[WIP] adds option for setting oci hooks

[mikebrow]

To address issue containerd/containerd#6645 I've started a prototype.

User must generate a json file for the hooks struct: https://github.com/opencontainers/runtime-spec/blob/master/specs-go/config.go#L114-L130

Hooks explained here: https://github.com/opencontainers/runtime-spec/blob/master/config.md#prestart

Signed-off-by: Mike Brown brownwm@us.ibm.com

[k8s-ci-robot]

@mikebrow: The following test failed, say /retest to rerun them all:

Test name	Commit	Details	Rerun command
pull-cri-containerd-node-e2e	98c65b2	link	/test pull-cri-containerd-node-e2e

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

[Random-Liu]

@mikebrow Why do we need this feature at cri-containerd level? This should be driven by CRI, right?

[mikebrow]

@mikebrow Why do we need this feature at cri-containerd level? This should be driven by CRI, right?

Yes, it should be driven by CRI. I put it here for prototyping only.

[lizrice]

We'd like to be able to configure prestart hooks, and this (or something like this) would give us just what we need. Our case is to hook in a security tool on prestart; our users would have the same hook configured on every node (or at least on every node where they want the tool to run), and the same hook would run for all containers.

It would be nice to be able to add the hook without a restart, but not essential.

[egernst]

@mikebrow @lizrice @Random-Liu -- I am hopeful that there's some traction/forward progress here. Any insights on how to drive this forward in containerd?

[krsna1729]

Need this functionality to do device provisioning at prestart and poststop stage of container lifecycle. Only cri-o seems to be supporting. It would be great if containerd supports too.

[alban]

I mentioned this issue for discussion in a previous OCI meeting (notes, slides) and I would like to mention it at the next Kubernetes SIG Node meeting (notes).

[mikebrow]

moving PR to PR #1248 as this branch has been deleted...