Repository Analysis

containerd/containerd

An open and reliable container runtime

1.1 Likely human-written View on GitHub
1.1
Adjusted Score
1.1
Raw Score
100%
Time Factor
2026-05-29
Last Push
20,781
Stars
Go
Language
284,815
Lines of Code
1472
Files
281
Pattern Hits
2026-05-31
Scan Date

Score History

Severity Breakdown

CRITICAL 0HIGH 4MEDIUM 5LOW 272

Pattern Findings

281 matches across 6 categories. Click a row to expand file-level details.

Over-Commented Block271 hits · 271 pts
SeverityFileLineSnippet
LOWcmd/containerd/server/config/config.go61 Version int `toml:"version"`
LOWcmd/containerd/server/config/config.go81 OOMScore int `toml:"oom_score"`
LOWcmd/containerd/server/config/config.go101 // In configs prior to version 4, an unset TTRPC address is derived from
LOWcmd/containerd/server/config/config.go601
LOWcmd/containerd/command/service_windows.go201 if runServiceFlag {
LOWcmd/containerd/command/service_windows.go221 }
LOWcmd/containerd-shim-runc-v2/task/service.go121 lifecycleMu sync.Mutex
LOWcmd/containerd-shim-runc-v2/task/service.go141 shutdown shutdown.Service
LOWcmd/containerd-shim-runc-v2/task/service.go661 for e := range s.ec {
LOWcore/metrics/cgroups/v1/metrics.go81 //
LOWcore/metrics/cgroups/v2/metrics.go61 task common.Statable
LOWcore/metrics/cgroups/v2/metrics.go81 //
LOWcore/snapshots/snapshotter.go141// allocating, snapshotting and mounting filesystem changesets. The model works
LOWcore/snapshots/snapshotter.go161//
LOWcore/snapshots/snapshotter.go181// unpack it to:
LOWcore/snapshots/snapshotter.go201// Once the mounts are performed, our temporary location is ready to capture
LOWcore/snapshots/snapshotter.go221// digest, but in practice, this will probably be the ChainID. This also removes
LOWcore/snapshots/snapshotter.go241//
LOWcore/snapshots/snapshotter.go261 // the kind of snapshot.
LOWcore/snapshots/snapshotter.go281 // available only for active snapshots.
LOWcore/snapshots/snapshotter.go301
LOWcore/snapshots/snapshotter.go321 // A committed snapshot will be created under name with the parent of the
LOWcore/snapshots/snapshotter.go341 // kind (active,view,committed)
LOWcore/snapshots/testsuite/issues.go241 return err
LOWcore/snapshots/testsuite/issues.go261// See https://github.com/docker/docker/issues/19082
LOWcore/images/handlers.go141
LOWcore/images/image.go141//
LOWcore/runtime/v2/socket_windows.go21// terminator gives 107 usable characters. The socket path passed to
LOWcore/runtime/v2/socket_unix.go21// maxSocketDirLen is the maximum length of the socket directory path.
LOWcore/runtime/v2/shim.go201 Delete(ctx context.Context) error
LOWcore/runtime/v2/shim.go341 // If grpc.WithBlock is specified in gopts this causes the connection to block waiting for
LOWcore/runtime/v2/shim.go561 //
LOWcore/runtime/v2/socket_linux.go21// null terminator gives 107 usable characters. The socket path passed
LOWcore/transfer/image/imagestore.go61type Reference struct {
LOWcore/transfer/local/transfer.go181 // overhead but use more memory. When ConcurrentLayerFetchBuffer is above
LOWcore/content/content.go21 "io"
LOWcore/content/content.go61}
LOWcore/remotes/handlers.go61// fetch and push operations for the same descriptor. The key is derived from
LOWcore/remotes/docker/registry.go21 "errors"
LOWcore/remotes/docker/registry.go41// | Public Registry | yes | yes | yes |
LOWcore/remotes/docker/resolver.go41 "github.com/containerd/containerd/v2/core/transfer"
LOWcore/remotes/docker/resolver.go61 // design puts large metadata in subobjects, as is consistent the
LOWcore/remotes/docker/resolver.go81
LOWcore/remotes/docker/resolver.go101 // mechanism for getting blob upload status is expensive.
LOWcore/remotes/docker/fetcher.go61}
LOWcore/remotes/docker/fetcher.go81// garbage collection pressure in sustained I/O scenarios.
LOWcore/remotes/docker/config/hosts.go341 // - pull
LOWcore/remotes/docker/config/hosts_resolver_test.go61// The hosts.toml has a server and mirror.
LOWcore/remotes/docker/auth/parse.go61 isToken octetType = 1 << iota
LOWcore/mount/manager.go41// Handler is an interface for plugins to perform a mount which is managed
LOWcore/mount/manager.go61// to view a filesystem or preparing a filesystem for a container that may
LOWcore/containers/containers.go41 // Image specifies the image reference used for a container.
LOWcore/metadata/gc.go81 // the parent object or requiring the parent already exists.
LOWcore/metadata/gc.go121// CollectionContext manages a resource collection during a single run of
LOWcore/metadata/db.go41
LOWcore/metadata/db.go81// image, container, namespace, snapshot, and content data
LOWcore/metadata/db.go301// mutations has been performed.
LOWcore/metadata/db_test.go641
LOWcore/metadata/content.go41
LOWcore/metadata/buckets.go21//
211 more matches not shown…
Cross-File Repetition3 hits · 15 pts
SeverityFileLineSnippet
HIGHreleases/v2.3.0.toml0\ ### which file should i download? * `containerd-<version>-<os>-<arch>.tar.gz`: ✅recommended. dynamically linked with g
HIGHreleases/v2.1.0.toml0\ ### which file should i download? * `containerd-<version>-<os>-<arch>.tar.gz`: ✅recommended. dynamically linked with g
HIGHreleases/v2.2.0.toml0\ ### which file should i download? * `containerd-<version>-<os>-<arch>.tar.gz`: ✅recommended. dynamically linked with g
AI Slop Vocabulary4 hits · 10 pts
SeverityFileLineSnippet
MEDIUMcore/remotes/docker/resolver.go361 // more robust, we mostly get this information from a secure trust store.
MEDIUMtest/init-buildx.sh81# Ensure we use a builder that can leverage it (the default on linux will not)
MEDIUMinternal/cri/opts/spec_windows.go89 // Essentially this means firstArgFromImg should be true iff:
LOWcontrib/gce/configure.sh23 # found python2, just use that
Synthetic Comment Markers1 hit · 8 pts
SeverityFileLineSnippet
HIGHCONTRIBUTING.md28## Automated and AI-generated contributions
Decorative Section Separators1 hit · 3 pts
SeverityFileLineSnippet
MEDIUMcore/metadata/buckets.go137// └─────ingests
Self-Referential Comments1 hit · 3 pts
SeverityFileLineSnippet
MEDIUMscript/test/utils.sh277 # Create the containerd ROOT dir and set full access to be inherited for "CREATOR OWNER"