Repository: containerd/containerd
File: internal/cri/server/container_create.go (Go)

Code before:
		}, nil
	}

	// Prepare container image snapshot. For container, the image should have
	// been pulled before creating the container, so do not ensure the image.
	imageRef := config.GetImage().GetImage()
	image, err := c.LocalResolve(imageRef)
	if err != nil {
		return nil, fmt.Errorf("failed to resolve image %q: %w", imageRef, err)
	}

	// Check if the image is unpacked for the target snapshotter.
	// For remote/proxy snapshotters (like nydus), the image needs to be unpacked
	// through the snapshotter to set up proper metadata and annotations.
	runtimeHandler := sandbox.Metadata.RuntimeHandler
	if runtimeHandler != "" {
		ociRuntime, err := c.config.GetSandboxRuntime(sandboxConfig, runtimeHandler)
		if err == nil && ociRuntime.Snapshotter != "" {
			unpacked, err := c.IsImageUnpacked(ctx, imageRef, ociRuntime.Snapshotter)
			if err != nil {
				log.G(ctx).WithError(err).Warnf("Failed to check if image %q is unpacked for snapshotter %q", imageRef, ociRuntime.Snapshotter)
			} else if !unpacked {
				// Image exists but not unpacked for target snapshotter.
				// Find a pullable reference (not just a digest) for remote snapshotters
				// that need to know the image source for guest pulling.
				pullableRef := imageRef
				for _, ref := range image.References {
					// Prefer a tag reference over a digest reference
					if !strings.Contains(ref, "@sha256:") {
						pullableRef = ref
						break
					}
				}
				// Fallback to first reference if all are digest-based
				if pullableRef == imageRef && len(image.References) > 0 {
					pullableRef = image.References[0]
				}
				log.G(ctx).Debugf("Image %q exists but not unpacked for snapshotter %q, unpacking with ref %q", imageRef, ociRuntime.Snapshotter, pullableRef)
				if err := c.ImageService.UnpackImage(ctx, pullableRef, ociRuntime.Snapshotter); err != nil {
					return nil, fmt.Errorf("failed to unpack image %q for snapshotter %q: %w", pullableRef, ociRuntime.Snapshotter, err)
				}
			}
		}
	}

	containerdImage, err := c.toContainerdImage(ctx, image)
	if err != nil {
		return nil, fmt.Errorf("failed to get image from containerd %q: %w", image.ID, err)
	}

	span.SetAttributes(

Review comment (suggestion):
In what case this logic will be triggered? (Assuming `PullImage` was called prior container creation?)

Code after:
		}, nil
	}

	// Prepare container image snapshot. For container, the image should have
	// been pulled before creating the container, so do not ensure the image.
	image, err := c.LocalResolve(config.GetImage().GetImage())
	if err != nil {
		return nil, fmt.Errorf("failed to resolve image %q: %w", config.GetImage().GetImage(), err)
	}
	containerdImage, err := c.toContainerdImage(ctx, image)
	if err != nil {
		return nil, fmt.Errorf("failed to get image from containerd %q: %w", image.ID, err)
	}

	span.SetAttributes(
		tracing.Attribute("container.image.ref", containerdImage.Name()),
	)

	_, err = c.createContainer(
		&createContainerRequest{
			ctx:                   ctx,
			containerID:           id,
			sandbox:               &sandbox,
			sandboxID:             sandboxID,
			imageID:               image.ID,
			containerConfig:       config,
			imageConfig:           &image.ImageSpec.Config,
			podSandboxConfig:      sandboxConfig,
			sandboxRuntimeHandler: sandbox.Metadata.RuntimeHandler,
			sandboxPid:            sandboxPid,
			NetNSPath:             sandbox.NetNSPath,
			containerName:         containerName,
			containerdImage:       &containerdImage,
			meta:                  &meta,
			start:                 time.Now(),
		},
	)
	if err != nil {
		return nil, err
	}

	return &runtime.CreateContainerResponse{ContainerId: id}, nil
}

type createContainerRequest struct {
	ctx                   context.Context
	containerID           string
	sandbox               *sandbox.Sandbox
	sandboxID             string
	imageID               string
	containerConfig       *runtime.ContainerConfig