Tooling

The repository ships and uses the following developer tools.

Build

• make drives everything (Makefile plus per-OS overlays Makefile.linux, Makefile.windows, Makefile.darwin, Makefile.freebsd).
• go ≥ 1.26 (per go.mod).
• buf for protobuf — install via script/setup/install-dev-tools. Used by make protos, make proto-fmt, make check-protos.

Code generators

• bin/protoc-gen-go-fieldpath — built from cmd/protoc-gen-go-fieldpath/. Generates *_fieldpath.pb.go for events.
• bin/go-buildtag — built from cmd/go-buildtag/. Adds //go:build constraints to generated _grpc.pb.go so the shim build can drop gRPC.
• bin/gen-manpages — built from cmd/gen-manpages/. Renders man pages from urfave/cli definitions.
• go-md2man (third-party) — converts the long-form Markdown manpages under docs/man/ to roff.

Lint

• golangci-lint with .golangci.yml. Pinned via script/setup/install-dev-tools.
• buf for .proto formatting and breaking-change detection.
• lychee (.lycheeignore) checks links in docs/.

Vendoring

containerd is fully vendored. make vendor runs go mod tidy && go mod vendor && go mod verify, then does the same for api/. make verify-vendor repeats the process in a tmp dir and diffs — used in CI to catch missed updates. make remove-replace strips the local replace directive on the api module so the vendor tree stays consistent for releases.

CI scripts

• script/setup/ — install scripts for runc, CNI, critools, seccomp, dev-tools, cni-windows, etc.
• script/test/ — test orchestration: cri-integration.sh, windows-integration-test.ps1, etc.
• script/release/ — release helpers.
• script/verify-go-modules.sh — sanity-check that the API submodule and main module agree.

Docker & Vagrant

• Dockerfile.test and contrib/Dockerfile.test build images for testing.
• Vagrantfile provides a Linux VM (Fedora) preinstalled with all dependencies for developers on macOS/Windows. vagrant up && vagrant ssh and you can make directly inside.
• .devcontainer/devcontainer.json configures GitHub Codespaces / VS Code dev containers.

Fuzzing

contrib/fuzz/ and .github/workflows/fuzz.yml integrate with the OSS-Fuzz project. Each fuzzer uses github.com/AdaLogics/go-fuzz-headers to feed deterministic inputs into containerd internals.

Release tooling

• releases/ contains both per-version *.toml notes and the deprecated cri-containerd note files.
• .github/workflows/release.yml and release/ cut binaries on tag push, sign artifacts, and upload to GitHub Releases.
• make release builds releases/<version>.tar.gz locally; make static-release does the same with a static link.