content: ensure root directory exists before checking fs-verity support #12416

ningmingxiao · 2025-10-26T14:40:54Z

if containerd run on a new host supported must be false

func NewLabeledStore(root string, ls LabelStore) (content.Store, error) {
	supported, _ := fsverity.IsSupported(root)

	s := &store{
		root:               root,
		ls:                 ls,
		integritySupported: supported,
		locks:              map[string]*lock{},
	}

because rootPath （io.containerd.content.v1.content） doesn't exist.

func IsSupported(rootPath string) (bool, error) {
	minKernelVersion := kernelversion.KernelVersion{Kernel: 5, Major: 4}
	s, err := kernelversion.GreaterEqualThan(minKernelVersion)
	if err != nil {
		return s, err
	}

	integrityDir, err := os.MkdirTemp(rootPath, ".fsverity-check-*")
	if err != nil {
		return false, err
	}

I find io.containerd.content.v1.content dir only be created when pull images.

@AkihiroSuda @mxpv @fuweid

plugins/content/local/store.go

fuweid · 2025-10-28T00:56:21Z

This is the git commit message. Feel free to use this in your commit

Currently, fs-verity support detection fails on fresh containerd
installations because the content store root directory
(io.containerd.content.v1.content) doesn't exist yet. This directory
is only created when pulling images, causing checker to
always be false on new hosts.

The IsSupported() function attempts to create a temporary directory
within rootPath to test fs-verity support, but fails when rootPath
doesn't exist, returning an error that is silently ignored.

Fix this by ensuring the root directory exists before performing
the fs-verity support check in NewLabeledStore().

ningmingxiao · 2025-10-28T01:03:24Z

done thanks @fuweid

ningmingxiao · 2025-10-29T01:52:27Z

@estesp @AkihiroSuda can this pr be merged it's easy to review.

ningmingxiao · 2025-10-29T08:03:16Z

ping @dmcgowan @mxpv @akhilerm can you take a look ? thanks

ningmingxiao · 2025-11-21T00:37:30Z

can you help review this pr it's easy to review @samuelkarp

ningmingxiao · 2025-12-02T08:46:14Z

ping @dmcgowan @mikebrow @mxpv can this pr be merged ？

mikebrow

see questions and a nit on the warning msg

plugins/content/local/store.go

mikebrow

LGTM

plugins/content/local/store_test.go

ningmingxiao · 2025-12-18T08:42:49Z

done thanks @AkihiroSuda

plugins/content/local/store.go

plugins/content/local/store_test.go

ningmingxiao · 2025-12-18T12:55:14Z

/retest

k8s-ci-robot · 2025-12-18T12:55:30Z

@ningmingxiao: Cannot trigger testing until a trusted user reviews the PR and leaves an /ok-to-test message.

Details

In response to this:

/retest

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

ningmingxiao · 2025-12-24T15:26:16Z

can you merge this pr ? I can create another pr change its mod to 0700 because the permission issue is unrelated to this pr
@AkihiroSuda @mikebrow @dmcgowan

ningmingxiao · 2026-01-12T15:21:12Z

can this pr be merged too? The file io.containerd.content.v1.content or permisson default is 755 , If it's not safety enough I can create another pr change it to 0700. ping @fuweid

Currently, fs-verity support detection fails on fresh containerd installations because the content store root directory (io.containerd.content.v1.content) doesn't exist yet. This directory is only created when pulling images, causing checker to always be false on new hosts. The IsSupported() function attempts to create a temporary directory within rootPath to test fs-verity support, but fails when rootPath doesn't exist, returning an error that is silently ignored. Fix this by ensuring the root directory exists before performing the fs-verity support check in NewLabeledStore(). Signed-off-by: ningmingxiao <ning.mingxiao@zte.com.cn>

github-project-automation bot added this to Pull Request Review Oct 26, 2025

github-project-automation bot moved this to Needs Triage in Pull Request Review Oct 26, 2025

k8s-ci-robot added the size/XS label Oct 26, 2025

dosubot bot added the kind/bug label Oct 26, 2025

ningmingxiao changed the title ~~bugfix:make sure content dir exist~~ bugfix:make sure content dir exist to fix integritySupported always false. Oct 27, 2025

ningmingxiao changed the title ~~bugfix:make sure content dir exist to fix integritySupported always false.~~ bugfix:make sure content dir exist to fix integritySupported always false Oct 27, 2025

fuweid reviewed Oct 28, 2025

View reviewed changes

plugins/content/local/store.go Outdated Show resolved Hide resolved

fuweid changed the title ~~bugfix:make sure content dir exist to fix integritySupported always false~~ content: ensure root directory exists before checking fs-verity support Oct 28, 2025

ningmingxiao force-pushed the fix_content_dir branch from 4544a0a to e0279b5 Compare October 28, 2025 01:02

ningmingxiao force-pushed the fix_content_dir branch 3 times, most recently from 7f49254 to f49a85e Compare October 28, 2025 05:59

fuweid approved these changes Oct 28, 2025

View reviewed changes

ningmingxiao mentioned this pull request Nov 5, 2025

[release/2.1] Prepare release notes for v2.1.5 #12483

Merged

ningmingxiao force-pushed the fix_content_dir branch from f49a85e to 6c05f4e Compare December 2, 2025 08:45

mikebrow reviewed Dec 2, 2025

View reviewed changes

plugins/content/local/store.go Outdated Show resolved Hide resolved

plugins/content/local/store.go Outdated Show resolved Hide resolved

ningmingxiao force-pushed the fix_content_dir branch from 6c05f4e to c244397 Compare December 3, 2025 01:50

k8s-ci-robot added size/S and removed size/XS labels Dec 3, 2025

mikebrow approved these changes Dec 3, 2025

View reviewed changes

github-project-automation bot moved this from Needs Triage to Review In Progress in Pull Request Review Dec 3, 2025

mikebrow reviewed Dec 3, 2025

View reviewed changes

plugins/content/local/store_test.go Show resolved Hide resolved

ningmingxiao force-pushed the fix_content_dir branch from c244397 to 9c24363 Compare December 6, 2025 03:24

k8s-ci-robot removed the size/S label Dec 6, 2025

ningmingxiao force-pushed the fix_content_dir branch from 6b5ceaf to 094eca6 Compare December 18, 2025 08:32

AkihiroSuda reviewed Dec 18, 2025

View reviewed changes

plugins/content/local/store.go Show resolved Hide resolved

AkihiroSuda reviewed Dec 18, 2025

View reviewed changes

plugins/content/local/store_test.go Show resolved Hide resolved

ningmingxiao force-pushed the fix_content_dir branch 4 times, most recently from 3da87e9 to e5caf33 Compare December 18, 2025 09:28

k8s-ci-robot added the do-not-merge/contains-merge-commits label Dec 18, 2025

ningmingxiao force-pushed the fix_content_dir branch from fc5c6ab to 7fe31f2 Compare December 18, 2025 10:10

k8s-ci-robot removed the do-not-merge/contains-merge-commits label Dec 18, 2025

ningmingxiao force-pushed the fix_content_dir branch 2 times, most recently from faf577e to 57f8fc9 Compare December 24, 2025 15:22

ningmingxiao force-pushed the fix_content_dir branch 2 times, most recently from 03e1fed to 502d5a8 Compare December 30, 2025 10:41

k8s-ci-robot added the do-not-merge/contains-merge-commits label Jan 12, 2026

ningmingxiao force-pushed the fix_content_dir branch from af7f6a2 to b244e1a Compare January 12, 2026 15:14

k8s-ci-robot removed the do-not-merge/contains-merge-commits label Jan 12, 2026

mikebrow force-pushed the fix_content_dir branch from b244e1a to 5f0f0dc Compare January 12, 2026 15:58

fuweid approved these changes Jan 13, 2026

View reviewed changes

fuweid added this pull request to the merge queue Jan 13, 2026

Merged via the queue into containerd:main with commit f0e04e5 Jan 13, 2026
52 checks passed

github-project-automation bot moved this from Review In Progress to Done in Pull Request Review Jan 13, 2026

ningmingxiao deleted the fix_content_dir branch January 14, 2026 01:22

content: ensure root directory exists before checking fs-verity support #12416

content: ensure root directory exists before checking fs-verity support #12416

Conversation

ningmingxiao commented Oct 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

fuweid commented Oct 28, 2025

Uh oh!

ningmingxiao commented Oct 28, 2025

Uh oh!

ningmingxiao commented Oct 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ningmingxiao commented Oct 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ningmingxiao commented Nov 21, 2025

Uh oh!

ningmingxiao commented Dec 2, 2025

Uh oh!

mikebrow left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

mikebrow left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

ningmingxiao commented Dec 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ningmingxiao commented Dec 18, 2025

Uh oh!

k8s-ci-robot commented Dec 18, 2025

Uh oh!

ningmingxiao commented Dec 24, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ningmingxiao commented Jan 12, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

ningmingxiao commented Oct 26, 2025 •

edited

Loading

ningmingxiao commented Oct 29, 2025 •

edited

Loading

ningmingxiao commented Oct 29, 2025 •

edited

Loading

ningmingxiao commented Dec 18, 2025 •

edited

Loading

ningmingxiao commented Dec 24, 2025 •

edited

Loading