Arbitrary image pinning support (i.e. to exclude from kubelet's image GC)

[cielavenir]

When containerd-snapshotter is configured, ctr can access docker image list by --namespace moby:

└─$ sudo ctr --namespace moby images ls
REF                                                                                                                  TYPE                                                      DIGEST                                                                  SIZE      PLATFORMS                                                                       LABELS                                 
docker.private/ci-abcde                                application/vnd.oci.image.index.v1+json                   sha256:95920585adb12563ed245745d12766fb1f33d74514a07fbb129c00d830fa9507 2.7 GiB   linux/amd64                                                                     io.cri-containerd.pinned=pinned

└─$ sudo k3s crictl images -o json | jq '.images[] | {repoTags,id,pinned}'
{
  "repoTags": [
    "docker.private/ci-abcde"
  ],
  "id": "sha256:95920585adb12563ed245745d12766fb1f33d74514a07fbb129c00d830fa9507",
  "pinned": false
}

According to containerd/containerd#6930 , io.cri-containerd.pinned=pinned label should cause cri to recognize the image is pinned, but it does not.

After checking with Claude, most likely that cri-dockerd does not have the feature to read that label. So, could you add that?

[cielavenir]

cc @pico737 (collegue)

[afbjorklund]

The "pinned" support in cri-dockerd only knows about the sandbox image (i.e. "registry.k8s.io/pause")

It will not recognize any labels from cri-containerd, and there are no matching labels for cri-dockerd

It was just a hack when dockershim was removed, and pod-infra-container moved from kubelet to cri-dockerd

https://github.com/kubernetes/enhancements/tree/master/keps/sig-node/2040-kubelet-cri#pinned-images

• Add support for pinning the infra container image #39

It would need more cri-dockerd code, to support pinned images.