cri

package
v0.12.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 28, 2026 License: Apache-2.0 Imports: 30 Imported by: 0

Documentation

Overview

Package cri provides the Kubernetes Container Runtime Interface.

Package cri provides the Kubernetes Container Runtime Interface.

server.go implements a real gRPC CRI server that exposes the RuntimeServiceServer and ImageServiceServer interfaces defined by k8s.io/cri-api. It translates between the CRI protobuf requests/responses and the existing CRIPlugin / dokiruntime.Runtime / image.Store operations.

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

This section is empty.

Types

type CRIContainer added in v0.11.0 

type CRIContainer struct {
	ID           string
	PodSandboxID string
	Name         string
	Attempt      uint32
	Image        string
	ImageRef     string
	ImageID      string
	Args         []string
	Env          []string
	WorkingDir   string
	Labels       map[string]string
	Annotations  map[string]string
	Mounts       []common.Mount
	CreatedAt    int64
	LogPath      string
}

CRIContainer holds CRI-specific container metadata that is not stored in the lower-level runtime.ContainerState (e.g. pod sandbox association and CRI ContainerMetadata such as name/attempt).

type CRIPlugin 

type CRIPlugin struct {
	// contains filtered or unexported fields
}

CRIPlugin implements the Kubernetes Container Runtime Interface. This provides a K8s-compatible container runtime via the CRI gRPC protocol.

func NewCRIPlugin 

func NewCRIPlugin(rt *runtime.Runtime, img *image.Store, net *network.Manager) *CRIPlugin

NewCRIPlugin creates a new CRI plugin.

func (*CRIPlugin) CreateContainer 

func (c *CRIPlugin) CreateContainer(cc *CRIContainer) error

CreateContainer creates a container within a pod sandbox but does NOT start it. The CRI gRPC API separates CreateContainer and StartContainer, so the caller is responsible for invoking StartContainer afterwards.

func (*CRIPlugin) GetContainer added in v0.11.0 

func (c *CRIPlugin) GetContainer(containerID string) (*CRIContainer, error)

GetContainer returns the CRI metadata for a container.

func (*CRIPlugin) ImageStatus 

func (c *CRIPlugin) ImageStatus(imageName string) (*common.ImageInfo, error)

ImageStatus returns the status of an image.

func (*CRIPlugin) IsCRIReady 

func (c *CRIPlugin) IsCRIReady() bool

IsCRIReady checks if CRI plugin is ready.

func (*CRIPlugin) ListContainers added in v0.11.0 

func (c *CRIPlugin) ListContainers(podID string) []*CRIContainer

ListContainers returns the CRI metadata for all containers, optionally filtered by pod sandbox ID. An empty podID returns every container.

func (*CRIPlugin) ListImages 

func (c *CRIPlugin) ListImages() ([]common.ImageInfo, error)

ListImages lists all available images.

func (*CRIPlugin) ListPodSandbox 

func (c *CRIPlugin) ListPodSandbox() []*PodSandbox

ListPodSandbox lists all pod sandboxes.

func (*CRIPlugin) PodSandboxStatus 

func (c *CRIPlugin) PodSandboxStatus(id string) (*PodSandbox, error)

PodSandboxStatus returns the status of a pod sandbox.

func (*CRIPlugin) PullImage 

func (c *CRIPlugin) PullImage(imageName string) error

PullImage pulls an image.

func (*CRIPlugin) RemoveContainer added in v0.11.0 

func (c *CRIPlugin) RemoveContainer(containerID string) error

RemoveContainer removes a container. If it is still running it is forcibly removed. This call is idempotent.

func (*CRIPlugin) RemoveImage 

func (c *CRIPlugin) RemoveImage(imageName string) error

RemoveImage removes an image.

func (*CRIPlugin) RemovePodSandbox 

func (c *CRIPlugin) RemovePodSandbox(id string) error

RemovePodSandbox removes a pod sandbox.

func (*CRIPlugin) RunPodSandbox 

func (c *CRIPlugin) RunPodSandbox(id, name, namespace string, labels, annotations map[string]string) (*PodSandbox, error)

RunPodSandbox creates and starts a pod sandbox.

func (*CRIPlugin) StartContainer added in v0.11.0 

func (c *CRIPlugin) StartContainer(containerID string) error

StartContainer starts a previously created container.

func (*CRIPlugin) StopContainer added in v0.11.0 

func (c *CRIPlugin) StopContainer(containerID string, timeout int) error

StopContainer stops a running container with a grace period (seconds).

func (*CRIPlugin) StopPodSandbox 

func (c *CRIPlugin) StopPodSandbox(id string) error

StopPodSandbox stops a pod sandbox.

func (*CRIPlugin) UpdateResources added in v0.12.0 

func (c *CRIPlugin) UpdateResources(containerID string, resources *runtime.LinuxResources) error

UpdateResources updates cgroup limits for a running container. Implements CRI UpdateContainerResources semantics: best-effort atomic with rollback on any controller failure.

func (*CRIPlugin) Version 

func (c *CRIPlugin) Version() map[string]string

Version returns CRI version info.

type CRIServer added in v0.11.0 

type CRIServer struct {
	v1.UnimplementedRuntimeServiceServer
	v1.UnimplementedImageServiceServer
	// contains filtered or unexported fields
}

CRIServer is a gRPC server implementing the Kubernetes Container Runtime Interface (CRI) v1 RuntimeService and ImageService.

It embeds the generated Unimplemented* servers by value (required for forward compatibility) and delegates the actual container/image work to the existing CRIPlugin, which wraps dokiruntime.Runtime, image.Store and network.Manager.

func NewCRIServer added in v0.11.0 

func NewCRIServer(plugin *CRIPlugin) *CRIServer

NewCRIServer creates a new CRIServer backed by the given CRIPlugin. It wires up the built-in WebSocket streamer so Exec/Attach actually stream, instead of returning codes.Unimplemented as they did while the streamer was dead code.

func (*CRIServer) Attach added in v0.11.0 

func (s *CRIServer) Attach(ctx context.Context, req *v1.AttachRequest) (*v1.AttachResponse, error)

Attach prepares a streaming endpoint to attach to a container.

func (*CRIServer) CheckpointContainer added in v0.11.0 

func (s *CRIServer) CheckpointContainer(ctx context.Context, req *v1.CheckpointContainerRequest) (*v1.CheckpointContainerResponse, error)

CheckpointContainer checkpoints a container using CRIU. This is a best-effort implementation that shells out to the criu binary (or `podman container checkpoint` if available). On hosts without CRIU, returns Unimplemented.

func (*CRIServer) Close added in v0.11.0 

func (s *CRIServer) Close() error

Close gracefully stops the gRPC server, letting in-flight RPCs complete.

func (*CRIServer) ContainerStats added in v0.11.0 

func (s *CRIServer) ContainerStats(ctx context.Context, req *v1.ContainerStatsRequest) (*v1.ContainerStatsResponse, error)

ContainerStats returns stats of the container.

func (*CRIServer) ContainerStatus added in v0.11.0 

func (s *CRIServer) ContainerStatus(ctx context.Context, req *v1.ContainerStatusRequest) (*v1.ContainerStatusResponse, error)

ContainerStatus returns the status of the container.

func (*CRIServer) CreateContainer added in v0.11.0 

func (s *CRIServer) CreateContainer(ctx context.Context, req *v1.CreateContainerRequest) (*v1.CreateContainerResponse, error)

CreateContainer creates a new container in the specified PodSandbox. The container is created but NOT started; StartContainer must be called separately.

func (*CRIServer) Exec added in v0.11.0 

func (s *CRIServer) Exec(ctx context.Context, req *v1.ExecRequest) (*v1.ExecResponse, error)

Exec prepares a streaming endpoint to execute a command in the container. The URL is on a per-call ephemeral HTTP server; kubelet opens it with the returned token.

func (*CRIServer) ExecSync added in v0.11.0 

func (s *CRIServer) ExecSync(ctx context.Context, req *v1.ExecSyncRequest) (*v1.ExecSyncResponse, error)

ExecSync runs a command in a container synchronously and returns the output. Per CVE-2022-1708 / CVE-2022-31030, stdout and stderr are capped at 16MB each; if the cap is hit, exit code is 0xff.

func (*CRIServer) GetContainerEvents added in v0.11.0 

func (s *CRIServer) GetContainerEvents(*v1.GetEventsRequest, grpc.ServerStreamingServer[v1.ContainerEventResponse]) error

GetContainerEvents gets container events from the CRI dokiruntime.

func (*CRIServer) ImageFsInfo added in v0.11.0 

func (s *CRIServer) ImageFsInfo(ctx context.Context, req *v1.ImageFsInfoRequest) (*v1.ImageFsInfoResponse, error)

ImageFsInfo returns information about the filesystem used to store images. kubelet 1.29+ requires this; without it the node is marked NotReady.

func (*CRIServer) ImageStatus added in v0.11.0 

func (s *CRIServer) ImageStatus(ctx context.Context, req *v1.ImageStatusRequest) (*v1.ImageStatusResponse, error)

ImageStatus returns the status of the image. If the image is not present, returns a response with Image set to nil (per CRI spec).

func (*CRIServer) ListContainerStats added in v0.11.0 

func (s *CRIServer) ListContainerStats(ctx context.Context, req *v1.ListContainerStatsRequest) (*v1.ListContainerStatsResponse, error)

ListContainerStats returns stats for all running containers matching the filter.

func (*CRIServer) ListContainers added in v0.11.0 

func (s *CRIServer) ListContainers(ctx context.Context, req *v1.ListContainersRequest) (*v1.ListContainersResponse, error)

ListContainers lists all containers by filters.

func (*CRIServer) ListImages added in v0.11.0 

func (s *CRIServer) ListImages(ctx context.Context, req *v1.ListImagesRequest) (*v1.ListImagesResponse, error)

ListImages lists existing images.

func (*CRIServer) ListMetricDescriptors added in v0.11.0 

func (s *CRIServer) ListMetricDescriptors(ctx context.Context, req *v1.ListMetricDescriptorsRequest) (*v1.ListMetricDescriptorsResponse, error)

ListMetricDescriptors gets the descriptors for the metrics.

func (*CRIServer) ListPodSandbox added in v0.11.0 

func (s *CRIServer) ListPodSandbox(ctx context.Context, req *v1.ListPodSandboxRequest) (*v1.ListPodSandboxResponse, error)

ListPodSandbox returns a list of PodSandboxes, optionally filtered.

func (*CRIServer) ListPodSandboxMetrics added in v0.11.0 

func (s *CRIServer) ListPodSandboxMetrics(ctx context.Context, req *v1.ListPodSandboxMetricsRequest) (*v1.ListPodSandboxMetricsResponse, error)

ListPodSandboxMetrics gets pod sandbox metrics from the CRI Runtime. Implements the v1.32+ PodSandboxMetrics spec.

func (*CRIServer) ListPodSandboxStats added in v0.11.0 

func (s *CRIServer) ListPodSandboxStats(ctx context.Context, req *v1.ListPodSandboxStatsRequest) (*v1.ListPodSandboxStatsResponse, error)

ListPodSandboxStats returns stats of the pod sandboxes matching a filter.

func (*CRIServer) ListenAndServe added in v0.11.0 

func (s *CRIServer) ListenAndServe(socketPath string) error

ListenAndServe creates a Unix socket listener at socketPath, registers the RuntimeService and ImageService, and serves gRPC requests. It blocks until the server is stopped via Close or the listener is closed.

func (*CRIServer) PodSandboxStats added in v0.11.0 

func (s *CRIServer) PodSandboxStats(ctx context.Context, req *v1.PodSandboxStatsRequest) (*v1.PodSandboxStatsResponse, error)

PodSandboxStats returns stats of the pod sandbox.

func (*CRIServer) PodSandboxStatus added in v0.11.0 

func (s *CRIServer) PodSandboxStatus(ctx context.Context, req *v1.PodSandboxStatusRequest) (*v1.PodSandboxStatusResponse, error)

PodSandboxStatus returns the status of the PodSandbox.

func (*CRIServer) PortForward added in v0.11.0 

func (s *CRIServer) PortForward(ctx context.Context, req *v1.PortForwardRequest) (*v1.PortForwardResponse, error)

PortForward prepares a streaming endpoint to forward ports from a PodSandbox.

func (*CRIServer) PullImage added in v0.11.0 

func (s *CRIServer) PullImage(ctx context.Context, req *v1.PullImageRequest) (*v1.PullImageResponse, error)

PullImage pulls an image with authentication config.

func (*CRIServer) RemoveContainer added in v0.11.0 

func (s *CRIServer) RemoveContainer(ctx context.Context, req *v1.RemoveContainerRequest) (*v1.RemoveContainerResponse, error)

RemoveContainer removes the container. Idempotent.

func (*CRIServer) RemoveImage added in v0.11.0 

func (s *CRIServer) RemoveImage(ctx context.Context, req *v1.RemoveImageRequest) (*v1.RemoveImageResponse, error)

RemoveImage removes the image. Idempotent.

func (*CRIServer) RemovePodSandbox added in v0.11.0 

func (s *CRIServer) RemovePodSandbox(ctx context.Context, req *v1.RemovePodSandboxRequest) (*v1.RemovePodSandboxResponse, error)

RemovePodSandbox removes the sandbox. Idempotent.

func (*CRIServer) ReopenContainerLog added in v0.11.0 

func (s *CRIServer) ReopenContainerLog(ctx context.Context, req *v1.ReopenContainerLogRequest) (*v1.ReopenContainerLogResponse, error)

ReopenContainerLog asks the runtime to reopen the container log file. Used by kubelet during log rotation.

func (*CRIServer) RunPodSandbox added in v0.11.0 

func (s *CRIServer) RunPodSandbox(ctx context.Context, req *v1.RunPodSandboxRequest) (*v1.RunPodSandboxResponse, error)

RunPodSandbox creates and starts a pod-level sandbox.

func (*CRIServer) RuntimeConfig added in v0.11.0 

func (s *CRIServer) RuntimeConfig(ctx context.Context, req *v1.RuntimeConfigRequest) (*v1.RuntimeConfigResponse, error)

RuntimeConfig returns configuration information of the dokiruntime. kubelet 1.28+ uses this to discover the cgroup driver instead of autodetecting.

func (*CRIServer) StartContainer added in v0.11.0 

func (s *CRIServer) StartContainer(ctx context.Context, req *v1.StartContainerRequest) (*v1.StartContainerResponse, error)

StartContainer starts the container.

func (*CRIServer) Status added in v0.11.0 

func (s *CRIServer) Status(ctx context.Context, req *v1.StatusRequest) (*v1.StatusResponse, error)

Status returns the status of the dokiruntime. Includes RuntimeHandlers (one per supported ExecutionMode) and RuntimeFeatures so that kubelet 1.36+ can advertise the supported feature set.

func (*CRIServer) StopContainer added in v0.11.0 

func (s *CRIServer) StopContainer(ctx context.Context, req *v1.StopContainerRequest) (*v1.StopContainerResponse, error)

StopContainer stops a running container with a grace period. Idempotent.

func (*CRIServer) StopPodSandbox added in v0.11.0 

func (s *CRIServer) StopPodSandbox(ctx context.Context, req *v1.StopPodSandboxRequest) (*v1.StopPodSandboxResponse, error)

StopPodSandbox stops any running process in the sandbox and reclaims network resources. Idempotent.

func (*CRIServer) StreamContainerStats added in v0.11.0 

func (s *CRIServer) StreamContainerStats(req *v1.StreamContainerStatsRequest, stream grpc.ServerStreamingServer[v1.StreamContainerStatsResponse]) error

StreamContainerStats is a streaming alternative to ListContainerStats. Used when kubelet has the CRIListStreaming feature gate enabled.

func (*CRIServer) StreamContainers added in v0.11.0 

func (s *CRIServer) StreamContainers(*v1.StreamContainersRequest, grpc.ServerStreamingServer[v1.StreamContainersResponse]) error

StreamContainers is a streaming alternative to ListContainers.

func (*CRIServer) StreamImages added in v0.11.0 

func (s *CRIServer) StreamImages(*v1.StreamImagesRequest, grpc.ServerStreamingServer[v1.StreamImagesResponse]) error

StreamImages is a streaming alternative to ListImages.

func (*CRIServer) StreamPodSandboxMetrics added in v0.11.0 

func (s *CRIServer) StreamPodSandboxMetrics(*v1.StreamPodSandboxMetricsRequest, grpc.ServerStreamingServer[v1.StreamPodSandboxMetricsResponse]) error

StreamPodSandboxMetrics is a streaming alternative to ListPodSandboxMetrics.

func (*CRIServer) StreamPodSandboxStats added in v0.11.0 

func (s *CRIServer) StreamPodSandboxStats(*v1.StreamPodSandboxStatsRequest, grpc.ServerStreamingServer[v1.StreamPodSandboxStatsResponse]) error

StreamPodSandboxStats is a streaming alternative to ListPodSandboxStats.

func (*CRIServer) StreamPodSandboxes added in v0.11.0 

func (s *CRIServer) StreamPodSandboxes(*v1.StreamPodSandboxesRequest, grpc.ServerStreamingServer[v1.StreamPodSandboxesResponse]) error

StreamPodSandboxes is a streaming alternative to ListPodSandbox.

func (*CRIServer) UpdateContainerResources added in v0.11.0 

func (s *CRIServer) UpdateContainerResources(ctx context.Context, req *v1.UpdateContainerResourcesRequest) (*v1.UpdateContainerResourcesResponse, error)

UpdateContainerResources updates container resource limits synchronously. Implements CRI v1.25+ semantics: all-or-nothing, transaction rollback on partial failure.

func (*CRIServer) UpdatePodSandboxResources added in v0.11.0 

func (s *CRIServer) UpdatePodSandboxResources(ctx context.Context, req *v1.UpdatePodSandboxResourcesRequest) (*v1.UpdatePodSandboxResourcesResponse, error)

UpdatePodSandboxResources updates the PodSandboxConfig with pod-level resource configuration. Used by In-Place Pod Vertical Scaling (KEP-5407, GA in 1.33).

func (*CRIServer) UpdateRuntimeConfig added in v0.11.0 

func (s *CRIServer) UpdateRuntimeConfig(ctx context.Context, req *v1.UpdateRuntimeConfigRequest) (*v1.UpdateRuntimeConfigResponse, error)

UpdateRuntimeConfig updates the runtime configuration based on the request. kubelet uses this to push PodCIDR and other network settings at startup.

func (*CRIServer) Version added in v0.11.0 

func (s *CRIServer) Version(ctx context.Context, req *v1.VersionRequest) (*v1.VersionResponse, error)

Version returns the runtime name, runtime version, and runtime API version.

type PodSandbox 

type PodSandbox struct {
	ID           string            `json:"id"`
	Name         string            `json:"name"`
	Namespace    string            `json:"namespace"`
	UID          string            `json:"uid"`
	CreatedAt    int64             `json:"created_at"`
	Labels       map[string]string `json:"labels"`
	Annotations  map[string]string `json:"annotations"`
	Containers   []string          `json:"containers"`
	Hostname     string            `json:"hostname"`
	LogDirectory string            `json:"log_directory"`
	State        string            `json:"state"`
	IP           string            `json:"ip"`
	Network      string            `json:"network"`
}

PodSandbox represents a Kubernetes Pod.

type StreamRequest added in v0.12.0 

type StreamRequest struct {
	Op         string // "exec" | "attach" | "portforward"
	ResourceID string // container id (exec/attach) or pod id (portforward)
	Cmd        []string
	Tty        bool
	Stdin      bool
	Stdout     bool
	Stderr     bool
	Ports      []int32
}

StreamRequest describes a reserved streaming operation. It carries the argv and stream selection so the handler can reconstruct the runtime call without squashing the command into a single space-joined string.

type Streamer added in v0.12.0 

type Streamer interface {
	Reserve(ctx context.Context, req StreamRequest) (token string, err error)
	Addr() (host string, port int)
}

Streamer manages ephemeral HTTP streaming endpoints for exec, attach, and portforward operations. Each call to Reserve picks an available port, starts a one-shot HTTP server, and returns the allocated port number.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.