Repository: containerd/containerd
File: internal/cri/server/sandbox_run.go (Go)

Code before:
	// but we don't care about sandbox TaskOOM right now, so it is fine.
	c.startSandboxExitMonitor(context.Background(), id, exitCh)

	// Send CONTAINER_STARTED event with ContainerId equal to SandboxId.
	c.generateAndSendContainerEvent(ctx, id, id, runtime.ContainerEventType_CONTAINER_STARTED_EVENT)

	sandboxRuntimeCreateTimer.WithValues(labels["oci_runtime_type"]).UpdateSince(runtimeStart)

	return &runtime.RunPodSandboxResponse{PodSandboxId: id}, nil
}

func (c *criService) ensurePauseImageExists(ctx context.Context, config *runtime.PodSandboxConfig, runtimeHandler string) error {
	imageConfig := c.ImageService.Config()

	ref := criconfig.DefaultSandboxImage

	if img, ok := imageConfig.PinnedImages["sandbox"]; ok && img != "" {
		ref = img
	}

	// Always go through PullImage which checks if the image is already
	// properly unpacked for the target snapshotter and returns early if so.
	// This handles cases where image metadata exists but content was
	// garbage collected, or where the image needs to be re-unpacked for
	// a different snapshotter.
	_, err := c.ImageService.PullImage(ctx, ref, nil, config, runtimeHandler)
	if err != nil {
		return fmt.Errorf("failed to pull image %q: %w", ref, err)
	}

	return nil
}

// getNetworkPlugin returns the network plugin to be used by the runtime class
// defaults to the global CNI options in the CRI config
func (c *criService) getNetworkPlugin(runtimeClass string) cni.CNI {
	if c.netPlugin == nil {
		return nil
	}
	i, ok := c.netPlugin[runtimeClass]
	if !ok {
		if i, ok = c.netPlugin[defaultNetworkPlugin]; !ok {
			return nil
		}
	}
	return i
}

// setupPodNetwork setups up the network for a pod
func (c *criService) setupPodNetwork(ctx context.Context, sandbox *sandboxstore.Sandbox) (retErr error) {
	ctx, span := tracing.StartSpan(ctx, tracing.Name("cni", "setup_pod_network"),

Review comment (suggestion):
In an air-gapped environment, there is a case where the pause image is imported rather than pulled. If we force to pull image, it will be breaking change. 

Code after:
	// TaskOOM from containerd may come before sandbox is added to store,
	// but we don't care about sandbox TaskOOM right now, so it is fine.
	c.startSandboxExitMonitor(context.Background(), id, exitCh)

	// Send CONTAINER_STARTED event with ContainerId equal to SandboxId.
	c.generateAndSendContainerEvent(ctx, id, id, runtime.ContainerEventType_CONTAINER_STARTED_EVENT)

	sandboxRuntimeCreateTimer.WithValues(labels["oci_runtime_type"]).UpdateSince(runtimeStart)

	return &runtime.RunPodSandboxResponse{PodSandboxId: id}, nil
}

func (c *criService) ensurePauseImageExists(ctx context.Context, config *runtime.PodSandboxConfig, runtimeHandler string) error {
	imageConfig := c.ImageService.Config()

	ref := criconfig.DefaultSandboxImage

	if img, ok := imageConfig.PinnedImages["sandbox"]; ok && img != "" {
		ref = img
	}

	_, err := c.ImageService.LocalResolve(ref)
	if err == nil {
		return nil
	} else if !errdefs.IsNotFound(err) {
		return fmt.Errorf("failed to get image %q: %w", ref, err)
	}

	_, err = c.ImageService.PullImage(ctx, ref, nil, config, runtimeHandler)
	if err != nil {
		return fmt.Errorf("failed to pull image %q: %w", ref, err)
	}

	return nil
}

// getNetworkPlugin returns the network plugin to be used by the runtime class
// defaults to the global CNI options in the CRI config
func (c *criService) getNetworkPlugin(runtimeClass string) cni.CNI {
	if c.netPlugin == nil {
		return nil
	}
	i, ok := c.netPlugin[runtimeClass]
	if !ok {
		if i, ok = c.netPlugin[defaultNetworkPlugin]; !ok {
			return nil
		}
	}
	return i
}