Proto commits in containerd/nri

These 33 commits are when the Protocol Buffers files have changed:

2026-04-13

api,stub: add dedicated RPC calls for all events. Define dedicated RPC calls on the wire for all pod and container lifecycle events. Update stub, builtin and WASM plugins accordingly. Signed-off-by: Krisztian Litkey <krisztian.litkey@intel.com>

2026-03-19

api,adaptation,stub: exchange versions during registration. Exchange NRI versions in use during plugin registration. If we do not get an NRI version from the runtime (too old peer NRI) try to infer it using the runtime type and version. The NRI version in use is discovered using the golang runtime provided build info. For plugins hosted in the main NRI repo this does not produce any useful result (because NRI is subject to a replace directive in the plugins' go.mod). Therefore within the repo we fall back to using a git-describe generated version. Signed-off-by: Krisztian Litkey <krisztian.litkey@intel.com>

2026-03-10

Enable adjusting container Linux memory policy. Signed-off-by: Antti Kervinen <antti.kervinen@intel.com>

2025-12-12

Implement removal of RDT Makes it possible to remove/override the linux.intelRdt object from the container configuration. Extend the API by adding new 'Remove' field to the LinuxRdt message which is used as a marker to fully delete/override the IntelRdt configuration. This patch also updates the adaptation and runtime-tools correspondingly. Signed-off-by: Markus Lehtonen <markus.lehtonen@intel.com>

api: add rdt Add new message for directly managing the linux.intelRdt object of the runtime-spec. NOTE: the old RdtClass field resides under LinuxResources message but the IntelRdt message is sepate from LinuxResources. This is to maintain parity with the OCI runtime-spec. It is also much more logical because the LinuxResources message is used in many places (like pod overhead, update resources etc) where the RDT fields don't make sense or cannot be applied. Also note that the Rdt object cannot be modified on container update (missing from UpdateContainerRequest) as this functionality is missing from the runtime spec and runtimes (runc/crun). Signed-off-by: Markus Lehtonen <markus.lehtonen@intel.com>

2025-12-04

pkg/api: add OptionalRepeatedString type Signed-off-by: Markus Lehtonen <markus.lehtonen@intel.com>

2025-12-03

api,adaptation,generate: allow setting scheduler attributes. Allow setting/resetting container linux scheduler attributes. Signed-off-by: Krisztian Litkey <krisztian.litkey@intel.com>

api,adaptation,generate: allow adjusting linux net devices. Allow adding and removing container linux net devices. Signed-off-by: Krisztian Litkey <krisztian.litkey@intel.com>

2025-11-26

api: add sysctl container adjustment Signed-off-by: Samuel Karp <samuelkarp@google.com>

2025-09-15

api,adaptation: add container uid/gid info. Obtain the container's user, group and supplemental group IDs from OCI Spec.Process.User and expose it to plugins. Signed-off-by: Krisztian Litkey <krisztian.litkey@intel.com>

The documentation is generated from this commit.

2025-07-16

adaptation,api: adjust LinuxNamespaces Signed-off-by: Etienne Champetier <e.champetier@ateme.com> Update adjustment plugin ownership tracking and conflict detection using the revised pkg/api-based infra. Signed-off-by: Krisztian Litkey <krisztian.litkey@intel.com>

2025-07-14

api: add LinuxNamespace to LinuxContainerAdjustment One line change in api.proto and regenerate the pb.go files. Signed-off-by: Etienne Champetier <e.champetier@ateme.com> Signed-off-by: Krisztian Litkey <krisztian.litkey@intel.com>

api: add seccomp adjustment This adds an adjustment for seccomp policies. The intent is that people can wholesale replace policies, or parse them, make some changes, and then send them back. Sending them *to* NRI via containerd requires some containerd patches as well, those are here: https://github.com/tych0/containerd/commits/nri-seccomp/ Specifically, we are interested in making the listenerPath of the policy dynamic based on a k8s pod spec, so we can't use the Localhost custom policy (well, we can use most of it, except for listenerPath, which we have an NRI plugin to change based on this code). This patch is a lot of boilerplate, which is unfortunate. There is a much smaller but similar patch: https://github.com/tych0/nri/commit/a70547a543f762542212fde804b9cd3f70cfc272 but it involves directly serializing a runtime-spec string Finally, note the comment in generate.go: the runtime-tools generate code does not have complete coverage for seccomp stuff, so I opted to not use any of it, vs. adding more stuff to runtime-tools. The fact that there are human and computer names is also confusing, it seems like we should stick to the computer names for this particular interface. Signed-off-by: Tycho Andersen <tycho@tycho.pizza>

api,adaptation: pass container seccomp profile to plugins. Pass information about CRI-requested container seccomp security profile information as input to plugins. Co-authored-by: Mike Brown <brownwm@us.ibm.com> Signed-off-by: Krisztian Litkey <krisztian.litkey@intel.com>

api,adaptation,generate: allow setting container I/O priority. Allow setting/resetting container I/O priority. Signed-off-by: Krisztian Litkey <krisztian.litkey@intel.com>

2025-06-11

api: pass injected CDI devices as input. Pass (fully qualified device) names of requested/injected CDI devices to NRI plugins. Signed-off-by: Krisztian Litkey <krisztian.litkey@intel.com>

2025-05-17

api,adaptation,stub: implement adjustment validation. Implement pluggable container adjustment validation. When validator plugins are present, use them to validate the collected adjustments, failing container creation if any validation fails. For adjustment validation plugins receive the pod, the pristing un- adjusted container, the collected container adjustments, information about which plugins adjusted what container parameters, and the list of plugins consulted for the adjustments. The plugin can then choose to accept or reject the adjustments. Accepting or rejecting adjustments are transactional. Either all or none of the adjustments are accepted, together with the container creation request. IOW, rejecting an adjustment results in a failed container creation request. Signed-off-by: Krisztian Litkey <krisztian.litkey@intel.com>

2025-05-15

api,adaptation: protoize conflict detection data types. Redefine conflict detection data types using protobuf. This allows passing them to plugins over a ttrpc API. Signed-off-by: Krisztian Litkey <krisztian.litkey@intel.com>

2025-03-04

api: add more data for container status. Add exit code, status reason and message, and timestamps for creation, start and exit to container data. Co-authored-by: Mike Brown <brownwm@us.ibm.com> Signed-off-by: Krisztian Litkey <krisztian.litkey@intel.com>

2025-02-28

api,adaptation,generate: allow setting container command line. Allow setting (or updating already set) container command line arguments. Signed-off-by: Krisztian Litkey <krisztian.litkey@intel.com>

2025-02-13

Add UpdatePodSandbox to NRI plugin API This API is called by the container runtime to update pod sandbox resources when they change. This is for the In-place Pod Resize KEP-1287. Signed-off-by: Chris Henzie <chrishenzie@google.com>

2024-12-06

Add WASM plugin support Signed-off-by: Sascha Grunert <sgrunert@redhat.com>

2024-10-26

api: support Pod IPs Allow NRI plugins to read the allocated IPs to the pod on the PodSandbox hooks. This is specially useful for networking daemons that depend on the Pod IPs assigned via CNI by the container runtime (service mesh, network policies, ... ) to create seamless integrations without having to modify the existing environment. Existing network integrations use techniques like: - CNI chaining (invasive) as the implementation needs to modify the existing deployment and can cause disruption due to mutations on the existing configurations. - Read Pod Status, that is too late in the process, since the pod lifecycle does not update the pod status until the containers are running, but there are applications like network policy implemetnations or service meshes that needs this information before the pod is completely created. - Inspect the host namespaces to gather the information, that is very intrusive and not portable, creating a tighly coupling between. Add a nri plugin that can be used as reference implementations for this integration, the nri plugin just log the interesting networking details of the pod (ips and network namespace) on the different hooks of the pod lifecucle. Change-Id: Idb9605c719903d0df51c9a1947e0f838870b5c0b Signed-off-by: Antonio Ojea <aojea@google.com>

2024-10-10

api: add support for multiple sync messages. Signed-off-by: Krisztian Litkey <krisztian.litkey@intel.com>

2024-09-27

api,adaptation,stub: let plugin know configured timeouts. Let plugins know the configured registration and request processing timeout. Signed-off-by: Krisztian Litkey <krisztian.litkey@intel.com>

2024-08-27

pkg,plugins,.codespellrc: add codespellrc, fix spelling. Add .codespellrc, fix reported existing spelling errors. Signed-off-by: Krisztian Litkey <krisztian.litkey@intel.com>

2024-08-19

NRI plugins support adjust oom_score_adj Signed-off-by: Xiaojin Zhang <874478410@qq.com>

2024-08-12

api: add support for native CDI device injection. Add support for native CDI injection. With this in place, a plugin can now directly request injection of CDI devices by device name. This is much simpler than first performing CDI device resolution and injection, followed by a set of low- level NRI adjustments for devices, mounts, env. vars. and OCI hooks to effectively do the same. Signed-off-by: Krisztian Litkey <krisztian.litkey@intel.com>

2024-07-19

support pids cgroup Signed-off-by: Yang Yang <yang8518296@163.com>

2023-08-19

api: add POSIXRlimit type Signed-off-by: Samuel Karp <samuelkarp@google.com>

2022-11-11

pkg/api: define updated NRI plugin API. Define a ttRPC-based updated NRI API which allows plugins more flexible control over containers with less overhead per plugin invocation/request. The new protocol allows plugins to - synchronize their state with the runtime on startup - subscribe for pod and container lifecycle events - adjust a subset of container parameters at creation - update assigned container resources otherwise The API allows adjusting the following parameters during container creation: - annotations - environment variables - mounts, devices - OCI hooks - assigned cgroupfs-controlled resources, including o scheduling parameters o memory and huge page limits o CPU and memory pinning o unified cgroup v2 parameters o RDT class (LLC, memory BW control) o Block I/O class (blkio controller parameters) The API allows updating the following container parameters otherwise: - assigned cgroupfs-controlled resources Signed-off-by: Krisztian Litkey <krisztian.litkey@intel.com>

2021-03-16

remove vendor directory This project is used as a library and doesn't produce binaries, in which case convention is to not use vendoring. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

This commit does not contain any .proto files.

2020-07-29

Vendor go modules Signed-off-by: Michael Crosby <michael@thepasture.io>