Merge pull request #5110 from kolyshkin/1.4-backports

AkihiroSuda · web-flow · commit e430416b62b3 · 2026-02-11T14:40:36.000+09:00
[1.4] assorted small backports
diff --git a/.cirrus.yml b/.cirrus.yml
@@ -11,8 +11,8 @@ task:
   env:
     HOME: /root
     CIRRUS_WORKING_DIR: /home/runc
-    GO_VER_PREFIX: "1.24."
-    BATS_VERSION: "v1.11.1"
+    GO_VER_PREFIX: "1.25."
+    BATS_VERSION: "v1.12.0"
     RPMS: gcc git-core iptables jq glibc-static libseccomp-devel make criu fuse-sshfs container-selinux
     # yamllint disable rule:key-duplicates
     matrix:
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
@@ -108,7 +108,7 @@ jobs:
     - name: Setup Bats and bats libs
       uses: bats-core/bats-action@3.0.1
       with:
-        bats-version: 1.11.1 # Known as BATS_VERSION in other places.
+        bats-version: 1.12.0 # Known as BATS_VERSION in other places.
         support-install: false
         assert-install: false
         detik-install: false
diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml
@@ -114,9 +114,9 @@ jobs:
       - uses: actions/checkout@v5
       - name: install shellcheck
         env:
-          VERSION: v0.10.0
+          VERSION: v0.11.0
           BASEURL: https://github.com/koalaman/shellcheck/releases/download
-          SHA256: f35ae15a4677945428bdfe61ccc297490d89dd1e544cc06317102637638c6deb
+          SHA256: 4da528ddb3a4d1b7b24a59d4e16eb2f5fd960f4bd9a3708a15baddbdf1d5a55b
         run: |
           mkdir ~/bin
           curl -sSfL --retry 5 $BASEURL/$VERSION/shellcheck-$VERSION.linux.x86_64.tar.xz |
diff --git a/.golangci.yml b/.golangci.yml
@@ -7,6 +7,9 @@ run:
 formatters:
   enable:
     - gofumpt
+  settings:
+    gofumpt:
+      extra-rules: true
 
 linters:
   enable:
diff --git a/Dockerfile b/Dockerfile
@@ -1,6 +1,6 @@
-ARG GO_VERSION=1.24
-ARG BATS_VERSION=v1.11.1
-ARG LIBSECCOMP_VERSION=2.5.6
+ARG GO_VERSION=1.25
+ARG BATS_VERSION=v1.12.0
+ARG LIBSECCOMP_VERSION=2.6.0
 
 FROM golang:${GO_VERSION}-bookworm
 ARG DEBIAN_FRONTEND=noninteractive
diff --git a/go.mod b/go.mod
@@ -23,7 +23,7 @@ require (
 	github.com/vishvananda/netlink v1.3.1
 	github.com/vishvananda/netns v0.0.5
 	golang.org/x/net v0.43.0
-	golang.org/x/sys v0.37.0
+	golang.org/x/sys v0.38.0
 	google.golang.org/protobuf v1.36.8
 )
 
diff --git a/go.sum b/go.sum
@@ -87,8 +87,8 @@ golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.10.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.37.0 h1:fdNQudmxPjkdUTPnLn5mdQv7Zwvbvpaxqs831goi9kQ=
-golang.org/x/sys v0.37.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/sys v0.38.0 h1:3yZWxaJjBmCWXqhN1qh02AkOnCQ1poK6oF+a7xWL6Gc=
+golang.org/x/sys v0.38.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
 google.golang.org/protobuf v1.36.8 h1:xHScyCOEuuwZEc6UtSOvPbAT4zRh0xcNRYekJwfqyMc=
 google.golang.org/protobuf v1.36.8/go.mod h1:fuxRtAxBytpl4zzqUh6/eyUujkJdNiuEkXntxiD/uRU=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
diff --git a/internal/linux/linux.go b/internal/linux/linux.go
@@ -2,7 +2,6 @@ package linux
 
 import (
 	"os"
-	"unsafe"
 
 	"golang.org/x/sys/unix"
 )
@@ -16,7 +15,7 @@ func Dup3(oldfd, newfd, flags int) error {
 }
 
 // Exec wraps [unix.Exec].
-func Exec(cmd string, args []string, env []string) error {
+func Exec(cmd string, args, env []string) error {
 	err := retryOnEINTR(func() error {
 		return unix.Exec(cmd, args, env)
 	})
@@ -75,13 +74,9 @@ func Sendmsg(fd int, p, oob []byte, to unix.Sockaddr, flags int) error {
 }
 
 // SetMempolicy wraps set_mempolicy.
-func SetMempolicy(mode uint, mask *unix.CPUSet) error {
+func SetMempolicy(mode int, mask *unix.CPUSet) error {
 	err := retryOnEINTR(func() error {
-		_, _, errno := unix.Syscall(unix.SYS_SET_MEMPOLICY, uintptr(mode), uintptr(unsafe.Pointer(mask)), unsafe.Sizeof(*mask)*8)
-		if errno != 0 {
-			return errno
-		}
-		return nil
+		return unix.SetMemPolicy(mode, mask)
 	})
 	return os.NewSyscallError("set_mempolicy", err)
 }
diff --git a/libcontainer/configs/memorypolicy.go b/libcontainer/configs/memorypolicy.go
@@ -3,29 +3,31 @@ package configs
 import "golang.org/x/sys/unix"
 
 // Memory policy modes and flags as defined in /usr/include/linux/mempolicy.h
-
+//
+// Deprecated: use constants from [unix] instead.
+//
 //nolint:revive,staticcheck,nolintlint // ignore ALL_CAPS errors in consts from numaif.h, will match unix.* in the future
 const (
-	MPOL_DEFAULT             = 0
-	MPOL_PREFERRED           = 1
-	MPOL_BIND                = 2
-	MPOL_INTERLEAVE          = 3
-	MPOL_LOCAL               = 4
-	MPOL_PREFERRED_MANY      = 5
-	MPOL_WEIGHTED_INTERLEAVE = 6
+	MPOL_DEFAULT             = unix.MPOL_DEFAULT
+	MPOL_PREFERRED           = unix.MPOL_PREFERRED
+	MPOL_BIND                = unix.MPOL_BIND
+	MPOL_INTERLEAVE          = unix.MPOL_INTERLEAVE
+	MPOL_LOCAL               = unix.MPOL_LOCAL
+	MPOL_PREFERRED_MANY      = unix.MPOL_PREFERRED_MANY
+	MPOL_WEIGHTED_INTERLEAVE = unix.MPOL_WEIGHTED_INTERLEAVE
 
-	MPOL_F_STATIC_NODES   = 1 << 15
-	MPOL_F_RELATIVE_NODES = 1 << 14
-	MPOL_F_NUMA_BALANCING = 1 << 13
+	MPOL_F_STATIC_NODES   = unix.MPOL_F_STATIC_NODES
+	MPOL_F_RELATIVE_NODES = unix.MPOL_F_RELATIVE_NODES
+	MPOL_F_NUMA_BALANCING = unix.MPOL_F_NUMA_BALANCING
 )
 
 // LinuxMemoryPolicy contains memory policy configuration.
 type LinuxMemoryPolicy struct {
 	// Mode specifies memory policy mode without mode flags. See
 	// set_mempolicy() documentation for details.
-	Mode uint `json:"mode,omitempty"`
+	Mode int `json:"mode,omitempty"`
 	// Flags contains mode flags.
-	Flags uint `json:"flags,omitempty"`
+	Flags int `json:"flags,omitempty"`
 	// Nodes contains NUMA nodes to which the mode applies.
 	Nodes *unix.CPUSet `json:"nodes,omitempty"`
 }
diff --git a/libcontainer/configs/validate/validator.go b/libcontainer/configs/validate/validator.go
@@ -490,16 +490,16 @@ func memoryPolicy(config *configs.Config) error {
 		return nil
 	}
 	switch mpol.Mode {
-	case configs.MPOL_DEFAULT, configs.MPOL_LOCAL:
+	case unix.MPOL_DEFAULT, unix.MPOL_LOCAL:
 		if mpol.Nodes != nil && mpol.Nodes.Count() != 0 {
 			return fmt.Errorf("memory policy mode requires 0 nodes but got %d", mpol.Nodes.Count())
 		}
-	case configs.MPOL_BIND, configs.MPOL_INTERLEAVE,
-		configs.MPOL_PREFERRED_MANY, configs.MPOL_WEIGHTED_INTERLEAVE:
+	case unix.MPOL_BIND, unix.MPOL_INTERLEAVE,
+		unix.MPOL_PREFERRED_MANY, unix.MPOL_WEIGHTED_INTERLEAVE:
 		if mpol.Nodes == nil || mpol.Nodes.Count() == 0 {
 			return fmt.Errorf("memory policy mode requires at least one node but got 0")
 		}
-	case configs.MPOL_PREFERRED:
+	case unix.MPOL_PREFERRED:
 		// Zero or more nodes are allowed by the kernel.
 	default:
 		return fmt.Errorf("invalid memory policy mode: %d", mpol.Mode)
diff --git a/libcontainer/criu_linux.go b/libcontainer/criu_linux.go
@@ -79,7 +79,7 @@ func (c *Container) checkCriuFeatures(criuOpts *CriuOpts, criuFeat *criurpc.Criu
 	return nil
 }
 
-func compareCriuVersion(criuVersion int, minVersion int) error {
+func compareCriuVersion(criuVersion, minVersion int) error {
 	// simple function to perform the actual version compare
 	if criuVersion < minVersion {
 		return fmt.Errorf("CRIU version %d must be %d or higher", criuVersion, minVersion)
diff --git a/libcontainer/integration/exec_test.go b/libcontainer/integration/exec_test.go
@@ -435,7 +435,7 @@ func TestFreeze(t *testing.T) {
 	}
 }
 
-func testFreeze(t *testing.T, withSystemd bool, useSet bool) {
+func testFreeze(t *testing.T, withSystemd, useSet bool) {
 	if testing.Short() {
 		return
 	}
diff --git a/libcontainer/intelrdt/cmt_test.go b/libcontainer/intelrdt/cmt_test.go
@@ -35,7 +35,7 @@ func TestGetCMTNumaNodeStats(t *testing.T) {
 	})
 }
 
-func checkCMTStatCorrection(got CMTNumaNodeStats, expected CMTNumaNodeStats, t *testing.T) {
+func checkCMTStatCorrection(got, expected CMTNumaNodeStats, t *testing.T) {
 	if got.LLCOccupancy != expected.LLCOccupancy {
 		t.Fatalf("Wrong value of `llc_occupancy`. Expected: %v but got: %v",
 			expected.LLCOccupancy,
diff --git a/libcontainer/intelrdt/intelrdt.go b/libcontainer/intelrdt/intelrdt.go
@@ -156,7 +156,7 @@ type Manager struct {
 // NewManager returns a new instance of Manager, or nil if the Intel RDT
 // functionality is not specified in the config, available from hardware or
 // enabled in the kernel.
-func NewManager(config *configs.Config, id string, path string) *Manager {
+func NewManager(config *configs.Config, id, path string) *Manager {
 	if config.IntelRdt == nil {
 		return nil
 	}
@@ -184,7 +184,7 @@ func NewManager(config *configs.Config, id string, path string) *Manager {
 
 // newManager is the same as NewManager, except it does not check if the feature
 // is actually available. Used by unit tests that mock intelrdt paths.
-func newManager(config *configs.Config, id string, path string) *Manager {
+func newManager(config *configs.Config, id, path string) *Manager {
 	return &Manager{
 		config: config,
 		id:     id,
diff --git a/libcontainer/intelrdt/mbm_test.go b/libcontainer/intelrdt/mbm_test.go
@@ -38,7 +38,7 @@ func TestGetMBMNumaNodeStats(t *testing.T) {
 	})
 }
 
-func checkMBMStatCorrection(got MBMNumaNodeStats, expected MBMNumaNodeStats, t *testing.T) {
+func checkMBMStatCorrection(got, expected MBMNumaNodeStats, t *testing.T) {
 	if got.MBMTotalBytes != expected.MBMTotalBytes {
 		t.Fatalf("Wrong value of mbm_total_bytes. Expected: %v but got: %v",
 			expected.MBMTotalBytes,
diff --git a/libcontainer/internal/userns/userns_maps_linux.go b/libcontainer/internal/userns/userns_maps_linux.go
@@ -39,7 +39,7 @@ func parseIdmapData(data []byte) (ms []configs.IDMap, err error) {
 // Do something equivalent to nsenter --user=<nsPath> cat <path>, but more
 // efficiently. Returns the contents of the requested file from within the user
 // namespace.
-func spawnUserNamespaceCat(nsPath string, path string) ([]byte, error) {
+func spawnUserNamespaceCat(nsPath, path string) ([]byte, error) {
 	rdr, wtr, err := os.Pipe()
 	if err != nil {
 		return nil, fmt.Errorf("create pipe for userns spawn failed: %w", err)
diff --git a/libcontainer/logs/logs_linux_test.go b/libcontainer/logs/logs_linux_test.go
@@ -142,7 +142,7 @@ func check(t *testing.T, l *log, txt, notxt string) {
 
 // checkWait is like check, but if the file is empty,
 // it waits until it's not.
-func checkWait(t *testing.T, l *log, txt string, notxt string) {
+func checkWait(t *testing.T, l *log, txt, notxt string) {
 	t.Helper()
 	const (
 		delay = 100 * time.Millisecond
diff --git a/libcontainer/network_linux.go b/libcontainer/network_linux.go
@@ -110,7 +110,7 @@ func (l *loopback) detach(n *configs.Network) (err error) {
 // The device name will be kept the same if device.Name is the zero value.
 // This function ensures that the move and rename operations occur atomically.
 // It preserves existing interface attributes, including global IP addresses.
-func devChangeNetNamespace(name string, nsPath string, device configs.LinuxNetDevice) error {
+func devChangeNetNamespace(name, nsPath string, device configs.LinuxNetDevice) error {
 	logrus.Debugf("attaching network device %s with attrs %+v to network namespace %s", name, device, nsPath)
 	link, err := netlink.LinkByName(name)
 	// recover same behavior on vishvananda/netlink@1.2.1 and do not fail when the kernel returns NLM_F_DUMP_INTR.
diff --git a/libcontainer/notify_linux.go b/libcontainer/notify_linux.go
@@ -17,7 +17,7 @@ const (
 	CriticalPressure
 )
 
-func registerMemoryEvent(cgDir string, evName string, arg string) (<-chan struct{}, error) {
+func registerMemoryEvent(cgDir, evName, arg string) (<-chan struct{}, error) {
 	evFile, err := os.Open(filepath.Join(cgDir, evName))
 	if err != nil {
 		return nil, err
diff --git a/libcontainer/nsenter/nsenter_test.go b/libcontainer/nsenter/nsenter_test.go
@@ -187,7 +187,7 @@ func init() {
 	}
 }
 
-func newPipe(t *testing.T) (parent *os.File, child *os.File) {
+func newPipe(t *testing.T) (parent, child *os.File) {
 	t.Helper()
 	fds, err := unix.Socketpair(unix.AF_LOCAL, unix.SOCK_STREAM|unix.SOCK_CLOEXEC, 0)
 	if err != nil {
diff --git a/libcontainer/rootfs_linux.go b/libcontainer/rootfs_linux.go
@@ -1403,7 +1403,7 @@ func reopenAfterMount(rootfs string, f *os.File, flags int) (_ *os.File, Err err
 
 // Do the mount operation followed by additional mounts required to take care
 // of propagation flags. This will always be scoped inside the container rootfs.
-func (m *mountEntry) mountPropagate(rootfs string, mountLabel string) error {
+func (m *mountEntry) mountPropagate(rootfs, mountLabel string) error {
 	var (
 		data  = label.FormatMountLabel(m.Data, mountLabel)
 		flags = m.Flags
diff --git a/libcontainer/seccomp/patchbpf/enosys_linux_test.go b/libcontainer/seccomp/patchbpf/enosys_linux_test.go
@@ -68,7 +68,7 @@ func mockFilter(t *testing.T, config *configs.Seccomp) (*bpf.VM, []bpf.Instructi
 
 // fakeConfig generates a fake libcontainer seccomp configuration. The syscalls
 // are added with an action distinct from the default action.
-func fakeConfig(defaultAction configs.Action, explicitSyscalls []string, arches []string) *configs.Seccomp {
+func fakeConfig(defaultAction configs.Action, explicitSyscalls, arches []string) *configs.Seccomp {
 	config := configs.Seccomp{
 		DefaultAction: defaultAction,
 		Architectures: arches,
@@ -299,8 +299,8 @@ func TestEnosysStub_SingleArch(t *testing.T) {
 }
 
 func TestEnosysStub_MultiArch(t *testing.T) {
-	for end := 0; end < len(testArches); end++ {
-		for start := 0; start < end; start++ {
+	for end := range len(testArches) {
+		for start := range end {
 			var arches []string
 			for _, arch := range testArches[start:end] {
 				// "native" indicates a blank architecture field for seccomp, to test
diff --git a/libcontainer/specconv/spec_linux.go b/libcontainer/specconv/spec_linux.go
@@ -42,8 +42,8 @@ var (
 		flag  int
 	}
 	complexFlags map[string]func(*configs.Mount)
-	mpolModeMap  map[string]uint
-	mpolModeFMap map[string]uint
+	mpolModeMap  map[string]int
+	mpolModeFMap map[string]int
 )
 
 func initMaps() {
@@ -152,20 +152,20 @@ func initMaps() {
 			},
 		}
 
-		mpolModeMap = map[string]uint{
-			string(specs.MpolDefault):            configs.MPOL_DEFAULT,
-			string(specs.MpolPreferred):          configs.MPOL_PREFERRED,
-			string(specs.MpolBind):               configs.MPOL_BIND,
-			string(specs.MpolInterleave):         configs.MPOL_INTERLEAVE,
-			string(specs.MpolLocal):              configs.MPOL_LOCAL,
-			string(specs.MpolPreferredMany):      configs.MPOL_PREFERRED_MANY,
-			string(specs.MpolWeightedInterleave): configs.MPOL_WEIGHTED_INTERLEAVE,
+		mpolModeMap = map[string]int{
+			string(specs.MpolDefault):            unix.MPOL_DEFAULT,
+			string(specs.MpolPreferred):          unix.MPOL_PREFERRED,
+			string(specs.MpolBind):               unix.MPOL_BIND,
+			string(specs.MpolInterleave):         unix.MPOL_INTERLEAVE,
+			string(specs.MpolLocal):              unix.MPOL_LOCAL,
+			string(specs.MpolPreferredMany):      unix.MPOL_PREFERRED_MANY,
+			string(specs.MpolWeightedInterleave): unix.MPOL_WEIGHTED_INTERLEAVE,
 		}
 
-		mpolModeFMap = map[string]uint{
-			string(specs.MpolFStaticNodes):   configs.MPOL_F_STATIC_NODES,
-			string(specs.MpolFRelativeNodes): configs.MPOL_F_RELATIVE_NODES,
-			string(specs.MpolFNumaBalancing): configs.MPOL_F_NUMA_BALANCING,
+		mpolModeFMap = map[string]int{
+			string(specs.MpolFStaticNodes):   unix.MPOL_F_STATIC_NODES,
+			string(specs.MpolFRelativeNodes): unix.MPOL_F_RELATIVE_NODES,
+			string(specs.MpolFNumaBalancing): unix.MPOL_F_NUMA_BALANCING,
 		}
 	})
 }
diff --git a/libcontainer/utils/cmsg.go b/libcontainer/utils/cmsg.go
@@ -114,7 +114,7 @@ func RecvFile(socket *os.File) (_ *os.File, Err error) {
 // SendFile sends a file over the given AF_UNIX socket. file.Name() is also
 // included so that if the other end uses RecvFile, the file will have the same
 // name information.
-func SendFile(socket *os.File, file *os.File) error {
+func SendFile(socket, file *os.File) error {
 	name := file.Name()
 	if len(name) >= MaxNameLen {
 		return fmt.Errorf("sendfd: filename too long: %s", name)
diff --git a/notify_socket.go b/notify_socket.go
@@ -25,7 +25,7 @@ type notifySocket struct {
 	socketPath string
 }
 
-func newNotifySocket(context *cli.Context, notifySocketHost string, id string) *notifySocket {
+func newNotifySocket(context *cli.Context, notifySocketHost, id string) *notifySocket {
 	if notifySocketHost == "" {
 		return nil
 	}
diff --git a/script/release_build.sh b/script/release_build.sh
@@ -19,7 +19,7 @@ set -e
 ## --->
 # Project-specific options and functions. In *theory* you shouldn't need to
 # touch anything else in this script in order to use this elsewhere.
-: "${LIBSECCOMP_VERSION:=2.5.6}"
+: "${LIBSECCOMP_VERSION:=2.6.0}"
 project="runc"
 root="$(readlink -f "$(dirname "${BASH_SOURCE[0]}")/..")"
 
diff --git a/vendor/golang.org/x/sys/unix/mkerrors.sh b/vendor/golang.org/x/sys/unix/mkerrors.sh
diff --git a/vendor/golang.org/x/sys/unix/syscall_linux.go b/vendor/golang.org/x/sys/unix/syscall_linux.go
diff --git a/vendor/golang.org/x/sys/unix/zerrors_linux.go b/vendor/golang.org/x/sys/unix/zerrors_linux.go
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_linux.go b/vendor/golang.org/x/sys/unix/zsyscall_linux.go
diff --git a/vendor/golang.org/x/sys/unix/ztypes_linux.go b/vendor/golang.org/x/sys/unix/ztypes_linux.go
diff --git a/vendor/golang.org/x/sys/windows/syscall_windows.go b/vendor/golang.org/x/sys/windows/syscall_windows.go
diff --git a/vendor/golang.org/x/sys/windows/types_windows.go b/vendor/golang.org/x/sys/windows/types_windows.go
diff --git a/vendor/golang.org/x/sys/windows/zsyscall_windows.go b/vendor/golang.org/x/sys/windows/zsyscall_windows.go
diff --git a/vendor/modules.txt b/vendor/modules.txt

Original file line number	Diff line number	Diff line change
`@@ -23,7 +23,7 @@ require (`
`23`	`23`	`github.com/vishvananda/netlink v1.3.1`
`24`	`24`	`github.com/vishvananda/netns v0.0.5`
`25`	`25`	`golang.org/x/net v0.43.0`
`26`		`- golang.org/x/sys v0.37.0`
	`26`	`+ golang.org/x/sys v0.38.0`
`27`	`27`	`google.golang.org/protobuf v1.36.8`
`28`	`28`	`)`
`29`	`29`