k3s: fix pause image reference for containerd v2

K3s's default pause image reference "rancher/mirrored-pause:3.6" is a
short name that containerd v1 auto-expanded to the fully qualified
"docker.io/rancher/mirrored-pause:3.6". The k3s v1.36 uprev moved to
containerd v2, which uses a new CRI plugin (io.containerd.cri.v1) with
a pinned_images config instead of the old sandbox_image. Containerd v2
no longer auto-expands short names when looking up pinned images,
causing every pod sandbox creation to fail with "image not found" even
though the image is present in the containerd image store under its
fully qualified name.

Pass --pause-image docker.io/rancher/mirrored-pause:3.6 in both the
server and agent systemd service files to use the fully qualified
reference that containerd v2 can resolve.

Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>

3 files changed, 15 insertions, 5 deletions

diff --git a/recipes-containers/k3s/k3s/k3s-agent.service b/recipes-containers/k3s/k3s/k3s-agent.service
index 0304d640..4962555c 100644
--- a/recipes-containers/k3s/k3s/k3s-agent.service
+++ b/recipes-containers/k3s/k3s/k3s-agent.service
@@ -31,6 +31,8 @@ ExecStartPre=-/sbin/modprobe overlay
 # controller populates this after joining, but the CNI plugin needs
 # the file to exist at sandbox creation time
 ExecStartPre=/bin/sh -c 'mkdir -p /run/flannel && test -f /run/flannel/subnet.env || echo "FLANNEL_NETWORK=10.42.0.0/16\nFLANNEL_SUBNET=10.42.0.1/24\nFLANNEL_MTU=1450\nFLANNEL_IPMASQ=true" > /run/flannel/subnet.env'
-ExecStart=/usr/local/bin/k3s agent
+# Containerd v2's CRI plugin requires the fully qualified image reference
+# for the sandbox (pause) image. See k3s.service for details.
+ExecStart=/usr/local/bin/k3s agent --pause-image docker.io/rancher/mirrored-pause:3.6
 ExecStopPost=/usr/local/bin/k3s-clean
 
diff --git a/recipes-containers/k3s/k3s/k3s.service b/recipes-containers/k3s/k3s/k3s.service
index e7402867..5e823260 100644
--- a/recipes-containers/k3s/k3s/k3s.service
+++ b/recipes-containers/k3s/k3s/k3s.service
@@ -34,7 +34,10 @@ ExecStartPre=-/sbin/modprobe overlay
 # Create flannel subnet.env if not present — k3s's embedded flannel
 # controller expects this file for CNI plugin configuration
 ExecStartPre=/bin/sh -c 'mkdir -p /run/flannel && test -f /run/flannel/subnet.env || echo "FLANNEL_NETWORK=10.42.0.0/16\nFLANNEL_SUBNET=10.42.0.1/24\nFLANNEL_MTU=1450\nFLANNEL_IPMASQ=true" > /run/flannel/subnet.env'
-ExecStart=/usr/local/bin/k3s server
+# Containerd v2's CRI plugin requires the fully qualified image reference
+# for the sandbox (pause) image. The k3s default "rancher/mirrored-pause:3.6"
+# is a short name that containerd v2 cannot resolve from its image store.
+ExecStart=/usr/local/bin/k3s server --pause-image docker.io/rancher/mirrored-pause:3.6
 # Avoid any delay due to this service when the system is rebooting or shutting
 # down by using the k3s-killall.sh script to kill all of the running k3s
 # services and containers
diff --git a/tests/test_k3s_runtime.py b/tests/test_k3s_runtime.py
index 662bdf4c..d26b9164 100644
--- a/tests/test_k3s_runtime.py
+++ b/tests/test_k3s_runtime.py
@@ -419,9 +419,13 @@ def k3s_multinode(request, poky_dir, build_dir, machine, k3s_image):
 
     rootfs_orig = ext4_files[-1]
 
-    # Create a copy of the rootfs for the agent VM — two VMs can't
-    # share the same ext4 file read-write
+    # Both VMs need their own rootfs copy — the original may still be
+    # locked by a previous runqemu session (single-node test), and two
+    # VMs can't share the same ext4 file read-write.
+    rootfs_server = Path(f"/tmp/k3s-server-rootfs-{os.getpid()}.ext4")
     rootfs_agent = Path(f"/tmp/k3s-agent-rootfs-{os.getpid()}.ext4")
+    print(f"Copying rootfs for server VM: {rootfs_orig} -> {rootfs_server}")
+    shutil.copy2(rootfs_orig, rootfs_server)
     print(f"Copying rootfs for agent VM: {rootfs_orig} -> {rootfs_agent}")
     shutil.copy2(rootfs_orig, rootfs_agent)
 
@@ -438,7 +442,7 @@ def k3s_multinode(request, poky_dir, build_dir, machine, k3s_image):
                        use_kvm=use_kvm, timeout=timeout,
                        extra_qemu_params=server_params,
                        use_runqemu=False,
-                       rootfs_path=rootfs_orig,
+                       rootfs_path=rootfs_server,
                        kernel_append="k3s.role=server k3s.node-ip=192.168.50.1",
                        log_suffix="-server")
 
@@ -454,6 +458,7 @@ def k3s_multinode(request, poky_dir, build_dir, machine, k3s_image):
                       rootfs_path=rootfs_agent,
                       kernel_append="k3s.role=agent k3s.node-ip=192.168.50.2 k3s.node-name=k3s-agent",
                       log_suffix="-agent")
+    server._rootfs_copy = str(rootfs_server)
     agent._rootfs_copy = str(rootfs_agent)
 
     try: