correct interpretation, such as the enum value being set with no
extension attached, or the reverse.
This is additive: only a new field is added to BootstrapResult, and
buf breaking is clean.
Signed-off-by: Derek McGowan <derek@mcg.dev>
Send the socket directory from containerd to the shim. The shim still
decides where the socket goes but can use the environment variable
passed from containerd to ensure the socket is placed in the configured
directory with proper permission.
This is needed for some rootless cases which do not have permission to
the default state directory as currently set. The directory being
hardcoded by the shim means it is currently not possible to change the
location the shim will listen at.
Signed-off-by: Derek McGowan <derek@mcg.dev>
Avoid using logrus concepts in the API, use slog style log levels with
integer values and 0 meaning the default "info" level.
Signed-off-by: Derek McGowan <derek@mcg.dev>
Revert changes related to reading annotations in runc v2 shim,
because this requires a special path for runc shim. This complicates
migration to the new bootstrap API.
Signed-off-by: Maksym Pavlenko <pavlenko.maksym@gmail.com>
buf will generate the protobuf text file which can be used for viewing
all protobuf changes in one file and quickly diffing changes.
Signed-off-by: Derek McGowan <derek@mcg.dev>
Silence a govulncheck noise:
```
Vulnerability #1: GO-2025-3595
Incorrect Neutralization of Input During Web Page Generation in x/net in
golang.org/x/net
More info: https://pkg.go.dev/vuln/GO-2025-3595
Module: golang.org/x/net
Found in: golang.org/x/net@v0.37.0
Fixed in: golang.org/x/net@v0.38.0
Your code is affected by 0 vulnerabilities.
This scan also found 0 vulnerabilities in packages you import and 1
vulnerability in modules you require, but your code doesn't appear to call these
vulnerabilities.
```
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
Derek McGowan