Repository: containerd/containerd
File: internal/cri/server/container_image_mount.go (Go)

Code before:
		if err != nil {
			return fmt.Errorf("failed to create directory to image volume target path %q: %w", target, err)
		}

		mounts = addVolatileOptionOnImageVolumeMount(mounts)
		if err := mount.All(mounts, target); err != nil {
			return fmt.Errorf("failed to mount image volume component %q: %w", target, err)
		}
	}

	if imageSubPath := extraMount.GetImageSubPath(); imageSubPath != "" {
		mountPoint, err := ensureImageSubPath(target, imageSubPath)
		if err != nil {
			return fmt.Errorf("failed to ensure image subpath %q in %q: %w", imageSubPath, target, err)
		}
		target = mountPoint
	}

	extraMount.HostPath = target

	// Clear UID/GID mappings from the mount to prevent the OCI runtime from
	// attempting idmap on the bind mount. The idmap is already applied to the
	// overlay lower layers via the snapshotter when the image volume is prepared.
	// This must be done regardless of whether the image volume was already mounted
	// (e.g., by another container in the same pod).
	clearImageVolumeMountMappings(extraMount)

	return nil
}

func (c *criService) cleanupImageMounts(
	ctx context.Context,
	sandboxID string,
) (retErr error) {
	// Some checks to avoid affecting old pods.
	ociRuntime, err := c.getPodSandboxRuntime(sandboxID)
	if err != nil {
		log.G(ctx).WithError(err).Errorf("failed to get sandbox runtime handler %q", sandboxID)
		return nil
	}
	snapshotter := c.RuntimeSnapshotter(ctx, ociRuntime)
	s := c.client.SnapshotService(snapshotter)
	if s == nil {
		return nil
	}
	targetBase := c.getImageVolumeBaseDir(sandboxID)
	entries, err := os.ReadDir(targetBase)
	if err != nil {
		if os.IsNotExist(err) {
			return nil
		}

Review comment (suggestion):
Let's just do the assign here. It's two lines and very straight forward what they are doing.

```suggestion
    mount.UidMappings = nil
	mount.GidMappings = nil
```

Code after:
		if err != nil {
			return fmt.Errorf("failed to create directory to image volume target path %q: %w", target, err)
		}

		mounts = addVolatileOptionOnImageVolumeMount(mounts)
		if err := mount.All(mounts, target); err != nil {
			return fmt.Errorf("failed to mount image volume component %q: %w", target, err)
		}
	}

	if imageSubPath := extraMount.GetImageSubPath(); imageSubPath != "" {
		mountPoint, err := ensureImageSubPath(target, imageSubPath)
		if err != nil {
			return fmt.Errorf("failed to ensure image subpath %q in %q: %w", imageSubPath, target, err)
		}
		target = mountPoint
	}

	extraMount.HostPath = target

	// Clear UID/GID mappings from the mount to prevent the OCI runtime from
	// attempting idmap on the bind mount. The idmap is already applied to the
	// overlay lower layers via the snapshotter when the image volume is prepared.
	// This must be done regardless of whether the image volume was already mounted
	// (e.g., by another container in the same pod).
	extraMount.UidMappings = nil
	extraMount.GidMappings = nil

	return nil
}

func (c *criService) cleanupImageMounts(
	ctx context.Context,
	sandboxID string,
) (retErr error) {
	// Some checks to avoid affecting old pods.
	ociRuntime, err := c.getPodSandboxRuntime(sandboxID)
	if err != nil {
		log.G(ctx).WithError(err).Errorf("failed to get sandbox runtime handler %q", sandboxID)
		return nil
	}
	snapshotter := c.RuntimeSnapshotter(ctx, ociRuntime)
	s := c.client.SnapshotService(snapshotter)
	if s == nil {
		return nil
	}
	targetBase := c.getImageVolumeBaseDir(sandboxID)
	entries, err := os.ReadDir(targetBase)
	if err != nil {
		if os.IsNotExist(err) {
			return nil