Akihiro Suda

`Import()` can't import a Docker v1 archive without `repositores` file (i.e., `docker save` with explicit digest)

4

### Description `Import()` can't import a Docker v1 archive without `repositores` file (i.e., `docker save` with explicit digest) ### Steps to reproduce the issue ```console $ docker save ubuntu:21.10@sha256:cc8f713078bfddfe9ace41e29eb73298f52b2c958ccacd1b376b9378e20906ef -o...

DockerResolver: support immutable tags

4

The tag part in `example.com/hello-world:42.0@sha256:deadbeef` had been just ignored. The tag was never verified with the specified digest because the tag was considered to be mutable. Even the existence of...

TestCheckpoint and TestUsernsCheckpoint are failing on centos-stream-9 (Segmentation fault)

5

https://cirrus-ci.com/task/4890404691640320?logs=unit_tests#L1358 ``` checkpoint_test.go:163: (00.023368) pie: 1: restoring lsm profile (current) unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 checkpoint_test.go:163: (00.023421) Error (criu/cr-restore.c:1510): 65440 stopped by signal 11: Segmentation fault checkpoint_test.go:163: (00.023704) mnt: Switching to new ns to...

Add `features.md` to formalize the `runc features` JSON

11

Add `features.md` and `features-linux.md`, to formalize the `runc features` JSON that was introduced in runc v1.1.0-rc1. A runtime caller MAY use this JSON to detect the features implemented by the...

seccomp listener: define the max size of Container Process State messages

4

https://github.com/opencontainers/runtime-spec/blob/8958f93039ab90be53d803cd7e231a775f644451/config-linux.md#the-container-process-state Currently we don't have any definition of the message size. I suggest to limit the size to be 4096 bytes corresponding to https://github.com/opencontainers/runc/blob/v1.1.0/contrib/cmd/seccompagent/seccompagent.go#L78 , but that may result in...

Make GID optional to allow retaining `overflowgid` (useful for exposing `crw-rw----` devices to Rootless Containers)

2

https://github.com/opencontainers/runtime-spec/blob/v1.0.2/config.md In the current spec, `.process.user.gid` is defined as a `REQUIRED` attribute. I suggest makng this attribute `OPTIONAL` to allow retaining `overflowgid`, by avoiding calling `setgroups(2)`. When `gid` is unset,...

Add systemd cgroup path spec

2

https://github.com/opencontainers/runtime-spec/blob/master/config-linux.md#cgroups-path The systemd cgroup path convention implemented in runc/crun should be added to the spec. This convention is becoming important for cgroup v2, because rootless containers depends on systemd for...

weight, leafWeight, and weightDevice are removed in kernel 5.0 https://github.com/torvalds/linux/commit/f382fb0bcef4c37dc049e9f6963e3baf204d815c

Proposal: descriptor: "dependency" property

5

A blob referenced via [descriptor](https://github.com/opencontainers/image-spec/blob/master/descriptor.md) MAY be a fine-graind CAS archive. e.g. continuity manifest. (WIP: https://github.com/opencontainers/image-spec/issues/577) This might make it difficult to implement "gc" for blob store, because the actual...