Amit Barve

I am stuck on this too. Temporary workaround seems to be to use the `DisableGoCliScan=true` (as explained [here](https://github.com/microsoft/component-detection/blob/main/docs/detectors/go.md#fallback-detection-strategy)) but we should definitely update this command to support `-mod=readonly` option.

Here is my understanding of the issue so far (feel free to correct me if I am wrong): The purpose of running `go list -m -json all` is to get...

CC @kevpar & @kiashok.

> https://github.com/containerd/containerd/blob/f5e7fe0cb6286333a597a407029fe7c760626669/core/runtime/v2/manager.go#L221 > > For main branch, v2.0, the sandbox mode won't start shim to get address. It connects to shim and let the hook-on-close empty. It won't call shim...

@mxpv Yeah, that's what I was expecting. I am running containerd 2.0 build without enabling sandboxed shim, so it should be using the regular shim and should generate `shim delete`...

I investigated this a bit more and found out that the older behavior of Containerd issuing `shim delete` commands for all containers (when starting CRI sandboxed containers) was because of...

> I don't think so. Please check out that shim v2 command line design doc. The shim v2 introduces binary delete to ensure resource can be deleted even if shim...

@KyleL1 can you please try building this exact same Dockerfile with Docker Desktop 4.3.2 and let me know if that works? I have hunch about what might be causing this...

Thanks. I will continue investigating and update here if I find anything.

@samuelkarp we originally wanted to have a separate mount manager plugin in containerd that the shim can call to mount the layers, however after some discussion we decided to not...