feature: support multiple containerd-shim

apis/swagger.yml

@@ -2004,6 +2004,11 @@ definitions:
  items:
  type: "string"
  example: ["--debug", "--systemd-cgroup=false"]
+ shim:
+ description: |
+ shim name, pass to containerd to choose which shim is used for container.
+ type: "string"
+
 
  Commit:
  description: |
@@ -2421,6 +2426,10 @@ definitions:
  Runtime:
  type: "string"
  description: "Runtime to use with this container."
+ Shim:
+ description: |
+ Shim name, pass to containerd to choose which shim is used for container.
+ type: "string"
  # Applicable to Windows
  ConsoleSize:
  type: "array"

cli/common_flags.go

@@ -76,6 +76,7 @@ func addCommonFlags(flagSet *pflag.FlagSet) *container {
  flagSet.BoolVar(&c.privileged, "privileged", false, "Give extended privileges to the container")
 
  flagSet.StringVar(&c.restartPolicy, "restart", "", "Restart policy to apply when container exits")
+ flagSet.StringVar(&c.shim, "shim", "io.containerd.runtime.v1.linux", "containerd shim used for this container")
  flagSet.StringVar(&c.runtime, "runtime", "", "OCI runtime to use for this container")
 
  flagSet.StringSliceVar(&c.securityOpt, "security-opt", nil, "Security Options")

cli/container.go

@@ -16,6 +16,7 @@ type container struct {
  tty bool
  volume []string
  volumesFrom []string
+ shim string
  runtime string
  env []string
  entrypoint string
@@ -206,6 +207,7 @@ func (c *container) config() (*types.ContainerCreateConfig, error) {
  Binds: c.volume,
  VolumesFrom: c.volumesFrom,
  Runtime: c.runtime,
+ Shim: c.shim,
  Resources: types.Resources{
  // cpu
  CPUShares: c.cpushare,

ctrd/container.go

@@ -5,7 +5,6 @@ import (
  "encoding/json"
  "fmt"
  "io"
- "runtime"
  "strings"
  "sync"
  "syscall"
@@ -504,7 +503,7 @@ func (c *Client) createContainer(ctx context.Context, ref, id, checkpointDir str
  // create container
  options := []containerd.NewContainerOpts{
  containerd.WithContainerLabels(container.Labels),
- containerd.WithRuntime(fmt.Sprintf("io.containerd.runtime.v1.%s", runtime.GOOS), &runctypes.RuncOptions{
+ containerd.WithRuntime(container.Shim, &runctypes.RuncOptions{
  Runtime: container.Runtime,
  RuntimeRoot: runtimeRoot,
  }),

ctrd/container_types.go

@@ -13,12 +13,16 @@ import (
 type Container struct {
  ID string
  Image string
- Runtime string
  Labels map[string]string
  IO *containerio.IO
  Spec *specs.Spec
  SnapshotID string
 
+ // Shim is shim name, specify shim used for container
+ Shim string
+ // Runtime is runtime name, specify runtime used for container
+ Runtime string
+
  // BaseFS is rootfs used by containerd container
  BaseFS string
 

daemon/mgr/container.go

@@ -688,11 +688,17 @@ func (mgr *ContainerManager) createContainerdContainer(ctx context.Context, c *C
  return err
  }
 
+ // shim always need for containerd.
+ if c.HostConfig.Shim == "" {
+ c.HostConfig.Shim = DefaultShim
+ }
+
  c.Lock()
  ctrdContainer := &ctrd.Container{
  ID: c.ID,
  Image: c.Config.Image,
  Labels: c.Config.Labels,
+ Shim: c.HostConfig.Shim,
  Runtime: runtime,
  Spec: sw.s,
  IO: mgr.IOs.Get(c.ID),

daemon/mgr/container_types.go

@@ -33,6 +33,9 @@ var (
 
  // ProfileUnconfined means run a container without the default seccomp profile.
  ProfileUnconfined = "unconfined"
+
+ // DefaultShim is default shim used for container.
+ DefaultShim = "io.containerd.runtime.v1.linux"
 )
 
 var (