Merge tag 'v2.0.1' into release-v2.0

containerd 2.0.1

Welcome to the v2.0.1 release of containerd!

The first patch release for containerd 2.0 includes a number of bug fixes and improvements.

* Fix apply IoOwner options when not in user namespace ([#11151](containerd/containerd#11151))
* Fix cri grpc plugin config migration ([#11140](containerd/containerd#11140))
* Support CNI STATUS Verb ([containerd/go-cni#123](containerd/go-cni#123))

* Update differ to handle zstd media types ([#11068](containerd/containerd#11068))

* Update runc binary to v1.2.3 ([#11142](containerd/containerd#11142))
* Fix panic due to nil dereference cgroups v2 ([#11098](containerd/containerd#11098))

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

* Derek McGowan
* Wei Fu
* Archit Kulkarni
* Jin Dong
* Phil Estes
* Akhil Mohan
* Akihiro Suda
* Alexey Lunev
* Austin Vazquez
* Maksym Pavlenko
* Mike Brown
* Michael Zappa
* Samuel Karp
* Sebastiaan van Stijn
* Andrey Smirnov
* Davanum Srinivas
<details><summary>50 commits</summary>
<p>

* Prepare release notes for v2.0.1 ([#11158](containerd/containerd#11158))
  * [`b0ece5dc5`](containerd/containerd@b0ece5d) Prepare release notes for v2.0.1
* build(deps): bump actions/attest-build-provenance from 1.4.4 to 2.1.0 ([#11154](containerd/containerd#11154))
  * [`fe6957084`](containerd/containerd@fe69570) build(deps): bump actions/attest-build-provenance from 1.4.4 to 2.1.0
* update xx to v1.6.1 for compatibility with alpine 3.21 and file 5.46+ ([#11153](containerd/containerd#11153))
  * [`eb2ce6882`](containerd/containerd@eb2ce68) update xx to v1.6.1 for compatibility with alpine 3.21 and file 5.46+
* ctr pull should unpack for default platform when transfer service is used ([#11139](containerd/containerd#11139))
  * [`44cdca68b`](containerd/containerd@44cdca6) ctr pull unpack for default platform using transfer service
* Fix apply IoOwner options when not in user namespace ([#11151](containerd/containerd#11151))
  * [`018d83650`](containerd/containerd@018d836) internal/cri: should not apply IoOwner options
* Update go-cni for CNI STATUS ([#11146](containerd/containerd#11146))
  * [`5eb7995a9`](containerd/containerd@5eb7995) feat: update go-cni version for CNI STATUS
* Fix cri grpc plugin config migration ([#11140](containerd/containerd#11140))
  * [`a2302ea89`](containerd/containerd@a2302ea) Add integration test for custom configuration
  * [`be5eda069`](containerd/containerd@be5eda0) complete cri grpc config migration
* Update runc binary to v1.2.3 ([#11142](containerd/containerd#11142))
  * [`a53eff53d`](containerd/containerd@a53eff5) update runc binary to v1.2.3
* Update differ to handle zstd media types ([#11068](containerd/containerd#11068))
  * [`73f57acb0`](containerd/containerd@73f57ac) Update differ to handle zstd media types
* update to go1.23.4 / go1.22.10 ([#11109](containerd/containerd#11109))
  * [`290e8bc70`](containerd/containerd@290e8bc) update to go1.23.4 / go1.22.10
* CI: update Fedora to 41 ([#11110](containerd/containerd#11110))
  * [`62b790bfa`](containerd/containerd@62b790b) CI: update Fedora to 41
* Fix panic due to nil dereference cgroups v2 ([#11098](containerd/containerd#11098))
  * [`3ba2df924`](containerd/containerd@3ba2df9) fix panic due to nil dereference cgroups v2
* Publish attestation as release artifact ([#11067](containerd/containerd#11067))
  * [`34a45cab2`](containerd/containerd@34a45ca) Publish attestation as release artifact
* Move rockylinux 9.4 to almalinux/9 in CI ([#11053](containerd/containerd#11053))
  * [`7dec6b460`](containerd/containerd@7dec6b4) move rocky 9.4 to almalinux/9 in CI
* *: should align pipe's owner with init process ([#11035](containerd/containerd#11035))
  * [`cf07f28ee`](containerd/containerd@cf07f28) *: should align pipe's owner with init process
* fix: set the credentials even if not provided ([#11031](containerd/containerd#11031))
  * [`986088866`](containerd/containerd@9860888) fix: set the credentials even if not provided
* fsverity_test.go: fix nil pointer derefence, fix test fail, fix minor/major device numbers resolving ([#10978](containerd/containerd#10978))
  * [`30b929ece`](containerd/containerd@30b929e) fsverity_test.go: fix major/minor device number resolving
  * [`10996a334`](containerd/containerd@10996a3) fsverity_test.go: fix nil pointer dereference, fix test fail
* update runc binary to 1.2.2 ([#11023](containerd/containerd#11023))
  * [`9081e979f`](containerd/containerd@9081e97) update runc binary to 1.2.2
* Revert "Disable vagrant strict dependency checking" ([#11009](containerd/containerd#11009))
  * [`6399c936f`](containerd/containerd@6399c93) Revert "Disable vagrant strict dependency checking"
* fsverity_linux.go: Fix fsverity.IsEnabled() for big endian systems ([#11005](containerd/containerd#11005))
  * [`a7f2b562f`](containerd/containerd@a7f2b56) fsverity_linux.go: Fix fsverity.IsEnabled() for big endian systems
* bump github.com/containerd/typeurl/v2 from 2.2.2 to 2.2.3 ([#10997](containerd/containerd#10997))
  * [`389e781ea`](containerd/containerd@389e781) build(deps): bump github.com/containerd/typeurl/v2 from 2.2.2 to 2.2.3
* update to go1.23.3 / go1.22.9 ([#10973](containerd/containerd#10973))
  * [`5b879f30c`](containerd/containerd@5b879f3) update to go1.23.3 / go1.22.9
* ci: enable marking 2.0 releases as latest ([#10963](containerd/containerd#10963))
  * [`458215f6c`](containerd/containerd@458215f) ci: enable marking 2.0 releases as latest
* Avoid arch info in the sed/replace when building cri-cni-containerd.tar.gz ([#10968](containerd/containerd#10968))
  * [`e99c2b55c`](containerd/containerd@e99c2b5) Avoid arch info in the sed/replace when building cri-cni-containerd.tar.gz
</p>
</details>
<details><summary>7 commits</summary>
<p>

* Support CNI STATUS Verb ([containerd/go-cni#123](containerd/go-cni#123))
  * [`208eca9`](containerd/go-cni@208eca9) support CNI status verb
* Bump github actions dependencies to match containerd CI repo and fix lint ([containerd/go-cni#122](containerd/go-cni#122))
  * [`386f475`](containerd/go-cni@386f475) Fix ci.yml indent
  * [`a9b0675`](containerd/go-cni@a9b0675) Another doc commit to trigger lint?
  * [`14af454`](containerd/go-cni@14af454) Bump github actions dependency versions
  * [`9e0d096`](containerd/go-cni@9e0d096) Trivial doc commit to trigger lint
</p>
</details>

* **github.com/containerd/go-cni**      v1.1.10 -> v1.1.11
* **github.com/containerd/typeurl/v2**  v2.2.2 -> v2.2.3

Previous release can be found at [v2.0.0](https://github.com/containerd/containerd/releases/tag/v2.0.0)
* `containerd-<VERSION>-<OS>-<ARCH>.tar.gz`:         ✅Recommended. Dynamically linked with glibc 2.31 (Ubuntu 20.04).
* `containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz`:  Statically linked. Expected to be used on non-glibc Linux distributions. Not position-independent.

In addition to containerd, typically you will have to install [runc](https://github.com/opencontainers/runc/releases)
and [CNI plugins](https://github.com/containernetworking/plugins/releases) from their official sites too.

See also the [Getting Started](https://github.com/containerd/containerd/blob/main/docs/getting-started.md) documentation.

.devcontainer/devcontainer.json

@@ -12,7 +12,7 @@
 	"features": {
 		"ghcr.io/devcontainers/features/docker-in-docker:2": {},
 		"ghcr.io/devcontainers/features/go:1": {
-			"version": "1.23.2"
+			"version": "1.23.4"
 		}
 	},
 

.github/actions/install-go/action.yml

@@ -3,7 +3,7 @@ description: "Reusable action to install Go, so there is one place to bump Go ve
 inputs:
   go-version:
     required: true
-    default: "1.23.2"
+    default: "1.23.4"
     description: "Go version to install"
 
 runs:

.github/workflows/api-release.yml

@@ -6,7 +6,7 @@ on:
 name: API Release
 
 env:
-  GO_VERSION: "1.23.2"
+  GO_VERSION: "1.23.4"
 
 permissions: # added using https://github.com/step-security/secure-workflows
   contents: read

.github/workflows/ci.yml

@@ -191,7 +191,7 @@ jobs:
     strategy:
       matrix:
         os: [ubuntu-22.04, ubuntu-24.04, arm64-8core-32gb, macos-13, windows-2019, windows-2022]
-        go-version: ["1.22.8", "1.23.2"]
+        go-version: ["1.22.10", "1.23.4"]
         exclude:
           - os: ${{ github.repository != 'containerd/containerd' && 'arm64-8core-32gb' }}
     steps:
@@ -534,16 +534,16 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - box: fedora/40-cloud-base
+          - box: fedora/41-cloud-base
             cgroup_driver: cgroupfs
             runc: runc
-          - box: fedora/40-cloud-base
+          - box: fedora/41-cloud-base
             cgroup_driver: systemd
             runc: runc
-          - box: fedora/40-cloud-base
+          - box: fedora/41-cloud-base
             cgroup_driver: cgroupfs
             runc: crun
-          - box: fedora/40-cloud-base
+          - box: fedora/41-cloud-base
             cgroup_driver: systemd
             runc: crun
             # We have to keep EL8 to test old glibc, cgroup, kernel, etc.
@@ -556,10 +556,10 @@ jobs:
           - box: almalinux/8
             cgroup_driver: systemd
             runc: runc
-          - box: rockylinux/[email protected]
+          - box: almalinux/9
             cgroup_driver: cgroupfs
             runc: runc
-          - box: rockylinux/[email protected]
+          - box: almalinux/9
             cgroup_driver: systemd
             runc: runc
     env:
@@ -587,16 +587,23 @@ jobs:
           echo "deb [signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list
           sudo sed -i 's/^Types: deb$/Types: deb deb-src/' /etc/apt/sources.list.d/ubuntu.sources
           sudo apt-get update
-          # Pinned to 2.4.1-1 until https://github.com/hashicorp/vagrant/pull/13532 in released version
-          sudo apt-get install -y libvirt-daemon libvirt-daemon-system vagrant=2.4.1-1 ovmf
+          sudo apt-get install -y libvirt-daemon libvirt-daemon-system vagrant ovmf
           # https://github.com/vagrant-libvirt/vagrant-libvirt/issues/1725#issuecomment-1454058646
           sudo cp /usr/share/OVMF/OVMF_VARS_4M.fd /var/lib/libvirt/qemu/nvram/
           sudo systemctl enable --now libvirtd
           sudo apt-get build-dep -y ruby-libvirt
           sudo apt-get install -y --no-install-recommends libxslt-dev libxml2-dev libvirt-dev ruby-bundler ruby-dev zlib1g-dev
           sudo vagrant plugin install vagrant-libvirt
       - name: Boot VM
-        run: sudo BOX=$BOX RUNC_FLAVOR=$RUNC_FLAVOR vagrant up --no-tty
+        run: |
+          sudo BOX=$BOX RUNC_FLAVOR=$RUNC_FLAVOR vagrant up --no-tty
+          if  [ "$BOX" = "fedora/41-cloud-base" ]; then
+            # Install the kernel update for Fedora 41 to fix an error "Extension MARK revision 0 not supported, missing kernel module"
+            # https://bugzilla.redhat.com/show_bug.cgi?id=2321325
+            sudo BOX=$BOX RUNC_FLAVOR=$RUNC_FLAVOR vagrant up --provision-with=upgrade-packages
+            sudo BOX=$BOX RUNC_FLAVOR=$RUNC_FLAVOR vagrant halt
+            sudo BOX=$BOX RUNC_FLAVOR=$RUNC_FLAVOR vagrant up
+          fi
       - name: test-integration
         run: sudo BOX=$BOX RUNC_FLAVOR=$RUNC_FLAVOR vagrant up --provision-with=selinux,install-runc,install-gotestsum,test-integration
       - name: test-cri-integration

.github/workflows/release.yml

@@ -13,7 +13,7 @@ on:
 name: Release
 
 env:
-  GO_VERSION: "1.23.2"
+  GO_VERSION: "1.23.4"
 
 permissions: # added using https://github.com/step-security/secure-workflows
   contents: read
@@ -147,6 +147,13 @@ jobs:
         uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
         with:
           path: builds
+      - name: Attest Artifacts
+        id: attest
+        uses: actions/attest-build-provenance@7668571508540a607bdfd90a87a560489fe372eb # v2.1.0
+        with:
+          subject-path: ./builds/release-tars-**/*.tar.gz
+      - name: Rename attestation artifact
+        run: mv ${{ steps.attest.outputs.bundle-path }} containerd-${{ needs.check.outputs.stringver }}-attestation.intoto.jsonl
       - name: Create Release
         uses: softprops/action-gh-release@e7a8f85e1c67a31e6ed99a94b41bd0b71bbee6b8 # v2.0.9
         with:
@@ -158,8 +165,5 @@ jobs:
           body_path: ./builds/containerd-release-notes/release-notes.md
           files: |
             builds/release-tars-**/*
-          make_latest: false
-      - name: Attest Artifacts
-        uses: actions/attest-build-provenance@1c608d11d69870c2092266b3f9a6f3abbf17002c # v1.4.3
-        with:
-          subject-path: ./builds/release-tars-**/*.tar.gz
+            containerd-*-attestation.intoto.jsonl
+          make_latest: true

.github/workflows/release/Dockerfile

@@ -18,7 +18,7 @@ ARG BASE_IMAGE=ubuntu:${UBUNTU_VERSION}
 ARG GO_VERSION
 ARG GO_IMAGE=golang:${GO_VERSION}
 FROM --platform=$BUILDPLATFORM $GO_IMAGE AS go
-FROM --platform=$BUILDPLATFORM tonistiigi/xx:1.2.1@sha256:8879a398dedf0aadaacfbd332b29ff2f84bc39ae6d4e9c0a1109db27ac5ba012 AS xx
+FROM --platform=$BUILDPLATFORM tonistiigi/xx:1.6.1@sha256:923441d7c25f1e2eb5789f82d987693c47b8ed987c4ab3b075d6ed2b5d6779a3 AS xx
 
 FROM --platform=$BUILDPLATFORM ${BASE_IMAGE} AS base
 COPY --from=xx / /

.mailmap

@@ -116,6 +116,7 @@ Mathis Michel <[email protected]>
 Michael Crosby <[email protected]> <[email protected]>
 Michael Katsoulis <[email protected]>
 Michael Zappa <[email protected]> <[email protected]>
+Michael Zappa <[email protected]> <[email protected]>
 Mike Brown <[email protected]> <[email protected]>
 Mohammad Asif Siddiqui <[email protected]>
 Nabeel Rana <[email protected]>

Vagrantfile

@@ -17,7 +17,7 @@
 
 # Vagrantfile for Fedora and EL
 Vagrant.configure("2") do |config|
-  config.vm.box = ENV["BOX"] ? ENV["BOX"].split("@")[0] : "fedora/40-cloud-base"
+  config.vm.box = ENV["BOX"] ? ENV["BOX"].split("@")[0] : "fedora/41-cloud-base"
   # BOX_VERSION is deprecated. Use "BOX=<BOX>@<BOX_VERSION>".
   config.vm.box_version = ENV["BOX_VERSION"] || (ENV["BOX"].split("@")[1] if ENV["BOX"])
 
@@ -107,7 +107,7 @@ EOF
   config.vm.provision "install-golang", type: "shell", run: "once" do |sh|
     sh.upload_path = "/tmp/vagrant-install-golang"
     sh.env = {
-        'GO_VERSION': ENV['GO_VERSION'] || "1.23.2",
+        'GO_VERSION': ENV['GO_VERSION'] || "1.23.4",
     }
     sh.inline = <<~SHELL
         #!/usr/bin/env bash

cmd/containerd-shim-runc-v2/runc/container.go

@@ -146,24 +146,9 @@ func NewContainer(ctx context.Context, platform stdio.Platform, r *task.CreateTa
 	}
 	pid := p.Pid()
 	if pid > 0 {
-		var cg interface{}
-		if cgroups.Mode() == cgroups.Unified {
-			g, err := cgroupsv2.PidGroupPath(pid)
-			if err != nil {
-				log.G(ctx).WithError(err).Errorf("loading cgroup2 for %d", pid)
-				return container, nil
-			}
-			cg, err = cgroupsv2.Load(g)
-			if err != nil {
-				log.G(ctx).WithError(err).Errorf("loading cgroup2 for %d", pid)
-			}
-		} else {
-			cg, err = cgroup1.Load(cgroup1.PidPath(pid))
-			if err != nil {
-				log.G(ctx).WithError(err).Errorf("loading cgroup for %d", pid)
-			}
+		if cg, err := loadProcessCgroup(ctx, pid); err == nil {
+			container.cgroup = cg
 		}
-		container.cgroup = cg
 	}
 	return container, nil
 }
@@ -367,23 +352,9 @@ func (c *Container) Start(ctx context.Context, r *task.StartRequest) (process.Pr
 		return p, err
 	}
 	if c.Cgroup() == nil && p.Pid() > 0 {
-		var cg interface{}
-		if cgroups.Mode() == cgroups.Unified {
-			g, err := cgroupsv2.PidGroupPath(p.Pid())
-			if err != nil {
-				log.G(ctx).WithError(err).Errorf("loading cgroup2 for %d", p.Pid())
-			}
-			cg, err = cgroupsv2.Load(g)
-			if err != nil {
-				log.G(ctx).WithError(err).Errorf("loading cgroup2 for %d", p.Pid())
-			}
-		} else {
-			cg, err = cgroup1.Load(cgroup1.PidPath(p.Pid()))
-			if err != nil {
-				log.G(ctx).WithError(err).Errorf("loading cgroup for %d", p.Pid())
-			}
+		if cg, err := loadProcessCgroup(ctx, p.Pid()); err == nil {
+			c.cgroup = cg
 		}
-		c.cgroup = cg
 	}
 	return p, nil
 }
@@ -512,3 +483,25 @@ func (c *Container) HasPid(pid int) bool {
 	}
 	return false
 }
+
+func loadProcessCgroup(ctx context.Context, pid int) (cg interface{}, err error) {
+	if cgroups.Mode() == cgroups.Unified {
+		g, err := cgroupsv2.PidGroupPath(pid)
+		if err != nil {
+			log.G(ctx).WithError(err).Errorf("loading cgroup2 for %d", pid)
+			return nil, err
+		}
+		cg, err = cgroupsv2.Load(g)
+		if err != nil {
+			log.G(ctx).WithError(err).Errorf("loading cgroup2 for %d", pid)
+			return nil, err
+		}
+	} else {
+		cg, err = cgroup1.Load(cgroup1.PidPath(pid))
+		if err != nil {
+			log.G(ctx).WithError(err).Errorf("loading cgroup for %d", pid)
+			return nil, err
+		}
+	}
+	return cg, nil
+}

cmd/ctr/commands/images/pull.go

@@ -119,19 +119,20 @@ command. As part of this process, we do the following:
 			if err != nil {
 				return err
 			}
-
-			// Set unpack configuration
-			for _, platform := range p {
-				sopts = append(sopts, image.WithUnpack(platform, cliContext.String("snapshotter")))
+			allPlatforms := cliContext.Bool("all-platforms")
+			if len(p) > 0 && allPlatforms {
+				return errors.New("cannot specify both --platform and --all-platforms")
 			}
-			if !cliContext.Bool("all-platforms") {
-				if len(p) == 0 {
-					p = append(p, platforms.DefaultSpec())
-				}
-				sopts = append(sopts, image.WithPlatforms(p...))
+			if len(p) == 0 && !allPlatforms {
+				p = append(p, platforms.DefaultSpec())
 			}
+			// we use an empty `Platform` slice to indicate that we want to pull all platforms
+			sopts = append(sopts, image.WithPlatforms(p...))
 			// TODO: Support unpack for all platforms..?
 			// Pass in a *?
+			for _, platform := range p {
+				sopts = append(sopts, image.WithUnpack(platform, cliContext.String("snapshotter")))
+			}
 
 			if cliContext.Bool("metadata-only") {
 				sopts = append(sopts, image.WithAllMetadata)

contrib/Dockerfile.test

@@ -34,7 +34,7 @@
 #   docker run --privileged --group-add keep-groups -v ./critest_exit_code.txt:/tmp/critest_exit_code.txt containerd-test
 # ------------------------------------------------------------------------------
 
-ARG GOLANG_VERSION=1.23.2
+ARG GOLANG_VERSION=1.23.4
 ARG GOLANG_IMAGE=golang
 
 FROM ${GOLANG_IMAGE}:${GOLANG_VERSION} AS golang

contrib/fuzz/oss_fuzz_build.sh

@@ -43,11 +43,11 @@ go run main.go --target_dir $SRC/containerd/images
 
 apt-get update && apt-get install -y wget
 cd $SRC
-wget --quiet https://go.dev/dl/go1.23.2.linux-amd64.tar.gz
+wget --quiet https://go.dev/dl/go1.23.4.linux-amd64.tar.gz
 
 mkdir temp-go
 rm -rf /root/.go/*
-tar -C temp-go/ -xzf go1.23.2.linux-amd64.tar.gz
+tar -C temp-go/ -xzf go1.23.4.linux-amd64.tar.gz
 mv temp-go/go/* /root/.go/
 cd $SRC/containerd
 

go.mod

@@ -18,7 +18,7 @@ require (
 	github.com/containerd/errdefs v1.0.0
 	github.com/containerd/errdefs/pkg v0.3.0
 	github.com/containerd/fifo v1.1.0
-	github.com/containerd/go-cni v1.1.10
+	github.com/containerd/go-cni v1.1.11
 	github.com/containerd/go-runc v1.1.0
 	github.com/containerd/imgcrypt/v2 v2.0.0-rc.1
 	github.com/containerd/log v0.1.0
@@ -27,7 +27,7 @@ require (
 	github.com/containerd/platforms v1.0.0-rc.0
 	github.com/containerd/plugin v1.0.0
 	github.com/containerd/ttrpc v1.2.6
-	github.com/containerd/typeurl/v2 v2.2.2
+	github.com/containerd/typeurl/v2 v2.2.3
 	github.com/containerd/zfs/v2 v2.0.0-rc.0
 	github.com/containernetworking/cni v1.2.3
 	github.com/containernetworking/plugins v1.5.1

go.sum

@@ -679,8 +679,8 @@ github.com/containerd/errdefs/pkg v0.3.0 h1:9IKJ06FvyNlexW690DXuQNx2KA2cUJXx151X
 github.com/containerd/errdefs/pkg v0.3.0/go.mod h1:NJw6s9HwNuRhnjJhM7pylWwMyAkmCQvQ4GpJHEqRLVk=
 github.com/containerd/fifo v1.1.0 h1:4I2mbh5stb1u6ycIABlBw9zgtlK8viPI9QkQNRQEEmY=
 github.com/containerd/fifo v1.1.0/go.mod h1:bmC4NWMbXlt2EZ0Hc7Fx7QzTFxgPID13eH0Qu+MAb2o=
-github.com/containerd/go-cni v1.1.10 h1:c2U73nld7spSWfiJwSh/8W9DK+/qQwYM2rngIhCyhyg=
-github.com/containerd/go-cni v1.1.10/go.mod h1:/Y/sL8yqYQn1ZG1om1OncJB1W4zN3YmjfP/ShCzG/OY=
+github.com/containerd/go-cni v1.1.11 h1:fWt1K15AmSLsEfa57N+qYw4NeGPiQKYq1pjNGJwV9mc=
+github.com/containerd/go-cni v1.1.11/go.mod h1:/Y/sL8yqYQn1ZG1om1OncJB1W4zN3YmjfP/ShCzG/OY=
 github.com/containerd/go-runc v1.1.0 h1:OX4f+/i2y5sUT7LhmcJH7GYrjjhHa1QI4e8yO0gGleA=
 github.com/containerd/go-runc v1.1.0/go.mod h1:xJv2hFF7GvHtTJd9JqTS2UVxMkULUYw4JN5XAUZqH5U=
 github.com/containerd/imgcrypt/v2 v2.0.0-rc.1 h1:7OMu5otk5Z2GeQs24JBPOmYbTc50+q6jo02qWNJc0p8=
@@ -698,8 +698,8 @@ github.com/containerd/plugin v1.0.0/go.mod h1:hQfJe5nmWfImiqT1q8Si3jLv3ynMUIBB47
 github.com/containerd/ttrpc v1.2.2/go.mod h1:sIT6l32Ph/H9cvnJsfXM5drIVzTr5A2flTf1G5tYZak=
 github.com/containerd/ttrpc v1.2.6 h1:zG+Kn5EZ6MUYCS1t2Hmt2J4tMVaLSFEJVOraDQwNPC4=
 github.com/containerd/ttrpc v1.2.6/go.mod h1:YCXHsb32f+Sq5/72xHubdiJRQY9inL4a4ZQrAbN1q9o=
-github.com/containerd/typeurl/v2 v2.2.2 h1:3jN/k2ysKuPCsln5Qv8bzR9cxal8XjkxPogJfSNO31k=
-github.com/containerd/typeurl/v2 v2.2.2/go.mod h1:95ljDnPfD3bAbDJRugOiShd/DlAAsxGtUBhJxIn7SCk=
+github.com/containerd/typeurl/v2 v2.2.3 h1:yNA/94zxWdvYACdYO8zofhrTVuQY73fFU1y++dYSw40=
+github.com/containerd/typeurl/v2 v2.2.3/go.mod h1:95ljDnPfD3bAbDJRugOiShd/DlAAsxGtUBhJxIn7SCk=
 github.com/containerd/zfs/v2 v2.0.0-rc.0 h1:0dRlgpoaepW7HuovtcvYQMF7NlpceQVdn7+3Udeth4M=
 github.com/containerd/zfs/v2 v2.0.0-rc.0/go.mod h1:g36g/XCEGDRxUXIFdM3oWAEvmTvhfz/eKWElqg4Secw=
 github.com/containernetworking/cni v1.2.3 h1:hhOcjNVUQTnzdRJ6alC5XF+wd9mfGIUaj8FuJbEslXM=

integration/client/migration_test.go

@@ -18,9 +18,11 @@ package client
 
 import (
 	"bytes"
+	"fmt"
 	"os"
 	"os/exec"
 	"path/filepath"
+	"regexp"
 	"runtime"
 	"strings"
 	"testing"
@@ -62,6 +64,17 @@ func TestMigration(t *testing.T) {
 				File:     "testdata/default-1.7.toml",
 				Migrated: defaultContent,
 			},
+			{
+				Name: "1.7-Custom",
+				File: "testdata/custom-1.7.toml",
+				Migrated: replaceAllValues(defaultContent, map[string]string{
+					"sandbox":               "'custom.io/pause:3.10'",
+					"stream_idle_timeout":   "'2h0m0s'",
+					"stream_server_address": "'127.0.1.1'",
+					"stream_server_port":    "'15000'",
+					"enable_tls_streaming":  "true",
+				}),
+			},
 		}...)
 	}
 
@@ -74,7 +87,7 @@ func TestMigration(t *testing.T) {
 			cmd.Stderr = os.Stderr
 			require.NoError(t, cmd.Run())
 			actual := buf.String()
-			assert.Equal(t, tc.Migrated, actual)
+			assert.Equal(t, tc.Migrated, actual, "Actual (full)\n%s", tc.Migrated, actual)
 		})
 	}
 
@@ -90,3 +103,15 @@ func currentDefaultConfig() (string, error) {
 	}
 	return buf.String(), nil
 }
+
+func replaceAllValues(src string, values map[string]string) string {
+	for k, v := range values {
+		src = replaceValue(src, k, v)
+	}
+	return src
+}
+
+func replaceValue(src, key, value string) string {
+	re := regexp.MustCompile(fmt.Sprintf(`(\s*)%s = [^\n]*`, key))
+	return re.ReplaceAllString(src, fmt.Sprintf(`${1}%s = %s`, key, value))
+}