feat(shim): add containerd access session

Signed-off-by: sidneychang <2190206983@qq.com>

Author: sidneychang

Makefile

@@ -73,6 +73,7 @@ URUNC_SRC      += $(wildcard $(CURDIR)/pkg/unikontainers/initrd/*.go)
 URUNC_SRC      += $(wildcard $(CURDIR)/pkg/network/*.go)
 SHIM_SRC       := $(wildcard $(CURDIR)/cmd/containerd-shim-urunc-v2/*.go)
 SHIM_SRC       += $(wildcard $(CURDIR)/pkg/containerd-shim/*.go)
+SHIM_SRC       += $(wildcard $(CURDIR)/pkg/containerd-shim/containerd/*.go)
 
 #? CNTR_TOOL Tool to run the linter container (default: docker)
 CNTR_TOOL ?= docker

go.mod

@@ -28,6 +28,7 @@ require (
 	github.com/vishvananda/netlink v1.3.1
 	github.com/vishvananda/netns v0.0.5
 	golang.org/x/sys v0.43.0
+	google.golang.org/grpc v1.79.3
 	k8s.io/cri-api v0.35.4
 )
 
@@ -79,7 +80,6 @@ require (
 	golang.org/x/tools v0.41.0 // indirect
 	google.golang.org/genproto v0.0.0-20260128011058-8636f8732409 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260128011058-8636f8732409 // indirect
-	google.golang.org/grpc v1.79.3 // indirect
 	google.golang.org/protobuf v1.36.11 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )

pkg/containerd-shim/containerd/client.go

@@ -0,0 +1,230 @@
+// Copyright (c) 2023-2026, Nubificus LTD
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package containerd
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	containersapi "github.com/containerd/containerd/api/services/containers/v1"
+	contentapi "github.com/containerd/containerd/api/services/content/v1"
+	imagesapi "github.com/containerd/containerd/api/services/images/v1"
+	leasesapi "github.com/containerd/containerd/api/services/leases/v1"
+	snapshotsapi "github.com/containerd/containerd/api/services/snapshots/v1"
+	"github.com/containerd/containerd/defaults"
+	"github.com/containerd/containerd/errdefs"
+	"github.com/containerd/containerd/namespaces"
+	"github.com/containerd/containerd/pkg/dialer"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/backoff"
+	"google.golang.org/grpc/credentials/insecure"
+)
+
+const defaultConnectTimeout = 10 * time.Second
+
+type Session struct {
+	conn *grpc.ClientConn
+
+	namespace   string
+	containerID string
+	container   *containersapi.Container
+}
+
+func OpenSession(ctx context.Context, address, containerID string) (*Session, error) {
+	if address == "" {
+		return nil, fmt.Errorf("containerd address is empty")
+	}
+	if containerID == "" {
+		return nil, fmt.Errorf("container id is empty")
+	}
+
+	namespace, err := namespaces.NamespaceRequired(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	backoffConfig := backoff.DefaultConfig
+	backoffConfig.MaxDelay = 3 * time.Second
+	dialOptions := []grpc.DialOption{
+		grpc.WithBlock(),
+		grpc.WithTransportCredentials(insecure.NewCredentials()),
+		grpc.FailOnNonTempDialError(true),
+		grpc.WithConnectParams(grpc.ConnectParams{Backoff: backoffConfig}),
+		grpc.WithContextDialer(dialer.ContextDialer),
+		grpc.WithReturnConnectionError(),
+		grpc.WithDefaultCallOptions(
+			grpc.MaxCallRecvMsgSize(defaults.DefaultMaxRecvMsgSize),
+			grpc.MaxCallSendMsgSize(defaults.DefaultMaxSendMsgSize),
+		),
+	}
+
+	dialCtx, cancel := context.WithTimeout(ctx, defaultConnectTimeout)
+	defer cancel()
+
+	conn, err := grpc.DialContext(dialCtx, dialer.DialAddress(address), dialOptions...)
+	if err != nil {
+		return nil, fmt.Errorf("dial containerd at %q: %w", address, err)
+	}
+
+	session := &Session{
+		conn:        conn,
+		namespace:   namespace,
+		containerID: containerID,
+	}
+
+	container, err := loadContainer(ctx, namespace, containerID, session.containersClient())
+	if err != nil {
+		if closeErr := conn.Close(); closeErr != nil {
+			return nil, fmt.Errorf("loadContainer failed: %w; close containerd connection: %v", err, closeErr)
+		}
+		return nil, fmt.Errorf("loadContainer failed: %w", err)
+	}
+	session.container = container
+
+	return session, nil
+}
+
+func (s *Session) Close() error {
+	if s == nil || s.conn == nil {
+		return nil
+	}
+	return s.conn.Close()
+}
+
+type BaseAccess struct {
+	namespace   string
+	containerID string
+	container   *containersapi.Container
+}
+
+func newBaseAccess(s *Session) BaseAccess {
+	return BaseAccess{
+		namespace:   s.namespace,
+		containerID: s.containerID,
+		container:   s.container,
+	}
+}
+
+func (a BaseAccess) Namespace() string {
+	return a.namespace
+}
+
+func (a BaseAccess) ContainerID() string {
+	return a.containerID
+}
+
+func (a BaseAccess) Container() *containersapi.Container {
+	return a.container
+}
+
+func (a BaseAccess) WithNamespace(ctx context.Context) context.Context {
+	return withNamespace(ctx, a.namespace)
+}
+
+type AnnotationAccess struct {
+	BaseAccess
+
+	images  imagesapi.ImagesClient
+	content contentapi.ContentClient
+}
+
+func NewAnnotationAccess(s *Session) AnnotationAccess {
+	return AnnotationAccess{
+		BaseAccess: newBaseAccess(s),
+		images:     s.imagesClient(),
+		content:    s.contentClient(),
+	}
+}
+
+func (a AnnotationAccess) Images() imagesapi.ImagesClient {
+	return a.images
+}
+
+func (a AnnotationAccess) Content() contentapi.ContentClient {
+	return a.content
+}
+
+type SnapshotViewAccess struct {
+	BaseAccess
+
+	snapshots snapshotsapi.SnapshotsClient
+	leases    leasesapi.LeasesClient
+}
+
+func NewSnapshotViewAccess(s *Session) SnapshotViewAccess {
+	return SnapshotViewAccess{
+		BaseAccess: newBaseAccess(s),
+		snapshots:  s.snapshotsClient(),
+		leases:     s.leasesClient(),
+	}
+}
+
+func (a SnapshotViewAccess) Snapshots() snapshotsapi.SnapshotsClient {
+	return a.snapshots
+}
+
+func (a SnapshotViewAccess) Leases() leasesapi.LeasesClient {
+	return a.leases
+}
+
+func loadContainer(ctx context.Context, namespace, containerID string, client containersapi.ContainersClient) (*containersapi.Container, error) {
+	resp, err := client.Get(withNamespace(ctx, namespace), &containersapi.GetContainerRequest{
+		ID: containerID,
+	})
+	if err != nil {
+		return nil, fmt.Errorf("get container %q: %w", containerID, containerdErr(err))
+	}
+	container := resp.GetContainer()
+	if container == nil {
+		return nil, fmt.Errorf("get container %q: empty response", containerID)
+	}
+
+	return container, nil
+}
+
+func withNamespace(ctx context.Context, namespace string) context.Context {
+	if ctx == nil {
+		ctx = context.Background()
+	}
+	return namespaces.WithNamespace(ctx, namespace)
+}
+
+func containerdErr(err error) error {
+	if err == nil {
+		return nil
+	}
+	return errdefs.FromGRPC(err)
+}
+
+func (s *Session) containersClient() containersapi.ContainersClient {
+	return containersapi.NewContainersClient(s.conn)
+}
+
+func (s *Session) imagesClient() imagesapi.ImagesClient {
+	return imagesapi.NewImagesClient(s.conn)
+}
+
+func (s *Session) contentClient() contentapi.ContentClient {
+	return contentapi.NewContentClient(s.conn)
+}
+
+func (s *Session) snapshotsClient() snapshotsapi.SnapshotsClient {
+	return snapshotsapi.NewSnapshotsClient(s.conn)
+}
+
+func (s *Session) leasesClient() leasesapi.LeasesClient {
+	return leasesapi.NewLeasesClient(s.conn)
+}