[Dallas Delaney (dallasd1)]

Summary

Patch containerd to be able to discover dmverity OCI referrers if new config option enable_dmverity_referrers is present. This patch represents changes to support this in the CRI, transfer service, unpacker, differ, snapshotter, and mount paths.

Tests have intentionally been stripped from this patch to reduce its size.

Additions

• Discover and fetch signed dm-verity referrers if they are present. The transfer service discovers referrers with artifactType application/vnd.containerd.erofs.dmverity.v1 for an image manifest and stores its per-layer EROFS metadata, Merkle tree, and detached PKCS#7 root-hash signature in the content store.
• Update the container resolver to identify parent snapshots that have a signed ChainID key
• Keep signed and unsigned snapshots independent of each other. Unsigned snapshots are unchanged. They retain pre-existing OCI ChainID keys. Signed snapshots use a separate key appended with "-dmverity". Images sharing layers can therefore use either key without replacing snapshots underneath existing containers.
• Reuse cached signed snapshots. Signed cache hits from snapshot key IDs and concurrent snapshot commits are checked against the root-hash label identity before reuse.
• Fetch without unpacking to allow AgentBaker to precache images without going through the transfer service. When the snapshotter advertises dm-verity-referrer support, transfer fetch-only requests retain the dmverity bundle and its payloads without creating snapshots.
• Create containers offline from a complete cache. If referrer data was fetched without unpacking, CRI can reconstruct signed materializations from retained image content and referrer artifacts without contacting the registry.
• Preserve ordinary paths. OverlayFS unpack remains unchanged.
• With EROFS in auto mode, images without a dmverity referrer continue through ordinary unsigned materialization.
• During FS mount, the kernel verifies the root-hash signature against its trusted keyrings. During container runtime, dm-verity checks reads against the Merkle tree.
• Setting config option enable_dmverity_referrers indicates the snapshotter is capable of referrer fetching. The snapshotter will materialize the published artifacts alongside the original layer tar data.

Limitations and Prerequisites

• This is an opt-in feature. Signed referrer execution requires enable_dmverity_referrers  enabled in the config, a compatible dm-verity mode, and the required kernel support.
• There must only be one dmverity referrer per image manifest. Multiple distinct referrers are rejected. There is no newest-referrer selection. This would require replacing ignoring cached snapshotter metadata and always replacing signatures, even for layers that haven't changed.
• A pre-existing race condition exists where two container process try to mount the same block device at the same time. The first one wins and the second fails with EBUSY. This is intentionally not resolved in this patch as it is outside the scope of this feature.
• Signed Kubernetes image volumes are unsupported. CRI rejects them on dm-verity-capable snapshotters instead of silently unpacking them unsigned. This restriction does not apply to ordinary OverlayFS volumes.
• Legacy client paths are not automatically integrated. The supported integration is in the transfer service plus CRI. Direct client Fetch() and ordinary client unpack/snapshot calls do not automatically exercise behavior.

PR that will invoke this behavior when IPE is enabled: #98

Change Log

• Add containerd patch based on three containerd functionality PRs

Type of Change

• Image build change (base image, sysexts, OEM images)
• Package/SPEC update
• CI/automation change
• SDK/toolchain update
• Configuration change
• Documentation update
• Bug fix

Does this affect the image build?

• Yes
• No

Associated Issues

Test Methodology

Test methods:

• acl-pipelines
• MAP pre-release tests
• MAP conformance tests
• AKS e2e tests
• local validation of non-IPE OverlayFS (default) and IPE EROFS expected behavior

Merge Checklist

All applicable boxes should be checked before merging

• Image builds successfully with this change (or image build is not affected)
• Any updated packages/SPECs build successfully
• Relevant kola tests pass
• All package sources are available
• Source files have up-to-date hashes/manifests
• Documentation has been updated to match any changes
• Ready to merge

[Copilot]

🟡 Changes recommended

The security-critical referrer discovery and validation pipeline lacks focused automated tests.

1 open finding

• Add unit tests for referrer discovery and validation paths · New

What changed in this PR

Adds opt-in signed dm-verity referrer support to containerd’s EROFS snapshotter and CRI integration.

Changes:

• Discovers, caches, validates, and materializes signed dm-verity artifacts.
• Separates signed and unsigned snapshot identities and supports offline reuse.
• Enables the patch in the containerd2 RPM.

File	Description
acl/​SPECS/​containerd2/​erofs-signed-dmverity.patch	Implements signed referrer handling across transfer, CRI, unpack, EROFS, and dm-verity paths.
acl/​SPECS/​containerd2/​containerd2.spec	Applies the patch and increments the package release.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Dallas Delaney (dallasd1)]

Adding a comment from the config toggle PR as a limitation of this change:

"AgentBaker skips existing images by name and otherwise imports the pause image using the default overlayfs snapshotter. If it is only prepared for overlayfs, switching to EROFS triggers another pull.

On network-isolated nodes whose bootstrap registry requires authentication, that runtime pull cannot authenticate. Pods then cannot start, even though the pause image is already cached.

Azure/AgentBaker#9761 updates VHD precaching but does not change this bootstrap logic."

[Copilot]

🟡 Changes recommended

Test-compilation failures, image-selection and cache regressions, and unbounded signature reads remain unresolved.

6 open issues

• Use the requested manifest for signed image validation · New
• Bound signature reads to prevent memory exhaustion · New
• Update EROFS tests for new helper signatures · New
• Preserve unambiguous ID-based cached image resolution · New
• Refresh cached snapshotters for existing image references · New
• Add unit tests for referrer discovery and validation paths

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

Unsigned image-ID resolution can regress, and security-sensitive snapshot isolation and mount guards lack targeted regression tests.

5 open issues

• Add regression tests for snapshot isolation and cache validation · New
• Allow resolution of unsigned manifests sharing a config · New
• Add coverage for signed-parent protection in merged fsmeta · New
• Refresh cached snapshotters for existing image references
• Add unit tests for referrer discovery and validation paths

4 resolved since last review

• Update EROFS tests for new helper signatures
• Bound signature reads to prevent memory exhaustion
• Use the requested manifest for signed image validation
• Preserve unambiguous ID-based cached image resolution

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

The security-critical integration across referrer discovery, snapshot caching, and kernel verification requires final human validation.

No open issues 🎉

5 resolved since last review

• Add coverage for signed-parent protection in merged fsmeta
• Allow resolution of unsigned manifests sharing a config
• Add regression tests for snapshot isolation and cache validation
• Refresh cached snapshotters for existing image references
• Add unit tests for referrer discovery and validation paths

_{Review effort: Balanced}

[aadhar-agarwal]

suggestion (non-blocking): Please retain the focused signed-referrer and snapshot-cache regression tests, possibly in a separate test-only patch. Removing them means the RPM's make test does not exercise the new signed-lifecycle cases when this patch is updated later.