Shim capabilities

A shim tells containerd what it is able to do by attaching typed extensions to the BootstrapResult it writes at startup. See runtime-v2.md for the bootstrap protocol itself.

message BootstrapResult {
  ...
  repeated Extension extensions = 6;
}

containerd ignores an extension whose type it does not recognize, so a shim can attach one unconditionally: an older containerd simply keeps its previous behavior.

Registry

containerd.types.MountCapabilities

The shim performs some mount types or transforms itself, and the mount manager must not perform them on its behalf.

message MountCapabilities {
  repeated string types = 1;      // e.g. "erofs", "loop"
  repeated string transforms = 2; // e.g. "format", "mkfs", "mkdir"
}

types are base mount types, with any transform prefixes removed. transforms name a transform on its own, without the /<mount-type> suffix, so claiming format applies to format/bind and format/mkdir/overlay alike, wherever either appears in a chain. See mounts.md for what each transform does.

containerd translates these into the mount.WithAllowMountType and mount.WithAllowTransform activation options . Attaching the extension with neither field set means the shim handles nothing beyond ordinary system mounts.

A claimed transform is only ever honored as a suffix of the chain it appears in: transforms apply outside-in, so an inner one’s input is an outer one’s output, and the mount manager still applies an outer, unclaimed transform even when an inner one is claimed. In format/mkdir/overlay, claiming mkdir gets the manager to apply format and hand back mkdir/overlay; claiming format alone does nothing, since mkdir cannot run without it having already run. A shim that wants to perform format itself should claim every transform after it in the chain too.

format in particular resolves templates such as {{ mount 0 }} against mount points internal to the mount manager (see mounts.md ); a shim can only claim it as part of a suffix that covers the rest of the chain, never on its own.

Added in containerd 2.4. Replaces the deprecated containerd.io/runtime-allow-mounts runtime info annotation. A shim that does not attach this extension is still checked for that annotation as a migration path, except for io.containerd.runc.v2 and io.containerd.runhcs.v1, which are known to never set it.