adaptation: avoid holding lock across runtime update callback

[ningmingxiao]

fix containerd/containerd#13733

[Copilot]

Pull request overview

This PR aims to address the deadlock reported in containerd/containerd#13733 by adjusting lock behavior in the NRI runtime adaptation, introducing an optional external mutex intended to control lock ordering between the runtime and the adaptation layer.

Changes:

• Added adaptMu to Adaptation and a new option WithAdaptLock to configure an external mutex.
• Updated updateContainers to acquire the optional external mutex before acquiring the internal Adaptation mutex.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[fuweid]

@ningmingxiao could you please update the git commit message with new title and this information? Thanks

  updateContainers currently holds the Adaptation mutex while calling the
  runtime-provided updateFn. containerd's updateFn acquires its local NRI
  mutex, while CRI lifecycle paths acquire the same locks in the opposite
  order:

      lifecycle: local mutex -> Adaptation mutex
      update:    Adaptation mutex -> local mutex

  Concurrent lifecycle and plugin-initiated update requests can therefore
  deadlock.

  updateContainers does not access mutable Adaptation state. Invoke updateFn
  without holding the Adaptation mutex and leave synchronization of
  runtime-owned state to the runtime.

  Fixes https://github.com/containerd/containerd/issues/13733

[ningmingxiao]

@fuweid done thanks

[fuweid]

LGTM

Thanks

[mikebrow]

LGTM