Testing

containerd has three rings of tests, run by separate Make targets and CI jobs.

1. Unit tests

make test

This runs go test against every non-vendored package except ./integration/.... The api/ module is also tested via go -C api test. Unit tests are expected to run on any developer machine without root and without containerd running.

Tests that need root (mount, cgroup, namespace work) are gated by testutil.RequiresRoot (in pkg/testutil/). They're filtered into a separate target:

sudo make root-test

The Makefile builds the TEST_REQUIRES_ROOT_PACKAGES list by grepping for testutil.RequiresRoot.

2. Integration tests (Go)

End-to-end tests that drive the containerd daemon over its gRPC API. They live in integration/client/:

make integration

The Make target launches go test -test.root -parallel 8 against ./integration/client. These require:

• A built bin/containerd and bin/containerd-shim-runc-v2
• runc and CNI installed (make install-deps)
• root or rootless setup with the appropriate cgroup controllers

integration/failpoint/ contains shim and CNI wrappers used to inject failures into integration tests. They are built via dedicated Make rules (bin/containerd-shim-runc-fp-v1, bin/cni-bridge-fp, bin/runc-fp, bin/loopback-v2).

3. CRI integration tests

The Kubernetes CRI plugin is tested by running the upstream critest and crictl against the daemon:

make cri-integration

This builds a test binary bin/cri-integration.test, then runs script/test/cri-integration.sh which sets up the daemon, the CNI bridge, and the necessary runtimes, and runs the integration suite under integration/.

Coverage

make coverage             # unit tests with -cover, accumulates coverage.txt
make root-coverage        # the same for root tests
make cri-integration-coverage  # CRI integration coverage profile

Linting

make check runs golangci-lint run with the project's .golangci.yml. The major linters enabled are errcheck, govet, staticcheck, unused, revive, gofmt, goimports, plus a few custom rules.

make proto-fmt formats .proto files; make check-protos fails CI if generated code is out of sync.

CI workflows

Workflow	What it runs
.github/workflows/ci.yml	The main matrix: lint, build, unit tests, integration on Linux + macOS + Windows
.github/workflows/nightly.yml	Nightly builds for Linux/Windows
.github/workflows/windows-periodic.yml / windows-hyperv-periodic.yml	Periodic Windows runs
.github/workflows/node-e2e.yml	Kubernetes node-e2e against the built containerd
.github/workflows/fuzz.yml	OSS-Fuzz integration via contrib/fuzz/
.github/workflows/codeql.yml, scorecards.yml	Security scanning
.github/workflows/release.yml, api-release.yml, release/*	Release builds and tagging
.github/workflows/links.yml	lychee link check on the docs

Writing new tests

• Place plain unit tests next to the code under test (foo.go ↔ foo_test.go). Use pkg/testutil for shared setup helpers.
• For tests that need a daemon, prefer adding to integration/client/. There's a fixture in main_test.go that boots a daemon for the run.
• For CRI tests, add to integration/ (the package becomes a single test binary). See integration/main_test.go for the harness.