Repository: kubernetes/kubernetes
File: cluster/gce/gci/configure.sh (Shell)

Code before:
    local temp_dir
    temp_dir=$(mktemp -d)
    
    # Download and install runc
    if download-robust "runc ${UBUNTU_INSTALL_RUNC_VERSION}" "${temp_dir}" \
       "https://github.com/opencontainers/runc/releases/download/${UBUNTU_INSTALL_RUNC_VERSION}/runc.${HOST_ARCH}"; then
      cp "${temp_dir}/runc.${HOST_ARCH}" /usr/sbin/runc && chmod 755 /usr/sbin/runc
    fi
    rm -rf "${temp_dir}"
  fi
  sudo systemctl start containerd
}

# If we are on cos we can try to install containerd
function install-containerd-cos {
  # bailout if we are not on COS
  if [ -e /etc/os-release ] && ! grep -q "ID=cos" /etc/os-release; then
    echo "Unable to automatically install containerd in non-cos image. Bailing out..."
    exit 2
  fi

  # Override to latest versions of containerd and runc
  systemctl stop containerd
  mkdir -p /home/containerd/
  mount --bind /home/containerd /home/containerd
  mount -o remount,exec /home/containerd
  if [[ -n "${COS_INSTALL_CONTAINERD_VERSION:-}" ]]; then
    local temp_dir
    temp_dir=$(mktemp -d)
    
    # Download containerd
    if download-robust "containerd ${COS_INSTALL_CONTAINERD_VERSION}" "${temp_dir}" \
       "https://github.com/containerd/containerd/releases/download/${COS_INSTALL_CONTAINERD_VERSION}/containerd-${COS_INSTALL_CONTAINERD_VERSION:1}-${HOST_PLATFORM}-${HOST_ARCH}.tar.gz"; then
      tar --overwrite -xzv -C /home/containerd/ -f "${temp_dir}"/containerd-*.tar.gz
      cp /usr/lib/systemd/system/containerd.service /etc/systemd/system/containerd.service
      sed -i 's|ExecStart=.*|ExecStart=/home/containerd/bin/containerd|' /etc/systemd/system/containerd.service
    fi
    rm -rf "${temp_dir}"
  fi
  if [[ -n "${COS_INSTALL_RUNC_VERSION:-}" ]]; then
    local temp_dir
    temp_dir=$(mktemp -d)
    mkdir -p /home/containerd/bin
    
    # Download and install runc
    if download-robust "runc ${COS_INSTALL_RUNC_VERSION}" "${temp_dir}" \
       "https://github.com/opencontainers/runc/releases/download/${COS_INSTALL_RUNC_VERSION}/runc.${HOST_ARCH}"; then
      cp "${temp_dir}/runc.${HOST_ARCH}" /home/containerd/bin/runc && chmod 755 /home/containerd/bin/runc
      sed -i "/\[Service\]/a Environment=PATH=/home/containerd/bin:$PATH" /etc/systemd/system/containerd.service
    fi
    rm -rf "${temp_dir}"

Review comment (suggestion):
hmm, we need to do a sweep for these sometime, we should be making CURL_FLAGS an array and using `"${CURL_FLAGS[@]}"`, not depending on word-splitting, this is not a reasonable disable.

not new though, just surfacing here ...

Code after:
  if [[ -z "$(command -v lsb_release)" || $(lsb_release -si) != "Ubuntu" ]]; then
    echo "Unable to automatically install containerd in non-ubuntu image. Bailing out..."; exit 2
  fi

  local -r custom_containerd="${UBUNTU_INSTALL_CONTAINERD_VERSION:-}"
  local -r custom_runc="${UBUNTU_INSTALL_RUNC_VERSION:-}"

  apt-get update
  apt-get install -y --no-install-recommends apt-transport-https ca-certificates \
    socat curl gnupg2 nfs-common software-properties-common lsb-release

  # Both versions specified: skip apt, install binaries directly
  if [[ -n "${custom_containerd}" && -n "${custom_runc}" ]]; then
    echo "Installing containerd ${custom_containerd} and runc ${custom_runc} (skipping apt)"
    ensure-containerd-systemd-service
    install-containerd-binary "${custom_containerd}" || { echo "ERROR: containerd download failed"; exit 1; }
    install-runc-binary "${custom_runc}" || { echo "ERROR: runc download failed"; exit 1; }
    systemctl start containerd
    return
  fi

  # Install from Docker apt repo, optionally override binaries
  local -r release="$(lsb_release -cs)"
  local -r keyring="/etc/apt/keyrings/docker.gpg"
  mkdir -p "$(dirname "${keyring}")"
  # shellcheck disable=SC2086
  curl ${CURL_FLAGS} -fsSL "https://download.docker.com/${HOST_PLATFORM}/$(. /etc/os-release; echo "$ID")/gpg" \
    | gpg --batch --dearmor -o "${keyring}"
  chmod a+r "${keyring}"
  echo "deb [arch=${HOST_ARCH} signed-by=${keyring}] https://download.docker.com/${HOST_PLATFORM}/$(. /etc/os-release; echo "$ID") ${release} stable" \
    > /etc/apt/sources.list.d/docker.list

  apt-get update && apt-get install -y --no-install-recommends containerd.io
  rm -rf /var/lib/apt/lists/*

  systemctl stop containerd
  [[ -n "${custom_containerd}" ]] && install-containerd-binary "${custom_containerd}"
  [[ -n "${custom_runc}" ]] && install-runc-binary "${custom_runc}"
  systemctl start containerd
}

# If we are on cos we can try to install containerd
function install-containerd-cos {
  # bailout if we are not on COS
  if [ -e /etc/os-release ] && ! grep -q "ID=cos" /etc/os-release; then
    echo "Unable to automatically install containerd in non-cos image. Bailing out..."
    exit 2
  fi

  # Override to latest versions of containerd and runc
  systemctl stop containerd