8000 [release/1.6] Update go-restful to v3.10.1 by mmerkes · Pull Request #8412 · containerd/containerd · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

[release/1.6] Update go-restful to v3.10.1 #8412

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 1 commit into from
Jul 21, 2023
Merged

[release/1.6] Update go-restful to v3.10.1 #8412

merged 1 commit into from
Jul 21, 2023

Conversation

mmerkes
Copy link
@mmerkes mmerkes commented Apr 18, 2023 •
edited
Loading

I cherry-picked #8221 and ran go mod tidy and go mod vendor like #8271. Silences a false alert about CVE-2022-1996. containerd is not affected by this CVE.

Resolves #8168

@k8s-ci-robot
Copy link

Hi @mmerkes. Thanks for your PR.

I'm waiting for a containerd member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@mmerkes mmerkes force-pushed the restful branch 2 times, most recently from df80c0c to 9a68d75 Compare April 18, 2023 16:31
@mmerkes mmerkes changed the title Cherry-pick #8221 and update go-restful to v3.10.2 Cherry-picks #8221 and update go-restful to v3.10.2 Apr 18, 2023
@mmerkes mmerkes changed the title Cherry-picks #8221 and update go-restful to v3.10.2 Cherry-pick #8221 and update go-restful to v3.10.2 Apr 18, 2023
@mmerkes mmerkes changed the title Cherry-pick #8221 and update go-restful to v3.10.2 [WIP] Update go-restful to v3.10.1 Apr 18, 2023
@mmerkes mmerkes force-pushed the restful branch 3 times, most recently from 42f6aa4 to b7dd8d7 Compare April 18, 2023 23:48
@AkihiroSuda @mmerkes
go.mod: github.com/emicklei/go-restful/v3 v3.10.1
a322077 
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
@AkihiroSuda
Copy link
Member
AkihiroSuda commented Apr 19, 2023 •
edited
Loading

Addresses CVE-2022-1996.

This is misleading information.

The affected component (CrossOriginResourceSharing, emicklei/go-restful@fd3c327) is not used in containerd. So, containerd isn't affected by this CVE.

@matrey
Copy link
matrey commented Apr 19, 2023

To clarify, as added to #8168, bumping the version of go-restful would make scanning tools used for compliance (Prisma Cloud in my case) happy. Currently they see a go-restful v3.7.3 inside containerd and shout "CVE!".

@thaJeztah
Copy link
Member

To clarify, as added to #8168, bumping the version of go-restful would make scanning tools used for compliance (Prisma Cloud in my case) happy. Currently they see a go-restful v3.7.3 inside containerd and shout "CVE!".

Yes, those are problematic; we must be careful though; if such changes are only to satisfy the scanners, but the diff brings in changes in other areas that are used, then the risk of bringing in those changes could be higher than the risk of a false positive from a scanner. So it's important to review the actual changes brought in, and outweigh the pros/cons

@mmerkes
Copy link
Author
mmerkes commented Apr 19, 2023

@thaJeztah @matrey @AkihiroSuda All good points. Do we have a clear preference here between satisfying our scanner overlords or minimizing unnecessary changes? Given that we've already brought the changes into main, I assume some risk analysis has already been done. If we pass on cherry-picking this commit, we should close #8168.

On a side node, I saw a couple of different CI/Vagrant failures in different test runs. Is there any known flakiness with those tests, and is there any documentation on running these tests independently for debugging?

@samuelkarp
Copy link
Member

You should report a bug to your scanning tool vendor. The govulncheck tool can be used to verify whether a given binary invokes code affected by a vulnerability. https://pkg.go.dev/vuln/GO-2022-0619 is the relevant Go vulnerability report and is not detected by govulncheck.

Do we have a clear preference here between satisfying our scanner overlords or minimizing unnecessary changes?

My general preference would be to avoid introducing unnecessary changes just to satisfy a (buggy) scanner. If there are other reasons to update (bug fixes, performance fixes) that could be a good reason to update independently of the scanner issue.

Given that we've already brought the changes into main, I assume some risk analysis has already been done

We're a bit more conservative over changes that make their way into our stable branches (release/1.6 and release/1.7). 1.6 is an LTS release, so dependency updates are in-scope, but I'd prefer to have a reason to do it (i.e., it improves containerd 1.6).

@mmerkes
Copy link
Author
mmerkes commented Apr 21, 2023

@samuelkarp That all makes sense. Thanks for response. I'll close this PR.

@mmerkes mmerkes closed this Apr 21, 2023
@AkihiroSuda
Copy link
Member
AkihiroSuda commented Apr 21, 2023 •
edited
Loading

I think this PR can be safely reopened.
Just Addresses [CVE-2022-1996](https://github.com/advisories/GHSA-r48q-9g5r-8q2h) should be reworded.

@AkihiroSuda AkihiroSuda reopened this Apr 21, 2023
@mmerkes
Copy link
Author
mmerkes commented Apr 21, 2023

@AkihiroSuda Tx for looking. What's your recommendation on the rewording and why you want to revive this PR?

@AkihiroSuda
Copy link
Member

What's your recommendation on the rewording

"Silences a false alert about CVE-2022-1996. containerd is not affected by this CVE."

and why you want to revive this PR?

Because the update seems harmless.
Still needs to be reviewed carefully, though.

@mmerkes mmerkes changed the title [WIP] Update go-restful to v3.10.1 Update go-restful to v3.10.1 Apr 21, 2023
@mmerkes mmerkes changed the title Update go-restful to v3.10.1 Update go-restful to v3.10.1 in release/1.6 8000 Apr 21, 2023
mikebrow
mikebrow reviewed Apr 24, 2023
View reviewed changes
Copy link
Member
@mikebrow mikebrow left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks like v3.9 aligns with k8s and clears the < 3.8 cve hurdle
https://github.com/kubernetes/kubernetes/blob/master/vendor/modules.txt#L192

estesp
estesp approved these changes Apr 24, 2023
View reviewed changes
Copy link
Member
@estesp estesp left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this is reasonable as we have already updated it and it silences CVE alerts that many have reported/noticed in containerd, and why we already updated main

mikebrow
mikebrow reviewed Apr 25, 2023
View reviewed changes
Copy link
Member
@mikebrow mikebrow left a comment •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

3.10.2 includes a revert for changes made in 3.10.1, specifically introduces MergePathStrategy to be able to revert behaviour of path concatenation back to 3.9.0 because 3.10.1's behavior "may cause your services not to work correctly anymore".. I have a bit of concern over jumping ahead of k8s to 3.10.1 given our v1.6 has to work with prior versions of k8s and I see k8s is having difficulty moving up from 3.9 to either 3.10.1 or 3.10.2

emicklei/go-restful@v3.10.1...v3.10.2

@estesp
Copy link
Member
estesp commented Apr 27, 2023

We already are on 3.10.1 in main and release/1.7 went out with 3.10.1. Seems our one use of go-restful (the streaming server endpoint in the CRI plugin) is unaffected by whatever path issue existing in 3.10.1.

Since this is a "cherry pick", I think we should either merge it since 1.7 and main are fine with it, or close it and update main to 3.10.2 and then cherry pick that back to release/1.7 and release/1.6

@mmerkes
Copy link
Author
mmerkes commented Apr 27, 2023

We already are on 3.10.1 in main and release/1.7 went out with 3.10.1. Seems our one use of go-restful (the streaming server endpoint in the CRI plugin) is unaffected by whatever path issue existing in 3.10.1.

Since this is a "cherry pick", I think we should either merge it since 1.7 and main are fine with it, or close it and update main to 3.10.2 and then cherry pick that back to release/1.7 and release/1.6

Agreed. Would be good to close the book. If we'd rather update it to 3.10.2, I can put up the PR.

gazal-k
gazal-k reviewed Apr 28, 2023
View reviewed changes
go.sum
@@ -351,8 +351,8 @@ github.com/elazarl/goproxy v0.0.0-20180725130230-947c36da3153/go.mod h1:/Zj4wYkg
github.com/emicklei/go-restful v0.0.0-20170410110728-ff4f55a20633/go.mod h1:otzb+WCGbkyDHkqmQmT5YD2WR4BBwUdeQoFo8l/7tVs=
github.com/emicklei/go-restful v2.9.5+incompatible h1:spTtZBk5DYEvbxMVutUuTyh1Ao2r4iyvLdACqsl/Ljk=
github.com/emicklei/go-restful v2.9.5+incompatible/go.mod h1:otzb+WCGbkyDHkqmQmT5YD2WR4BBwUdeQoFo8l/7tVs=
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

does this indicate indirect usage of go-restful 2.x?

cc @jpmcb

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No

@samuelkarp samuelkarp mentioned this pull request May 4, 2023
Closed
@AkihiroSuda AkihiroSuda merged commit 62f6b96 into containerd:release/1.6 Jul 21, 2023
@fuweid fuweid changed the title Update go-restful to v3.10.1 in release/1.6 [release/16.] Update go-restful to v3.10.1 Jul 21, 2023
@fuweid fuweid changed the title [release/16.] Update go-restful to v3.10.1 [release/1.6] Update go-restful to v3.10.1 Jul 21, 2023
aravindhp added a commit to openshift/containerd that referenced this pull request Jul 27, 2023
@aravindhp
Merge tag 'v1.6.22' into release-4.13
fc9275c 
containerd 1.6.22

Welcome to the v1.6.22 release of containerd!

The twenty-second patch release for containerd 1.6 contains various fixes and updates.

* **RunC: Update runc binary to v1.1.8** ([containerd#8842](containerd#8842))
* **CRI: Fix additionalGids: it should fallback to imageConfig.User when securityContext.RunAsUser,RunAsUsername are empty** ([containerd#8823](containerd#8823))
* **CRI: Write generated CNI config atomically** ([containerd#8826](containerd#8826))
* **Fix concurrent writes for `UpdateContainerStats`** ([containerd#8819](containerd#8819))
* **Make checkContainerTimestamps less strict on Windows** ([containerd#8827](containerd#8827))
* **Port-Forward: Correctly handle known errors** ([containerd#8805](containerd#8805))
* **Resolve docker.NewResolver race condition** ([containerd#8800](containerd#8800))
* **SecComp: Always allow `name_to_handle_at`** ([containerd#8754](containerd#8754))
* **Adding support to run hcsshim from local clone** ([containerd#8713](containerd#8713))
* **Pinned image support** ([containerd#8720](containerd#8720))
* **Runtime/V2/RunC: Handle early exits w/o big locks** ([containerd#8695](containerd#8695))
* **CRITool: Move up to CRI-TOOLS v1.27.0** ([containerd#7997](containerd#7997))
* **Fix cpu architecture detection issue on emulated ARM platform** ([containerd#8533](containerd#8533))
* **Task: Don't `close()` io before `cancel()`** ([containerd#8659](containerd#8659))
* **Fix panic when remote differ returns empty result** ([containerd#8640](containerd#8640))
* **Plugins: Notify readiness when registered plugins are ready** ([containerd#8583](containerd#8583))
* **Unwrap io errors in server connection receive error handling** ([ttrpc#143](containerd/ttrpc#143))

See the changelog for complete list of changes

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

* Akihiro Suda
* Phil Estes
* Sebastiaan van Stijn
* Derek McGowan
* Wei Fu
* Kazuyoshi Kato
* Austin Vazquez
* Samuel Karp
* dependabot[bot]
* Jin Dong
* Maksym Pavlenko
* Mike Brown
* Shingo Omura
* Akhil Mohan
* Bjorn Neergaard
* Laura Brehm
* Tony Fang
* Aditi Sharma
* Andrey Epifanov
* Benjamin Wang
* Brian Goff
* Cory Snider
* Daniel Canter
* Daniel Lenar
* Henry Wang
* Luca Comellini
* Madhav Jivrajani
* Mahamed Ali
* Mohit Sharma
* Oliver Radwell
* Priyanka Saggu
* Qasim Sarfraz
* Takumasa Sakao
* wangxiang
* zounengren

<details><summary>95 commits</summary>
<p>

* [release/1.6] Prepare release notes for v1.6.22 ([containerd#8863](containerd#8863))
  * [`0770a4601`](containerd@0770a46) [release/1.6] Add release notes for v1.6.22
* [release/1.6] migrate to community owned bucket for node e2e tests ([containerd#8876](containerd#8876))
  * [`512a672af`](containerd@512a672) migrate to community owned bucket
* [release/1.6] cri: memory.memsw.limit_in_bytes: no such file or directory ([containerd#8870](containerd#8870))
  * [`b585ff155`](containerd@b585ff1) cri: memory.memsw.limit_in_bytes: no such file or directory
* [release/1.6] Update go-restful to v3.10.1  ([containerd#8412](containerd#8412))
  * [`a322077bf`](containerd@a322077) go.mod: github.com/emicklei/go-restful/v3 v3.10.1
* [release/1.6 backport] update runc binary to v1.1.8 ([containerd#8842](containerd#8842))
  * [`b3ac068eb`](containerd@b3ac068) update runc binary to v1.1.8
* [release/1.6 backport] ci: remove libseccomp-dev installation for nightly ([containerd#8773](containerd#8773))
  * [`6e2bcb6dd`](containerd@6e2bcb6) ci: remove libseccomp-dev installation for nightly
* [release/1.6 backport] [CRI] fix additionalGids: it should fallback to imageConfig.User when securityContext.RunAsUser,RunAsUsername are empty ([containerd#8823](containerd#8823))
  * [`cd06f23af`](containerd@cd06f23) capture desc variable in range variable just in case that it run in parallel mode
  * [`30f5c6a1f`](containerd@30f5c6a) Use t.TempDir instead of os.MkdirTemp
  * [`59d8363ef`](containerd@59d8363) fix userstr for dditionalGids on Linux
* [release/1.6 backport] cri: write generated CNI config atomically ([containerd#8826](containerd#8826))
  * [`d75bf78c2`](containerd@d75bf78) ctr: update WritePidFile to use atomicfile
  * [`5f70b23c1`](containerd@5f70b23) shim: WritePidFile & WriteAddress use atomicfile
  * [`505d444b0`](containerd@505d444) cri: write generated CNI config atomically on Unix
  * [`b2d2d3829`](containerd@b2d2d38) atomicfile: new package for atomic file writes
* [release/1.6 backport] Fix concurrent writes for UpdateContainerStats ([containerd#8819](containerd#8819))
  * [`9f650143f`](containerd@9f65014) Fix concurrent writes for UpdateContainerStats
* [release/1.6 backport] Make checkContainerTimestamps less strict on Windows ([containerd#8827](containerd#8827))
  * [`568ce91ca`](containerd@568ce91) Make checkContainerTimestamps less strict on Windows
* [release/1.6 backport] dependency: bump go.etcd.io/bbolt to v1.3.7 ([containerd#8817](containerd#8817))
  * [`d2f47192a`](containerd@d2f4719) dependency: bump go.etcd.io/bbolt to v1.3.7
  * [`fb56dc245`](containerd@fb56dc2) [release/1.6] vendor: github.com/stretchr/testify v1.8.1
* [release/1.6 backport] Move logrus setup code to log package ([containerd#8832](containerd#8832))
  * [`7fbd5dc89`](containerd@7fbd5dc) Move logrus setup code to log package
* [release/1.6 backport] release: Add "cri-containerd.DEPRECATED.txt" in the deprecated cri-containerd-* bundles ([containerd#8820](containerd#8820))
  * [`59a143670`](containerd@59a1436) release: Add "cri-containerd.DEPRECATED.txt" in the deprecated cri-containerd-* bundles
* [release/1.6 backport] Use version 2 configuration format in docs ([containerd#8821](containerd#8821))
  * [`5b51b79e2`](containerd@5b51b79) [release/1.6] fix remaining "v1 config" plugin IDs
  * [`b7cf26d8d`](containerd@b7cf26d) docs: Fix sample config.toml syntax
  * [`fcdaf0966`](containerd@fcdaf09) docs: migrate config v1 to v2
  * [`728d5c5f0`](containerd@728d5c5) Use version 2 config and mention containerd config command
* [release/1.6] update go to go1.19.11 ([containerd#8816](containerd#8816))
  * [`81aa14718`](containerd@81aa147) [release/1.6] update go to go1.19.11
* [release/1.6] update go to go1.19.10 ([containerd#8715](containerd#8715))
  * [`17cd86629`](containerd@17cd866) [release/1.6] update go to go1.19.10
* [release/1.6 backport] bugfix(port-forward): Correctly handle known errors ([containerd#8805](containerd#8805))
  * [`fdb65f214`](containerd@fdb65f2) bugfix(port-forward): Correctly handle known errors
* [release/1.6] Resolve docker.NewResolver race condition ([containerd#8800](containerd#8800))
  * [`b5784af66`](containerd@b5784af) Change http.Header copy to builtin Clone
  * [`31c466f82`](containerd@31c466f) Resolve docker.NewResolver race condition
* [release/1.6 backport] vendor: github.com/containerd/zfs v1.1.0 ([containerd#8781](containerd#8781))
  * [`be6406ca6`](containerd@be6406c) vendor: github.com/containerd/zfs v1.1.0
  * [`9f1260074`](containerd@9f12600) [release/1.6] vendor gotest.tools/v3 v3.5.0
  * [`526e9e0ce`](containerd@526e9e0) Bump grpc to v1.50.1
  * [`0e7d2d121`](containerd@0e7d2d1) go.mod: github.com/sirupsen/logrus v1.9.0
  * [`5b153c621`](containerd@5b153c6) go.mod: github.com/moby/sys/mountinfo v0.6.2
  * [`9dee60960`](containerd@9dee609) go.mod: github.com/moby/sys/mountinfo v0.6.0
* [release/1.6 backport] seccomp: always allow name_to_handle_at ([containerd#8754](containerd#8754))
  * [`07ea7b9e7`](containerd@07ea7b9) seccomp: always allow name_to_handle_at
* [release/1.6 backport] Update ginkgo to match cri-tools' version ([containerd#8759](containerd#8759))
  * [`1dae51fed`](containerd@1dae51f) Update ginkgo to match cri-tools' version
* [release/1.6 backport] integration/client: add timeout to `TestShimOOMScore` ([containerd#8749](containerd#8749))
  * [`bd76ab978`](containerd@bd76ab9) integration/client: add timeout to `TestShimOOMScore`
* [release/1.6 backport] Adding support to run hcsshim from local clone ([containerd#8713](containerd#8713))
  * [`8e14eccb2`](containerd@8e14ecc) Adding support to run hcsshim from local clone
* [1.6] Add Fields type alias to log package ([containerd#8739](containerd#8739))
  * [`9f2cdd589`](containerd@9f2cdd5) Add Fields type alias to log package
* [release/1.6] Pinned image support ([containerd#8720](containerd#8720))
  * [`f4713aad0`](containerd@f4713aa) Pinned image support
* [release/1.6 backport] runtime/v2/runc: handle early exits w/o big locks ([containerd#8695](containerd#8695))
  * [`dbeec47b4`](containerd@dbeec47) runtime/v2/runc: handle early exits w/o big locks
* [release/1.6 backport] move up to CRI-TOOLS v1.27.0 ([containerd#7997](containerd#7997))
  * [`a8e01e40a`](containerd@a8e01e4) move to CRI-TOOLS v1.27.0
  * [`755f80698`](containerd@755f806) move up to CRI-TOOLS v1.26.0
  * [`b29cc035f`](containerd@b29cc03) bump critools into ca1571e6edd116b2c95f52e3dfa0b4779b74223a
  * [`9138999f5`](containerd@9138999) Upgrade critools from 1.24.1 to 1.25.0
* [release/1.6] cherry-pick: No more nondistributable layers in MS registry ([containerd#8691](containerd#8691))
  * [`712ff8eb3`](containerd@712ff8e) No more nondistributable layers in MS registry
* [release/1.6] Fix cpu architecture detection issue on emulated ARM platform ([containerd#8533](containerd#8533))
  * [`2b16e4bfa`](containerd@2b16e4b) Add unit test to function GetCPUVariantFromArch
  * [`106e36ec3`](containerd@106e36e) Use uname machine field to get CPU variant if fails at /proc/cpuinfo
* [release/1.6] Update lint timeout ([containerd#8679](containerd#8679))
  * [`287fdfea6`](containerd@287fdfe) Update linter timeout to match main branch
* [release/1.6 backport] task: don't `close()` io before `cancel()` ([containerd#8659](containerd#8659))
  * [`b27f7daa5`](containerd@b27f7da) task: don't `close()` io before `cancel()`
* [release/1.6] update test box to fedora 37 ([containerd#8660](containerd#8660))
  * [`8b4c69248`](containerd@8b4c692) update test box to fedora 37
* [release/1.6] Revert "Downgrade MinGW to version 10.2.0" ([containerd#8668](containerd#8668))
  * [`81d6085af`](containerd@81d6085) Revert "Downgrade MinGW to version 10.2.0"
* [release/1.6 backport] Fix panic when remote differ returns empty result ([containerd#8640](containerd#8640))
  * [`f98122378`](containerd@f981223) Fix panic when remote differ returns empty result
* [1.6] Bump x/net to 0.8 ([containerd#8642](containerd#8642))
  * [`aa53f272d`](containerd@aa53f27) Bump x/net to 0.8
* [release/1.6 backport] remotes/docker: ResolverOptions: fix deprecation comments ([containerd#8620](containerd#8620))
  * [`56ff20839`](containerd@56ff208) remotes/docker: ResolverOptions: fix deprecation comments
* [release/1.6] notify readiness when registered plugins are ready ([containerd#8583](containerd#8583))
  * [`bccaf68b7`](containerd@bccaf68) notify readiness when registered plugins are ready
* [release/1.6] Update ttrpc to 1.1.2 ([containerd#8528](containerd#8528))
  * [`1cdbbe76b`](containerd@1cdbbe7) Update ttrpc to 1.1.2
</p>
</details>

<details><summary>2 commits</summary>
<p>

* [release/1.1] Unwrap io errors in server connection receive error handling ([containerd#143](containerd/ttrpc#143))
  * [`d5f7eed`](containerd/ttrpc@d5f7eed) Unwrap io errors in server connection receive error handling
</p>
</details>

<details><summary>49 commits</summary>
<p>

* gofumpt and update status badges ([containerd#75](containerd/zfs#75))
  * [`5e3457b`](containerd/zfs@5e3457b) TestZFSUsage: use t.TempDir()
  * [`6e9c675`](containerd/zfs@6e9c675) README: update badges
  * [`ff17a79`](containerd/zfs@ff17a79) gofmt code
* go.mod: github.com/mistifyio/go-zfs/v3 v3.0.1 ([containerd#73](containerd/zfs#73))
  * [`d3485b9`](containerd/zfs@d3485b9) go.mod: github.com/mistifyio/go-zfs/v3 v3.0.1
* gha: fix golangci-lint, and upgrade to v1.52.2 ([containerd#74](containerd/zfs#74))
  * [`23c831a`](containerd/zfs@23c831a) remove pre-go1.17 build-tags, and fix missing build-tags in plugin
  * [`e5acd95`](containerd/zfs@e5acd95) gha: fix golangci-lint, upgrade to v1.52.2
* Bump github.com/containerd/containerd from 1.6.12 to 1.6.18 ([containerd#72](containerd/zfs#72))
  * [`00b96c2`](containerd/zfs@00b96c2) Bump github.com/containerd/containerd from 1.6.12 to 1.6.18
* Bump github.com/containerd/containerd from 1.6.9 to 1.6.12 ([containerd#69](containerd/zfs#69))
  * [`a099def`](containerd/zfs@a099def) Bump github.com/containerd/containerd from 1.6.9 to 1.6.12
* Add CodeQL analysis workflow ([containerd#67](containerd/zfs#67))
  * [`fee1db7`](containerd/zfs@fee1db7) Add CodeQL analysis workflow
* Update GitHub actions CI workflow ([containerd#66](containerd/zfs#66))
  * [`b8b7ab2`](containerd/zfs@b8b7ab2) Update GitHub actions CI workflow
* Upgrade compiler to Go 1.19 and update dependencies ([containerd#68](containerd/zfs#68))
  * [`3e729b3`](containerd/zfs@3e729b3) Update dependencies
  * [`3c003f8`](containerd/zfs@3c003f8) Upgrade compiler to Go 1.19
* Remove references to io/ioutil package ([containerd#65](containerd/zfs#65))
  * [`d700762`](containerd/zfs@d700762) Remove references to io/ioutil package
* Update go.mod and move to supported Go version ([containerd#62](containerd/zfs#62))
  * [`f52906e`](containerd/zfs@f52906e) Update Go version to supported version
  * [`79ca2cb`](containerd/zfs@79ca2cb) Update containerd depedency to latest
* go.mod: github.com/mistifyio/go-zfs v3.0.0 ([containerd#59](containerd/zfs#59))
  * [`2e3db29`](containerd/zfs@2e3db29) go.mod: github.com/mistifyio/go-zfs v3.0.0
* go.mod: github.com/mistifyio/go-zfs/v3 v3.0.0-20220217145925-d014733a5309 ([containerd#58](containerd/zfs#58))
  * [`d904e63`](containerd/zfs@d904e63) go.mod: github.com/mistifyio/go-zfs/v3 v3.0.0-20220217145925-d014733a5309
* Update vendoring to containerd 1.6.x ([containerd#57](containerd/zfs#57))
  * [`e021180`](containerd/zfs@e021180) Update vendoring to containerd 1.6.x
* Bump github.com/containerd/containerd from 1.5.8 to 1.5.9 ([containerd#55](containerd/zfs#55))
  * [`fc0c9a9`](containerd/zfs@fc0c9a9) Bump github.com/containerd/containerd from 1.5.8 to 1.5.9
* Bump github.com/containerd/containerd from 1.5.5 to 1.5.8 ([containerd#54](containerd/zfs#54))
  * [`5d2f28c`](containerd/zfs@5d2f28c) Bump github.com/containerd/containerd from 1.5.5 to 1.5.8
* follow-up-containerd#52: fix the order of cause in fmt.Errorf ([containerd#53](containerd/zfs#53))
  * [`b3f193d`](containerd/zfs@b3f193d) follow-up-containerd#52: fix the order of cause in fmt.Errorf
* replace pkg/errors ([containerd#52](containerd/zfs#52))
  * [`d5b0a2f`](containerd/zfs@d5b0a2f) replace pkg/errors
* Bump github.com/containerd/containerd from 1.5.2 to 1.5.4 ([containerd#51](containerd/zfs#51))
  * [`fd6afa5`](containerd/zfs@fd6afa5) Bump github.com/containerd/containerd from 1.5.2 to 1.5.4
* Bump containerd to 1.5.2 ([containerd#50](containerd/zfs#50))
  * [`aef875e`](containerd/zfs@aef875e) bump containerd to 1.5.2
* Rename branches from master to main ([containerd#49](containerd/zfs#49))
  * [`35c6af7`](containerd/zfs@35c6af7) Rename branches from master to main
* sync up with containerd 1.5 GA  ([containerd#47](containerd/zfs#47))
  * [`3d5efef`](containerd/zfs@3d5efef) vendor sync up with containerd 1.5 ga
* README.md: fix CI badge ([containerd#46](containerd/zfs#46))
  * [`0977d81`](containerd/zfs@0977d81) README.md: fix CI badge
</p>
</details>

* **github.com/containerd/ttrpc**        v1.1.1 -> v1.1.2
* **github.com/containerd/zfs**          v1.0.0 -> v1.1.0
* **github.com/emicklei/go-restful/v3**  v3.7.3 -> v3.10.1
* **github.com/google/go-cmp**           v0.5.6 -> v0.5.9
* **github.com/google/uuid**             v1.2.0 -> v1.3.0
* **github.com/mistifyio/go-zfs/v3**     v3.0.1 **_new_**
* **github.com/moby/sys/mountinfo**      v0.5.0 -> v0.6.2
* **github.com/sirupsen/logrus**         v1.8.1 -> v1.9.0
* **github.com/stretchr/testify**        v1.7.0 -> v1.8.1
* **go.etcd.io/bbolt**                   v1.3.6 -> v1.3.7
* **golang.org/x/net**                   a158d28d115b -> v0.8.0
* **golang.org/x/sys**                   8c9f86f7a55f -> v0.6.0
* **golang.org/x/term**                  03fcf44c2211 -> v0.6.0
* **golang.org/x/text**                  v0.3.7 -> v0.8.0
* **google.golang.org/grpc**             v1.47.0 -> v1.50.1
* **google.golang.org/protobuf**         v1.28.0 -> v1.28.1
* **gotest.tools/v3**                    v3.0.3 -> v3.5.0

Previous release can be found at [v1.6.21](https://github.com/containerd/containerd/releases/tag/v1.6.21)
aravindhp added a commit to openshift/containerd that referenced this pull request Jul 27, 2023
@aravindhp
Merge tag 'v1.6.22' into release-4.12
9f21099 
containerd 1.6.22

Welcome to the v1.6.22 release of containerd!

The twenty-second patch release for containerd 1.6 contains various fixes and updates.

* **RunC: Update runc binary to v1.1.8** ([containerd#8842](containerd#8842))
* **CRI: Fix additionalGids: it should fallback to imageConfig.User when securityContext.RunAsUser,RunAsUsername are empty** ([containerd#8823](containerd#8823))
* **CRI: Write generated CNI config atomically** ([containerd#8826](containerd#8826))
* **Fix concurrent writes for `UpdateContainerStats`** ([containerd#8819](containerd#8819))
* **Make checkContainerTimestamps less strict on Windows** ([containerd#8827](containerd#8827))
* **Port-Forward: Correctly handle known errors** ([containerd#8805](containerd#8805))
* **Resolve docker.NewResolver race condition** ([containerd#8800](containerd#8800))
* **SecComp: Always allow `name_to_handle_at`** ([containerd#8754](containerd#8754))
* **Adding support to run hcsshim from local clone** ([containerd#8713](containerd#8713))
* **Pinned image support** ([containerd#8720](containerd#8720))
* **Runtime/V2/RunC: Handle early exits w/o big locks** ([containerd#8695](containerd#8695))
* **CRITool: Move up to CRI-TOOLS v1.27.0** ([containerd#7997](containerd#7997))
* **Fix cpu architecture detection issue on emulated ARM platform** ([containerd#8533](containerd#8533))
* **Task: Don't `close()` io before `cancel()`** ([containerd#8659](containerd#8659))
* **Fix panic when remote differ returns empty result** ([containerd#8640](containerd#8640))
* **Plugins: Notify readiness when registered plugins are ready** ([containerd#8583](containerd#8583))
* **Unwrap io errors in server connection receive error handling** ([ttrpc#143](containerd/ttrpc#143))

See the changelog for complete list of changes

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

* Akihiro Suda
* Phil Estes
* Sebastiaan van Stijn
* Derek McGowan
* Wei Fu
* Kazuyoshi Kato
* Austin Vazquez
* Samuel Karp
* dependabot[bot]
* Jin Dong
* Maksym Pavlenko
* Mike Brown
* Shingo Omura
* Akhil Mohan
* Bjorn Neergaard
* Laura Brehm
* Tony Fang
* Aditi Sharma
* Andrey Epifanov
* Benjamin Wang
* Brian Goff
* Cory Snider
* Daniel Canter
* Daniel Lenar
* Henry Wang
* Luca Comellini
* Madhav Jivrajani
* Mahamed Ali
* Mohit Sharma
* Oliver Radwell
* Priyanka Saggu
* Qasim Sarfraz
* Takumasa Sakao
* wangxiang
* zounengren

<details><summary>95 commits</summary>
<p>

* [release/1.6] Prepare release notes for v1.6.22 ([containerd#8863](containerd#8863))
  * [`0770a4601`](containerd@0770a46) [release/1.6] Add release notes for v1.6.22
* [release/1.6] migrate to community owned bucket for node e2e tests ([containerd#8876](containerd#8876))
  * [`512a672af`](containerd@512a672) migrate to community owned bucket
* [release/1.6] cri: memory.memsw.limit_in_bytes: no such file or directory ([containerd#8870](containerd#8870))
  * [`b585ff155`](containerd@b585ff1) cri: memory.memsw.limit_in_bytes: no such file or directory
* [release/1.6] Update go-restful to v3.10.1  ([containerd#8412](containerd#8412))
  * [`a322077bf`](containerd@a322077) go.mod: github.com/emicklei/go-restful/v3 v3.10.1
* [release/1.6 backport] update runc binary to v1.1.8 ([containerd#8842](containerd#8842))
  * [`b3ac068eb`](containerd@b3ac068) update runc binary to v1.1.8
* [release/1.6 backport] ci: remove libseccomp-dev installation for nightly ([containerd#8773](containerd#8773))
  * [`6e2bcb6dd`](containerd@6e2bcb6) ci: remove libseccomp-dev installation for nightly
* [release/1.6 backport] [CRI] fix additionalGids: it should fallback to imageConfig.User when securityContext.RunAsUser,RunAsUsername are empty ([containerd#8823](containerd#8823))
  * [`cd06f23af`](containerd@cd06f23) capture desc variable in range variable just in case that it run in parallel mode
  * [`30f5c6a1f`](containerd@30f5c6a) Use t.TempDir instead of os.MkdirTemp
  * [`59d8363ef`](containerd@59d8363) fix userstr for dditionalGids on Linux
* [release/1.6 backport] cri: write generated CNI config atomically ([containerd#8826](containerd#8826))
  * [`d75bf78c2`](containerd@d75bf78) ctr: update WritePidFile to use atomicfile
  * [`5f70b23c1`](containerd@5f70b23) shim: WritePidFile & WriteAddress use atomicfile
  * [`505d444b0`](containerd@505d444) cri: write generated CNI config atomically on Unix
  * [`b2d2d3829`](containerd@b2d2d38) atomicfile: new package for atomic file writes
* [release/1.6 backport] Fix concurrent writes for UpdateContainerStats ([containerd#8819](containerd#8819))
  * [`9f650143f`](containerd@9f65014) Fix concurrent writes for UpdateContainerStats
* [release/1.6 backport] Make checkContainerTimestamps less strict on Windows ([containerd#8827](containerd#8827))
  * [`568ce91ca`](containerd@568ce91) Make checkContainerTimestamps less strict on Windows
* [release/1.6 backport] dependency: bump go.etcd.io/bbolt to v1.3.7 ([containerd#8817](containerd#8817))
  * [`d2f47192a`](containerd@d2f4719) dependency: bump go.etcd.io/bbolt to v1.3.7
  * [`fb56dc245`](containerd@fb56dc2) [release/1.6] vendor: github.com/stretchr/testify v1.8.1
* [release/1.6 backport] Move logrus setup code to log package ([containerd#8832](containerd#8832))
  * [`7fbd5dc89`](containerd@7fbd5dc) Move logrus setup code to log package
* [release/1.6 backport] release: Add "cri-containerd.DEPRECATED.txt" in the deprecated cri-containerd-* bundles ([containerd#8820](containerd#8820))
  * [`59a143670`](containerd@59a1436) release: Add "cri-containerd.DEPRECATED.txt" in the deprecated cri-containerd-* bundles
* [release/1.6 backport] Use version 2 configuration format in docs ([containerd#8821](containerd#8821))
  * [`5b51b79e2`](containerd@5b51b79) [release/1.6] fix remaining "v1 config" plugin IDs
  * [`b7cf26d8d`](containerd@b7cf26d) docs: Fix sample config.toml syntax
  * [`fcdaf0966`](containerd@fcdaf09) docs: migrate config v1 to v2
  * [`728d5c5f0`](containerd@728d5c5) Use version 2 config and mention containerd config command
* [release/1.6] update go to go1.19.11 ([containerd#8816](containerd#8816))
  * [`81aa14718`](containerd@81aa147) [release/1.6] update go to go1.19.11
* [release/1.6] update go to go1.19.10 ([containerd#8715](containerd#8715))
  * [`17cd86629`](containerd@17cd866) [release/1.6] update go to go1.19.10
* [release/1.6 backport] bugfix(port-forward): Correctly handle known errors ([containerd#8805](containerd#8805))
  * [`fdb65f214`](containerd@fdb65f2) bugfix(port-forward): Correctly handle known errors
* [release/1.6] Resolve docker.NewResolver race condition ([containerd#8800](containerd#8800))
  * [`b5784af66`](containerd@b5784af) Change http.Header copy to builtin Clone
  * [`31c466f82`](containerd@31c466f) Resolve docker.NewResolver race condition
* [release/1.6 backport] vendor: github.com/containerd/zfs v1.1.0 ([containerd#8781](containerd#8781))
  * [`be6406ca6`](containerd@be6406c) vendor: github.com/containerd/zfs v1.1.0
  * [`9f1260074`](containerd@9f12600) [release/1.6] vendor gotest.tools/v3 v3.5.0
  * [`526e9e0ce`](containerd@526e9e0) Bump grpc to v1.50.1
  * [`0e7d2d121`](containerd@0e7d2d1) go.mod: github.com/sirupsen/logrus v1.9.0
  * [`5b153c621`](containerd@5b153c6) go.mod: github.com/moby/sys/mountinfo v0.6.2
  * [`9dee60960`](containerd@9dee609) go.mod: github.com/moby/sys/mountinfo v0.6.0
* [release/1.6 backport] seccomp: always allow name_to_handle_at ([containerd#8754](containerd#8754))
  * [`07ea7b9e7`](containerd@07ea7b9) seccomp: always allow name_to_handle_at
* [release/1.6 backport] Update ginkgo to match cri-tools' version ([containerd#8759](containerd#8759))
  * [`1dae51fed`](containerd@1dae51f) Update ginkgo to match cri-tools' version
* [release/1.6 backport] integration/client: add timeout to `TestShimOOMScore` ([containerd#8749](containerd#8749))
  * [`bd76ab978`](containerd@bd76ab9) integration/client: add timeout to `TestShimOOMScore`
* [release/1.6 backport] Adding support to run hcsshim from local clone ([containerd#8713](containerd#8713))
  * [`8e14eccb2`](containerd@8e14ecc) Adding support to run hcsshim from local clone
* [1.6] Add Fields type alias to log package ([containerd#8739](containerd#8739))
  * [`9f2cdd589`](containerd@9f2cdd5) Add Fields type alias to log package
* [release/1.6] Pinned image support ([containerd#8720](containerd#8720))
  * [`f4713aad0`](containerd@f4713aa) Pinned image support
* [release/1.6 backport] runtime/v2/runc: handle early exits w/o big locks ([containerd#8695](containerd#8695))
  * [`dbeec47b4`](containerd@dbeec47) runtime/v2/runc: handle early exits w/o big locks
* [release/1.6 backport] move up to CRI-TOOLS v1.27.0 ([containerd#7997](containerd#7997))
  * [`a8e01e40a`](containerd@a8e01e4) move to CRI-TOOLS v1.27.0
  * [`755f80698`](containerd@755f806) move up to CRI-TOOLS v1.26.0
  * [`b29cc035f`](containerd@b29cc03) bump critools into ca1571e6edd116b2c95f52e3dfa0b4779b74223a
  * [`9138999f5`](containerd@9138999) Upgrade critools from 1.24.1 to 1.25.0
* [release/1.6] cherry-pick: No more nondistributable layers in MS registry ([containerd#8691](containerd#8691))
  * [`712ff8eb3`](containerd@712ff8e) No more nondistributable layers in MS registry
* [release/1.6] Fix cpu architecture detection issue on emulated ARM platform ([containerd#8533](containerd#8533))
  * [`2b16e4bfa`](containerd@2b16e4b) Add unit test to function GetCPUVariantFromArch
  * [`106e36ec3`](containerd@106e36e) Use uname machine field to get CPU variant if fails at /proc/cpuinfo
* [release/1.6] Update lint timeout ([containerd#8679](containerd#8679))
  * [`287fdfea6`](containerd@287fdfe) Update linter timeout to match main branch
* [release/1.6 backport] task: don't `close()` io before `cancel()` ([containerd#8659](containerd#8659))
  * [`b27f7daa5`](containerd@b27f7da) task: don't `close()` io before `cancel()`
* [release/1.6] update test box to fedora 37 ([containerd#8660](containerd#8660))
  * [`8b4c69248`](containerd@8b4c692) update test box to fedora 37
* [release/1.6] Revert "Downgrade MinGW to version 10.2.0" ([containerd#8668](containerd#8668))
  * [`81d6085af`](containerd@81d6085) Revert "Downgrade MinGW to version 10.2.0"
* [release/1.6 backport] Fix panic when remote differ returns empty result ([containerd#8640](containerd#8640))
  * [`f98122378`](containerd@f981223) Fix panic when remote differ returns empty result
* [1.6] Bump x/net to 0.8 ([containerd#8642](containerd#8642))
  * [`aa53f272d`](containerd@aa53f27) Bump x/net to 0.8
* [release/1.6 backport] remotes/docker: ResolverOptions: fix deprecation comments ([containerd#8620](containerd#8620))
  * [`56ff20839`](containerd@56ff208) remotes/docker: ResolverOptions: fix deprecation comments
* [release/1.6] notify readiness when registered plugins are ready ([containerd#8583](containerd#8583))
  * [`bccaf68b7`](containerd@bccaf68) notify readiness when registered plugins are ready
* [release/1.6] Update ttrpc to 1.1.2 ([containerd#8528](containerd#8528))
  * [`1cdbbe76b`](containerd@1cdbbe7) Update ttrpc to 1.1.2
</p>
</details>

<details><summary>2 commits</summary>
<p>

* [release/1.1] Unwrap io errors in server connection receive error handling ([containerd#143](containerd/ttrpc#143))
  * [`d5f7eed`](containerd/ttrpc@d5f7eed) Unwrap io errors in server connection receive error handling
</p>
</details>

<details><summary>49 commits</summary>
<p>

* gofumpt and update status badges ([containerd#75](containerd/zfs#75))
  * [`5e3457b`](containerd/zfs@5e3457b) TestZFSUsage: use t.TempDir()
  * [`6e9c675`](containerd/zfs@6e9c675) README: update badges
  * [`ff17a79`](containerd/zfs@ff17a79) gofmt code
* go.mod: github.com/mistifyio/go-zfs/v3 v3.0.1 ([containerd#73](containerd/zfs#73))
  * [`d3485b9`](containerd/zfs@d3485b9) go.mod: github.com/mistifyio/go-zfs/v3 v3.0.1
* gha: fix golangci-lint, and upgrade to v1.52.2 ([containerd#74](containerd/zfs#74))
  * [`23c831a`](containerd/zfs@23c831a) remove pre-go1.17 build-tags, and fix missing build-tags in plugin
  * [`e5acd95`](containerd/zfs@e5acd95) gha: fix golangci-lint, upgrade to v1.52.2
* Bump github.com/containerd/containerd from 1.6.12 to 1.6.18 ([containerd#72](containerd/zfs#72))
  * [`00b96c2`](containerd/zfs@00b96c2) Bump github.com/containerd/containerd from 1.6.12 to 1.6.18
* Bump github.com/containerd/containerd from 1.6.9 to 1.6.12 ([containerd#69](containerd/zfs#69))
  * [`a099def`](containerd/zfs@a099def) Bump github.com/containerd/containerd from 1.6.9 to 1.6.12
* Add CodeQL analysis workflow ([containerd#67](containerd/zfs#67))
  * [`fee1db7`](containerd/zfs@fee1db7) Add CodeQL analysis workflow
* Update GitHub actions CI workflow ([containerd#66](containerd/zfs#66))
  * [`b8b7ab2`](containerd/zfs@b8b7ab2) Update GitHub actions CI workflow
* Upgrade compiler to Go 1.19 and update dependencies ([containerd#68](containerd/zfs#68))
  * [`3e729b3`](containerd/zfs@3e729b3) Update dependencies
  * [`3c003f8`](containerd/zfs@3c003f8) Upgrade compiler to Go 1.19
* Remove references to io/ioutil package ([containerd#65](containerd/zfs#65))
  * [`d700762`](containerd/zfs@d700762) Remove references to io/ioutil package
* Update go.mod and move to supported Go version ([containerd#62](containerd/zfs#62))
  * [`f52906e`](containerd/zfs@f52906e) Update Go version to supported version
  * [`79ca2cb`](containerd/zfs@79ca2cb) Update containerd depedency to latest
* go.mod: github.com/mistifyio/go-zfs v3.0.0 ([containerd#59](containerd/zfs#59))
  * [`2e3db29`](containerd/zfs@2e3db29) go.mod: github.com/mistifyio/go-zfs v3.0.0
* go.mod: github.com/mistifyio/go-zfs/v3 v3.0.0-20220217145925-d014733a5309 ([containerd#58](containerd/zfs#58))
  * [`d904e63`](containerd/zfs@d904e63) go.mod: github.com/mistifyio/go-zfs/v3 v3.0.0-20220217145925-d014733a5309
* Update vendoring to containerd 1.6.x ([containerd#57](containerd/zfs#57))
  * [`e021180`](containerd/zfs@e021180) Update vendoring to containerd 1.6.x
* Bump github.com/containerd/containerd from 1.5.8 to 1.5.9 ([containerd#55](containerd/zfs#55))
  * [`fc0c9a9`](containerd/zfs@fc0c9a9) Bump github.com/containerd/containerd from 1.5.8 to 1.5.9
* Bump github.com/containerd/containerd from 1.5.5 to 1.5.8 ([containerd#54](containerd/zfs#54))
  * [`5d2f28c`](containerd/zfs@5d2f28c) Bump github.com/containerd/containerd from 1.5.5 to 1.5.8
* follow-up-containerd#52: fix the order of cause in fmt.Errorf ([containerd#53](containerd/zfs#53))
  * [`b3f193d`](containerd/zfs@b3f193d) follow-up-containerd#52: fix the order of cause in fmt.Errorf
* replace pkg/errors ([containerd#52](containerd/zfs#52))
  * [`d5b0a2f`](containerd/zfs@d5b0a2f) replace pkg/errors
* Bump github.com/containerd/containerd from 1.5.2 to 1.5.4 ([containerd#51](containerd/zfs#51))
  * [`fd6afa5`](containerd/zfs@fd6afa5) Bump github.com/containerd/containerd from 1.5.2 to 1.5.4
* Bump containerd to 1.5.2 ([containerd#50](containerd/zfs#50))
  * [`aef875e`](containerd/zfs@aef875e) bump containerd to 1.5.2
* Rename branches from master to main ([containerd#49](containerd/zfs#49))
  * [`35c6af7`](containerd/zfs@35c6af7) Rename branches from master to main
* sync up with containerd 1.5 GA  ([containerd#47](containerd/zfs#47))
  * [`3d5ef
3D11
ef`](containerd/zfs@3d5efef) vendor sync up with containerd 1.5 ga
* README.md: fix CI badge ([containerd#46](containerd/zfs#46))
  * [`0977d81`](containerd/zfs@0977d81) README.md: fix CI badge
</p>
</details>

* **github.com/containerd/ttrpc**        v1.1.1 -> v1.1.2
* **github.com/containerd/zfs**          v1.0.0 -> v1.1.0
* **github.com/emicklei/go-restful/v3**  v3.7.3 -> v3.10.1
* **github.com/google/go-cmp**           v0.5.6 -> v0.5.9
* **github.com/google/uuid**             v1.2.0 -> v1.3.0
* **github.com/mistifyio/go-zfs/v3**     v3.0.1 **_new_**
* **github.com/moby/sys/mountinfo**      v0.5.0 -> v0.6.2
* **github.com/sirupsen/logrus**         v1.8.1 -> v1.9.0
* **github.com/stretchr/testify**        v1.7.0 -> v1.8.1
* **go.etcd.io/bbolt**                   v1.3.6 -> v1.3.7
* **golang.org/x/net**                   a158d28d115b -> v0.8.0
* **golang.org/x/sys**                   8c9f86f7a55f -> v0.6.0
* **golang.org/x/term**                  03fcf44c2211 -> v0.6.0
* **golang.org/x/text**                  v0.3.7 -> v0.8.0
* **google.golang.org/grpc**             v1.47.0 -> v1.50.1
* **google.golang.org/protobuf**         v1.28.0 -> v1.28.1
* **gotest.tools/v3**                    v3.0.3 -> v3.5.0

Previous release can be found at [v1.6.21](https://github.com/containerd/containerd/releases/tag/v1.6.21)
aravindhp added a commit to openshift/containerd that referenced this pull request Jul 27, 2023
@aravindhp
Merge tag 'v1.6.22' into release-4.11
89bc303 
containerd 1.6.22

Welcome to the v1.6.22 release of containerd!

The twenty-second patch release for containerd 1.6 contains various fixes and updates.

* **RunC: Update runc binary to v1.1.8** ([containerd#8842](containerd#8842))
* **CRI: Fix additionalGids: it should fallback to imageConfig.User when securityContext.RunAsUser,RunAsUsername are empty** ([containerd#8823](containerd#8823))
* **CRI: Write generated CNI config atomically** ([containerd#8826](containerd#8826))
* **Fix concurrent writes for `UpdateContainerStats`** ([containerd#8819](containerd#8819))
* **Make checkContainerTimestamps less strict on Windows** ([containerd#8827](containerd#8827))
* **Port-Forward: Correctly handle known errors** ([containerd#8805](containerd#8805))
* **Resolve docker.NewResolver race condition** ([containerd#8800](containerd#8800))
* **SecComp: Always allow `name_to_handle_at`** ([containerd#8754](containerd#8754))
* **Adding support to run hcsshim from local clone** ([containerd#8713](containerd#8713))
* **Pinned image support** ([containerd#8720](containerd#8720))
* **Runtime/V2/RunC: Handle early exits w/o big locks** ([containerd#8695](containerd#8695))
* **CRITool: Move up to CRI-TOOLS v1.27.0** ([containerd#7997](containerd#7997))
* **Fix cpu architecture detection issue on emulated ARM platform** ([containerd#8533](containerd#8533))
* **Task: Don't `close()` io before `cancel()`** ([containerd#8659](containerd#8659))
* **Fix panic when remote differ returns empty result** ([containerd#8640](containerd#8640))
* **Plugins: Notify readiness when registered plugins are ready** ([containerd#8583](containerd#8583))
* **Unwrap io errors in server connection receive error handling** ([ttrpc#143](containerd/ttrpc#143))

See the changelog for complete list of changes

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

* Akihiro Suda
* Phil Estes
* Sebastiaan van Stijn
* Derek McGowan
* Wei Fu
* Kazuyoshi Kato
* Austin Vazquez
* Samuel Karp
* dependabot[bot]
* Jin Dong
* Maksym Pavlenko
* Mike Brown
* Shingo Omura
* Akhil Mohan
* Bjorn Neergaard
* Laura Brehm
* Tony Fang
* Aditi Sharma
* Andrey Epifanov
* Benjamin Wang
* Brian Goff
* Cory Snider
* Daniel Canter
* Daniel Lenar
* Henry Wang
* Luca Comellini
* Madhav Jivrajani
* Mahamed Ali
* Mohit Sharma
* Oliver Radwell
* Priyanka Saggu
* Qasim Sarfraz
* Takumasa Sakao
* wangxiang
* zounengren

<details><summary>95 commits</summary>
<p>

* [release/1.6] Prepare release notes for v1.6.22 ([containerd#8863](containerd#8863))
  * [`0770a4601`](containerd@0770a46) [release/1.6] Add release notes for v1.6.22
* [release/1.6] migrate to community owned bucket for node e2e tests ([containerd#8876](containerd#8876))
  * [`512a672af`](containerd@512a672) migrate to community owned bucket
* [release/1.6] cri: memory.memsw.limit_in_bytes: no such file or directory ([containerd#8870](containerd#8870))
  * [`b585ff155`](containerd@b585ff1) cri: memory.memsw.limit_in_bytes: no such file or directory
* [release/1.6] Update go-restful to v3.10.1  ([containerd#8412](containerd#8412))
  * [`a322077bf`](containerd@a322077) go.mod: github.com/emicklei/go-restful/v3 v3.10.1
* [release/1.6 backport] update runc binary to v1.1.8 ([containerd#8842](containerd#8842))
  * [`b3ac068eb`](containerd@b3ac068) update runc binary to v1.1.8
* [release/1.6 backport] ci: remove libseccomp-dev installation for nightly ([containerd#8773](containerd#8773))
  * [`6e2bcb6dd`](containerd@6e2bcb6) ci: remove libseccomp-dev installation for nightly
* [release/1.6 backport] [CRI] fix additionalGids: it should fallback to imageConfig.User when securityContext.RunAsUser,RunAsUsername are empty ([containerd#8823](containerd#8823))
  * [`cd06f23af`](containerd@cd06f23) capture desc variable in range variable just in case that it run in parallel mode
  * [`30f5c6a1f`](containerd@30f5c6a) Use t.TempDir instead of os.MkdirTemp
  * [`59d8363ef`](containerd@59d8363) fix userstr for dditionalGids on Linux
* [release/1.6 backport] cri: write generated CNI config atomically ([containerd#8826](containerd#8826))
  * [`d75bf78c2`](containerd@d75bf78) ctr: update WritePidFile to use atomicfile
  * [`5f70b23c1`](containerd@5f70b23) shim: WritePidFile & WriteAddress use atomicfile
  * [`505d444b0`](containerd@505d444) cri: write generated CNI config atomically on Unix
  * [`b2d2d3829`](containerd@b2d2d38) atomicfile: new package for atomic file writes
* [release/1.6 backport] Fix concurrent writes for UpdateContainerStats ([containerd#8819](containerd#8819))
  * [`9f650143f`](containerd@9f65014) Fix concurrent writes for UpdateContainerStats
* [release/1.6 backport] Make checkContainerTimestamps less strict on Windows ([containerd#8827](containerd#8827))
  * [`568ce91ca`](containerd@568ce91) Make checkContainerTimestamps less strict on Windows
* [release/1.6 backport] dependency: bump go.etcd.io/bbolt to v1.3.7 ([containerd#8817](containerd#8817))
  * [`d2f47192a`](containerd@d2f4719) dependency: bump go.etcd.io/bbolt to v1.3.7
  * [`fb56dc245`](containerd@fb56dc2) [release/1.6] vendor: github.com/stretchr/testify v1.8.1
* [release/1.6 backport] Move logrus setup code to log package ([containerd#8832](containerd#8832))
  * [`7fbd5dc89`](containerd@7fbd5dc) Move logrus setup code to log package
* [release/1.6 backport] release: Add "cri-containerd.DEPRECATED.txt" in the deprecated cri-containerd-* bundles ([containerd#8820](containerd#8820))
  * [`59a143670`](containerd@59a1436) release: Add "cri-containerd.DEPRECATED.txt" in the deprecated cri-containerd-* bundles
* [release/1.6 backport] Use version 2 configuration format in docs ([containerd#8821](containerd#8821))
  * [`5b51b79e2`](containerd@5b51b79) [release/1.6] fix remaining "v1 config" plugin IDs
  * [`b7cf26d8d`](containerd@b7cf26d) docs: Fix sample config.toml syntax
  * [`fcdaf0966`](containerd@fcdaf09) docs: migrate config v1 to v2
  * [`728d5c5f0`](containerd@728d5c5) Use version 2 config and mention containerd config command
* [release/1.6] update go to go1.19.11 ([containerd#8816](containerd#8816))
  * [`81aa14718`](containerd@81aa147) [release/1.6] update go to go1.19.11
* [release/1.6] update go to go1.19.10 ([containerd#8715](containerd#8715))
  * [`17cd86629`](containerd@17cd866) [release/1.6] update go to go1.19.10
* [release/1.6 backport] bugfix(port-forward): Correctly handle known errors ([containerd#8805](containerd#8805))
  * [`fdb65f214`](containerd@fdb65f2) bugfix(port-forward): Correctly handle known errors
* [release/1.6] Resolve docker.NewResolver race condition ([containerd#8800](containerd#8800))
  * [`b5784af66`](containerd@b5784af) Change http.Header copy to builtin Clone
  * [`31c466f82`](containerd@31c466f) Resolve docker.NewResolver race condition
* [release/1.6 backport] vendor: github.com/containerd/zfs v1.1.0 ([containerd#8781](containerd#8781))
  * [`be6406ca6`](containerd@be6406c) vendor: github.com/containerd/zfs v1.1.0
  * [`9f1260074`](containerd@9f12600) [release/1.6] vendor gotest.tools/v3 v3.5.0
  * [`526e9e0ce`](containerd@526e9e0) Bump grpc to v1.50.1
  * [`0e7d2d121`](containerd@0e7d2d1) go.mod: github.com/sirupsen/logrus v1.9.0
  * [`5b153c621`](containerd@5b153c6) go.mod: github.com/moby/sys/mountinfo v0.6.2
  * [`9dee60960`](containerd@9dee609) go.mod: github.com/moby/sys/mountinfo v0.6.0
* [release/1.6 backport] seccomp: always allow name_to_handle_at ([containerd#8754](containerd#8754))
  * [`07ea7b9e7`](containerd@07ea7b9) seccomp: always allow name_to_handle_at
* [release/1.6 backport] Update ginkgo to match cri-tools' version ([containerd#8759](containerd#8759))
  * [`1dae51fed`](containerd@1dae51f) Update ginkgo to match cri-tools' version
* [release/1.6 backport] integration/client: add timeout to `TestShimOOMScore` ([containerd#8749](containerd#8749))
  * [`bd76ab978`](containerd@bd76ab9) integration/client: add timeout to `TestShimOOMScore`
* [release/1.6 backport] Adding support to run hcsshim from local clone ([containerd#8713](containerd#8713))
  * [`8e14eccb2`](containerd@8e14ecc) Adding support to run hcsshim from local clone
* [1.6] Add Fields type alias to log package ([containerd#8739](containerd#8739))
  * [`9f2cdd589`](containerd@9f2cdd5) Add Fields type alias to log package
* [release/1.6] Pinned image support ([containerd#8720](containerd#8720))
  * [`f4713aad0`](containerd@f4713aa) Pinned image support
* [release/1.6 backport] runtime/v2/runc: handle early exits w/o big locks ([containerd#8695](containerd#8695))
  * [`dbeec47b4`](containerd@dbeec47) runtime/v2/runc: handle early exits w/o big locks
* [release/1.6 backport] move up to CRI-TOOLS v1.27.0 ([containerd#7997](containerd#7997))
  * [`a8e01e40a`](containerd@a8e01e4) move to CRI-TOOLS v1.27.0
  * [`755f80698`](containerd@755f806) move up to CRI-TOOLS v1.26.0
  * [`b29cc035f`](containerd@b29cc03) bump critools into ca1571e6edd116b2c95f52e3dfa0b4779b74223a
  * [`9138999f5`](containerd@9138999) Upgrade critools from 1.24.1 to 1.25.0
* [release/1.6] cherry-pick: No more nondistributable layers in MS registry ([containerd#8691](containerd#8691))
  * [`712ff8eb3`](containerd@712ff8e) No more nondistributable layers in MS registry
* [release/1.6] Fix cpu architecture detection issue on emulated ARM platform ([containerd#8533](containerd#8533))
  * [`2b16e4bfa`](containerd@2b16e4b) Add unit test to function GetCPUVariantFromArch
  * [`106e36ec3`](containerd@106e36e) Use uname machine field to get CPU variant if fails at /proc/cpuinfo
* [release/1.6] Update lint timeout ([containerd#8679](containerd#8679))
  * [`287fdfea6`](containerd@287fdfe) Update linter timeout to match main branch
* [release/1.6 backport] task: don't `close()` io before `cancel()` ([containerd#8659](containerd#8659))
  * [`b27f7daa5`](containerd@b27f7da) task: don't `close()` io before `cancel()`
* [release/1.6] update test box to fedora 37 ([containerd#8660](containerd#8660))
  * [`8b4c69248`](containerd@8b4c692) update test box to fedora 37
* [release/1.6] Revert "Downgrade MinGW to version 10.2.0" ([containerd#8668](containerd#8668))
  * [`81d6085af`](containerd@81d6085) Revert "Downgrade MinGW to version 10.2.0"
* [release/1.6 backport] Fix panic when remote differ returns empty result ([containerd#8640](containerd#8640))
  * [`f98122378`](containerd@f981223) Fix panic when remote differ returns empty result
* [1.6] Bump x/net to 0.8 ([containerd#8642](containerd#8642))
  * [`aa53f272d`](containerd@aa53f27) Bump x/net to 0.8
* [release/1.6 backport] remotes/docker: ResolverOptions: fix deprecation comments ([containerd#8620](containerd#8620))
  * [`56ff20839`](containerd@56ff208) remotes/docker: ResolverOptions: fix deprecation comments
* [release/1.6] notify readiness when registered plugins are ready ([containerd#8583](containerd#8583))
  * [`bccaf68b7`](containerd@bccaf68) notify readiness when registered plugins are ready
* [release/1.6] Update ttrpc to 1.1.2 ([containerd#8528](containerd#8528))
  * [`1cdbbe76b`](containerd@1cdbbe7) Update ttrpc to 1.1.2
</p>
</details>

<details><summary>2 commits</summary>
<p>

* [release/1.1] Unwrap io errors in server connection receive error handling ([containerd#143](containerd/ttrpc#143))
  * [`d5f7eed`](containerd/ttrpc@d5f7eed) Unwrap io errors in server connection receive error handling
</p>
</details>

<details><summary>49 commits</summary>
<p>

* gofumpt and update status badges ([containerd#75](containerd/zfs#75))
  * [`5e3457b`](containerd/zfs@5e3457b) TestZFSUsage: use t.TempDir()
  * [`6e9c675`](containerd/zfs@6e9c675) README: update badges
  * [`ff17a79`](containerd/zfs@ff17a79) gofmt code
* go.mod: github.com/mistifyio/go-zfs/v3 v3.0.1 ([containerd#73](containerd/zfs#73))
  * [`d3485b9`](containerd/zfs@d3485b9) go.mod: github.com/mistifyio/go-zfs/v3 v3.0.1
* gha: fix golangci-lint, and upgrade to v1.52.2 ([containerd#74](containerd/zfs#74))
  * [`23c831a`](containerd/zfs@23c831a) remove pre-go1.17 build-tags, and fix missing build-tags in plugin
  * [`e5acd95`](containerd/zfs@e5acd95) gha: fix golangci-lint, upgrade to v1.52.2
* Bump github.com/containerd/containerd from 1.6.12 to 1.6.18 ([containerd#72](containerd/zfs#72))
  * [`00b96c2`](containerd/zfs@00b96c2) Bump github.com/containerd/containerd from 1.6.12 to 1.6.18
* Bump github.com/containerd/containerd from 1.6.9 to 1.6.12 ([containerd#69](containerd/zfs#69))
  * [`a099def`](containerd/zfs@a099def) Bump github.com/containerd/containerd from 1.6.9 to 1.6.12
* Add CodeQL analysis workflow ([containerd#67](containerd/zfs#67))
  * [`fee1db7`](containerd/zfs@fee1db7) Add CodeQL analysis workflow
* Update GitHub actions CI workflow ([containerd#66](containerd/zfs#66))
  * [`b8b7ab2`](containerd/zfs@b8b7ab2) Update GitHub actions CI workflow
* Upgrade compiler to Go 1.19 and update dependencies ([containerd#68](containerd/zfs#68))
  * [`3e729b3`](containerd/zfs@3e729b3) Update dependencies
  * [`3c003f8`](containerd/zfs@3c003f8) Upgrade compiler to Go 1.19
* Remove references to io/ioutil package ([containerd#65](containerd/zfs#65))
  * [`d700762`](containerd/zfs@d700762) Remove references to io/ioutil package
* Update go.mod and move to supported Go version ([containerd#62](containerd/zfs#62))
  * [`f52906e`](containerd/zfs@f52906e) Update Go version to supported version
  * [`79ca2cb`](containerd/zfs@79ca2cb) Update containerd depedency to latest
* go.mod: github.com/mistifyio/go-zfs v3.0.0 ([containerd#59](containerd/zfs#59))
  * [`2e3db29`](containerd/zfs@2e3db29) go.mod: github.com/mistifyio/go-zfs v3.0.0
* go.mod: github.com/mistifyio/go-zfs/v3 v3.0.0-20220217145925-d014733a5309 ([containerd#58](containerd/zfs#58))
  * [`d904e63`](containerd/zfs@d904e63) go.mod: github.com/mistifyio/go-zfs/v3 v3.0.0-20220217145925-d014733a5309
* Update vendoring to containerd 1.6.x ([containerd#57](containerd/zfs#57))
  * [`e021180`](containerd/zfs@e021180) Update vendoring to containerd 1.6.x
* Bump github.com/containerd/containerd from 1.5.8 to 1.5.9 ([containerd#55](containerd/zfs#55))
  * [`fc0c9a9`](containerd/zfs@fc0c9a9) Bump github.com/containerd/containerd from 1.5.8 to 1.5.9
* Bump github.com/containerd/containerd from 1.5.5 to 1.5.8 ([containerd#54](containerd/zfs#54))
  * [`5d2f28c`](containerd/zfs@5d2f28c) Bump github.com/containerd/containerd from 1.5.5 to 1.5.8
* follow-up-containerd#52: fix the order of cause in fmt.Errorf ([containerd#53](containerd/zfs#53))
  * [`b3f193d`](containerd/zfs@b3f193d) follow-up-containerd#52: fix the order of cause in fmt.Errorf
* replace pkg/errors ([containerd#52](containerd/zfs#52))
  * [`d5b0a2f`](containerd/zfs@d5b0a2f) replace pkg/errors
* Bump github.com/containerd/containerd from 1.5.2 to 1.5.4 ([containerd#51](containerd/zfs#51))
  * [`fd6afa5`](containerd/zfs@fd6afa5) Bump github.com/containerd/containerd from 1.5.2 to 1.5.4
* Bump containerd to 1.5.2 ([containerd#50](containerd/zfs#50))
  * [`aef875e`](containerd/zfs@aef875e) bump containerd to 1.5.2
* Rename branches from master to main ([containerd#49](containerd/zfs#49))
  * [`35c6af7`](containerd/zfs@35c6af7) Rename branches from master to main
* sync up with containerd 1.5 GA  ([containerd#47](containerd/zfs#47))
  * [`3d5efef`](containerd/zfs@3d5efef) vendor sync up with containerd 1.5 ga
* README.md: fix CI badge ([containerd#46](containerd/zfs#46))
  * [`0977d81`](containerd/zfs@0977d81) README.md: fix CI badge
</p>
</details>

* **github.com/containerd/ttrpc**        v1.1.1 -> v1.1.2
* **github.com/containerd/zfs**          v1.0.0 -> v1.1.0
* **github.com/emicklei/go-restful/v3**  v3.7.3 -> v3.10.1
* **github.com/google/go-cmp**           v0.5.6 -> v0.5.9
* **github.com/google/uuid**             v1.2.0 -> v1.3.0
* **github.com/mistifyio/go-zfs/v3**     v3.0.1 **_new_**
* **github.com/moby/sys/mountinfo**      v0.5.0 -> v0.6.2
* **github.com/sirupsen/logrus**         v1.8.1 -> v1.9.0
* **github.com/stretchr/testify**        v1.7.0 -> v1.8.1
* **go.etcd.io/bbolt**                   v1.3.6 -> v1.3.7
* **golang.org/x/net**                   a158d28d115b -> v0.8.0
* **golang.org/x/sys**                   8c9f86f7a55f -> v0.6.0
* **golang.org/x/term**                  03fcf44c2211 -> v0.6.0
* **golang.org/x/text**                  v0.3.7 -> v0.8.0
* **google.golang.org/grpc**             v1.47.0 -> v1.50.1
* **google.golang.org/protobuf**         v1.28.0 -> v1.28.1
* **gotest.tools/v3**                    v3.0.3 -> v3.5.0

Previous release can be found at [v1.6.21](https://github.com/containerd/containerd/releases/tag/v1.6.21)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@gazal-k gazal-k gazal-k left review comments

@AkihiroSuda AkihiroSuda AkihiroSuda left review comments

@mikebrow mikebrow mikebrow left review comments

@dmcgowan dmcgowan dmcgowan approved these changes

@estesp estesp estesp approved these changes

Assignees
No one assigned
Labels
needs-ok-to-test
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
10 participants
@mmerkes @k8s-ci-robot @AkihiroSuda @matrey @thaJeztah @samuelkarp @estesp @dmcgowan @gazal-k @mikebrow
0