[pull] main from containerd:main

.dockerignore

@@ -5,6 +5,3 @@ _output
 
 # golangci-lint
 /build
-
-# vagrant
-/.vagrant

.github/dependabot.yml

@@ -23,8 +23,9 @@ updates:
           - "github.com/moby/sys/*"
       docker:
         patterns:
-          - "github.com/docker/docker"
           - "github.com/docker/cli"
+          - "github.com/moby/moby/client"
+          - "github.com/moby/moby/v2"
       containerd:
         patterns:
           - "github.com/containerd/containerd"

.github/workflows/flaky-test-dashboard.yml

@@ -0,0 +1,73 @@
+# This workflow collects the test failures that the CI reported over the last week, and publishes
+# them to a single GitHub issue: the "flaky test dashboard", containerd/nerdctl#5202.
+#
+# Everything reusable lives in the mod/soigneur action: the data source is the archived
+# logs of the test runs, in which hack/github/gotestsum-reporter.sh left one marker line per
+# failing test, so there is no database, no test result artifact, and no server involved.
+# See docs/testing/flaky.md.
+name: flaky-test-dashboard
+
+on:
+  schedule:
+    # Every Monday at 07:00 UTC: a quiet hour, since collecting a week does download the logs of
+    # every test run of that week (about 50 MB, and one API request per run).
+    - cron: "0 7 * * 1"
+  workflow_dispatch:
+    inputs:
+      days:
+        description: "Size of the window to report on, in days"
+        required: false
+        default: "7"
+        type: string
+      branch:
+        description: "Branch to report on"
+        required: false
+        default: "main"
+        type: string
+      publish:
+        description: "Update the dashboard issue (otherwise, only write to the run summary)"
+        required: false
+        default: true
+        type: boolean
+
+permissions:
+  contents: read
+
+# The dashboard is a single issue: two runs rewriting it, and commenting on it, at the same time
+# would be visible. Queue them instead.
+concurrency:
+  group: flaky-test-dashboard
+  cancel-in-progress: false
+
+jobs:
+  dashboard:
+    name: "collect and publish"
+    # Never run on forks: this would open an issue in the fork.
+    if: ${{ github.repository == 'containerd/nerdctl' }}
+    runs-on: ubuntu-26.04
+    timeout-minutes: 45
+    permissions:
+      contents: read  # fetch the action from this repository
+      actions: read  # list the workflow runs, and download their logs
+      issues: write  # create, and update, the dashboard issue
+
+    steps:
+      # `$/` resolves the action from this repository at the ref the workflow runs at, so there
+      # is nothing to check out, and no working tree that a previous step could have altered.
+      - name: "Run"
+        uses: $/mod/soigneur
+        with:
+          # https://github.com/containerd/nerdctl/issues/5202 is *the* dashboard: its description
+          # is rewritten, and the digest posted as a comment. Nothing ever opens an issue.
+          issue-number: "5202"
+          branch: ${{ inputs.branch || 'main' }}
+          days: ${{ inputs.days || '7' }}
+          # The other workflows have no test to report on, and downloading their logs would only
+          # spend requests. Keep this in sync when a test workflow is added.
+          workflows: "workflow-test.yml,workflow-flaky.yml,workflow-tigron.yml"
+          # For a schedule, `inputs.publish` is empty, and publishing is what the schedule is for.
+          publish: ${{ inputs.publish || github.event_name == 'schedule' }}
+          docs-url: "https://github.com/containerd/nerdctl/blob/main/docs/testing/flaky.md"
+          footer-notes: |
+            - Only the integration suites report per-test data: the unit tests, Windows, and
+              FreeBSD do not run the reporter.

.github/workflows/ghcr-image-build-and-publish.yml

@@ -24,26 +24,29 @@ env:
 jobs:
   build:
 
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     permissions:
       contents: read
       packages: write
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          persist-credentials: false
 
+      # FIXME: setup-qemu-action is depended by `gomodjail pack`
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392  # v3.6.0
+        uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1  # v4.4.0
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2  # v3.10.0
+        uses: docker/setup-buildx-action@594f3bf4285d9ea8dc53c9a0c9c4092420091003  # v4.4.0
 
       # Login against a Docker registry except on PR
       # https://github.com/docker/login-action
       - name: Log into registry ${{ env.REGISTRY }}
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772  # v3.4.0
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f  # v4.6.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
@@ -53,17 +56,33 @@ jobs:
       # https://github.com/docker/metadata-action
       - name: Extract Docker metadata
         id: meta
-        uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804  # v5.7.0
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302  # v6.2.0
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
 
+      # Build the image for the host platform and load it into Docker, to smoke test
+      # it before the multi-platform image is built and published
+      - name: Build Docker image for the smoke test
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc  # v7.4.0
+        with:
+          context: .
+          load: true
+          tags: nerdctl-smoke-test
+          secrets: |
+            github_token=${{ secrets.GITHUB_TOKEN }}
+
+      - name: Smoke test
+        run: docker run -t --rm --privileged nerdctl-smoke-test nerdctl run --rm hello-world
+
       # Build and push Docker image with Buildx (don't push on PR)
       # https://github.com/docker/build-push-action
       - name: Build and push Docker image
-        uses: docker/build-push-action@14487ce63c7a62a4a324b0bfb37086795e31c6c1  # v6.16.0
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc  # v7.4.0
         with:
           context: .
           platforms: linux/amd64,linux/arm64
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
+          secrets: |
+            github_token=${{ secrets.GITHUB_TOKEN }}

.github/workflows/job-build.yml

@@ -35,12 +35,15 @@ jobs:
 
     steps:
       - name: "Init: checkout"
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           fetch-depth: 1
+          persist-credentials: false
 
       - if: ${{ inputs.canary }}
         name: "Init (canary): retrieve GO_VERSION"
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           . ./hack/github/action-helpers.sh
           latest_go="$(. ./hack/provisioning/version/fetch.sh; go::canary::for::go-setup)"
@@ -50,7 +53,7 @@ jobs:
 
       - if: ${{ env.GO_VERSION != '' }}
         name: "Init: install go"
-        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5  # v5.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e  # v7.0.0
         with:
           go-version: ${{ env.GO_VERSION }}
           check-latest: true
@@ -70,6 +73,8 @@ jobs:
             local goarm="${3:-}"
             local result
 
+            GOOS="$goos" GOARCH="$goarch" GOARM="$goarm" go build ./examples/...
+
             github::timer::begin
 
             GOOS="$goos" GOARCH="$goarch" GOARM="$goarm" make binaries \
@@ -88,11 +93,21 @@ jobs:
           build linux arm64
           build windows
           build freebsd
+          # These architectures are not released, but we still verify that we can at least compile
           build darwin
           build linux arm 6
-          # These architectures are not released, but we still verify that we can at least compile
+          build linux loong64
           build linux ppc64le
           build linux riscv64
           build linux s390x
 
           [ ! "$failure" ] || exit 1
+
+      - if: ${{ env.GO_VERSION != '' }}
+        name: "Run: make binaries with custom BUILDTAGS"
+        run: |
+          set -eux
+          # no_ipfs: make sure it does not incur any IPFS-related dependency
+          go mod vendor
+          rm -rf vendor/github.com/ipfs vendor/github.com/multiformats
+          BUILDTAGS=no_ipfs make binaries

.github/workflows/job-lint-deps.yml

@@ -0,0 +1,66 @@
+# This job runs the linters that vet the dependency tree declared in go.mod.
+#
+# - gosocialcheck reports the dependencies which do not appear to be adopted by a trusted
+#   project (CNCF Graduated). Modules that are trusted anyway are annotated
+#   `gosocialcheck:trusted` in go.mod.
+#   https://github.com/AkihiroSuda/gosocialcheck
+#   This is advisory, not a gate: `--gha` reports the findings as annotations on the run and
+#   on the PR, and always exits 0.
+#   To run locally, use `make lint-gosocialcheck` (without `--gha`, so it does exit non-zero).
+name: job-lint-deps
+
+on:
+  workflow_call:
+    inputs:
+      timeout:
+        required: true
+        type: number
+      go-version:
+        required: true
+        type: string
+      runner:
+        required: true
+        type: string
+
+env:
+  GOTOOLCHAIN: local
+
+jobs:
+  lint-deps:
+    name: "dependencies"
+    timeout-minutes: ${{ inputs.timeout }}
+    runs-on: ${{ inputs.runner }}
+    defaults:
+      run:
+        shell: bash
+
+    steps:
+      - name: "Init: checkout"
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          # gosocialcheck's `--gha` fetches the base branch on demand to rank the findings whose
+          # go.sum line changed in the PR first, so a shallow checkout is enough.
+          fetch-depth: 1
+          persist-credentials: false
+
+      - name: "Init: install go"
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e  # v7.0.0
+        with:
+          go-version: ${{ inputs.go-version }}
+          check-latest: true
+          # The calling workflow also runs on push, so the setup-go cache is disabled
+          # for zizmor's cache-poisoning audit
+          cache: false
+
+      - name: "Init: install dev-tools"
+        run: |
+          echo "::group:: make install-dev-tools"
+          make install-dev-tools
+          echo "::endgroup::"
+
+      - name: "Run: gosocialcheck"
+        env:
+          # gosocialcheck queries the GitHub API, which is heavily rate-limited when anonymous
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          NO_COLOR=true make lint-gosocialcheck GOSOCIALCHECK_FLAGS=--gha

.github/workflows/job-lint-go.yml

@@ -39,12 +39,15 @@ jobs:
 
     steps:
       - name: "Init: checkout"
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           fetch-depth: 1
+          persist-credentials: false
 
       - if: ${{ inputs.canary }}
         name: "Init (canary): retrieve GO_VERSION"
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           latest_go="$(. ./hack/provisioning/version/fetch.sh; go::canary::for::go-setup)"
           printf "GO_VERSION=%s\n" "$latest_go" >> "$GITHUB_ENV"
@@ -53,7 +56,7 @@ jobs:
 
       - if: ${{ env.GO_VERSION != '' }}
         name: "Init: install go"
-        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5  # v5.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e  # v7.0.0
         with:
           go-version: ${{ env.GO_VERSION }}
           check-latest: true
@@ -72,5 +75,7 @@ jobs:
           if [ "${{ inputs.canary }}" == "true" ]; then
             NO_COLOR=true make lint-go-all
           else
-            NO_COLOR=true GOOS="${{ inputs.goos }}" make lint-go
+            NO_COLOR=true GOOS="${INPUTS_GOOS}" make lint-go
           fi
+        env:
+          INPUTS_GOOS: ${{ inputs.goos }}

.github/workflows/job-lint-other.yml

@@ -25,9 +25,10 @@ jobs:
 
     steps:
       - name: "Init: checkout"
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           fetch-depth: 1
+          persist-credentials: false
 
       - name: "Run: yaml"
         run: |

.github/workflows/job-lint-project.yml

@@ -30,27 +30,31 @@ jobs:
 
     steps:
       - name: "Init: checkout"
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           fetch-depth: 100
           path: src/github.com/containerd/nerdctl
+          persist-credentials: false
 
       - name: "Init: install go"
-        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5  # v5.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e  # v7.0.0
         with:
           go-version: ${{ inputs.go-version }}
           check-latest: true
           cache-dependency-path: src/github.com/containerd/nerdctl
 
       - name: "Run"
-        uses: containerd/project-checks@d7751f3c375b8fe4a84c02a068184ee4c1f59bc4  # v1.2.2
+        uses: containerd/project-checks@9d887fad80ae4e40d6f10a68529082e7fc06a9af  # v1.2.3
         with:
           working-directory: src/github.com/containerd/nerdctl
           repo-access-token: ${{ secrets.GITHUB_TOKEN }}
           # go-licenses-ignore is set because go-licenses cannot detect the license of the following package:
           # * go-base36: Apache-2.0 OR MIT (https://github.com/multiformats/go-base36/blob/master/LICENSE.md)
+          # * filepath-securejoin: MPL-2.0 AND BSD-3-Clause, exceptionally approved by CNCF
+          #   (https://github.com/cncf/foundation/issues/1154#issuecomment-3562385979)
           #
           # The list of the CNCF-approved licenses can be found here:
           # https://github.com/cncf/foundation/blob/main/allowed-third-party-license-policy.md
           go-licenses-ignore: |
             github.com/multiformats/go-base36
+            github.com/cyphar/filepath-securejoin