Fix nop write closer

.dockerignore

@@ -5,6 +5,3 @@ _output
 
 # golangci-lint
 /build
-
-# vagrant
-/.vagrant

.github/workflows/ghcr-image-build-and-publish.yml

@@ -31,13 +31,13 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           persist-credentials: false
 
       # FIXME: setup-qemu-action is depended by `gomodjail pack`
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a  # v4.0.0
+        uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3  # v4.1.0
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5  # v4.1.0

.github/workflows/job-build.yml

@@ -35,7 +35,7 @@ jobs:
 
     steps:
       - name: "Init: checkout"
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           fetch-depth: 1
           persist-credentials: false

.github/workflows/job-lint-go.yml

@@ -39,7 +39,7 @@ jobs:
 
     steps:
       - name: "Init: checkout"
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           fetch-depth: 1
           persist-credentials: false

.github/workflows/job-lint-other.yml

@@ -25,7 +25,7 @@ jobs:
 
     steps:
       - name: "Init: checkout"
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           fetch-depth: 1
           persist-credentials: false

.github/workflows/job-lint-project.yml

@@ -30,7 +30,7 @@ jobs:
 
     steps:
       - name: "Init: checkout"
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           fetch-depth: 100
           path: src/github.com/containerd/nerdctl

.github/workflows/job-test-dependencies.yml

@@ -31,7 +31,7 @@ jobs:
 
     steps:
       - name: "Init: checkout"
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           fetch-depth: 1
           persist-credentials: false

.github/workflows/job-test-in-container.yml

@@ -67,7 +67,7 @@ jobs:
 
     steps:
       - name: "Init: checkout"
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           fetch-depth: 1
           persist-credentials: false

.github/workflows/job-test-in-host.yml

@@ -83,7 +83,7 @@ jobs:
 
     steps:
       - name: "Init: checkout"
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           fetch-depth: 1
           persist-credentials: false

.github/workflows/job-test-in-lima-freebsd.yml

@@ -0,0 +1,65 @@
+name: job-test-in-lima-freebsd
+
+on:
+  workflow_call:
+    inputs:
+      timeout:
+        required: true
+        type: number
+      runner:
+        required: true
+        type: string
+
+jobs:
+  test:
+    name: "FreeBSD"
+    timeout-minutes: ${{ inputs.timeout }}
+    runs-on: "${{ inputs.runner }}"
+    steps:
+      - name: "Init: checkout"
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        with:
+          fetch-depth: 1
+          persist-credentials: false
+
+      - name: "Init: lima"
+        uses: lima-vm/lima-actions/setup@55627e31b78637bf254a8b2a14da8ea7d12564e5  # v1.1.0
+        id: lima-actions-setup
+
+      - name: "Init: Cache"
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae  # v5.0.5
+        with:
+          path: ~/.cache/lima
+          key: lima-${{ steps.lima-actions-setup.outputs.version }}-freebsd
+
+      - name: "Init: Install xorriso (required by Lima for running FreeBSD)"
+        run: |
+          set -eux
+          sudo apt-get update
+          sudo apt-get install -y xorriso
+
+      - name: "Init: start the guest VM"
+        run: |
+          set -eux
+          limactl start --plain --name=default template://freebsd
+          lima freebsd-version -kru
+          lima sudo pkg install -y bash go containerd runj
+
+      - name: "Init: copy source into the guest VM"
+        run: |
+          set -eux
+          limactl copy -r . default:/tmp/nerdctl
+
+      - name: "Init: build nerdctl"
+        run: lima --workdir /tmp/nerdctl sudo go build -o /usr/local/bin/nerdctl ./cmd/nerdctl
+
+      - name: "Run: test-unit"
+        run: lima --workdir /tmp/nerdctl go test -v ./pkg/...
+
+      - name: "Run: test-integration"
+        timeout-minutes: 3
+        run: |
+          set -eux
+          lima sudo containerd >containerd.log 2>&1 &
+          sleep 3
+          lima sudo /usr/local/bin/nerdctl run --rm --net=none dougrabson/freebsd-minimal:13 echo 'Nerdctl is up and running.'

.github/workflows/job-test-in-lima.yml

@@ -31,7 +31,7 @@ jobs:
       GUEST: ${{ inputs.guest }}
     steps:
       - name: "Init: checkout"
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           fetch-depth: 1
           persist-credentials: false

.github/workflows/job-test-unit.yml

@@ -46,7 +46,7 @@ jobs:
 
     steps:
       - name: "Init: checkout"
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           fetch-depth: 1
           persist-credentials: false

.github/workflows/release.yml

@@ -23,12 +23,12 @@ jobs:
       id-token: write  # for provenances
       attestations: write  # for provenances
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
       with:
         persist-credentials: false
     # FIXME: setup-qemu-action is depended by `gomodjail pack`
     - name: "Set up QEMU"
-      uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a  # v4.0.0
+      uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3  # v4.1.0
     - name: "Install go"
       uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c  # v6.4.0
       with:

.github/workflows/workflow-flaky.yml

@@ -36,7 +36,7 @@ jobs:
 
   test-integration-freebsd:
     name: "FreeBSD"
-    uses: ./.github/workflows/job-test-in-vagrant.yml
+    uses: ./.github/workflows/job-test-in-lima-freebsd.yml
     with:
       timeout: 15
       runner: ubuntu-24.04
@@ -49,7 +49,7 @@ jobs:
       ROOTFUL: true
     steps:
       - name: "Init: checkout"
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           fetch-depth: 1
           persist-credentials: false

.github/workflows/workflow-lint.yml

@@ -33,9 +33,10 @@ jobs:
           - runner: ubuntu-24.04
             goos: windows
           # Additionally lint for canary
-          - runner: ubuntu-24.04
-            goos: linux
-            canary: true
+          # FIXME: failing since the release of go1.27rc1
+          # - runner: ubuntu-24.04
+          #   goos: linux
+          #   canary: true
     with:
       timeout: 10
       go-version: "1.26"
@@ -72,8 +73,9 @@ jobs:
         include:
           - go-version: "1.26"
           # Additionally build for canary
-          - go-version: "1.26"
-            canary: true
+          # FIXME: failing since the release of go1.27rc1
+          # - go-version: "1.26"
+          #   canary: true
     with:
       timeout: 10
       go-version: ${{ matrix.go-version }}
@@ -85,7 +87,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: "Init: checkout"
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           fetch-depth: 1
           persist-credentials: false

.github/workflows/workflow-test.yml

@@ -26,8 +26,9 @@ jobs:
           - runner: "ubuntu-24.04"
           - runner: "macos-15"
           - runner: "windows-2025"
-          - runner: "ubuntu-24.04"
-            canary: true
+          # FIXME: failing since the release of go1.27rc1
+          # - runner: "ubuntu-24.04"
+          #   canary: true
     with:
       runner: ${{ matrix.runner }}
       canary: ${{ matrix.canary && true || false }}
@@ -51,7 +52,7 @@ jobs:
           - runner: ubuntu-24.04-arm
           # Additionally build for old containerd on amd
           - runner: ubuntu-24.04
-            containerd-version: v1.7.30
+            containerd-version: v1.7.33
     with:
       runner: ${{ matrix.runner }}
       containerd-version: ${{ matrix.containerd-version }}
@@ -80,7 +81,7 @@ jobs:
           # old containerd + old ubuntu + old rootlesskit
           - runner: ubuntu-22.04
             target: rootless
-            containerd-version: v1.7.30
+            containerd-version: v1.7.33
             rootlesskit-version: v1.1.1
           # gomodjail
           - runner: ubuntu-24.04
@@ -97,16 +98,17 @@ jobs:
           # old containerd + old ubuntu
           - runner: ubuntu-22.04
             target: rootful
-            containerd-version: v1.7.30
+            containerd-version: v1.7.33
           # ipv6
           - runner: ubuntu-24.04
             target: rootful
             ipv6: true
             skip-flaky: true
           # all canary
-          - runner: ubuntu-24.04
-            target: rootful
-            canary: true
+          # FIXME: failing since the release of go1.27rc1
+          # - runner: ubuntu-24.04
+          #   target: rootful
+          #   canary: true
 
     with:
       timeout: 80
@@ -128,8 +130,9 @@ jobs:
         include:
           # Test on windows w/o canary
           - runner: windows-2022
-          - runner: windows-2025
-            canary: true
+          # FIXME: failing since the release of go1.27rc1
+          # - runner: windows-2025
+          #   canary: true
           # Test docker on linux
           - runner: ubuntu-24.04
             binary: docker
@@ -156,13 +159,13 @@ jobs:
       # Windows CI still requires containerd v2.2.
       # [v2.3.0 regression] The virtual machine or container JSON document is invalid. (Hyper-V container)
       # https://github.com/containerd/containerd/issues/13254
-      windows-containerd-version: 2.2.3
-      windows-containerd-sha: 81314dd5e3baad958acae0e4d1ff21eb27b7c8f8809232ab06c9f397cd221e02
-      linux-containerd-version: 2.3.1
+      windows-containerd-version: 2.2.5
+      windows-containerd-sha: 8724c3a873b4984f5ee092c8f15c1a98ebbb0f968106cf8f5849ea100f3a0236
+      linux-containerd-version: 2.3.2
       # FIXME: containerd SHAs are not verified for authenticity (only affects tests)
       # https://github.com/containerd/nerdctl/issues/4666
       # Note: these are for amd64
-      linux-containerd-sha: 628448bd973610c656c1cbea8e88b32fafd85b23cc1aa4a3372eb7198478c054
+      linux-containerd-sha: 75625e6f6595bb95f3fb9c8123a60534af4a8d9b52d7617065967bcefe71a17a
       linux-containerd-service-sha: 1941362cbaa89dd591b99c32b050d82c583d3cd2e5fa63085d7017457ec5fca8
       linux-cni-version: v1.9.1
       linux-cni-sha: b98f74a0f8522f0a83867178729c1aa70f2158f90c45a2ca8fa791db1c76b303

.github/workflows/workflow-tigron.yml

@@ -31,11 +31,12 @@ jobs:
           - runner: windows-2022
           - runner: ubuntu-24.04
             goos: freebsd
-          - runner: ubuntu-24.04
-            canary: go-canary
+          # FIXME: failing since the release of go1.27rc1
+          # - runner: ubuntu-24.04
+          #   canary: go-canary
     steps:
       - name: "Checkout project"
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           fetch-depth: 100
           persist-credentials: false