Dockerfile の STOPSIGNAL のハンドリング

var killCommand = &cli.Command{
	Name:      "kill",
(snip)
	Action: func(cliContext *cli.Context) error {
		id := cliContext.Args().First()
(snip)
		} else {
			sig, err = containerd.GetStopSignal(ctx, container, sig)
			if err != nil {
				return err
			}
		}
		task, err := container.Task(ctx, nil)
		if err != nil {
			return err
		}
		err = RemoveCniNetworkIfExist(ctx, container)
		if err != nil {
			return err
		}
		return task.Kill(ctx, sig, opts...)

// GetStopSignal retrieves the container stop signal, specified by the
// well-known containerd label (StopSignalLabel)
func GetStopSignal(ctx context.Context, container Container, defaultSignal syscall.Signal) (syscall.Signal, error) {
	labels, err := container.Labels(ctx)
	if err != nil {
		return -1, err
	}

	if stopSignal, ok := labels[StopSignalLabel]; ok {
		return signal.ParseSignal(stopSignal)
	}

	return defaultSignal, nil
}

// WithImageStopSignal sets a well-known containerd label (StopSignalLabel)
// on the container for storing the stop signal specified in the OCI image
// config
func WithImageStopSignal(image Image, defaultSignal string) NewContainerOpts {
	return func(ctx context.Context, _ *Client, c *containers.Container) error {
		if c.Labels == nil {
			c.Labels = make(map[string]string)
		}
		stopSignal, err := GetOCIStopSignal(ctx, image, defaultSignal)
		if err != nil {
			return err
		}
		c.Labels[StopSignalLabel] = stopSignal
		return nil
	}
}

// GetOCIStopSignal retrieves the stop signal specified in the OCI image config
func GetOCIStopSignal(ctx context.Context, image Image, defaultSignal string) (string, error) {
	_, err := signal.ParseSignal(defaultSignal)
	if err != nil {
		return "", err
	}
	ic, err := image.Config(ctx)
	if err != nil {
		return "", err
	}
	if !images.IsConfigType(ic.MediaType) {
		return "", fmt.Errorf("unknown image config media type %s", ic.MediaType)
	}

	var (
		ociimage v1.Image
		config   v1.ImageConfig
	)
	p, err := content.ReadBlob(ctx, image.ContentStore(), ic)
	if err != nil {
		return "", err
	}

	if err = json.Unmarshal(p, &ociimage); err != nil {
		return "", err
	}
	config = ociimage.Config

	if config.StopSignal == "" {
		return defaultSignal, nil
	}

	return config.StopSignal, nil
}

func NewContainer(ctx context.Context, client *containerd.Client, cliContext *cli.Context) (containerd.Container, error) {
	var (
		id     string
		config = cliContext.IsSet("config")
	)
(snip)
		if cliContext.Bool("rootfs") {
			rootfs, err := filepath.Abs(ref)
			if err != nil {
				return nil, err
			}
			opts = append(opts, oci.WithRootFSPath(rootfs))
			cOpts = append(cOpts, containerd.WithContainerLabels(commands.LabelArgs(cliContext.StringSlice("label"))))
		} else {
(snip)
			cOpts = append(cOpts, containerd.WithImageStopSignal(image, "SIGTERM"))
		}
(snip)
	cOpts = append(cOpts, spec)

	// oci.WithImageConfig (WithUsername, WithUserID) depends on access to rootfs for resolving via
	// the /etc/{passwd,group} files. So cOpts needs to have precedence over opts.
	return client.NewContainer(ctx, id, cOpts...)
}