containerd: support custom shim path

cmd/buildkitd/config/config.go

@@ -131,6 +131,7 @@ type ContainerdConfig struct {
 
 type ContainerdRuntime struct {
 	Name    string                 `toml:"name"`
+	Path    string                 `toml:"path"`
 	Options map[string]interface{} `toml:"options"`
 }
 

cmd/buildkitd/config/load_test.go

@@ -44,6 +44,7 @@ platforms=["linux/amd64"]
 address="containerd.sock"
 [worker.containerd.runtime]
 name="exotic"
+path="/usr/bin/exotic"
 options.foo="bar"
 [[worker.containerd.gcpolicy]]
 all=true
@@ -107,6 +108,7 @@ searchDomains=["example.com"]
 	require.Equal(t, 0, len(cfg.Workers.OCI.GCPolicy))
 	require.Equal(t, "non-default", cfg.Workers.Containerd.Namespace)
 	require.Equal(t, "exotic", cfg.Workers.Containerd.Runtime.Name)
+	require.Equal(t, "/usr/bin/exotic", cfg.Workers.Containerd.Runtime.Path)
 	require.Equal(t, "bar", cfg.Workers.Containerd.Runtime.Options["foo"])
 	require.Equal(t, 3, len(cfg.Workers.Containerd.GCPolicy))
 

cmd/buildkitd/main_containerd_worker.go

@@ -322,6 +322,7 @@ func containerdWorkerInitializer(c *cli.Context, common workerInitializerOpt) ([
 
 		runtime = &containerd.RuntimeInfo{
 			Name:    cfg.Runtime.Name,
+			Path:    cfg.Runtime.Path,
 			Options: opts,
 		}
 	}

docs/buildkitd.toml.md

@@ -109,6 +109,7 @@ insecure-entitlements = [ "network.host", "security.insecure" ]
   # configure the containerd runtime
   [worker.containerd.runtime]
     name = "io.containerd.runc.v2"
+    path = "/path/to/containerd/runc/shim"
     options = { BinaryName = "runc" }
 
   [[worker.containerd.gcpolicy]]

executor/containerdexecutor/executor.go

@@ -56,6 +56,7 @@ type OnCreateRuntimer interface {
 
 type RuntimeInfo struct {
 	Name    string
+	Path    string
 	Options any
 }
 
@@ -179,8 +180,10 @@ func (w *containerdExecutor) Run(ctx context.Context, id string, root executor.M
 	if err != nil {
 		return nil, err
 	}
-
-	task, err := container.NewTask(ctx, cio.NewCreator(cioOpts...), taskOpts)
+	if w.runtime != nil && w.runtime.Path != "" {
+		taskOpts = append(taskOpts, containerd.WithRuntimePath(w.runtime.Path))
+	}
+	task, err := container.NewTask(ctx, cio.NewCreator(cioOpts...), taskOpts...)
 	if err != nil {
 		return nil, err
 	}

executor/containerdexecutor/executor_unix.go

@@ -161,7 +161,7 @@ func (w *containerdExecutor) createOCISpec(ctx context.Context, id, resolvConf,
 	return spec, releaseAll, nil
 }
 
-func (d *containerState) getTaskOpts() (containerd.NewTaskOpts, error) {
+func (d *containerState) getTaskOpts() ([]containerd.NewTaskOpts, error) {
 	rootfs := containerd.WithRootFS([]mount.Mount{{
 		Source:  d.rootfsPath,
 		Type:    "bind",
@@ -174,7 +174,7 @@ func (d *containerState) getTaskOpts() (containerd.NewTaskOpts, error) {
 			Options: []string{},
 		}})
 	}
-	return rootfs, nil
+	return []containerd.NewTaskOpts{rootfs}, nil
 }
 
 func setArgs(spec *specs.Process, args []string) {

executor/containerdexecutor/executor_windows.go

@@ -96,8 +96,8 @@ func (w *containerdExecutor) createOCISpec(ctx context.Context, id, resolvConf,
 	return spec, releaseAll, nil
 }
 
-func (d *containerState) getTaskOpts() (containerd.NewTaskOpts, error) {
-	return containerd.WithRootFS(d.rootMounts), nil
+func (d *containerState) getTaskOpts() ([]containerd.NewTaskOpts, error) {
+	return []containerd.NewTaskOpts{containerd.WithRootFS(d.rootMounts)}, nil
 }
 
 func setArgs(spec *specs.Process, args []string) {