feat(shim): add containerd access session

Signed-off-by: sidneychang <2190206983@qq.com>

Author: sidneychang

go.mod

@@ -28,6 +28,7 @@ require (
 	github.com/vishvananda/netlink v1.3.1
 	github.com/vishvananda/netns v0.0.5
 	golang.org/x/sys v0.43.0
+	google.golang.org/grpc v1.79.3
 	k8s.io/cri-api v0.35.4
 )
 
@@ -79,7 +80,6 @@ require (
 	golang.org/x/tools v0.41.0 // indirect
 	google.golang.org/genproto v0.0.0-20260128011058-8636f8732409 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260128011058-8636f8732409 // indirect
-	google.golang.org/grpc v1.79.3 // indirect
 	google.golang.org/protobuf v1.36.11 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )

pkg/containerd-shim/containerd_session.go

@@ -0,0 +1,184 @@
+// Copyright (c) 2023-2026, Nubificus LTD
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package containerdshim
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	containersapi "github.com/containerd/containerd/api/services/containers/v1"
+	contentapi "github.com/containerd/containerd/api/services/content/v1"
+	imagesapi "github.com/containerd/containerd/api/services/images/v1"
+	leasesapi "github.com/containerd/containerd/api/services/leases/v1"
+	snapshotsapi "github.com/containerd/containerd/api/services/snapshots/v1"
+	"github.com/containerd/containerd/defaults"
+	"github.com/containerd/containerd/errdefs"
+	"github.com/containerd/containerd/namespaces"
+	"github.com/containerd/containerd/pkg/dialer"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/backoff"
+	"google.golang.org/grpc/credentials/insecure"
+)
+
+const defaultConnectTimeout = 10 * time.Second
+
+// ContainerdSession owns one shim-side connection to containerd for a single task
+// operation. It intentionally does not expose the underlying grpc connection,
+// but it does expose narrow generated service clients for feature helpers.
+type ContainerdSession struct {
+	conn *grpc.ClientConn
+
+	namespace   string
+	containerID string
+	container   *containersapi.Container
+}
+
+// OpenContainerdSession opens a narrow containerd session for a single task operation.
+// The containerd namespace must already be present in ctx.
+func OpenContainerdSession(ctx context.Context, address, containerID string) (*ContainerdSession, error) {
+	if address == "" {
+		return nil, fmt.Errorf("containerd address is empty")
+	}
+	if containerID == "" {
+		return nil, fmt.Errorf("container id is empty")
+	}
+
+	namespace, err := namespaces.NamespaceRequired(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	backoffConfig := backoff.DefaultConfig
+	backoffConfig.MaxDelay = 3 * time.Second
+	dialOptions := []grpc.DialOption{
+		grpc.WithBlock(),
+		grpc.WithTransportCredentials(insecure.NewCredentials()),
+		grpc.FailOnNonTempDialError(true),
+		grpc.WithConnectParams(grpc.ConnectParams{Backoff: backoffConfig}),
+		grpc.WithContextDialer(dialer.ContextDialer),
+		grpc.WithReturnConnectionError(),
+		grpc.WithDefaultCallOptions(
+			grpc.MaxCallRecvMsgSize(defaults.DefaultMaxRecvMsgSize),
+			grpc.MaxCallSendMsgSize(defaults.DefaultMaxSendMsgSize),
+		),
+	}
+
+	dialCtx, cancel := context.WithTimeout(ctx, defaultConnectTimeout)
+	defer cancel()
+
+	conn, err := grpc.DialContext(dialCtx, dialer.DialAddress(address), dialOptions...)
+	if err != nil {
+		return nil, fmt.Errorf("dial containerd at %q: %w", address, err)
+	}
+
+	session := &ContainerdSession{
+		conn:        conn,
+		namespace:   namespace,
+		containerID: containerID,
+	}
+
+	if err := session.loadContainer(ctx); err != nil {
+		if closeErr := conn.Close(); closeErr != nil {
+			return nil, fmt.Errorf("%w; close containerd connection: %v", err, closeErr)
+		}
+		return nil, err
+	}
+
+	return session, nil
+}
+
+// Close closes the underlying containerd connection.
+func (s *ContainerdSession) Close() error {
+	if s == nil || s.conn == nil {
+		return nil
+	}
+	return s.conn.Close()
+}
+
+// Namespace returns the containerd namespace bound to this session.
+func (s *ContainerdSession) Namespace() string {
+	return s.namespace
+}
+
+// ContainerID returns the container ID bound to this session.
+func (s *ContainerdSession) ContainerID() string {
+	return s.containerID
+}
+
+// Container returns the task-level container metadata loaded during session
+// creation.
+func (s *ContainerdSession) Container() *containersapi.Container {
+	return s.container
+}
+
+func (s *ContainerdSession) loadContainer(ctx context.Context) error {
+	resp, err := s.ContainersClient().Get(s.withNamespace(ctx), &containersapi.GetContainerRequest{
+		ID: s.containerID,
+	})
+	if err != nil {
+		return fmt.Errorf("get container %q: %w", s.containerID, containerdErr(err))
+	}
+	if resp.GetContainer() == nil {
+		return fmt.Errorf("get container %q: empty response", s.containerID)
+	}
+
+	s.container = resp.GetContainer()
+	return nil
+}
+
+func (s *ContainerdSession) withNamespace(ctx context.Context) context.Context {
+	if ctx == nil {
+		ctx = context.Background()
+	}
+	return namespaces.WithNamespace(ctx, s.namespace)
+}
+
+func containerdErr(err error) error {
+	if err == nil {
+		return nil
+	}
+	return errdefs.FromGRPC(err)
+}
+
+// ContainersClient returns a generated containers service client scoped to the
+// session connection.
+func (s *ContainerdSession) ContainersClient() containersapi.ContainersClient {
+	return containersapi.NewContainersClient(s.conn)
+}
+
+// ImagesClient returns a generated images service client scoped to the session
+// connection.
+func (s *ContainerdSession) ImagesClient() imagesapi.ImagesClient {
+	return imagesapi.NewImagesClient(s.conn)
+}
+
+// ContentClient returns a generated content service client scoped to the
+// session connection.
+func (s *ContainerdSession) ContentClient() contentapi.ContentClient {
+	return contentapi.NewContentClient(s.conn)
+}
+
+// SnapshotsClient returns a generated snapshots service client scoped to the
+// session connection.
+func (s *ContainerdSession) SnapshotsClient() snapshotsapi.SnapshotsClient {
+	return snapshotsapi.NewSnapshotsClient(s.conn)
+}
+
+// LeasesClient returns a generated leases service client scoped to the session
+// connection.
+func (s *ContainerdSession) LeasesClient() leasesapi.LeasesClient {
+	return leasesapi.NewLeasesClient(s.conn)
+}