Containerd 2.5 Adds Default Timeout for Proxy Plugins

containerd 2.5 introduces a default_timeout setting for proxy plugins, assigning a deadline to external plugin calls lacking an explicit caller-set limit. Merged in PR containerd#14187 on main, this addition is scheduled for the January 6 release of version 2.5 and is absent in 2.4.

Previously, a missing deadline allowed a wedged proxy snapshotter—such as soci—to hang indefinitely during garbage collection while holding locks required by other operations. This left affected nodes reporting as Ready while failing to start pods for hours.

Configured per plugin within the containerd configuration file under proxy_plugins, the timeout applies across all ten snapshotter calls. Operators running lazy-pulling snapshotters like soci, stargz, or nydus as proxy plugins face the highest exposure. Selecting a value requires careful calibration to avoid failing slow healthy calls, which will abort once they reach the specified limit.

The design evolved from an initial 17-line fix targeting only the hanging garbage collection call. After 30 review rounds and a subsequent reversion 13 days later, contributor Fu Wei noted that external processes can deadlock on any call, prompting the broader per-plugin default replacement.