containerd / containerd/nerdctl
Regression since v2.1.3: removing CRI containers fails on missing network annotations
- Dominant language
- Go
- Stars
- 10.4k
- Forks
- 826
- Avg merge
- 1d 23h
- Merged PRs (30d)
- 44
Description
### Description
Removing a stopped Kubernetes/CRI-created container fails with `unexpected end of JSON input` when its OCI spec lacks the `nerdctl/networks` annotation. This appears to reintroduce #3765 / #3771: #4290 added an early return after `NetworkOptionsFromSpec`, before the existing nonfatal fallback and `c.Delete`.
Confirmed with official release binaries on the same Linux/containerd host:
- **v2.1.3:** `nerdctl -n k8s.io rm ` exits 1; container record remains.
- **v2.1.2:** immediately afterward, removes that exact same exited container, exit 0 (network metadata warning is nonfatal).
- **v2.3.5:** a fresh equivalent exited CRI container fails identically, exit 1; record remains.
### Steps to reproduce the issue
On a disposable Kubernetes/containerd test node, using a namespace where this Pod is permitted:
```yaml
apiVersion: v1
kind: Pod
metadata:
name: nerdctl-rm-repro
spec:
restartPolicy: Never
containers:
- name: probe
image: busybox:1.34.1
command: ["sh", "-c", "echo repro; exit 0"]
```
1. Create the Pod and wait for phase `Succeeded` (our test used an already-cached mirror of busybox).
2. On its assigned node, obtain its container ID from `crictl ps -a` or the Pod's `status.containerStatuses[].containerID` (strip `containerd://`). Confirm `crictl inspect ` reports `CONTAINER_EXITED`.
3. Confirm `ctr -n k8s.io containers info ` shows `io.cri-containerd.kind=container` and no `nerdctl/networks` spec annotation.
4. Run standalone v2.1.3 `nerdctl -n k8s.io rm `, check exit code and whether `ctr -n k8s.io containers info ` still succeeds.
5. Repeat with v2.1.2 on the same record. Use a fresh completed Pod to test v2.3.5.
6. Delete the disposable Pods with kubectl afterward. Do not use active workloads for this test.
### Describe the results you received and expected
v2.1.3 and v2.3.5:
```text
level=fatal msg="1 errors:\nunexpected end of JSON input"
exit_code=1
container_record=present
```
v2.1.2, on the same record previously rejected by v2.1.3:
```text
level=info msg="unable to retrieve networking information for that container" ... error="unexpected end of JSON input"
exit_code=0
container_record=absent
```
Expected: preserve #3771's nonfatal handling of missing nerdctl network annotations and remove the exited container. If cross-tool removal is intentionally unsupported, please fail clearly before making partial changes.
Related independent report: https://github.com/rancher-sandbox/rancher-desktop/issues/9116.
### What version of nerdctl are you using?
Official Linux amd64 release binaries v2.1.2, v2.1.3, and v2.3.5; archives verified against release SHA256SUMS.
### Are you using a variant of nerdctl?
No; official upstream binaries.
### Host information
Linux; Kubernetes-created container. Detailed host configuration omitted.
Source comparison: [v2.1.2 remove.go](https://github.com/containerd/nerdctl/blob/v2.1.2/pkg/cmd/container/remove.go), [v2.1.3 remove.go](https://github.com/containerd/nerdctl/blob/v2.1.3/pkg/cmd/container/remove.go), [v2.3.5 remove.go](https://github.com/containerd/nerdctl/blob/v2.3.5/pkg/cmd/container/remove.go).
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.