Merge tag 'v1.7.21' into release-v1.7

containerd 1.7.21 Welcome to the v1.7.21 release of containerd! The twenty-first patch release for containerd 1.7 contains various fixes and updates. * Regenerate introspection UUID if state is empty ([#10510](containerd/containerd#10510)) * Set stderr to empty string when using terminal on Windows ([#10499](containerd/containerd#10499)) * Move builds to Go 1.22 and add support for testing with 1.23 ([#10596](containerd/containerd#10596)) * Borrow latest wsstream from k8s v1.31.x to 1.7 ([#10575](containerd/containerd#10575)) * Ensure the CRIAPIV1Alpha2 warning's lastOccurrence is accurate ([#10571](containerd/containerd#10571)) * Make `StopContainer` idempotent ([#10528](containerd/containerd#10528)) * Make `StopPodSandbox` idempotent ([#10527](containerd/containerd#10527)) * Fix failed force deletion for tasks with PID 0 ([#10523](containerd/containerd#10523)) * Fix packaged runc reporting incorrect version ([#10559](containerd/containerd#10559)) * Ensure `/run/containerd` gets created with correct perms ([#10534](containerd/containerd#10534)) * Ensure the CRIAPIV1Alpha2 warning's lastOccurrence is accurate ([#10571](containerd/containerd#10571)) * Update warnings for deprecated CRI config fields ([#10512](containerd/containerd#10512)) Please try out the release binaries and report any issues at https://github.com/containerd/containerd/issues. * Davanum Srinivas * Samuel Karp * Sebastiaan van Stijn * Phil Estes * Maksym Pavlenko * Akhil Mohan * Chris Henzie * Derek McGowan * Kazuyoshi Kato * Sascha Grunert * Akihiro Suda * Erikson Tung * Iceber Gu * Mauri de Souza Meneguzzo * Mike Brown * Shengjing Zhu * TinaMor * rongfu.leng <details><summary>45 commits</summary> <p> * Prepare release notes for v1.7.21 ([#10632](containerd/containerd#10632)) * [`975f279ee`](containerd/containerd@975f279) Prepare release notes for v1.7.21 * go.mod: keep minimum go version at go1.21 ([#10633](containerd/containerd#10633)) * [`d63bd8464`](containerd/containerd@d63bd84) go.mod: keep minimum go version at go1.21 * Move builds to Go 1.22 and add support for testing with 1.23 ([#10596](containerd/containerd#10596)) * [`c76028088`](containerd/containerd@c760280) update golangci-lint to 1.60.1 * [`3b263d082`](containerd/containerd@3b263d0) add go1.23.0, drop go1.21.x * Fix TestNewBinaryIOCleanup on Go 1.23 and Linux 5.4 ([#10590](containerd/containerd#10590)) * [`09ca004de`](containerd/containerd@09ca004) Fix TestNewBinaryIOCleanup on Go 1.23 and Linux 5.4 * Borrow latest wsstream from k8s v1.31.x to 1.7 ([#10575](containerd/containerd#10575)) * [`9269d97b1`](containerd/containerd@9269d97) hide wsstream under internal/ to prevent external use * [`59815fa44`](containerd/containerd@59815fa) golangci-lint should only look for problems in new code * [`1c431dc6f`](containerd/containerd@1c431dc) Run go mod tidy * [`226f93d92`](containerd/containerd@226f93d) Add copyright headers * [`6f3252733`](containerd/containerd@6f32527) switch over references to the new package * [`0a85d476a`](containerd/containerd@0a85d47) Fix up some constant references * [`82bfa44d0`](containerd/containerd@82bfa44) Copy over wsstream from k8s v1.31.0-rc.1 release * Ensure the CRIAPIV1Alpha2 warning's lastOccurrence is accurate ([#10571](containerd/containerd#10571)) * [`52b79f337`](containerd/containerd@52b79f3) Update CRIAPIV1Alpha2 warning lastOccurrence every call * pkg/userns: deprecate and migrate to github.com/moby/sys/userns ([#10564](containerd/containerd#10564)) * [`dce0b5a6d`](containerd/containerd@dce0b5a) migrate to github.com/moby/sys/userns * [`65f7d0740`](containerd/containerd@65f7d07) pkg/userns: deprecate and migrate to github.com/moby/sys/user/userns * [`f21675c27`](containerd/containerd@f21675c) vendor: github.com/moby/sys/user v0.2.0 * update to go1.21.13 / go1.22.6 ([#10570](containerd/containerd#10570)) * [`228914a5e`](containerd/containerd@228914a) update to go1.21.13 / go1.22.6 * Fix TestNewBinaryIOCleanup failing with gotip ([#10554](containerd/containerd#10554)) * [`3ff82ba0f`](containerd/containerd@3ff82ba) Fix TestNewBinaryIOCleanup failing with gotip * Fix packaged runc reporting incorrect version ([#10559](containerd/containerd#10559)) * [`d51143f6f`](containerd/containerd@d51143f) script/setup/install-runc: fix runc using incorrect version * update auths code comment ([#10536](containerd/containerd#10536)) * [`7bb1455d8`](containerd/containerd@7bb1455) update auths code comment * Ensure `/run/containerd` gets created with correct perms ([#10534](containerd/containerd#10534)) * [`16c5fc768`](containerd/containerd@16c5fc7) Ensure /run/containerd is created with correct perms * Make `StopContainer` idempotent ([#10528](containerd/containerd#10528)) * [`6da4e40b2`](containerd/containerd@6da4e40) Make `StopContainer` RPC idempotent * Make `StopPodSandbox` idempotent ([#10527](containerd/containerd#10527)) * [`b3b6f1507`](containerd/containerd@b3b6f15) Make `StopPodSandbox` RPC idempotent * Fix failed force deletion for tasks with PID 0 ([#10523](containerd/containerd#10523)) * [`0db46f664`](containerd/containerd@0db46f6) client: fix tasks with PID 0 cannot be forced to delete * Update warnings for deprecated CRI config fields ([#10512](containerd/containerd#10512)) * [`9afb8dcdf`](containerd/containerd@9afb8dc) deprecation: update warnings for CRI config fields * Regenerate introspection UUID if state is empty ([#10510](containerd/containerd#10510)) * [`b140792e4`](containerd/containerd@b140792) introspection: regenerate UUID if state is empty * Set stderr to empty string when using terminal on Windows ([#10499](containerd/containerd#10499)) * [`f9beac3db`](containerd/containerd@f9beac3) Set stderr to empty string when using terminal on Windows. </p> </details> * **github.com/moby/sys/userns** v0.1.0 **_new_** Previous release can be found at [v1.7.20](https://github.com/containerd/containerd/releases/tag/v1.7.20)
open-beagle · Sep 4, 2024 · ec63e14 · ec63e14
2 parents 36e1d1e + 4727319
commit ec63e14
Show file tree

Hide file tree

Showing 63 changed files with 1,445 additions and 186 deletions.
diff --git a/.github/actions/install-go/action.yml b/.github/actions/install-go/action.yml
@@ -3,7 +3,7 @@ description: "Reusable action to install Go, so there is one place to bump Go ve
 inputs:
   go-version:
     required: true
-    default: "1.21.12"
+    default: "1.22.6"
     description: "Go version to install"
 
 runs:

diff --git a/.github/workflows/api-release.yml b/.github/workflows/api-release.yml
@@ -6,7 +6,7 @@ on:
 name: API Release
 
 env:
-  GO_VERSION: "1.21.12"
+  GO_VERSION: "1.22.6"
 
 permissions: # added using https://github.com/step-security/secure-workflows
   contents: read

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -33,7 +33,8 @@ jobs:
       - uses: ./.github/actions/install-go
       - uses: golangci/golangci-lint-action@v4
         with:
-          version: v1.56.1
+          only-new-issues: true
+          version: v1.60.1
           skip-cache: true
           args: --timeout=8m
 
@@ -191,7 +192,7 @@ jobs:
     strategy:
       matrix:
         os: [ubuntu-20.04, actuated-arm64-4cpu-16gb, macos-12, windows-2019, windows-2022]
-        go-version: ["1.21.12", "1.22.5"]
+        go-version: ["1.22.6", "1.23.0"]
     steps:
       - uses: actions/checkout@v4
       - uses: ./.github/actions/install-go

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -13,7 +13,7 @@ on:
 name: Release
 
 env:
-  GO_VERSION: "1.21.12"
+  GO_VERSION: "1.22.6"
 
 permissions: # added using https://github.com/step-security/secure-workflows
   contents: read

diff --git a/BUILDING.md b/BUILDING.md
@@ -15,7 +15,7 @@ This doc includes:
 To build the `containerd` daemon, and the `ctr` simple test client, the following build system dependencies are required:
 
 
-* Go 1.21.x or above
+* Go 1.22.x or above
 * Protoc 3.x compiler and headers (download at the [Google protobuf releases page](https://github.com/protocolbuffers/protobuf/releases))
 * Btrfs headers and libraries for your distribution. Note that building the btrfs driver can be disabled via the build tag `no_btrfs`, removing this dependency.
 

diff --git a/Vagrantfile b/Vagrantfile
@@ -104,7 +104,7 @@ EOF
   config.vm.provision "install-golang", type: "shell", run: "once" do |sh|
     sh.upload_path = "/tmp/vagrant-install-golang"
     sh.env = {
-        'GO_VERSION': ENV['GO_VERSION'] || "1.21.12",
+        'GO_VERSION': ENV['GO_VERSION'] || "1.22.6",
     }
     sh.inline = <<~SHELL
         #!/usr/bin/env bash

diff --git a/archive/tar.go b/archive/tar.go
@@ -29,9 +29,10 @@ import (
 	"syscall"
 	"time"
 
+	"github.com/moby/sys/userns"
+
 	"github.com/containerd/containerd/archive/tarheader"
 	"github.com/containerd/containerd/pkg/epoch"
-	"github.com/containerd/containerd/pkg/userns"
 	"github.com/containerd/continuity/fs"
 	"github.com/containerd/log"
 )

diff --git a/archive/tar_unix.go b/archive/tar_unix.go
@@ -27,10 +27,11 @@ import (
 	"strings"
 	"syscall"
 
-	"github.com/containerd/containerd/pkg/userns"
+	"github.com/moby/sys/userns"
+	"golang.org/x/sys/unix"
+
 	"github.com/containerd/continuity/fs"
 	"github.com/containerd/continuity/sysx"
-	"golang.org/x/sys/unix"
 )
 
 func chmodTarEntry(perm os.FileMode) os.FileMode {

diff --git a/cio/io.go b/cio/io.go
@@ -268,26 +268,6 @@ func BinaryIO(binary string, args map[string]string) Creator {
 	}
 }
 
-// TerminalBinaryIO forwards container STDOUT|STDERR directly to a logging binary
-// It also sets the terminal option to true
-func TerminalBinaryIO(binary string, args map[string]string) Creator {
-	return func(_ string) (IO, error) {
-		uri, err := LogURIGenerator("binary", binary, args)
-		if err != nil {
-			return nil, err
-		}
-
-		res := uri.String()
-		return &logURI{
-			config: Config{
-				Stdout:   res,
-				Stderr:   res,
-				Terminal: true,
-			},
-		}, nil
-	}
-}
-
 // LogFile creates a file on disk that logs the task's STDOUT,STDERR.
 // If the log file already exists, the logs will be appended to the file.
 func LogFile(path string) Creator {

diff --git a/cio/io_unix.go b/cio/io_unix.go
@@ -22,6 +22,7 @@ import (
 	"context"
 	"fmt"
 	"io"
+	"net/url"
 	"os"
 	"path/filepath"
 	"sync"
@@ -158,3 +159,37 @@ func NewDirectIO(ctx context.Context, fifos *FIFOSet) (*DirectIO, error) {
 		},
 	}, err
 }
+
+// TerminalLogURI provides the raw logging URI
+// as well as sets the terminal option to true.
+func TerminalLogURI(uri *url.URL) Creator {
+	return func(_ string) (IO, error) {
+		return &logURI{
+			config: Config{
+				Stdout:   uri.String(),
+				Stderr:   uri.String(),
+				Terminal: true,
+			},
+		}, nil
+	}
+}
+
+// TerminalBinaryIO forwards container STDOUT|STDERR directly to a logging binary
+// It also sets the terminal option to true
+func TerminalBinaryIO(binary string, args map[string]string) Creator {
+	return func(_ string) (IO, error) {
+		uri, err := LogURIGenerator("binary", binary, args)
+		if err != nil {
+			return nil, err
+		}
+
+		res := uri.String()
+		return &logURI{
+			config: Config{
+				Stdout:   res,
+				Stderr:   res,
+				Terminal: true,
+			},
+		}, nil
+	}
+}
diff --git a/cio/io_windows.go b/cio/io_windows.go
@@ -20,6 +20,7 @@ import (
 	"context"
 	"fmt"
 	"io"
+	"net/url"
 
 	winio "github.com/Microsoft/go-winio"
 	"github.com/containerd/log"
@@ -155,3 +156,42 @@ func NewDirectIOFromFIFOSet(ctx context.Context, stdin io.WriteCloser, stdout, s
 		},
 	}
 }
+
+// TerminalLogURI provides the raw logging URI
+// as well as sets the terminal option to true.
+func TerminalLogURI(uri *url.URL) Creator {
+	return func(_ string) (IO, error) {
+		return &logURI{
+			config: Config{
+				Terminal: true,
+				Stdout:   uri.String(),
+
+				// Windows HCSShim requires that stderr is an empty string when using terminal.
+				// https://github.com/microsoft/hcsshim/blob/200feabd854da69f615a598ed6a1263ce9531676/cmd/containerd-shim-runhcs-v1/service_internal.go#L127
+				Stderr: "",
+			},
+		}, nil
+	}
+}
+
+// TerminalBinaryIO forwards container STDOUT|STDERR directly to a logging binary
+// It also sets the terminal option to true
+func TerminalBinaryIO(binary string, args map[string]string) Creator {
+	return func(_ string) (IO, error) {
+		uri, err := LogURIGenerator("binary", binary, args)
+		if err != nil {
+			return nil, err
+		}
+
+		return &logURI{
+			config: Config{
+				Terminal: true,
+				Stdout:   uri.String(),
+
+				// Windows HCSShim requires that stderr is an empty string when using terminal.
+				// https://github.com/microsoft/hcsshim/blob/200feabd854da69f615a598ed6a1263ce9531676/cmd/containerd-shim-runhcs-v1/service_internal.go#L127
+				Stderr: "",
+			},
+		}, nil
+	}
+}
diff --git a/contrib/Dockerfile.test b/contrib/Dockerfile.test
@@ -29,7 +29,7 @@
 #   docker run --privileged containerd-test
 # ------------------------------------------------------------------------------
 
-ARG GOLANG_VERSION=1.21.12
+ARG GOLANG_VERSION=1.22.6
 ARG GOLANG_IMAGE=golang
 
 FROM ${GOLANG_IMAGE}:${GOLANG_VERSION} AS golang

diff --git a/contrib/fuzz/oss_fuzz_build.sh b/contrib/fuzz/oss_fuzz_build.sh
@@ -43,11 +43,11 @@ go run main.go --target_dir $SRC/containerd/images
 
 apt-get update && apt-get install -y wget
 cd $SRC
-wget --quiet https://go.dev/dl/go1.21.12.linux-amd64.tar.gz
+wget --quiet https://go.dev/dl/go1.22.6.linux-amd64.tar.gz
 
 mkdir temp-go
 rm -rf /root/.go/*
-tar -C temp-go/ -xzf go1.21.12.linux-amd64.tar.gz
+tar -C temp-go/ -xzf go1.22.6.linux-amd64.tar.gz
 mv temp-go/go/* /root/.go/
 cd $SRC/containerd
 

diff --git a/diff/apply/apply_linux.go b/diff/apply/apply_linux.go
@@ -23,12 +23,12 @@ import (
 	"os"
 	"strings"
 
+	"github.com/moby/sys/userns"
+	"golang.org/x/sys/unix"
+
 	"github.com/containerd/containerd/archive"
 	"github.com/containerd/containerd/mount"
-	"github.com/containerd/containerd/pkg/userns"
 	"github.com/containerd/errdefs"
-
-	"golang.org/x/sys/unix"
 )
 
 func apply(ctx context.Context, mounts []mount.Mount, r io.Reader, sync bool) (retErr error) {

diff --git a/go.mod b/go.mod
@@ -48,7 +48,8 @@ require (
 	github.com/moby/sys/sequential v0.5.0
 	github.com/moby/sys/signal v0.7.0
 	github.com/moby/sys/symlink v0.2.0
-	github.com/moby/sys/user v0.1.0
+	github.com/moby/sys/user v0.3.0
+	github.com/moby/sys/userns v0.1.0
 	github.com/opencontainers/go-digest v1.0.0
 	github.com/opencontainers/image-spec v1.1.0
 	github.com/opencontainers/runtime-spec v1.1.0
@@ -70,6 +71,7 @@ require (
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.19.0
 	go.opentelemetry.io/otel/sdk v1.21.0
 	go.opentelemetry.io/otel/trace v1.21.0
+	golang.org/x/net v0.23.0
 	golang.org/x/sync v0.5.0
 	golang.org/x/sys v0.18.0
 	google.golang.org/genproto v0.0.0-20231211222908-989df2bf70f3
@@ -132,7 +134,6 @@ require (
 	go.opentelemetry.io/proto/otlp v1.0.0 // indirect
 	golang.org/x/crypto v0.21.0 // indirect
 	golang.org/x/mod v0.12.0 // indirect
-	golang.org/x/net v0.23.0 // indirect
 	golang.org/x/oauth2 v0.11.0 // indirect
 	golang.org/x/term v0.18.0 // indirect
 	golang.org/x/text v0.14.0 // indirect

diff --git a/go.sum b/go.sum
@@ -545,8 +545,10 @@ github.com/moby/sys/signal v0.7.0/go.mod h1:GQ6ObYZfqacOwTtlXvcmh9A26dVRul/hbOZn
 github.com/moby/sys/symlink v0.1.0/go.mod h1:GGDODQmbFOjFsXvfLVn3+ZRxkch54RkSiGqsZeMYowQ=
 github.com/moby/sys/symlink v0.2.0 h1:tk1rOM+Ljp0nFmfOIBtlV3rTDlWOwFRhjEeAhZB0nZc=
 github.com/moby/sys/symlink v0.2.0/go.mod h1:7uZVF2dqJjG/NsClqul95CqKOBRQyYSNnJ6BMgR/gFs=
-github.com/moby/sys/user v0.1.0 h1:WmZ93f5Ux6het5iituh9x2zAG7NFY9Aqi49jjE1PaQg=
-github.com/moby/sys/user v0.1.0/go.mod h1:fKJhFOnsCN6xZ5gSfbM6zaHGgDJMrqt9/reuj4T7MmU=
+github.com/moby/sys/user v0.3.0 h1:9ni5DlcW5an3SvRSx4MouotOygvzaXbaSrc/wGDFWPo=
+github.com/moby/sys/user v0.3.0/go.mod h1:bG+tYYYJgaMtRKgEmuueC0hJEAZWwtIbZTB+85uoHjs=
+github.com/moby/sys/userns v0.1.0 h1:tVLXkFOxVu9A64/yh59slHVv9ahO9UIev4JZusOLG/g=
+github.com/moby/sys/userns v0.1.0/go.mod h1:IHUYgu/kao6N8YZlp9Cf444ySSvCmDlmzUcYfDHOl28=
 github.com/moby/term v0.0.0-20200312100748-672ec06f55cd/go.mod h1:DdlQx2hp0Ss5/fLikoLlEeIYiATotOjgB//nb973jeo=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=

diff --git a/integration/client/go.mod b/integration/client/go.mod
@@ -52,7 +52,8 @@ require (
 	github.com/moby/sys/mountinfo v0.6.2 // indirect
 	github.com/moby/sys/sequential v0.5.0 // indirect
 	github.com/moby/sys/signal v0.7.0 // indirect
-	github.com/moby/sys/user v0.1.0 // indirect
+	github.com/moby/sys/user v0.3.0 // indirect
+	github.com/moby/sys/userns v0.1.0 // indirect
 	github.com/opencontainers/selinux v1.11.0 // indirect
 	github.com/pelletier/go-toml v1.9.5 // indirect
 	github.com/pkg/errors v0.9.1 // indirect

diff --git a/integration/client/go.sum b/integration/client/go.sum
@@ -1820,8 +1820,10 @@ github.com/moby/sys/signal v0.6.0/go.mod h1:GQ6ObYZfqacOwTtlXvcmh9A26dVRul/hbOZn
 github.com/moby/sys/signal v0.7.0 h1:25RW3d5TnQEoKvRbEKUGay6DCQ46IxAVTT9CUMgmsSI=
 github.com/moby/sys/signal v0.7.0/go.mod h1:GQ6ObYZfqacOwTtlXvcmh9A26dVRul/hbOZn88Kg8Tg=
 github.com/moby/sys/symlink v0.2.0/go.mod h1:7uZVF2dqJjG/NsClqul95CqKOBRQyYSNnJ6BMgR/gFs=
-github.com/moby/sys/user v0.1.0 h1:WmZ93f5Ux6het5iituh9x2zAG7NFY9Aqi49jjE1PaQg=
-github.com/moby/sys/user v0.1.0/go.mod h1:fKJhFOnsCN6xZ5gSfbM6zaHGgDJMrqt9/reuj4T7MmU=
+github.com/moby/sys/user v0.3.0 h1:9ni5DlcW5an3SvRSx4MouotOygvzaXbaSrc/wGDFWPo=
+github.com/moby/sys/user v0.3.0/go.mod h1:bG+tYYYJgaMtRKgEmuueC0hJEAZWwtIbZTB+85uoHjs=
+github.com/moby/sys/userns v0.1.0 h1:tVLXkFOxVu9A64/yh59slHVv9ahO9UIev4JZusOLG/g=
+github.com/moby/sys/userns v0.1.0/go.mod h1:IHUYgu/kao6N8YZlp9Cf444ySSvCmDlmzUcYfDHOl28=
 github.com/moby/term v0.0.0-20210610120745-9d4ed1856297/go.mod h1:vgPCkQMyxTZ7IDy8SXRufE172gr8+K/JE/7hHFxHW3A=
 github.com/moby/term v0.0.0-20220808134915-39b0c02b01ae/go.mod h1:E2VnQOmVuvZB6UYnnDB0qG5Nq/1tD9acaOpo6xmt0Kw=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=

diff --git a/mount/mount_linux.go b/mount/mount_linux.go
@@ -26,7 +26,7 @@ import (
 	"strings"
 	"time"
 
-	"github.com/containerd/containerd/pkg/userns"
+	"github.com/moby/sys/userns"
 	"golang.org/x/sys/unix"
 )
 

diff --git a/oci/utils_unix.go b/oci/utils_unix.go
@@ -24,7 +24,7 @@ import (
 	"os"
 	"path/filepath"
 
-	"github.com/containerd/containerd/pkg/userns"
+	"github.com/moby/sys/userns"
 	specs "github.com/opencontainers/runtime-spec/specs-go"
 	"golang.org/x/sys/unix"
 )

diff --git a/oci/utils_unix_test.go b/oci/utils_unix_test.go
@@ -25,9 +25,8 @@ import (
 	"runtime"
 	"testing"
 
+	"github.com/moby/sys/userns"
 	"github.com/stretchr/testify/assert"
-
-	"github.com/containerd/containerd/pkg/userns"
 )
 
 func cleanupTest() {

diff --git a/pkg/cri/config/config.go b/pkg/cri/config/config.go
@@ -239,7 +239,7 @@ type Registry struct {
 	Configs map[string]RegistryConfig `toml:"configs" json:"configs"`
 	// Auths are registry endpoint to auth config mapping. The registry endpoint must
 	// be a valid url with host specified.
-	// DEPRECATED: Use ConfigPath instead. Remove in containerd 1.6.
+	// DEPRECATED: Use ConfigPath instead. Remove in containerd 2.0, supported in 1.x releases.
 	Auths map[string]AuthConfig `toml:"auths" json:"auths"`
 	// Headers adds additional HTTP headers that get sent to all registries
 	Headers map[string][]string `toml:"headers" json:"headers"`

diff --git a/pkg/cri/instrument/instrumented_service.go b/pkg/cri/instrument/instrumented_service.go
@@ -105,13 +105,13 @@ func (in *instrumentedAlphaService) checkInitialized(ctx context.Context) error
 
 // emitUsageWarning emits a warning when v1alpha2 cri-api is called.
 func (in *instrumentedAlphaService) emitUsageWarning(ctx context.Context) {
-	// Only emit the warning the first time an v1alpha2 api is called
+	// Only log the warning the first time an v1alpha2 api is called
 	in.emitWarning.Do(func() {
 		log.G(ctx).Warning("CRI API v1alpha2 is deprecated since containerd v1.7 and removed in containerd v2.0. Use CRI API v1 instead.")
-		if in.warn != nil {
-			in.warn.Emit(ctx, deprecation.CRIAPIV1Alpha2)
-		}
 	})
+	if in.warn != nil {
+		in.warn.Emit(ctx, deprecation.CRIAPIV1Alpha2)
+	}
 }
 
 func (in *instrumentedService) RunPodSandbox(ctx context.Context, r *runtime.RunPodSandboxRequest) (res *runtime.RunPodSandboxResponse, err error) {

diff --git a/pkg/cri/sbserver/container_stop.go b/pkg/cri/sbserver/container_stop.go
@@ -40,7 +40,14 @@ func (c *criService) StopContainer(ctx context.Context, r *runtime.StopContainer
 	// Get container config from container store.
 	container, err := c.containerStore.Get(r.GetContainerId())
 	if err != nil {
-		return nil, fmt.Errorf("an error occurred when try to find container %q: %w", r.GetContainerId(), err)
+		if !errdefs.IsNotFound(err) {
+			return nil, fmt.Errorf("an error occurred when try to find container %q: %w", r.GetContainerId(), err)
+		}
+
+		// The StopContainer RPC is idempotent, and must not return an error if
+		// the container has already been stopped. Ref:
+		// https://github.com/kubernetes/cri-api/blob/c20fa40/pkg/apis/runtime/v1/api.proto#L67-L68
+		return &runtime.StopContainerResponse{}, nil
 	}
 
 	if err := c.stopContainer(ctx, container, time.Duration(r.GetTimeout())*time.Second); err != nil {