gVisor w/ containerd v2.x

[milantracy]

Description

integrate gVisor with containerd v2.x

• https://github.com/containerd/containerd/blob/main/docs/containerd-2.0.md#whats-breaking
• https://github.com/containerd/containerd/blob/main/docs/containerd-2.0.md#whats-changing
• https://samuel.karp.dev/blog/2024/11/containerd-2.0-kubecon-na-2024/

would be good to start with, while I don't expect a significant number of changes on gVisor.

Is this feature related to a specific bug?

No response

Do you have a specific solution in mind?

No response

[lorenz]

https://github.com/monogon-dev/monogon/blob/main/third_party/go/patches/gvisor-containerd-compat.patch is what we're using, most things work fine with that.

[milantracy]

Thanks a lot @lorenz

[smira]

I tried adapting @lorenz patch above to latest gvisor code, but still same symptoms - the pods are stuck in terminating phase, runsc* processes are still running siderolabs/extensions#663

[samuelkarp]

It looks like this is a bug in containerd. We've merged a fix in containerd/containerd#11741 and it should be in the next 2.0.x release (2.0.6).

[milantracy]

I tested and verified that gvsior behavior is working pro once the fix is patched.

[lubex96]

Hi colleagues,

Can you please confirm if the fix discussed here will be available in containerd v2.1.0?

Thanks!

[smira]

Please note the change got reverted in containerd 2.1.0: containerd/containerd#11793

[milantracy]

The PR you linked is the new fix, which I have verified that it works

[smira]

The PR you linked is the new fix, which I have verified that it works

We're observing some issues with Talos Linux and gvisor/containerd 2.1.0:

• fix: bring back updated containerd gvisor patch siderolabs/pkgs#1235
• feat: update containerd to 2.1.0 siderolabs/talos#11024

I will update once I know more, but it seems to be a different issue linked to gvsior pod shutdown.

[milantracy]

@smira can you verified that Talos works with https://github.com/containerd/containerd/tree/release/2.0

I am working on containerd/containerd#11828 to cherry pick the change into 2.0.x release, it will be helpful if you can share more on what went wrong on your side

[smira]

I can verify that containerd 2.0 works with the patch from the original PR with gvisor: https://github.com/siderolabs/pkgs/tree/release-1.10/containerd/patches

The restart patch is not relevant here.

[smira]

@milantracy the tests seem to pass now for Talos main with container 2.1.0 and a "hacky" patch from siderolabs/pkgs#1235: https://github.com/siderolabs/talos/actions/runs/15118232352/job/42494829782?pr=11024

I don't have any details (yet), but there's definitely something missing.

[smira]

So I can see that the following process is "left" once the gVisor pod terminated with contianerd 2.1.0:

172.20.0.5  7490  S      9        0.02      1.3 GB   14 MB   system_u:system_r:pod_containerd_t:s0  /usr/local/bin/containerd-shim-runsc-v1 -namespace k8s.io -address /run/containerd/containerd.sock -publish-binary /usr/bin/containerd