From 61ef8af5c164b6bbc9a25a4e7972c8fab343348b Mon Sep 17 00:00:00 2001 From: Mateo Lelong Date: Wed, 15 Apr 2026 10:48:34 +0200 Subject: [PATCH 1/2] fix(shimkit): fix OTEL init in start mode + add TLS (compat with published 1.0.0 Signed-off-by: Mateo Lelong --- Cargo.lock | 13 +++++++++++++ crates/containerd-shimkit/Cargo.toml | 1 + crates/containerd-shimkit/src/sandbox/cli.rs | 15 ++++++++++----- .../containerd-shimkit/src/sandbox/shim/otel.rs | 2 +- 4 files changed, 25 insertions(+), 6 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 770341c2bc..4906deb466 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -4688,6 +4688,7 @@ dependencies = [ "percent-encoding", "pin-project-lite", "rustls 0.21.12", + "rustls-native-certs", "rustls-pemfile 1.0.4", "serde", "serde_json", @@ -4927,6 +4928,18 @@ dependencies = [ "zeroize", ] +[[package]] +name = "rustls-native-certs" +version = "0.6.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a9aace74cb666635c918e9c12bc0d348266037aa8eb599b5cba565709a8dff00" +dependencies = [ + "openssl-probe", + "rustls-pemfile 1.0.4", + "schannel", + "security-framework", +] + [[package]] name = "rustls-pemfile" version = "1.0.4" diff --git a/crates/containerd-shimkit/Cargo.toml b/crates/containerd-shimkit/Cargo.toml index b3f39e6ba0..7576c5fe4d 100644 --- a/crates/containerd-shimkit/Cargo.toml +++ b/crates/containerd-shimkit/Cargo.toml @@ -51,6 +51,7 @@ opentelemetry-otlp = { version = "0.16.0", default-features = false, features = "grpc-tonic", "http-proto", "reqwest-client", + "reqwest-rustls", "trace", ], optional = true } opentelemetry_sdk = { version = "0.23", default-features = false, features = [ diff --git a/crates/containerd-shimkit/src/sandbox/cli.rs b/crates/containerd-shimkit/src/sandbox/cli.rs index 709294b2c2..83cdca4e1a 100644 --- a/crates/containerd-shimkit/src/sandbox/cli.rs +++ b/crates/containerd-shimkit/src/sandbox/cli.rs @@ -246,13 +246,18 @@ where } #[cfg(feature = "opentelemetry")] - if otel_traces_enabled() { + // Only initialize OTEL in serve mode (empty action). + if otel_traces_enabled() && flags.action.is_empty() { // opentelemetry uses tokio, so we need to initialize a runtime async { - let otlp_config = OtlpConfig::build_from_env().expect("Failed to build OtelConfig."); - let _guard = otlp_config - .init() - .expect("Failed to initialize OpenTelemetry."); + let _guard = OtlpConfig::build_from_env() + .and_then(|c| c.init()) + .map_err(|e| { + eprintln!( + "Failed to initialize OpenTelemetry (continuing without tracing): {e}" + ) + }) + .ok(); tokio::task::block_in_place(move || { shim_main_inner::(name, config); }); diff --git a/crates/containerd-shimkit/src/sandbox/shim/otel.rs b/crates/containerd-shimkit/src/sandbox/shim/otel.rs index dbaec9334c..162de3224f 100644 --- a/crates/containerd-shimkit/src/sandbox/shim/otel.rs +++ b/crates/containerd-shimkit/src/sandbox/shim/otel.rs @@ -88,7 +88,7 @@ impl Config { /// Initializes the tracer, sets up the telemetry and subscriber layers, and sets the global subscriber. /// /// Note: this function should be called only once and be called by the binary entry point. - pub fn init(&self) -> anyhow::Result { + pub fn init(&self) -> anyhow::Result> { let tracer = self.init_tracer()?; let telemetry = tracing_opentelemetry::layer().with_tracer(tracer); set_text_map_propagator(TraceContextPropagator::new()); From 34a2ab926f3a81b0b4156b20ca742292e88b354f Mon Sep 17 00:00:00 2001 From: Mateo Lelong Date: Wed, 3 Jun 2026 16:47:03 +0200 Subject: [PATCH 2/2] fix(shimkit): replace use<> in public API with named types Signed-off-by: Mateo Lelong --- crates/containerd-shimkit/src/sandbox/shim/otel.rs | 4 ++-- crates/containerd-shimkit/src/sandbox/sync.rs | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/crates/containerd-shimkit/src/sandbox/shim/otel.rs b/crates/containerd-shimkit/src/sandbox/shim/otel.rs index 162de3224f..07bae70942 100644 --- a/crates/containerd-shimkit/src/sandbox/shim/otel.rs +++ b/crates/containerd-shimkit/src/sandbox/shim/otel.rs @@ -88,7 +88,7 @@ impl Config { /// Initializes the tracer, sets up the telemetry and subscriber layers, and sets the global subscriber. /// /// Note: this function should be called only once and be called by the binary entry point. - pub fn init(&self) -> anyhow::Result> { + pub fn init(&self) -> anyhow::Result { let tracer = self.init_tracer()?; let telemetry = tracing_opentelemetry::layer().with_tracer(tracer); set_text_map_propagator(TraceContextPropagator::new()); @@ -154,7 +154,7 @@ impl Config { /// Shutdown of the open telemetry services will automatically called when the OtelConfig instance goes out of scope. #[must_use] -struct ShutdownGuard; +pub struct ShutdownGuard; impl Drop for ShutdownGuard { fn drop(&mut self) { diff --git a/crates/containerd-shimkit/src/sandbox/sync.rs b/crates/containerd-shimkit/src/sandbox/sync.rs index 281033d2a0..414d505b87 100644 --- a/crates/containerd-shimkit/src/sandbox/sync.rs +++ b/crates/containerd-shimkit/src/sandbox/sync.rs @@ -80,7 +80,7 @@ impl WaitableCell { /// The function `f` will always be called, regardless of whether the `WaitableCell` has a value or not. /// The `WaitableCell` is going to be set even in the case of an unwind. In this case, ff the function `f` /// panics it will cause an abort, so it's recommended to avoid any panics in `f`. - pub fn set_guard_with, F: FnOnce() -> R>(&self, f: F) -> impl Drop + use { + pub fn set_guard_with, F: FnOnce() -> R>(&self, f: F) -> impl Drop { let cell = (*self).clone(); WaitableCellSetGuard { f: Some(f), cell } }