code improve and bugfix

Signed-off-by: zhongtao <zhongtao17@huawei.com> (cherry picked from commit 287b224ffae5e96750bd13f62b91e8ec09dfb4fa)
2024-06-11 19:55:44 +08:00 · 2024-06-11 19:55:44 +08:00 · d212adab19
commit d212adab19
parent bb31f4443e
24 changed files with 3403 additions and 1 deletions
--- a/0086-cdi-test-case-and-gateway.patch
+++ b/0086-cdi-test-case-and-gateway.patch
@ -0,0 +1,359 @@
 From 3fb6de60ecf10278a676a41f8d0c334d1f90d303 Mon Sep 17 00:00:00 2001
 From: liuxu <liuxu156@huawei.com>
 Date: Wed, 17 Apr 2024 18:02:48 +0800
 Subject: [PATCH 086/108] cdi:test case and gateway
 Signed-off-by: liuxu <liuxu156@huawei.com>
 ---
 CI/make-and-install.sh                        |   2 +-
 CI/test_cases/container_cases/cdi_test.sh     | 205 ++++++++++++++++++
 .../criconfigs/container-config-cdi.json      |  50 +++++
 .../test_data/cdi_devices.json                |  53 +++++
 4 files changed, 309 insertions(+), 1 deletion(-)
 create mode 100755 CI/test_cases/container_cases/cdi_test.sh
 create mode 100644 CI/test_cases/container_cases/criconfigs/container-config-cdi.json
 create mode 100644 CI/test_cases/container_cases/test_data/cdi_devices.json
 diff --git a/CI/make-and-install.sh b/CI/make-and-install.sh
 index 9d4c5533..61281965 100755
 --- a/CI/make-and-install.sh
 +++ b/CI/make-and-install.sh
@@ -105,7 +105,7 @@ cd build
 if [[ ${enable_gcov} -ne 0 ]]; then
   cmake -DLIB_INSTALL_DIR=${builddir}/lib -DCMAKE_INSTALL_PREFIX=${builddir} -DCMAKE_INSTALL_SYSCONFDIR=${builddir}/etc -DCMAKE_BUILD_TYPE=Debug -DGCOV=ON -DENABLE_EMBEDDED=ON -DENABLE_COVERAGE=ON -DENABLE_CRI_API_V1=ON -DENABLE_CDI=ON -DENABLE_UT=ON -DENABLE_METRICS=ON -DENABLE_REMOTE_LAYER_STORE=ON -DENABLE_GRPC_REMOTE_CONNECT=ON ..
 else
 -  cmake -DLIB_INSTALL_DIR=${builddir}/lib -DCMAKE_INSTALL_PREFIX=${builddir} -DCMAKE_INSTALL_SYSCONFDIR=${builddir}/etc -DENABLE_EMBEDDED=ON -DENABLE_METRICS=ON -DENABLE_REMOTE_LAYER_STORE=ON -DENABLE_CRI_API_V1=ON -DENABLE_GRPC_REMOTE_CONNECT=ON ..
 +  cmake -DLIB_INSTALL_DIR=${builddir}/lib -DCMAKE_INSTALL_PREFIX=${builddir} -DCMAKE_INSTALL_SYSCONFDIR=${builddir}/etc -DENABLE_EMBEDDED=ON -DENABLE_METRICS=ON -DENABLE_REMOTE_LAYER_STORE=ON -DENABLE_CRI_API_V1=ON -DENABLE_CDI=ON -DENABLE_GRPC_REMOTE_CONNECT=ON ..
 fi
 make -j $(nproc)
 make install
 diff --git a/CI/test_cases/container_cases/cdi_test.sh b/CI/test_cases/container_cases/cdi_test.sh
 new file mode 100755
 index 00000000..dd7b1177
 --- /dev/null
 +++ b/CI/test_cases/container_cases/cdi_test.sh
@@ -0,0 +1,205 @@
 +#!/bin/bash
 +#
 +# attributes: isulad cdi
 +# concurrent: NA
 +# spend time: 41
 +
 +#######################################################################
 +##- Copyright (c) Huawei Technologies Co., Ltd. 2024. All rights reserved.
 +# - iSulad licensed under the Mulan PSL v2.
 +# - You can use this software according to the terms and conditions of the Mulan PSL v2.
 +# - You may obtain a copy of Mulan PSL v2 at:
 +# -     http://license.coscl.org.cn/MulanPSL2
 +# - THIS SOFTWARE IS PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTIES OF ANY KIND, EITHER EXPRESS OR
 +# - IMPLIED, INCLUDING BUT NOT LIMITED TO NON-INFRINGEMENT, MERCHANTABILITY OR FIT FOR A PARTICULAR
 +# - PURPOSE.
 +# - See the Mulan PSL v2 for more details.
 +##- @Description:CI
 +##- @Author: liuxu
 +##- @Create: 2024-04-16
 +#######################################################################
 +
 +source ../helpers.sh
 +curr_path=$(dirname $(readlink -f "$0"))
 +data_path=$(realpath $curr_path/criconfigs)
 +pause_img_path=$(realpath $curr_path/test_data)
 +cdi_static_dir="/etc/cdi"
 +
 +function do_pre()
 +{
 +    cp /etc/isulad/daemon.json /etc/isulad/daemon.bak
 +    sed -i "s#\"pod-sandbox-image\": \"\"#\"pod-sandbox-image\": \"mirrorgooglecontainers/pause-amd64:3.0\"#g" /etc/isulad/daemon.json
 +    sed -i "/\"cni-conf-dir\": \".*\"/a\ \ \ \ \"enable-cri-v1\": true," /etc/isulad/daemon.json
 +    sed -i "/\"cni-conf-dir\": \".*\"/a\ \ \ \ \"enable-cdi\": true," /etc/isulad/daemon.json
 +
 +    check_valgrind_log
 +    start_isulad_without_valgrind
 +
 +    isula load -i ${pause_img_path}/pause.tar
 +    [[ $? -ne 0 ]] && msg_err "${FUNCNAME[0]}:${LINENO} - failed to load pause" && return ${FAILURE}
 +
 +    isula pull busybox
 +    [[ $? -ne 0 ]] && msg_err "${FUNCNAME[0]}:${LINENO} - failed to pull busybox" && return ${FAILURE}
 +
 +    crictl images | grep "mirrorgooglecontainers/pause-amd64"
 +    [[ $? -ne 0 ]] && msg_err "${FUNCNAME[0]}:${LINENO} - Failed to find mirrorgooglecontainers/pause-amd64 image" && return ${FAILURE}
 +
 +    return 0
 +}
 +
 +function do_post()
 +{
 +    cp -f /etc/isulad/daemon.bak /etc/isulad/daemon.json
 +    check_valgrind_log
 +    start_isulad_without_valgrind
 +}
 +
 +function verify_injected_vendor0() {
 +    # check env
 +    output=$(crictl exec --sync "$1" sh -c 'echo $VENDOR0')
 +    [[ "$output" != "injected" ]] && msg_err "${FUNCNAME[0]}:${LINENO} - env check failed" && return ${FAILURE}
 +
 +    # check hooks
 +    cat /tmp/cdi_hook_test.log | grep "prestart"
 +    [[ $? -ne 0 ]] && msg_err "${FUNCNAME[0]}:${LINENO} - hook check failed" && return ${FAILURE}
 +
 +    # check mounts
 +    output=$(crictl exec --sync "$1" sh -c 'stat -c %a /tmp/cdi_mounts_test')
 +    [[ "$output" != "755" ]] && msg_err "${FUNCNAME[0]}:${LINENO} - mount check failed" && return ${FAILURE}
 +
 +    return 0
 +}
 +
 +function verify_injected_loop8() {
 +    # check env
 +    output=$(crictl exec --sync "$1" sh -c 'echo $LOOP8')
 +    [[ "$output" != "CDI8" ]] && msg_err "${FUNCNAME[0]}:${LINENO} - env check failed" && return ${FAILURE}
 +
 +    # check device nodes
 +    output=$(crictl exec --sync "$1" sh -c 'stat -c %a /dev/loop8')
 +    [[ "$output" != "640" ]] && msg_err "${FUNCNAME[0]}:${LINENO} - device nodes check failed" && return ${FAILURE}
 +    output=$(crictl exec --sync "$1" sh -c 'stat -c %t.%T /dev/loop8')
 +    [[ "$output" != "7.8" ]] && msg_err "${FUNCNAME[0]}:${LINENO} - device nodes check failed" && return ${FAILURE}
 +    output=$(crictl exec --sync "$1" sh -c 'stat -c %t.%T /dev/loop8c')
 +    [[ "$output" != "7.b" ]] && msg_err "${FUNCNAME[0]}:${LINENO} - device nodes check failed" && return ${FAILURE}
 +
 +    # check mounts
 +    output=$(crictl exec --sync "$1" sh -c 'stat -c %a /tmp/cdi_mounts_test_loop8')
 +    [[ "$output" != "755" ]] && msg_err "${FUNCNAME[0]}:${LINENO} - mount check failed" && return ${FAILURE}
 +
 +    return 0
 +}
 +
 +function verify_injected_loop9() {
 +    # check env
 +    output=$(crictl exec --sync "$1" sh -c 'echo $LOOP9')
 +    [[ "$output" != "present" ]] && msg_err "${FUNCNAME[0]}:${LINENO} - env check failed" && return ${FAILURE}
 +
 +    # check device nodes
 +    output=$(crictl exec --sync "$1" sh -c 'stat -c %a /dev/loop9')
 +    [[ "$output" != "644" ]] && msg_err "${FUNCNAME[0]}:${LINENO} - device nodes check failed" && return ${FAILURE}
 +    output=$(crictl exec --sync "$1" sh -c 'stat -c %t.%T /dev/loop9')
 +    [[ "$output" != "7.9" ]] && msg_err "${FUNCNAME[0]}:${LINENO} - device nodes check failed" && return ${FAILURE}
 +
 +    return 0
 +}
 +
 +function check_full_cdi()
 +{
 +    verify_injected_vendor0 $1
 +    [[ $? -ne 0 ]] && msg_err "${FUNCNAME[0]}:${LINENO} - verify_injected_vendor0 failed" && return ${FAILURE}
 +    
 +    verify_injected_loop8 $1
 +    [[ $? -ne 0 ]] && msg_err "${FUNCNAME[0]}:${LINENO} - verify_injected_loop8 failed" && return ${FAILURE}
 +    
 +    verify_injected_loop9 $1
 +    [[ $? -ne 0 ]] && msg_err "${FUNCNAME[0]}:${LINENO} - verify_injected_loop9 failed" && return ${FAILURE}
 +
 +    return 0
 +}
 +
 +function do_test_help()
 +{
 +    msg_info "cdi test starting..."
 +
 +    isula rm -f `isula ps -a -q`
 +
 +    sid=`crictl runp ${data_path}/$1`
 +    [[ $? -ne 0 ]] && msg_err "${FUNCNAME[0]}:${LINENO} - Failed to run sandbox" && return ${FAILURE}
 +
 +    cid=`crictl create $sid ${data_path}/$2 ${data_path}/$1`
 +    [[ $? -ne 0 ]] && msg_err "${FUNCNAME[0]}:${LINENO} - create container failed" && return ${FAILURE}
 +
 +    crictl start $cid
 +    [[ $? -ne 0 ]] && msg_err "${FUNCNAME[0]}:${LINENO} - start container failed" && return ${FAILURE}
 +
 +    crictl stats
 +    [[ $? -ne 0 ]] && msg_err "${FUNCNAME[0]}:${LINENO} - stats container failed" && return ${FAILURE}
 +
 +    check_full_cdi $cid
 +    [[ $? -ne 0 ]] && msg_err "${FUNCNAME[0]}:${LINENO} - check cdi failed" && return ${FAILURE}
 +
 +    crictl stop $cid
 +    [[ $? -ne 0 ]] && msg_err "${FUNCNAME[0]}:${LINENO} - stop container failed" && return ${FAILURE}
 +
 +    crictl rm $cid
 +    [[ $? -ne 0 ]] && msg_err "${FUNCNAME[0]}:${LINENO} - rm container failed" && return ${FAILURE}
 +
 +    crictl stopp $sid
 +    [[ $? -ne 0 ]] && msg_err "${FUNCNAME[0]}:${LINENO} - stop sandbox failed" && return ${FAILURE}
 +
 +    crictl rmp $sid
 +    [[ $? -ne 0 ]] && msg_err "${FUNCNAME[0]}:${LINENO} - rm sandbox failed" && return ${FAILURE}
 +
 +    return 0
 +}
 +
 +function do_test_full_cdi()
 +{
 +    if [ ! -d "$cdi_static_dir" ]; then
 +        mkdir -p "$cdi_static_dir"
 +    fi
 +    cp -f ${pause_img_path}/cdi_devices.json ${cdi_static_dir}/cdi_devices.json
 +
 +    mkdir -p /tmp/cdi_mounts_test
 +    cat  > /tmp/cdi_mounts_test_loop8  << EOF
 +origin data
 +EOF
 +    chmod  755  /tmp/cdi_mounts_test_loop8
 +    mkdir -p /tmp/cdi_mounts_test_loop9
 +    
 +    mknod /dev/loop8 b 7 8
 +    mknod /dev/loop9 b 7 9
 +    mknod /dev/loop8c c 7 11
 +
 +    cat  > /tmp/cdi_printargs.sh  << EOF
 +#!/bin/bash
 +echo "\$(date +'%Y-%m-%d %H:%M:%S') Input parameter: \$1 \$2" >> /tmp/cdi_hook_test.log
 +EOF
 +    chmod  755  /tmp/cdi_printargs.sh
 +
 +    do_test_help "sandbox-config.json" "container-config-cdi.json" || ((ans++))
 +
 +    rm -f /tmp/cdi_printargs.sh
 +    rm -f /tmp/cdi_hook_test.log
 +    rm -f /dev/loop8
 +    rm -f /dev/loop9
 +    rm -f /dev/loop8c
 +
 +    rm -f ${cdi_static_dir}/cdi_devices.json
 +    rm -f /tmp/cdi_printargs
 +    rmdir /tmp/cdi_mounts_test
 +    rm -f /tmp/cdi_mounts_test_loop8
 +    rmdir /tmp/cdi_mounts_test_loop9
 +    rm -f /tmp/cdi_printargs.sh
 +
 +    return 0
 +}
 +
 +declare -i ans=0
 +
 +do_pre || ((ans++))
 +do_test_full_cdi || ((ans++))
 +do_post
 +
 +show_result ${ans} "${curr_path}/${0}"
 diff --git a/CI/test_cases/container_cases/criconfigs/container-config-cdi.json b/CI/test_cases/container_cases/criconfigs/container-config-cdi.json
 new file mode 100644
 index 00000000..b9805c8a
 --- /dev/null
 +++ b/CI/test_cases/container_cases/criconfigs/container-config-cdi.json
@@ -0,0 +1,50 @@
 +{
 +    "metadata": {
 +        "name": "haozi"
 +    },
 +    "image":{
 +        "image": "busybox:latest"
 +    },
 +    "command": [
 +        "/bin/sh",
 +        "-c",
 +        "i=0; while true; do echo \"$i: $(date)\"; i=$((i+1)); sleep 10; done"
 +    ],
 +    "labels": {
 +        "filter_label_key": "filter_label_val"
 +    },
 +    "annotations": {
 +        "extension.network.kubernetes.io/cni/instancename": "pod_instance_name",
 +        "cdi.k8s.io/test": "vendor0.com/device=loop8,vendor0.com/device=loop9"
 +    },
 +    "CDI_Devices":[
 +        { "Name": "vendor0.com/device=loop8" },
 +        { "Name": "vendor0.com/device=loop9" } 
 +    ],
 +    "mounts" : [
 +        {
 +            "container_path": "/tmp/contpath",
 +            "host_path": "/tmp/hostpath",
 +            "readonly": true,
 +            "selinux_relabel": true,
 +            "propagation": 0
 +        },
 +        {
 +            "container_path": "/tmp/contpath2",
 +            "host_path": "/tmp/hostpath2",
 +            "readonly": false,
 +            "selinux_relabel": false,
 +            "propagation": 0
 +        }
 +    ],
 +    "linux": {
 +	    "security_context": {
 +		    "namespace_options": {
 +		        "host_network": true,
 +		        "host_pid": false,
 +		        "host_ipc": false
 +		    }
 +	    }
 +    },
 +    "log_path": "cri_test.log"
 +}
 diff --git a/CI/test_cases/container_cases/test_data/cdi_devices.json b/CI/test_cases/container_cases/test_data/cdi_devices.json
 new file mode 100644
 index 00000000..f7fe65d4
 --- /dev/null
 +++ b/CI/test_cases/container_cases/test_data/cdi_devices.json
@@ -0,0 +1,53 @@
 +{
 +  "cdiVersion": "0.6.0",
 +  "kind": "vendor0.com/device",
 +  "annotations":{
 +      "cdi_annotation":"cdi_annotation_value"
 +  },
 +  "devices": [
 +    {
 +      "name": "loop8",
 +      "annotations":{
 +          "loop8_annotation":"loop8_annotation_value"
 +      },
 +      "containerEdits": {
 +          "env": [
 +              "LOOP8=CDI8",
 +              "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/dev"
 +          ],
 +          "deviceNodes": [
 +              {"path": "/dev/loop8", "type": "b", "fileMode": 416},
 +              {"path": "/dev/loop8c", "type": "c"}
 +          ],
 +          "mounts": [
 +              {"hostPath": "/tmp/cdi_mounts_test_loop8", "containerPath": "/tmp/cdi_mounts_test_loop8", "options": ["ro","nosuid","nodev","bind"]},
 +              {"hostPath": "tmpfs", "containerPath": "/tmp/data", "type": "tmpfs", "options": ["nosuid","strictatime","mode=755","size=65536k"]}
 +          ]
 +      }
 +    },{
 +      "name": "loop9",
 +      "containerEdits": {
 +          "env":["LOOP9=present"],
 +          "deviceNodes": [{
 +                  "path": "/dev/loop9", "type": "b", "major": 7, "minor": 9, "fileMode": 420
 +              }
 +          ]
 +      }
 +    }
 +  ],
 +  "containerEdits": {
 +    "env": [
 +      "VENDOR0=injected",
 +      "BAR=BARVALUE1"
 +    ],
 +    "hooks": [
 +      {"hookName": "prestart", "path": "/tmp/cdi_printargs.sh", "args":["prestart0", "prestart1"], "env":["prestartenv=value"]},
 +      {"hookName": "prestart", "path": "/tmp/cdi_printargs.sh", "args":["prestart0", "prestart1"], "env":["prestartenv=value"]},
 +      {"hookName": "poststart", "path": "/tmp/cdi_printargs.sh", "args":["poststart0", "poststart1"], "env":["poststartenv=value"]},
 +      {"hookName": "poststop", "path": "/tmp/cdi_printargs.sh", "args":["poststop0", "poststop1"], "env":["poststopenv=value"]}
 +    ],
 +    "mounts": [
 +      {"hostPath": "/tmp/cdi_mounts_test", "containerPath": "/tmp/cdi_mounts_test", "options": ["ro","nosuid","nodev","bind"]}
 +    ]
 +  }
 +}
 \ No newline at end of file
 -- 
 2.25.1
--- a/0087-code-improve.patch
+++ b/0087-code-improve.patch
--- a/0088-testcase-close-cdi-testcase.patch
+++ b/0088-testcase-close-cdi-testcase.patch
@ -0,0 +1,29 @@
 From eba353bef72bf62cd47f1b03a9fbd4c621ad479e Mon Sep 17 00:00:00 2001
 From: liuxu <liuxu156@huawei.com>
 Date: Thu, 16 May 2024 18:00:01 +0800
 Subject: [PATCH 088/108] testcase:close cdi testcase
 Signed-off-by: liuxu <liuxu156@huawei.com>
 ---
 CI/test_cases/container_cases/cdi_test.sh | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)
 diff --git a/CI/test_cases/container_cases/cdi_test.sh b/CI/test_cases/container_cases/cdi_test.sh
 index dd7b1177..f9fd4567 100755
 --- a/CI/test_cases/container_cases/cdi_test.sh
 +++ b/CI/test_cases/container_cases/cdi_test.sh
@@ -198,8 +198,8 @@ EOF
 declare -i ans=0
 -do_pre || ((ans++))
 -do_test_full_cdi || ((ans++))
 -do_post
 +# do_pre || ((ans++))
 +# do_test_full_cdi || ((ans++))
 +# do_post
 show_result ${ans} "${curr_path}/${0}"
 -- 
 2.25.1
--- a/0089-docs-update-cni-doc.patch
+++ b/0089-docs-update-cni-doc.patch
@ -0,0 +1,68 @@
 From 7fc8578097b9f8254962dc4fb277492b3251e5cb Mon Sep 17 00:00:00 2001
 From: liuxu <liuxu156@huawei.com>
 Date: Thu, 16 May 2024 17:56:08 +0800
 Subject: [PATCH 089/108] docs:update cni doc
 Signed-off-by: liuxu <liuxu156@huawei.com>
 ---
 README.md                | 2 +-
 README_zh.md             | 2 +-
 docs/design/README.md    | 2 ++
 docs/design/README_zh.md | 2 ++
 4 files changed, 6 insertions(+), 2 deletions(-)
 diff --git a/README.md b/README.md
 index 694ddbc2..7ddc62ab 100644
 --- a/README.md
 +++ b/README.md
@@ -228,7 +228,7 @@ Using [ptcr](https://gitee.com/openeuler/ptcr) as a performance test tool , it s
 The standard specification versions that `iSulad` is compatible with are as follows:
 - Compatible with OCI 1.0.0.
 -- Compatible with CNI 0.3.0 and above.
 +- Compatible with CNI 0.3.0 - 1.0.0, iSulad supports CNI 1.0.0 from 2.1.4 version.
 - Compatible with lcr 2.1.x and above.
 ## Kubernetes Support
 diff --git a/README_zh.md b/README_zh.md
 index 5db28f3a..45ac66ac 100755
 --- a/README_zh.md
 +++ b/README_zh.md
@@ -224,7 +224,7 @@ $ sudo isula rm test
 `iSulad` 能够兼容的标准规范版本如下：
 - 兼容 1.0.0 版本的OCI
 -- 兼容 0.3.0 版本以上的CNI
 +- 兼容 0.3.0-1.0.0 版本的CNI，iSulad从2.1.4版本后支持 CNI 1.0.0版本
 - 兼容 2.1.x 版本以上的lcr
 ## Kubernetes Support
 diff --git a/docs/design/README.md b/docs/design/README.md
 index d2a3702d..c171cb20 100644
 --- a/docs/design/README.md
 +++ b/docs/design/README.md
@@ -43,6 +43,8 @@ This section contains some design documents for users who want to learn more abo
 - You can see how the cni operator modules are designed in [cni_operator_design](./detailed/Network/cni_operator_design.md).
 +- You can see how the cni operator modules update to CNI v1.0.0 in [cni_1.0.0_change](./detailed/Network/cni_1.0.0_change.md)。
 +
 - You can see how the CRI adapter modules are designed in [CRI_adapter_design](./detailed/Network/CRI_adapter_design.md).
 - You can see how the native network adapter modules are designed in [native_network_adapter_design](./detailed/Network/native_network_adapter_design.md).
 diff --git a/docs/design/README_zh.md b/docs/design/README_zh.md
 index c6172b6f..0f4cf13e 100644
 --- a/docs/design/README_zh.md
 +++ b/docs/design/README_zh.md
@@ -49,6 +49,8 @@
 - 查看 cni operator 模块的设计文档： [cni_operator_design](./detailed/Network/cni_operator_design_zh.md) 。
 +- 查看 cni operator 模块升级到CNI v1.0.0的设计文档： [cni_1.0.0_change](./detailed/Network/cni_1.0.0_change.md) 。
 +
 - 查看 CRI adapter 模块的设计文档： [CRI_adapter_design](./detailed/Network/CRI_adapter_design_zh.md) 。
 - 查看 native network adapter 模块的设计文档： [native_network_adapter_design](./detailed/Network/native_network_adapter_design_zh.md) 。
 -- 
 2.25.1
--- a/0090-modify-the-user-error-log-to-be-the-same-as-before.patch
+++ b/0090-modify-the-user-error-log-to-be-the-same-as-before.patch
@ -0,0 +1,100 @@
 From 3b0f34c7cd55686cf18f65efbdc0be8a84f13e3e Mon Sep 17 00:00:00 2001
 From: zhongtao <zhongtao17@huawei.com>
 Date: Mon, 20 May 2024 17:54:04 +1400
 Subject: [PATCH 090/108] modify the user error log to be the same as before
 Signed-off-by: zhongtao <zhongtao17@huawei.com>
 ---
 src/daemon/common/id_name_manager.c           |  4 +--
 .../executor/container_cb/execution_create.c  | 26 +++++++++++--------
 .../container_cb/execution_information.c      |  4 ++-
 3 files changed, 20 insertions(+), 14 deletions(-)
 diff --git a/src/daemon/common/id_name_manager.c b/src/daemon/common/id_name_manager.c
 index 263a584d..f64094b9 100644
 --- a/src/daemon/common/id_name_manager.c
 +++ b/src/daemon/common/id_name_manager.c
@@ -242,7 +242,7 @@ static bool try_add_name(const char *name)
     }
     if (!util_valid_container_name(name)) {
 -        ERROR("Failed to add invalid name: %s", name);
 +        ERROR("Invalid container name (%s), only [a-zA-Z0-9][a-zA-Z0-9_.-]+$ are allowed.", name);
         return false;
     }
@@ -262,7 +262,7 @@ static bool try_remove_name(const char *name)
     }
     if (!util_valid_container_name(name)) {
 -        ERROR("Failed to remove invalid name: %s", name);
 +        ERROR("Invalid container name (%s), only [a-zA-Z0-9][a-zA-Z0-9_.-]+$ are allowed.", name);
         return false;
     }
 diff --git a/src/daemon/executor/container_cb/execution_create.c b/src/daemon/executor/container_cb/execution_create.c
 index 785b4e27..041089dd 100644
 --- a/src/daemon/executor/container_cb/execution_create.c
 +++ b/src/daemon/executor/container_cb/execution_create.c
@@ -761,8 +761,17 @@ static int maintain_container_id(const container_create_request *request, char *
 #endif
     if (!nret) {
 -        ERROR("Failed to add entry to id name manager with new id and name");
 -        isulad_set_error_message("Failed to add entry to id name manager with new id and name");
 +        __isula_auto_free char *used_id = NULL;
 +        used_id = container_name_index_get(name);
 +        if(used_id != NULL) {
 +            ERROR("Name %s is in use by container %s", name, used_id);
 +            isulad_set_error_message("Conflict. The name \"%s\" is already in use by container %s. "
 +                                    "You have to remove (or rename) that container to be able to reuse that name.",
 +                                    name, used_id);
 +        } else {
 +            ERROR("Failed to add entry to id name manager with new id and name");
 +            isulad_set_error_message("Failed to add entry to id name manager with new id and name");
 +        }
         ret = -1;
         goto out;
     }
@@ -775,19 +784,14 @@ static int maintain_container_id(const container_create_request *request, char *
         goto out;
     }
 -    char *used_id = NULL;
 -    used_id = container_name_index_get(name);
 -    ERROR("Name %s is in use by container %s", name, used_id);
 -    isulad_set_error_message("Conflict. The name \"%s\" is already in use by container %s. "
 -                             "You have to remove (or rename) that container to be able to reuse that name.",
 -                             name, used_id);
 -    free(used_id);
 -    used_id = NULL;
 -    ret = -1;
     if (!skip_id_name_manage && !id_name_manager_remove_entry(id, name)) {
         WARN("Failed to remove %s and %s from id name manager", id, name);
     }
 +    ERROR("Failed to add %s to container name index", name);
 +    isulad_set_error_message("Failed to add %s to container name index", name);
 +    ret = -1;
 +
 out:
     *out_id = id;
     *out_name = name;
 diff --git a/src/daemon/executor/container_cb/execution_information.c b/src/daemon/executor/container_cb/execution_information.c
 index c02cc830..58924257 100644
 --- a/src/daemon/executor/container_cb/execution_information.c
 +++ b/src/daemon/executor/container_cb/execution_information.c
@@ -1149,7 +1149,9 @@ static int container_rename(container_t *cont, const char *new_name)
     if (!id_name_manager_rename(new_name, old_name)) {
         ERROR("Failed to rename %s to %s in id-name manager", old_name, new_name);
 -        isulad_set_error_message("Failed to rename %s to %s in id-name manager", old_name, new_name);
 +        isulad_set_error_message("Conflict. The name \"%s\" is already in use by container %s. "
 +                                 "You have to remove (or rename) that container to be able to reuse that name.",
 +                                 new_name, new_name);
         ret = -1;
         goto out;
     }
 -- 
 2.25.1
--- a/0091-add-enable-cri-v1-in-k8s-integration.patch
+++ b/0091-add-enable-cri-v1-in-k8s-integration.patch
@ -0,0 +1,54 @@
 From 1f69ffe589f7225a1db83377e276ddbab963bd16 Mon Sep 17 00:00:00 2001
 From: jikai <jikai11@huawei.com>
 Date: Tue, 21 May 2024 01:13:08 +0000
 Subject: [PATCH 091/108] add enable cri v1 in k8s integration
 Signed-off-by: jikai <jikai11@huawei.com>
 ---
 docs/manual/k8s_integration.md    | 9 +++++++++
 docs/manual/k8s_integration_zh.md | 9 +++++++++
 2 files changed, 18 insertions(+)
 diff --git a/docs/manual/k8s_integration.md b/docs/manual/k8s_integration.md
 index 8fcd0a54..14de0ef4 100644
 --- a/docs/manual/k8s_integration.md
 +++ b/docs/manual/k8s_integration.md
@@ -20,6 +20,15 @@
    if `hosts` is not configured, the default endpoint is `unix:///var/run/isulad.sock`.
 +   `iSulad` supports both `CRI V1alpha2` and `CRI V1`, and uses `CRI V1alph2` by default.
 +   If `CRI V1` is required, it can be configured in `/etc/isulad/daemon.json` to enable `CRI V1`:
 +
 +   ```json
 +       "enable-cri-v1": true,
 +   ```
 +
 +   If `iSulad` is compiled from source codes, `-D ENABLE_CRI_API_V1=ON` option is required in cmake.
 +
 2. Restart `isulad`:
    ```bash
 diff --git a/docs/manual/k8s_integration_zh.md b/docs/manual/k8s_integration_zh.md
 index 6dda1e4d..26ba6cc4 100644
 --- a/docs/manual/k8s_integration_zh.md
 +++ b/docs/manual/k8s_integration_zh.md
@@ -20,6 +20,15 @@
    如果`hosts`没有配置，默认的`endpoint`为``unix:///var/run/isulad.sock``
 +   `iSulad`同时支持`CRI V1alpha2`和`CRI V1`两种`CRI`接口，默认使用`CRI V1alph2`，若需使用`CRI V1`，
 +   需要在`/etc/isulad/daemon.json`对`iSulad`进行相关配置，配置方式为：
 +
 +   ```json
 +       "enable-cri-v1": true,
 +   ```
 +
 +   若使用源码编译`iSulad`，还需在编译时增加cmake编译选项`-D ENABLE_CRI_API_V1=ON`。
 +
 2. 重启`isulad`
    ```bash
 -- 
 2.25.1
--- a/0092-isolate-oom-monitor-codes.patch
+++ b/0092-isolate-oom-monitor-codes.patch
@ -0,0 +1,317 @@
 From d97656a8b99f4fa95a9c15abfbac777a94b84d55 Mon Sep 17 00:00:00 2001
 From: jikai <jikai11@huawei.com>
 Date: Mon, 20 May 2024 08:48:00 +0000
 Subject: [PATCH 092/108] isolate oom monitor codes
 Signed-off-by: jikai <jikai11@huawei.com>
 ---
 cmake/options.cmake                                |  7 +++++++
 src/daemon/common/cgroup/cgroup.c                  |  2 ++
 src/daemon/common/cgroup/cgroup.h                  |  2 ++
 src/daemon/common/cgroup/cgroup_common.h           |  4 ++++
 src/daemon/common/cgroup/cgroup_v1.c               |  8 ++++++++
 src/daemon/common/cgroup/cgroup_v2.c               |  8 ++++++++
 src/daemon/common/cri/v1/v1_cri_helpers.cc         |  2 ++
 src/daemon/modules/container/container_state.c     |  2 ++
 .../modules/container/supervisor/supervisor.c      | 14 ++++++++++++++
 9 files changed, 49 insertions(+)
 diff --git a/cmake/options.cmake b/cmake/options.cmake
 index a15b8194..5b17f631 100644
 --- a/cmake/options.cmake
 +++ b/cmake/options.cmake
@@ -58,6 +58,13 @@ if (ENABLE_SANDBOXER STREQUAL "ON")
     message("${Green}--  Enable sandbox API${ColourReset}")
 endif()
 +option(ENABLE_OOM_MONITOR "Enable oom monitor" ON)
 +IF (ENABLE_OOM_MONITOR STREQUAL "ON")
 +    add_definitions(-DENABLE_OOM_MONITOR)
 +    set(ENABLE_OOM_MONITOR 1)
 +    message("${Green}--  Enable oom monitor${ColourReset}")
 +endif()
 +
 option(ENABLE_SYSTEMD_NOTIFY "Enable systemd notify" ON)
 if (ENABLE_SYSTEMD_NOTIFY STREQUAL "ON")
     add_definitions(-DSYSTEMD_NOTIFY)
 diff --git a/src/daemon/common/cgroup/cgroup.c b/src/daemon/common/cgroup/cgroup.c
 index 71bf9801..77fafdae 100644
 --- a/src/daemon/common/cgroup/cgroup.c
 +++ b/src/daemon/common/cgroup/cgroup.c
@@ -197,6 +197,7 @@ char *common_convert_cgroup_path(const char *cgroup_path)
     return util_strdup_s(result);
 }
 +#ifdef ENABLE_OOM_MONITOR
 cgroup_oom_handler_info_t *common_get_cgroup_oom_handler(int fd, const char *name, const char *cgroup_path,
                                                          const char *exit_fifo)
 {
@@ -225,3 +226,4 @@ void common_free_cgroup_oom_handler_info(cgroup_oom_handler_info_t *info)
     free(info->cgroup_memory_event_path);
     free(info);
 }
 +#endif
 diff --git a/src/daemon/common/cgroup/cgroup.h b/src/daemon/common/cgroup/cgroup.h
 index 0bbb70a0..1ebbfa98 100644
 --- a/src/daemon/common/cgroup/cgroup.h
 +++ b/src/daemon/common/cgroup/cgroup.h
@@ -43,9 +43,11 @@ char *common_get_own_cgroup_path(const char *subsystem);
 char *common_convert_cgroup_path(const char *cgroup_path);
 +#ifdef ENABLE_OOM_MONITOR
 cgroup_oom_handler_info_t *common_get_cgroup_oom_handler(int fd, const char *name, const char *cgroup_path,
                                                          const char *exit_fifo);
 void common_free_cgroup_oom_handler_info(cgroup_oom_handler_info_t *info);
 +#endif
 #ifdef __cplusplus
 }
 diff --git a/src/daemon/common/cgroup/cgroup_common.h b/src/daemon/common/cgroup/cgroup_common.h
 index 46a7de50..01fc669c 100644
 --- a/src/daemon/common/cgroup/cgroup_common.h
 +++ b/src/daemon/common/cgroup/cgroup_common.h
@@ -116,6 +116,7 @@ typedef struct {
     cgroup_pids_metrics_t cgpids_metrics;
 } cgroup_metrics_t;
 +#ifdef ENABLE_OOM_MONITOR
 #define CGROUP_OOM_HANDLE_CONTINUE false
 #define CGROUP_OOM_HANDLE_CLOSE true
@@ -126,6 +127,7 @@ typedef struct _cgroup_oom_handler_info_t {
     char *cgroup_memory_event_path;
     bool (*oom_event_handler)(int, void *);
 } cgroup_oom_handler_info_t;
 +#endif
 typedef struct {
     int (*get_cgroup_version)(void);
@@ -140,8 +142,10 @@ typedef struct {
     char *(*get_init_cgroup_path)(const char *subsystem);
     char *(*get_own_cgroup_path)(const char *subsystem);
 +#ifdef ENABLE_OOM_MONITOR
     cgroup_oom_handler_info_t *(*get_cgroup_oom_handler)(int fd, const char *name, const char *cgroup_path,
                                                          const char *exit_fifo);
 +#endif
 } cgroup_ops;
 #ifdef __cplusplus
 diff --git a/src/daemon/common/cgroup/cgroup_v1.c b/src/daemon/common/cgroup/cgroup_v1.c
 index 45b1d096..018336ea 100644
 --- a/src/daemon/common/cgroup/cgroup_v1.c
 +++ b/src/daemon/common/cgroup/cgroup_v1.c
@@ -20,12 +20,16 @@
 #include <stdio.h>
 #include <stdlib.h>
 +#ifdef ENABLE_OOM_MONITOR
 #include <sys/eventfd.h>
 +#endif
 #include "utils.h"
 #include "sysinfo.h"
 #include "err_msg.h"
 +#ifdef ENABLE_OOM_MONITOR
 #include "events_sender_api.h"
 +#endif
 #define CGROUP_HUGETLB_LIMIT "hugetlb.%s.limit_in_bytes"
 #define CGROUP_MOUNT_PATH_PREFIX "/sys/fs/cgroup/"
@@ -1052,6 +1056,7 @@ static char *common_get_cgroup_path(const char *path, const char *subsystem)
     return res;
 }
 +#ifdef ENABLE_OOM_MONITOR
 static bool oom_cb_cgroup_v1(int fd, void *cbdata)
 {
     cgroup_oom_handler_info_t *info = (cgroup_oom_handler_info_t *)cbdata;
@@ -1205,6 +1210,7 @@ cleanup:
     common_free_cgroup_oom_handler_info(info);
     return NULL;
 }
 +#endif
 char *get_init_cgroup_path_v1(const char *subsystem)
 {
@@ -1232,6 +1238,8 @@ int cgroup_v1_ops_init(cgroup_ops *ops)
     ops->get_cgroup_mnt_and_root_path = get_cgroup_mnt_and_root_path_v1;
     ops->get_init_cgroup_path = get_init_cgroup_path_v1;
     ops->get_own_cgroup_path = get_own_cgroup_v1;
 +#ifdef ENABLE_OOM_MONITOR
     ops->get_cgroup_oom_handler = get_cgroup_oom_handler_v1;
 +#endif
     return 0;
 }
 \ No newline at end of file
 diff --git a/src/daemon/common/cgroup/cgroup_v2.c b/src/daemon/common/cgroup/cgroup_v2.c
 index 76754dc1..ce72e6c4 100644
 --- a/src/daemon/common/cgroup/cgroup_v2.c
 +++ b/src/daemon/common/cgroup/cgroup_v2.c
@@ -17,14 +17,18 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <sys/stat.h>
 +#ifdef ENABLE_OOM_MONITOR
 #include <sys/inotify.h>
 +#endif
 #include <isula_libutils/auto_cleanup.h>
 #include "utils.h"
 #include "path.h"
 #include "sysinfo.h"
 +#ifdef ENABLE_OOM_MONITOR
 #include "events_sender_api.h"
 +#endif
 // Cgroup V2 Item Definition
 #define CGROUP2_CPU_WEIGHT "cpu.weight"
@@ -416,6 +420,7 @@ static int get_cgroup_mnt_and_root_v2(const char *subsystem, char **mountpoint,
     return 0;
 }
 +#ifdef ENABLE_OOM_MONITOR
 static bool oom_cb_cgroup_v2(int fd, void *cbdata)
 {
     const size_t events_size = sizeof(struct inotify_event) + NAME_MAX + 1;
@@ -547,6 +552,7 @@ cleanup:
     common_free_cgroup_oom_handler_info(info);
     return NULL;
 }
 +#endif
 int get_cgroup_version_v2()
 {
@@ -562,6 +568,8 @@ int cgroup_v2_ops_init(cgroup_ops *ops)
     ops->get_cgroup_info = get_cgroup_info_v2;
     ops->get_cgroup_metrics = get_cgroup_metrics_v2;
     ops->get_cgroup_mnt_and_root_path = get_cgroup_mnt_and_root_v2;
 +#ifdef ENABLE_OOM_MONITOR
     ops->get_cgroup_oom_handler = get_cgroup_oom_handler_v2;
 +#endif
     return 0;
 }
 \ No newline at end of file
 diff --git a/src/daemon/common/cri/v1/v1_cri_helpers.cc b/src/daemon/common/cri/v1/v1_cri_helpers.cc
 index 478dd105..31b6b137 100644
 --- a/src/daemon/common/cri/v1/v1_cri_helpers.cc
 +++ b/src/daemon/common/cri/v1/v1_cri_helpers.cc
@@ -517,9 +517,11 @@ void UpdateBaseStatusFromInspect(
         } else { // Case 3
             state = runtime::v1::CONTAINER_CREATED;
         }
 +#ifdef ENABLE_OOM_MONITOR
         if (inspect->state->oom_killed == true) {
             reason = "OOMKilled";
         }
 +#endif
         if (inspect->state->error != nullptr) {
             message = inspect->state->error;
         }
 diff --git a/src/daemon/modules/container/container_state.c b/src/daemon/modules/container/container_state.c
 index 452a2b26..f8ad0537 100644
 --- a/src/daemon/modules/container/container_state.c
 +++ b/src/daemon/modules/container/container_state.c
@@ -587,7 +587,9 @@ container_inspect_state *container_state_to_inspect_state(container_state_t *s)
     state->running = s->state->running;
     state->paused = s->state->paused;
     state->restarting = s->state->restarting;
 +#ifdef ENABLE_OOM_MONITOR
     state->oom_killed = s->state->oom_killed;
 +#endif
     state->pid = s->state->pid;
     state->exit_code = s->state->exit_code;
 diff --git a/src/daemon/modules/container/supervisor/supervisor.c b/src/daemon/modules/container/supervisor/supervisor.c
 index 39d9fdb8..294783eb 100644
 --- a/src/daemon/modules/container/supervisor/supervisor.c
 +++ b/src/daemon/modules/container/supervisor/supervisor.c
@@ -42,8 +42,10 @@
 #ifdef ENABLE_CRI_API_V1
 #include "sandbox_ops.h"
 #endif
 +#ifdef ENABLE_OOM_MONITOR
 #include "cgroup.h"
 #include "specs_api.h"
 +#endif
 pthread_mutex_t g_supervisor_lock = PTHREAD_MUTEX_INITIALIZER;
 struct epoll_descr g_supervisor_descr;
@@ -286,6 +288,7 @@ static int supervisor_exit_cb(int fd, uint32_t events, void *cbdata, struct epol
     return EPOLL_LOOP_HANDLE_CONTINUE;
 }
 +#ifdef ENABLE_OOM_MONITOR
 static int oom_handle_cb(int fd, uint32_t events, void *cbdata, struct epoll_descr *descr)
 {
     cgroup_oom_handler_info_t *oom_handler_info = (cgroup_oom_handler_info_t *)cbdata;
@@ -305,6 +308,7 @@ static int oom_handle_cb(int fd, uint32_t events, void *cbdata, struct epoll_des
     return EPOLL_LOOP_HANDLE_CONTINUE;
 }
 +#endif
 /* supervisor add exit monitor */
 int container_supervisor_add_exit_monitor(int fd, const char *exit_fifo, const pid_ppid_info_t *pid_info,
@@ -312,8 +316,10 @@ int container_supervisor_add_exit_monitor(int fd, const char *exit_fifo, const p
 {
     int ret = 0;
     struct supervisor_handler_data *data = NULL;
 +#ifdef ENABLE_OOM_MONITOR
     cgroup_oom_handler_info_t *oom_handler_info = NULL;
     __isula_auto_free char *cgroup_path = NULL;
 +#endif
     if (fd < 0) {
         ERROR("Invalid exit fifo fd");
@@ -326,12 +332,14 @@ int container_supervisor_add_exit_monitor(int fd, const char *exit_fifo, const p
         return -1;
     }
 +#ifdef ENABLE_OOM_MONITOR
     cgroup_path = merge_container_cgroups_path(cont->common_config->id, cont->hostconfig);
     if (cgroup_path == NULL) {
         ERROR("Failed to get cgroup path");
         close(fd);
         return -1;
     }
 +#endif
     data = util_common_calloc_s(sizeof(struct supervisor_handler_data));
     if (data == NULL) {
@@ -353,9 +361,12 @@ int container_supervisor_add_exit_monitor(int fd, const char *exit_fifo, const p
     data->pid_info.start_time = pid_info->start_time;
     data->pid_info.ppid = pid_info->ppid;
     data->pid_info.pstart_time = pid_info->pstart_time;
 +#ifdef ENABLE_OOM_MONITOR
     oom_handler_info = common_get_cgroup_oom_handler(fd, cont->common_config->id, cgroup_path, exit_fifo);
 +#endif
     supervisor_handler_lock();
 +#ifdef ENABLE_OOM_MONITOR
     if (oom_handler_info != NULL) {
         ret = epoll_loop_add_handler(&g_supervisor_descr, oom_handler_info->oom_event_fd, oom_handle_cb, oom_handler_info);
         if (ret != 0) {
@@ -363,6 +374,7 @@ int container_supervisor_add_exit_monitor(int fd, const char *exit_fifo, const p
             goto err;
         }
     }
 +#endif
     ret = epoll_loop_add_handler(&g_supervisor_descr, fd, supervisor_exit_cb, data);
     if (ret != 0) {
@@ -374,7 +386,9 @@ int container_supervisor_add_exit_monitor(int fd, const char *exit_fifo, const p
 err:
     supervisor_handler_data_free(data);
 +#ifdef ENABLE_OOM_MONITOR
     common_free_cgroup_oom_handler_info(oom_handler_info);
 +#endif
 out:
     supervisor_handler_unlock();
     return ret;
 -- 
 2.25.1
--- a/0093-change-fork-process-exit-mode.patch
+++ b/0093-change-fork-process-exit-mode.patch
@ -0,0 +1,64 @@
 From 0ff5a421e31096fbd10cf00c45a3849297023391 Mon Sep 17 00:00:00 2001
 From: zhongtao <zhongtao17@huawei.com>
 Date: Thu, 23 May 2024 01:09:41 +1400
 Subject: [PATCH 093/108] change fork process exit mode
 ---
 src/utils/tar/util_archive.c | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)
 diff --git a/src/utils/tar/util_archive.c b/src/utils/tar/util_archive.c
 index 52b51162..204dab83 100644
 --- a/src/utils/tar/util_archive.c
 +++ b/src/utils/tar/util_archive.c
@@ -897,9 +897,9 @@ int archive_unpack(const struct io_read_wrapper *content, const char *dstdir, co
 child_out:
         if (ret != 0) {
 -            exit(EXIT_FAILURE);
 +            _exit(EXIT_FAILURE);
         }
 -        exit(EXIT_SUCCESS);
 +        _exit(EXIT_SUCCESS);
     }
     close(pipe_stderr[1]);
     pipe_stderr[1] = -1;
@@ -1342,9 +1342,9 @@ int archive_chroot_tar(const char *path, const char *file, const char *root_dir,
 child_out:
         if (ret != 0) {
 -            exit(EXIT_FAILURE);
 +            _exit(EXIT_FAILURE);
         } else {
 -            exit(EXIT_SUCCESS);
 +            _exit(EXIT_SUCCESS);
         }
     }
     close(pipe_for_read[1]);
@@ -1577,9 +1577,9 @@ int archive_chroot_untar_stream(const struct io_read_wrapper *context, const cha
 child_out:
         if (ret != 0) {
 -            exit(EXIT_FAILURE);
 +            _exit(EXIT_FAILURE);
         }
 -        exit(EXIT_SUCCESS);
 +        _exit(EXIT_SUCCESS);
     }
     close(pipe_stderr[1]);
@@ -1727,9 +1727,9 @@ child_out:
         free(tar_base_name);
         if (ret != 0) {
 -            exit(EXIT_FAILURE);
 +            _exit(EXIT_FAILURE);
         } else {
 -            exit(EXIT_SUCCESS);
 +            _exit(EXIT_SUCCESS);
         }
     }
 -- 
 2.25.1
--- a/0094-fix-error-log-for-verify_cpu_realtime.patch
+++ b/0094-fix-error-log-for-verify_cpu_realtime.patch
@ -0,0 +1,26 @@
 From 1671a136d1b7d209c453a8ad2b1bf062a3afbe09 Mon Sep 17 00:00:00 2001
 From: zhongtao <zhongtao17@huawei.com>
 Date: Tue, 28 May 2024 17:23:45 +1400
 Subject: [PATCH 094/108] fix error log for verify_cpu_realtime
 Signed-off-by: zhongtao <zhongtao17@huawei.com>
 ---
 src/daemon/modules/spec/verify.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/src/daemon/modules/spec/verify.c b/src/daemon/modules/spec/verify.c
 index 57e16ef9..1ce76c1d 100644
 --- a/src/daemon/modules/spec/verify.c
 +++ b/src/daemon/modules/spec/verify.c
@@ -390,7 +390,7 @@ static int verify_cpu_realtime(const sysinfo_t *sysinfo, int64_t realtime_period
     if (realtime_runtime != 0 && !(sysinfo->cgcpuinfo.cpu_rt_runtime)) {
         ERROR("Invalid --cpu-rt-runtime: Your kernel does not support cgroup rt runtime");
 -        isulad_set_error_message("Invalid --cpu-rt-period: Your kernel does not support cgroup rt runtime");
 +        isulad_set_error_message("Invalid --cpu-rt-runtime: Your kernel does not support cgroup rt runtime");
         ret = -1;
         goto out;
     }
 -- 
 2.25.1
--- a/0095-bugfix-change-max-network-name-len.patch
+++ b/0095-bugfix-change-max-network-name-len.patch
@ -0,0 +1,54 @@
 From e2a7e6bfb0f0e97e5e1543fac7a5e0807fadaba0 Mon Sep 17 00:00:00 2001
 From: liuxu <liuxu156@huawei.com>
 Date: Thu, 30 May 2024 16:50:56 +0800
 Subject: [PATCH 095/108] bugfix: change max network name len
 Signed-off-by: liuxu <liuxu156@huawei.com>
 ---
 docs/design/detailed/Network/native_network_adapter_design.md   | 2 +-
 .../design/detailed/Network/native_network_adapter_design_zh.md | 2 +-
 src/utils/cutils/utils.h                                        | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)
 diff --git a/docs/design/detailed/Network/native_network_adapter_design.md b/docs/design/detailed/Network/native_network_adapter_design.md
 index b58989eb..1010bd73 100644
 --- a/docs/design/detailed/Network/native_network_adapter_design.md
 +++ b/docs/design/detailed/Network/native_network_adapter_design.md
@@ -204,7 +204,7 @@ Client:
 1. Parse the parameters passed in by the user.
 2. Verify the incoming parameters, including:
    - Only one network is allowed to be created at a time, that is, at most one name can be specified.
 -   - If name is specified, check whether the length of name exceeds MAX_NETWORK_NAME_LEN(128).
 +   - If name is specified, check whether the length of name exceeds MAX_NETWORK_NAME_LEN(255).
 3. Send the request to the server
 Server:
 diff --git a/docs/design/detailed/Network/native_network_adapter_design_zh.md b/docs/design/detailed/Network/native_network_adapter_design_zh.md
 index 30860f3d..62c4b6ef 100644
 --- a/docs/design/detailed/Network/native_network_adapter_design_zh.md
 +++ b/docs/design/detailed/Network/native_network_adapter_design_zh.md
@@ -204,7 +204,7 @@ int native_network_add_container_list(const char *network_name, const char *cont
 1. 解析用户传入的参数
 2. 对传入的参数进行校验，包括
    - 每次只允许创建一个网络， 即最多指定一个name
 -   - 若指定name，检查name长度是否超过MAX_NETWORK_NAME_LEN(128)
 +   - 若指定name，检查name长度是否超过MAX_NETWORK_NAME_LEN(255)
 3. 发送请求到服务端
 服务端：
 diff --git a/src/utils/cutils/utils.h b/src/utils/cutils/utils.h
 index 3671272a..4417a165 100644
 --- a/src/utils/cutils/utils.h
 +++ b/src/utils/cutils/utils.h
@@ -99,7 +99,7 @@ int malloc_trim(size_t pad);
 #define MAX_IMAGE_REF_LEN 384
 #define MAX_CONTAINER_NAME_LEN 1024
 #define MAX_RUNTIME_NAME_LEN 32
 -#define MAX_NETWORK_NAME_LEN 128
 +#define MAX_NETWORK_NAME_LEN 255
 #define LOGIN_USERNAME_LEN 255
 #define LOGIN_PASSWORD_LEN 255
 -- 
 2.25.1
--- a/0096-del-useless-info.patch
+++ b/0096-del-useless-info.patch
@ -0,0 +1,26 @@
 From b36cfa4325f43b3fa1468ba360b3d51f6ef1c3ca Mon Sep 17 00:00:00 2001
 From: liuxu <liuxu156@huawei.com>
 Date: Thu, 30 May 2024 17:14:48 +0800
 Subject: [PATCH 096/108] del useless info
 Signed-off-by: liuxu <liuxu156@huawei.com>
 ---
 release_notes | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/release_notes b/release_notes
 index 2d564c7e..fdcd3690 100644
 --- a/release_notes
 +++ b/release_notes
@@ -72,7 +72,7 @@
     dev stats:
       - 357 files changed, 7886 insertions(+), 2849 deletions(-)
 -      - contributors: zhongtao, jikai, haozi007, jake, liuxu, xuxuepeng, zhangxiaoyu, sailorvii, chen524, dreamloy, l00804245, yangjiaqi
 +      - contributors: zhongtao, jikai, haozi007, jake, liuxu, xuxuepeng, zhangxiaoyu, sailorvii, chen524, dreamloy, yangjiaqi
 2023-11-07 xuepengxu release 2.1.4
     - !2238 modify the default value of EANBLE_IMAGE_LIBARAY to off * modify the default value of EANBLE_IMAGE_LIBARAY to off
 -- 
 2.25.1
--- a/0097-code-improve.patch
+++ b/0097-code-improve.patch
@ -0,0 +1,83 @@
 From 2aa26649f20ae5992ace7bb8cb62a5ee9c3f7a81 Mon Sep 17 00:00:00 2001
 From: zhongtao <zhongtao17@huawei.com>
 Date: Thu, 30 May 2024 21:30:43 +1400
 Subject: [PATCH 097/108] code improve
 Signed-off-by: zhongtao <zhongtao17@huawei.com>
 ---
 src/cmd/isula/volume/prune.c                             | 2 +-
 src/cmd/options/opt_log.c                                | 2 +-
 src/daemon/executor/container_cb/execution_extend.c      | 3 ++-
 src/daemon/executor/container_cb/execution_information.c | 2 +-
 src/daemon/modules/image/oci/registry_type.c             | 2 +-
 5 files changed, 6 insertions(+), 5 deletions(-)
 diff --git a/src/cmd/isula/volume/prune.c b/src/cmd/isula/volume/prune.c
 index c8d632ed..3b5bfbf1 100644
 --- a/src/cmd/isula/volume/prune.c
 +++ b/src/cmd/isula/volume/prune.c
@@ -79,7 +79,7 @@ out:
 int cmd_volume_prune_main(int argc, const char **argv)
 {
 -    int i = 0;
 +    size_t i = 0;
     struct isula_libutils_log_config lconf = { 0 };
     int exit_code = 1;
     command_t cmd;
 diff --git a/src/cmd/options/opt_log.c b/src/cmd/options/opt_log.c
 index b1abcfaf..8ffb9966 100644
 --- a/src/cmd/options/opt_log.c
 +++ b/src/cmd/options/opt_log.c
@@ -67,7 +67,7 @@ static int log_opt_syslog_facility(const char *key, const char *value, char **pa
                                       "authpriv", "ftp",    "local0", "local1", "local2",
                                       "local3",   "local4", "local5", "local6", "local7"
                                     };
 -    int i;
 +    size_t i;
     size_t f_len = sizeof(facility_values) / sizeof(const char *);
     for (i = 0; i < f_len; i++) {
 diff --git a/src/daemon/executor/container_cb/execution_extend.c b/src/daemon/executor/container_cb/execution_extend.c
 index 52401633..ed072848 100644
 --- a/src/daemon/executor/container_cb/execution_extend.c
 +++ b/src/daemon/executor/container_cb/execution_extend.c
@@ -990,7 +990,8 @@ out:
 static int update_container_unified(const char *id, const host_config *hostconfig, host_config *chostconfig)
 {
 -    int i, cgroup_version;
 +    int cgroup_version;
 +    size_t i;
     if (hostconfig->unified == NULL || hostconfig->unified->len == 0) {
         return 0;
 diff --git a/src/daemon/executor/container_cb/execution_information.c b/src/daemon/executor/container_cb/execution_information.c
 index 58924257..4aee3aef 100644
 --- a/src/daemon/executor/container_cb/execution_information.c
 +++ b/src/daemon/executor/container_cb/execution_information.c
@@ -244,7 +244,7 @@ static int get_proxy_env(char **proxy, const char *type)
     }
     *col_pos = '\0';
     nret = snprintf(*proxy, proxy_len, "%s:%s%s", tmp_proxy, mask_str, at_pos);
 -    if (nret < 0 || nret >= proxy_len) {
 +    if (nret < 0 || (size_t)nret >= proxy_len) {
         ret = -1;
         free(*proxy);
         *proxy = NULL;
 diff --git a/src/daemon/modules/image/oci/registry_type.c b/src/daemon/modules/image/oci/registry_type.c
 index 6c9ff747..7a2c25ed 100644
 --- a/src/daemon/modules/image/oci/registry_type.c
 +++ b/src/daemon/modules/image/oci/registry_type.c
@@ -59,7 +59,7 @@ void free_layer_blob(layer_blob *layer)
 void free_pull_desc(pull_descriptor *desc)
 {
 -    int i = 0;
 +    size_t i = 0;
     if (desc == NULL) {
         return;
 -- 
 2.25.1
--- a/0098-cdi-add-debug-info.patch
+++ b/0098-cdi-add-debug-info.patch
@ -0,0 +1,33 @@
 From 5a5f4879246783932ab620b2461a7cd832ddc1f0 Mon Sep 17 00:00:00 2001
 From: liuxu <liuxu156@huawei.com>
 Date: Fri, 31 May 2024 16:38:26 +0800
 Subject: [PATCH 098/108] cdi:add debug info
 Signed-off-by: liuxu <liuxu156@huawei.com>
 ---
 src/daemon/modules/device/cdi/cdi_cache.c | 2 ++
 1 file changed, 2 insertions(+)
 diff --git a/src/daemon/modules/device/cdi/cdi_cache.c b/src/daemon/modules/device/cdi/cdi_cache.c
 index e9a9b804..cd7158dd 100644
 --- a/src/daemon/modules/device/cdi/cdi_cache.c
 +++ b/src/daemon/modules/device/cdi/cdi_cache.c
@@ -306,6 +306,7 @@ static void refresh_scan_spec_func(struct cdi_scan_fn_maps *scan_fn_maps, const
             ERROR("Failed to insert device to devices by name %s", qualified);
             goto error_out;
         }
 +        DEBUG("Add device %s into memory", qualified);
         free(qualified);
         qualified = NULL;
     }
@@ -445,6 +446,7 @@ static int cdi_inject_devices(struct cdi_cache *c, oci_runtime_spec *oci_spec, s
     for (i = 0; i < devices->len; i++) {
         device = devices->items[i];
 +        DEBUG("Search cdi devices %s.", device);
         d = map_search(c->devices, (void *)device);
         if (d == NULL) {
             if (util_append_string_array(unresolved, device) != 0) {
 -- 
 2.25.1
--- a/0099-bugfix-cni-network-name-UT.patch
+++ b/0099-bugfix-cni-network-name-UT.patch
@ -0,0 +1,28 @@
 From 4a98535064319a9df3143d9c4b397f44fbbb56c5 Mon Sep 17 00:00:00 2001
 From: liuxu <liuxu156@huawei.com>
 Date: Mon, 3 Jun 2024 16:11:06 +0800
 Subject: [PATCH 099/108] bugfix:cni network name UT
 Signed-off-by: liuxu <liuxu156@huawei.com>
 ---
 test/cutils/utils_network/utils_network_ut.cc | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
 diff --git a/test/cutils/utils_network/utils_network_ut.cc b/test/cutils/utils_network/utils_network_ut.cc
 index 33eb6eb5..68f6f011 100644
 --- a/test/cutils/utils_network/utils_network_ut.cc
 +++ b/test/cutils/utils_network/utils_network_ut.cc
@@ -344,8 +344,8 @@ TEST(utils_network, test_net_contain_ip)
 TEST(utils_network, test_validate_network_name)
 {
     ASSERT_EQ(util_validate_network_name(nullptr), false);
 -    ASSERT_EQ(util_validate_network_name(std::string(128, 'a').c_str()), true);
 -    ASSERT_EQ(util_validate_network_name(std::string(129, 'a').c_str()), false);
 +    ASSERT_EQ(util_validate_network_name(std::string(255, 'a').c_str()), true);
 +    ASSERT_EQ(util_validate_network_name(std::string(256, 'a').c_str()), false);
     ASSERT_EQ(util_validate_network_name(std::string(".abce").c_str()), false);
 }
 -- 
 2.25.1
--- a/0100-bugfix-malloc-right-type-size.patch
+++ b/0100-bugfix-malloc-right-type-size.patch
@ -0,0 +1,40 @@
 From 7bf26415fcba090e281324ba92f7d7e6487b94fc Mon Sep 17 00:00:00 2001
 From: liuxu <liuxu156@huawei.com>
 Date: Tue, 4 Jun 2024 16:30:19 +0800
 Subject: [PATCH 100/108] bugfix:malloc right type size
 Signed-off-by: liuxu <liuxu156@huawei.com>
 ---
 src/client/connect/rest/rest_volumes_client.c | 2 +-
 src/daemon/modules/service/service_network.c  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)
 diff --git a/src/client/connect/rest/rest_volumes_client.c b/src/client/connect/rest/rest_volumes_client.c
 index 88254e6c..2327c28e 100644
 --- a/src/client/connect/rest/rest_volumes_client.c
 +++ b/src/client/connect/rest/rest_volumes_client.c
@@ -251,7 +251,7 @@ static int prune_request_to_rest(const struct isula_prune_volume_request *reques
     parser_error err = NULL;
     int ret = 0;
 -    nrequest = util_common_calloc_s(sizeof(volume_list_volume_request));
 +    nrequest = util_common_calloc_s(sizeof(volume_prune_volume_request));
     if (nrequest == NULL) {
         ERROR("Out of memory");
         return -1;
 diff --git a/src/daemon/modules/service/service_network.c b/src/daemon/modules/service/service_network.c
 index 6754cf1a..fe6dbf1d 100644
 --- a/src/daemon/modules/service/service_network.c
 +++ b/src/daemon/modules/service/service_network.c
@@ -74,7 +74,7 @@ static struct attach_net_conf_list *build_attach_networks(const defs_map_string_
         return NULL;
     }
 -    list = (struct attach_net_conf_list *)util_common_calloc_s(sizeof(struct attach_net_conf));
 +    list = (struct attach_net_conf_list *)util_common_calloc_s(sizeof(struct attach_net_conf_list));
     if (list == NULL) {
         ERROR("Out of memory");
         return NULL;
 -- 
 2.25.1
--- a/0101-use-isula_clean_path-rather-than-realpath.patch
+++ b/0101-use-isula_clean_path-rather-than-realpath.patch
@ -0,0 +1,26 @@
 From 60a2b15e0090018b7850b37369964bf62e253419 Mon Sep 17 00:00:00 2001
 From: jikai <jikai11@huawei.com>
 Date: Wed, 5 Jun 2024 02:07:23 +0000
 Subject: [PATCH 101/108] use isula_clean_path rather than realpath
 Signed-off-by: jikai <jikai11@huawei.com>
 ---
 src/cmd/isulad-shim/process.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/src/cmd/isulad-shim/process.c b/src/cmd/isulad-shim/process.c
 index 18fae03f..dd41c77f 100644
 --- a/src/cmd/isulad-shim/process.c
 +++ b/src/cmd/isulad-shim/process.c
@@ -489,7 +489,7 @@ static bool attach_fifopath_security_check(process_t *p, const char *fifopath)
         return false;
     }
 -    if (realpath(fifopath, real_path) == NULL) {
 +    if (isula_clean_path(fifopath, real_path, sizeof(real_path)) == NULL) {
         ERROR("Failed to get realpath for '%s': %d.", real_path, SHIM_SYS_ERR(errno));
         return false;
     }
 -- 
 2.25.1
--- a/0102-fix-false-engine-rootpath-reference.patch
+++ b/0102-fix-false-engine-rootpath-reference.patch
@ -0,0 +1,32 @@
 From fa25a8923e47ed6b65e0bcd08954589f5b26092c Mon Sep 17 00:00:00 2001
 From: jikai <jikai11@huawei.com>
 Date: Wed, 5 Jun 2024 02:10:48 +0000
 Subject: [PATCH 102/108] fix false engine rootpath reference
 Signed-off-by: jikai <jikai11@huawei.com>
 ---
 src/daemon/config/isulad_config.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
 diff --git a/src/daemon/config/isulad_config.c b/src/daemon/config/isulad_config.c
 index 80689bce..d7b54498 100644
 --- a/src/daemon/config/isulad_config.c
 +++ b/src/daemon/config/isulad_config.c
@@ -398,12 +398,12 @@ char *conf_get_sandbox_rootpath(void)
         ERROR("Get rootpath failed");
         return epath;
     }
 -    if (strlen(rootpath) > (PATH_MAX - strlen(ENGINE_ROOTPATH_NAME)) - 2) {
 +    if (strlen(rootpath) > (PATH_MAX - strlen(SANDBOX_ROOTPATH_NAME)) - 2) {
         ERROR("Root path is too long");
         return epath;
     }
     // rootpath + "/" + SANDBOX_ROOTPATH_NAME + "/0"
 -    len = strlen(rootpath) + 1 + strlen(ENGINE_ROOTPATH_NAME) + 1;
 +    len = strlen(rootpath) + 1 + strlen(SANDBOX_ROOTPATH_NAME) + 1;
     epath = util_smart_calloc_s(sizeof(char), len);
     if (epath == NULL) {
         ERROR("Out of memory");
 -- 
 2.25.1
--- a/0103-bugfix-add-note.patch
+++ b/0103-bugfix-add-note.patch
@ -0,0 +1,25 @@
 From 8eea40e09aa34da85cfa191f07cfe7e123c9809d Mon Sep 17 00:00:00 2001
 From: liuxu <liuxu156@huawei.com>
 Date: Wed, 5 Jun 2024 10:18:06 +0800
 Subject: [PATCH 103/108] bugfix:add note
 Signed-off-by: liuxu <liuxu156@huawei.com>
 ---
 src/utils/cutils/utils_array.h | 1 +
 1 file changed, 1 insertion(+)
 diff --git a/src/utils/cutils/utils_array.h b/src/utils/cutils/utils_array.h
 index 0c4fd217..553c2c13 100644
 --- a/src/utils/cutils/utils_array.h
 +++ b/src/utils/cutils/utils_array.h
@@ -30,6 +30,7 @@ void util_free_array_by_len(char **array, size_t len);
 void util_free_array(char **array);
 +// this function just copies the first len elements of array and does not automatically add NULL element in the end.
 char **util_copy_array_by_len(char **array, size_t len);
 int util_grow_array(char ***orig_array, size_t *orig_capacity, size_t size,
 -- 
 2.25.1
--- a/0104-bugfix-adapt-network-name-max-len.patch
+++ b/0104-bugfix-adapt-network-name-max-len.patch
@ -0,0 +1,64 @@
 From 174f7d9d959bd129675651ccf7ef460794188b63 Mon Sep 17 00:00:00 2001
 From: liuxu <liuxu156@huawei.com>
 Date: Wed, 5 Jun 2024 10:40:22 +0800
 Subject: [PATCH 104/108] bugfix:adapt network name max len
 Signed-off-by: liuxu <liuxu156@huawei.com>
 ---
 CI/test_cases/network_cases/network_create.sh | 5 +++--
 src/utils/cutils/utils.h                      | 7 ++++++-
 test/cutils/utils_network/utils_network_ut.cc | 4 ++--
 3 files changed, 11 insertions(+), 5 deletions(-)
 diff --git a/CI/test_cases/network_cases/network_create.sh b/CI/test_cases/network_cases/network_create.sh
 index 3107da12..da54fdd0 100755
 --- a/CI/test_cases/network_cases/network_create.sh
 +++ b/CI/test_cases/network_cases/network_create.sh
@@ -33,8 +33,9 @@ function test_network_create()
     local name1="cni1"
     local name2="cni2"
     local name3="a"
 -    for i in $(seq 1 7);do
 -        name3=${name3}${name3}
 +    local basechar="a"
 +    for i in $(seq 1 199);do
 +        name3=${name3}${basechar}
     done
     local name4=${name3}b
     local invalid_name=".xx"
 diff --git a/src/utils/cutils/utils.h b/src/utils/cutils/utils.h
 index 4417a165..ce0ca703 100644
 --- a/src/utils/cutils/utils.h
 +++ b/src/utils/cutils/utils.h
@@ -99,7 +99,12 @@ int malloc_trim(size_t pad);
 #define MAX_IMAGE_REF_LEN 384
 #define MAX_CONTAINER_NAME_LEN 1024
 #define MAX_RUNTIME_NAME_LEN 32
 -#define MAX_NETWORK_NAME_LEN 255
 +/* 
 + * Linux limits the length of the file name to 255,
 + * isulad will create file by name "${ISULAD_CNI_NETWORK_CONF_FILE_PRE}${network_name}.conflist"
 + * when create native network,so we limit the length of the network name to 200.
 + */
 +#define MAX_NETWORK_NAME_LEN 200
 #define LOGIN_USERNAME_LEN 255
 #define LOGIN_PASSWORD_LEN 255
 diff --git a/test/cutils/utils_network/utils_network_ut.cc b/test/cutils/utils_network/utils_network_ut.cc
 index 68f6f011..be85e398 100644
 --- a/test/cutils/utils_network/utils_network_ut.cc
 +++ b/test/cutils/utils_network/utils_network_ut.cc
@@ -344,8 +344,8 @@ TEST(utils_network, test_net_contain_ip)
 TEST(utils_network, test_validate_network_name)
 {
     ASSERT_EQ(util_validate_network_name(nullptr), false);
 -    ASSERT_EQ(util_validate_network_name(std::string(255, 'a').c_str()), true);
 -    ASSERT_EQ(util_validate_network_name(std::string(256, 'a').c_str()), false);
 +    ASSERT_EQ(util_validate_network_name(std::string(200, 'a').c_str()), true);
 +    ASSERT_EQ(util_validate_network_name(std::string(201, 'a').c_str()), false);
     ASSERT_EQ(util_validate_network_name(std::string(".abce").c_str()), false);
 }
 -- 
 2.25.1
--- a/0105-start-sandbox-before-setup-network-by-default.patch
+++ b/0105-start-sandbox-before-setup-network-by-default.patch
@ -0,0 +1,140 @@
 From e6b3528acff10fb2bc62e2da0c3754f1e36cbd54 Mon Sep 17 00:00:00 2001
 From: zhongtao <zhongtao17@huawei.com>
 Date: Wed, 5 Jun 2024 10:04:59 +0800
 Subject: [PATCH 105/108] start sandbox before setup network by default
 Signed-off-by: zhongtao <zhongtao17@huawei.com>
 ---
 src/daemon/common/cri/cri_helpers.cc          | 12 +++++++
 src/daemon/common/cri/cri_helpers.h           |  3 ++
 .../cri_pod_sandbox_manager_service.cc        | 34 +++++++++++++------
 src/daemon/modules/spec/specs.c               |  2 +-
 src/utils/cutils/utils_file.c                 |  2 +-
 5 files changed, 41 insertions(+), 12 deletions(-)
 diff --git a/src/daemon/common/cri/cri_helpers.cc b/src/daemon/common/cri/cri_helpers.cc
 index 68d569cc..8117403c 100644
 --- a/src/daemon/common/cri/cri_helpers.cc
 +++ b/src/daemon/common/cri/cri_helpers.cc
@@ -47,6 +47,8 @@ const std::string Constants::DOCKER_IMAGEID_PREFIX { "docker://" };
 const std::string Constants::DOCKER_PULLABLE_IMAGEID_PREFIX { "docker-pullable://" };
 const std::string Constants::RUNTIME_READY { "RuntimeReady" };
 const std::string Constants::NETWORK_READY { "NetworkReady" };
 +// Kata 2.x need create network namespace and setup network befoce run podsandbox
 +const std::string Constants::NETWORK_SETUP_ANNOTATION_KEY { "cri.sandbox.network.setup.v2" };
 const std::string Constants::POD_CHECKPOINT_KEY { "cri.sandbox.isulad.checkpoint" };
 const std::string Constants::CONTAINER_TYPE_ANNOTATION_KEY { "io.kubernetes.cri.container-type" };
 const std::string Constants::CONTAINER_NAME_ANNOTATION_KEY { "io.kubernetes.cri.container-name" };
@@ -1140,4 +1142,14 @@ auto GetPodSELinuxLabelOpts(const std::string &selinuxLabel, Errors &error)
     return fmtiSuladOpts(selinuxOpts, securityOptSep);
 }
 +bool SetupNetworkFirst(const std::map<std::string, std::string> &annotations)
 +{
 +    auto iter = annotations.find(CRIHelpers::Constants::NETWORK_SETUP_ANNOTATION_KEY);
 +    if (iter == annotations.end()) {
 +        return false;
 +    }
 +
 +    return iter->second == std::string("true");
 +}
 +
 } // namespace CRIHelpers
 diff --git a/src/daemon/common/cri/cri_helpers.h b/src/daemon/common/cri/cri_helpers.h
 index 5c450b32..11a80b45 100644
 --- a/src/daemon/common/cri/cri_helpers.h
 +++ b/src/daemon/common/cri/cri_helpers.h
@@ -49,6 +49,7 @@ public:
     static const std::string DOCKER_PULLABLE_IMAGEID_PREFIX;
     static const std::string RUNTIME_READY;
     static const std::string NETWORK_READY;
 +    static const std::string NETWORK_SETUP_ANNOTATION_KEY;
     static const std::string POD_CHECKPOINT_KEY;
     static const size_t MAX_CHECKPOINT_KEY_LEN { 250 };
     static const std::string CONTAINER_TYPE_ANNOTATION_KEY;
@@ -151,6 +152,8 @@ auto GetPodSELinuxLabelOpts(const std::string &selinuxLabel, Errors &error) -> s
 auto GetlegacySeccompiSuladOpts(const std::string &seccompProfile, Errors &error) -> std::vector<iSuladOpt>;
 auto GetSeccompiSuladOptsByPath(const char *dstpath, Errors &error) -> std::vector<iSuladOpt>;
 +
 +bool SetupNetworkFirst(const std::map<std::string, std::string> &annotations);
 }; // namespace CRIHelpers
 #endif // DAEMON_ENTRY_CRI_CRI_HELPERS_H
 diff --git a/src/daemon/entry/cri/v1alpha/cri_pod_sandbox_manager_service.cc b/src/daemon/entry/cri/v1alpha/cri_pod_sandbox_manager_service.cc
 index af6b5fff..f852f4df 100644
 --- a/src/daemon/entry/cri/v1alpha/cri_pod_sandbox_manager_service.cc
 +++ b/src/daemon/entry/cri/v1alpha/cri_pod_sandbox_manager_service.cc
@@ -655,19 +655,33 @@ auto PodSandboxManagerService::RunPodSandbox(const runtime::v1alpha2::PodSandbox
         }
     }
 -    // Step 7: Setup networking for the sandbox.
 -    SetupSandboxNetwork(config, response_id, inspect_data, networkOptions, stdAnnos, network_setting_json, error);
 -    if (error.NotEmpty()) {
 -        goto cleanup_ns;
 -    }
 +    // Step 7: According to the annotation and network namespace mode,
 +    //         determine the order of start sandbox and setup network.
 +    if (CRIHelpers::SetupNetworkFirst(stdAnnos)) {
 +        // Step 7.1: Setup networking for the sandbox, and then start the sandbox container.
 +        SetupSandboxNetwork(config, response_id, inspect_data, networkOptions, stdAnnos, network_setting_json, error);
 +        if (error.NotEmpty()) {
 +            goto cleanup_ns;
 +        }
 -    // Step 8: Start the sandbox container.
 -    StartSandboxContainer(response_id, error);
 -    if (error.NotEmpty()) {
 -        goto cleanup_network;
 +        StartSandboxContainer(response_id, error);
 +        if (error.NotEmpty()) {
 +            goto cleanup_network;
 +        }
 +    } else {
 +        // Step 7.2: (Default)Start the sandbox container, and then setup networking for the sandbox.
 +        StartSandboxContainer(response_id, error);
 +        if (error.NotEmpty()) {
 +            goto cleanup_ns;
 +        }
 +
 +        SetupSandboxNetwork(config, response_id, inspect_data, networkOptions, stdAnnos, network_setting_json, error);
 +        if (error.NotEmpty()) {
 +            goto cleanup_ns;
 +        }
     }
 -    // Step 9: Save network settings json to disk
 +    // Step 8: Save network settings json to disk
     if (namespace_is_cni(inspect_data->host_config->network_mode)) {
         Errors tmpErr;
         UpdatePodSandboxNetworkSettings(response_id, network_setting_json, tmpErr);
 diff --git a/src/daemon/modules/spec/specs.c b/src/daemon/modules/spec/specs.c
 index 122f9992..f0538e26 100644
 --- a/src/daemon/modules/spec/specs.c
 +++ b/src/daemon/modules/spec/specs.c
@@ -1601,7 +1601,7 @@ static int merge_share_network_namespace(const oci_runtime_spec *oci_spec, const
     int ret = 0;
     char *ns_path = NULL;
 -    if (host_spec->network_mode == NULL) {
 +    if (host_spec->network_mode == NULL || strlen(host_spec->network_mode) == 0) {
         return 0;
     }
 diff --git a/src/utils/cutils/utils_file.c b/src/utils/cutils/utils_file.c
 index 6fc6852d..90bb156f 100644
 --- a/src/utils/cutils/utils_file.c
 +++ b/src/utils/cutils/utils_file.c
@@ -85,7 +85,7 @@ bool util_file_exists(const char *f)
     struct stat buf;
     int nret;
 -    if (f == NULL) {
 +    if (f == NULL || strlen(f) == 0) {
         return false;
     }
 -- 
 2.25.1
--- a/0106-Revert-use-isula_clean_path-rather-than-realpath.patch
+++ b/0106-Revert-use-isula_clean_path-rather-than-realpath.patch
@ -0,0 +1,28 @@
 From f690c9a2dff298b41dc607e4ea6dd09113a322fb Mon Sep 17 00:00:00 2001
 From: jikai <jikai11@huawei.com>
 Date: Thu, 6 Jun 2024 02:13:36 +0000
 Subject: [PATCH 106/108] Revert "use isula_clean_path rather than realpath"
 This reverts commit 60a2b15e0090018b7850b37369964bf62e253419.
 Signed-off-by: jikai <jikai11@huawei.com>
 ---
 src/cmd/isulad-shim/process.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/src/cmd/isulad-shim/process.c b/src/cmd/isulad-shim/process.c
 index dd41c77f..18fae03f 100644
 --- a/src/cmd/isulad-shim/process.c
 +++ b/src/cmd/isulad-shim/process.c
@@ -489,7 +489,7 @@ static bool attach_fifopath_security_check(process_t *p, const char *fifopath)
         return false;
     }
 -    if (isula_clean_path(fifopath, real_path, sizeof(real_path)) == NULL) {
 +    if (realpath(fifopath, real_path) == NULL) {
         ERROR("Failed to get realpath for '%s': %d.", real_path, SHIM_SYS_ERR(errno));
         return false;
     }
 -- 
 2.25.1
--- a/0107-bugfix-for-start-sandbox-before-setup-network-by-def.patch
+++ b/0107-bugfix-for-start-sandbox-before-setup-network-by-def.patch
@ -0,0 +1,28 @@
 From 63f4f9bc9c36825d85a14f6a33102194d30e12a7 Mon Sep 17 00:00:00 2001
 From: zhongtao <zhongtao17@huawei.com>
 Date: Fri, 7 Jun 2024 02:24:49 +1400
 Subject: [PATCH 107/108] bugfix for start sandbox before setup network by
 default
 Signed-off-by: zhongtao <zhongtao17@huawei.com>
 ---
 .../entry/cri/v1alpha/cri_pod_sandbox_manager_service.cc       | 3 +++
 1 file changed, 3 insertions(+)
 diff --git a/src/daemon/entry/cri/v1alpha/cri_pod_sandbox_manager_service.cc b/src/daemon/entry/cri/v1alpha/cri_pod_sandbox_manager_service.cc
 index f852f4df..bc3f4031 100644
 --- a/src/daemon/entry/cri/v1alpha/cri_pod_sandbox_manager_service.cc
 +++ b/src/daemon/entry/cri/v1alpha/cri_pod_sandbox_manager_service.cc
@@ -677,6 +677,9 @@ auto PodSandboxManagerService::RunPodSandbox(const runtime::v1alpha2::PodSandbox
         SetupSandboxNetwork(config, response_id, inspect_data, networkOptions, stdAnnos, network_setting_json, error);
         if (error.NotEmpty()) {
 +            Errors stopError;
 +            StopContainerHelper(response_id, stopError);
 +            WARN("Error stop container: %s: %s", response_id.c_str(), stopError.GetCMessage());
             goto cleanup_ns;
         }
     }
 -- 
 2.25.1
--- a/0108-skip-test-rely-on-docker.io.patch
+++ b/0108-skip-test-rely-on-docker.io.patch
@ -0,0 +1,59 @@
 From d3e7b0b0d19ca4937716d835e3627714157d6cc3 Mon Sep 17 00:00:00 2001
 From: zhongtao <zhongtao17@huawei.com>
 Date: Tue, 11 Jun 2024 17:14:58 +0800
 Subject: [PATCH 108/108] skip test rely on docker.io
 Signed-off-by: zhongtao <zhongtao17@huawei.com>
 ---
 CI/test_cases/image_cases/image_search.sh      | 4 +++-
 CI/test_cases/image_cases/integration_check.sh | 2 +-
 CI/test_cases/image_cases/registry.sh          | 5 +++--
 3 files changed, 7 insertions(+), 4 deletions(-)
 diff --git a/CI/test_cases/image_cases/image_search.sh b/CI/test_cases/image_cases/image_search.sh
 index 11af02f1..4bf0e099 100755
 --- a/CI/test_cases/image_cases/image_search.sh
 +++ b/CI/test_cases/image_cases/image_search.sh
@@ -76,7 +76,9 @@ function test_image_search()
 declare -i ans=0
 -test_image_search || ((ans++))
 +# unable to pull image from docker.io without agent, skip this test
 +# registry API v1 is not implemented in https://3laho3y3.mirror.aliyuncs.com and isula search cannot be tested
 +# test_image_search || ((ans++))
 show_result ${ans} "${curr_path}/${0}"
 diff --git a/CI/test_cases/image_cases/integration_check.sh b/CI/test_cases/image_cases/integration_check.sh
 index 6ec3ab52..f340348d 100755
 --- a/CI/test_cases/image_cases/integration_check.sh
 +++ b/CI/test_cases/image_cases/integration_check.sh
@@ -27,7 +27,7 @@ image="busybox"
 function test_image_info()
 {
   local ret=0
 -  local uimage="docker.io/library/nats"
 +  local uimage="nats"
   local test="list && inspect image info test => (${FUNCNAME[@]})"
   local lid
   local cid
 diff --git a/CI/test_cases/image_cases/registry.sh b/CI/test_cases/image_cases/registry.sh
 index e33983d6..7ea9a0c5 100755
 --- a/CI/test_cases/image_cases/registry.sh
 +++ b/CI/test_cases/image_cases/registry.sh
@@ -74,8 +74,9 @@ function isula_pull()
     isula run --rm -ti busybox echo hello 2>&1 | grep pulling
     [[ $? -ne 0 ]] && msg_err "${FUNCNAME[0]}:${LINENO} - --pull missing failed" && ((ret++))
 -    isula pull docker.io/library/busybox:latest
 -    [[ $? -ne 0 ]] && msg_err "${FUNCNAME[0]}:${LINENO} - --pull docker.io/library/busybox:latest failed" && ((ret++))
 +    # Unable to pull image from docker.io without agent, skip this test
 +    # isula pull docker.io/library/busybox:latest
 +    # [[ $? -ne 0 ]] && msg_err "${FUNCNAME[0]}:${LINENO} - --pull docker.io/library/busybox:latest failed" && ((ret++))
     isula pull 3laho3y3.mirror.aliyuncs.com/library/busybox
     fn_check_eq "$?" "0" "isula pull 3laho3y3.mirror.aliyuncs.com/library/busybox"
 -- 
 2.25.1
--- a/iSulad.spec
+++ b/iSulad.spec
@ -1,5 +1,5 @@
 %global _version 2.1.5
-%global _release 9
+%global _release 10
 %global is_systemd 1
 %global enable_criv1 1
 %global enable_cdi 1
@ -101,6 +101,29 @@ Patch0082:	0082-fix-shim-controller-set-incorrect-sandbox-status-sta.patch
 Patch0083:	0083-fix-bug-for-invalid-env-write.patch
 Patch0084:	0084-trim-key-value-for-env.patch
 Patch0085:	0085-cdi-allow-env-variable-has-an-empty-value.patch
 Patch0086:	0086-cdi-test-case-and-gateway.patch
 Patch0087:	0087-code-improve.patch
 Patch0088:	0088-testcase-close-cdi-testcase.patch
 Patch0089:	0089-docs-update-cni-doc.patch
 Patch0090:	0090-modify-the-user-error-log-to-be-the-same-as-before.patch
 Patch0091:	0091-add-enable-cri-v1-in-k8s-integration.patch
 Patch0092:	0092-isolate-oom-monitor-codes.patch
 Patch0093:	0093-change-fork-process-exit-mode.patch
 Patch0094:	0094-fix-error-log-for-verify_cpu_realtime.patch
 Patch0095:	0095-bugfix-change-max-network-name-len.patch
 Patch0096:	0096-del-useless-info.patch
 Patch0097:	0097-code-improve.patch
 Patch0098:	0098-cdi-add-debug-info.patch
 Patch0099:	0099-bugfix-cni-network-name-UT.patch
 Patch0100:	0100-bugfix-malloc-right-type-size.patch
 Patch0101:	0101-use-isula_clean_path-rather-than-realpath.patch
 Patch0102:	0102-fix-false-engine-rootpath-reference.patch
 Patch0103:	0103-bugfix-add-note.patch
 Patch0104:	0104-bugfix-adapt-network-name-max-len.patch
 Patch0105:	0105-start-sandbox-before-setup-network-by-default.patch
 Patch0106:	0106-Revert-use-isula_clean_path-rather-than-realpath.patch
 Patch0107:	0107-bugfix-for-start-sandbox-before-setup-network-by-def.patch
 Patch0108:	0108-skip-test-rely-on-docker.io.patch
 %ifarch x86_64 aarch64
 Provides:       libhttpclient.so()(64bit)
@ -357,6 +380,12 @@ fi
 %endif
 %changelog
 * Tue Jun 11 2024 zhongtao <zhongtao17@huawei.com> - 2.1.5-10
 - Type: update
 - ID: NA
 - SUG: NA
 - DESC: code improve and bugfix
 * Sat May 11 2024 liuxu <liuxu156@huawei.com> - 2.1.5-9
 - Type: update
 - ID: NA