Help us shape the future of Go! Take the 2026 Go Developer Survey

cri

package
v0.12.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 28, 2026 License: Apache-2.0 Imports: 30 Imported by: 0

Documentation

Overview

Package cri provides the Kubernetes Container Runtime Interface.

Package cri provides the Kubernetes Container Runtime Interface.

server.go implements a real gRPC CRI server that exposes the RuntimeServiceServer and ImageServiceServer interfaces defined by k8s.io/cri-api. It translates between the CRI protobuf requests/responses and the existing CRIPlugin / dokiruntime.Runtime / image.Store operations.

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

This section is empty.

Types

type CRIContainer added in v0.11.0 

type CRIContainer struct {
	ID           string
	PodSandboxID string
	Name         string
	Attempt      uint32
	Image        string
	ImageRef     string
	ImageID      string
	Args         []string
	Env          []string
	WorkingDir   string
	Labels       map[string]string
	Annotations  map[string]string
	Mounts       []common.Mount
	CreatedAt    int64
	LogPath      string
}

CRIContainer holds CRI-specific container metadata that is not stored in the lower-level runtime.ContainerState (e.g. pod sandbox association and CRI ContainerMetadata such as name/attempt).

type CRIPlugin 

type CRIPlugin struct {
	// contains filtered or unexported fields
}

CRIPlugin implements the Kubernetes Container Runtime Interface. This provides a K8s-compatible container runtime via the CRI gRPC protocol.

func NewCRIPlugin 

func NewCRIPlugin(rt *runtime.Runtime, img *image.Store, net *network.Manager) *CRIPlugin

NewCRIPlugin creates a new CRI plugin.

func (*CRIPlugin) CreateContainer 

func (c *CRIPlugin) CreateContainer(cc *CRIContainer) error

CreateContainer creates a container within a pod sandbox but does NOT start it. The CRI gRPC API separates CreateContainer and StartContainer, so the caller is responsible for invoking StartContainer afterwards.

func (*CRIPlugin) GetContainer added in v0.11.0 

func (c *CRIPlugin) GetContainer(containerID string) (*CRIContainer, error)

GetContainer returns the CRI metadata for a container.

func (*CRIPlugin) ImageStatus 

func (c *CRIPlugin) ImageStatus(imageName string) (*common.ImageInfo, error)

ImageStatus returns the status of an image.

func (*CRIPlugin) IsCRIReady 

func (c *CRIPlugin) IsCRIReady() bool

IsCRIReady checks if CRI plugin is ready.

func (*CRIPlugin) ListContainers added in v0.11.0 

func (c *CRIPlugin) ListContainers(podID string) []*CRIContainer

ListContainers returns the CRI metadata for all containers, optionally filtered by pod sandbox ID. An empty podID returns every container.

func (*CRIPlugin) ListImages 

func (c *CRIPlugin) ListImages() ([]common.ImageInfo, error)

ListImages lists all available images.

func (*CRIPlugin) ListPodSandbox 

func (c *CRIPlugin) ListPodSandbox() []*PodSandbox

ListPodSandbox lists all pod sandboxes.

func (*CRIPlugin) PodSandboxStatus 

func (c *CRIPlugin) PodSandboxStatus(id string) (*PodSandbox, error)

PodSandboxStatus returns the status of a pod sandbox.

func (*CRIPlugin) PullImage 

func (c *CRIPlugin) PullImage(imageName string) error

PullImage pulls an image.

func (*CRIPlugin) RemoveContainer added in v0.11.0 

func (c *CRIPlugin) RemoveContainer(containerID string) error

RemoveContainer removes a container. If it is still running it is forcibly removed. This call is idempotent.

func (*CRIPlugin) RemoveImage 

func (c *CRIPlugin) RemoveImage(imageName string) error

RemoveImage removes an image.

func (*CRIPlugin) RemovePodSandbox 

func (c *CRIPlugin) RemovePodSandbox(id string) error

RemovePodSandbox removes a pod sandbox.

func (*CRIPlugin) RunPodSandbox 

func (c *CRIPlugin) RunPodSandbox(id, name, namespace string, labels, annotations map[string]string) (*PodSandbox, error)

RunPodSandbox creates and starts a pod sandbox.

func (*CRIPlugin) StartContainer added in v0.11.0 

func (c *CRIPlugin) StartContainer(containerID string) error

StartContainer starts a previously created container.

func (*CRIPlugin) StopContainer added in v0.11.0 

func (c *CRIPlugin) StopContainer(containerID string, timeout int) error

StopContainer stops a running container with a grace period (seconds).

func (*CRIPlugin) StopPodSandbox 

func (c *CRIPlugin) StopPodSandbox(id string) error

StopPodSandbox stops a pod sandbox.

func (*CRIPlugin) UpdateResources added in v0.12.0 

func (c *CRIPlugin) UpdateResources(containerID string, resources *runtime.LinuxResources) error

UpdateResources updates cgroup limits for a running container. Implements CRI UpdateContainerResources semantics: best-effort atomic with rollback on any controller failure.

func (*CRIPlugin) Version 

func (c *CRIPlugin) Version() map[string]string

Version returns CRI version info.

type CRIServer added in v0.11.0 

type CRIServer struct {
	v1.UnimplementedRuntimeServiceServer
	v1.UnimplementedImageServiceServer
	// contains filtered or unexported fields
}

CRIServer is a gRPC server implementing the Kubernetes Container Runtime Interface (CRI) v1 RuntimeService and ImageService.

It embeds the generated Unimplemented* servers by value (required for forward compatibility) and delegates the actual container/image work to the existing CRIPlugin, which wraps dokiruntime.Runtime, image.Store and network.Manager.

func NewCRIServer added in v0.11.0 

func NewCRIServer(plugin *CRIPlugin) *CRIServer

NewCRIServer creates a new CRIServer backed by the given CRIPlugin. It wires up the built-in WebSocket streamer so Exec/Attach actually stream, instead of returning codes.Unimplemented as they did while the streamer was dead code.

func (*CRIServer) Attach added in v0.11.0 

func (s *CRIServer) Attach(ctx context.Context, req *v1.AttachRequest) (*v1.AttachResponse, error)

Attach prepares a streaming endpoint to attach to a container.

func (*CRIServer) CheckpointContainer added in v0.11.0 

func (s *CRIServer) CheckpointContainer(ctx context.Context, req *v1.CheckpointContainerRequest) (*v1.CheckpointContainerResponse, error)

CheckpointContainer checkpoints a container using CRIU. This is a best-effort implementation that shells out to the criu binary (or `podman container checkpoint` if available). On hosts without CRIU, returns Unimplemented.

func (*CRIServer) Close added in v0.11.0 

func (s *CRIServer) Close() error

Close gracefully stops the gRPC server, letting in-flight RPCs complete.

func (*CRIServer) ContainerStats added in v0.11.0 

func (s *CRIServer) ContainerStats(ctx context.Context, req *v1.ContainerStatsRequest) (*v1.ContainerStatsResponse, error)

ContainerStats returns stats of the container.

func (*CRIServer) ContainerStatus added in v0.11.0 

func (s *CRIServer) ContainerStatus(ctx context.Context, req *v1.ContainerStatusRequest) (*v1.ContainerStatusResponse, error)

ContainerStatus returns the status of the container.

func (*CRIServer) CreateContainer added in v0.11.0 

func (s *CRIServer) CreateContainer(ctx context.Context, req *v1.CreateContainerRequest) (*v1.CreateContainerResponse, error)

CreateContainer creates a new container in the specified PodSandbox. The container is created but NOT started; StartContainer must be called separately.

func (*CRIServer) Exec added in v0.11.0 

func (s *CRIServer) Exec(ctx context.Context, req *v1.ExecRequest) (*v1.ExecResponse, error)

Exec prepares a streaming endpoint to execute a command in the container. The URL is on a per-call ephemeral HTTP server; kubelet opens it with the returned token.

func (*CRIServer) ExecSync added in v0.11.0 

func (s *CRIServer) ExecSync(ctx context.Context, req *v1.ExecSyncRequest) (*v1.ExecSyncResponse, error)

ExecSync runs a command in a container synchronously and returns the output. Per CVE-2022-1708 / CVE-2022-31030, stdout and stderr are capped at 16MB each; if the cap is hit, exit code is 0xff.

func (*CRIServer) GetContainerEvents added in v0.11.0 

func (s *CRIServer) GetContainerEvents(*v1.GetEventsRequest, grpc.ServerStreamingServer[v1.ContainerEventResponse]) error

GetContainerEvents gets container events from the CRI dokiruntime.

func (*CRIServer) ImageFsInfo added in v0.11.0 

func (s *CRIServer) ImageFsInfo(ctx context.Context, req *v1.ImageFsInfoRequest) (*v1.ImageFsInfoResponse, error)

ImageFsInfo returns information about the filesystem used to store images. kubelet 1.29+ requires this; without it the node is marked NotReady.

func (*CRIServer) ImageStatus added in v0.11.0 

func (s *CRIServer) ImageStatus(ctx context.Context, req *v1.ImageStatusRequest) (*v1.ImageStatusResponse, error)

ImageStatus returns the status of the image. If the image is not present, returns a response with Image set to nil (per CRI spec).

func (*CRIServer) ListContainerStats added in v0.11.0 

func (s *CRIServer) ListContainerStats(ctx context.Context, req *v1.ListContainerStatsRequest) (*v1.ListContainerStatsResponse, error)

ListContainerStats returns stats for all running containers matching the filter.

func (*CRIServer) ListContainers added in v0.11.0 

func (s *CRIServer) ListContainers(ctx context.Context, req *v1.ListContainersRequest) (*v1.ListContainersResponse, error)

ListContainers lists all containers by filters.

func (*CRIServer) ListImages added in v0.11.0 

func (s *CRIServer) ListImages(ctx context.Context, req *v1.ListImagesRequest) (*v1.ListImagesResponse, error)

ListImages lists existing images.

func (*CRIServer) ListMetricDescriptors added in v0.11.0 

func (s *CRIServer) ListMetricDescriptors(ctx context.Context, req *v1.ListMetricDescriptorsRequest) (*v1.ListMetricDescriptorsResponse, error)

ListMetricDescriptors gets the descriptors for the metrics.

func (*CRIServer) ListPodSandbox added in v0.11.0 

func (s *CRIServer) ListPodSandbox(ctx context.Context, req *v1.ListPodSandboxRequest) (*v1.ListPodSandboxResponse, error)

ListPodSandbox returns a list of PodSandboxes, optionally filtered.

func (*CRIServer) ListPodSandboxMetrics added in v0.11.0 

func (s *CRIServer) ListPodSandboxMetrics(ctx context.Context, req *v1.ListPodSandboxMetricsRequest) (*v1.ListPodSandboxMetricsResponse, error)

ListPodSandboxMetrics gets pod sandbox metrics from the CRI Runtime. Implements the v1.32+ PodSandboxMetrics spec.

func (*CRIServer) ListPodSandboxStats added in v0.11.0 

func (s *CRIServer) ListPodSandboxStats(ctx context.Context, req *v1.ListPodSandboxStatsRequest) (*v1.ListPodSandboxStatsResponse, error)

ListPodSandboxStats returns stats of the pod sandboxes matching a filter.

func (*CRIServer) ListenAndServe added in v0.11.0 

func (s *CRIServer) ListenAndServe(socketPath string) error

ListenAndServe creates a Unix socket listener at socketPath, registers the RuntimeService and ImageService, and serves gRPC requests. It blocks until the server is stopped via Close or the listener is closed.

func (*CRIServer) PodSandboxStats added in v0.11.0 

func (s *CRIServer) PodSandboxStats(ctx context.Context, req *v1.PodSandboxStatsRequest) (*v1.PodSandboxStatsResponse, error)

PodSandboxStats returns stats of the pod sandbox.

func (*CRIServer) PodSandboxStatus added in v0.11.0 

func (s *CRIServer) PodSandboxStatus(ctx context.Context, req *v1.PodSandboxStatusRequest) (*v1.PodSandboxStatusResponse, error)

PodSandboxStatus returns the status of the PodSandbox.

func (*CRIServer) PortForward added in v0.11.0 

func (s *CRIServer) PortForward(ctx context.Context, req *v1.PortForwardRequest) (*v1.PortForwardResponse, error)

PortForward prepares a streaming endpoint to forward ports from a PodSandbox.

func (*CRIServer) PullImage added in v0.11.0 

func (s *CRIServer) PullImage(ctx context.Context, req *v1.PullImageRequest) (*v1.PullImageResponse, error)

PullImage pulls an image with authentication config.

func (*CRIServer) RemoveContainer added in v0.11.0 

func (s *CRIServer) RemoveContainer(ctx context.Context, req *v1.RemoveContainerRequest) (*v1.RemoveContainerResponse, error)

RemoveContainer removes the container. Idempotent.

func (*CRIServer) RemoveImage added in v0.11.0 

func (s *CRIServer) RemoveImage(ctx context.Context, req *v1.RemoveImageRequest) (*v1.RemoveImageResponse, error)

RemoveImage removes the image. Idempotent.

func (*CRIServer) RemovePodSandbox added in v0.11.0 

func (s *CRIServer) RemovePodSandbox(ctx context.Context, req *v1.RemovePodSandboxRequest) (*v1.RemovePodSandboxResponse, error)

RemovePodSandbox removes the sandbox. Idempotent.

func (*CRIServer) ReopenContainerLog added in v0.11.0 

func (s *CRIServer) ReopenContainerLog(ctx context.Context, req *v1.ReopenContainerLogRequest) (*v1.ReopenContainerLogResponse, error)

ReopenContainerLog asks the runtime to reopen the container log file. Used by kubelet during log rotation.

func (*CRIServer) RunPodSandbox added in v0.11.0 

func (s *CRIServer) RunPodSandbox(ctx context.Context, req *v1.RunPodSandboxRequest) (*v1.RunPodSandboxResponse, error)

RunPodSandbox creates and starts a pod-level sandbox.

func (*CRIServer) RuntimeConfig added in v0.11.0 

func (s *CRIServer) RuntimeConfig(ctx context.Context, req *v1.RuntimeConfigRequest) (*v1.RuntimeConfigResponse, error)

RuntimeConfig returns configuration information of the dokiruntime. kubelet 1.28+ uses this to discover the cgroup driver instead of autodetecting.

func (*CRIServer) StartContainer added in v0.11.0 

func (s *CRIServer) StartContainer(ctx context.Context, req *v1.StartContainerRequest) (*v1.StartContainerResponse, error)

StartContainer starts the container.

func (*CRIServer) Status added in v0.11.0 

func (s *CRIServer) Status(ctx context.Context, req *v1.StatusRequest) (*v1.StatusResponse, error)

Status returns the status of the dokiruntime. Includes RuntimeHandlers (one per supported ExecutionMode) and RuntimeFeatures so that kubelet 1.36+ can advertise the supported feature set.

func (*CRIServer) StopContainer added in v0.11.0 

func (s *CRIServer) StopContainer(ctx context.Context, req *v1.StopContainerRequest) (*v1.StopContainerResponse, error)

StopContainer stops a running container with a grace period. Idempotent.

func (*CRIServer) StopPodSandbox added in v0.11.0 

func (s *CRIServer) StopPodSandbox(ctx context.Context, req *v1.StopPodSandboxRequest) (*v1.StopPodSandboxResponse, error)

StopPodSandbox stops any running process in the sandbox and reclaims network resources. Idempotent.

func (*CRIServer) StreamContainerStats added in v0.11.0 

func (s *CRIServer) StreamContainerStats(req *v1.StreamContainerStatsRequest, stream grpc.ServerStreamingServer[v1.StreamContainerStatsResponse]) error

StreamContainerStats is a streaming alternative to ListContainerStats. Used when kubelet has the CRIListStreaming feature gate enabled.

func (*CRIServer) StreamContainers added in v0.11.0 

func (s *CRIServer) StreamContainers(*v1.StreamContainersRequest, grpc.ServerStreamingServer[v1.StreamContainersResponse]) error

StreamContainers is a streaming alternative to ListContainers.

func (*CRIServer) StreamImages added in v0.11.0 

func (s *CRIServer) StreamImages(*v1.StreamImagesRequest, grpc.ServerStreamingServer[v1.StreamImagesResponse]) error

StreamImages is a streaming alternative to ListImages.

func (*CRIServer) StreamPodSandboxMetrics added in v0.11.0 

func (s *CRIServer) StreamPodSandboxMetrics(*v1.StreamPodSandboxMetricsRequest, grpc.ServerStreamingServer[v1.StreamPodSandboxMetricsResponse]) error

StreamPodSandboxMetrics is a streaming alternative to ListPodSandboxMetrics.

func (*CRIServer) StreamPodSandboxStats added in v0.11.0 

func (s *CRIServer) StreamPodSandboxStats(*v1.StreamPodSandboxStatsRequest, grpc.ServerStreamingServer[v1.StreamPodSandboxStatsResponse]) error

StreamPodSandboxStats is a streaming alternative to ListPodSandboxStats.

func (*CRIServer) StreamPodSandboxes added in v0.11.0 

func (s *CRIServer) StreamPodSandboxes(*v1.StreamPodSandboxesRequest, grpc.ServerStreamingServer[v1.StreamPodSandboxesResponse]) error

StreamPodSandboxes is a streaming alternative to ListPodSandbox.

func (*CRIServer) UpdateContainerResources added in v0.11.0 

func (s *CRIServer) UpdateContainerResources(ctx context.Context, req *v1.UpdateContainerResourcesRequest) (*v1.UpdateContainerResourcesResponse, error)

UpdateContainerResources updates container resource limits synchronously. Implements CRI v1.25+ semantics: all-or-nothing, transaction rollback on partial failure.

func (*CRIServer) UpdatePodSandboxResources added in v0.11.0 

func (s *CRIServer) UpdatePodSandboxResources(ctx context.Context, req *v1.UpdatePodSandboxResourcesRequest) (*v1.UpdatePodSandboxResourcesResponse, error)

UpdatePodSandboxResources updates the PodSandboxConfig with pod-level resource configuration. Used by In-Place Pod Vertical Scaling (KEP-5407, GA in 1.33).

func (*CRIServer) UpdateRuntimeConfig added in v0.11.0 

func (s *CRIServer) UpdateRuntimeConfig(ctx context.Context, req *v1.UpdateRuntimeConfigRequest) (*v1.UpdateRuntimeConfigResponse, error)

UpdateRuntimeConfig updates the runtime configuration based on the request. kubelet uses this to push PodCIDR and other network settings at startup.

func (*CRIServer) Version added in v0.11.0 

func (s *CRIServer) Version(ctx context.Context, req *v1.VersionRequest) (*v1.VersionResponse, error)

Version returns the runtime name, runtime version, and runtime API version.

type PodSandbox 

type PodSandbox struct {
	ID           string            `json:"id"`
	Name         string            `json:"name"`
	Namespace    string            `json:"namespace"`
	UID          string            `json:"uid"`
	CreatedAt    int64             `json:"created_at"`
	Labels       map[string]string `json:"labels"`
	Annotations  map[string]string `json:"annotations"`
	Containers   []string          `json:"containers"`
	Hostname     string            `json:"hostname"`
	LogDirectory string            `json:"log_directory"`
	State        string            `json:"state"`
	IP           string            `json:"ip"`
	Network      string            `json:"network"`
}

PodSandbox represents a Kubernetes Pod.

type StreamRequest added in v0.12.0 

type StreamRequest struct {
	Op         string // "exec" | "attach" | "portforward"
	ResourceID string // container id (exec/attach) or pod id (portforward)
	Cmd        []string
	Tty        bool
	Stdin      bool
	Stdout     bool
	Stderr     bool
	Ports      []int32
}

StreamRequest describes a reserved streaming operation. It carries the argv and stream selection so the handler can reconstruct the runtime call without squashing the command into a single space-joined string.

type Streamer added in v0.12.0 

type Streamer interface {
	Reserve(ctx context.Context, req StreamRequest) (token string, err error)
	Addr() (host string, port int)
}

Streamer manages ephemeral HTTP streaming endpoints for exec, attach, and portforward operations. Each call to Reserve picks an available port, starts a one-shot HTTP server, and returns the allocated port number.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.