Function WithImageConfigLabels

client/container_opts.go:123–160

WithImageConfigLabels sets the image config labels on the container. The existing labels are cleared as this is expected to be the first operation in setting up a container's labels. Use WithAdditionalContainerLabels to add/overwrite the existing image config labels. Image config labels in the name

(image Image)

// (containerd.io/) and the CRI plugin (io.cri-containerd) are not copied
// to the container.
func WithImageConfigLabels(image Image) NewContainerOpts {
	return func(ctx context.Context, _ *Client, c *containers.Container) error {
		ic, err := image.Config(ctx)
		if err != nil {
			return err
		}
		if !images.IsConfigType(ic.MediaType) {
			return fmt.Errorf("unknown image config media type %s", ic.MediaType)
		}

		var (
			ociimage v1.Image
			config   v1.ImageConfig
		)
		p, err := content.ReadBlob(ctx, image.ContentStore(), ic)
		if err != nil {
			return err
		}

		if err = json.Unmarshal(p, &ociimage); err != nil {
			return err
		}
		config = ociimage.Config

		c.Labels = config.Labels
		// Labels in the containerd.io/* namespace are interpreted by containerd
		// itself, and labels in the io.cri-containerd.* namespace are interpreted
		// by the CRI plugin, so they are not copied from untrusted image configs.
		maps.DeleteFunc(c.Labels, func(k, _ string) bool {
			if labels.IsReserved(k) {
				log.G(ctx).Warnf("skipping image label %q: the label namespace is reserved for containerd; possible malicious image attempting to alter containerd behavior", k)
				return true
			}
			return false
		})
		return nil
	}
}

// WithAdditionalContainerLabels adds the provided labels to the container
// The existing labels are preserved as long as they do not conflict with the added labels.