Affected by GO-2022-0344 and 15 other vulnerabilities

GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

GO-2022-0784: containerd-shim API Exposed to Host Network Containers in github.com/containerd/containerd

GO-2022-0803: containerd v1.2.x can be coerced into leaking credentials during image pull in github.com/containerd/containerd

GO-2022-0921: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

GO-2025-3528: containerd has an integer overflow in User ID handling in github.com/containerd/containerd

GO-2025-4100: containerd affected by a local privilege escalation via wide permissions on CRI directory in github.com/containerd/containerd

GO-2025-4108: containerd CRI server: Host memory exhaustion through Attach goroutine leak in github.com/containerd/containerd

GO-2026-5064: containerd CRI checkpoint restore CDI annotation smuggling in github.com/containerd/containerd

GO-2026-5338: containerd: CRI checkpoint import allows local image tag poisoning in github.com/containerd/containerd

GO-2026-5622: Arbitrary host CRI log file read via symlink following in CRI checkpoint restore in github.com/containerd/containerd

GO-2026-6444: containerd: CRI ExecSync Goroutine Leak Leads to Node-Level Denial of Service in github.com/containerd/containerd

GO-2026-6597: Containerd has image-pull DoS via crafted OCI index graph amplification in github.com/containerd/containerd

The highest tagged major version is v2.

schema1

package

v1.2.13 Latest Latest Go to latest Published: Feb 18, 2020 License: Apache-2.0 Imports: 22 Imported by: 310

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/containerd/containerd

Links

Documentation ¶

Index ¶

func ReadStripSignature(schema1Blob io.Reader) ([]byte, error)
type ConvertOpt
- func UseDockerSchema2() ConvertOpt
type ConvertOptions
type Converter
- func NewConverter(contentStore content.Store, fetcher remotes.Fetcher) *Converter
- func (c *Converter) Convert(ctx context.Context, opts ...ConvertOpt) (ocispec.Descriptor, error)
- func (c *Converter) Handle(ctx context.Context, desc ocispec.Descriptor) ([]ocispec.Descriptor, error)

Constants ¶

This section is empty.

Variables ¶

This section is empty.

Functions ¶

func ReadStripSignature ¶ added in v1.2.9

func ReadStripSignature(schema1Blob io.Reader) ([]byte, error)

ReadStripSignature reads in a schema1 manifest and returns a byte array with the "signatures" field stripped

Types ¶

type ConvertOpt ¶ added in v1.1.0

type ConvertOpt func(context.Context, *ConvertOptions) error

ConvertOpt allows configuring a convert operation.

func UseDockerSchema2 ¶ added in v1.1.0

func UseDockerSchema2() ConvertOpt

UseDockerSchema2 is used to indicate that a schema1 manifest should be converted into the media types for a docker schema2 manifest.

type ConvertOptions ¶ added in v1.1.0

type ConvertOptions struct {
	// ManifestMediaType specifies the media type of the manifest OCI descriptor.
	ManifestMediaType string

	// ConfigMediaType specifies the media type of the manifest config OCI
	// descriptor.
	ConfigMediaType string
}

ConvertOptions provides options on converting a docker schema1 manifest.

type Converter ¶

type Converter struct {
	// contains filtered or unexported fields
}

Converter converts schema1 manifests to schema2 on fetch

func NewConverter ¶

func NewConverter(contentStore content.Store, fetcher remotes.Fetcher) *Converter

NewConverter returns a new converter

func (*Converter) Convert ¶

func (c *Converter) Convert(ctx context.Context, opts ...ConvertOpt) (ocispec.Descriptor, error)

Convert a docker manifest to an OCI descriptor

func (*Converter) Handle ¶

func (c *Converter) Handle(ctx context.Context, desc ocispec.Descriptor) ([]ocispec.Descriptor, error)

Handle fetching descriptors for a docker media type

Source Files ¶

View all Source files

converter.go

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL