Fnlb was moved to its own repo: fnproject/lb (#702)

* Fnlb was moved to its own repo: fnproject/lb

* Clean up fnlb leftovers

* Newer deps

vendor/github.com/opencontainers/image-spec/image-layout.md

@@ -1,6 +1,6 @@
 ## OCI Image Layout Specification
 
-* The OCI Image Layout is a slash separated layout of OCI content-addressable blobs and [location-addressable](https://en.wikipedia.org/wiki/Content-addressable_storage#Content-addressed_vs._location-addressed) references (refs).
+* The OCI Image Layout is directory structure for OCI content-addressable blobs and [location-addressable](https://en.wikipedia.org/wiki/Content-addressable_storage#Content-addressed_vs._location-addressed) references (refs).
 * This layout MAY be used in a variety of different transport mechanisms: archive formats (e.g. tar, zip), shared filesystem environments (e.g. nfs), or networked file fetching (e.g. http, ftp, rsync).
 
 Given an image layout and a ref, a tool can create an [OCI Runtime Specification bundle](https://github.com/opencontainers/runtime-spec/blob/v1.0.0/bundle.md) by:

vendor/github.com/opencontainers/image-spec/specs-go/version.go

@@ -22,10 +22,10 @@ const (
 	// VersionMinor is for functionality in a backwards-compatible manner
 	VersionMinor = 0
 	// VersionPatch is for backwards-compatible bug fixes
-	VersionPatch = 0
+	VersionPatch = 1
 
 	// VersionDev indicates development branch. Releases will be empty string.
-	VersionDev = "-dev"
+	VersionDev = ""
 )
 
 // Version is the specification version that the package types support.

vendor/github.com/opencontainers/runc/.gitignore

@@ -1,5 +1,4 @@
 vendor/pkg
 /runc
-contrib/cmd/recvtty/recvtty
+Godeps/_workspace/src/github.com/opencontainers/runc
 man/man8
-release

vendor/github.com/opencontainers/runc/.pullapprove.yml

@@ -1,10 +0,0 @@
-approve_by_comment: true
-approve_regex: ^LGTM
-reject_regex: ^Rejected
-reset_on_push: true
-author_approval: ignored
-reviewers:
-  teams:
-    - runc-maintainers
-  name: default
-  required: 2

vendor/github.com/opencontainers/runc/.travis.yml

@@ -1,33 +0,0 @@
-language: go
-go:
-  - 1.7.x
-  - 1.8.x
-  - tip
-
-matrix:
-  allow_failures:
-    - go: tip
-
-go_import_path: github.com/opencontainers/runc
-
-# `make ci` uses Docker.
-sudo: required
-services:
-  - docker
-
-env:
-  global:
-    - BUILDTAGS="seccomp apparmor selinux ambient"
-
-before_install:
-  - sudo apt-get -qq update
-  - sudo apt-get install -y libseccomp-dev libapparmor-dev
-  - go get -u github.com/golang/lint/golint
-  - go get -u github.com/vbatts/git-validation
-  - go get -u github.com/mvdan/sh/cmd/shfmt
-  - env | grep TRAVIS_
-
-script:
-  - git-validation -run DCO,short-subject -v
-  - make BUILDTAGS="${BUILDTAGS}"
-  - make BUILDTAGS="${BUILDTAGS}" clean ci

vendor/github.com/opencontainers/runc/CONTRIBUTING.md

@@ -1,12 +1,5 @@
 ## Contribution Guidelines
 
-### Security issues
-
-If you are reporting a security issue, do not create an issue or file a pull
-request on GitHub. Instead, disclose the issue responsibly by sending an email
-to security@opencontainers.org (which is inhabited only by the maintainers of
-the various OCI projects).
-
 ### Pull requests are always welcome
 
 We are always thrilled to receive pull requests, and do our best to

vendor/github.com/opencontainers/runc/Dockerfile

@@ -1,60 +1,3 @@
-FROM golang:1.8.0
-
-# libseccomp in jessie is not _quite_ new enough -- need backports version
-RUN echo 'deb http://httpredir.debian.org/debian jessie-backports main' > /etc/apt/sources.list.d/backports.list
-
-RUN apt-get update && apt-get install -y \
-    build-essential \
-    curl \
-    sudo \
-    gawk \
-    iptables \
-    jq \
-    pkg-config \
-    libaio-dev \
-    libcap-dev \
-    libprotobuf-dev \
-    libprotobuf-c0-dev \
-    libnl-3-dev \
-    libnet-dev \
-    libseccomp2/jessie-backports \
-    libseccomp-dev/jessie-backports \
-    protobuf-c-compiler \
-    protobuf-compiler \
-    python-minimal \
-    --no-install-recommends \
-    && apt-get clean
-
-# Add a dummy user for the rootless integration tests. While runC does
-# not require an entry in /etc/passwd to operate, one of the tests uses
-# `git clone` -- and `git clone` does not allow you to clone a
-# repository if the current uid does not have an entry in /etc/passwd.
-RUN useradd -u1000 -m -d/home/rootless -s/bin/bash rootless
-
-# install bats
-RUN cd /tmp \
-    && git clone https://github.com/sstephenson/bats.git \
-    && cd bats \
-    && git reset --hard 03608115df2071fff4eaaff1605768c275e5f81f \
-    && ./install.sh /usr/local \
-    && rm -rf /tmp/bats
-
-# install criu
-ENV CRIU_VERSION 3ca8e575b49763030d3ddfec4af190a4c9f9deef
-RUN mkdir -p /usr/src/criu \
-    && curl -sSL https://github.com/xemul/criu/archive/${CRIU_VERSION}.tar.gz | tar -v -C /usr/src/criu/ -xz --strip-components=1 \
-    && cd /usr/src/criu \
-    && make install-criu \
-    && rm -rf /usr/src/criu
-
-# setup a playground for us to spawn containers in
-ENV ROOTFS /busybox
-RUN mkdir -p ${ROOTFS} \
-    && curl -o- -sSL 'https://github.com/docker-library/busybox/raw/a0558a9006ce0dd6f6ec5d56cfd3f32ebeeb815f/glibc/busybox.tar.xz' | tar xfJC - ${ROOTFS}
-
-
-COPY script/tmpmount /
-WORKDIR /go/src/github.com/opencontainers/runc
-ENTRYPOINT ["/tmpmount"]
-
+FROM runc_test
 ADD . /go/src/github.com/opencontainers/runc
+RUN make

vendor/github.com/opencontainers/runc/Godeps/Godeps.json

@@ -0,0 +1,77 @@
+{
+	"ImportPath": "github.com/opencontainers/runc",
+	"GoVersion": "go1.5.3",
+	"Deps": [
+		{
+			"ImportPath": "github.com/Sirupsen/logrus",
+			"Comment": "v0.7.3-2-g26709e2",
+			"Rev": "26709e2714106fb8ad40b773b711ebce25b78914"
+		},
+		{
+			"ImportPath": "github.com/codegangsta/cli",
+			"Comment": "1.2.0-187-gc31a797",
+			"Rev": "c31a7975863e7810c92e2e288a9ab074f9a88f29"
+		},
+		{
+			"ImportPath": "github.com/coreos/go-systemd/activation",
+			"Comment": "v4",
+			"Rev": "b4a58d95188dd092ae20072bac14cece0e67c388"
+		},
+		{
+			"ImportPath": "github.com/coreos/go-systemd/dbus",
+			"Comment": "v4",
+			"Rev": "b4a58d95188dd092ae20072bac14cece0e67c388"
+		},
+		{
+			"ImportPath": "github.com/coreos/go-systemd/util",
+			"Comment": "v4",
+			"Rev": "b4a58d95188dd092ae20072bac14cece0e67c388"
+		},
+		{
+			"ImportPath": "github.com/docker/docker/pkg/mount",
+			"Comment": "v1.4.1-4831-g0f5c9d3",
+			"Rev": "0f5c9d301b9b1cca66b3ea0f9dec3b5317d3686d"
+		},
+		{
+			"ImportPath": "github.com/docker/docker/pkg/symlink",
+			"Comment": "v1.4.1-4831-g0f5c9d3",
+			"Rev": "0f5c9d301b9b1cca66b3ea0f9dec3b5317d3686d"
+		},
+		{
+			"ImportPath": "github.com/docker/docker/pkg/term",
+			"Comment": "v1.4.1-4831-g0f5c9d3",
+			"Rev": "0f5c9d301b9b1cca66b3ea0f9dec3b5317d3686d"
+		},
+		{
+			"ImportPath": "github.com/docker/go-units",
+			"Comment": "v0.1.0",
+			"Rev": "9b001659dd36225e356b4467c465d732e745f53d"
+		},
+		{
+			"ImportPath": "github.com/godbus/dbus",
+			"Comment": "v3",
+			"Rev": "c7fdd8b5cd55e87b4e1f4e372cdb1db61dd6c66f"
+		},
+		{
+			"ImportPath": "github.com/golang/protobuf/proto",
+			"Rev": "f7137ae6b19afbfd61a94b746fda3b3fe0491874"
+		},
+		{
+			"ImportPath": "github.com/opencontainers/runtime-spec/specs-go",
+			"Comment": "v0.5.0-34-g6e08c69",
+			"Rev": "6e08c6983ef8c2173f10ca09266907d4e9e71716"
+		},
+		{
+			"ImportPath": "github.com/seccomp/libseccomp-golang",
+			"Rev": "1b506fc7c24eec5a3693cdcbed40d9c226cfc6a1"
+		},
+		{
+			"ImportPath": "github.com/syndtr/gocapability/capability",
+			"Rev": "2c00daeb6c3b45114c80ac44119e7b8801fdd852"
+		},
+		{
+			"ImportPath": "github.com/vishvananda/netlink",
+			"Rev": "1e2e08e8a2dcdacaae3f14ac44c5cfa31361f270"
+		}
+	]
+}

vendor/github.com/opencontainers/runc/Godeps/Readme

@@ -0,0 +1,5 @@
+This directory tree is generated automatically by godep.
+
+Please do not edit.
+
+See https://github.com/tools/godep for more information.

vendor/github.com/opencontainers/runc/Godeps/_workspace/.gitignore

@@ -0,0 +1,2 @@
+/pkg
+/bin

vendor/github.com/opencontainers/runc/MAINTAINERS

@@ -2,6 +2,8 @@ Michael Crosby <michael@docker.com> (@crosbymichael)
 Rohit Jnagal <jnagal@google.com> (@rjnagal)
 Victor Marmol <vmarmol@google.com> (@vmarmol)
 Mrunal Patel <mpatel@redhat.com> (@mrunalp)
+Alexander Morozov <lk4d4@docker.com> (@LK4D4)
 Daniel, Dao Quang Minh <dqminh89@gmail.com> (@dqminh)
+Andrey Vagin <avagin@virtuozzo.com> (@avagin)
 Qiang Huang <h.huangqiang@huawei.com> (@hqhq)
 Aleksa Sarai <asarai@suse.de> (@cyphar)

vendor/github.com/opencontainers/runc/Makefile

@@ -1,122 +1,57 @@
-.PHONY: all shell dbuild man \
-	    localtest localunittest localintegration \
-	    test unittest integration
+RUNC_IMAGE=runc_dev
+RUNC_TEST_IMAGE=runc_test
+PROJECT=github.com/opencontainers/runc
+TEST_DOCKERFILE=script/test_Dockerfile
+BUILDTAGS=seccomp
+RUNC_BUILD_PATH=/go/src/github.com/opencontainers/runc/runc
+RUNC_INSTANCE=runc_dev
+COMMIT=$(shell git rev-parse HEAD 2> /dev/null || true)
+RUNC_LINK=$(CURDIR)/Godeps/_workspace/src/github.com/opencontainers/runc
+export GOPATH:=$(CURDIR)/Godeps/_workspace:$(GOPATH)
 
-GO := go
+.PHONY=dbuild
 
-SOURCES := $(shell find . 2>&1 | grep -E '.*\.(c|h|go)$$')
-PREFIX := $(DESTDIR)/usr/local
-BINDIR := $(PREFIX)/sbin
-GIT_BRANCH := $(shell git rev-parse --abbrev-ref HEAD 2>/dev/null)
-GIT_BRANCH_CLEAN := $(shell echo $(GIT_BRANCH) | sed -e "s/[^[:alnum:]]/-/g")
-RUNC_IMAGE := runc_dev$(if $(GIT_BRANCH_CLEAN),:$(GIT_BRANCH_CLEAN))
-PROJECT := github.com/opencontainers/runc
-BUILDTAGS := seccomp
-COMMIT_NO := $(shell git rev-parse HEAD 2> /dev/null || true)
-COMMIT := $(if $(shell git status --porcelain --untracked-files=no),"${COMMIT_NO}-dirty","${COMMIT_NO}")
+all:
+ifneq ($(RUNC_LINK), $(wildcard $(RUNC_LINK)))
+	ln -sfn $(CURDIR) $(RUNC_LINK)
+endif
+	go build -ldflags "-X main.gitCommit=${COMMIT}" -tags "$(BUILDTAGS)" -o runc .
 
-MAN_DIR := $(CURDIR)/man/man8
-MAN_PAGES = $(shell ls $(MAN_DIR)/*.8)
-MAN_PAGES_BASE = $(notdir $(MAN_PAGES))
-MAN_INSTALL_PATH := ${PREFIX}/share/man/man8/
-
-RELEASE_DIR := $(CURDIR)/release
-
-VERSION := ${shell cat ./VERSION}
-
-SHELL := $(shell command -v bash 2>/dev/null)
-
-.DEFAULT: runc
-
-runc: $(SOURCES)
-	$(GO) build -buildmode=pie $(EXTRA_FLAGS) -ldflags "-X main.gitCommit=${COMMIT} -X main.version=${VERSION} $(EXTRA_LDFLAGS)" -tags "$(BUILDTAGS)" -o runc .
-
-all: runc recvtty
-
-recvtty: contrib/cmd/recvtty/recvtty
-
-contrib/cmd/recvtty/recvtty: $(SOURCES)
-	$(GO) build -buildmode=pie $(EXTRA_FLAGS) -ldflags "-X main.gitCommit=${COMMIT} -X main.version=${VERSION} $(EXTRA_LDFLAGS)" -tags "$(BUILDTAGS)" -o contrib/cmd/recvtty/recvtty ./contrib/cmd/recvtty
-
-static: $(SOURCES)
-	CGO_ENABLED=1 $(GO) build $(EXTRA_FLAGS) -tags "$(BUILDTAGS) cgo static_build" -ldflags "-w -extldflags -static -X main.gitCommit=${COMMIT} -X main.version=${VERSION} $(EXTRA_LDFLAGS)" -o runc .
-	CGO_ENABLED=1 $(GO) build $(EXTRA_FLAGS) -tags "$(BUILDTAGS) cgo static_build" -ldflags "-w -extldflags -static -X main.gitCommit=${COMMIT} -X main.version=${VERSION} $(EXTRA_LDFLAGS)" -o contrib/cmd/recvtty/recvtty ./contrib/cmd/recvtty
-
-release:
-	script/release.sh -r release/$(VERSION) -v $(VERSION)
-
-dbuild: runcimage
-	docker run --rm -v $(CURDIR):/go/src/$(PROJECT) --privileged $(RUNC_IMAGE) make clean all
+static:
+	CGO_ENABLED=1 go build -tags "$(BUILDTAGS) cgo static_build" -ldflags "-w -extldflags -static -X main.gitCommit=${COMMIT}" -o runc .
 
 lint:
-	$(GO) vet $(allpackages)
-	$(GO) fmt $(allpackages)
+	go vet ./...
+	go fmt ./...
 
-man:
-	man/md2man-all.sh
+runctestimage:
+	docker build -t $(RUNC_TEST_IMAGE) -f $(TEST_DOCKERFILE) .
 
-runcimage:
+test: runctestimage
+	docker run -e TESTFLAGS -ti --privileged --rm -v $(CURDIR):/go/src/$(PROJECT) $(RUNC_TEST_IMAGE) make localtest
+	tests/sniffTest
+
+localtest: all
+	go test -tags "$(BUILDTAGS)" ${TESTFLAGS} -v ./...
+
+dbuild: runctestimage
 	docker build -t $(RUNC_IMAGE) .
-
-test:
-	make unittest integration rootlessintegration
-
-localtest:
-	make localunittest localintegration localrootlessintegration
-
-unittest: runcimage
-	docker run -e TESTFLAGS -t --privileged --rm -v $(CURDIR):/go/src/$(PROJECT) $(RUNC_IMAGE) make localunittest
-
-localunittest: all
-	$(GO) test -timeout 3m -tags "$(BUILDTAGS)" ${TESTFLAGS} -v $(allpackages)
-
-integration: runcimage
-	docker run -e TESTFLAGS -t --privileged --rm -v $(CURDIR):/go/src/$(PROJECT) $(RUNC_IMAGE) make localintegration
-
-localintegration: all
-	bats -t tests/integration${TESTFLAGS}
-
-rootlessintegration: runcimage
-	docker run -e TESTFLAGS -t --privileged --rm -v $(CURDIR):/go/src/$(PROJECT) --cap-drop=ALL -u rootless $(RUNC_IMAGE) make localintegration
-
-# FIXME: This should not be separate from rootlessintegration's method of running.
-localrootlessintegration: all
-	sudo -u rootless -H PATH="${PATH}" bats -t tests/integration${TESTFLAGS}
-
-shell: all
-	docker run -e TESTFLAGS -ti --privileged --rm -v $(CURDIR):/go/src/$(PROJECT) $(RUNC_IMAGE) bash
+	docker create --name=$(RUNC_INSTANCE) $(RUNC_IMAGE)
+	docker cp $(RUNC_INSTANCE):$(RUNC_BUILD_PATH) .
+	docker rm $(RUNC_INSTANCE)
 
 install:
-	install -D -m0755 runc $(BINDIR)/runc
-
-install-bash:
-	install -D -m0644 contrib/completions/bash/runc $(PREFIX)/share/bash-completion/completions/runc
-
-install-man:
-	install -d -m 755 $(MAN_INSTALL_PATH)
-	install -m 644 $(MAN_PAGES) $(MAN_INSTALL_PATH)
+	install -D -m0755 runc /usr/local/sbin/runc
 
 uninstall:
-	rm -f $(BINDIR)/runc
-
-uninstall-bash:
-	rm -f $(PREFIX)/share/bash-completion/completions/runc
-
-uninstall-man:
-	rm -f $(addprefix $(MAN_INSTALL_PATH),$(MAN_PAGES_BASE))
+	rm -f /usr/local/sbin/runc
 
 clean:
 	rm -f runc
-	rm -f contrib/cmd/recvtty/recvtty
-	rm -rf $(RELEASE_DIR)
-	rm -rf $(MAN_DIR)
+	rm -f $(RUNC_LINK)
 
 validate:
 	script/validate-gofmt
-	$(GO) vet $(allpackages)
+	go vet ./...
 
-ci: validate test release
-
-# memoize allpackages, so that it's executed only once and only if used
-_allpackages = $(shell $(GO) list ./... | grep -v vendor)
-allpackages = $(if $(__allpackages),,$(eval __allpackages := $$(_allpackages)))$(__allpackages)
+ci: validate localtest

vendor/github.com/opencontainers/runc/README.md

@@ -1,244 +1,144 @@
-# runc
+[![Build Status](https://jenkins.dockerproject.org/buildStatus/icon?job=runc Master)](https://jenkins.dockerproject.org/job/runc Master)
 
-[![Build Status](https://travis-ci.org/opencontainers/runc.svg?branch=master)](https://travis-ci.org/opencontainers/runc)
-[![Go Report Card](https://goreportcard.com/badge/github.com/opencontainers/runc)](https://goreportcard.com/report/github.com/opencontainers/runc)
-[![GoDoc](https://godoc.org/github.com/opencontainers/runc?status.svg)](https://godoc.org/github.com/opencontainers/runc)
+## runc
 
-## Introduction
+`runc` is a CLI tool for spawning and running containers according to the OCF specification.
 
-`runc` is a CLI tool for spawning and running containers according to the OCI specification.
+## State of the project
 
-## Releases
+Currently `runc` is an implementation of the OCI specification.  We are currently sprinting
+to have a v1 of the spec out. So the `runc` config format will be constantly changing until
+the spec is finalized. However, we encourage you to try out the tool and give feedback.
 
-`runc` depends on and tracks the [runtime-spec](https://github.com/opencontainers/runtime-spec) repository.
-We will try to make sure that `runc` and the OCI specification major versions stay in lockstep.
-This means that `runc` 1.0.0 should implement the 1.0 version of the specification.
+### OCF
 
-You can find official releases of `runc` on the [release](https://github.com/opencontainers/runc/releases) page.
+How does `runc` integrate with the Open Container Initiative Specification?
+`runc` depends on the types specified in the
+[specs](https://github.com/opencontainers/runtime-spec) repository. Whenever the
+specification is updated and ready to be versioned `runc` will update its dependency
+on the specs repository and support the update spec.
 
-### Security
+### Building:
 
-If you wish to report a security issue, please disclose the issue responsibly
-to security@opencontainers.org.
-
-## Building
-
-`runc` currently supports the Linux platform with various architecture support.
-It must be built with Go version 1.6 or higher in order for some features to function properly.
-
-In order to enable seccomp support you will need to install `libseccomp` on your platform.
-> e.g. `libseccomp-devel` for CentOS, or `libseccomp-dev` for Ubuntu
-
-Otherwise, if you do not want to build `runc` with seccomp support you can add `BUILDTAGS=""` when running make.
+At the time of writing, runc only builds on the Linux platform.
 
 ```bash
 # create a 'github.com/opencontainers' in your GOPATH/src
 cd github.com/opencontainers
 git clone https://github.com/opencontainers/runc
 cd runc
-
 make
 sudo make install
 ```
 
-`runc` will be installed to `/usr/local/sbin/runc` on your system.
+In order to enable seccomp support you will need to install libseccomp on your platform.
+If you do not want to build `runc` with seccomp support you can add `BUILDTAGS=""` when running make.
 
 #### Build Tags
 
-`runc` supports optional build tags for compiling support of various features.
-To add build tags to the make option the `BUILDTAGS` variable must be set.
+`runc` supports optional build tags for compiling in support for various features.
 
-```bash
-make BUILDTAGS='seccomp apparmor'
-```
 
 | Build Tag | Feature                            | Dependency  |
 |-----------|------------------------------------|-------------|
 | seccomp   | Syscall filtering                  | libseccomp  |
 | selinux   | selinux process and mount labeling | <none>      |
 | apparmor  | apparmor profile support           | libapparmor |
-| ambient   | ambient capability support         | kernel 4.3  |
 
+### Testing:
 
-### Running the test suite
-
-`runc` currently supports running its test suite via Docker.
-To run the suite just type `make test`.
+You can run tests for runC by using command:
 
 ```bash
-make test
+# make test
 ```
 
-There are additional make targets for running the tests outside of a container but this is not recommended as the tests are written with the expectation that they can write and remove anywhere.
+Note that test cases are run in Docker container, so you need to install
+`docker` first. And test requires mounting cgroups inside container, it's
+done by docker now, so you need a docker version newer than 1.8.0-rc2.
 
-You can run a specific test case by setting the `TESTFLAGS` variable.
+You can also run specific test cases by:
 
 ```bash
 # make test TESTFLAGS="-run=SomeTestFunction"
 ```
 
-### Dependencies Management
+### Using:
 
-`runc` uses [vndr](https://github.com/LK4D4/vndr) for dependencies management.
-Please refer to [vndr](https://github.com/LK4D4/vndr) for how to add or update
-new dependencies.
-
-## Using runc
-
-### Creating an OCI Bundle
-
-In order to use runc you must have your container in the format of an OCI bundle.
-If you have Docker installed you can use its `export` method to acquire a root filesystem from an existing Docker container.
+To run a container with the id "test", execute `runc start` with the containers id as arg one 
+in the bundle's root directory:
 
 ```bash
-# create the top most bundle directory
-mkdir /mycontainer
-cd /mycontainer
+runc start test
+/ $ ps
+PID   USER     COMMAND
+1     daemon   sh
+5     daemon   sh
+/ $
+```
 
-# create the rootfs directory
+### OCI Container JSON Format:
+
+OCI container JSON format is based on OCI [specs](https://github.com/opencontainers/runtime-spec).
+You can generate JSON files by using `runc spec`.
+It assumes that the file-system is found in a directory called
+`rootfs` and there is a user with uid and gid of `0` defined within that file-system.
+
+### Examples:
+
+#### Using a Docker image (requires version 1.3 or later)
+
+To test using Docker's `busybox` image follow these steps:
+* Install `docker` and download the `busybox` image: `docker pull busybox`
+* Create a container from that image and export its contents to a tar file:
+`docker export $(docker create busybox) > busybox.tar`
+* Untar the contents to create your filesystem directory:
+```
 mkdir rootfs
-
-# export busybox via Docker into the rootfs directory
-docker export $(docker create busybox) | tar -C rootfs -xvf -
+tar -C rootfs -xf busybox.tar
+```
+* Create `config.json` by using `runc spec`.
+* Execute `runc start` and you should be placed into a shell where you can run `ps`:
+```
+$ runc start test
+/ # ps
+PID   USER     COMMAND
+    1 root     sh
+    9 root     ps
 ```
 
-After a root filesystem is populated you just generate a spec in the format of a `config.json` file inside your bundle.
-`runc` provides a `spec` command to generate a base template spec that you are then able to edit.
-To find features and documentation for fields in the spec please refer to the [specs](https://github.com/opencontainers/runtime-spec) repository.
+#### Using runc with systemd
 
-```bash
-runc spec
-```
+To use runc with systemd, you can create a unit file
+`/usr/lib/systemd/system/minecraft.service` as below (edit your
+own Description or WorkingDirectory or service name as you need).
 
-### Running Containers
-
-Assuming you have an OCI bundle from the previous step you can execute the container in two different ways.
-
-The first way is to use the convenience command `run` that will handle creating, starting, and deleting the container after it exits.
-
-```bash
-# run as root
-cd /mycontainer
-runc run mycontainerid
-```
-
-If you used the unmodified `runc spec` template this should give you a `sh` session inside the container.
-
-The second way to start a container is using the specs lifecycle operations.
-This gives you more power over how the container is created and managed while it is running.
-This will also launch the container in the background so you will have to edit the `config.json` to remove the `terminal` setting for the simple examples here.
-Your process field in the `config.json` should look like this below with `"terminal": false` and `"args": ["sleep", "5"]`.
-
-
-```json
-        "process": {
-                "terminal": false,
-                "user": {
-                        "uid": 0,
-                        "gid": 0
-                },
-                "args": [
-                        "sleep", "5"
-                ],
-                "env": [
-                        "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
-                        "TERM=xterm"
-                ],
-                "cwd": "/",
-                "capabilities": {
-                        "bounding": [
-                                "CAP_AUDIT_WRITE",
-                                "CAP_KILL",
-                                "CAP_NET_BIND_SERVICE"
-                        ],
-                        "effective": [
-                                "CAP_AUDIT_WRITE",
-                                "CAP_KILL",
-                                "CAP_NET_BIND_SERVICE"
-                        ],
-                        "inheritable": [
-                                "CAP_AUDIT_WRITE",
-                                "CAP_KILL",
-                                "CAP_NET_BIND_SERVICE"
-                        ],
-                        "permitted": [
-                                "CAP_AUDIT_WRITE",
-                                "CAP_KILL",
-                                "CAP_NET_BIND_SERVICE"
-                        ],
-                        "ambient": [
-                                "CAP_AUDIT_WRITE",
-                                "CAP_KILL",
-                                "CAP_NET_BIND_SERVICE"
-                        ]
-                },
-                "rlimits": [
-                        {
-                                "type": "RLIMIT_NOFILE",
-                                "hard": 1024,
-                                "soft": 1024
-                        }
-                ],
-                "noNewPrivileges": true
-        },
-```
-
-Now we can go through the lifecycle operations in your shell.
-
-
-```bash
-# run as root
-cd /mycontainer
-runc create mycontainerid
-
-# view the container is created and in the "created" state
-runc list
-
-# start the process inside the container
-runc start mycontainerid
-
-# after 5 seconds view that the container has exited and is now in the stopped state
-runc list
-
-# now delete the container
-runc delete mycontainerid
-```
-
-This adds more complexity but allows higher level systems to manage runc and provides points in the containers creation to setup various settings after the container has created and/or before it is deleted.
-This is commonly used to setup the container's network stack after `create` but before `start` where the user's defined process will be running.
-
-#### Rootless containers
-`runc` has the ability to run containers without root privileges. This is called `rootless`. You need to pass some parameters to `runc` in order to run rootless containers. See below and compare with the previous version. Run the following commands as an ordinary user:
-```bash
-# Same as the first example
-mkdir ~/mycontainer
-cd ~/mycontainer
-mkdir rootfs
-docker export $(docker create busybox) | tar -C rootfs -xvf -
-
-# The --rootless parameter instructs runc spec to generate a configuration for a rootless container, which will allow you to run the container as a non-root user.
-runc spec --rootless
-
-# The --root parameter tells runc where to store the container state. It must be writable by the user.
-runc --root /tmp/runc run mycontainerid
-```
-
-#### Supervisors
-
-`runc` can be used with process supervisors and init systems to ensure that containers are restarted when they exit.
-An example systemd unit file looks something like this.
-
-```systemd
+```service
 [Unit]
-Description=Start My Container
+Description=Minecraft Build Server
+Documentation=http://minecraft.net
+After=network.target
 
 [Service]
-Type=forking
-ExecStart=/usr/local/sbin/runc run -d --pid-file /run/mycontainerid.pid mycontainerid
-ExecStopPost=/usr/local/sbin/runc delete mycontainerid
-WorkingDirectory=/mycontainer
-PIDFile=/run/mycontainerid.pid
+CPUQuota=200%
+MemoryLimit=1536M
+ExecStart=/usr/local/bin/runc start minecraft
+Restart=on-failure
+WorkingDirectory=/containers/minecraftbuild
 
 [Install]
 WantedBy=multi-user.target
 ```
+
+Make sure you have the bundle's root directory and JSON configs in
+your WorkingDirectory, then use systemd commands to start the service:
+
+```bash
+systemctl daemon-reload
+systemctl start minecraft.service
+```
+
+Note that if you use JSON configs by `runc spec`, you need to modify
+`config.json` and change `process.terminal` to false so runc won't
+create tty, because we can't set terminal from the stdin when using
+systemd service.

vendor/github.com/opencontainers/runc/VERSION

@@ -1 +0,0 @@
-1.0.0-rc4+dev

vendor/github.com/opencontainers/runc/checkpoint.go

@@ -7,11 +7,8 @@ import (
 	"strconv"
 	"strings"
 
+	"github.com/codegangsta/cli"
 	"github.com/opencontainers/runc/libcontainer"
-	"github.com/opencontainers/runtime-spec/specs-go"
-	"github.com/urfave/cli"
-
-	"golang.org/x/sys/unix"
 )
 
 var checkpointCommand = cli.Command{
@@ -25,50 +22,27 @@ checkpointed.`,
 	Flags: []cli.Flag{
 		cli.StringFlag{Name: "image-path", Value: "", Usage: "path for saving criu image files"},
 		cli.StringFlag{Name: "work-path", Value: "", Usage: "path for saving work files and logs"},
-		cli.StringFlag{Name: "parent-path", Value: "", Usage: "path for previous criu image files in pre-dump"},
 		cli.BoolFlag{Name: "leave-running", Usage: "leave the process running after checkpointing"},
 		cli.BoolFlag{Name: "tcp-established", Usage: "allow open tcp connections"},
 		cli.BoolFlag{Name: "ext-unix-sk", Usage: "allow external unix sockets"},
 		cli.BoolFlag{Name: "shell-job", Usage: "allow shell jobs"},
 		cli.StringFlag{Name: "page-server", Value: "", Usage: "ADDRESS:PORT of the page server"},
 		cli.BoolFlag{Name: "file-locks", Usage: "handle file locks, for safety"},
-		cli.BoolFlag{Name: "pre-dump", Usage: "dump container's memory information only, leave the container running after this"},
-		cli.StringFlag{Name: "manage-cgroups-mode", Value: "", Usage: "cgroups mode: 'soft' (default), 'full' and 'strict'"},
-		cli.StringSliceFlag{Name: "empty-ns", Usage: "create a namespace, but don't restore its properties"},
-		cli.BoolFlag{Name: "auto-dedup", Usage: "enable auto deduplication of memory images"},
+		cli.StringFlag{Name: "manage-cgroups-mode", Value: "", Usage: "cgroups mode: 'soft' (default), 'full' and 'strict'."},
 	},
-	Action: func(context *cli.Context) error {
-		if err := checkArgs(context, 1, exactArgs); err != nil {
-			return err
-		}
-		// XXX: Currently this is untested with rootless containers.
-		if isRootless() {
-			return fmt.Errorf("runc checkpoint requires root")
-		}
-
+	Action: func(context *cli.Context) {
 		container, err := getContainer(context)
 		if err != nil {
-			return err
-		}
-		status, err := container.Status()
-		if err != nil {
-			return err
-		}
-		if status == libcontainer.Created {
-			fatalf("Container cannot be checkpointed in created state")
+			fatal(err)
 		}
 		defer destroy(container)
 		options := criuOptions(context)
 		// these are the mandatory criu options for a container
 		setPageServer(context, options)
 		setManageCgroupsMode(context, options)
-		if err := setEmptyNsMask(context, options); err != nil {
-			return err
-		}
 		if err := container.Checkpoint(options); err != nil {
-			return err
+			fatal(err)
 		}
-		return nil
 	},
 }
 
@@ -113,22 +87,3 @@ func setManageCgroupsMode(context *cli.Context, options *libcontainer.CriuOpts)
 		}
 	}
 }
-
-var namespaceMapping = map[specs.LinuxNamespaceType]int{
-	specs.NetworkNamespace: unix.CLONE_NEWNET,
-}
-
-func setEmptyNsMask(context *cli.Context, options *libcontainer.CriuOpts) error {
-	var nsmask int
-
-	for _, ns := range context.StringSlice("empty-ns") {
-		f, exists := namespaceMapping[specs.LinuxNamespaceType(ns)]
-		if !exists {
-			return fmt.Errorf("namespace %q is not supported", ns)
-		}
-		nsmask |= f
-	}
-
-	options.EmptyNs = uint32(nsmask)
-	return nil
-}

vendor/github.com/opencontainers/runc/contrib/cmd/recvtty/recvtty.go

@@ -1,236 +0,0 @@
-/*
- * Copyright 2016 SUSE LLC
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package main
-
-import (
-	"fmt"
-	"io"
-	"io/ioutil"
-	"net"
-	"os"
-	"strings"
-
-	"github.com/opencontainers/runc/libcontainer"
-	"github.com/opencontainers/runc/libcontainer/utils"
-	"github.com/urfave/cli"
-)
-
-// version will be populated by the Makefile, read from
-// VERSION file of the source code.
-var version = ""
-
-// gitCommit will be the hash that the binary was built from
-// and will be populated by the Makefile
-var gitCommit = ""
-
-const (
-	usage = `Open Container Initiative contrib/cmd/recvtty
-
-recvtty is a reference implementation of a consumer of runC's --console-socket
-API. It has two main modes of operation:
-
-  * single: Only permit one terminal to be sent to the socket, which is
-	then hooked up to the stdio of the recvtty process. This is useful
-	for rudimentary shell management of a container.
-
-  * null: Permit as many terminals to be sent to the socket, but they
-	are read to /dev/null. This is used for testing, and imitates the
-	old runC API's --console=/dev/pts/ptmx hack which would allow for a
-	similar trick. This is probably not what you want to use, unless
-	you're doing something like our bats integration tests.
-
-To use recvtty, just specify a socket path at which you want to receive
-terminals:
-
-    $ recvtty [--mode <single|null>] socket.sock
-`
-)
-
-func bail(err error) {
-	fmt.Fprintf(os.Stderr, "[recvtty] fatal error: %v\n", err)
-	os.Exit(1)
-}
-
-func handleSingle(path string) error {
-	// Open a socket.
-	ln, err := net.Listen("unix", path)
-	if err != nil {
-		return err
-	}
-	defer ln.Close()
-
-	// We only accept a single connection, since we can only really have
-	// one reader for os.Stdin. Plus this is all a PoC.
-	conn, err := ln.Accept()
-	if err != nil {
-		return err
-	}
-	defer conn.Close()
-
-	// Close ln, to allow for other instances to take over.
-	ln.Close()
-
-	// Get the fd of the connection.
-	unixconn, ok := conn.(*net.UnixConn)
-	if !ok {
-		return fmt.Errorf("failed to cast to unixconn")
-	}
-
-	socket, err := unixconn.File()
-	if err != nil {
-		return err
-	}
-	defer socket.Close()
-
-	// Get the master file descriptor from runC.
-	master, err := utils.RecvFd(socket)
-	if err != nil {
-		return err
-	}
-	if err = libcontainer.SaneTerminal(master); err != nil {
-		return err
-	}
-
-	// Copy from our stdio to the master fd.
-	quitChan := make(chan struct{})
-	go func() {
-		io.Copy(os.Stdout, master)
-		quitChan <- struct{}{}
-	}()
-	go func() {
-		io.Copy(master, os.Stdin)
-		quitChan <- struct{}{}
-	}()
-
-	// Only close the master fd once we've stopped copying.
-	<-quitChan
-	master.Close()
-	return nil
-}
-
-func handleNull(path string) error {
-	// Open a socket.
-	ln, err := net.Listen("unix", path)
-	if err != nil {
-		return err
-	}
-	defer ln.Close()
-
-	// As opposed to handleSingle we accept as many connections as we get, but
-	// we don't interact with Stdin at all (and we copy stdout to /dev/null).
-	for {
-		conn, err := ln.Accept()
-		if err != nil {
-			return err
-		}
-		go func(conn net.Conn) {
-			// Don't leave references lying around.
-			defer conn.Close()
-
-			// Get the fd of the connection.
-			unixconn, ok := conn.(*net.UnixConn)
-			if !ok {
-				return
-			}
-
-			socket, err := unixconn.File()
-			if err != nil {
-				return
-			}
-			defer socket.Close()
-
-			// Get the master file descriptor from runC.
-			master, err := utils.RecvFd(socket)
-			if err != nil {
-				return
-			}
-
-			// Just do a dumb copy to /dev/null.
-			devnull, err := os.OpenFile("/dev/null", os.O_RDWR, 0)
-			if err != nil {
-				// TODO: Handle this nicely.
-				return
-			}
-
-			io.Copy(devnull, master)
-			devnull.Close()
-		}(conn)
-	}
-}
-
-func main() {
-	app := cli.NewApp()
-	app.Name = "recvtty"
-	app.Usage = usage
-
-	// Set version to be the same as runC.
-	var v []string
-	if version != "" {
-		v = append(v, version)
-	}
-	if gitCommit != "" {
-		v = append(v, fmt.Sprintf("commit: %s", gitCommit))
-	}
-	app.Version = strings.Join(v, "\n")
-
-	// Set the flags.
-	app.Flags = []cli.Flag{
-		cli.StringFlag{
-			Name:  "mode, m",
-			Value: "single",
-			Usage: "Mode of operation (single or null)",
-		},
-		cli.StringFlag{
-			Name:  "pid-file",
-			Value: "",
-			Usage: "Path to write daemon process ID to",
-		},
-	}
-
-	app.Action = func(ctx *cli.Context) error {
-		args := ctx.Args()
-		if len(args) != 1 {
-			return fmt.Errorf("need to specify a single socket path")
-		}
-		path := ctx.Args()[0]
-
-		pidPath := ctx.String("pid-file")
-		if pidPath != "" {
-			pid := fmt.Sprintf("%d\n", os.Getpid())
-			if err := ioutil.WriteFile(pidPath, []byte(pid), 0644); err != nil {
-				return err
-			}
-		}
-
-		switch ctx.String("mode") {
-		case "single":
-			if err := handleSingle(path); err != nil {
-				return err
-			}
-		case "null":
-			if err := handleNull(path); err != nil {
-				return err
-			}
-		default:
-			return fmt.Errorf("need to select a valid mode: %s", ctx.String("mode"))
-		}
-		return nil
-	}
-	if err := app.Run(os.Args); err != nil {
-		bail(err)
-	}
-}

vendor/github.com/opencontainers/runc/contrib/completions/bash/runc

@@ -1,805 +0,0 @@
-#!/bin/bash
-#
-# bash completion file for runc command
-#
-# This script provides completion of:
-#  - commands and their options
-#  - filepaths
-#
-# To enable the completions either:
-#  - place this file in /usr/share/bash-completion/completions
-#  or
-#  - copy this file to e.g. ~/.runc-completion.sh and add the line
-#    below to your .bashrc after bash completion features are loaded
-#    . ~/.runc-completion.sh
-#
-# Configuration:
-#
-
-# Note for developers:
-# Please arrange options sorted alphabetically by long name with the short
-# options immediately following their corresponding long form.
-# This order should be applied to lists, alternatives and code blocks.
-
-__runc_previous_extglob_setting=$(shopt -p extglob)
-shopt -s extglob
-
-__runc_list_all() {
-	COMPREPLY=($(compgen -W "$(runc list -q)" -- $cur))
-}
-
-__runc_pos_first_nonflag() {
-	local argument_flags=$1
-
-	local counter=$((${subcommand_pos:-${command_pos}} + 1))
-	while [ $counter -le $cword ]; do
-		if [ -n "$argument_flags" ] && eval "case '${words[$counter]}' in $argument_flags) true ;; *) false ;; esac"; then
-			((counter++))
-		else
-			case "${words[$counter]}" in
-			-*) ;;
-			*)
-				break
-				;;
-			esac
-		fi
-		((counter++))
-	done
-
-	echo $counter
-}
-
-# Transforms a multiline list of strings into a single line string
-# with the words separated by "|".
-# This is used to prepare arguments to __runc_pos_first_nonflag().
-__runc_to_alternatives() {
-	local parts=($1)
-	local IFS='|'
-	echo "${parts[*]}"
-}
-
-# Transforms a multiline list of options into an extglob pattern
-# suitable for use in case statements.
-__runc_to_extglob() {
-	local extglob=$(__runc_to_alternatives "$1")
-	echo "@($extglob)"
-}
-
-# Subcommand processing.
-# Locates the first occurrence of any of the subcommands contained in the
-# first argument. In case of a match, calls the corresponding completion
-# function and returns 0.
-# If no match is found, 1 is returned. The calling function can then
-# continue processing its completion.
-#
-# TODO if the preceding command has options that accept arguments and an
-# argument is equal ot one of the subcommands, this is falsely detected as
-# a match.
-__runc_subcommands() {
-	local subcommands="$1"
-
-	local counter=$(($command_pos + 1))
-	while [ $counter -lt $cword ]; do
-		case "${words[$counter]}" in
-		$(__runc_to_extglob "$subcommands"))
-			subcommand_pos=$counter
-			local subcommand=${words[$counter]}
-			local completions_func=_runc_${command}_${subcommand}
-			declare -F $completions_func >/dev/null && $completions_func
-			return 0
-			;;
-		esac
-		((counter++))
-	done
-	return 1
-}
-
-# List all Signals
-__runc_list_signals() {
-	COMPREPLY=($(compgen -W "$(for i in $(kill -l | xargs); do echo $i; done | grep SIG)"))
-}
-
-# suppress trailing whitespace
-__runc_nospace() {
-	# compopt is not available in ancient bash versions
-	type compopt &>/dev/null && compopt -o nospace
-}
-
-# The list of capabilities is defined in types.go, ALL was added manually.
-__runc_complete_capabilities() {
-	COMPREPLY=($(compgen -W "
-		ALL
-		AUDIT_CONTROL
-		AUDIT_WRITE
-		AUDIT_READ
-		BLOCK_SUSPEND
-		CHOWN
-		DAC_OVERRIDE
-		DAC_READ_SEARCH
-		FOWNER
-		FSETID
-		IPC_LOCK
-		IPC_OWNER
-		KILL
-		LEASE
-		LINUX_IMMUTABLE
-		MAC_ADMIN
-		MAC_OVERRIDE
-		MKNOD
-		NET_ADMIN
-		NET_BIND_SERVICE
-		NET_BROADCAST
-		NET_RAW
-		SETFCAP
-		SETGID
-		SETPCAP
-		SETUID
-		SYS_ADMIN
-		SYS_BOOT
-		SYS_CHROOT
-		SYSLOG
-		SYS_MODULE
-		SYS_NICE
-		SYS_PACCT
-		SYS_PTRACE
-		SYS_RAWIO
-		SYS_RESOURCE
-		SYS_TIME
-		SYS_TTY_CONFIG
-		WAKE_ALARM
-	" -- "$cur"))
-}
-
-_runc_exec() {
-	local boolean_options="
-	   --help
-	   --no-new-privs
-	   --tty, -t
-	   --detach, -d
-	"
-
-	local options_with_args="
-	   --console
-	   --cwd
-	   --env, -e
-	   --user, -u
-	   --process, -p
-	   --pid-file
-	   --process-label
-	   --apparmor
-	   --cap, -c
-	"
-
-	local all_options="$options_with_args $boolean_options"
-
-	case "$prev" in
-	--cap | -c)
-		__runc_complete_capabilities
-		return
-		;;
-
-	--console | --cwd | --process | --apparmor)
-		case "$cur" in
-		*:*) ;; # TODO somehow do _filedir for stuff inside the image, if it's already specified (which is also somewhat difficult to determine)
-		'')
-			COMPREPLY=($(compgen -W '/' -- "$cur"))
-			__runc_nospace
-			;;
-		/*)
-			_filedir
-			__runc_nospace
-			;;
-		esac
-		return
-		;;
-	--env | -e)
-		COMPREPLY=($(compgen -e -- "$cur"))
-		__runc_nospace
-		return
-		;;
-	$(__runc_to_extglob "$options_with_args"))
-		return
-		;;
-	esac
-
-	case "$cur" in
-	-*)
-		COMPREPLY=($(compgen -W "$all_options" -- "$cur"))
-		;;
-	*)
-		__runc_list_all
-		;;
-	esac
-}
-
-# global options that may appear after the runc command
-_runc_runc() {
-	local boolean_options="
-		$global_boolean_options
-		--help
-		--version -v
-		--debug
-	"
-	local options_with_args="
-		--log
-		--log-format
-		--root
-		--criu
-	"
-
-	case "$prev" in
-	--log | --root | --criu)
-		case "$cur" in
-		*:*) ;; # TODO somehow do _filedir for stuff inside the image, if it's already specified (which is also somewhat difficult to determine)
-		'')
-			COMPREPLY=($(compgen -W '/' -- "$cur"))
-			__runc_nospace
-			;;
-		*)
-			_filedir
-			__runc_nospace
-			;;
-		esac
-		return
-		;;
-
-	--log-format)
-		COMPREPLY=($(compgen -W 'text json' -- "$cur"))
-		return
-		;;
-
-	$(__runc_to_extglob "$options_with_args"))
-		return
-		;;
-	esac
-
-	case "$cur" in
-	-*)
-		COMPREPLY=($(compgen -W "$boolean_options $options_with_args" -- "$cur"))
-		;;
-	*)
-		local counter=$(__runc_pos_first_nonflag $(__runc_to_extglob "$options_with_args"))
-		if [ $cword -eq $counter ]; then
-			COMPREPLY=($(compgen -W "${commands[*]} help" -- "$cur"))
-		fi
-		;;
-	esac
-}
-
-_runc_pause() {
-	local boolean_options="
-	   --help
-	   -h
-	"
-
-	case "$cur" in
-	-*)
-		COMPREPLY=($(compgen -W "$boolean_options $options_with_args" -- "$cur"))
-		;;
-	*)
-		__runc_list_all
-		;;
-	esac
-}
-
-_runc_ps() {
-	local boolean_options="
-	   --help
-	   -h
-	"
-
-	case "$cur" in
-	-*)
-		COMPREPLY=($(compgen -W "$boolean_options $options_with_args" -- "$cur"))
-		;;
-	*)
-		__runc_list_all
-		;;
-	esac
-}
-
-_runc_delete() {
-	local boolean_options="
-	   --help
-	   -h
-	"
-
-	case "$cur" in
-	-*)
-		COMPREPLY=($(compgen -W "$boolean_options $options_with_args" -- "$cur"))
-		;;
-	*)
-		__runc_list_all
-		;;
-	esac
-}
-
-_runc_kill() {
-	local boolean_options="
-	   --help
-	   -h
-          --all
-          -a
-	"
-
-	case "$prev" in
-	"kill")
-		__runc_list_all
-		return
-		;;
-	*)
-		__runc_list_signals
-		return
-		;;
-	esac
-	case "$cur" in
-	-*)
-		COMPREPLY=($(compgen -W "$boolean_options $options_with_args" -- "$cur"))
-		;;
-	*)
-		__runc_list_all
-		;;
-	esac
-}
-
-_runc_events() {
-	local boolean_options="
-	   --help
-	   --stats
-	"
-
-	local options_with_args="
-	   --interval
-	"
-
-	case "$prev" in
-	$(__runc_to_extglob "$options_with_args"))
-		return
-		;;
-	esac
-
-	case "$cur" in
-	-*)
-		COMPREPLY=($(compgen -W "$boolean_options $options_with_args" -- "$cur"))
-		;;
-	*)
-		__runc_list_all
-		;;
-	esac
-}
-
-_runc_list() {
-	local boolean_options="
-	   --help
-	   --quiet 
-	   -q
-	"
-
-	local options_with_args="
-	   --format
-	   -f
-	"
-
-	case "$prev" in
-	--format | -f)
-		COMPREPLY=($(compgen -W 'text json' -- "$cur"))
-		return
-		;;
-
-	$(__runc_to_extglob "$options_with_args"))
-		return
-		;;
-	esac
-
-	case "$cur" in
-	-*)
-		COMPREPLY=($(compgen -W "$boolean_options $options_with_args" -- "$cur"))
-		;;
-	*)
-		local counter=$(__runc_pos_first_nonflag $(__runc_to_extglob "$options_with_args"))
-		;;
-	esac
-}
-
-_runc_spec() {
-	local boolean_options="
-	   --help
-	"
-
-	local options_with_args="
-	   --bundle
-	   -b
-	"
-
-	case "$prev" in
-	--bundle | -b)
-		case "$cur" in
-		'')
-			COMPREPLY=($(compgen -W '/' -- "$cur"))
-			__runc_nospace
-			;;
-		/*)
-			_filedir
-			__runc_nospace
-			;;
-		esac
-		return
-		;;
-
-	$(__runc_to_extglob "$options_with_args"))
-		return
-		;;
-	esac
-
-	case "$cur" in
-	-*)
-		COMPREPLY=($(compgen -W "$boolean_options $options_with_args" -- "$cur"))
-		;;
-	*)
-		local counter=$(__runc_pos_first_nonflag $(__runc_to_extglob "$options_with_args"))
-		;;
-	esac
-}
-
-_runc_run() {
-	local boolean_options="
-	   --help
-	   --detatch
-	   -d
-	   --no-subreaper
-	   --no-pivot
-	   --no-new-keyring
-	"
-
-	local options_with_args="
-	   --bundle
-	   -b
-	   --console
-	   --pid-file
-	"
-
-	case "$prev" in
-	--bundle | -b | --console | --pid-file)
-		case "$cur" in
-		'')
-			COMPREPLY=($(compgen -W '/' -- "$cur"))
-			__runc_nospace
-			;;
-		/*)
-			_filedir
-			__runc_nospace
-			;;
-		esac
-		return
-		;;
-
-	$(__runc_to_extglob "$options_with_args"))
-		return
-		;;
-	esac
-
-	case "$cur" in
-	-*)
-		COMPREPLY=($(compgen -W "$boolean_options $options_with_args" -- "$cur"))
-		;;
-	*)
-		__runc_list_all
-		;;
-	esac
-}
-
-_runc_checkpoint() {
-	local boolean_options="
-	   --help
-	   -h
-	   --leave-running
-	   --tcp-established
-	   --ext-unix-sk
-	   --shell-job
-	   --file-locks
-	"
-
-	local options_with_args="
-	   --image-path
-	   --work-path
-	   --page-server
-	   --manage-cgroups-mode
-	"
-
-	case "$prev" in
-	--page-server) ;;
-
-	--manage-cgroups-mode)
-		COMPREPLY=($(compgen -W "soft full strict" -- "$cur"))
-		return
-		;;
-
-	--image-path | --work-path)
-		case "$cur" in
-		*:*) ;; # TODO somehow do _filedir for stuff inside the image, if it's already specified (which is also somewhat difficult to determine)
-		'')
-			COMPREPLY=($(compgen -W '/' -- "$cur"))
-			__runc_nospace
-			;;
-		*)
-			_filedir
-			__runc_nospace
-			;;
-		esac
-		return
-		;;
-
-	$(__runc_to_extglob "$options_with_args"))
-		return
-		;;
-	esac
-
-	case "$cur" in
-	-*)
-		COMPREPLY=($(compgen -W "$boolean_options $options_with_args" -- "$cur"))
-		;;
-	*)
-		__runc_list_all
-		;;
-	esac
-}
-_runc_create() {
-	local boolean_options="
-	   --help
-	   --no-pivot
-	   --no-new-keyring
-	"
-
-	local options_with_args="
-	   --bundle
-	   -b
-	   --console
-	   --pid-file
-	"
-	case "$prev" in
-	--bundle | -b | --console | --pid-file)
-		case "$cur" in
-		'')
-			COMPREPLY=($(compgen -W '/' -- "$cur"))
-			__runc_nospace
-			;;
-		/*)
-			_filedir
-			__runc_nospace
-			;;
-		esac
-		return
-		;;
-
-	$(__runc_to_extglob "$options_with_args"))
-		return
-		;;
-	esac
-
-	case "$cur" in
-	-*)
-		COMPREPLY=($(compgen -W "$boolean_options $options_with_args" -- "$cur"))
-		;;
-	*)
-		__runc_list_all
-		;;
-	esac
-
-}
-
-_runc_help() {
-	local counter=$(__runc_pos_first_nonflag)
-	if [ $cword -eq $counter ]; then
-		COMPREPLY=($(compgen -W "${commands[*]}" -- "$cur"))
-	fi
-}
-
-_runc_restore() {
-	local boolean_options="
-	   --help
-	   --tcp-established
-	   --ext-unix-sk
-	   --shell-job
-	   --file-locks
-	   --detach
-	   -d
-	   --no-subreaper
-	   --no-pivot
-	"
-
-	local options_with_args="
-	   -b
-	   --bundle
-	   --image-path
-	   --work-path
-	   --manage-cgroups-mode
-	   --pid-file
-	"
-
-	local all_options="$options_with_args $boolean_options"
-
-	case "$prev" in
-	--manage-cgroups-mode)
-		COMPREPLY=($(compgen -W "soft full strict" -- "$cur"))
-		return
-		;;
-
-	--pid-file | --image-path | --work-path | --bundle | -b)
-		case "$cur" in
-		*:*) ;; # TODO somehow do _filedir for stuff inside the image, if it's already specified (which is also somewhat difficult to determine)
-		'')
-			COMPREPLY=($(compgen -W '/' -- "$cur"))
-			__runc_nospace
-			;;
-		/*)
-			_filedir
-			__runc_nospace
-			;;
-		esac
-		return
-		;;
-
-	$(__runc_to_extglob "$options_with_args"))
-		return
-		;;
-	esac
-
-	case "$cur" in
-	-*)
-		COMPREPLY=($(compgen -W "$all_options" -- "$cur"))
-		;;
-	*)
-		__runc_list_all
-		;;
-	esac
-}
-
-_runc_resume() {
-	local boolean_options="
-	   --help
-	   -h
-	"
-
-	case "$cur" in
-	-*)
-		COMPREPLY=($(compgen -W "$boolean_options $options_with_args" -- "$cur"))
-		;;
-	*)
-		__runc_list_all
-		;;
-	esac
-}
-
-_runc_state() {
-	local boolean_options="
-	   --help
-	   -h
-	"
-
-	case "$cur" in
-	-*)
-		COMPREPLY=($(compgen -W "$boolean_options $options_with_args" -- "$cur"))
-		;;
-	*)
-		__runc_list_all
-		;;
-	esac
-}
-_runc_start() {
-	local boolean_options="
-	   --help
-	   -h
-	"
-
-	case "$cur" in
-	-*)
-		COMPREPLY=($(compgen -W "$boolean_options $options_with_args" -- "$cur"))
-		;;
-	*)
-		__runc_list_all
-		;;
-	esac
-}
-_runc_update() {
-	local boolean_options="
-	   --help
-	"
-
-	local options_with_args="
-	   --blkio-weight
-	   --cpu-period
-	   --cpu-quota
-	   --cpu-rt-period
-	   --cpu-rt-runtime
-	   --cpu-share
-	   --cpuset-cpus
-	   --cpuset-mems
-	   --kernel-memory
-	   --kernel-memory-tcp
-	   --memory
-	   --memory-reservation
-	   --memory-swap
-
-	"
-
-	case "$prev" in
-	$(__runc_to_extglob "$options_with_args"))
-		return
-		;;
-	esac
-
-	case "$cur" in
-	-*)
-		COMPREPLY=($(compgen -W "$boolean_options $options_with_args" -- "$cur"))
-		;;
-	*)
-		__runc_list_all
-		;;
-	esac
-}
-
-_runc() {
-	local previous_extglob_setting=$(shopt -p extglob)
-	shopt -s extglob
-
-	local commands=(
-		checkpoint
-		create
-		delete
-		events
-		exec
-		init
-		kill
-		list
-		pause
-		ps
-		restore
-		resume
-		run
-		spec
-		start
-		state
-		update
-		help
-		h
-	)
-
-	# These options are valid as global options for all client commands
-	# and valid as command options for `runc daemon`
-	local global_boolean_options="
-		--help -h
-		--version -v
-	"
-
-	COMPREPLY=()
-	local cur prev words cword
-	_get_comp_words_by_ref -n : cur prev words cword
-
-	local command='runc' command_pos=0 subcommand_pos
-	local counter=1
-	while [ $counter -lt $cword ]; do
-		case "${words[$counter]}" in
-		-*) ;;
-		=)
-			((counter++))
-			;;
-		*)
-			command="${words[$counter]}"
-			command_pos=$counter
-			break
-			;;
-		esac
-		((counter++))
-	done
-
-	local completions_func=_runc_${command}
-	declare -F $completions_func >/dev/null && $completions_func
-
-	eval "$previous_extglob_setting"
-	return 0
-}
-
-eval "$__runc_previous_extglob_setting"
-unset __runc_previous_extglob_setting
-
-complete -F _runc runc

vendor/github.com/opencontainers/runc/create.go

@@ -1,74 +0,0 @@
-package main
-
-import (
-	"os"
-
-	"github.com/urfave/cli"
-)
-
-var createCommand = cli.Command{
-	Name:  "create",
-	Usage: "create a container",
-	ArgsUsage: `<container-id>
-
-Where "<container-id>" is your name for the instance of the container that you
-are starting. The name you provide for the container instance must be unique on
-your host.`,
-	Description: `The create command creates an instance of a container for a bundle. The bundle
-is a directory with a specification file named "` + specConfig + `" and a root
-filesystem.
-
-The specification file includes an args parameter. The args parameter is used
-to specify command(s) that get run when the container is started. To change the
-command(s) that get executed on start, edit the args parameter of the spec. See
-"runc spec --help" for more explanation.`,
-	Flags: []cli.Flag{
-		cli.StringFlag{
-			Name:  "bundle, b",
-			Value: "",
-			Usage: `path to the root of the bundle directory, defaults to the current directory`,
-		},
-		cli.StringFlag{
-			Name:  "console-socket",
-			Value: "",
-			Usage: "path to an AF_UNIX socket which will receive a file descriptor referencing the master end of the console's pseudoterminal",
-		},
-		cli.StringFlag{
-			Name:  "pid-file",
-			Value: "",
-			Usage: "specify the file to write the process id to",
-		},
-		cli.BoolFlag{
-			Name:  "no-pivot",
-			Usage: "do not use pivot root to jail process inside rootfs.  This should be used whenever the rootfs is on top of a ramdisk",
-		},
-		cli.BoolFlag{
-			Name:  "no-new-keyring",
-			Usage: "do not create a new session keyring for the container.  This will cause the container to inherit the calling processes session key",
-		},
-		cli.IntFlag{
-			Name:  "preserve-fds",
-			Usage: "Pass N additional file descriptors to the container (stdio + $LISTEN_FDS + N in total)",
-		},
-	},
-	Action: func(context *cli.Context) error {
-		if err := checkArgs(context, 1, exactArgs); err != nil {
-			return err
-		}
-		if err := revisePidFile(context); err != nil {
-			return err
-		}
-		spec, err := setupSpec(context)
-		if err != nil {
-			return err
-		}
-		status, err := startContainer(context, spec, CT_ACT_CREATE, nil)
-		if err != nil {
-			return err
-		}
-		// exit with the container's exit status so any external supervisor is
-		// notified of the exit with the correct exit status.
-		os.Exit(status)
-		return nil
-	},
-}

vendor/github.com/opencontainers/runc/delete.go

@@ -1,90 +1,38 @@
-// +build !solaris
-
 package main
 
 import (
-	"fmt"
 	"os"
 	"path/filepath"
-	"syscall"
-	"time"
 
+	"github.com/codegangsta/cli"
 	"github.com/opencontainers/runc/libcontainer"
-	"github.com/urfave/cli"
-
-	"golang.org/x/sys/unix"
 )
 
-func killContainer(container libcontainer.Container) error {
-	_ = container.Signal(unix.SIGKILL, false)
-	for i := 0; i < 100; i++ {
-		time.Sleep(100 * time.Millisecond)
-		if err := container.Signal(syscall.Signal(0), false); err != nil {
-			destroy(container)
-			return nil
-		}
-	}
-	return fmt.Errorf("container init still running")
-}
-
 var deleteCommand = cli.Command{
 	Name:  "delete",
-	Usage: "delete any resources held by the container often used with detached container",
+	Usage: "delete any resources held by the container often used with detached containers",
 	ArgsUsage: `<container-id>
 
 Where "<container-id>" is the name for the instance of the container.
-
-EXAMPLE:
+	 
 For example, if the container id is "ubuntu01" and runc list currently shows the
-status of "ubuntu01" as "stopped" the following will delete resources held for
-"ubuntu01" removing "ubuntu01" from the runc list of containers:
-
+status of "ubuntu01" as "destroyed" the following will delete resources held for
+"ubuntu01" removing "ubuntu01" from the runc list of containers:  
+	 
        # runc delete ubuntu01`,
-	Flags: []cli.Flag{
-		cli.BoolFlag{
-			Name:  "force, f",
-			Usage: "Forcibly deletes the container if it is still running (uses SIGKILL)",
-		},
-	},
-	Action: func(context *cli.Context) error {
-		if err := checkArgs(context, 1, exactArgs); err != nil {
-			return err
-		}
-
-		id := context.Args().First()
-		force := context.Bool("force")
+	Action: func(context *cli.Context) {
 		container, err := getContainer(context)
 		if err != nil {
 			if lerr, ok := err.(libcontainer.Error); ok && lerr.Code() == libcontainer.ContainerNotExists {
 				// if there was an aborted start or something of the sort then the container's directory could exist but
 				// libcontainer does not see it because the state.json file inside that directory was never created.
-				path := filepath.Join(context.GlobalString("root"), id)
-				if e := os.RemoveAll(path); e != nil {
-					fmt.Fprintf(os.Stderr, "remove %s: %v\n", path, e)
-				}
-				if force {
-					return nil
+				path := filepath.Join(context.GlobalString("root"), context.Args().First())
+				if err := os.RemoveAll(path); err == nil {
+					return
 				}
 			}
-			return err
+			fatal(err)
 		}
-		s, err := container.Status()
-		if err != nil {
-			return err
-		}
-		switch s {
-		case libcontainer.Stopped:
-			destroy(container)
-		case libcontainer.Created:
-			return killContainer(container)
-		default:
-			if force {
-				return killContainer(container)
-			} else {
-				return fmt.Errorf("cannot delete container %s that is not stopped: %s\n", id, s)
-			}
-		}
-
-		return nil
+		destroy(container)
 	},
 }

vendor/github.com/opencontainers/runc/events.go

@@ -4,16 +4,13 @@ package main
 
 import (
 	"encoding/json"
-	"fmt"
 	"os"
 	"sync"
 	"time"
 
+	"github.com/Sirupsen/logrus"
+	"github.com/codegangsta/cli"
 	"github.com/opencontainers/runc/libcontainer"
-	"github.com/opencontainers/runc/libcontainer/cgroups"
-
-	"github.com/sirupsen/logrus"
-	"github.com/urfave/cli"
 )
 
 // event struct for encoding the event data to json.
@@ -23,82 +20,9 @@ type event struct {
 	Data interface{} `json:"data,omitempty"`
 }
 
-// stats is the runc specific stats structure for stability when encoding and decoding stats.
-type stats struct {
-	CPU     cpu                `json:"cpu"`
-	Memory  memory             `json:"memory"`
-	Pids    pids               `json:"pids"`
-	Blkio   blkio              `json:"blkio"`
-	Hugetlb map[string]hugetlb `json:"hugetlb"`
-}
-
-type hugetlb struct {
-	Usage   uint64 `json:"usage,omitempty"`
-	Max     uint64 `json:"max,omitempty"`
-	Failcnt uint64 `json:"failcnt"`
-}
-
-type blkioEntry struct {
-	Major uint64 `json:"major,omitempty"`
-	Minor uint64 `json:"minor,omitempty"`
-	Op    string `json:"op,omitempty"`
-	Value uint64 `json:"value,omitempty"`
-}
-
-type blkio struct {
-	IoServiceBytesRecursive []blkioEntry `json:"ioServiceBytesRecursive,omitempty"`
-	IoServicedRecursive     []blkioEntry `json:"ioServicedRecursive,omitempty"`
-	IoQueuedRecursive       []blkioEntry `json:"ioQueueRecursive,omitempty"`
-	IoServiceTimeRecursive  []blkioEntry `json:"ioServiceTimeRecursive,omitempty"`
-	IoWaitTimeRecursive     []blkioEntry `json:"ioWaitTimeRecursive,omitempty"`
-	IoMergedRecursive       []blkioEntry `json:"ioMergedRecursive,omitempty"`
-	IoTimeRecursive         []blkioEntry `json:"ioTimeRecursive,omitempty"`
-	SectorsRecursive        []blkioEntry `json:"sectorsRecursive,omitempty"`
-}
-
-type pids struct {
-	Current uint64 `json:"current,omitempty"`
-	Limit   uint64 `json:"limit,omitempty"`
-}
-
-type throttling struct {
-	Periods          uint64 `json:"periods,omitempty"`
-	ThrottledPeriods uint64 `json:"throttledPeriods,omitempty"`
-	ThrottledTime    uint64 `json:"throttledTime,omitempty"`
-}
-
-type cpuUsage struct {
-	// Units: nanoseconds.
-	Total  uint64   `json:"total,omitempty"`
-	Percpu []uint64 `json:"percpu,omitempty"`
-	Kernel uint64   `json:"kernel"`
-	User   uint64   `json:"user"`
-}
-
-type cpu struct {
-	Usage      cpuUsage   `json:"usage,omitempty"`
-	Throttling throttling `json:"throttling,omitempty"`
-}
-
-type memoryEntry struct {
-	Limit   uint64 `json:"limit"`
-	Usage   uint64 `json:"usage,omitempty"`
-	Max     uint64 `json:"max,omitempty"`
-	Failcnt uint64 `json:"failcnt"`
-}
-
-type memory struct {
-	Cache     uint64            `json:"cache,omitempty"`
-	Usage     memoryEntry       `json:"usage,omitempty"`
-	Swap      memoryEntry       `json:"swap,omitempty"`
-	Kernel    memoryEntry       `json:"kernel,omitempty"`
-	KernelTCP memoryEntry       `json:"kernelTCP,omitempty"`
-	Raw       map[string]uint64 `json:"raw,omitempty"`
-}
-
 var eventsCommand = cli.Command{
 	Name:  "events",
-	Usage: "display container events such as OOM notifications, cpu, memory, and IO usage statistics",
+	Usage: "display container events such as OOM notifications, cpu, memory, IO and network stats",
 	ArgsUsage: `<container-id>
 
 Where "<container-id>" is the name for the instance of the container.`,
@@ -108,24 +32,10 @@ information is displayed once every 5 seconds.`,
 		cli.DurationFlag{Name: "interval", Value: 5 * time.Second, Usage: "set the stats collection interval"},
 		cli.BoolFlag{Name: "stats", Usage: "display the container's stats then exit"},
 	},
-	Action: func(context *cli.Context) error {
-		if err := checkArgs(context, 1, exactArgs); err != nil {
-			return err
-		}
+	Action: func(context *cli.Context) {
 		container, err := getContainer(context)
 		if err != nil {
-			return err
-		}
-		duration := context.Duration("interval")
-		if duration <= 0 {
-			return fmt.Errorf("duration interval must be greater than 0")
-		}
-		status, err := container.Status()
-		if err != nil {
-			return err
-		}
-		if status == libcontainer.Stopped {
-			return fmt.Errorf("container with id %s is not running", container.ID())
+			fatal(err)
 		}
 		var (
 			stats  = make(chan *libcontainer.Stats, 1)
@@ -145,12 +55,12 @@ information is displayed once every 5 seconds.`,
 		if context.Bool("stats") {
 			s, err := container.Stats()
 			if err != nil {
-				return err
+				fatal(err)
 			}
-			events <- &event{Type: "stats", ID: container.ID(), Data: convertLibcontainerStats(s)}
+			events <- &event{Type: "stats", ID: container.ID(), Data: s}
 			close(events)
 			group.Wait()
-			return nil
+			return
 		}
 		go func() {
 			for range time.Tick(context.Duration("interval")) {
@@ -164,7 +74,7 @@ information is displayed once every 5 seconds.`,
 		}()
 		n, err := container.NotifyOOM()
 		if err != nil {
-			return err
+			fatal(err)
 		}
 		for {
 			select {
@@ -178,7 +88,7 @@ information is displayed once every 5 seconds.`,
 					n = nil
 				}
 			case s := <-stats:
-				events <- &event{Type: "stats", ID: container.ID(), Data: convertLibcontainerStats(s)}
+				events <- &event{Type: "stats", ID: container.ID(), Data: s}
 			}
 			if n == nil {
 				close(events)
@@ -186,76 +96,5 @@ information is displayed once every 5 seconds.`,
 			}
 		}
 		group.Wait()
-		return nil
 	},
 }
-
-func convertLibcontainerStats(ls *libcontainer.Stats) *stats {
-	cg := ls.CgroupStats
-	if cg == nil {
-		return nil
-	}
-	var s stats
-	s.Pids.Current = cg.PidsStats.Current
-	s.Pids.Limit = cg.PidsStats.Limit
-
-	s.CPU.Usage.Kernel = cg.CpuStats.CpuUsage.UsageInKernelmode
-	s.CPU.Usage.User = cg.CpuStats.CpuUsage.UsageInUsermode
-	s.CPU.Usage.Total = cg.CpuStats.CpuUsage.TotalUsage
-	s.CPU.Usage.Percpu = cg.CpuStats.CpuUsage.PercpuUsage
-	s.CPU.Throttling.Periods = cg.CpuStats.ThrottlingData.Periods
-	s.CPU.Throttling.ThrottledPeriods = cg.CpuStats.ThrottlingData.ThrottledPeriods
-	s.CPU.Throttling.ThrottledTime = cg.CpuStats.ThrottlingData.ThrottledTime
-
-	s.Memory.Cache = cg.MemoryStats.Cache
-	s.Memory.Kernel = convertMemoryEntry(cg.MemoryStats.KernelUsage)
-	s.Memory.KernelTCP = convertMemoryEntry(cg.MemoryStats.KernelTCPUsage)
-	s.Memory.Swap = convertMemoryEntry(cg.MemoryStats.SwapUsage)
-	s.Memory.Usage = convertMemoryEntry(cg.MemoryStats.Usage)
-	s.Memory.Raw = cg.MemoryStats.Stats
-
-	s.Blkio.IoServiceBytesRecursive = convertBlkioEntry(cg.BlkioStats.IoServiceBytesRecursive)
-	s.Blkio.IoServicedRecursive = convertBlkioEntry(cg.BlkioStats.IoServicedRecursive)
-	s.Blkio.IoQueuedRecursive = convertBlkioEntry(cg.BlkioStats.IoQueuedRecursive)
-	s.Blkio.IoServiceTimeRecursive = convertBlkioEntry(cg.BlkioStats.IoServiceTimeRecursive)
-	s.Blkio.IoWaitTimeRecursive = convertBlkioEntry(cg.BlkioStats.IoWaitTimeRecursive)
-	s.Blkio.IoMergedRecursive = convertBlkioEntry(cg.BlkioStats.IoMergedRecursive)
-	s.Blkio.IoTimeRecursive = convertBlkioEntry(cg.BlkioStats.IoTimeRecursive)
-	s.Blkio.SectorsRecursive = convertBlkioEntry(cg.BlkioStats.SectorsRecursive)
-
-	s.Hugetlb = make(map[string]hugetlb)
-	for k, v := range cg.HugetlbStats {
-		s.Hugetlb[k] = convertHugtlb(v)
-	}
-	return &s
-}
-
-func convertHugtlb(c cgroups.HugetlbStats) hugetlb {
-	return hugetlb{
-		Usage:   c.Usage,
-		Max:     c.MaxUsage,
-		Failcnt: c.Failcnt,
-	}
-}
-
-func convertMemoryEntry(c cgroups.MemoryData) memoryEntry {
-	return memoryEntry{
-		Limit:   c.Limit,
-		Usage:   c.Usage,
-		Max:     c.MaxUsage,
-		Failcnt: c.Failcnt,
-	}
-}
-
-func convertBlkioEntry(c []cgroups.BlkioStatEntry) []blkioEntry {
-	var out []blkioEntry
-	for _, e := range c {
-		out = append(out, blkioEntry{
-			Major: e.Major,
-			Minor: e.Minor,
-			Op:    e.Op,
-			Value: e.Value,
-		})
-	}
-	return out
-}

vendor/github.com/opencontainers/runc/exec.go

@@ -9,30 +9,27 @@ import (
 	"strconv"
 	"strings"
 
-	"github.com/opencontainers/runc/libcontainer"
+	"github.com/codegangsta/cli"
 	"github.com/opencontainers/runc/libcontainer/utils"
 	"github.com/opencontainers/runtime-spec/specs-go"
-	"github.com/urfave/cli"
 )
 
 var execCommand = cli.Command{
 	Name:  "exec",
 	Usage: "execute new process inside the container",
-	ArgsUsage: `<container-id> <command> [command options]  || -p process.json <container-id>
+	ArgsUsage: `<container-id> <container command>
 
 Where "<container-id>" is the name for the instance of the container and
-"<command>" is the command to be executed in the container.
-"<command>" can't be empty unless a "-p" flag provided.
+"<container command>" is the command to be executed in the container.
 
-EXAMPLE:
 For example, if the container is configured to run the linux ps command the
 following will output a list of processes running in the container:
-
+	 
        # runc exec <container-id> ps`,
 	Flags: []cli.Flag{
 		cli.StringFlag{
-			Name:  "console-socket",
-			Usage: "path to an AF_UNIX socket which will receive a file descriptor referencing the master end of the console's pseudoterminal",
+			Name:  "console",
+			Usage: "specify the pty slave path for use with the container",
 		},
 		cli.StringFlag{
 			Name:  "cwd",
@@ -81,25 +78,20 @@ following will output a list of processes running in the container:
 			Usage: "add a capability to the bounding set for the process",
 		},
 		cli.BoolFlag{
-			Name:   "no-subreaper",
-			Usage:  "disable the use of the subreaper used to reap reparented processes",
-			Hidden: true,
+			Name:  "no-subreaper",
+			Usage: "disable the use of the subreaper used to reap reparented processes",
 		},
 	},
-	Action: func(context *cli.Context) error {
-		if err := checkArgs(context, 1, minArgs); err != nil {
-			return err
-		}
-		if err := revisePidFile(context); err != nil {
-			return err
+	Action: func(context *cli.Context) {
+		if os.Geteuid() != 0 {
+			fatalf("runc should be run as root")
 		}
 		status, err := execProcess(context)
-		if err == nil {
-			os.Exit(status)
+		if err != nil {
+			fatalf("exec failed: %v", err)
 		}
-		return fmt.Errorf("exec failed: %v", err)
+		os.Exit(status)
 	},
-	SkipArgReorder: true,
 }
 
 func execProcess(context *cli.Context) (int, error) {
@@ -107,17 +99,6 @@ func execProcess(context *cli.Context) (int, error) {
 	if err != nil {
 		return -1, err
 	}
-	status, err := container.Status()
-	if err != nil {
-		return -1, err
-	}
-	if status == libcontainer.Stopped {
-		return -1, fmt.Errorf("cannot exec a container that has stopped")
-	}
-	path := context.String("process")
-	if path == "" && len(context.Args()) == 1 {
-		return -1, fmt.Errorf("process args cannot be empty")
-	}
 	detach := context.Bool("detach")
 	state, err := container.State()
 	if err != nil {
@@ -129,13 +110,12 @@ func execProcess(context *cli.Context) (int, error) {
 		return -1, err
 	}
 	r := &runner{
-		enableSubreaper: false,
+		enableSubreaper: !context.Bool("no-subreaper"),
 		shouldDestroy:   false,
 		container:       container,
-		consoleSocket:   context.String("console-socket"),
+		console:         context.String("console"),
 		detach:          detach,
 		pidFile:         context.String("pid-file"),
-		action:          CT_ACT_RUN,
 	}
 	return r.run(p)
 }
@@ -174,17 +154,12 @@ func getProcess(context *cli.Context, bundle string) (*specs.Process, error) {
 		p.SelinuxLabel = l
 	}
 	if caps := context.StringSlice("cap"); len(caps) > 0 {
-		for _, c := range caps {
-			p.Capabilities.Bounding = append(p.Capabilities.Bounding, c)
-			p.Capabilities.Inheritable = append(p.Capabilities.Inheritable, c)
-			p.Capabilities.Effective = append(p.Capabilities.Effective, c)
-			p.Capabilities.Permitted = append(p.Capabilities.Permitted, c)
-			p.Capabilities.Ambient = append(p.Capabilities.Ambient, c)
-		}
+		p.Capabilities = caps
 	}
 	// append the passed env variables
-	p.Env = append(p.Env, context.StringSlice("env")...)
-
+	for _, e := range context.StringSlice("env") {
+		p.Env = append(p.Env, e)
+	}
 	// set the tty
 	if context.IsSet("tty") {
 		p.Terminal = context.Bool("tty")
@@ -208,5 +183,5 @@ func getProcess(context *cli.Context, bundle string) (*specs.Process, error) {
 		}
 		p.User.UID = uint32(uid)
 	}
-	return p, nil
+	return &p, nil
 }

vendor/github.com/opencontainers/runc/init.go

@@ -1,31 +0,0 @@
-package main
-
-import (
-	"os"
-	"runtime"
-
-	"github.com/opencontainers/runc/libcontainer"
-	_ "github.com/opencontainers/runc/libcontainer/nsenter"
-	"github.com/urfave/cli"
-)
-
-func init() {
-	if len(os.Args) > 1 && os.Args[1] == "init" {
-		runtime.GOMAXPROCS(1)
-		runtime.LockOSThread()
-	}
-}
-
-var initCommand = cli.Command{
-	Name:  "init",
-	Usage: `initialize the namespaces and launch the process (do not call it outside of runc)`,
-	Action: func(context *cli.Context) error {
-		factory, _ := libcontainer.New("")
-		if err := factory.StartInitialization(); err != nil {
-			// as the error is sent back to the parent there is no need to log
-			// or write it to stderr because the parent process will handle this
-			os.Exit(1)
-		}
-		panic("libcontainer: container init failed to exec")
-	},
-}

vendor/github.com/opencontainers/runc/kill.go

@@ -8,78 +8,63 @@ import (
 	"strings"
 	"syscall"
 
-	"golang.org/x/sys/unix"
-
-	"github.com/urfave/cli"
+	"github.com/codegangsta/cli"
 )
 
 var signalMap = map[string]syscall.Signal{
-	"ABRT":   unix.SIGABRT,
-	"ALRM":   unix.SIGALRM,
-	"BUS":    unix.SIGBUS,
-	"CHLD":   unix.SIGCHLD,
-	"CLD":    unix.SIGCLD,
-	"CONT":   unix.SIGCONT,
-	"FPE":    unix.SIGFPE,
-	"HUP":    unix.SIGHUP,
-	"ILL":    unix.SIGILL,
-	"INT":    unix.SIGINT,
-	"IO":     unix.SIGIO,
-	"IOT":    unix.SIGIOT,
-	"KILL":   unix.SIGKILL,
-	"PIPE":   unix.SIGPIPE,
-	"POLL":   unix.SIGPOLL,
-	"PROF":   unix.SIGPROF,
-	"PWR":    unix.SIGPWR,
-	"QUIT":   unix.SIGQUIT,
-	"SEGV":   unix.SIGSEGV,
-	"STKFLT": unix.SIGSTKFLT,
-	"STOP":   unix.SIGSTOP,
-	"SYS":    unix.SIGSYS,
-	"TERM":   unix.SIGTERM,
-	"TRAP":   unix.SIGTRAP,
-	"TSTP":   unix.SIGTSTP,
-	"TTIN":   unix.SIGTTIN,
-	"TTOU":   unix.SIGTTOU,
-	"UNUSED": unix.SIGUNUSED,
-	"URG":    unix.SIGURG,
-	"USR1":   unix.SIGUSR1,
-	"USR2":   unix.SIGUSR2,
-	"VTALRM": unix.SIGVTALRM,
-	"WINCH":  unix.SIGWINCH,
-	"XCPU":   unix.SIGXCPU,
-	"XFSZ":   unix.SIGXFSZ,
+	"ABRT":   syscall.SIGABRT,
+	"ALRM":   syscall.SIGALRM,
+	"BUS":    syscall.SIGBUS,
+	"CHLD":   syscall.SIGCHLD,
+	"CLD":    syscall.SIGCLD,
+	"CONT":   syscall.SIGCONT,
+	"FPE":    syscall.SIGFPE,
+	"HUP":    syscall.SIGHUP,
+	"ILL":    syscall.SIGILL,
+	"INT":    syscall.SIGINT,
+	"IO":     syscall.SIGIO,
+	"IOT":    syscall.SIGIOT,
+	"KILL":   syscall.SIGKILL,
+	"PIPE":   syscall.SIGPIPE,
+	"POLL":   syscall.SIGPOLL,
+	"PROF":   syscall.SIGPROF,
+	"PWR":    syscall.SIGPWR,
+	"QUIT":   syscall.SIGQUIT,
+	"SEGV":   syscall.SIGSEGV,
+	"STKFLT": syscall.SIGSTKFLT,
+	"STOP":   syscall.SIGSTOP,
+	"SYS":    syscall.SIGSYS,
+	"TERM":   syscall.SIGTERM,
+	"TRAP":   syscall.SIGTRAP,
+	"TSTP":   syscall.SIGTSTP,
+	"TTIN":   syscall.SIGTTIN,
+	"TTOU":   syscall.SIGTTOU,
+	"UNUSED": syscall.SIGUNUSED,
+	"URG":    syscall.SIGURG,
+	"USR1":   syscall.SIGUSR1,
+	"USR2":   syscall.SIGUSR2,
+	"VTALRM": syscall.SIGVTALRM,
+	"WINCH":  syscall.SIGWINCH,
+	"XCPU":   syscall.SIGXCPU,
+	"XFSZ":   syscall.SIGXFSZ,
 }
 
 var killCommand = cli.Command{
 	Name:  "kill",
 	Usage: "kill sends the specified signal (default: SIGTERM) to the container's init process",
-	ArgsUsage: `<container-id> [signal]
+	ArgsUsage: `<container-id> <signal>
 
 Where "<container-id>" is the name for the instance of the container and
-"[signal]" is the signal to be sent to the init process.
-
-EXAMPLE:
+"<signal>" is the signal to be sent to the init process.
+	 
 For example, if the container id is "ubuntu01" the following will send a "KILL"
 signal to the init process of the "ubuntu01" container:
 	 
        # runc kill ubuntu01 KILL`,
-	Flags: []cli.Flag{
-		cli.BoolFlag{
-			Name:  "all, a",
-			Usage: "send the specified signal to all processes inside the container",
-		},
-	},
-	Action: func(context *cli.Context) error {
-		if err := checkArgs(context, 1, minArgs); err != nil {
-			return err
-		}
-		if err := checkArgs(context, 2, maxArgs); err != nil {
-			return err
-		}
+	Action: func(context *cli.Context) {
 		container, err := getContainer(context)
 		if err != nil {
-			return err
+			fatal(err)
 		}
 
 		sigstr := context.Args().Get(1)
@@ -89,25 +74,19 @@ signal to the init process of the "ubuntu01" container:
 
 		signal, err := parseSignal(sigstr)
 		if err != nil {
-			return err
+			fatal(err)
 		}
-		if err := container.Signal(signal, context.Bool("all")); err != nil {
-			return err
+
+		if err := container.Signal(signal); err != nil {
+			fatal(err)
 		}
-		return nil
 	},
 }
 
 func parseSignal(rawSignal string) (syscall.Signal, error) {
 	s, err := strconv.Atoi(rawSignal)
 	if err == nil {
-		sig := syscall.Signal(s)
-		for _, msig := range signalMap {
-			if sig == msig {
-				return sig, nil
-			}
-		}
-		return -1, fmt.Errorf("unknown signal %q", rawSignal)
+		return syscall.Signal(s), nil
 	}
 	signal, ok := signalMap[strings.TrimPrefix(strings.ToUpper(rawSignal), "SIG")]
 	if !ok {

vendor/github.com/opencontainers/runc/libcontainer/README.md

@@ -1,7 +1,3 @@
-# libcontainer
-
-[![GoDoc](https://godoc.org/github.com/opencontainers/runc/libcontainer?status.svg)](https://godoc.org/github.com/opencontainers/runc/libcontainer)
-
 Libcontainer provides a native Go implementation for creating containers
 with namespaces, cgroups, capabilities, and filesystem access controls.
 It allows you to manage the lifecycle of the container performing additional operations
@@ -20,14 +16,7 @@ the current binary (/proc/self/exe) to be executed as the init process, and use
 arg "init", we call the first step process "bootstrap", so you always need a "init"
 function as the entry of "bootstrap".
 
-In addition to the go init function the early stage bootstrap is handled by importing
-[nsenter](https://github.com/opencontainers/runc/blob/master/libcontainer/nsenter/README.md).
-
 ```go
-import (
-	_ "github.com/opencontainers/runc/libcontainer/nsenter"
-)
-
 func init() {
 	if len(os.Args) > 1 && os.Args[1] == "init" {
 		runtime.GOMAXPROCS(1)
@@ -56,91 +45,25 @@ Once you have an instance of the factory created we can create a configuration
 struct describing how the container is to be created. A sample would look similar to this:
 
 ```go
-defaultMountFlags := unix.MS_NOEXEC | unix.MS_NOSUID | unix.MS_NODEV
+defaultMountFlags := syscall.MS_NOEXEC | syscall.MS_NOSUID | syscall.MS_NODEV
 config := &configs.Config{
 	Rootfs: "/your/path/to/rootfs",
-	Capabilities: &configs.Capabilities{
-                Bounding: []string{
-                        "CAP_CHOWN",
-                        "CAP_DAC_OVERRIDE",
-                        "CAP_FSETID",
-                        "CAP_FOWNER",
-                        "CAP_MKNOD",
-                        "CAP_NET_RAW",
-                        "CAP_SETGID",
-                        "CAP_SETUID",
-                        "CAP_SETFCAP",
-                        "CAP_SETPCAP",
-                        "CAP_NET_BIND_SERVICE",
-                        "CAP_SYS_CHROOT",
-                        "CAP_KILL",
-                        "CAP_AUDIT_WRITE",
-                },
-                Effective: []string{
-                        "CAP_CHOWN",
-                        "CAP_DAC_OVERRIDE",
-                        "CAP_FSETID",
-                        "CAP_FOWNER",
-                        "CAP_MKNOD",
-                        "CAP_NET_RAW",
-                        "CAP_SETGID",
-                        "CAP_SETUID",
-                        "CAP_SETFCAP",
-                        "CAP_SETPCAP",
-                        "CAP_NET_BIND_SERVICE",
-                        "CAP_SYS_CHROOT",
-                        "CAP_KILL",
-                        "CAP_AUDIT_WRITE",
-                },
-                Inheritable: []string{
-                        "CAP_CHOWN",
-                        "CAP_DAC_OVERRIDE",
-                        "CAP_FSETID",
-                        "CAP_FOWNER",
-                        "CAP_MKNOD",
-                        "CAP_NET_RAW",
-                        "CAP_SETGID",
-                        "CAP_SETUID",
-                        "CAP_SETFCAP",
-                        "CAP_SETPCAP",
-                        "CAP_NET_BIND_SERVICE",
-                        "CAP_SYS_CHROOT",
-                        "CAP_KILL",
-                        "CAP_AUDIT_WRITE",
-                },
-                Permitted: []string{
-                        "CAP_CHOWN",
-                        "CAP_DAC_OVERRIDE",
-                        "CAP_FSETID",
-                        "CAP_FOWNER",
-                        "CAP_MKNOD",
-                        "CAP_NET_RAW",
-                        "CAP_SETGID",
-                        "CAP_SETUID",
-                        "CAP_SETFCAP",
-                        "CAP_SETPCAP",
-                        "CAP_NET_BIND_SERVICE",
-                        "CAP_SYS_CHROOT",
-                        "CAP_KILL",
-                        "CAP_AUDIT_WRITE",
-                },
-                Ambient: []string{
-                        "CAP_CHOWN",
-                        "CAP_DAC_OVERRIDE",
-                        "CAP_FSETID",
-                        "CAP_FOWNER",
-                        "CAP_MKNOD",
-                        "CAP_NET_RAW",
-                        "CAP_SETGID",
-                        "CAP_SETUID",
-                        "CAP_SETFCAP",
-                        "CAP_SETPCAP",
-                        "CAP_NET_BIND_SERVICE",
-                        "CAP_SYS_CHROOT",
-                        "CAP_KILL",
-                        "CAP_AUDIT_WRITE",
-                },
-        },
+	Capabilities: []string{
+		"CAP_CHOWN",
+		"CAP_DAC_OVERRIDE",
+		"CAP_FSETID",
+		"CAP_FOWNER",
+		"CAP_MKNOD",
+		"CAP_NET_RAW",
+		"CAP_SETGID",
+		"CAP_SETUID",
+		"CAP_SETFCAP",
+		"CAP_SETPCAP",
+		"CAP_NET_BIND_SERVICE",
+		"CAP_SYS_CHROOT",
+		"CAP_KILL",
+		"CAP_AUDIT_WRITE",
+	},
 	Namespaces: configs.Namespaces([]configs.Namespace{
 		{Type: configs.NEWNS},
 		{Type: configs.NEWUTS},
@@ -154,13 +77,12 @@ config := &configs.Config{
 		Parent: "system",
 		Resources: &configs.Resources{
 			MemorySwappiness: nil,
-			AllowAllDevices:  nil,
+			AllowAllDevices:  false,
 			AllowedDevices:   configs.DefaultAllowedDevices,
 		},
 	},
 	MaskPaths: []string{
 		"/proc/kcore",
-		"/sys/firmware",
 	},
 	ReadonlyPaths: []string{
 		"/proc/sys", "/proc/sysrq-trigger", "/proc/irq", "/proc/bus",
@@ -178,14 +100,14 @@ config := &configs.Config{
 			Source:      "tmpfs",
 			Destination: "/dev",
 			Device:      "tmpfs",
-			Flags:       unix.MS_NOSUID | unix.MS_STRICTATIME,
+			Flags:       syscall.MS_NOSUID | syscall.MS_STRICTATIME,
 			Data:        "mode=755",
 		},
 		{
 			Source:      "devpts",
 			Destination: "/dev/pts",
 			Device:      "devpts",
-			Flags:       unix.MS_NOSUID | unix.MS_NOEXEC,
+			Flags:       syscall.MS_NOSUID | syscall.MS_NOEXEC,
 			Data:        "newinstance,ptmxmode=0666,mode=0620,gid=5",
 		},
 		{
@@ -205,7 +127,7 @@ config := &configs.Config{
 			Source:      "sysfs",
 			Destination: "/sys",
 			Device:      "sysfs",
-			Flags:       defaultMountFlags | unix.MS_RDONLY,
+			Flags:       defaultMountFlags | syscall.MS_RDONLY,
 		},
 	},
 	UidMappings: []configs.IDMap{
@@ -231,7 +153,7 @@ config := &configs.Config{
 	},
 	Rlimits: []configs.Rlimit{
 		{
-			Type: unix.RLIMIT_NOFILE,
+			Type: syscall.RLIMIT_NOFILE,
 			Hard: uint64(1025),
 			Soft: uint64(1025),
 		},
@@ -262,10 +184,10 @@ process := &libcontainer.Process{
 	Stderr: os.Stderr,
 }
 
-err := container.Run(process)
+err := container.Start(process)
 if err != nil {
-	container.Destroy()
 	logrus.Fatal(err)
+	container.Destroy()
 	return
 }
 
@@ -297,15 +219,6 @@ container.Resume()
 
 // send signal to container's init process.
 container.Signal(signal)
-
-// update container resource constraints.
-container.Set(config)
-
-// get current status of the container.
-status, err := container.Status()
-
-// get current container's state information.
-state, err := container.State()
 ```
 
 

vendor/github.com/opencontainers/runc/libcontainer/SPEC.md

@@ -71,6 +71,7 @@ that are required for executing a container's process.
 | /dev/tty     | 0666 |  rwm       |
 | /dev/random  | 0666 |  rwm       |
 | /dev/urandom | 0666 |  rwm       |
+| /dev/fuse    | 0666 |  rwm       |
 
 
 **ptmx**
@@ -89,7 +90,7 @@ in tmpfs.
 
 After `/dev/null` has been setup we check for any external links between
 the container's io, STDIN, STDOUT, STDERR.  If the container's io is pointing
-to `/dev/null` outside the container we close and `dup2` the `/dev/null` 
+to `/dev/null` outside the container we close and `dup2` the the `/dev/null` 
 that is local to the container's rootfs.
 
 
@@ -296,7 +297,7 @@ a container.
 | -------------- | ------------------------------------------------------------------ |
 | Get processes  | Return all the pids for processes running inside a container       | 
 | Get Stats      | Return resource statistics for the container as a whole            |
-| Wait           | Waits on the container's init process ( pid 1 )                    |
+| Wait           | Wait waits on the container's init process ( pid 1 )               |
 | Wait Process   | Wait on any of the container's processes returning the exit status | 
 | Destroy        | Kill the container's init process and remove any filesystem state  |
 | Signal         | Send a signal to the container's init process                      |

vendor/github.com/opencontainers/runc/libcontainer/apparmor/apparmor.go

@@ -7,7 +7,6 @@ package apparmor
 // #include <stdlib.h>
 import "C"
 import (
-	"fmt"
 	"io/ioutil"
 	"os"
 	"unsafe"
@@ -33,7 +32,7 @@ func ApplyProfile(name string) error {
 	cName := C.CString(name)
 	defer C.free(unsafe.Pointer(cName))
 	if _, err := C.aa_change_onexec(cName); err != nil {
-		return fmt.Errorf("apparmor failed to apply profile: %s", err)
+		return err
 	}
 	return nil
 }

vendor/github.com/opencontainers/runc/libcontainer/capabilities_linux.go

@@ -7,11 +7,10 @@ import (
 	"os"
 	"strings"
 
-	"github.com/opencontainers/runc/libcontainer/configs"
 	"github.com/syndtr/gocapability/capability"
 )
 
-const allCapabilityTypes = capability.CAPS | capability.BOUNDS | capability.AMBS
+const allCapabilityTypes = capability.CAPS | capability.BOUNDS
 
 var capabilityMap map[string]capability.Cap
 
@@ -31,84 +30,40 @@ func init() {
 	}
 }
 
-func newContainerCapList(capConfig *configs.Capabilities) (*containerCapabilities, error) {
-	bounding := []capability.Cap{}
-	for _, c := range capConfig.Bounding {
+func newCapWhitelist(caps []string) (*whitelist, error) {
+	l := []capability.Cap{}
+	for _, c := range caps {
 		v, ok := capabilityMap[c]
 		if !ok {
 			return nil, fmt.Errorf("unknown capability %q", c)
 		}
-		bounding = append(bounding, v)
-	}
-	effective := []capability.Cap{}
-	for _, c := range capConfig.Effective {
-		v, ok := capabilityMap[c]
-		if !ok {
-			return nil, fmt.Errorf("unknown capability %q", c)
-		}
-		effective = append(effective, v)
-	}
-	inheritable := []capability.Cap{}
-	for _, c := range capConfig.Inheritable {
-		v, ok := capabilityMap[c]
-		if !ok {
-			return nil, fmt.Errorf("unknown capability %q", c)
-		}
-		inheritable = append(inheritable, v)
-	}
-	permitted := []capability.Cap{}
-	for _, c := range capConfig.Permitted {
-		v, ok := capabilityMap[c]
-		if !ok {
-			return nil, fmt.Errorf("unknown capability %q", c)
-		}
-		permitted = append(permitted, v)
-	}
-	ambient := []capability.Cap{}
-	for _, c := range capConfig.Ambient {
-		v, ok := capabilityMap[c]
-		if !ok {
-			return nil, fmt.Errorf("unknown capability %q", c)
-		}
-		ambient = append(ambient, v)
+		l = append(l, v)
 	}
 	pid, err := capability.NewPid(os.Getpid())
 	if err != nil {
 		return nil, err
 	}
-	return &containerCapabilities{
-		bounding:    bounding,
-		effective:   effective,
-		inheritable: inheritable,
-		permitted:   permitted,
-		ambient:     ambient,
-		pid:         pid,
+	return &whitelist{
+		keep: l,
+		pid:  pid,
 	}, nil
 }
 
-type containerCapabilities struct {
-	pid         capability.Capabilities
-	bounding    []capability.Cap
-	effective   []capability.Cap
-	inheritable []capability.Cap
-	permitted   []capability.Cap
-	ambient     []capability.Cap
+type whitelist struct {
+	pid  capability.Capabilities
+	keep []capability.Cap
 }
 
-// ApplyBoundingSet sets the capability bounding set to those specified in the whitelist.
-func (c *containerCapabilities) ApplyBoundingSet() error {
-	c.pid.Clear(capability.BOUNDS)
-	c.pid.Set(capability.BOUNDS, c.bounding...)
-	return c.pid.Apply(capability.BOUNDS)
+// dropBoundingSet drops the capability bounding set to those specified in the whitelist.
+func (w *whitelist) dropBoundingSet() error {
+	w.pid.Clear(capability.BOUNDS)
+	w.pid.Set(capability.BOUNDS, w.keep...)
+	return w.pid.Apply(capability.BOUNDS)
 }
 
-// Apply sets all the capabilities for the current process in the config.
-func (c *containerCapabilities) ApplyCaps() error {
-	c.pid.Clear(allCapabilityTypes)
-	c.pid.Set(capability.BOUNDS, c.bounding...)
-	c.pid.Set(capability.PERMITTED, c.permitted...)
-	c.pid.Set(capability.INHERITABLE, c.inheritable...)
-	c.pid.Set(capability.EFFECTIVE, c.effective...)
-	c.pid.Set(capability.AMBIENT, c.ambient...)
-	return c.pid.Apply(allCapabilityTypes)
+// drop drops all capabilities for the current process except those specified in the whitelist.
+func (w *whitelist) drop() error {
+	w.pid.Clear(allCapabilityTypes)
+	w.pid.Set(allCapabilityTypes, w.keep...)
+	return w.pid.Apply(allCapabilityTypes)
 }

vendor/github.com/opencontainers/runc/libcontainer/cgroups/cgroups.go

@@ -27,9 +27,9 @@ type Manager interface {
 	// Destroys the cgroup set
 	Destroy() error
 
-	// The option func SystemdCgroups() and Cgroupfs() require following attributes:
+	// NewCgroupManager() and LoadCgroupManager() require following attributes:
 	// 	Paths   map[string]string
-	// 	Cgroups *configs.Cgroup
+	// 	Cgroups *cgroups.Cgroup
 	// Paths maps cgroup subsystem to path at which it is mounted.
 	// Cgroups specifies specific cgroup settings for the various subsystems
 
@@ -37,7 +37,7 @@ type Manager interface {
 	// restore the object later.
 	GetPaths() map[string]string
 
-	// Sets the cgroup as configured.
+	// Set the cgroup as configured.
 	Set(container *configs.Config) error
 }
 

vendor/github.com/opencontainers/runc/libcontainer/cgroups/fs/apply_raw.go

@@ -9,6 +9,7 @@ import (
 	"io/ioutil"
 	"os"
 	"path/filepath"
+	"strconv"
 	"sync"
 
 	"github.com/opencontainers/runc/libcontainer/cgroups"
@@ -32,6 +33,7 @@ var (
 		&FreezerGroup{},
 		&NameGroup{GroupName: "name=systemd", Join: true},
 	}
+	CgroupProcesses  = "cgroup.procs"
 	HugePageSizes, _ = cgroups.GetHugePageSize()
 )
 
@@ -104,8 +106,6 @@ func (m *Manager) Apply(pid int) (err error) {
 	if m.Cgroups == nil {
 		return nil
 	}
-	m.mu.Lock()
-	defer m.mu.Unlock()
 
 	var c = m.Cgroups
 
@@ -114,8 +114,8 @@ func (m *Manager) Apply(pid int) (err error) {
 		return err
 	}
 
-	m.Paths = make(map[string]string)
 	if c.Paths != nil {
+		paths := make(map[string]string)
 		for name, path := range c.Paths {
 			_, err := d.path(name)
 			if err != nil {
@@ -124,30 +124,32 @@ func (m *Manager) Apply(pid int) (err error) {
 				}
 				return err
 			}
-			m.Paths[name] = path
+			paths[name] = path
 		}
+		m.Paths = paths
 		return cgroups.EnterPid(m.Paths, pid)
 	}
 
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	paths := make(map[string]string)
 	for _, sys := range subsystems {
+		if err := sys.Apply(d); err != nil {
+			return err
+		}
 		// TODO: Apply should, ideally, be reentrant or be broken up into a separate
 		// create and join phase so that the cgroup hierarchy for a container can be
 		// created then join consists of writing the process pids to cgroup.procs
 		p, err := d.path(sys.Name())
 		if err != nil {
-			// The non-presence of the devices subsystem is
-			// considered fatal for security reasons.
-			if cgroups.IsNotFound(err) && sys.Name() != "devices" {
+			if cgroups.IsNotFound(err) {
 				continue
 			}
 			return err
 		}
-		m.Paths[sys.Name()] = p
-
-		if err := sys.Apply(d); err != nil {
-			return err
-		}
+		paths[sys.Name()] = p
 	}
+	m.Paths = paths
 	return nil
 }
 
@@ -188,15 +190,18 @@ func (m *Manager) GetStats() (*cgroups.Stats, error) {
 }
 
 func (m *Manager) Set(container *configs.Config) error {
-	// If Paths are set, then we are just joining cgroups paths
-	// and there is no need to set any values.
-	if m.Cgroups.Paths != nil {
-		return nil
-	}
-
-	paths := m.GetPaths()
 	for _, sys := range subsystems {
-		path := paths[sys.Name()]
+		// Generate fake cgroup data.
+		d, err := getCgroupData(container.Cgroups, -1)
+		if err != nil {
+			return err
+		}
+		// Get the path, but don't error out if the cgroup wasn't found.
+		path, err := d.path(sys.Name())
+		if err != nil && !cgroups.IsNotFound(err) {
+			return err
+		}
+
 		if err := sys.Set(path, container.Cgroups); err != nil {
 			return err
 		}
@@ -213,8 +218,14 @@ func (m *Manager) Set(container *configs.Config) error {
 // Freeze toggles the container's freezer cgroup depending on the state
 // provided
 func (m *Manager) Freeze(state configs.FreezerState) error {
-	paths := m.GetPaths()
-	dir := paths["freezer"]
+	d, err := getCgroupData(m.Cgroups, 0)
+	if err != nil {
+		return err
+	}
+	dir, err := d.path("freezer")
+	if err != nil {
+		return err
+	}
 	prevState := m.Cgroups.Resources.Freezer
 	m.Cgroups.Resources.Freezer = state
 	freezer, err := subsystems.Get("freezer")
@@ -230,13 +241,28 @@ func (m *Manager) Freeze(state configs.FreezerState) error {
 }
 
 func (m *Manager) GetPids() ([]int, error) {
-	paths := m.GetPaths()
-	return cgroups.GetPids(paths["devices"])
+	dir, err := getCgroupPath(m.Cgroups)
+	if err != nil {
+		return nil, err
+	}
+	return cgroups.GetPids(dir)
 }
 
 func (m *Manager) GetAllPids() ([]int, error) {
-	paths := m.GetPaths()
-	return cgroups.GetAllPids(paths["devices"])
+	dir, err := getCgroupPath(m.Cgroups)
+	if err != nil {
+		return nil, err
+	}
+	return cgroups.GetAllPids(dir)
+}
+
+func getCgroupPath(c *configs.Cgroup) (string, error) {
+	d, err := getCgroupData(c, 0)
+	if err != nil {
+		return "", err
+	}
+
+	return d.path("devices")
 }
 
 func getCgroupData(c *configs.Cgroup, pid int) (*cgroupData, error) {
@@ -267,8 +293,25 @@ func getCgroupData(c *configs.Cgroup, pid int) (*cgroupData, error) {
 	}, nil
 }
 
+func (raw *cgroupData) parentPath(subsystem, mountpoint, root string) (string, error) {
+	// Use GetThisCgroupDir instead of GetInitCgroupDir, because the creating
+	// process could in container and shared pid namespace with host, and
+	// /proc/1/cgroup could point to whole other world of cgroups.
+	initPath, err := cgroups.GetThisCgroupDir(subsystem)
+	if err != nil {
+		return "", err
+	}
+	// This is needed for nested containers, because in /proc/self/cgroup we
+	// see pathes from host, which don't exist in container.
+	relDir, err := filepath.Rel(root, initPath)
+	if err != nil {
+		return "", err
+	}
+	return filepath.Join(mountpoint, relDir), nil
+}
+
 func (raw *cgroupData) path(subsystem string) (string, error) {
-	mnt, err := cgroups.FindCgroupMountpoint(subsystem)
+	mnt, root, err := cgroups.FindCgroupMountpointAndRoot(subsystem)
 	// If we didn't mount the subsystem, there is no point we make the path.
 	if err != nil {
 		return "", err
@@ -276,14 +319,11 @@ func (raw *cgroupData) path(subsystem string) (string, error) {
 
 	// If the cgroup name/path is absolute do not look relative to the cgroup of the init process.
 	if filepath.IsAbs(raw.innerPath) {
-		// Sometimes subsystems can be mounted together as 'cpu,cpuacct'.
+		// Sometimes subsystems can be mounted togethger as 'cpu,cpuacct'.
 		return filepath.Join(raw.root, filepath.Base(mnt), raw.innerPath), nil
 	}
 
-	// Use GetOwnCgroupPath instead of GetInitCgroupPath, because the creating
-	// process could in container and shared pid namespace with host, and
-	// /proc/1/cgroup could point to whole other world of cgroups.
-	parentPath, err := cgroups.GetOwnCgroupPath(subsystem)
+	parentPath, err := raw.parentPath(subsystem, mnt, root)
 	if err != nil {
 		return "", err
 	}
@@ -299,7 +339,7 @@ func (raw *cgroupData) join(subsystem string) (string, error) {
 	if err := os.MkdirAll(path, 0755); err != nil {
 		return "", err
 	}
-	if err := cgroups.WriteCgroupProc(path, raw.pid); err != nil {
+	if err := writeFile(path, CgroupProcesses, strconv.Itoa(raw.pid)); err != nil {
 		return "", err
 	}
 	return path, nil
@@ -309,7 +349,7 @@ func writeFile(dir, file, data string) error {
 	// Normally dir should not be empty, one case is that cgroup subsystem
 	// is not mounted, we will get empty dir, and we want it fail here.
 	if dir == "" {
-		return fmt.Errorf("no such directory for %s", file)
+		return fmt.Errorf("no such directory for %s.", file)
 	}
 	if err := ioutil.WriteFile(filepath.Join(dir, file), []byte(data), 0700); err != nil {
 		return fmt.Errorf("failed to write %v to %v: %v", data, file, err)
@@ -332,8 +372,8 @@ func removePath(p string, err error) error {
 	return nil
 }
 
-func CheckCpushares(path string, c uint64) error {
-	var cpuShares uint64
+func CheckCpushares(path string, c int64) error {
+	var cpuShares int64
 
 	if c == 0 {
 		return nil

vendor/github.com/opencontainers/runc/libcontainer/cgroups/fs/cpu.go

@@ -22,59 +22,21 @@ func (s *CpuGroup) Name() string {
 func (s *CpuGroup) Apply(d *cgroupData) error {
 	// We always want to join the cpu group, to allow fair cpu scheduling
 	// on a container basis
-	path, err := d.path("cpu")
+	_, err := d.join("cpu")
 	if err != nil && !cgroups.IsNotFound(err) {
 		return err
 	}
-	return s.ApplyDir(path, d.config, d.pid)
-}
-
-func (s *CpuGroup) ApplyDir(path string, cgroup *configs.Cgroup, pid int) error {
-	// This might happen if we have no cpu cgroup mounted.
-	// Just do nothing and don't fail.
-	if path == "" {
-		return nil
-	}
-	if err := os.MkdirAll(path, 0755); err != nil {
-		return err
-	}
-	// We should set the real-Time group scheduling settings before moving
-	// in the process because if the process is already in SCHED_RR mode
-	// and no RT bandwidth is set, adding it will fail.
-	if err := s.SetRtSched(path, cgroup); err != nil {
-		return err
-	}
-	// because we are not using d.join we need to place the pid into the procs file
-	// unlike the other subsystems
-	if err := cgroups.WriteCgroupProc(path, pid); err != nil {
-		return err
-	}
-
-	return nil
-}
-
-func (s *CpuGroup) SetRtSched(path string, cgroup *configs.Cgroup) error {
-	if cgroup.Resources.CpuRtPeriod != 0 {
-		if err := writeFile(path, "cpu.rt_period_us", strconv.FormatUint(cgroup.Resources.CpuRtPeriod, 10)); err != nil {
-			return err
-		}
-	}
-	if cgroup.Resources.CpuRtRuntime != 0 {
-		if err := writeFile(path, "cpu.rt_runtime_us", strconv.FormatInt(cgroup.Resources.CpuRtRuntime, 10)); err != nil {
-			return err
-		}
-	}
 	return nil
 }
 
 func (s *CpuGroup) Set(path string, cgroup *configs.Cgroup) error {
 	if cgroup.Resources.CpuShares != 0 {
-		if err := writeFile(path, "cpu.shares", strconv.FormatUint(cgroup.Resources.CpuShares, 10)); err != nil {
+		if err := writeFile(path, "cpu.shares", strconv.FormatInt(cgroup.Resources.CpuShares, 10)); err != nil {
 			return err
 		}
 	}
 	if cgroup.Resources.CpuPeriod != 0 {
-		if err := writeFile(path, "cpu.cfs_period_us", strconv.FormatUint(cgroup.Resources.CpuPeriod, 10)); err != nil {
+		if err := writeFile(path, "cpu.cfs_period_us", strconv.FormatInt(cgroup.Resources.CpuPeriod, 10)); err != nil {
 			return err
 		}
 	}
@@ -83,8 +45,15 @@ func (s *CpuGroup) Set(path string, cgroup *configs.Cgroup) error {
 			return err
 		}
 	}
-	if err := s.SetRtSched(path, cgroup); err != nil {
-		return err
+	if cgroup.Resources.CpuRtPeriod != 0 {
+		if err := writeFile(path, "cpu.rt_period_us", strconv.FormatInt(cgroup.Resources.CpuRtPeriod, 10)); err != nil {
+			return err
+		}
+	}
+	if cgroup.Resources.CpuRtRuntime != 0 {
+		if err := writeFile(path, "cpu.rt_runtime_us", strconv.FormatInt(cgroup.Resources.CpuRtRuntime, 10)); err != nil {
+			return err
+		}
 	}
 
 	return nil

vendor/github.com/opencontainers/runc/libcontainer/cgroups/fs/cpu_test.go

@@ -106,13 +106,13 @@ func TestCpuStats(t *testing.T) {
 	defer helper.cleanup()
 
 	const (
-		nrPeriods     = 2000
-		nrThrottled   = 200
-		throttledTime = uint64(18446744073709551615)
+		kNrPeriods     = 2000
+		kNrThrottled   = 200
+		kThrottledTime = uint64(18446744073709551615)
 	)
 
 	cpuStatContent := fmt.Sprintf("nr_periods %d\n nr_throttled %d\n throttled_time %d\n",
-		nrPeriods, nrThrottled, throttledTime)
+		kNrPeriods, kNrThrottled, kThrottledTime)
 	helper.writeFileContents(map[string]string{
 		"cpu.stat": cpuStatContent,
 	})
@@ -125,9 +125,9 @@ func TestCpuStats(t *testing.T) {
 	}
 
 	expectedStats := cgroups.ThrottlingData{
-		Periods:          nrPeriods,
-		ThrottledPeriods: nrThrottled,
-		ThrottledTime:    throttledTime}
+		Periods:          kNrPeriods,
+		ThrottledPeriods: kNrThrottled,
+		ThrottledTime:    kThrottledTime}
 
 	expectThrottlingDataEquals(t, expectedStats, actualStats.CpuStats.ThrottlingData)
 }
@@ -161,49 +161,3 @@ func TestInvalidCpuStat(t *testing.T) {
 		t.Fatal("Expected failed stat parsing.")
 	}
 }
-
-func TestCpuSetRtSchedAtApply(t *testing.T) {
-	helper := NewCgroupTestUtil("cpu", t)
-	defer helper.cleanup()
-
-	const (
-		rtRuntimeBefore = 0
-		rtRuntimeAfter  = 5000
-		rtPeriodBefore  = 0
-		rtPeriodAfter   = 7000
-	)
-
-	helper.writeFileContents(map[string]string{
-		"cpu.rt_runtime_us": strconv.Itoa(rtRuntimeBefore),
-		"cpu.rt_period_us":  strconv.Itoa(rtPeriodBefore),
-	})
-
-	helper.CgroupData.config.Resources.CpuRtRuntime = rtRuntimeAfter
-	helper.CgroupData.config.Resources.CpuRtPeriod = rtPeriodAfter
-	cpu := &CpuGroup{}
-	if err := cpu.ApplyDir(helper.CgroupPath, helper.CgroupData.config, 1234); err != nil {
-		t.Fatal(err)
-	}
-
-	rtRuntime, err := getCgroupParamUint(helper.CgroupPath, "cpu.rt_runtime_us")
-	if err != nil {
-		t.Fatalf("Failed to parse cpu.rt_runtime_us - %s", err)
-	}
-	if rtRuntime != rtRuntimeAfter {
-		t.Fatal("Got the wrong value, set cpu.rt_runtime_us failed.")
-	}
-	rtPeriod, err := getCgroupParamUint(helper.CgroupPath, "cpu.rt_period_us")
-	if err != nil {
-		t.Fatalf("Failed to parse cpu.rt_period_us - %s", err)
-	}
-	if rtPeriod != rtPeriodAfter {
-		t.Fatal("Got the wrong value, set cpu.rt_period_us failed.")
-	}
-	pid, err := getCgroupParamUint(helper.CgroupPath, "cgroup.procs")
-	if err != nil {
-		t.Fatalf("Failed to parse cgroup.procs - %s", err)
-	}
-	if pid != 1234 {
-		t.Fatal("Got the wrong value, set cgroup.procs failed.")
-	}
-}

vendor/github.com/opencontainers/runc/libcontainer/cgroups/fs/cpuset.go

@@ -8,6 +8,7 @@ import (
 	"io/ioutil"
 	"os"
 	"path/filepath"
+	"strconv"
 
 	"github.com/opencontainers/runc/libcontainer/cgroups"
 	"github.com/opencontainers/runc/libcontainer/configs"
@@ -57,34 +58,16 @@ func (s *CpusetGroup) ApplyDir(dir string, cgroup *configs.Cgroup, pid int) erro
 	if dir == "" {
 		return nil
 	}
-	mountInfo, err := ioutil.ReadFile("/proc/self/mountinfo")
+	root, err := getCgroupRoot()
 	if err != nil {
 		return err
 	}
-	root := filepath.Dir(cgroups.GetClosestMountpointAncestor(dir, string(mountInfo)))
-	// 'ensureParent' start with parent because we don't want to
-	// explicitly inherit from parent, it could conflict with
-	// 'cpuset.cpu_exclusive'.
-	if err := s.ensureParent(filepath.Dir(dir), root); err != nil {
+	if err := s.ensureParent(dir, root); err != nil {
 		return err
 	}
-	if err := os.MkdirAll(dir, 0755); err != nil {
-		return err
-	}
-	// We didn't inherit cpuset configs from parent, but we have
-	// to ensure cpuset configs are set before moving task into the
-	// cgroup.
-	// The logic is, if user specified cpuset configs, use these
-	// specified configs, otherwise, inherit from parent. This makes
-	// cpuset configs work correctly with 'cpuset.cpu_exclusive', and
-	// keep backward compatbility.
-	if err := s.ensureCpusAndMems(dir, cgroup); err != nil {
-		return err
-	}
-
 	// because we are not using d.join we need to place the pid into the procs file
 	// unlike the other subsystems
-	if err := cgroups.WriteCgroupProc(dir, pid); err != nil {
+	if err := writeFile(dir, "cgroup.procs", strconv.Itoa(pid)); err != nil {
 		return err
 	}
 
@@ -154,10 +137,3 @@ func (s *CpusetGroup) copyIfNeeded(current, parent string) error {
 func (s *CpusetGroup) isEmpty(b []byte) bool {
 	return len(bytes.Trim(b, "\n")) == 0
 }
-
-func (s *CpusetGroup) ensureCpusAndMems(path string, cgroup *configs.Cgroup) error {
-	if err := s.Set(path, cgroup); err != nil {
-		return err
-	}
-	return s.copyIfNeeded(path, filepath.Dir(path))
-}

vendor/github.com/opencontainers/runc/libcontainer/cgroups/fs/devices.go

@@ -43,23 +43,21 @@ func (s *DevicesGroup) Set(path string, cgroup *configs.Cgroup) error {
 		}
 		return nil
 	}
-	if cgroup.Resources.AllowAllDevices != nil {
-		if *cgroup.Resources.AllowAllDevices == false {
-			if err := writeFile(path, "devices.deny", "a"); err != nil {
-				return err
-			}
-
-			for _, dev := range cgroup.Resources.AllowedDevices {
-				if err := writeFile(path, "devices.allow", dev.CgroupString()); err != nil {
-					return err
-				}
-			}
-			return nil
-		}
-
-		if err := writeFile(path, "devices.allow", "a"); err != nil {
+	if !cgroup.Resources.AllowAllDevices {
+		if err := writeFile(path, "devices.deny", "a"); err != nil {
 			return err
 		}
+
+		for _, dev := range cgroup.Resources.AllowedDevices {
+			if err := writeFile(path, "devices.allow", dev.CgroupString()); err != nil {
+				return err
+			}
+		}
+		return nil
+	}
+
+	if err := writeFile(path, "devices.allow", "a"); err != nil {
+		return err
 	}
 
 	for _, dev := range cgroup.Resources.DeniedDevices {

vendor/github.com/opencontainers/runc/libcontainer/cgroups/fs/devices_test.go

@@ -40,8 +40,8 @@ func TestDevicesSetAllow(t *testing.T) {
 	helper.writeFileContents(map[string]string{
 		"devices.deny": "a",
 	})
-	allowAllDevices := false
-	helper.CgroupData.config.Resources.AllowAllDevices = &allowAllDevices
+
+	helper.CgroupData.config.Resources.AllowAllDevices = false
 	helper.CgroupData.config.Resources.AllowedDevices = allowedDevices
 	devices := &DevicesGroup{}
 	if err := devices.Set(helper.CgroupPath, helper.CgroupData.config); err != nil {
@@ -56,19 +56,6 @@ func TestDevicesSetAllow(t *testing.T) {
 	if value != allowedList {
 		t.Fatal("Got the wrong value, set devices.allow failed.")
 	}
-
-	// When AllowAllDevices is nil, devices.allow file should not be modified.
-	helper.CgroupData.config.Resources.AllowAllDevices = nil
-	if err := devices.Set(helper.CgroupPath, helper.CgroupData.config); err != nil {
-		t.Fatal(err)
-	}
-	value, err = getCgroupParamString(helper.CgroupPath, "devices.allow")
-	if err != nil {
-		t.Fatalf("Failed to parse devices.allow - %s", err)
-	}
-	if value != allowedList {
-		t.Fatal("devices policy shouldn't have changed on AllowedAllDevices=nil.")
-	}
 }
 
 func TestDevicesSetDeny(t *testing.T) {
@@ -79,8 +66,7 @@ func TestDevicesSetDeny(t *testing.T) {
 		"devices.allow": "a",
 	})
 
-	allowAllDevices := true
-	helper.CgroupData.config.Resources.AllowAllDevices = &allowAllDevices
+	helper.CgroupData.config.Resources.AllowAllDevices = true
 	helper.CgroupData.config.Resources.DeniedDevices = deniedDevices
 	devices := &DevicesGroup{}
 	if err := devices.Set(helper.CgroupPath, helper.CgroupData.config); err != nil {

vendor/github.com/opencontainers/runc/libcontainer/cgroups/fs/memory.go

@@ -5,23 +5,13 @@ package fs
 import (
 	"bufio"
 	"fmt"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"strconv"
 	"strings"
-	"syscall" // only for Errno
 
 	"github.com/opencontainers/runc/libcontainer/cgroups"
 	"github.com/opencontainers/runc/libcontainer/configs"
-
-	"golang.org/x/sys/unix"
-)
-
-const (
-	cgroupKernelMemoryLimit = "memory.kmem.limit_in_bytes"
-	cgroupMemorySwapLimit   = "memory.memsw.limit_in_bytes"
-	cgroupMemoryLimit       = "memory.limit_in_bytes"
 )
 
 type MemoryGroup struct {
@@ -35,23 +25,20 @@ func (s *MemoryGroup) Apply(d *cgroupData) (err error) {
 	path, err := d.path("memory")
 	if err != nil && !cgroups.IsNotFound(err) {
 		return err
-	} else if path == "" {
-		return nil
 	}
 	if memoryAssigned(d.config) {
-		if _, err := os.Stat(path); os.IsNotExist(err) {
+		if path != "" {
 			if err := os.MkdirAll(path, 0755); err != nil {
 				return err
 			}
-			// Only enable kernel memory accouting when this cgroup
-			// is created by libcontainer, otherwise we might get
-			// error when people use `cgroupsPath` to join an existed
-			// cgroup whose kernel memory is not initialized.
-			if err := EnableKernelMemoryAccounting(path); err != nil {
-				return err
-			}
+		}
+		// We have to set kernel memory here, as we can't change it once
+		// processes have been attached.
+		if err := s.SetKernelMemory(path, d.config); err != nil {
+			return err
 		}
 	}
+
 	defer func() {
 		if err != nil {
 			os.RemoveAll(path)
@@ -67,57 +54,21 @@ func (s *MemoryGroup) Apply(d *cgroupData) (err error) {
 	return nil
 }
 
-func EnableKernelMemoryAccounting(path string) error {
-	// Check if kernel memory is enabled
-	// We have to limit the kernel memory here as it won't be accounted at all
-	// until a limit is set on the cgroup and limit cannot be set once the
-	// cgroup has children, or if there are already tasks in the cgroup.
-	for _, i := range []int64{1, -1} {
-		if err := setKernelMemory(path, i); err != nil {
+func (s *MemoryGroup) SetKernelMemory(path string, cgroup *configs.Cgroup) error {
+	// This has to be done separately because it has special constraints (it
+	// can't be done after there are processes attached to the cgroup).
+	if cgroup.Resources.KernelMemory > 0 {
+		if err := writeFile(path, "memory.kmem.limit_in_bytes", strconv.FormatInt(cgroup.Resources.KernelMemory, 10)); err != nil {
 			return err
 		}
 	}
 	return nil
 }
 
-func setKernelMemory(path string, kernelMemoryLimit int64) error {
-	if path == "" {
-		return fmt.Errorf("no such directory for %s", cgroupKernelMemoryLimit)
-	}
-	if !cgroups.PathExists(filepath.Join(path, cgroupKernelMemoryLimit)) {
-		// kernel memory is not enabled on the system so we should do nothing
-		return nil
-	}
-	if err := ioutil.WriteFile(filepath.Join(path, cgroupKernelMemoryLimit), []byte(strconv.FormatInt(kernelMemoryLimit, 10)), 0700); err != nil {
-		// Check if the error number returned by the syscall is "EBUSY"
-		// The EBUSY signal is returned on attempts to write to the
-		// memory.kmem.limit_in_bytes file if the cgroup has children or
-		// once tasks have been attached to the cgroup
-		if pathErr, ok := err.(*os.PathError); ok {
-			if errNo, ok := pathErr.Err.(syscall.Errno); ok {
-				if errNo == unix.EBUSY {
-					return fmt.Errorf("failed to set %s, because either tasks have already joined this cgroup or it has children", cgroupKernelMemoryLimit)
-				}
-			}
-		}
-		return fmt.Errorf("failed to write %v to %v: %v", kernelMemoryLimit, cgroupKernelMemoryLimit, err)
-	}
-	return nil
-}
-
 func setMemoryAndSwap(path string, cgroup *configs.Cgroup) error {
-	// If the memory update is set to -1 we should also
-	// set swap to -1, it means unlimited memory.
-	if cgroup.Resources.Memory == -1 {
-		// Only set swap if it's enabled in kernel
-		if cgroups.PathExists(filepath.Join(path, cgroupMemorySwapLimit)) {
-			cgroup.Resources.MemorySwap = -1
-		}
-	}
-
 	// When memory and swap memory are both set, we need to handle the cases
 	// for updating container.
-	if cgroup.Resources.Memory != 0 && cgroup.Resources.MemorySwap != 0 {
+	if cgroup.Resources.Memory != 0 && cgroup.Resources.MemorySwap > 0 {
 		memoryUsage, err := getMemoryData(path, "")
 		if err != nil {
 			return err
@@ -126,29 +77,29 @@ func setMemoryAndSwap(path string, cgroup *configs.Cgroup) error {
 		// When update memory limit, we should adapt the write sequence
 		// for memory and swap memory, so it won't fail because the new
 		// value and the old value don't fit kernel's validation.
-		if cgroup.Resources.MemorySwap == -1 || memoryUsage.Limit < uint64(cgroup.Resources.MemorySwap) {
-			if err := writeFile(path, cgroupMemorySwapLimit, strconv.FormatInt(cgroup.Resources.MemorySwap, 10)); err != nil {
+		if memoryUsage.Limit < uint64(cgroup.Resources.MemorySwap) {
+			if err := writeFile(path, "memory.memsw.limit_in_bytes", strconv.FormatInt(cgroup.Resources.MemorySwap, 10)); err != nil {
 				return err
 			}
-			if err := writeFile(path, cgroupMemoryLimit, strconv.FormatInt(cgroup.Resources.Memory, 10)); err != nil {
+			if err := writeFile(path, "memory.limit_in_bytes", strconv.FormatInt(cgroup.Resources.Memory, 10)); err != nil {
 				return err
 			}
 		} else {
-			if err := writeFile(path, cgroupMemoryLimit, strconv.FormatInt(cgroup.Resources.Memory, 10)); err != nil {
+			if err := writeFile(path, "memory.limit_in_bytes", strconv.FormatInt(cgroup.Resources.Memory, 10)); err != nil {
 				return err
 			}
-			if err := writeFile(path, cgroupMemorySwapLimit, strconv.FormatInt(cgroup.Resources.MemorySwap, 10)); err != nil {
+			if err := writeFile(path, "memory.memsw.limit_in_bytes", strconv.FormatInt(cgroup.Resources.MemorySwap, 10)); err != nil {
 				return err
 			}
 		}
 	} else {
 		if cgroup.Resources.Memory != 0 {
-			if err := writeFile(path, cgroupMemoryLimit, strconv.FormatInt(cgroup.Resources.Memory, 10)); err != nil {
+			if err := writeFile(path, "memory.limit_in_bytes", strconv.FormatInt(cgroup.Resources.Memory, 10)); err != nil {
 				return err
 			}
 		}
-		if cgroup.Resources.MemorySwap != 0 {
-			if err := writeFile(path, cgroupMemorySwapLimit, strconv.FormatInt(cgroup.Resources.MemorySwap, 10)); err != nil {
+		if cgroup.Resources.MemorySwap > 0 {
+			if err := writeFile(path, "memory.memsw.limit_in_bytes", strconv.FormatInt(cgroup.Resources.MemorySwap, 10)); err != nil {
 				return err
 			}
 		}
@@ -162,18 +113,11 @@ func (s *MemoryGroup) Set(path string, cgroup *configs.Cgroup) error {
 		return err
 	}
 
-	if cgroup.Resources.KernelMemory != 0 {
-		if err := setKernelMemory(path, cgroup.Resources.KernelMemory); err != nil {
-			return err
-		}
-	}
-
 	if cgroup.Resources.MemoryReservation != 0 {
 		if err := writeFile(path, "memory.soft_limit_in_bytes", strconv.FormatInt(cgroup.Resources.MemoryReservation, 10)); err != nil {
 			return err
 		}
 	}
-
 	if cgroup.Resources.KernelMemoryTCP != 0 {
 		if err := writeFile(path, "memory.kmem.tcp.limit_in_bytes", strconv.FormatInt(cgroup.Resources.KernelMemoryTCP, 10)); err != nil {
 			return err
@@ -186,12 +130,12 @@ func (s *MemoryGroup) Set(path string, cgroup *configs.Cgroup) error {
 	}
 	if cgroup.Resources.MemorySwappiness == nil || int64(*cgroup.Resources.MemorySwappiness) == -1 {
 		return nil
-	} else if *cgroup.Resources.MemorySwappiness <= 100 {
-		if err := writeFile(path, "memory.swappiness", strconv.FormatUint(*cgroup.Resources.MemorySwappiness, 10)); err != nil {
+	} else if int64(*cgroup.Resources.MemorySwappiness) >= 0 && int64(*cgroup.Resources.MemorySwappiness) <= 100 {
+		if err := writeFile(path, "memory.swappiness", strconv.FormatInt(*cgroup.Resources.MemorySwappiness, 10)); err != nil {
 			return err
 		}
 	} else {
-		return fmt.Errorf("invalid value:%d. valid memory swappiness range is 0-100", *cgroup.Resources.MemorySwappiness)
+		return fmt.Errorf("invalid value:%d. valid memory swappiness range is 0-100", int64(*cgroup.Resources.MemorySwappiness))
 	}
 
 	return nil
@@ -243,14 +187,6 @@ func (s *MemoryGroup) GetStats(path string, stats *cgroups.Stats) error {
 	}
 	stats.MemoryStats.KernelTCPUsage = kernelTCPUsage
 
-	useHierarchy := strings.Join([]string{"memory", "use_hierarchy"}, ".")
-	value, err := getCgroupParamUint(path, useHierarchy)
-	if err != nil {
-		return err
-	}
-	if value == 1 {
-		stats.MemoryStats.UseHierarchy = true
-	}
 	return nil
 }
 
@@ -261,7 +197,7 @@ func memoryAssigned(cgroup *configs.Cgroup) bool {
 		cgroup.Resources.KernelMemory > 0 ||
 		cgroup.Resources.KernelMemoryTCP > 0 ||
 		cgroup.Resources.OomKillDisable ||
-		(cgroup.Resources.MemorySwappiness != nil && int64(*cgroup.Resources.MemorySwappiness) != -1)
+		(cgroup.Resources.MemorySwappiness != nil && *cgroup.Resources.MemorySwappiness != -1)
 }
 
 func getMemoryData(path, name string) (cgroups.MemoryData, error) {

vendor/github.com/opencontainers/runc/libcontainer/cgroups/fs/memory_test.go

@@ -12,11 +12,10 @@ import (
 const (
 	memoryStatContents = `cache 512
 rss 1024`
-	memoryUsageContents        = "2048\n"
-	memoryMaxUsageContents     = "4096\n"
-	memoryFailcnt              = "100\n"
-	memoryLimitContents        = "8192\n"
-	memoryUseHierarchyContents = "1\n"
+	memoryUsageContents    = "2048\n"
+	memoryMaxUsageContents = "4096\n"
+	memoryFailcnt          = "100\n"
+	memoryLimitContents    = "8192\n"
 )
 
 func TestMemorySetMemory(t *testing.T) {
@@ -87,6 +86,47 @@ func TestMemorySetMemoryswap(t *testing.T) {
 	}
 }
 
+func TestMemorySetNegativeMemoryswap(t *testing.T) {
+	helper := NewCgroupTestUtil("memory", t)
+	defer helper.cleanup()
+
+	const (
+		memoryBefore     = 314572800 // 300M
+		memoryAfter      = 524288000 // 500M
+		memoryswapBefore = 629145600 // 600M
+		memoryswapAfter  = 629145600 // 600M
+	)
+
+	helper.writeFileContents(map[string]string{
+		"memory.limit_in_bytes":       strconv.Itoa(memoryBefore),
+		"memory.memsw.limit_in_bytes": strconv.Itoa(memoryswapBefore),
+	})
+
+	helper.CgroupData.config.Resources.Memory = memoryAfter
+	// Negative value means not change
+	helper.CgroupData.config.Resources.MemorySwap = -1
+	memory := &MemoryGroup{}
+	if err := memory.Set(helper.CgroupPath, helper.CgroupData.config); err != nil {
+		t.Fatal(err)
+	}
+
+	value, err := getCgroupParamUint(helper.CgroupPath, "memory.limit_in_bytes")
+	if err != nil {
+		t.Fatalf("Failed to parse memory.limit_in_bytes - %s", err)
+	}
+	if value != memoryAfter {
+		t.Fatal("Got the wrong value, set memory.limit_in_bytes failed.")
+	}
+
+	value, err = getCgroupParamUint(helper.CgroupPath, "memory.memsw.limit_in_bytes")
+	if err != nil {
+		t.Fatalf("Failed to parse memory.memsw.limit_in_bytes - %s", err)
+	}
+	if value != memoryswapAfter {
+		t.Fatal("Got the wrong value, set memory.memsw.limit_in_bytes failed.")
+	}
+}
+
 func TestMemorySetMemoryLargerThanSwap(t *testing.T) {
 	helper := NewCgroupTestUtil("memory", t)
 	defer helper.cleanup()
@@ -190,7 +230,7 @@ func TestMemorySetKernelMemory(t *testing.T) {
 
 	helper.CgroupData.config.Resources.KernelMemory = kernelMemoryAfter
 	memory := &MemoryGroup{}
-	if err := memory.Set(helper.CgroupPath, helper.CgroupData.config); err != nil {
+	if err := memory.SetKernelMemory(helper.CgroupPath, helper.CgroupData.config); err != nil {
 		t.Fatal(err)
 	}
 
@@ -236,7 +276,7 @@ func TestMemorySetMemorySwappinessDefault(t *testing.T) {
 	defer helper.cleanup()
 
 	swappinessBefore := 60 //default is 60
-	swappinessAfter := uint64(0)
+	swappinessAfter := int64(0)
 
 	helper.writeFileContents(map[string]string{
 		"memory.swappiness": strconv.Itoa(swappinessBefore),
@@ -252,7 +292,7 @@ func TestMemorySetMemorySwappinessDefault(t *testing.T) {
 	if err != nil {
 		t.Fatalf("Failed to parse memory.swappiness - %s", err)
 	}
-	if value != swappinessAfter {
+	if int64(value) != swappinessAfter {
 		t.Fatalf("Got the wrong value (%d), set memory.swappiness = %d failed.", value, swappinessAfter)
 	}
 }
@@ -274,7 +314,6 @@ func TestMemoryStats(t *testing.T) {
 		"memory.kmem.max_usage_in_bytes":  memoryMaxUsageContents,
 		"memory.kmem.failcnt":             memoryFailcnt,
 		"memory.kmem.limit_in_bytes":      memoryLimitContents,
-		"memory.use_hierarchy":            memoryUseHierarchyContents,
 	})
 
 	memory := &MemoryGroup{}
@@ -283,7 +322,7 @@ func TestMemoryStats(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	expectedStats := cgroups.MemoryStats{Cache: 512, Usage: cgroups.MemoryData{Usage: 2048, MaxUsage: 4096, Failcnt: 100, Limit: 8192}, SwapUsage: cgroups.MemoryData{Usage: 2048, MaxUsage: 4096, Failcnt: 100, Limit: 8192}, KernelUsage: cgroups.MemoryData{Usage: 2048, MaxUsage: 4096, Failcnt: 100, Limit: 8192}, Stats: map[string]uint64{"cache": 512, "rss": 1024}, UseHierarchy: true}
+	expectedStats := cgroups.MemoryStats{Cache: 512, Usage: cgroups.MemoryData{Usage: 2048, MaxUsage: 4096, Failcnt: 100, Limit: 8192}, SwapUsage: cgroups.MemoryData{Usage: 2048, MaxUsage: 4096, Failcnt: 100, Limit: 8192}, KernelUsage: cgroups.MemoryData{Usage: 2048, MaxUsage: 4096, Failcnt: 100, Limit: 8192}, Stats: map[string]uint64{"cache": 512, "rss": 1024}}
 	expectMemoryStatEquals(t, expectedStats, actualStats.MemoryStats)
 }
 
@@ -432,11 +471,11 @@ func TestMemorySetOomControl(t *testing.T) {
 	defer helper.cleanup()
 
 	const (
-		oomKillDisable = 1 // disable oom killer, default is 0
+		oom_kill_disable = 1 // disable oom killer, default is 0
 	)
 
 	helper.writeFileContents(map[string]string{
-		"memory.oom_control": strconv.Itoa(oomKillDisable),
+		"memory.oom_control": strconv.Itoa(oom_kill_disable),
 	})
 
 	memory := &MemoryGroup{}
@@ -449,7 +488,7 @@ func TestMemorySetOomControl(t *testing.T) {
 		t.Fatalf("Failed to parse memory.oom_control - %s", err)
 	}
 
-	if value != oomKillDisable {
+	if value != oom_kill_disable {
 		t.Fatalf("Got the wrong value, set memory.oom_control failed.")
 	}
 }

vendor/github.com/opencontainers/runc/libcontainer/cgroups/fs/net_cls.go

@@ -3,8 +3,6 @@
 package fs
 
 import (
-	"strconv"
-
 	"github.com/opencontainers/runc/libcontainer/cgroups"
 	"github.com/opencontainers/runc/libcontainer/configs"
 )
@@ -25,8 +23,8 @@ func (s *NetClsGroup) Apply(d *cgroupData) error {
 }
 
 func (s *NetClsGroup) Set(path string, cgroup *configs.Cgroup) error {
-	if cgroup.Resources.NetClsClassid != 0 {
-		if err := writeFile(path, "net_cls.classid", strconv.FormatUint(uint64(cgroup.Resources.NetClsClassid), 10)); err != nil {
+	if cgroup.Resources.NetClsClassid != "" {
+		if err := writeFile(path, "net_cls.classid", cgroup.Resources.NetClsClassid); err != nil {
 			return err
 		}
 	}

vendor/github.com/opencontainers/runc/libcontainer/cgroups/fs/net_cls_test.go

@@ -3,13 +3,12 @@
 package fs
 
 import (
-	"strconv"
 	"testing"
 )
 
 const (
-	classidBefore = 0x100002
-	classidAfter  = 0x100001
+	classidBefore = "0x100002"
+	classidAfter  = "0x100001"
 )
 
 func TestNetClsSetClassid(t *testing.T) {
@@ -17,7 +16,7 @@ func TestNetClsSetClassid(t *testing.T) {
 	defer helper.cleanup()
 
 	helper.writeFileContents(map[string]string{
-		"net_cls.classid": strconv.FormatUint(classidBefore, 10),
+		"net_cls.classid": classidBefore,
 	})
 
 	helper.CgroupData.config.Resources.NetClsClassid = classidAfter
@@ -29,7 +28,7 @@ func TestNetClsSetClassid(t *testing.T) {
 	// As we are in mock environment, we can't get correct value of classid from
 	// net_cls.classid.
 	// So. we just judge if we successfully write classid into file
-	value, err := getCgroupParamUint(helper.CgroupPath, "net_cls.classid")
+	value, err := getCgroupParamString(helper.CgroupPath, "net_cls.classid")
 	if err != nil {
 		t.Fatalf("Failed to parse net_cls.classid - %s", err)
 	}

vendor/github.com/opencontainers/runc/libcontainer/cgroups/fs/stats_util_test.go

@@ -6,9 +6,8 @@ import (
 	"fmt"
 	"testing"
 
+	"github.com/Sirupsen/logrus"
 	"github.com/opencontainers/runc/libcontainer/cgroups"
-
-	"github.com/sirupsen/logrus"
 )
 
 func blkioStatEntryEquals(expected, actual []cgroups.BlkioStatEntry) error {
@@ -85,11 +84,6 @@ func expectMemoryStatEquals(t *testing.T, expected, actual cgroups.MemoryStats)
 	expectMemoryDataEquals(t, expected.SwapUsage, actual.SwapUsage)
 	expectMemoryDataEquals(t, expected.KernelUsage, actual.KernelUsage)
 
-	if expected.UseHierarchy != actual.UseHierarchy {
-		logrus.Printf("Expected memory use hiearchy %v, but found %v\n", expected.UseHierarchy, actual.UseHierarchy)
-		t.Fail()
-	}
-
 	for key, expValue := range expected.Stats {
 		actValue, ok := actual.Stats[key]
 		if !ok {

vendor/github.com/opencontainers/runc/libcontainer/cgroups/fs/utils.go

@@ -12,6 +12,7 @@ import (
 )
 
 var (
+	ErrNotSupportStat = errors.New("stats are not supported for subsystem")
 	ErrNotValidFormat = errors.New("line is not a valid key value format")
 )
 

vendor/github.com/opencontainers/runc/libcontainer/cgroups/rootless/rootless.go

@@ -1,128 +0,0 @@
-// +build linux
-
-package rootless
-
-import (
-	"fmt"
-
-	"github.com/opencontainers/runc/libcontainer/cgroups"
-	"github.com/opencontainers/runc/libcontainer/cgroups/fs"
-	"github.com/opencontainers/runc/libcontainer/configs"
-	"github.com/opencontainers/runc/libcontainer/configs/validate"
-)
-
-// TODO: This is copied from libcontainer/cgroups/fs, which duplicates this code
-//       needlessly. We should probably export this list.
-
-var subsystems = []subsystem{
-	&fs.CpusetGroup{},
-	&fs.DevicesGroup{},
-	&fs.MemoryGroup{},
-	&fs.CpuGroup{},
-	&fs.CpuacctGroup{},
-	&fs.PidsGroup{},
-	&fs.BlkioGroup{},
-	&fs.HugetlbGroup{},
-	&fs.NetClsGroup{},
-	&fs.NetPrioGroup{},
-	&fs.PerfEventGroup{},
-	&fs.FreezerGroup{},
-	&fs.NameGroup{GroupName: "name=systemd"},
-}
-
-type subsystem interface {
-	// Name returns the name of the subsystem.
-	Name() string
-
-	// Returns the stats, as 'stats', corresponding to the cgroup under 'path'.
-	GetStats(path string, stats *cgroups.Stats) error
-}
-
-// The noop cgroup manager is used for rootless containers, because we currently
-// cannot manage cgroups if we are in a rootless setup. This manager is chosen
-// by factory if we are in rootless mode. We error out if any cgroup options are
-// set in the config -- this may change in the future with upcoming kernel features
-// like the cgroup namespace.
-
-type Manager struct {
-	Cgroups *configs.Cgroup
-	Paths   map[string]string
-}
-
-func (m *Manager) Apply(pid int) error {
-	// If there are no cgroup settings, there's nothing to do.
-	if m.Cgroups == nil {
-		return nil
-	}
-
-	// We can't set paths.
-	// TODO(cyphar): Implement the case where the runner of a rootless container
-	//               owns their own cgroup, which would allow us to set up a
-	//               cgroup for each path.
-	if m.Cgroups.Paths != nil {
-		return fmt.Errorf("cannot change cgroup path in rootless container")
-	}
-
-	// We load the paths into the manager.
-	paths := make(map[string]string)
-	for _, sys := range subsystems {
-		name := sys.Name()
-
-		path, err := cgroups.GetOwnCgroupPath(name)
-		if err != nil {
-			// Ignore paths we couldn't resolve.
-			continue
-		}
-
-		paths[name] = path
-	}
-
-	m.Paths = paths
-	return nil
-}
-
-func (m *Manager) GetPaths() map[string]string {
-	return m.Paths
-}
-
-func (m *Manager) Set(container *configs.Config) error {
-	// We have to re-do the validation here, since someone might decide to
-	// update a rootless container.
-	return validate.New().Validate(container)
-}
-
-func (m *Manager) GetPids() ([]int, error) {
-	dir, err := cgroups.GetOwnCgroupPath("devices")
-	if err != nil {
-		return nil, err
-	}
-	return cgroups.GetPids(dir)
-}
-
-func (m *Manager) GetAllPids() ([]int, error) {
-	dir, err := cgroups.GetOwnCgroupPath("devices")
-	if err != nil {
-		return nil, err
-	}
-	return cgroups.GetAllPids(dir)
-}
-
-func (m *Manager) GetStats() (*cgroups.Stats, error) {
-	// TODO(cyphar): We can make this work if we figure out a way to allow usage
-	//               of cgroups with a rootless container. While this doesn't
-	//               actually require write access to a cgroup directory, the
-	//               statistics are not useful if they can be affected by
-	//               non-container processes.
-	return nil, fmt.Errorf("cannot get cgroup stats in rootless container")
-}
-
-func (m *Manager) Freeze(state configs.FreezerState) error {
-	// TODO(cyphar): We can make this work if we figure out a way to allow usage
-	//               of cgroups with a rootless container.
-	return fmt.Errorf("cannot use freezer cgroup in rootless container")
-}
-
-func (m *Manager) Destroy() error {
-	// We don't have to do anything here because we didn't do any setup.
-	return nil
-}

vendor/github.com/opencontainers/runc/libcontainer/cgroups/stats.go

@@ -11,7 +11,6 @@ type ThrottlingData struct {
 	ThrottledTime uint64 `json:"throttled_time,omitempty"`
 }
 
-// CpuUsage denotes the usage of a CPU.
 // All CPU stats are aggregate since container inception.
 type CpuUsage struct {
 	// Total CPU time consumed.
@@ -51,8 +50,6 @@ type MemoryStats struct {
 	KernelUsage MemoryData `json:"kernel_usage,omitempty"`
 	// usage of kernel TCP memory
 	KernelTCPUsage MemoryData `json:"kernel_tcp_usage,omitempty"`
-	// if true, memory usage is accounted for throughout a hierarchy of cgroups.
-	UseHierarchy bool `json:"use_hierarchy"`
 
 	Stats map[string]uint64 `json:"stats,omitempty"`
 }

vendor/github.com/opencontainers/runc/libcontainer/cgroups/systemd/apply_systemd.go

@@ -5,8 +5,10 @@ package systemd
 import (
 	"errors"
 	"fmt"
+	"io/ioutil"
 	"os"
 	"path/filepath"
+	"strconv"
 	"strings"
 	"sync"
 	"time"
@@ -65,16 +67,13 @@ var subsystems = subsystemSet{
 
 const (
 	testScopeWait = 4
-	testSliceWait = 4
 )
 
 var (
 	connLock                        sync.Mutex
 	theConn                         *systemdDbus.Conn
 	hasStartTransientUnit           bool
-	hasStartTransientSliceUnit      bool
 	hasTransientDefaultDependencies bool
-	hasDelegate                     bool
 )
 
 func newProp(name string, units interface{}) systemdDbus.Property {
@@ -147,48 +146,6 @@ func UseSystemd() bool {
 
 		// Not critical because of the stop unit logic above.
 		theConn.StopUnit(scope, "replace", nil)
-
-		// Assume StartTransientUnit on a scope allows Delegate
-		hasDelegate = true
-		dl := newProp("Delegate", true)
-		if _, err := theConn.StartTransientUnit(scope, "replace", []systemdDbus.Property{dl}, nil); err != nil {
-			if dbusError, ok := err.(dbus.Error); ok {
-				if strings.Contains(dbusError.Name, "org.freedesktop.DBus.Error.PropertyReadOnly") {
-					hasDelegate = false
-				}
-			}
-		}
-
-		// Assume we have the ability to start a transient unit as a slice
-		// This was broken until systemd v229, but has been back-ported on RHEL environments >= 219
-		// For details, see: https://bugzilla.redhat.com/show_bug.cgi?id=1370299
-		hasStartTransientSliceUnit = true
-
-		// To ensure simple clean-up, we create a slice off the root with no hierarchy
-		slice := fmt.Sprintf("libcontainer_%d_systemd_test_default.slice", os.Getpid())
-		if _, err := theConn.StartTransientUnit(slice, "replace", nil, nil); err != nil {
-			if _, ok := err.(dbus.Error); ok {
-				hasStartTransientSliceUnit = false
-			}
-		}
-
-		for i := 0; i <= testSliceWait; i++ {
-			if _, err := theConn.StopUnit(slice, "replace", nil); err != nil {
-				if dbusError, ok := err.(dbus.Error); ok {
-					if strings.Contains(dbusError.Name, "org.freedesktop.systemd1.NoSuchUnit") {
-						hasStartTransientSliceUnit = false
-						break
-					}
-				}
-			} else {
-				break
-			}
-			time.Sleep(time.Millisecond)
-		}
-
-		// Not critical because of the stop unit logic above.
-		theConn.StopUnit(scope, "replace", nil)
-		theConn.StopUnit(slice, "replace", nil)
 	}
 	return hasStartTransientUnit
 }
@@ -222,29 +179,13 @@ func (m *Manager) Apply(pid int) error {
 		slice = c.Parent
 	}
 
-	properties = append(properties, systemdDbus.PropDescription("libcontainer container "+c.Name))
-
-	// if we create a slice, the parent is defined via a Wants=
-	if strings.HasSuffix(unitName, ".slice") {
-		// This was broken until systemd v229, but has been back-ported on RHEL environments >= 219
-		if !hasStartTransientSliceUnit {
-			return fmt.Errorf("systemd version does not support ability to start a slice as transient unit")
-		}
-		properties = append(properties, systemdDbus.PropWants(slice))
-	} else {
-		// otherwise, we use Slice=
-		properties = append(properties, systemdDbus.PropSlice(slice))
-	}
-
-	// only add pid if its valid, -1 is used w/ general slice creation.
-	if pid != -1 {
-		properties = append(properties, newProp("PIDs", []uint32{uint32(pid)}))
-	}
-
-	if hasDelegate {
+	properties = append(properties,
+		systemdDbus.PropSlice(slice),
+		systemdDbus.PropDescription("docker container "+c.Name),
+		newProp("PIDs", []uint32{uint32(pid)}),
 		// This is only supported on systemd versions 218 and above.
-		properties = append(properties, newProp("Delegate", true))
-	}
+		newProp("Delegate", true),
+	)
 
 	// Always enable accounting, this gets us the same behaviour as the fs implementation,
 	// plus the kernel has some problems with joining the memory cgroup at a later time.
@@ -260,19 +201,12 @@ func (m *Manager) Apply(pid int) error {
 
 	if c.Resources.Memory != 0 {
 		properties = append(properties,
-			newProp("MemoryLimit", c.Resources.Memory))
+			newProp("MemoryLimit", uint64(c.Resources.Memory)))
 	}
 
 	if c.Resources.CpuShares != 0 {
 		properties = append(properties,
-			newProp("CPUShares", c.Resources.CpuShares))
-	}
-
-	// cpu.cfs_quota_us and cpu.cfs_period_us are controlled by systemd.
-	if c.Resources.CpuQuota != 0 && c.Resources.CpuPeriod != 0 {
-		cpuQuotaPerSecUSec := uint64(c.Resources.CpuQuota*1000000) / c.Resources.CpuPeriod
-		properties = append(properties,
-			newProp("CPUQuotaPerSecUSec", cpuQuotaPerSecUSec))
+			newProp("CPUShares", uint64(c.Resources.CpuShares)))
 	}
 
 	if c.Resources.BlkioWeight != 0 {
@@ -280,15 +214,17 @@ func (m *Manager) Apply(pid int) error {
 			newProp("BlockIOWeight", uint64(c.Resources.BlkioWeight)))
 	}
 
-	// We have to set kernel memory here, as we can't change it once
-	// processes have been attached to the cgroup.
-	if c.Resources.KernelMemory != 0 {
+	// We need to set kernel memory before processes join cgroup because
+	// kmem.limit_in_bytes can only be set when the cgroup is empty.
+	// And swap memory limit needs to be set after memory limit, only
+	// memory limit is handled by systemd, so it's kind of ugly here.
+	if c.Resources.KernelMemory > 0 {
 		if err := setKernelMemory(c); err != nil {
 			return err
 		}
 	}
 
-	if _, err := theConn.StartTransientUnit(unitName, "replace", properties, nil); err != nil && !isUnitExists(err) {
+	if _, err := theConn.StartTransientUnit(unitName, "replace", properties, nil); err != nil {
 		return err
 	}
 
@@ -333,6 +269,15 @@ func (m *Manager) GetPaths() map[string]string {
 	return paths
 }
 
+func writeFile(dir, file, data string) error {
+	// Normally dir should not be empty, one case is that cgroup subsystem
+	// is not mounted, we will get empty dir, and we want it fail here.
+	if dir == "" {
+		return fmt.Errorf("no such directory for %s.", file)
+	}
+	return ioutil.WriteFile(filepath.Join(dir, file), []byte(data), 0700)
+}
+
 func join(c *configs.Cgroup, subsystem string, pid int) (string, error) {
 	path, err := getSubsystemPath(c, subsystem)
 	if err != nil {
@@ -341,9 +286,10 @@ func join(c *configs.Cgroup, subsystem string, pid int) (string, error) {
 	if err := os.MkdirAll(path, 0755); err != nil {
 		return "", err
 	}
-	if err := cgroups.WriteCgroupProc(path, pid); err != nil {
+	if err := writeFile(path, "cgroup.procs", strconv.Itoa(pid)); err != nil {
 		return "", err
 	}
+
 	return path, nil
 }
 
@@ -353,6 +299,7 @@ func joinCgroups(c *configs.Cgroup, pid int) error {
 		switch name {
 		case "name=systemd":
 			// let systemd handle this
+			break
 		case "cpuset":
 			path, err := getSubsystemPath(c, name)
 			if err != nil && !cgroups.IsNotFound(err) {
@@ -362,6 +309,7 @@ func joinCgroups(c *configs.Cgroup, pid int) error {
 			if err := s.ApplyDir(path, c, pid); err != nil {
 				return err
 			}
+			break
 		default:
 			_, err := join(c, name, pid)
 			if err != nil {
@@ -383,10 +331,10 @@ func joinCgroups(c *configs.Cgroup, pid int) error {
 	return nil
 }
 
-// systemd represents slice hierarchy using `-`, so we need to follow suit when
+// systemd represents slice heirarchy using `-`, so we need to follow suit when
 // generating the path of slice. Essentially, test-a-b.slice becomes
 // test.slice/test-a.slice/test-a-b.slice.
-func ExpandSlice(slice string) (string, error) {
+func expandSlice(slice string) (string, error) {
 	suffix := ".slice"
 	// Name has to end with ".slice", but can't be just ".slice".
 	if len(slice) < len(suffix) || !strings.HasSuffix(slice, suffix) {
@@ -400,10 +348,6 @@ func ExpandSlice(slice string) (string, error) {
 
 	var path, prefix string
 	sliceName := strings.TrimSuffix(slice, suffix)
-	// if input was -.slice, we should just return root now
-	if sliceName == "-" {
-		return "/", nil
-	}
 	for _, component := range strings.Split(sliceName, "-") {
 		// test--a.slice isn't permitted, nor is -test.slice.
 		if component == "" {
@@ -424,19 +368,17 @@ func getSubsystemPath(c *configs.Cgroup, subsystem string) (string, error) {
 		return "", err
 	}
 
-	initPath, err := cgroups.GetInitCgroup(subsystem)
+	initPath, err := cgroups.GetInitCgroupDir(subsystem)
 	if err != nil {
 		return "", err
 	}
-	// if pid 1 is systemd 226 or later, it will be in init.scope, not the root
-	initPath = strings.TrimSuffix(filepath.Clean(initPath), "init.scope")
 
 	slice := "system.slice"
 	if c.Parent != "" {
 		slice = c.Parent
 	}
 
-	slice, err = ExpandSlice(slice)
+	slice, err = expandSlice(slice)
 	if err != nil {
 		return "", err
 	}
@@ -497,11 +439,6 @@ func (m *Manager) GetStats() (*cgroups.Stats, error) {
 }
 
 func (m *Manager) Set(container *configs.Config) error {
-	// If Paths are set, then we are just joining cgroups paths
-	// and there is no need to set any values.
-	if m.Cgroups.Paths != nil {
-		return nil
-	}
 	for _, sys := range subsystems {
 		// Get the subsystem path, but don't error out for not found cgroups.
 		path, err := getSubsystemPath(container.Cgroups, sys.Name())
@@ -523,11 +460,7 @@ func (m *Manager) Set(container *configs.Config) error {
 }
 
 func getUnitName(c *configs.Cgroup) string {
-	// by default, we create a scope unless the user explicitly asks for a slice.
-	if !strings.HasSuffix(c.Name, ".slice") {
-		return fmt.Sprintf("%s-%s.scope", c.ScopePrefix, c.Name)
-	}
-	return c.Name
+	return fmt.Sprintf("%s-%s.scope", c.ScopePrefix, c.Name)
 }
 
 func setKernelMemory(c *configs.Cgroup) error {
@@ -539,15 +472,8 @@ func setKernelMemory(c *configs.Cgroup) error {
 	if err := os.MkdirAll(path, 0755); err != nil {
 		return err
 	}
-	return fs.EnableKernelMemoryAccounting(path)
-}
 
-// isUnitExists returns true if the error is that a systemd unit already exists.
-func isUnitExists(err error) bool {
-	if err != nil {
-		if dbusError, ok := err.(dbus.Error); ok {
-			return strings.Contains(dbusError.Name, "org.freedesktop.systemd1.UnitExists")
-		}
-	}
-	return false
+	// This doesn't get called by manager.Set, so we need to do it here.
+	s := &fs.MemoryGroup{}
+	return s.SetKernelMemory(path, c)
 }

vendor/github.com/opencontainers/runc/libcontainer/cgroups/utils.go

@@ -16,24 +16,37 @@ import (
 	"github.com/docker/go-units"
 )
 
-const (
-	cgroupNamePrefix = "name="
-	CgroupProcesses  = "cgroup.procs"
-)
+const cgroupNamePrefix = "name="
 
-// https://www.kernel.org/doc/Documentation/cgroup-v1/cgroups.txt
+// https://www.kernel.org/doc/Documentation/cgroups/cgroups.txt
 func FindCgroupMountpoint(subsystem string) (string, error) {
-	mnt, _, err := FindCgroupMountpointAndRoot(subsystem)
-	return mnt, err
-}
-
-func FindCgroupMountpointAndRoot(subsystem string) (string, string, error) {
 	// We are not using mount.GetMounts() because it's super-inefficient,
 	// parsing it directly sped up x10 times because of not using Sscanf.
 	// It was one of two major performance drawbacks in container start.
-	if !isSubsystemAvailable(subsystem) {
-		return "", "", NewNotFoundError(subsystem)
+	f, err := os.Open("/proc/self/mountinfo")
+	if err != nil {
+		return "", err
 	}
+	defer f.Close()
+
+	scanner := bufio.NewScanner(f)
+	for scanner.Scan() {
+		txt := scanner.Text()
+		fields := strings.Split(txt, " ")
+		for _, opt := range strings.Split(fields[len(fields)-1], ",") {
+			if opt == subsystem {
+				return fields[4], nil
+			}
+		}
+	}
+	if err := scanner.Err(); err != nil {
+		return "", err
+	}
+
+	return "", NewNotFoundError(subsystem)
+}
+
+func FindCgroupMountpointAndRoot(subsystem string) (string, string, error) {
 	f, err := os.Open("/proc/self/mountinfo")
 	if err != nil {
 		return "", "", err
@@ -57,30 +70,6 @@ func FindCgroupMountpointAndRoot(subsystem string) (string, string, error) {
 	return "", "", NewNotFoundError(subsystem)
 }
 
-func isSubsystemAvailable(subsystem string) bool {
-	cgroups, err := ParseCgroupFile("/proc/self/cgroup")
-	if err != nil {
-		return false
-	}
-	_, avail := cgroups[subsystem]
-	return avail
-}
-
-func GetClosestMountpointAncestor(dir, mountinfo string) string {
-	deepestMountPoint := ""
-	for _, mountInfoEntry := range strings.Split(mountinfo, "\n") {
-		mountInfoParts := strings.Fields(mountInfoEntry)
-		if len(mountInfoParts) < 5 {
-			continue
-		}
-		mountPoint := mountInfoParts[4]
-		if strings.HasPrefix(mountPoint, deepestMountPoint) && strings.HasPrefix(dir, mountPoint) {
-			deepestMountPoint = mountPoint
-		}
-	}
-	return deepestMountPoint
-}
-
 func FindCgroupMountpointDir() (string, error) {
 	f, err := os.Open("/proc/self/mountinfo")
 	if err != nil {
@@ -124,7 +113,7 @@ type Mount struct {
 	Subsystems []string
 }
 
-func (m Mount) GetOwnCgroup(cgroups map[string]string) (string, error) {
+func (m Mount) GetThisCgroupDir(cgroups map[string]string) (string, error) {
 	if len(m.Subsystems) == 0 {
 		return "", fmt.Errorf("no subsystem for mount")
 	}
@@ -132,17 +121,16 @@ func (m Mount) GetOwnCgroup(cgroups map[string]string) (string, error) {
 	return getControllerPath(m.Subsystems[0], cgroups)
 }
 
-func getCgroupMountsHelper(ss map[string]bool, mi io.Reader, all bool) ([]Mount, error) {
+func getCgroupMountsHelper(ss map[string]bool, mi io.Reader) ([]Mount, error) {
 	res := make([]Mount, 0, len(ss))
 	scanner := bufio.NewScanner(mi)
-	numFound := 0
-	for scanner.Scan() && numFound < len(ss) {
+	for scanner.Scan() {
 		txt := scanner.Text()
 		sepIdx := strings.Index(txt, " - ")
 		if sepIdx == -1 {
 			return nil, fmt.Errorf("invalid mountinfo format")
 		}
-		if txt[sepIdx+3:sepIdx+10] == "cgroup2" || txt[sepIdx+3:sepIdx+9] != "cgroup" {
+		if txt[sepIdx+3:sepIdx+9] != "cgroup" {
 			continue
 		}
 		fields := strings.Split(txt, " ")
@@ -151,16 +139,11 @@ func getCgroupMountsHelper(ss map[string]bool, mi io.Reader, all bool) ([]Mount,
 			Root:       fields[3],
 		}
 		for _, opt := range strings.Split(fields[len(fields)-1], ",") {
-			if !ss[opt] {
-				continue
-			}
 			if strings.HasPrefix(opt, cgroupNamePrefix) {
 				m.Subsystems = append(m.Subsystems, opt[len(cgroupNamePrefix):])
-			} else {
-				m.Subsystems = append(m.Subsystems, opt)
 			}
-			if !all {
-				numFound++
+			if ss[opt] {
+				m.Subsystems = append(m.Subsystems, opt)
 			}
 		}
 		res = append(res, m)
@@ -171,28 +154,26 @@ func getCgroupMountsHelper(ss map[string]bool, mi io.Reader, all bool) ([]Mount,
 	return res, nil
 }
 
-// GetCgroupMounts returns the mounts for the cgroup subsystems.
-// all indicates whether to return just the first instance or all the mounts.
-func GetCgroupMounts(all bool) ([]Mount, error) {
+func GetCgroupMounts() ([]Mount, error) {
 	f, err := os.Open("/proc/self/mountinfo")
 	if err != nil {
 		return nil, err
 	}
 	defer f.Close()
 
-	allSubsystems, err := ParseCgroupFile("/proc/self/cgroup")
+	all, err := GetAllSubsystems()
 	if err != nil {
 		return nil, err
 	}
 
 	allMap := make(map[string]bool)
-	for s := range allSubsystems {
+	for _, s := range all {
 		allMap[s] = true
 	}
-	return getCgroupMountsHelper(allMap, f, all)
+	return getCgroupMountsHelper(allMap, f)
 }
 
-// GetAllSubsystems returns all the cgroup subsystems supported by the kernel
+// Returns all the cgroup subsystems supported by the kernel
 func GetAllSubsystems() ([]string, error) {
 	f, err := os.Open("/proc/cgroups")
 	if err != nil {
@@ -204,6 +185,9 @@ func GetAllSubsystems() ([]string, error) {
 
 	s := bufio.NewScanner(f)
 	for s.Scan() {
+		if err := s.Err(); err != nil {
+			return nil, err
+		}
 		text := s.Text()
 		if text[0] != '#' {
 			parts := strings.Fields(text)
@@ -212,14 +196,11 @@ func GetAllSubsystems() ([]string, error) {
 			}
 		}
 	}
-	if err := s.Err(); err != nil {
-		return nil, err
-	}
 	return subsystems, nil
 }
 
-// GetOwnCgroup returns the relative path to the cgroup docker is running in.
-func GetOwnCgroup(subsystem string) (string, error) {
+// Returns the relative path to the cgroup docker is running in.
+func GetThisCgroupDir(subsystem string) (string, error) {
 	cgroups, err := ParseCgroupFile("/proc/self/cgroup")
 	if err != nil {
 		return "", err
@@ -228,16 +209,8 @@ func GetOwnCgroup(subsystem string) (string, error) {
 	return getControllerPath(subsystem, cgroups)
 }
 
-func GetOwnCgroupPath(subsystem string) (string, error) {
-	cgroup, err := GetOwnCgroup(subsystem)
-	if err != nil {
-		return "", err
-	}
+func GetInitCgroupDir(subsystem string) (string, error) {
 
-	return getCgroupPathHelper(subsystem, cgroup)
-}
-
-func GetInitCgroup(subsystem string) (string, error) {
 	cgroups, err := ParseCgroupFile("/proc/1/cgroup")
 	if err != nil {
 		return "", err
@@ -246,33 +219,8 @@ func GetInitCgroup(subsystem string) (string, error) {
 	return getControllerPath(subsystem, cgroups)
 }
 
-func GetInitCgroupPath(subsystem string) (string, error) {
-	cgroup, err := GetInitCgroup(subsystem)
-	if err != nil {
-		return "", err
-	}
-
-	return getCgroupPathHelper(subsystem, cgroup)
-}
-
-func getCgroupPathHelper(subsystem, cgroup string) (string, error) {
-	mnt, root, err := FindCgroupMountpointAndRoot(subsystem)
-	if err != nil {
-		return "", err
-	}
-
-	// This is needed for nested containers, because in /proc/self/cgroup we
-	// see pathes from host, which don't exist in container.
-	relCgroup, err := filepath.Rel(root, cgroup)
-	if err != nil {
-		return "", err
-	}
-
-	return filepath.Join(mnt, relCgroup), nil
-}
-
 func readProcsFile(dir string) ([]int, error) {
-	f, err := os.Open(filepath.Join(dir, CgroupProcesses))
+	f, err := os.Open(filepath.Join(dir, "cgroup.procs"))
 	if err != nil {
 		return nil, err
 	}
@@ -295,8 +243,6 @@ func readProcsFile(dir string) ([]int, error) {
 	return out, nil
 }
 
-// ParseCgroupFile parses the given cgroup file, typically from
-// /proc/<pid>/cgroup, into a map of subgroups to cgroup names.
 func ParseCgroupFile(path string) (map[string]string, error) {
 	f, err := os.Open(path)
 	if err != nil {
@@ -304,35 +250,21 @@ func ParseCgroupFile(path string) (map[string]string, error) {
 	}
 	defer f.Close()
 
-	return parseCgroupFromReader(f)
-}
-
-// helper function for ParseCgroupFile to make testing easier
-func parseCgroupFromReader(r io.Reader) (map[string]string, error) {
-	s := bufio.NewScanner(r)
+	s := bufio.NewScanner(f)
 	cgroups := make(map[string]string)
 
 	for s.Scan() {
-		text := s.Text()
-		// from cgroups(7):
-		// /proc/[pid]/cgroup
-		// ...
-		// For each cgroup hierarchy ... there is one entry
-		// containing three colon-separated fields of the form:
-		//     hierarchy-ID:subsystem-list:cgroup-path
-		parts := strings.SplitN(text, ":", 3)
-		if len(parts) < 3 {
-			return nil, fmt.Errorf("invalid cgroup entry: must contain at least two colons: %v", text)
+		if err := s.Err(); err != nil {
+			return nil, err
 		}
 
+		text := s.Text()
+		parts := strings.Split(text, ":")
+
 		for _, subs := range strings.Split(parts[1], ",") {
 			cgroups[subs] = parts[2]
 		}
 	}
-	if err := s.Err(); err != nil {
-		return nil, err
-	}
-
 	return cgroups, nil
 }
 
@@ -359,7 +291,8 @@ func PathExists(path string) bool {
 func EnterPid(cgroupPaths map[string]string, pid int) error {
 	for _, path := range cgroupPaths {
 		if PathExists(path) {
-			if err := WriteCgroupProc(path, pid); err != nil {
+			if err := ioutil.WriteFile(filepath.Join(path, "cgroup.procs"),
+				[]byte(strconv.Itoa(pid)), 0700); err != nil {
 				return err
 			}
 		}
@@ -428,7 +361,7 @@ func GetAllPids(path string) ([]int, error) {
 	// collect pids from all sub-cgroups
 	err := filepath.Walk(path, func(p string, info os.FileInfo, iErr error) error {
 		dir, file := filepath.Split(p)
-		if file != CgroupProcesses {
+		if file != "cgroup.procs" {
 			return nil
 		}
 		if iErr != nil {
@@ -443,20 +376,3 @@ func GetAllPids(path string) ([]int, error) {
 	})
 	return pids, err
 }
-
-// WriteCgroupProc writes the specified pid into the cgroup's cgroup.procs file
-func WriteCgroupProc(dir string, pid int) error {
-	// Normally dir should not be empty, one case is that cgroup subsystem
-	// is not mounted, we will get empty dir, and we want it fail here.
-	if dir == "" {
-		return fmt.Errorf("no such directory for %s", CgroupProcesses)
-	}
-
-	// Dont attach any pid to the cgroup if -1 is specified as a pid
-	if pid != -1 {
-		if err := ioutil.WriteFile(filepath.Join(dir, CgroupProcesses), []byte(strconv.Itoa(pid)), 0700); err != nil {
-			return fmt.Errorf("failed to write %v to %v: %v", pid, CgroupProcesses, err)
-		}
-	}
-	return nil
-}

vendor/github.com/opencontainers/runc/libcontainer/cgroups/utils_test.go

@@ -4,8 +4,6 @@ package cgroups
 
 import (
 	"bytes"
-	"fmt"
-	"reflect"
 	"strings"
 	"testing"
 )
@@ -93,34 +91,6 @@ const systemdMountinfo = `115 83 0:32 / / rw,relatime - aufs none rw,si=c0bd3d3,
 136 117 0:12 /1 /dev/console rw,nosuid,noexec,relatime - devpts none rw,gid=5,mode=620,ptmxmode=000
 84 115 0:40 / /tmp rw,relatime - tmpfs none rw`
 
-const cgroup2Mountinfo = `18 64 0:18 / /sys rw,nosuid,nodev,noexec,relatime shared:6 - sysfs sysfs rw,seclabel
-19 64 0:4 / /proc rw,nosuid,nodev,noexec,relatime shared:5 - proc proc rw
-20 64 0:6 / /dev rw,nosuid shared:2 - devtmpfs devtmpfs rw,seclabel,size=8171204k,nr_inodes=2042801,mode=755
-21 18 0:19 / /sys/kernel/security rw,nosuid,nodev,noexec,relatime shared:7 - securityfs securityfs rw
-22 20 0:20 / /dev/shm rw,nosuid,nodev shared:3 - tmpfs tmpfs rw,seclabel
-23 20 0:21 / /dev/pts rw,nosuid,noexec,relatime shared:4 - devpts devpts rw,seclabel,gid=5,mode=620,ptmxmode=000
-24 64 0:22 / /run rw,nosuid,nodev shared:24 - tmpfs tmpfs rw,seclabel,mode=755
-25 18 0:23 / /sys/fs/cgroup ro,nosuid,nodev,noexec shared:8 - tmpfs tmpfs ro,seclabel,mode=755
-26 25 0:24 / /sys/fs/cgroup/systemd rw,nosuid,nodev,noexec,relatime shared:9 - cgroup2 cgroup rw
-27 18 0:25 / /sys/fs/pstore rw,nosuid,nodev,noexec,relatime shared:20 - pstore pstore rw,seclabel
-28 18 0:26 / /sys/firmware/efi/efivars rw,nosuid,nodev,noexec,relatime shared:21 - efivarfs efivarfs rw
-29 25 0:27 / /sys/fs/cgroup/cpu,cpuacct rw,nosuid,nodev,noexec,relatime shared:10 - cgroup cgroup rw,cpu,cpuacct
-30 25 0:28 / /sys/fs/cgroup/memory rw,nosuid,nodev,noexec,relatime shared:11 - cgroup cgroup rw,memory
-31 25 0:29 / /sys/fs/cgroup/net_cls,net_prio rw,nosuid,nodev,noexec,relatime shared:12 - cgroup cgroup rw,net_cls,net_prio
-32 25 0:30 / /sys/fs/cgroup/blkio rw,nosuid,nodev,noexec,relatime shared:13 - cgroup cgroup rw,blkio
-33 25 0:31 / /sys/fs/cgroup/perf_event rw,nosuid,nodev,noexec,relatime shared:14 - cgroup cgroup rw,perf_event
-34 25 0:32 / /sys/fs/cgroup/hugetlb rw,nosuid,nodev,noexec,relatime shared:15 - cgroup cgroup rw,hugetlb
-35 25 0:33 / /sys/fs/cgroup/freezer rw,nosuid,nodev,noexec,relatime shared:16 - cgroup cgroup rw,freezer
-36 25 0:34 / /sys/fs/cgroup/cpuset rw,nosuid,nodev,noexec,relatime shared:17 - cgroup cgroup rw,cpuset
-37 25 0:35 / /sys/fs/cgroup/devices rw,nosuid,nodev,noexec,relatime shared:18 - cgroup cgroup rw,devices
-38 25 0:36 / /sys/fs/cgroup/pids rw,nosuid,nodev,noexec,relatime shared:19 - cgroup cgroup rw,pids
-61 18 0:37 / /sys/kernel/config rw,relatime shared:22 - configfs configfs rw
-64 0 253:0 / / rw,relatime shared:1 - ext4 /dev/mapper/fedora_dhcp--16--129-root rw,seclabel,data=ordered
-39 18 0:17 / /sys/fs/selinux rw,relatime shared:23 - selinuxfs selinuxfs rw
-40 20 0:16 / /dev/mqueue rw,relatime shared:25 - mqueue mqueue rw,seclabel
-41 20 0:39 / /dev/hugepages rw,relatime shared:26 - hugetlbfs hugetlbfs rw,seclabel
-`
-
 func TestGetCgroupMounts(t *testing.T) {
 	type testData struct {
 		mountInfo  string
@@ -162,7 +132,7 @@ func TestGetCgroupMounts(t *testing.T) {
 	}
 	for _, td := range testTable {
 		mi := bytes.NewBufferString(td.mountInfo)
-		cgMounts, err := getCgroupMountsHelper(td.subsystems, mi, false)
+		cgMounts, err := getCgroupMountsHelper(td.subsystems, mi)
 		if err != nil {
 			t.Fatal(err)
 		}
@@ -215,119 +185,8 @@ func BenchmarkGetCgroupMounts(b *testing.B) {
 		b.StopTimer()
 		mi := bytes.NewBufferString(fedoraMountinfo)
 		b.StartTimer()
-		if _, err := getCgroupMountsHelper(subsystems, mi, false); err != nil {
+		if _, err := getCgroupMountsHelper(subsystems, mi); err != nil {
 			b.Fatal(err)
 		}
 	}
 }
-
-func TestParseCgroupString(t *testing.T) {
-	testCases := []struct {
-		input          string
-		expectedError  error
-		expectedOutput map[string]string
-	}{
-		{
-			// Taken from a CoreOS instance running systemd 225 with CPU/Mem
-			// accounting enabled in systemd
-			input: `9:blkio:/
-8:freezer:/
-7:perf_event:/
-6:devices:/system.slice/system-sshd.slice
-5:cpuset:/
-4:cpu,cpuacct:/system.slice/system-sshd.slice/sshd@126-10.240.0.15:22-xxx.yyy.zzz.aaa:33678.service
-3:net_cls,net_prio:/
-2:memory:/system.slice/system-sshd.slice/sshd@126-10.240.0.15:22-xxx.yyy.zzz.aaa:33678.service
-1:name=systemd:/system.slice/system-sshd.slice/sshd@126-10.240.0.15:22-xxx.yyy.zzz.aaa:33678.service`,
-			expectedOutput: map[string]string{
-				"name=systemd": "/system.slice/system-sshd.slice/sshd@126-10.240.0.15:22-xxx.yyy.zzz.aaa:33678.service",
-				"blkio":        "/",
-				"freezer":      "/",
-				"perf_event":   "/",
-				"devices":      "/system.slice/system-sshd.slice",
-				"cpuset":       "/",
-				"cpu":          "/system.slice/system-sshd.slice/sshd@126-10.240.0.15:22-xxx.yyy.zzz.aaa:33678.service",
-				"cpuacct":      "/system.slice/system-sshd.slice/sshd@126-10.240.0.15:22-xxx.yyy.zzz.aaa:33678.service",
-				"net_cls":      "/",
-				"net_prio":     "/",
-				"memory":       "/system.slice/system-sshd.slice/sshd@126-10.240.0.15:22-xxx.yyy.zzz.aaa:33678.service",
-			},
-		},
-		{
-			input:         `malformed input`,
-			expectedError: fmt.Errorf(`invalid cgroup entry: must contain at least two colons: malformed input`),
-		},
-	}
-
-	for ndx, testCase := range testCases {
-		out, err := parseCgroupFromReader(strings.NewReader(testCase.input))
-		if err != nil {
-			if testCase.expectedError == nil || testCase.expectedError.Error() != err.Error() {
-				t.Errorf("%v: expected error %v, got error %v", ndx, testCase.expectedError, err)
-			}
-		} else {
-			if !reflect.DeepEqual(testCase.expectedOutput, out) {
-				t.Errorf("%v: expected output %v, got error %v", ndx, testCase.expectedOutput, out)
-			}
-		}
-	}
-
-}
-
-func TestIgnoreCgroup2Mount(t *testing.T) {
-	subsystems := map[string]bool{
-		"cpuset":       true,
-		"cpu":          true,
-		"cpuacct":      true,
-		"memory":       true,
-		"devices":      true,
-		"freezer":      true,
-		"net_cls":      true,
-		"blkio":        true,
-		"perf_event":   true,
-		"pids":         true,
-		"name=systemd": true,
-	}
-
-	mi := bytes.NewBufferString(cgroup2Mountinfo)
-	cgMounts, err := getCgroupMountsHelper(subsystems, mi, false)
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, m := range cgMounts {
-		if m.Mountpoint == "/sys/fs/cgroup/systemd" {
-			t.Errorf("parsed a cgroup2 mount at /sys/fs/cgroup/systemd instead of ignoring it")
-		}
-	}
-}
-
-const fakeMountInfo = ` 18 24 0:17 / /sys rw,nosuid,nodev,noexec,relatime - sysfs sysfs rw
-100 99 1:31 / /foo/bar rw,relatime - fake fake rw,fake
-100 99 1:31 / /foo/bar/baz2 rw,relatime - fake fake rw,fake
-100 99 1:31 / /foo/bar/baz rw,relatime - fake fake rw,fake
-100 99 1:31 / /foo/bar/bazza rw,relatime - fake fake rw,fake
-100 99 1:31 / /foo/bar/baz3 rw,relatime - fake fake rw,fake
-100 99 1:31 / /foo rw,relatime - fake fake rw,fake
-100 99 1:31 / /unrelated rw,relatime - fake fake rw,fake
-100 99 1:31 / / rw,relatime - fake fake rw,fake
-`
-
-func TestGetClosestMountpointAncestor(t *testing.T) {
-	testCases := []struct {
-		input      string
-		mountinfos string
-		output     string
-	}{
-		{input: "/foo/bar/baz/a/b/c", mountinfos: fakeMountInfo, output: "/foo/bar/baz"},
-		{input: "/foo/bar/baz", mountinfos: fakeMountInfo, output: "/foo/bar/baz"},
-		{input: "/foo/bar/bazza", mountinfos: fakeMountInfo, output: "/foo/bar/bazza"},
-		{input: "/a/b/c/d", mountinfos: fakeMountInfo, output: "/"},
-	}
-
-	for _, c := range testCases {
-		mountpoint := GetClosestMountpointAncestor(c.input, c.mountinfos)
-		if mountpoint != c.output {
-			t.Errorf("expected %s, got %s", c.output, mountpoint)
-		}
-	}
-}

vendor/github.com/opencontainers/runc/libcontainer/configs/cgroup_unix.go

@@ -1,3 +1,5 @@
+// +build linux freebsd
+
 package configs
 
 type FreezerState string
@@ -20,7 +22,7 @@ type Cgroup struct {
 	// The path is assumed to be relative to the host system cgroup mountpoint.
 	Path string `json:"path"`
 
-	// ScopePrefix describes prefix for the scope name
+	// ScopePrefix decribes prefix for the scope name
 	ScopePrefix string `json:"scope_prefix"`
 
 	// Paths represent the absolute cgroups paths to join.
@@ -34,7 +36,7 @@ type Cgroup struct {
 type Resources struct {
 	// If this is true allow access to any kind of device within the container.  If false, allow access only to devices explicitly listed in the allowed_devices list.
 	// Deprecated
-	AllowAllDevices *bool `json:"allow_all_devices,omitempty"`
+	AllowAllDevices bool `json:"allow_all_devices,omitempty"`
 	// Deprecated
 	AllowedDevices []*Device `json:"allowed_devices,omitempty"`
 	// Deprecated
@@ -58,19 +60,19 @@ type Resources struct {
 	KernelMemoryTCP int64 `json:"kernel_memory_tcp"`
 
 	// CPU shares (relative weight vs. other containers)
-	CpuShares uint64 `json:"cpu_shares"`
+	CpuShares int64 `json:"cpu_shares"`
 
 	// CPU hardcap limit (in usecs). Allowed cpu time in a given period.
 	CpuQuota int64 `json:"cpu_quota"`
 
 	// CPU period to be used for hardcapping (in usecs). 0 to use system default.
-	CpuPeriod uint64 `json:"cpu_period"`
+	CpuPeriod int64 `json:"cpu_period"`
 
 	// How many time CPU will use in realtime scheduling (in usecs).
-	CpuRtRuntime int64 `json:"cpu_rt_quota"`
+	CpuRtRuntime int64 `json:"cpu_quota"`
 
 	// CPU period to be used for realtime scheduling (in usecs).
-	CpuRtPeriod uint64 `json:"cpu_rt_period"`
+	CpuRtPeriod int64 `json:"cpu_period"`
 
 	// CPU to use
 	CpusetCpus string `json:"cpuset_cpus"`
@@ -93,7 +95,7 @@ type Resources struct {
 	// IO read rate limit per cgroup per device, bytes per second.
 	BlkioThrottleReadBpsDevice []*ThrottleDevice `json:"blkio_throttle_read_bps_device"`
 
-	// IO write rate limit per cgroup per device, bytes per second.
+	// IO write rate limit per cgroup per divice, bytes per second.
 	BlkioThrottleWriteBpsDevice []*ThrottleDevice `json:"blkio_throttle_write_bps_device"`
 
 	// IO read rate limit per cgroup per device, IO per second.
@@ -112,11 +114,11 @@ type Resources struct {
 	OomKillDisable bool `json:"oom_kill_disable"`
 
 	// Tuning swappiness behaviour per cgroup
-	MemorySwappiness *uint64 `json:"memory_swappiness"`
+	MemorySwappiness *int64 `json:"memory_swappiness"`
 
 	// Set priority of network traffic for container
 	NetPrioIfpriomap []*IfPrioMap `json:"net_prio_ifpriomap"`
 
 	// Set class identifier for container's network packets
-	NetClsClassid uint32 `json:"net_cls_classid_u"`
+	NetClsClassid string `json:"net_cls_classid"`
 }

vendor/github.com/opencontainers/runc/libcontainer/configs/config.go

@@ -7,9 +7,7 @@ import (
 	"os/exec"
 	"time"
 
-	"github.com/opencontainers/runtime-spec/specs-go"
-
-	"github.com/sirupsen/logrus"
+	"github.com/Sirupsen/logrus"
 )
 
 type Rlimit struct {
@@ -35,7 +33,7 @@ type Seccomp struct {
 	Syscalls      []*Syscall `json:"syscalls"`
 }
 
-// Action is taken upon rule match in Seccomp
+// An action to be taken upon rule match in Seccomp
 type Action int
 
 const (
@@ -46,7 +44,7 @@ const (
 	Trace
 )
 
-// Operator is a comparison operator to be used when matching syscall arguments in Seccomp
+// A comparison operator to be used when matching syscall arguments in Seccomp
 type Operator int
 
 const (
@@ -59,7 +57,7 @@ const (
 	MaskEqualTo
 )
 
-// Arg is a rule to match a specific syscall argument in Seccomp
+// A rule to match a specific syscall argument in Seccomp
 type Arg struct {
 	Index    uint     `json:"index"`
 	Value    uint64   `json:"value"`
@@ -67,7 +65,7 @@ type Arg struct {
 	Op       Operator `json:"op"`
 }
 
-// Syscall is a rule to match a syscall in Seccomp
+// An rule to match a syscall in Seccomp
 type Syscall struct {
 	Name   string `json:"name"`
 	Action Action `json:"action"`
@@ -87,6 +85,11 @@ type Config struct {
 	// that the parent process dies.
 	ParentDeathSignal int `json:"parent_death_signal"`
 
+	// PivotDir allows a custom directory inside the container's root filesystem to be used as pivot, when NoPivotRoot is not set.
+	// When a custom PivotDir not set, a temporary dir inside the root filesystem will be used. The pivot dir needs to be writeable.
+	// This is required when using read only root filesystems. In these cases, a read/writeable path can be (bind) mounted somewhere inside the root filesystem to act as pivot.
+	PivotDir string `json:"pivot_dir"`
+
 	// Path to a directory containing the container's root filesystem.
 	Rootfs string `json:"rootfs"`
 
@@ -114,8 +117,8 @@ type Config struct {
 	Namespaces Namespaces `json:"namespaces"`
 
 	// Capabilities specify the capabilities to keep when executing the process inside the container
-	// All capabilities not specified will be dropped from the processes capability mask
-	Capabilities *Capabilities `json:"capabilities"`
+	// All capbilities not specified will be dropped from the processes capability mask
+	Capabilities []string `json:"capabilities"`
 
 	// Networks specifies the container's network setup to be created
 	Networks []*Network `json:"networks"`
@@ -145,6 +148,10 @@ type Config struct {
 	// More information about kernel oom score calculation here: https://lwn.net/Articles/317814/
 	OomScoreAdj int `json:"oom_score_adj"`
 
+	// AdditionalGroups specifies the gids that should be added to supplementary groups
+	// in addition to those that the user belongs to.
+	AdditionalGroups []string `json:"additional_groups"`
+
 	// UidMappings is an array of User ID mappings for User Namespaces
 	UidMappings []IDMap `json:"uid_mappings"`
 
@@ -180,13 +187,6 @@ type Config struct {
 
 	// Labels are user defined metadata that is stored in the config and populated on the state
 	Labels []string `json:"labels"`
-
-	// NoNewKeyring will not allocated a new session keyring for the container.  It will use the
-	// callers keyring in this case.
-	NoNewKeyring bool `json:"no_new_keyring"`
-
-	// Rootless specifies whether the container is a rootless container.
-	Rootless bool `json:"rootless"`
 }
 
 type Hooks struct {
@@ -201,19 +201,6 @@ type Hooks struct {
 	Poststop []Hook
 }
 
-type Capabilities struct {
-	// Bounding is the set of capabilities checked by the kernel.
-	Bounding []string
-	// Effective is the set of capabilities checked by the kernel.
-	Effective []string
-	// Inheritable is the capabilities preserved across execve.
-	Inheritable []string
-	// Permitted is the limiting superset for effective capabilities.
-	Permitted []string
-	// Ambient is the ambient set of capabilities that are kept.
-	Ambient []string
-}
-
 func (hooks *Hooks) UnmarshalJSON(b []byte) error {
 	var state struct {
 		Prestart  []CommandHook
@@ -261,14 +248,20 @@ func (hooks Hooks) MarshalJSON() ([]byte, error) {
 }
 
 // HookState is the payload provided to a hook on execution.
-type HookState specs.State
+type HookState struct {
+	Version    string `json:"ociVersion"`
+	ID         string `json:"id"`
+	Pid        int    `json:"pid"`
+	Root       string `json:"root"`
+	BundlePath string `json:"bundlePath"`
+}
 
 type Hook interface {
 	// Run executes the hook with the provided state.
 	Run(HookState) error
 }
 
-// NewFunctionHook will call the provided function when the hook is run.
+// NewFunctionHooks will call the provided function when the hook is run.
 func NewFunctionHook(f func(HookState) error) FuncHook {
 	return FuncHook{
 		run: f,
@@ -291,7 +284,7 @@ type Command struct {
 	Timeout *time.Duration `json:"timeout"`
 }
 
-// NewCommandHook will execute the provided command when the hook is run.
+// NewCommandHooks will execute the provided command when the hook is run.
 func NewCommandHook(cmd Command) CommandHook {
 	return CommandHook{
 		Command: cmd,
@@ -307,38 +300,29 @@ func (c Command) Run(s HookState) error {
 	if err != nil {
 		return err
 	}
-	var stdout, stderr bytes.Buffer
 	cmd := exec.Cmd{
-		Path:   c.Path,
-		Args:   c.Args,
-		Env:    c.Env,
-		Stdin:  bytes.NewReader(b),
-		Stdout: &stdout,
-		Stderr: &stderr,
-	}
-	if err := cmd.Start(); err != nil {
-		return err
+		Path:  c.Path,
+		Args:  c.Args,
+		Env:   c.Env,
+		Stdin: bytes.NewReader(b),
 	}
 	errC := make(chan error, 1)
 	go func() {
-		err := cmd.Wait()
+		out, err := cmd.CombinedOutput()
 		if err != nil {
-			err = fmt.Errorf("error running hook: %v, stdout: %s, stderr: %s", err, stdout.String(), stderr.String())
+			err = fmt.Errorf("%s: %s", err, out)
 		}
 		errC <- err
 	}()
-	var timerCh <-chan time.Time
 	if c.Timeout != nil {
-		timer := time.NewTimer(*c.Timeout)
-		defer timer.Stop()
-		timerCh = timer.C
-	}
-	select {
-	case err := <-errC:
-		return err
-	case <-timerCh:
-		cmd.Process.Kill()
-		cmd.Wait()
-		return fmt.Errorf("hook ran past specified timeout of %.1fs", c.Timeout.Seconds())
+		select {
+		case err := <-errC:
+			return err
+		case <-time.After(*c.Timeout):
+			cmd.Process.Kill()
+			cmd.Wait()
+			return fmt.Errorf("hook ran past specified timeout of %.1fs", c.Timeout.Seconds())
+		}
 	}
+	return <-errC
 }

vendor/github.com/opencontainers/runc/libcontainer/configs/config_linux.go

@@ -1,61 +0,0 @@
-package configs
-
-import "fmt"
-
-// HostUID gets the translated uid for the process on host which could be
-// different when user namespaces are enabled.
-func (c Config) HostUID(containerId int) (int, error) {
-	if c.Namespaces.Contains(NEWUSER) {
-		if c.UidMappings == nil {
-			return -1, fmt.Errorf("User namespaces enabled, but no uid mappings found.")
-		}
-		id, found := c.hostIDFromMapping(containerId, c.UidMappings)
-		if !found {
-			return -1, fmt.Errorf("User namespaces enabled, but no user mapping found.")
-		}
-		return id, nil
-	}
-	// Return unchanged id.
-	return containerId, nil
-}
-
-// HostRootUID gets the root uid for the process on host which could be non-zero
-// when user namespaces are enabled.
-func (c Config) HostRootUID() (int, error) {
-	return c.HostUID(0)
-}
-
-// HostGID gets the translated gid for the process on host which could be
-// different when user namespaces are enabled.
-func (c Config) HostGID(containerId int) (int, error) {
-	if c.Namespaces.Contains(NEWUSER) {
-		if c.GidMappings == nil {
-			return -1, fmt.Errorf("User namespaces enabled, but no gid mappings found.")
-		}
-		id, found := c.hostIDFromMapping(containerId, c.GidMappings)
-		if !found {
-			return -1, fmt.Errorf("User namespaces enabled, but no group mapping found.")
-		}
-		return id, nil
-	}
-	// Return unchanged id.
-	return containerId, nil
-}
-
-// HostRootGID gets the root gid for the process on host which could be non-zero
-// when user namespaces are enabled.
-func (c Config) HostRootGID() (int, error) {
-	return c.HostGID(0)
-}
-
-// Utility function that gets a host ID for a container ID from user namespace map
-// if that ID is present in the map.
-func (c Config) hostIDFromMapping(containerID int, uMap []IDMap) (int, bool) {
-	for _, m := range uMap {
-		if (containerID >= m.ContainerID) && (containerID <= (m.ContainerID + m.Size - 1)) {
-			hostID := m.HostID + (containerID - m.ContainerID)
-			return hostID, true
-		}
-	}
-	return -1, false
-}

vendor/github.com/opencontainers/runc/libcontainer/configs/config_test.go

@@ -123,7 +123,7 @@ func TestFuncHookRun(t *testing.T) {
 		Version: "1",
 		ID:      "1",
 		Pid:     1,
-		Bundle:  "/bundle",
+		Root:    "root",
 	}
 
 	fHook := configs.NewFunctionHook(func(s configs.HookState) error {
@@ -141,7 +141,7 @@ func TestCommandHookRun(t *testing.T) {
 		Version: "1",
 		ID:      "1",
 		Pid:     1,
-		Bundle:  "/bundle",
+		Root:    "root",
 	}
 	timeout := time.Second
 
@@ -164,7 +164,7 @@ func TestCommandHookRunTimeout(t *testing.T) {
 		Version: "1",
 		ID:      "1",
 		Pid:     1,
-		Bundle:  "/bundle",
+		Root:    "root",
 	}
 	timeout := (10 * time.Millisecond)
 

vendor/github.com/opencontainers/runc/libcontainer/configs/config_unix.go

@@ -0,0 +1,51 @@
+// +build freebsd linux
+
+package configs
+
+import "fmt"
+
+// Gets the root uid for the process on host which could be non-zero
+// when user namespaces are enabled.
+func (c Config) HostUID() (int, error) {
+	if c.Namespaces.Contains(NEWUSER) {
+		if c.UidMappings == nil {
+			return -1, fmt.Errorf("User namespaces enabled, but no user mappings found.")
+		}
+		id, found := c.hostIDFromMapping(0, c.UidMappings)
+		if !found {
+			return -1, fmt.Errorf("User namespaces enabled, but no root user mapping found.")
+		}
+		return id, nil
+	}
+	// Return default root uid 0
+	return 0, nil
+}
+
+// Gets the root gid for the process on host which could be non-zero
+// when user namespaces are enabled.
+func (c Config) HostGID() (int, error) {
+	if c.Namespaces.Contains(NEWUSER) {
+		if c.GidMappings == nil {
+			return -1, fmt.Errorf("User namespaces enabled, but no gid mappings found.")
+		}
+		id, found := c.hostIDFromMapping(0, c.GidMappings)
+		if !found {
+			return -1, fmt.Errorf("User namespaces enabled, but no root group mapping found.")
+		}
+		return id, nil
+	}
+	// Return default root gid 0
+	return 0, nil
+}
+
+// Utility function that gets a host ID for a container ID from user namespace map
+// if that ID is present in the map.
+func (c Config) hostIDFromMapping(containerID int, uMap []IDMap) (int, bool) {
+	for _, m := range uMap {
+		if (containerID >= m.ContainerID) && (containerID <= (m.ContainerID + m.Size - 1)) {
+			hostID := m.HostID + (containerID - m.ContainerID)
+			return hostID, true
+		}
+	}
+	return -1, false
+}

vendor/github.com/opencontainers/runc/libcontainer/configs/config_unix_test.go

@@ -1,3 +1,5 @@
+// +build linux freebsd
+
 package configs
 
 import (
@@ -8,6 +10,30 @@ import (
 	"testing"
 )
 
+// Checks whether the expected capability is specified in the capabilities.
+func contains(expected string, values []string) bool {
+	for _, v := range values {
+		if v == expected {
+			return true
+		}
+	}
+	return false
+}
+
+func containsDevice(expected *Device, values []*Device) bool {
+	for _, d := range values {
+		if d.Path == expected.Path &&
+			d.Permissions == expected.Permissions &&
+			d.FileMode == expected.FileMode &&
+			d.Major == expected.Major &&
+			d.Minor == expected.Minor &&
+			d.Type == expected.Type {
+			return true
+		}
+	}
+	return false
+}
+
 func loadConfig(name string) (*Config, error) {
 	f, err := os.Open(filepath.Join("../sample_configs", name))
 	if err != nil {
@@ -63,11 +89,11 @@ func TestRemoveNamespace(t *testing.T) {
 	}
 }
 
-func TestHostRootUIDNoUSERNS(t *testing.T) {
+func TestHostUIDNoUSERNS(t *testing.T) {
 	config := &Config{
 		Namespaces: Namespaces{},
 	}
-	uid, err := config.HostRootUID()
+	uid, err := config.HostUID()
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -76,7 +102,7 @@ func TestHostRootUIDNoUSERNS(t *testing.T) {
 	}
 }
 
-func TestHostRootUIDWithUSERNS(t *testing.T) {
+func TestHostUIDWithUSERNS(t *testing.T) {
 	config := &Config{
 		Namespaces: Namespaces{{Type: NEWUSER}},
 		UidMappings: []IDMap{
@@ -87,7 +113,7 @@ func TestHostRootUIDWithUSERNS(t *testing.T) {
 			},
 		},
 	}
-	uid, err := config.HostRootUID()
+	uid, err := config.HostUID()
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -96,11 +122,11 @@ func TestHostRootUIDWithUSERNS(t *testing.T) {
 	}
 }
 
-func TestHostRootGIDNoUSERNS(t *testing.T) {
+func TestHostGIDNoUSERNS(t *testing.T) {
 	config := &Config{
 		Namespaces: Namespaces{},
 	}
-	uid, err := config.HostRootGID()
+	uid, err := config.HostGID()
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -109,7 +135,7 @@ func TestHostRootGIDNoUSERNS(t *testing.T) {
 	}
 }
 
-func TestHostRootGIDWithUSERNS(t *testing.T) {
+func TestHostGIDWithUSERNS(t *testing.T) {
 	config := &Config{
 		Namespaces: Namespaces{{Type: NEWUSER}},
 		GidMappings: []IDMap{
@@ -120,7 +146,7 @@ func TestHostRootGIDWithUSERNS(t *testing.T) {
 			},
 		},
 	}
-	uid, err := config.HostRootGID()
+	uid, err := config.HostGID()
 	if err != nil {
 		t.Fatal(err)
 	}

vendor/github.com/opencontainers/runc/libcontainer/configs/device_defaults.go

@@ -3,7 +3,7 @@
 package configs
 
 var (
-	// DefaultSimpleDevices are devices that are to be both allowed and created.
+	// These are devices that are to be both allowed and created.
 	DefaultSimpleDevices = []*Device{
 		// /dev/null and zero
 		{
@@ -107,5 +107,19 @@ var (
 			Permissions: "rwm",
 		},
 	}, DefaultSimpleDevices...)
-	DefaultAutoCreatedDevices = append([]*Device{}, DefaultSimpleDevices...)
+	DefaultAutoCreatedDevices = append([]*Device{
+		{
+			// /dev/fuse is created but not allowed.
+			// This is to allow java to work.  Because java
+			// Insists on there being a /dev/fuse
+			// https://github.com/docker/docker/issues/514
+			// https://github.com/docker/docker/issues/2393
+			//
+			Path:        "/dev/fuse",
+			Type:        'c',
+			Major:       10,
+			Minor:       229,
+			Permissions: "rwm",
+		},
+	}, DefaultSimpleDevices...)
 )

vendor/github.com/opencontainers/runc/libcontainer/configs/mount.go

@@ -1,11 +1,5 @@
 package configs
 
-const (
-	// EXT_COPYUP is a directive to copy up the contents of a directory when
-	// a tmpfs is mounted over it.
-	EXT_COPYUP = 1 << iota
-)
-
 type Mount struct {
 	// Source path for the mount.
 	Source string `json:"source"`
@@ -28,9 +22,6 @@ type Mount struct {
 	// Relabel source if set, "z" indicates shared, "Z" indicates unshared.
 	Relabel string `json:"relabel"`
 
-	// Extensions are additional flags that are specific to runc.
-	Extensions int `json:"extensions"`
-
 	// Optional Command to be run before Source is mounted.
 	PremountCmds []Command `json:"premount_cmds"`
 

vendor/github.com/opencontainers/runc/libcontainer/configs/namespaces_syscall.go

@@ -2,19 +2,19 @@
 
 package configs
 
-import "golang.org/x/sys/unix"
+import "syscall"
 
 func (n *Namespace) Syscall() int {
 	return namespaceInfo[n.Type]
 }
 
 var namespaceInfo = map[NamespaceType]int{
-	NEWNET:  unix.CLONE_NEWNET,
-	NEWNS:   unix.CLONE_NEWNS,
-	NEWUSER: unix.CLONE_NEWUSER,
-	NEWIPC:  unix.CLONE_NEWIPC,
-	NEWUTS:  unix.CLONE_NEWUTS,
-	NEWPID:  unix.CLONE_NEWPID,
+	NEWNET:  syscall.CLONE_NEWNET,
+	NEWNS:   syscall.CLONE_NEWNS,
+	NEWUSER: syscall.CLONE_NEWUSER,
+	NEWIPC:  syscall.CLONE_NEWIPC,
+	NEWUTS:  syscall.CLONE_NEWUTS,
+	NEWPID:  syscall.CLONE_NEWPID,
 }
 
 // CloneFlags parses the container's Namespaces options to set the correct

vendor/github.com/opencontainers/runc/libcontainer/configs/namespaces_syscall_unsupported.go

@@ -4,10 +4,12 @@ package configs
 
 func (n *Namespace) Syscall() int {
 	panic("No namespace syscall support")
+	return 0
 }
 
 // CloneFlags parses the container's Namespaces options to set the correct
 // flags on clone, unshare. This function returns flags only for new namespaces.
 func (n *Namespaces) CloneFlags() uintptr {
 	panic("No namespace syscall support")
+	return uintptr(0)
 }

vendor/github.com/opencontainers/runc/libcontainer/configs/namespaces_unix.go

@@ -1,3 +1,5 @@
+// +build linux freebsd
+
 package configs
 
 import (
@@ -20,8 +22,8 @@ var (
 	supportedNamespaces = make(map[NamespaceType]bool)
 )
 
-// NsName converts the namespace type to its filename
-func NsName(ns NamespaceType) string {
+// nsToFile converts the namespace type to its filename
+func nsToFile(ns NamespaceType) string {
 	switch ns {
 	case NEWNET:
 		return "net"
@@ -48,7 +50,7 @@ func IsNamespaceSupported(ns NamespaceType) bool {
 	if ok {
 		return supported
 	}
-	nsFile := NsName(ns)
+	nsFile := nsToFile(ns)
 	// if the namespace type is unknown, just return false
 	if nsFile == "" {
 		return false
@@ -62,12 +64,12 @@ func IsNamespaceSupported(ns NamespaceType) bool {
 
 func NamespaceTypes() []NamespaceType {
 	return []NamespaceType{
-		NEWUSER, // Keep user NS always first, don't move it.
-		NEWIPC,
-		NEWUTS,
 		NEWNET,
 		NEWPID,
 		NEWNS,
+		NEWUTS,
+		NEWIPC,
+		NEWUSER,
 	}
 }
 
@@ -79,7 +81,10 @@ type Namespace struct {
 }
 
 func (n *Namespace) GetPath(pid int) string {
-	return fmt.Sprintf("/proc/%d/ns/%s", pid, NsName(n.Type))
+	if n.Path != "" {
+		return n.Path
+	}
+	return fmt.Sprintf("/proc/%d/ns/%s", pid, nsToFile(n.Type))
 }
 
 func (n *Namespaces) Remove(t NamespaceType) bool {

vendor/github.com/opencontainers/runc/libcontainer/configs/namespaces_unsupported.go

@@ -1,4 +1,4 @@
-// +build !linux
+// +build !linux,!freebsd
 
 package configs
 

vendor/github.com/opencontainers/runc/libcontainer/configs/validate/rootless.go

@@ -1,117 +0,0 @@
-package validate
-
-import (
-	"fmt"
-	"os"
-	"reflect"
-	"strings"
-
-	"github.com/opencontainers/runc/libcontainer/configs"
-)
-
-var (
-	geteuid = os.Geteuid
-	getegid = os.Getegid
-)
-
-func (v *ConfigValidator) rootless(config *configs.Config) error {
-	if err := rootlessMappings(config); err != nil {
-		return err
-	}
-	if err := rootlessMount(config); err != nil {
-		return err
-	}
-	// Currently, cgroups cannot effectively be used in rootless containers.
-	// The new cgroup namespace doesn't really help us either because it doesn't
-	// have nice interactions with the user namespace (we're working with upstream
-	// to fix this).
-	if err := rootlessCgroup(config); err != nil {
-		return err
-	}
-
-	// XXX: We currently can't verify the user config at all, because
-	//      configs.Config doesn't store the user-related configs. So this
-	//      has to be verified by setupUser() in init_linux.go.
-
-	return nil
-}
-
-func rootlessMappings(config *configs.Config) error {
-	rootuid, err := config.HostRootUID()
-	if err != nil {
-		return fmt.Errorf("failed to get root uid from uidMappings: %v", err)
-	}
-	if euid := geteuid(); euid != 0 {
-		if !config.Namespaces.Contains(configs.NEWUSER) {
-			return fmt.Errorf("rootless containers require user namespaces")
-		}
-		if rootuid != euid {
-			return fmt.Errorf("rootless containers cannot map container root to a different host user")
-		}
-	}
-
-	rootgid, err := config.HostRootGID()
-	if err != nil {
-		return fmt.Errorf("failed to get root gid from gidMappings: %v", err)
-	}
-
-	// Similar to the above test, we need to make sure that we aren't trying to
-	// map to a group ID that we don't have the right to be.
-	if rootgid != getegid() {
-		return fmt.Errorf("rootless containers cannot map container root to a different host group")
-	}
-
-	// We can only map one user and group inside a container (our own).
-	if len(config.UidMappings) != 1 || config.UidMappings[0].Size != 1 {
-		return fmt.Errorf("rootless containers cannot map more than one user")
-	}
-	if len(config.GidMappings) != 1 || config.GidMappings[0].Size != 1 {
-		return fmt.Errorf("rootless containers cannot map more than one group")
-	}
-
-	return nil
-}
-
-// cgroup verifies that the user isn't trying to set any cgroup limits or paths.
-func rootlessCgroup(config *configs.Config) error {
-	// Nothing set at all.
-	if config.Cgroups == nil || config.Cgroups.Resources == nil {
-		return nil
-	}
-
-	// Used for comparing to the zero value.
-	left := reflect.ValueOf(*config.Cgroups.Resources)
-	right := reflect.Zero(left.Type())
-
-	// This is all we need to do, since specconv won't add cgroup options in
-	// rootless mode.
-	if !reflect.DeepEqual(left.Interface(), right.Interface()) {
-		return fmt.Errorf("cannot specify resource limits in rootless container")
-	}
-
-	return nil
-}
-
-// mount verifies that the user isn't trying to set up any mounts they don't have
-// the rights to do. In addition, it makes sure that no mount has a `uid=` or
-// `gid=` option that doesn't resolve to root.
-func rootlessMount(config *configs.Config) error {
-	// XXX: We could whitelist allowed devices at this point, but I'm not
-	//      convinced that's a good idea. The kernel is the best arbiter of
-	//      access control.
-
-	for _, mount := range config.Mounts {
-		// Check that the options list doesn't contain any uid= or gid= entries
-		// that don't resolve to root.
-		for _, opt := range strings.Split(mount.Data, ",") {
-			if strings.HasPrefix(opt, "uid=") && opt != "uid=0" {
-				return fmt.Errorf("cannot specify uid= mount options in rootless containers where argument isn't 0")
-			}
-			if strings.HasPrefix(opt, "gid=") && opt != "gid=0" {
-				return fmt.Errorf("cannot specify gid= mount options in rootless containers where argument isn't 0")
-			}
-		}
-	}
-
-	return nil
-}

vendor/github.com/opencontainers/runc/libcontainer/configs/validate/rootless_test.go

@@ -1,195 +0,0 @@
-package validate
-
-import (
-	"testing"
-
-	"github.com/opencontainers/runc/libcontainer/configs"
-)
-
-func init() {
-	geteuid = func() int { return 1337 }
-	getegid = func() int { return 7331 }
-}
-
-func rootlessConfig() *configs.Config {
-	return &configs.Config{
-		Rootfs:   "/var",
-		Rootless: true,
-		Namespaces: configs.Namespaces(
-			[]configs.Namespace{
-				{Type: configs.NEWUSER},
-			},
-		),
-		UidMappings: []configs.IDMap{
-			{
-				HostID:      geteuid(),
-				ContainerID: 0,
-				Size:        1,
-			},
-		},
-		GidMappings: []configs.IDMap{
-			{
-				HostID:      getegid(),
-				ContainerID: 0,
-				Size:        1,
-			},
-		},
-	}
-}
-
-func TestValidateRootless(t *testing.T) {
-	validator := New()
-
-	config := rootlessConfig()
-	if err := validator.Validate(config); err != nil {
-		t.Errorf("Expected error to not occur: %+v", err)
-	}
-}
-
-/* rootlessMappings() */
-
-func TestValidateRootlessUserns(t *testing.T) {
-	validator := New()
-
-	config := rootlessConfig()
-	config.Namespaces = nil
-	if err := validator.Validate(config); err == nil {
-		t.Errorf("Expected error to occur if user namespaces not set")
-	}
-}
-
-func TestValidateRootlessMappingUid(t *testing.T) {
-	validator := New()
-
-	config := rootlessConfig()
-	config.UidMappings = nil
-	if err := validator.Validate(config); err == nil {
-		t.Errorf("Expected error to occur if no uid mappings provided")
-	}
-
-	config = rootlessConfig()
-	config.UidMappings[0].HostID = geteuid() + 1
-	if err := validator.Validate(config); err == nil {
-		t.Errorf("Expected error to occur if geteuid() != mapped uid")
-	}
-
-	config = rootlessConfig()
-	config.UidMappings[0].Size = 1024
-	if err := validator.Validate(config); err == nil {
-		t.Errorf("Expected error to occur if more than one uid mapped")
-	}
-
-	config = rootlessConfig()
-	config.UidMappings = append(config.UidMappings, configs.IDMap{
-		HostID:      geteuid() + 1,
-		ContainerID: 0,
-		Size:        1,
-	})
-	if err := validator.Validate(config); err == nil {
-		t.Errorf("Expected error to occur if more than one uid extent mapped")
-	}
-}
-
-func TestValidateRootlessMappingGid(t *testing.T) {
-	validator := New()
-
-	config := rootlessConfig()
-	config.GidMappings = nil
-	if err := validator.Validate(config); err == nil {
-		t.Errorf("Expected error to occur if no gid mappings provided")
-	}
-
-	config = rootlessConfig()
-	config.GidMappings[0].HostID = getegid() + 1
-	if err := validator.Validate(config); err == nil {
-		t.Errorf("Expected error to occur if getegid() != mapped gid")
-	}
-
-	config = rootlessConfig()
-	config.GidMappings[0].Size = 1024
-	if err := validator.Validate(config); err == nil {
-		t.Errorf("Expected error to occur if more than one gid mapped")
-	}
-
-	config = rootlessConfig()
-	config.GidMappings = append(config.GidMappings, configs.IDMap{
-		HostID:      getegid() + 1,
-		ContainerID: 0,
-		Size:        1,
-	})
-	if err := validator.Validate(config); err == nil {
-		t.Errorf("Expected error to occur if more than one gid extent mapped")
-	}
-}
-
-/* rootlessMount() */
-
-func TestValidateRootlessMountUid(t *testing.T) {
-	config := rootlessConfig()
-	validator := New()
-
-	config.Mounts = []*configs.Mount{
-		{
-			Source:      "devpts",
-			Destination: "/dev/pts",
-			Device:      "devpts",
-		},
-	}
-
-	if err := validator.Validate(config); err != nil {
-		t.Errorf("Expected error to not occur when uid= not set in mount options: %+v", err)
-	}
-
-	config.Mounts[0].Data = "uid=5"
-	if err := validator.Validate(config); err == nil {
-		t.Errorf("Expected error to occur when setting uid=5 in mount options")
-	}
-
-	config.Mounts[0].Data = "uid=0"
-	if err := validator.Validate(config); err != nil {
-		t.Errorf("Expected error to not occur when setting uid=0 in mount options: %+v", err)
-	}
-}
-
-func TestValidateRootlessMountGid(t *testing.T) {
-	config := rootlessConfig()
-	validator := New()
-
-	config.Mounts = []*configs.Mount{
-		{
-			Source:      "devpts",
-			Destination: "/dev/pts",
-			Device:      "devpts",
-		},
-	}
-
-	if err := validator.Validate(config); err != nil {
-		t.Errorf("Expected error to not occur when gid= not set in mount options: %+v", err)
-	}
-
-	config.Mounts[0].Data = "gid=5"
-	if err := validator.Validate(config); err == nil {
-		t.Errorf("Expected error to occur when setting gid=5 in mount options")
-	}
-
-	config.Mounts[0].Data = "gid=0"
-	if err := validator.Validate(config); err != nil {
-		t.Errorf("Expected error to not occur when setting gid=0 in mount options: %+v", err)
-	}
-}
-
-/* rootlessCgroup() */
-
-func TestValidateRootlessCgroup(t *testing.T) {
-	validator := New()
-
-	config := rootlessConfig()
-	config.Cgroups = &configs.Cgroup{
-		Resources: &configs.Resources{
-			PidsLimit: 1337,
-		},
-	}
-	if err := validator.Validate(config); err == nil {
-		t.Errorf("Expected error to occur if cgroup limits set")
-	}
-}

vendor/github.com/opencontainers/runc/libcontainer/configs/validate/validator.go

@@ -7,7 +7,6 @@ import (
 	"strings"
 
 	"github.com/opencontainers/runc/libcontainer/configs"
-	selinux "github.com/opencontainers/selinux/go-selinux"
 )
 
 type Validator interface {
@@ -40,23 +39,12 @@ func (v *ConfigValidator) Validate(config *configs.Config) error {
 	if err := v.sysctl(config); err != nil {
 		return err
 	}
-	if config.Rootless {
-		if err := v.rootless(config); err != nil {
-			return err
-		}
-	}
 	return nil
 }
 
 // rootfs validates if the rootfs is an absolute path and is not a symlink
 // to the container's root filesystem.
 func (v *ConfigValidator) rootfs(config *configs.Config) error {
-	if _, err := os.Stat(config.Rootfs); err != nil {
-		if os.IsNotExist(err) {
-			return fmt.Errorf("rootfs (%s) does not exist", config.Rootfs)
-		}
-		return err
-	}
 	cleaned, err := filepath.Abs(config.Rootfs)
 	if err != nil {
 		return err
@@ -92,10 +80,6 @@ func (v *ConfigValidator) security(config *configs.Config) error {
 		!config.Namespaces.Contains(configs.NEWNS) {
 		return fmt.Errorf("unable to restrict sys entries without a private MNT namespace")
 	}
-	if config.ProcessLabel != "" && !selinux.GetEnabled() {
-		return fmt.Errorf("selinux label is specified in config, but selinux is disabled or not supported")
-	}
-
 	return nil
 }
 
@@ -137,11 +121,6 @@ func (v *ConfigValidator) sysctl(config *configs.Config) error {
 		}
 		if strings.HasPrefix(s, "net.") {
 			if config.Namespaces.Contains(configs.NEWNET) {
-				if path := config.Namespaces.PathOf(configs.NEWNET); path != "" {
-					if err := checkHostNs(s, path); err != nil {
-						return err
-					}
-				}
 				continue
 			} else {
 				return fmt.Errorf("sysctl %q is not allowed in the hosts network namespace", s)
@@ -152,44 +131,3 @@ func (v *ConfigValidator) sysctl(config *configs.Config) error {
 
 	return nil
 }
-
-func isSymbolicLink(path string) (bool, error) {
-	fi, err := os.Lstat(path)
-	if err != nil {
-		return false, err
-	}
-
-	return fi.Mode()&os.ModeSymlink == os.ModeSymlink, nil
-}
-
-// checkHostNs checks whether network sysctl is used in host namespace.
-func checkHostNs(sysctlConfig string, path string) error {
-	var currentProcessNetns = "/proc/self/ns/net"
-	// readlink on the current processes network namespace
-	destOfCurrentProcess, err := os.Readlink(currentProcessNetns)
-	if err != nil {
-		return fmt.Errorf("read soft link %q error", currentProcessNetns)
-	}
-
-	// First check if the provided path is a symbolic link
-	symLink, err := isSymbolicLink(path)
-	if err != nil {
-		return fmt.Errorf("could not check that %q is a symlink: %v", path, err)
-	}
-
-	if symLink == false {
-		// The provided namespace is not a symbolic link,
-		// it is not the host namespace.
-		return nil
-	}
-
-	// readlink on the path provided in the struct
-	destOfContainer, err := os.Readlink(path)
-	if err != nil {
-		return fmt.Errorf("read soft link %q error", path)
-	}
-	if destOfContainer == destOfCurrentProcess {
-		return fmt.Errorf("sysctl %q is not allowed in the hosts network namespace", sysctlConfig)
-	}
-	return nil
-}

vendor/github.com/opencontainers/runc/libcontainer/configs/validate/validator_test.go

@@ -100,7 +100,7 @@ func TestValidateHostnameWithoutUTSNamespace(t *testing.T) {
 func TestValidateSecurityWithMaskPaths(t *testing.T) {
 	config := &configs.Config{
 		Rootfs:    "/var",
-		MaskPaths: []string{"/proc/kcore"},
+		MaskPaths: []string{"/proc/kcores"},
 		Namespaces: configs.Namespaces(
 			[]configs.Namespace{
 				{Type: configs.NEWNS},
@@ -136,7 +136,7 @@ func TestValidateSecurityWithROPaths(t *testing.T) {
 func TestValidateSecurityWithoutNEWNS(t *testing.T) {
 	config := &configs.Config{
 		Rootfs:        "/var",
-		MaskPaths:     []string{"/proc/kcore"},
+		MaskPaths:     []string{"/proc/kcores"},
 		ReadonlyPaths: []string{"/proc/sys"},
 	}
 
@@ -148,9 +148,6 @@ func TestValidateSecurityWithoutNEWNS(t *testing.T) {
 }
 
 func TestValidateUsernamespace(t *testing.T) {
-	if _, err := os.Stat("/proc/self/ns/user"); os.IsNotExist(err) {
-		t.Skip("userns is unsupported")
-	}
 	config := &configs.Config{
 		Rootfs: "/var",
 		Namespaces: configs.Namespaces(
@@ -201,67 +198,3 @@ func TestValidateSysctl(t *testing.T) {
 		}
 	}
 }
-
-func TestValidateValidSysctl(t *testing.T) {
-	sysctl := map[string]string{
-		"fs.mqueue.ctl": "ctl",
-		"net.ctl":       "ctl",
-		"kernel.msgmax": "ctl",
-	}
-
-	for k, v := range sysctl {
-		config := &configs.Config{
-			Rootfs: "/var",
-			Sysctl: map[string]string{k: v},
-			Namespaces: []configs.Namespace{
-				{
-					Type: configs.NEWNET,
-				},
-				{
-					Type: configs.NEWIPC,
-				},
-			},
-		}
-
-		validator := validate.New()
-		err := validator.Validate(config)
-		if err != nil {
-			t.Errorf("Expected error to not occur with {%s=%s} but got: %q", k, v, err)
-		}
-	}
-}
-
-func TestValidateSysctlWithSameNs(t *testing.T) {
-	config := &configs.Config{
-		Rootfs: "/var",
-		Sysctl: map[string]string{"net.ctl": "ctl"},
-		Namespaces: configs.Namespaces(
-			[]configs.Namespace{
-				{
-					Type: configs.NEWNET,
-					Path: "/proc/self/ns/net",
-				},
-			},
-		),
-	}
-
-	validator := validate.New()
-	err := validator.Validate(config)
-	if err == nil {
-		t.Error("Expected error to occur but it was nil")
-	}
-}
-
-func TestValidateSysctlWithoutNETNamespace(t *testing.T) {
-	config := &configs.Config{
-		Rootfs:     "/var",
-		Sysctl:     map[string]string{"net.ctl": "ctl"},
-		Namespaces: []configs.Namespace{},
-	}
-
-	validator := validate.New()
-	err := validator.Validate(config)
-	if err == nil {
-		t.Error("Expected error to occur but it was nil")
-	}
-}

vendor/github.com/opencontainers/runc/libcontainer/console.go

@@ -1,17 +1,15 @@
 package libcontainer
 
-import (
-	"io"
-	"os"
-)
+import "io"
 
 // Console represents a pseudo TTY.
 type Console interface {
-	io.ReadWriteCloser
+	io.ReadWriter
+	io.Closer
 
 	// Path returns the filesystem path to the slave side of the pty.
 	Path() string
 
 	// Fd returns the fd for the master of the pty.
-	File() *os.File
+	Fd() uintptr
 }

vendor/github.com/opencontainers/runc/libcontainer/console_freebsd.go

@@ -6,8 +6,8 @@ import (
 	"errors"
 )
 
-// newConsole returns an initialized console that can be used within a container by copying bytes
+// NewConsole returns an initalized console that can be used within a container by copying bytes
 // from the master side to the slave that is attached as the tty for the container's init process.
-func newConsole() (Console, error) {
+func NewConsole(uid, gid int) (Console, error) {
 	return nil, errors.New("libcontainer console is not supported on FreeBSD")
 }

vendor/github.com/opencontainers/runc/libcontainer/console_linux.go

@@ -3,21 +3,17 @@ package libcontainer
 import (
 	"fmt"
 	"os"
+	"path/filepath"
+	"syscall"
 	"unsafe"
 
-	"golang.org/x/sys/unix"
+	"github.com/opencontainers/runc/libcontainer/label"
 )
 
-func ConsoleFromFile(f *os.File) Console {
-	return &linuxConsole{
-		master: f,
-	}
-}
-
-// newConsole returns an initialized console that can be used within a container by copying bytes
+// NewConsole returns an initalized console that can be used within a container by copying bytes
 // from the master side to the slave that is attached as the tty for the container's init process.
-func newConsole() (Console, error) {
-	master, err := os.OpenFile("/dev/ptmx", unix.O_RDWR|unix.O_NOCTTY|unix.O_CLOEXEC, 0)
+func NewConsole(uid, gid int) (Console, error) {
+	master, err := os.OpenFile("/dev/ptmx", syscall.O_RDWR|syscall.O_NOCTTY|syscall.O_CLOEXEC, 0)
 	if err != nil {
 		return nil, err
 	}
@@ -28,20 +24,34 @@ func newConsole() (Console, error) {
 	if err := unlockpt(master); err != nil {
 		return nil, err
 	}
+	if err := os.Chmod(console, 0600); err != nil {
+		return nil, err
+	}
+	if err := os.Chown(console, uid, gid); err != nil {
+		return nil, err
+	}
 	return &linuxConsole{
 		slavePath: console,
 		master:    master,
 	}, nil
 }
 
-// linuxConsole is a linux pseudo TTY for use within a container.
+// newConsoleFromPath is an internal function returning an initialized console for use inside
+// a container's MNT namespace.
+func newConsoleFromPath(slavePath string) *linuxConsole {
+	return &linuxConsole{
+		slavePath: slavePath,
+	}
+}
+
+// linuxConsole is a linux psuedo TTY for use within a container.
 type linuxConsole struct {
 	master    *os.File
 	slavePath string
 }
 
-func (c *linuxConsole) File() *os.File {
-	return c.master
+func (c *linuxConsole) Fd() uintptr {
+	return c.master.Fd()
 }
 
 func (c *linuxConsole) Path() string {
@@ -65,29 +75,33 @@ func (c *linuxConsole) Close() error {
 
 // mount initializes the console inside the rootfs mounting with the specified mount label
 // and applying the correct ownership of the console.
-func (c *linuxConsole) mount() error {
-	oldMask := unix.Umask(0000)
-	defer unix.Umask(oldMask)
-	f, err := os.Create("/dev/console")
+func (c *linuxConsole) mount(rootfs, mountLabel string) error {
+	oldMask := syscall.Umask(0000)
+	defer syscall.Umask(oldMask)
+	if err := label.SetFileLabel(c.slavePath, mountLabel); err != nil {
+		return err
+	}
+	dest := filepath.Join(rootfs, "/dev/console")
+	f, err := os.Create(dest)
 	if err != nil && !os.IsExist(err) {
 		return err
 	}
 	if f != nil {
 		f.Close()
 	}
-	return unix.Mount(c.slavePath, "/dev/console", "bind", unix.MS_BIND, "")
+	return syscall.Mount(c.slavePath, dest, "bind", syscall.MS_BIND, "")
 }
 
 // dupStdio opens the slavePath for the console and dups the fds to the current
 // processes stdio, fd 0,1,2.
 func (c *linuxConsole) dupStdio() error {
-	slave, err := c.open(unix.O_RDWR)
+	slave, err := c.open(syscall.O_RDWR)
 	if err != nil {
 		return err
 	}
 	fd := int(slave.Fd())
 	for _, i := range []int{0, 1, 2} {
-		if err := unix.Dup3(fd, i, 0); err != nil {
+		if err := syscall.Dup3(fd, i, 0); err != nil {
 			return err
 		}
 	}
@@ -96,7 +110,7 @@ func (c *linuxConsole) dupStdio() error {
 
 // open is a clone of os.OpenFile without the O_CLOEXEC used to open the pty slave.
 func (c *linuxConsole) open(flag int) (*os.File, error) {
-	r, e := unix.Open(c.slavePath, flag, 0)
+	r, e := syscall.Open(c.slavePath, flag, 0)
 	if e != nil {
 		return nil, &os.PathError{
 			Op:   "open",
@@ -108,7 +122,7 @@ func (c *linuxConsole) open(flag int) (*os.File, error) {
 }
 
 func ioctl(fd uintptr, flag, data uintptr) error {
-	if _, _, err := unix.Syscall(unix.SYS_IOCTL, fd, flag, data); err != 0 {
+	if _, _, err := syscall.Syscall(syscall.SYS_IOCTL, fd, flag, data); err != 0 {
 		return err
 	}
 	return nil
@@ -118,35 +132,14 @@ func ioctl(fd uintptr, flag, data uintptr) error {
 // unlockpt should be called before opening the slave side of a pty.
 func unlockpt(f *os.File) error {
 	var u int32
-	return ioctl(f.Fd(), unix.TIOCSPTLCK, uintptr(unsafe.Pointer(&u)))
+	return ioctl(f.Fd(), syscall.TIOCSPTLCK, uintptr(unsafe.Pointer(&u)))
 }
 
 // ptsname retrieves the name of the first available pts for the given master.
 func ptsname(f *os.File) (string, error) {
-	n, err := unix.IoctlGetInt(int(f.Fd()), unix.TIOCGPTN)
-	if err != nil {
+	var n int32
+	if err := ioctl(f.Fd(), syscall.TIOCGPTN, uintptr(unsafe.Pointer(&n))); err != nil {
 		return "", err
 	}
 	return fmt.Sprintf("/dev/pts/%d", n), nil
 }
-
-// SaneTerminal sets the necessary tty_ioctl(4)s to ensure that a pty pair
-// created by us acts normally. In particular, a not-very-well-known default of
-// Linux unix98 ptys is that they have +onlcr by default. While this isn't a
-// problem for terminal emulators, because we relay data from the terminal we
-// also relay that funky line discipline.
-func SaneTerminal(terminal *os.File) error {
-	termios, err := unix.IoctlGetTermios(int(terminal.Fd()), unix.TCGETS)
-	if err != nil {
-		return fmt.Errorf("ioctl(tty, tcgets): %s", err.Error())
-	}
-
-	// Set -onlcr so we don't have to deal with \r.
-	termios.Oflag &^= unix.ONLCR
-
-	if err := unix.IoctlSetTermios(int(terminal.Fd()), unix.TCSETS, termios); err != nil {
-		return fmt.Errorf("ioctl(tty, tcsets): %s", err.Error())
-	}
-
-	return nil
-}

vendor/github.com/opencontainers/runc/libcontainer/console_solaris.go

@@ -1,11 +0,0 @@
-package libcontainer
-
-import (
-	"errors"
-)
-
-// newConsole returns an initialized console that can be used within a container by copying bytes
-// from the master side to the slave that is attached as the tty for the container's init process.
-func newConsole() (Console, error) {
-	return nil, errors.New("libcontainer console is not supported on Solaris")
-}

vendor/github.com/opencontainers/runc/libcontainer/console_windows.go

@@ -1,11 +1,11 @@
 package libcontainer
 
-// newConsole returns an initialized console that can be used within a container
-func newConsole() (Console, error) {
+// NewConsole returns an initalized console that can be used within a container
+func NewConsole(uid, gid int) (Console, error) {
 	return &windowsConsole{}, nil
 }
 
-// windowsConsole is a Windows pseudo TTY for use within a container.
+// windowsConsole is a Windows psuedo TTY for use within a container.
 type windowsConsole struct {
 }
 

vendor/github.com/opencontainers/runc/libcontainer/container.go

@@ -1,4 +1,4 @@
-// Package libcontainer provides a native Go implementation for creating containers
+// Libcontainer provides a native Go implementation for creating containers
 // with namespaces, cgroups, capabilities, and filesystem access controls.
 // It allows you to manage the lifecycle of the container performing additional operations
 // after the container is created.
@@ -11,20 +11,24 @@ import (
 	"github.com/opencontainers/runc/libcontainer/configs"
 )
 
-// Status is the status of a container.
+// The status of a container.
 type Status int
 
 const (
-	// Created is the status that denotes the container exists but has not been run yet.
+	// The container exists but has not been run yet
 	Created Status = iota
-	// Running is the status that denotes the container exists and is running.
+
+	// The container exists and is running.
 	Running
-	// Pausing is the status that denotes the container exists, it is in the process of being paused.
+
+	// The container exists, it is in the process of being paused.
 	Pausing
-	// Paused is the status that denotes the container exists, but all its processes are paused.
+
+	// The container exists, but all its processes are paused.
 	Paused
-	// Stopped is the status that denotes the container does not have a created or running process.
-	Stopped
+
+	// The container does not exist.
+	Destroyed
 )
 
 func (s Status) String() string {
@@ -37,8 +41,8 @@ func (s Status) String() string {
 		return "pausing"
 	case Paused:
 		return "paused"
-	case Stopped:
-		return "stopped"
+	case Destroyed:
+		return "destroyed"
 	default:
 		return "unknown"
 	}
@@ -54,7 +58,7 @@ type BaseState struct {
 	InitProcessPid int `json:"init_process_pid"`
 
 	// InitProcessStartTime is the init process start time in clock cycles since boot time.
-	InitProcessStartTime uint64 `json:"init_process_start"`
+	InitProcessStartTime string `json:"init_process_start"`
 
 	// Created is the unix timestamp for the creation time of the container in UTC
 	Created time.Time `json:"created"`
@@ -63,7 +67,7 @@ type BaseState struct {
 	Config configs.Config `json:"config"`
 }
 
-// BaseContainer is a libcontainer container object.
+// A libcontainer container object.
 //
 // Each container is thread-safe within the same process. Since a container can
 // be destroyed by a separate process, any function may return that the container
@@ -75,14 +79,14 @@ type BaseContainer interface {
 	// Returns the current status of the container.
 	//
 	// errors:
-	// ContainerNotExists - Container no longer exists,
+	// ContainerDestroyed - Container no longer exists,
 	// Systemerror - System error.
 	Status() (Status, error)
 
 	// State returns the current container's state information.
 	//
 	// errors:
-	// SystemError - System error.
+	// Systemerror - System error.
 	State() (*State, error)
 
 	// Returns the current config of the container.
@@ -91,7 +95,7 @@ type BaseContainer interface {
 	// Returns the PIDs inside this container. The PIDs are in the namespace of the calling process.
 	//
 	// errors:
-	// ContainerNotExists - Container no longer exists,
+	// ContainerDestroyed - Container no longer exists,
 	// Systemerror - System error.
 	//
 	// Some of the returned PIDs may no longer refer to processes in the Container, unless
@@ -101,7 +105,7 @@ type BaseContainer interface {
 	// Returns statistics for the container.
 	//
 	// errors:
-	// ContainerNotExists - Container no longer exists,
+	// ContainerDestroyed - Container no longer exists,
 	// Systemerror - System error.
 	Stats() (*Stats, error)
 
@@ -110,57 +114,31 @@ type BaseContainer interface {
 	// We can use this to change resources when containers are running.
 	//
 	// errors:
-	// SystemError - System error.
+	// Systemerror - System error.
 	Set(config configs.Config) error
 
 	// Start a process inside the container. Returns error if process fails to
 	// start. You can track process lifecycle with passed Process structure.
 	//
 	// errors:
-	// ContainerNotExists - Container no longer exists,
+	// ContainerDestroyed - Container no longer exists,
 	// ConfigInvalid - config is invalid,
 	// ContainerPaused - Container is paused,
-	// SystemError - System error.
+	// Systemerror - System error.
 	Start(process *Process) (err error)
 
-	// Run immediately starts the process inside the container.  Returns error if process
-	// fails to start.  It does not block waiting for the exec fifo  after start returns but
-	// opens the fifo after start returns.
-	//
-	// errors:
-	// ContainerNotExists - Container no longer exists,
-	// ConfigInvalid - config is invalid,
-	// ContainerPaused - Container is paused,
-	// SystemError - System error.
-	Run(process *Process) (err error)
-
-	// Destroys the container, if its in a valid state, after killing any
-	// remaining running processes.
+	// Destroys the container after killing all running processes.
 	//
 	// Any event registrations are removed before the container is destroyed.
 	// No error is returned if the container is already destroyed.
 	//
-	// Running containers must first be stopped using Signal(..).
-	// Paused containers must first be resumed using Resume(..).
-	//
 	// errors:
-	// ContainerNotStopped - Container is still running,
-	// ContainerPaused - Container is paused,
-	// SystemError - System error.
+	// Systemerror - System error.
 	Destroy() error
 
 	// Signal sends the provided signal code to the container's initial process.
 	//
-	// If all is specified the signal is sent to all processes in the container
-	// including the initial process.
-	//
 	// errors:
-	// SystemError - System error.
-	Signal(s os.Signal, all bool) error
-
-	// Exec signals the container to exec the users process at the end of the init.
-	//
-	// errors:
-	// SystemError - System error.
-	Exec() error
+	// Systemerror - System error.
+	Signal(s os.Signal) error
 }

vendor/github.com/opencontainers/runc/libcontainer/container_linux_test.go

@@ -9,7 +9,6 @@ import (
 
 	"github.com/opencontainers/runc/libcontainer/cgroups"
 	"github.com/opencontainers/runc/libcontainer/configs"
-	"github.com/opencontainers/runc/libcontainer/system"
 )
 
 type mockCgroupManager struct {
@@ -53,7 +52,7 @@ func (m *mockCgroupManager) Freeze(state configs.FreezerState) error {
 
 type mockProcess struct {
 	_pid    int
-	started uint64
+	started string
 }
 
 func (m *mockProcess) terminate() error {
@@ -64,7 +63,7 @@ func (m *mockProcess) pid() int {
 	return m._pid
 }
 
-func (m *mockProcess) startTime() (uint64, error) {
+func (m *mockProcess) startTime() (string, error) {
 	return m.started, nil
 }
 
@@ -80,11 +79,11 @@ func (m *mockProcess) signal(_ os.Signal) error {
 	return nil
 }
 
-func (m *mockProcess) externalDescriptors() []string {
+func (p *mockProcess) externalDescriptors() []string {
 	return []string{}
 }
 
-func (m *mockProcess) setExternalDescriptors(newFds []string) {
+func (p *mockProcess) setExternalDescriptors(newFds []string) {
 }
 
 func TestGetContainerPids(t *testing.T) {
@@ -135,7 +134,7 @@ func TestGetContainerState(t *testing.T) {
 	var (
 		pid                 = os.Getpid()
 		expectedMemoryPath  = "/sys/fs/cgroup/memory/myid"
-		expectedNetworkPath = fmt.Sprintf("/proc/%d/ns/net", pid)
+		expectedNetworkPath = "/networks/fd"
 	)
 	container := &linuxContainer{
 		id: "myid",
@@ -151,7 +150,7 @@ func TestGetContainerState(t *testing.T) {
 		},
 		initProcess: &mockProcess{
 			_pid:    pid,
-			started: 10,
+			started: "010",
 		},
 		cgroupManager: &mockCgroupManager{
 			pids: []int{1, 2, 3},
@@ -175,8 +174,8 @@ func TestGetContainerState(t *testing.T) {
 	if state.InitProcessPid != pid {
 		t.Fatalf("expected pid %d but received %d", pid, state.InitProcessPid)
 	}
-	if state.InitProcessStartTime != 10 {
-		t.Fatalf("expected process start time 10 but received %d", state.InitProcessStartTime)
+	if state.InitProcessStartTime != "010" {
+		t.Fatalf("expected process start time 010 but received %s", state.InitProcessStartTime)
 	}
 	paths := state.CgroupPaths
 	if paths == nil {
@@ -217,65 +216,3 @@ func TestGetContainerState(t *testing.T) {
 		}
 	}
 }
-
-func TestGetContainerStateAfterUpdate(t *testing.T) {
-	var (
-		pid = os.Getpid()
-	)
-	stat, err := system.Stat(pid)
-	if err != nil {
-		t.Fatal(err)
-	}
-	container := &linuxContainer{
-		id: "myid",
-		config: &configs.Config{
-			Namespaces: []configs.Namespace{
-				{Type: configs.NEWPID},
-				{Type: configs.NEWNS},
-				{Type: configs.NEWNET},
-				{Type: configs.NEWUTS},
-				{Type: configs.NEWIPC},
-			},
-			Cgroups: &configs.Cgroup{
-				Resources: &configs.Resources{
-					Memory: 1024,
-				},
-			},
-		},
-		initProcess: &mockProcess{
-			_pid:    pid,
-			started: stat.StartTime,
-		},
-		cgroupManager: &mockCgroupManager{},
-	}
-	container.state = &createdState{c: container}
-	state, err := container.State()
-	if err != nil {
-		t.Fatal(err)
-	}
-	if state.InitProcessPid != pid {
-		t.Fatalf("expected pid %d but received %d", pid, state.InitProcessPid)
-	}
-	if state.InitProcessStartTime != stat.StartTime {
-		t.Fatalf("expected process start time %d but received %d", stat.StartTime, state.InitProcessStartTime)
-	}
-	if state.Config.Cgroups.Resources.Memory != 1024 {
-		t.Fatalf("expected Memory to be 1024 but received %q", state.Config.Cgroups.Memory)
-	}
-
-	// Set initProcessStartTime so we fake to be running
-	container.initProcessStartTime = state.InitProcessStartTime
-	container.state = &runningState{c: container}
-	newConfig := container.Config()
-	newConfig.Cgroups.Resources.Memory = 2048
-	if err := container.Set(newConfig); err != nil {
-		t.Fatal(err)
-	}
-	state, err = container.State()
-	if err != nil {
-		t.Fatal(err)
-	}
-	if state.Config.Cgroups.Resources.Memory != 2048 {
-		t.Fatalf("expected Memory to be 2048 but received %q", state.Config.Cgroups.Memory)
-	}
-}

vendor/github.com/opencontainers/runc/libcontainer/container_solaris.go

@@ -1,20 +0,0 @@
-package libcontainer
-
-// State represents a running container's state
-type State struct {
-	BaseState
-
-	// Platform specific fields below here
-}
-
-// A libcontainer container object.
-//
-// Each container is thread-safe within the same process. Since a container can
-// be destroyed by a separate process, any function may return that the container
-// was not found.
-type Container interface {
-	BaseContainer
-
-	// Methods below here are platform specific
-
-}

vendor/github.com/opencontainers/runc/libcontainer/criu_opts_unix.go

@@ -1,13 +1,15 @@
+// +build linux freebsd
+
 package libcontainer
 
 // cgroup restoring strategy provided by criu
-type cgMode uint32
+type cg_mode uint32
 
 const (
-	CRIU_CG_MODE_SOFT    cgMode = 3 + iota // restore cgroup properties if only dir created by criu
-	CRIU_CG_MODE_FULL                      // always restore all cgroups and their properties
-	CRIU_CG_MODE_STRICT                    // restore all, requiring them to not present in the system
-	CRIU_CG_MODE_DEFAULT                   // the same as CRIU_CG_MODE_SOFT
+	CRIU_CG_MODE_SOFT    cg_mode = 3 + iota // restore cgroup properties if only dir created by criu
+	CRIU_CG_MODE_FULL                       // always restore all cgroups and their properties
+	CRIU_CG_MODE_STRICT                     // restore all, requiring them to not present in the system
+	CRIU_CG_MODE_DEFAULT                    // the same as CRIU_CG_MODE_SOFT
 )
 
 type CriuPageServerInfo struct {
@@ -23,16 +25,13 @@ type VethPairName struct {
 type CriuOpts struct {
 	ImagesDirectory         string             // directory for storing image files
 	WorkDirectory           string             // directory to cd and write logs/pidfiles/stats to
-	ParentImage             string             // direcotry for storing parent image files in pre-dump and dump
 	LeaveRunning            bool               // leave container in running state after checkpoint
 	TcpEstablished          bool               // checkpoint/restore established TCP connections
 	ExternalUnixConnections bool               // allow external unix connections
 	ShellJob                bool               // allow to dump and restore shell jobs
 	FileLocks               bool               // handle file locks, for safety
-	PreDump                 bool               // call criu predump to perform iterative checkpoint
 	PageServer              CriuPageServerInfo // allow to dump to criu page server
 	VethPairs               []VethPairName     // pass the veth to criu when restore
-	ManageCgroupsMode       cgMode             // dump or restore cgroup mode
+	ManageCgroupsMode       cg_mode            // dump or restore cgroup mode
 	EmptyNs                 uint32             // don't c/r properties for namespace from this mask
-	AutoDedup               bool               // auto deduplication for incremental dumps
 }

vendor/github.com/opencontainers/runc/libcontainer/criurpc/criurpc.pb.go

@@ -12,7 +12,6 @@ It has these top-level messages:
 	CriuPageServerInfo
 	CriuVethPair
 	ExtMountMap
-	JoinNamespace
 	InheritFd
 	CgroupRoot
 	UnixSk
@@ -23,30 +22,21 @@ It has these top-level messages:
 	CriuFeatures
 	CriuReq
 	CriuResp
-	CriuVersion
 */
 package criurpc
 
 import proto "github.com/golang/protobuf/proto"
-import fmt "fmt"
 import math "math"
 
 // Reference imports to suppress errors if they are not otherwise used.
 var _ = proto.Marshal
-var _ = fmt.Errorf
 var _ = math.Inf
 
-// This is a compile-time assertion to ensure that this generated file
-// is compatible with the proto package it is being compiled against.
-// A compilation error at this line likely means your copy of the
-// proto package needs to be updated.
-const _ = proto.ProtoPackageIsVersion2 // please upgrade the proto package
-
 type CriuCgMode int32
 
 const (
 	CriuCgMode_IGNORE  CriuCgMode = 0
-	CriuCgMode_CG_NONE CriuCgMode = 1
+	CriuCgMode_NONE    CriuCgMode = 1
 	CriuCgMode_PROPS   CriuCgMode = 2
 	CriuCgMode_SOFT    CriuCgMode = 3
 	CriuCgMode_FULL    CriuCgMode = 4
@@ -56,7 +46,7 @@ const (
 
 var CriuCgMode_name = map[int32]string{
 	0: "IGNORE",
-	1: "CG_NONE",
+	1: "NONE",
 	2: "PROPS",
 	3: "SOFT",
 	4: "FULL",
@@ -65,7 +55,7 @@ var CriuCgMode_name = map[int32]string{
 }
 var CriuCgMode_value = map[string]int32{
 	"IGNORE":  0,
-	"CG_NONE": 1,
+	"NONE":    1,
 	"PROPS":   2,
 	"SOFT":    3,
 	"FULL":    4,
@@ -89,7 +79,6 @@ func (x *CriuCgMode) UnmarshalJSON(data []byte) error {
 	*x = CriuCgMode(value)
 	return nil
 }
-func (CriuCgMode) EnumDescriptor() ([]byte, []int) { return fileDescriptor0, []int{0} }
 
 type CriuReqType int32
 
@@ -104,21 +93,19 @@ const (
 	CriuReqType_CPUINFO_DUMP  CriuReqType = 7
 	CriuReqType_CPUINFO_CHECK CriuReqType = 8
 	CriuReqType_FEATURE_CHECK CriuReqType = 9
-	CriuReqType_VERSION       CriuReqType = 10
 )
 
 var CriuReqType_name = map[int32]string{
-	0:  "EMPTY",
-	1:  "DUMP",
-	2:  "RESTORE",
-	3:  "CHECK",
-	4:  "PRE_DUMP",
-	5:  "PAGE_SERVER",
-	6:  "NOTIFY",
-	7:  "CPUINFO_DUMP",
-	8:  "CPUINFO_CHECK",
-	9:  "FEATURE_CHECK",
-	10: "VERSION",
+	0: "EMPTY",
+	1: "DUMP",
+	2: "RESTORE",
+	3: "CHECK",
+	4: "PRE_DUMP",
+	5: "PAGE_SERVER",
+	6: "NOTIFY",
+	7: "CPUINFO_DUMP",
+	8: "CPUINFO_CHECK",
+	9: "FEATURE_CHECK",
 }
 var CriuReqType_value = map[string]int32{
 	"EMPTY":         0,
@@ -131,7 +118,6 @@ var CriuReqType_value = map[string]int32{
 	"CPUINFO_DUMP":  7,
 	"CPUINFO_CHECK": 8,
 	"FEATURE_CHECK": 9,
-	"VERSION":       10,
 }
 
 func (x CriuReqType) Enum() *CriuReqType {
@@ -150,7 +136,6 @@ func (x *CriuReqType) UnmarshalJSON(data []byte) error {
 	*x = CriuReqType(value)
 	return nil
 }
-func (CriuReqType) EnumDescriptor() ([]byte, []int) { return fileDescriptor0, []int{1} }
 
 type CriuPageServerInfo struct {
 	Address          *string `protobuf:"bytes,1,opt,name=address" json:"address,omitempty"`
@@ -160,10 +145,9 @@ type CriuPageServerInfo struct {
 	XXX_unrecognized []byte  `json:"-"`
 }
 
-func (m *CriuPageServerInfo) Reset()                    { *m = CriuPageServerInfo{} }
-func (m *CriuPageServerInfo) String() string            { return proto.CompactTextString(m) }
-func (*CriuPageServerInfo) ProtoMessage()               {}
-func (*CriuPageServerInfo) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{0} }
+func (m *CriuPageServerInfo) Reset()         { *m = CriuPageServerInfo{} }
+func (m *CriuPageServerInfo) String() string { return proto.CompactTextString(m) }
+func (*CriuPageServerInfo) ProtoMessage()    {}
 
 func (m *CriuPageServerInfo) GetAddress() string {
 	if m != nil && m.Address != nil {
@@ -194,15 +178,14 @@ func (m *CriuPageServerInfo) GetFd() int32 {
 }
 
 type CriuVethPair struct {
-	IfIn             *string `protobuf:"bytes,1,req,name=if_in,json=ifIn" json:"if_in,omitempty"`
-	IfOut            *string `protobuf:"bytes,2,req,name=if_out,json=ifOut" json:"if_out,omitempty"`
+	IfIn             *string `protobuf:"bytes,1,req,name=if_in" json:"if_in,omitempty"`
+	IfOut            *string `protobuf:"bytes,2,req,name=if_out" json:"if_out,omitempty"`
 	XXX_unrecognized []byte  `json:"-"`
 }
 
-func (m *CriuVethPair) Reset()                    { *m = CriuVethPair{} }
-func (m *CriuVethPair) String() string            { return proto.CompactTextString(m) }
-func (*CriuVethPair) ProtoMessage()               {}
-func (*CriuVethPair) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{1} }
+func (m *CriuVethPair) Reset()         { *m = CriuVethPair{} }
+func (m *CriuVethPair) String() string { return proto.CompactTextString(m) }
+func (*CriuVethPair) ProtoMessage()    {}
 
 func (m *CriuVethPair) GetIfIn() string {
 	if m != nil && m.IfIn != nil {
@@ -224,10 +207,9 @@ type ExtMountMap struct {
 	XXX_unrecognized []byte  `json:"-"`
 }
 
-func (m *ExtMountMap) Reset()                    { *m = ExtMountMap{} }
-func (m *ExtMountMap) String() string            { return proto.CompactTextString(m) }
-func (*ExtMountMap) ProtoMessage()               {}
-func (*ExtMountMap) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{2} }
+func (m *ExtMountMap) Reset()         { *m = ExtMountMap{} }
+func (m *ExtMountMap) String() string { return proto.CompactTextString(m) }
+func (*ExtMountMap) ProtoMessage()    {}
 
 func (m *ExtMountMap) GetKey() string {
 	if m != nil && m.Key != nil {
@@ -243,49 +225,15 @@ func (m *ExtMountMap) GetVal() string {
 	return ""
 }
 
-type JoinNamespace struct {
-	Ns               *string `protobuf:"bytes,1,req,name=ns" json:"ns,omitempty"`
-	NsFile           *string `protobuf:"bytes,2,req,name=ns_file,json=nsFile" json:"ns_file,omitempty"`
-	ExtraOpt         *string `protobuf:"bytes,3,opt,name=extra_opt,json=extraOpt" json:"extra_opt,omitempty"`
-	XXX_unrecognized []byte  `json:"-"`
-}
-
-func (m *JoinNamespace) Reset()                    { *m = JoinNamespace{} }
-func (m *JoinNamespace) String() string            { return proto.CompactTextString(m) }
-func (*JoinNamespace) ProtoMessage()               {}
-func (*JoinNamespace) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{3} }
-
-func (m *JoinNamespace) GetNs() string {
-	if m != nil && m.Ns != nil {
-		return *m.Ns
-	}
-	return ""
-}
-
-func (m *JoinNamespace) GetNsFile() string {
-	if m != nil && m.NsFile != nil {
-		return *m.NsFile
-	}
-	return ""
-}
-
-func (m *JoinNamespace) GetExtraOpt() string {
-	if m != nil && m.ExtraOpt != nil {
-		return *m.ExtraOpt
-	}
-	return ""
-}
-
 type InheritFd struct {
 	Key              *string `protobuf:"bytes,1,req,name=key" json:"key,omitempty"`
 	Fd               *int32  `protobuf:"varint,2,req,name=fd" json:"fd,omitempty"`
 	XXX_unrecognized []byte  `json:"-"`
 }
 
-func (m *InheritFd) Reset()                    { *m = InheritFd{} }
-func (m *InheritFd) String() string            { return proto.CompactTextString(m) }
-func (*InheritFd) ProtoMessage()               {}
-func (*InheritFd) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{4} }
+func (m *InheritFd) Reset()         { *m = InheritFd{} }
+func (m *InheritFd) String() string { return proto.CompactTextString(m) }
+func (*InheritFd) ProtoMessage()    {}
 
 func (m *InheritFd) GetKey() string {
 	if m != nil && m.Key != nil {
@@ -307,10 +255,9 @@ type CgroupRoot struct {
 	XXX_unrecognized []byte  `json:"-"`
 }
 
-func (m *CgroupRoot) Reset()                    { *m = CgroupRoot{} }
-func (m *CgroupRoot) String() string            { return proto.CompactTextString(m) }
-func (*CgroupRoot) ProtoMessage()               {}
-func (*CgroupRoot) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{5} }
+func (m *CgroupRoot) Reset()         { *m = CgroupRoot{} }
+func (m *CgroupRoot) String() string { return proto.CompactTextString(m) }
+func (*CgroupRoot) ProtoMessage()    {}
 
 func (m *CgroupRoot) GetCtrl() string {
 	if m != nil && m.Ctrl != nil {
@@ -331,10 +278,9 @@ type UnixSk struct {
 	XXX_unrecognized []byte  `json:"-"`
 }
 
-func (m *UnixSk) Reset()                    { *m = UnixSk{} }
-func (m *UnixSk) String() string            { return proto.CompactTextString(m) }
-func (*UnixSk) ProtoMessage()               {}
-func (*UnixSk) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{6} }
+func (m *UnixSk) Reset()         { *m = UnixSk{} }
+func (m *UnixSk) String() string { return proto.CompactTextString(m) }
+func (*UnixSk) ProtoMessage()    {}
 
 func (m *UnixSk) GetInode() uint32 {
 	if m != nil && m.Inode != nil {
@@ -344,62 +290,51 @@ func (m *UnixSk) GetInode() uint32 {
 }
 
 type CriuOpts struct {
-	ImagesDirFd          *int32              `protobuf:"varint,1,req,name=images_dir_fd,json=imagesDirFd" json:"images_dir_fd,omitempty"`
-	Pid                  *int32              `protobuf:"varint,2,opt,name=pid" json:"pid,omitempty"`
-	LeaveRunning         *bool               `protobuf:"varint,3,opt,name=leave_running,json=leaveRunning" json:"leave_running,omitempty"`
-	ExtUnixSk            *bool               `protobuf:"varint,4,opt,name=ext_unix_sk,json=extUnixSk" json:"ext_unix_sk,omitempty"`
-	TcpEstablished       *bool               `protobuf:"varint,5,opt,name=tcp_established,json=tcpEstablished" json:"tcp_established,omitempty"`
-	EvasiveDevices       *bool               `protobuf:"varint,6,opt,name=evasive_devices,json=evasiveDevices" json:"evasive_devices,omitempty"`
-	ShellJob             *bool               `protobuf:"varint,7,opt,name=shell_job,json=shellJob" json:"shell_job,omitempty"`
-	FileLocks            *bool               `protobuf:"varint,8,opt,name=file_locks,json=fileLocks" json:"file_locks,omitempty"`
-	LogLevel             *int32              `protobuf:"varint,9,opt,name=log_level,json=logLevel,def=2" json:"log_level,omitempty"`
-	LogFile              *string             `protobuf:"bytes,10,opt,name=log_file,json=logFile" json:"log_file,omitempty"`
-	Ps                   *CriuPageServerInfo `protobuf:"bytes,11,opt,name=ps" json:"ps,omitempty"`
-	NotifyScripts        *bool               `protobuf:"varint,12,opt,name=notify_scripts,json=notifyScripts" json:"notify_scripts,omitempty"`
-	Root                 *string             `protobuf:"bytes,13,opt,name=root" json:"root,omitempty"`
-	ParentImg            *string             `protobuf:"bytes,14,opt,name=parent_img,json=parentImg" json:"parent_img,omitempty"`
-	TrackMem             *bool               `protobuf:"varint,15,opt,name=track_mem,json=trackMem" json:"track_mem,omitempty"`
-	AutoDedup            *bool               `protobuf:"varint,16,opt,name=auto_dedup,json=autoDedup" json:"auto_dedup,omitempty"`
-	WorkDirFd            *int32              `protobuf:"varint,17,opt,name=work_dir_fd,json=workDirFd" json:"work_dir_fd,omitempty"`
-	LinkRemap            *bool               `protobuf:"varint,18,opt,name=link_remap,json=linkRemap" json:"link_remap,omitempty"`
-	Veths                []*CriuVethPair     `protobuf:"bytes,19,rep,name=veths" json:"veths,omitempty"`
-	CpuCap               *uint32             `protobuf:"varint,20,opt,name=cpu_cap,json=cpuCap,def=4294967295" json:"cpu_cap,omitempty"`
-	ForceIrmap           *bool               `protobuf:"varint,21,opt,name=force_irmap,json=forceIrmap" json:"force_irmap,omitempty"`
-	ExecCmd              []string            `protobuf:"bytes,22,rep,name=exec_cmd,json=execCmd" json:"exec_cmd,omitempty"`
-	ExtMnt               []*ExtMountMap      `protobuf:"bytes,23,rep,name=ext_mnt,json=extMnt" json:"ext_mnt,omitempty"`
-	ManageCgroups        *bool               `protobuf:"varint,24,opt,name=manage_cgroups,json=manageCgroups" json:"manage_cgroups,omitempty"`
-	CgRoot               []*CgroupRoot       `protobuf:"bytes,25,rep,name=cg_root,json=cgRoot" json:"cg_root,omitempty"`
-	RstSibling           *bool               `protobuf:"varint,26,opt,name=rst_sibling,json=rstSibling" json:"rst_sibling,omitempty"`
-	InheritFd            []*InheritFd        `protobuf:"bytes,27,rep,name=inherit_fd,json=inheritFd" json:"inherit_fd,omitempty"`
-	AutoExtMnt           *bool               `protobuf:"varint,28,opt,name=auto_ext_mnt,json=autoExtMnt" json:"auto_ext_mnt,omitempty"`
-	ExtSharing           *bool               `protobuf:"varint,29,opt,name=ext_sharing,json=extSharing" json:"ext_sharing,omitempty"`
-	ExtMasters           *bool               `protobuf:"varint,30,opt,name=ext_masters,json=extMasters" json:"ext_masters,omitempty"`
-	SkipMnt              []string            `protobuf:"bytes,31,rep,name=skip_mnt,json=skipMnt" json:"skip_mnt,omitempty"`
-	EnableFs             []string            `protobuf:"bytes,32,rep,name=enable_fs,json=enableFs" json:"enable_fs,omitempty"`
-	UnixSkIno            []*UnixSk           `protobuf:"bytes,33,rep,name=unix_sk_ino,json=unixSkIno" json:"unix_sk_ino,omitempty"`
-	ManageCgroupsMode    *CriuCgMode         `protobuf:"varint,34,opt,name=manage_cgroups_mode,json=manageCgroupsMode,enum=CriuCgMode" json:"manage_cgroups_mode,omitempty"`
-	GhostLimit           *uint32             `protobuf:"varint,35,opt,name=ghost_limit,json=ghostLimit,def=1048576" json:"ghost_limit,omitempty"`
-	IrmapScanPaths       []string            `protobuf:"bytes,36,rep,name=irmap_scan_paths,json=irmapScanPaths" json:"irmap_scan_paths,omitempty"`
-	External             []string            `protobuf:"bytes,37,rep,name=external" json:"external,omitempty"`
-	EmptyNs              *uint32             `protobuf:"varint,38,opt,name=empty_ns,json=emptyNs" json:"empty_ns,omitempty"`
-	JoinNs               []*JoinNamespace    `protobuf:"bytes,39,rep,name=join_ns,json=joinNs" json:"join_ns,omitempty"`
-	CgroupProps          *string             `protobuf:"bytes,41,opt,name=cgroup_props,json=cgroupProps" json:"cgroup_props,omitempty"`
-	CgroupPropsFile      *string             `protobuf:"bytes,42,opt,name=cgroup_props_file,json=cgroupPropsFile" json:"cgroup_props_file,omitempty"`
-	CgroupDumpController []string            `protobuf:"bytes,43,rep,name=cgroup_dump_controller,json=cgroupDumpController" json:"cgroup_dump_controller,omitempty"`
-	FreezeCgroup         *string             `protobuf:"bytes,44,opt,name=freeze_cgroup,json=freezeCgroup" json:"freeze_cgroup,omitempty"`
-	Timeout              *uint32             `protobuf:"varint,45,opt,name=timeout" json:"timeout,omitempty"`
-	TcpSkipInFlight      *bool               `protobuf:"varint,46,opt,name=tcp_skip_in_flight,json=tcpSkipInFlight" json:"tcp_skip_in_flight,omitempty"`
-	WeakSysctls          *bool               `protobuf:"varint,47,opt,name=weak_sysctls,json=weakSysctls" json:"weak_sysctls,omitempty"`
-	LazyPages            *bool               `protobuf:"varint,48,opt,name=lazy_pages,json=lazyPages" json:"lazy_pages,omitempty"`
-	StatusFd             *int32              `protobuf:"varint,49,opt,name=status_fd,json=statusFd" json:"status_fd,omitempty"`
-	OrphanPtsMaster      *bool               `protobuf:"varint,50,opt,name=orphan_pts_master,json=orphanPtsMaster" json:"orphan_pts_master,omitempty"`
-	XXX_unrecognized     []byte              `json:"-"`
+	ImagesDirFd       *int32              `protobuf:"varint,1,req,name=images_dir_fd" json:"images_dir_fd,omitempty"`
+	Pid               *int32              `protobuf:"varint,2,opt,name=pid" json:"pid,omitempty"`
+	LeaveRunning      *bool               `protobuf:"varint,3,opt,name=leave_running" json:"leave_running,omitempty"`
+	ExtUnixSk         *bool               `protobuf:"varint,4,opt,name=ext_unix_sk" json:"ext_unix_sk,omitempty"`
+	TcpEstablished    *bool               `protobuf:"varint,5,opt,name=tcp_established" json:"tcp_established,omitempty"`
+	EvasiveDevices    *bool               `protobuf:"varint,6,opt,name=evasive_devices" json:"evasive_devices,omitempty"`
+	ShellJob          *bool               `protobuf:"varint,7,opt,name=shell_job" json:"shell_job,omitempty"`
+	FileLocks         *bool               `protobuf:"varint,8,opt,name=file_locks" json:"file_locks,omitempty"`
+	LogLevel          *int32              `protobuf:"varint,9,opt,name=log_level,def=2" json:"log_level,omitempty"`
+	LogFile           *string             `protobuf:"bytes,10,opt,name=log_file" json:"log_file,omitempty"`
+	Ps                *CriuPageServerInfo `protobuf:"bytes,11,opt,name=ps" json:"ps,omitempty"`
+	NotifyScripts     *bool               `protobuf:"varint,12,opt,name=notify_scripts" json:"notify_scripts,omitempty"`
+	Root              *string             `protobuf:"bytes,13,opt,name=root" json:"root,omitempty"`
+	ParentImg         *string             `protobuf:"bytes,14,opt,name=parent_img" json:"parent_img,omitempty"`
+	TrackMem          *bool               `protobuf:"varint,15,opt,name=track_mem" json:"track_mem,omitempty"`
+	AutoDedup         *bool               `protobuf:"varint,16,opt,name=auto_dedup" json:"auto_dedup,omitempty"`
+	WorkDirFd         *int32              `protobuf:"varint,17,opt,name=work_dir_fd" json:"work_dir_fd,omitempty"`
+	LinkRemap         *bool               `protobuf:"varint,18,opt,name=link_remap" json:"link_remap,omitempty"`
+	Veths             []*CriuVethPair     `protobuf:"bytes,19,rep,name=veths" json:"veths,omitempty"`
+	CpuCap            *uint32             `protobuf:"varint,20,opt,name=cpu_cap,def=4294967295" json:"cpu_cap,omitempty"`
+	ForceIrmap        *bool               `protobuf:"varint,21,opt,name=force_irmap" json:"force_irmap,omitempty"`
+	ExecCmd           []string            `protobuf:"bytes,22,rep,name=exec_cmd" json:"exec_cmd,omitempty"`
+	ExtMnt            []*ExtMountMap      `protobuf:"bytes,23,rep,name=ext_mnt" json:"ext_mnt,omitempty"`
+	ManageCgroups     *bool               `protobuf:"varint,24,opt,name=manage_cgroups" json:"manage_cgroups,omitempty"`
+	CgRoot            []*CgroupRoot       `protobuf:"bytes,25,rep,name=cg_root" json:"cg_root,omitempty"`
+	RstSibling        *bool               `protobuf:"varint,26,opt,name=rst_sibling" json:"rst_sibling,omitempty"`
+	InheritFd         []*InheritFd        `protobuf:"bytes,27,rep,name=inherit_fd" json:"inherit_fd,omitempty"`
+	AutoExtMnt        *bool               `protobuf:"varint,28,opt,name=auto_ext_mnt" json:"auto_ext_mnt,omitempty"`
+	ExtSharing        *bool               `protobuf:"varint,29,opt,name=ext_sharing" json:"ext_sharing,omitempty"`
+	ExtMasters        *bool               `protobuf:"varint,30,opt,name=ext_masters" json:"ext_masters,omitempty"`
+	SkipMnt           []string            `protobuf:"bytes,31,rep,name=skip_mnt" json:"skip_mnt,omitempty"`
+	EnableFs          []string            `protobuf:"bytes,32,rep,name=enable_fs" json:"enable_fs,omitempty"`
+	UnixSkIno         []*UnixSk           `protobuf:"bytes,33,rep,name=unix_sk_ino" json:"unix_sk_ino,omitempty"`
+	ManageCgroupsMode *CriuCgMode         `protobuf:"varint,34,opt,name=manage_cgroups_mode,enum=CriuCgMode" json:"manage_cgroups_mode,omitempty"`
+	GhostLimit        *uint32             `protobuf:"varint,35,opt,name=ghost_limit,def=1048576" json:"ghost_limit,omitempty"`
+	IrmapScanPaths    []string            `protobuf:"bytes,36,rep,name=irmap_scan_paths" json:"irmap_scan_paths,omitempty"`
+	External          []string            `protobuf:"bytes,37,rep,name=external" json:"external,omitempty"`
+	EmptyNs           *uint32             `protobuf:"varint,38,opt,name=empty_ns" json:"empty_ns,omitempty"`
+	NoSeccomp         *bool               `protobuf:"varint,39,opt,name=no_seccomp" json:"no_seccomp,omitempty"`
+	XXX_unrecognized  []byte              `json:"-"`
 }
 
-func (m *CriuOpts) Reset()                    { *m = CriuOpts{} }
-func (m *CriuOpts) String() string            { return proto.CompactTextString(m) }
-func (*CriuOpts) ProtoMessage()               {}
-func (*CriuOpts) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{7} }
+func (m *CriuOpts) Reset()         { *m = CriuOpts{} }
+func (m *CriuOpts) String() string { return proto.CompactTextString(m) }
+func (*CriuOpts) ProtoMessage()    {}
 
 const Default_CriuOpts_LogLevel int32 = 2
 const Default_CriuOpts_CpuCap uint32 = 4294967295
@@ -671,79 +606,9 @@ func (m *CriuOpts) GetEmptyNs() uint32 {
 	return 0
 }
 
-func (m *CriuOpts) GetJoinNs() []*JoinNamespace {
-	if m != nil {
-		return m.JoinNs
-	}
-	return nil
-}
-
-func (m *CriuOpts) GetCgroupProps() string {
-	if m != nil && m.CgroupProps != nil {
-		return *m.CgroupProps
-	}
-	return ""
-}
-
-func (m *CriuOpts) GetCgroupPropsFile() string {
-	if m != nil && m.CgroupPropsFile != nil {
-		return *m.CgroupPropsFile
-	}
-	return ""
-}
-
-func (m *CriuOpts) GetCgroupDumpController() []string {
-	if m != nil {
-		return m.CgroupDumpController
-	}
-	return nil
-}
-
-func (m *CriuOpts) GetFreezeCgroup() string {
-	if m != nil && m.FreezeCgroup != nil {
-		return *m.FreezeCgroup
-	}
-	return ""
-}
-
-func (m *CriuOpts) GetTimeout() uint32 {
-	if m != nil && m.Timeout != nil {
-		return *m.Timeout
-	}
-	return 0
-}
-
-func (m *CriuOpts) GetTcpSkipInFlight() bool {
-	if m != nil && m.TcpSkipInFlight != nil {
-		return *m.TcpSkipInFlight
-	}
-	return false
-}
-
-func (m *CriuOpts) GetWeakSysctls() bool {
-	if m != nil && m.WeakSysctls != nil {
-		return *m.WeakSysctls
-	}
-	return false
-}
-
-func (m *CriuOpts) GetLazyPages() bool {
-	if m != nil && m.LazyPages != nil {
-		return *m.LazyPages
-	}
-	return false
-}
-
-func (m *CriuOpts) GetStatusFd() int32 {
-	if m != nil && m.StatusFd != nil {
-		return *m.StatusFd
-	}
-	return 0
-}
-
-func (m *CriuOpts) GetOrphanPtsMaster() bool {
-	if m != nil && m.OrphanPtsMaster != nil {
-		return *m.OrphanPtsMaster
+func (m *CriuOpts) GetNoSeccomp() bool {
+	if m != nil && m.NoSeccomp != nil {
+		return *m.NoSeccomp
 	}
 	return false
 }
@@ -753,10 +618,9 @@ type CriuDumpResp struct {
 	XXX_unrecognized []byte `json:"-"`
 }
 
-func (m *CriuDumpResp) Reset()                    { *m = CriuDumpResp{} }
-func (m *CriuDumpResp) String() string            { return proto.CompactTextString(m) }
-func (*CriuDumpResp) ProtoMessage()               {}
-func (*CriuDumpResp) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{8} }
+func (m *CriuDumpResp) Reset()         { *m = CriuDumpResp{} }
+func (m *CriuDumpResp) String() string { return proto.CompactTextString(m) }
+func (*CriuDumpResp) ProtoMessage()    {}
 
 func (m *CriuDumpResp) GetRestored() bool {
 	if m != nil && m.Restored != nil {
@@ -770,10 +634,9 @@ type CriuRestoreResp struct {
 	XXX_unrecognized []byte `json:"-"`
 }
 
-func (m *CriuRestoreResp) Reset()                    { *m = CriuRestoreResp{} }
-func (m *CriuRestoreResp) String() string            { return proto.CompactTextString(m) }
-func (*CriuRestoreResp) ProtoMessage()               {}
-func (*CriuRestoreResp) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{9} }
+func (m *CriuRestoreResp) Reset()         { *m = CriuRestoreResp{} }
+func (m *CriuRestoreResp) String() string { return proto.CompactTextString(m) }
+func (*CriuRestoreResp) ProtoMessage()    {}
 
 func (m *CriuRestoreResp) GetPid() int32 {
 	if m != nil && m.Pid != nil {
@@ -788,10 +651,9 @@ type CriuNotify struct {
 	XXX_unrecognized []byte  `json:"-"`
 }
 
-func (m *CriuNotify) Reset()                    { *m = CriuNotify{} }
-func (m *CriuNotify) String() string            { return proto.CompactTextString(m) }
-func (*CriuNotify) ProtoMessage()               {}
-func (*CriuNotify) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{10} }
+func (m *CriuNotify) Reset()         { *m = CriuNotify{} }
+func (m *CriuNotify) String() string { return proto.CompactTextString(m) }
+func (*CriuNotify) ProtoMessage()    {}
 
 func (m *CriuNotify) GetScript() string {
 	if m != nil && m.Script != nil {
@@ -811,15 +673,13 @@ func (m *CriuNotify) GetPid() int32 {
 // List of features which can queried via
 // CRIU_REQ_TYPE__FEATURE_CHECK
 type CriuFeatures struct {
-	MemTrack         *bool  `protobuf:"varint,1,opt,name=mem_track,json=memTrack" json:"mem_track,omitempty"`
-	LazyPages        *bool  `protobuf:"varint,2,opt,name=lazy_pages,json=lazyPages" json:"lazy_pages,omitempty"`
+	MemTrack         *bool  `protobuf:"varint,1,opt,name=mem_track" json:"mem_track,omitempty"`
 	XXX_unrecognized []byte `json:"-"`
 }
 
-func (m *CriuFeatures) Reset()                    { *m = CriuFeatures{} }
-func (m *CriuFeatures) String() string            { return proto.CompactTextString(m) }
-func (*CriuFeatures) ProtoMessage()               {}
-func (*CriuFeatures) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{11} }
+func (m *CriuFeatures) Reset()         { *m = CriuFeatures{} }
+func (m *CriuFeatures) String() string { return proto.CompactTextString(m) }
+func (*CriuFeatures) ProtoMessage()    {}
 
 func (m *CriuFeatures) GetMemTrack() bool {
 	if m != nil && m.MemTrack != nil {
@@ -828,22 +688,15 @@ func (m *CriuFeatures) GetMemTrack() bool {
 	return false
 }
 
-func (m *CriuFeatures) GetLazyPages() bool {
-	if m != nil && m.LazyPages != nil {
-		return *m.LazyPages
-	}
-	return false
-}
-
 type CriuReq struct {
 	Type          *CriuReqType `protobuf:"varint,1,req,name=type,enum=CriuReqType" json:"type,omitempty"`
 	Opts          *CriuOpts    `protobuf:"bytes,2,opt,name=opts" json:"opts,omitempty"`
-	NotifySuccess *bool        `protobuf:"varint,3,opt,name=notify_success,json=notifySuccess" json:"notify_success,omitempty"`
+	NotifySuccess *bool        `protobuf:"varint,3,opt,name=notify_success" json:"notify_success,omitempty"`
 	//
 	// When set service won't close the connection but
 	// will wait for more req-s to appear. Works not
 	// for all request types.
-	KeepOpen *bool `protobuf:"varint,4,opt,name=keep_open,json=keepOpen" json:"keep_open,omitempty"`
+	KeepOpen *bool `protobuf:"varint,4,opt,name=keep_open" json:"keep_open,omitempty"`
 	//
 	// 'features' can be used to query which features
 	// are supported by the installed criu/kernel
@@ -852,10 +705,9 @@ type CriuReq struct {
 	XXX_unrecognized []byte        `json:"-"`
 }
 
-func (m *CriuReq) Reset()                    { *m = CriuReq{} }
-func (m *CriuReq) String() string            { return proto.CompactTextString(m) }
-func (*CriuReq) ProtoMessage()               {}
-func (*CriuReq) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{12} }
+func (m *CriuReq) Reset()         { *m = CriuReq{} }
+func (m *CriuReq) String() string { return proto.CompactTextString(m) }
+func (*CriuReq) ProtoMessage()    {}
 
 func (m *CriuReq) GetType() CriuReqType {
 	if m != nil && m.Type != nil {
@@ -899,17 +751,14 @@ type CriuResp struct {
 	Restore          *CriuRestoreResp    `protobuf:"bytes,4,opt,name=restore" json:"restore,omitempty"`
 	Notify           *CriuNotify         `protobuf:"bytes,5,opt,name=notify" json:"notify,omitempty"`
 	Ps               *CriuPageServerInfo `protobuf:"bytes,6,opt,name=ps" json:"ps,omitempty"`
-	CrErrno          *int32              `protobuf:"varint,7,opt,name=cr_errno,json=crErrno" json:"cr_errno,omitempty"`
+	CrErrno          *int32              `protobuf:"varint,7,opt,name=cr_errno" json:"cr_errno,omitempty"`
 	Features         *CriuFeatures       `protobuf:"bytes,8,opt,name=features" json:"features,omitempty"`
-	CrErrmsg         *string             `protobuf:"bytes,9,opt,name=cr_errmsg,json=crErrmsg" json:"cr_errmsg,omitempty"`
-	Version          *CriuVersion        `protobuf:"bytes,10,opt,name=version" json:"version,omitempty"`
 	XXX_unrecognized []byte              `json:"-"`
 }
 
-func (m *CriuResp) Reset()                    { *m = CriuResp{} }
-func (m *CriuResp) String() string            { return proto.CompactTextString(m) }
-func (*CriuResp) ProtoMessage()               {}
-func (*CriuResp) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{13} }
+func (m *CriuResp) Reset()         { *m = CriuResp{} }
+func (m *CriuResp) String() string { return proto.CompactTextString(m) }
+func (*CriuResp) ProtoMessage()    {}
 
 func (m *CriuResp) GetType() CriuReqType {
 	if m != nil && m.Type != nil {
@@ -967,212 +816,7 @@ func (m *CriuResp) GetFeatures() *CriuFeatures {
 	return nil
 }
 
-func (m *CriuResp) GetCrErrmsg() string {
-	if m != nil && m.CrErrmsg != nil {
-		return *m.CrErrmsg
-	}
-	return ""
-}
-
-func (m *CriuResp) GetVersion() *CriuVersion {
-	if m != nil {
-		return m.Version
-	}
-	return nil
-}
-
-// Answer for criu_req_type.VERSION requests
-type CriuVersion struct {
-	Major            *int32  `protobuf:"varint,1,req,name=major" json:"major,omitempty"`
-	Minor            *int32  `protobuf:"varint,2,req,name=minor" json:"minor,omitempty"`
-	Gitid            *string `protobuf:"bytes,3,opt,name=gitid" json:"gitid,omitempty"`
-	Sublevel         *int32  `protobuf:"varint,4,opt,name=sublevel" json:"sublevel,omitempty"`
-	Extra            *int32  `protobuf:"varint,5,opt,name=extra" json:"extra,omitempty"`
-	Name             *string `protobuf:"bytes,6,opt,name=name" json:"name,omitempty"`
-	XXX_unrecognized []byte  `json:"-"`
-}
-
-func (m *CriuVersion) Reset()                    { *m = CriuVersion{} }
-func (m *CriuVersion) String() string            { return proto.CompactTextString(m) }
-func (*CriuVersion) ProtoMessage()               {}
-func (*CriuVersion) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{14} }
-
-func (m *CriuVersion) GetMajor() int32 {
-	if m != nil && m.Major != nil {
-		return *m.Major
-	}
-	return 0
-}
-
-func (m *CriuVersion) GetMinor() int32 {
-	if m != nil && m.Minor != nil {
-		return *m.Minor
-	}
-	return 0
-}
-
-func (m *CriuVersion) GetGitid() string {
-	if m != nil && m.Gitid != nil {
-		return *m.Gitid
-	}
-	return ""
-}
-
-func (m *CriuVersion) GetSublevel() int32 {
-	if m != nil && m.Sublevel != nil {
-		return *m.Sublevel
-	}
-	return 0
-}
-
-func (m *CriuVersion) GetExtra() int32 {
-	if m != nil && m.Extra != nil {
-		return *m.Extra
-	}
-	return 0
-}
-
-func (m *CriuVersion) GetName() string {
-	if m != nil && m.Name != nil {
-		return *m.Name
-	}
-	return ""
-}
-
 func init() {
-	proto.RegisterType((*CriuPageServerInfo)(nil), "criu_page_server_info")
-	proto.RegisterType((*CriuVethPair)(nil), "criu_veth_pair")
-	proto.RegisterType((*ExtMountMap)(nil), "ext_mount_map")
-	proto.RegisterType((*JoinNamespace)(nil), "join_namespace")
-	proto.RegisterType((*InheritFd)(nil), "inherit_fd")
-	proto.RegisterType((*CgroupRoot)(nil), "cgroup_root")
-	proto.RegisterType((*UnixSk)(nil), "unix_sk")
-	proto.RegisterType((*CriuOpts)(nil), "criu_opts")
-	proto.RegisterType((*CriuDumpResp)(nil), "criu_dump_resp")
-	proto.RegisterType((*CriuRestoreResp)(nil), "criu_restore_resp")
-	proto.RegisterType((*CriuNotify)(nil), "criu_notify")
-	proto.RegisterType((*CriuFeatures)(nil), "criu_features")
-	proto.RegisterType((*CriuReq)(nil), "criu_req")
-	proto.RegisterType((*CriuResp)(nil), "criu_resp")
-	proto.RegisterType((*CriuVersion)(nil), "criu_version")
 	proto.RegisterEnum("CriuCgMode", CriuCgMode_name, CriuCgMode_value)
 	proto.RegisterEnum("CriuReqType", CriuReqType_name, CriuReqType_value)
 }
-
-func init() { proto.RegisterFile("criurpc.proto", fileDescriptor0) }
-
-var fileDescriptor0 = []byte{
-	// 1781 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x8c, 0x56, 0xdd, 0x72, 0x5b, 0xb7,
-	0x11, 0x0e, 0x29, 0xfe, 0x1c, 0x82, 0x3f, 0xa6, 0x10, 0xdb, 0x81, 0x93, 0xda, 0x62, 0xe8, 0x28,
-	0x51, 0x15, 0x97, 0x4d, 0x58, 0x3b, 0xae, 0x33, 0xed, 0x85, 0x47, 0x22, 0x5d, 0x36, 0x92, 0xc8,
-	0x01, 0x25, 0xcf, 0xe4, 0x0a, 0x73, 0x74, 0x0e, 0x48, 0xc1, 0x3c, 0x7f, 0x05, 0x40, 0x45, 0xf2,
-	0x83, 0xf4, 0x29, 0xfa, 0x0c, 0x7d, 0x84, 0xbe, 0x4e, 0x6f, 0x3b, 0xbb, 0x00, 0x65, 0x29, 0xc9,
-	0xb4, 0xbd, 0xc3, 0x7e, 0x58, 0x00, 0xbb, 0xfb, 0xed, 0x0f, 0x48, 0x3b, 0xd2, 0x6a, 0xad, 0x8b,
-	0x68, 0x50, 0xe8, 0xdc, 0xe6, 0xfd, 0x25, 0x79, 0x00, 0x80, 0x28, 0xc2, 0xa5, 0x14, 0x46, 0xea,
-	0x4b, 0xa9, 0x85, 0xca, 0x16, 0x39, 0x65, 0xa4, 0x1e, 0xc6, 0xb1, 0x96, 0xc6, 0xb0, 0x52, 0xaf,
-	0xb4, 0xd7, 0xe0, 0x1b, 0x91, 0x52, 0x52, 0x29, 0x72, 0x6d, 0x59, 0xb9, 0x57, 0xda, 0xab, 0x72,
-	0x5c, 0xd3, 0x2e, 0xd9, 0x2a, 0x54, 0xcc, 0xb6, 0x10, 0x82, 0x25, 0xed, 0x90, 0xf2, 0x22, 0x66,
-	0x15, 0x04, 0xca, 0x8b, 0xb8, 0xff, 0x27, 0xd2, 0xc1, 0x87, 0x2e, 0xa5, 0xbd, 0x10, 0x45, 0xa8,
-	0x34, 0xfd, 0x98, 0x54, 0xd5, 0x42, 0xa8, 0x8c, 0x95, 0x7a, 0xe5, 0xbd, 0x06, 0xaf, 0xa8, 0xc5,
-	0x24, 0xa3, 0x0f, 0x48, 0x4d, 0x2d, 0x44, 0xbe, 0x86, 0xeb, 0x01, 0xad, 0xaa, 0xc5, 0x74, 0x6d,
-	0xfb, 0x7f, 0x20, 0x6d, 0x79, 0x65, 0x45, 0x9a, 0xaf, 0x33, 0x2b, 0xd2, 0xb0, 0x80, 0x07, 0x57,
-	0xf2, 0xda, 0x1f, 0x85, 0x25, 0x20, 0x97, 0x61, 0xe2, 0x8f, 0xc1, 0xb2, 0xff, 0x96, 0x74, 0xde,
-	0xe5, 0x2a, 0x13, 0x59, 0x98, 0x4a, 0x53, 0x84, 0x91, 0x04, 0xa3, 0x32, 0xe3, 0x0f, 0x95, 0x33,
-	0x43, 0x3f, 0x21, 0xf5, 0xcc, 0x88, 0x85, 0x4a, 0xa4, 0x3f, 0x57, 0xcb, 0xcc, 0x58, 0x25, 0x92,
-	0x7e, 0x46, 0x1a, 0xf2, 0xca, 0xea, 0x50, 0xe4, 0x85, 0x45, 0xaf, 0x1a, 0x3c, 0x40, 0x60, 0x5a,
-	0xd8, 0xfe, 0x80, 0x10, 0x95, 0x5d, 0x48, 0xad, 0xac, 0x58, 0xc4, 0xbf, 0x62, 0x89, 0x73, 0x1d,
-	0x2e, 0x74, 0xae, 0xbf, 0x20, 0xcd, 0x68, 0xa9, 0xf3, 0x75, 0x21, 0x74, 0x9e, 0x5b, 0x88, 0x5f,
-	0x64, 0x75, 0xe2, 0xc3, 0x8a, 0x6b, 0x8c, 0x69, 0x68, 0x2f, 0xbc, 0x15, 0xb8, 0xee, 0xef, 0x90,
-	0xfa, 0x3a, 0x53, 0x57, 0xc2, 0xac, 0xe8, 0x7d, 0x52, 0x55, 0x59, 0x1e, 0x4b, 0x7c, 0xa5, 0xcd,
-	0x9d, 0xd0, 0xff, 0x57, 0x9b, 0x34, 0x30, 0xa6, 0x79, 0x61, 0x0d, 0xed, 0x93, 0xb6, 0x4a, 0xc3,
-	0xa5, 0x34, 0x22, 0x56, 0x5a, 0x2c, 0x62, 0xd4, 0xad, 0xf2, 0xa6, 0x03, 0x0f, 0x95, 0x1e, 0xc7,
-	0x1b, 0x9a, 0xca, 0x1f, 0x68, 0x7a, 0x4a, 0xda, 0x89, 0x0c, 0x2f, 0xa5, 0xd0, 0xeb, 0x2c, 0x53,
-	0xd9, 0x12, 0x9d, 0x0d, 0x78, 0x0b, 0x41, 0xee, 0x30, 0xfa, 0x84, 0x34, 0x21, 0xfa, 0xde, 0x1a,
-	0x24, 0x35, 0xe0, 0x10, 0xa0, 0xb3, 0x4c, 0x5d, 0xcd, 0x57, 0xf4, 0x2b, 0x72, 0xcf, 0x46, 0x85,
-	0x90, 0xc6, 0x86, 0xe7, 0x89, 0x32, 0x17, 0x32, 0x66, 0x55, 0xd4, 0xe9, 0xd8, 0xa8, 0x18, 0x7d,
-	0x40, 0x41, 0x51, 0x5e, 0x86, 0x46, 0x5d, 0x4a, 0x11, 0xcb, 0x4b, 0x15, 0x49, 0xc3, 0x6a, 0x4e,
-	0xd1, 0xc3, 0x87, 0x0e, 0x85, 0xf8, 0x9b, 0x0b, 0x99, 0x24, 0xe2, 0x5d, 0x7e, 0xce, 0xea, 0xa8,
-	0x12, 0x20, 0xf0, 0xd7, 0xfc, 0x9c, 0x3e, 0x26, 0x04, 0x28, 0x13, 0x49, 0x1e, 0xad, 0x0c, 0x0b,
-	0x9c, 0x35, 0x80, 0x1c, 0x01, 0x40, 0x9f, 0x90, 0x46, 0x92, 0x2f, 0x45, 0x22, 0x2f, 0x65, 0xc2,
-	0x1a, 0xe0, 0xea, 0xf7, 0xa5, 0x21, 0x0f, 0x92, 0x7c, 0x79, 0x04, 0x10, 0x7d, 0x44, 0x60, 0xed,
-	0x58, 0x27, 0x2e, 0xb5, 0x93, 0x7c, 0x89, 0xb4, 0x7f, 0x49, 0xca, 0x85, 0x61, 0xcd, 0x5e, 0x69,
-	0xaf, 0x39, 0x7c, 0x38, 0xf8, 0xd5, 0xc2, 0xe0, 0xe5, 0xc2, 0xd0, 0x5d, 0xd2, 0xc9, 0x72, 0xab,
-	0x16, 0xd7, 0xc2, 0x44, 0x5a, 0x15, 0xd6, 0xb0, 0x16, 0x5a, 0xd1, 0x76, 0xe8, 0xdc, 0x81, 0xc0,
-	0x2a, 0x30, 0xce, 0xda, 0x8e, 0x69, 0x64, 0xff, 0x31, 0x21, 0x45, 0xa8, 0x65, 0x66, 0x85, 0x4a,
-	0x97, 0xac, 0x83, 0x3b, 0x0d, 0x87, 0x4c, 0xd2, 0x25, 0x38, 0x6e, 0x75, 0x18, 0xad, 0x44, 0x2a,
-	0x53, 0x76, 0xcf, 0x39, 0x8e, 0xc0, 0xb1, 0x4c, 0xe1, 0x6c, 0xb8, 0xb6, 0xb9, 0x88, 0x65, 0xbc,
-	0x2e, 0x58, 0xd7, 0x39, 0x0e, 0xc8, 0x21, 0x00, 0x40, 0xd3, 0x4f, 0xb9, 0x5e, 0x6d, 0xf8, 0xdf,
-	0x46, 0x96, 0x1b, 0x00, 0x39, 0xf6, 0x1f, 0x13, 0x92, 0xa8, 0x6c, 0x25, 0xb4, 0x4c, 0xc3, 0x82,
-	0x51, 0x77, 0x1c, 0x10, 0x0e, 0x00, 0xdd, 0x25, 0x55, 0x28, 0x4e, 0xc3, 0x3e, 0xee, 0x6d, 0xed,
-	0x35, 0x87, 0xf7, 0x06, 0x77, 0xeb, 0x95, 0xbb, 0x5d, 0xfa, 0x94, 0xd4, 0xa3, 0x62, 0x2d, 0xa2,
-	0xb0, 0x60, 0xf7, 0x7b, 0xa5, 0xbd, 0xf6, 0xf7, 0xe4, 0xf9, 0xf0, 0xd5, 0xf3, 0x57, 0xdf, 0xbd,
-	0x1c, 0xbe, 0x7a, 0xc1, 0x6b, 0x51, 0xb1, 0x3e, 0x08, 0x0b, 0xba, 0x43, 0x9a, 0x8b, 0x5c, 0x47,
-	0x52, 0x28, 0x0d, 0x6f, 0x3d, 0xc0, 0xb7, 0x08, 0x42, 0x13, 0x40, 0x80, 0x04, 0x79, 0x25, 0x23,
-	0x11, 0xa5, 0x31, 0x7b, 0xd8, 0xdb, 0x02, 0x12, 0x40, 0x3e, 0x48, 0x21, 0x49, 0xea, 0x58, 0xeb,
-	0x99, 0x65, 0x9f, 0xa0, 0x25, 0x9d, 0xc1, 0x9d, 0xda, 0xe7, 0x35, 0x79, 0x65, 0x8f, 0x33, 0x0b,
-	0x2c, 0xa4, 0x61, 0x06, 0xfc, 0xb8, 0xf2, 0x32, 0x8c, 0x39, 0x16, 0x1c, 0x7a, 0xe0, 0x40, 0xba,
-	0x4b, 0xea, 0xd1, 0x12, 0x4b, 0x8f, 0x3d, 0xc2, 0xfb, 0x5a, 0x83, 0x5b, 0xe5, 0xc8, 0x6b, 0xd1,
-	0x92, 0x03, 0x31, 0x3b, 0xa4, 0xa9, 0x8d, 0x15, 0x46, 0x9d, 0x27, 0x50, 0x07, 0x9f, 0x3a, 0x93,
-	0xb5, 0xb1, 0x73, 0x87, 0xd0, 0xfd, 0xdb, 0x65, 0xcf, 0x3e, 0xc3, 0xab, 0x9a, 0x83, 0x0f, 0x10,
-	0x6f, 0xf8, 0xf5, 0x38, 0xa6, 0x3d, 0xd2, 0x42, 0xa6, 0x36, 0x8e, 0xfc, 0xc6, 0xdd, 0x06, 0xd8,
-	0xc8, 0x19, 0xbf, 0xe3, 0x6a, 0xca, 0x5c, 0x84, 0x1a, 0x9e, 0x7b, 0xec, 0x14, 0xe4, 0x95, 0x9d,
-	0x3b, 0x64, 0xa3, 0x90, 0x86, 0xc6, 0x4a, 0x6d, 0xd8, 0x93, 0x1b, 0x85, 0x63, 0x87, 0x40, 0x08,
-	0xcd, 0x4a, 0x15, 0x78, 0xff, 0x8e, 0x0b, 0x21, 0xc8, 0x70, 0x39, 0xb4, 0xaf, 0x2c, 0x3c, 0x4f,
-	0xa4, 0x58, 0x18, 0xd6, 0xc3, 0xbd, 0xc0, 0x01, 0x63, 0x43, 0xf7, 0x48, 0xd3, 0x57, 0xb2, 0x50,
-	0x59, 0xce, 0x3e, 0x47, 0x47, 0x82, 0x81, 0xc7, 0x78, 0x63, 0x8d, 0x45, 0x3d, 0xc9, 0x72, 0xfa,
-	0x67, 0xf2, 0xf1, 0xdd, 0x00, 0x8b, 0x14, 0x9a, 0x50, 0xbf, 0x57, 0xda, 0xeb, 0x0c, 0xdb, 0x2e,
-	0x3f, 0xa2, 0x25, 0x82, 0x7c, 0xfb, 0x4e, 0xd0, 0x8f, 0xf3, 0x58, 0xc2, 0x43, 0xcb, 0x8b, 0xdc,
-	0x58, 0x91, 0xa8, 0x54, 0x59, 0xf6, 0x14, 0xb3, 0xa5, 0xfe, 0xed, 0x37, 0xcf, 0xff, 0xf8, 0xe2,
-	0xe5, 0x77, 0x9c, 0xe0, 0xde, 0x11, 0x6c, 0xd1, 0x3d, 0xd2, 0xc5, 0x44, 0x11, 0x26, 0x0a, 0x33,
-	0x01, 0xdd, 0xcf, 0xb0, 0x2f, 0xd0, 0xec, 0x0e, 0xe2, 0xf3, 0x28, 0xcc, 0x66, 0x80, 0xd2, 0x4f,
-	0x21, 0x6f, 0xac, 0xd4, 0x59, 0x98, 0xb0, 0x5d, 0xef, 0x98, 0x97, 0x31, 0xa7, 0xd2, 0xc2, 0x5e,
-	0x8b, 0xcc, 0xb0, 0x2f, 0xe1, 0x31, 0x5e, 0x47, 0xf9, 0x04, 0x7c, 0xae, 0xbb, 0x51, 0x60, 0xd8,
-	0x57, 0x3e, 0xbb, 0xef, 0x8e, 0x06, 0x5e, 0x03, 0xf9, 0xc4, 0xd0, 0xcf, 0x49, 0xcb, 0x67, 0x47,
-	0xa1, 0xf3, 0xc2, 0xb0, 0xdf, 0x62, 0x85, 0xfa, 0x06, 0x3e, 0x03, 0x88, 0xee, 0x93, 0xed, 0xdb,
-	0x2a, 0xae, 0x93, 0xec, 0xa3, 0xde, 0xbd, 0x5b, 0x7a, 0xd8, 0x51, 0x9e, 0x93, 0x87, 0x5e, 0x37,
-	0x5e, 0xa7, 0x85, 0x88, 0xf2, 0xcc, 0xea, 0x3c, 0x49, 0xa4, 0x66, 0x5f, 0xa3, 0xf5, 0xf7, 0xdd,
-	0xee, 0xe1, 0x3a, 0x2d, 0x0e, 0x6e, 0xf6, 0xa0, 0x2b, 0x2f, 0xb4, 0x94, 0xef, 0x37, 0x81, 0x67,
-	0xcf, 0xf0, 0xf6, 0x96, 0x03, 0x5d, 0x8c, 0x61, 0x42, 0x5b, 0x95, 0x4a, 0x98, 0x95, 0xbf, 0x73,
-	0xde, 0x7a, 0x91, 0x7e, 0x4d, 0x28, 0xf4, 0x63, 0xcc, 0x0e, 0x95, 0x89, 0x45, 0xa2, 0x96, 0x17,
-	0x96, 0x0d, 0x30, 0x83, 0xa0, 0x53, 0xcf, 0x57, 0xaa, 0x98, 0x64, 0x63, 0x84, 0xc1, 0xe1, 0x9f,
-	0x64, 0xb8, 0x12, 0xe6, 0xda, 0x44, 0x36, 0x31, 0xec, 0xf7, 0xa8, 0xd6, 0x04, 0x6c, 0xee, 0x20,
-	0x6c, 0x1c, 0xe1, 0xfb, 0x6b, 0xec, 0x85, 0x86, 0x7d, 0xe3, 0x1b, 0x47, 0xf8, 0xfe, 0x7a, 0x06,
-	0x00, 0x36, 0x6b, 0x1b, 0xda, 0xb5, 0x81, 0xba, 0xf8, 0x16, 0xbb, 0x4e, 0xe0, 0x80, 0x71, 0x0c,
-	0xc1, 0xca, 0x75, 0x71, 0x01, 0xb4, 0x5a, 0xe3, 0xb3, 0x99, 0x0d, 0x9d, 0x29, 0x6e, 0x63, 0x66,
-	0x8d, 0x4b, 0xe9, 0xfe, 0x33, 0xff, 0x47, 0xc0, 0x50, 0x69, 0x69, 0x0a, 0xa0, 0x5b, 0x4b, 0x63,
-	0x73, 0x2d, 0x63, 0x9c, 0x97, 0x01, 0xbf, 0x91, 0xfb, 0xbb, 0x64, 0x1b, 0xb5, 0x3d, 0xe0, 0x0e,
-	0xf8, 0x09, 0xe7, 0x66, 0x1f, 0x2c, 0xfb, 0x2f, 0x49, 0x13, 0xd5, 0x5c, 0x6b, 0xa6, 0x0f, 0x49,
-	0xcd, 0xf5, 0x6c, 0x3f, 0x7f, 0xbd, 0xf4, 0xcb, 0xd1, 0xd8, 0xff, 0xc1, 0xfd, 0x95, 0xc4, 0x42,
-	0x86, 0x76, 0xad, 0x9d, 0x9f, 0xa9, 0x4c, 0x05, 0xb6, 0xe3, 0x8d, 0x35, 0xa9, 0x4c, 0x4f, 0x41,
-	0xfe, 0x59, 0x8c, 0xca, 0x3f, 0x8b, 0x51, 0xff, 0x9f, 0x25, 0x12, 0x78, 0x6b, 0xff, 0x46, 0xfb,
-	0xa4, 0x62, 0xaf, 0x0b, 0x37, 0xcd, 0x3b, 0xc3, 0xce, 0x60, 0xb3, 0x21, 0x00, 0xe5, 0xb8, 0x47,
-	0x9f, 0x90, 0x0a, 0x8c, 0x75, 0xbc, 0xa9, 0x39, 0x24, 0x83, 0x9b, 0x41, 0xcf, 0x11, 0xbf, 0x3d,
-	0x82, 0xd6, 0x51, 0x04, 0xdf, 0xb4, 0xad, 0x3b, 0x23, 0xc8, 0x81, 0x60, 0xf3, 0x4a, 0xca, 0x42,
-	0xe4, 0x85, 0xcc, 0xfc, 0xe0, 0x0e, 0x00, 0x98, 0x16, 0x32, 0xa3, 0xfb, 0x24, 0xd8, 0x38, 0x87,
-	0x03, 0xbb, 0xb9, 0xb1, 0x65, 0x83, 0xf2, 0x9b, 0xfd, 0xfe, 0xbf, 0xcb, 0xfe, 0xb3, 0x81, 0x61,
-	0xfe, 0x7f, 0x3c, 0x60, 0xa4, 0xbe, 0x31, 0x0d, 0xbe, 0x35, 0x01, 0xdf, 0x88, 0xf4, 0x29, 0xa9,
-	0x00, 0xc5, 0x68, 0xf1, 0xcd, 0xa0, 0xb9, 0x21, 0x9d, 0xe3, 0x26, 0x7d, 0x46, 0xea, 0x9e, 0x59,
-	0xb4, 0xbb, 0x39, 0xa4, 0x83, 0x5f, 0xd0, 0xcd, 0x37, 0x2a, 0xf4, 0x0b, 0x52, 0x73, 0x8e, 0x7b,
-	0x47, 0x5a, 0x83, 0x5b, 0xa4, 0x73, 0xbf, 0xe7, 0xe7, 0x7b, 0xed, 0x7f, 0xce, 0xf7, 0x47, 0x40,
-	0x96, 0x90, 0x5a, 0x67, 0x39, 0xfe, 0x3e, 0xaa, 0xbc, 0x1e, 0xe9, 0x11, 0x88, 0x77, 0x62, 0x16,
-	0xfc, 0xf7, 0x98, 0x41, 0xf0, 0xdd, 0x35, 0xa9, 0x59, 0xe2, 0x4f, 0xa4, 0xc1, 0x03, 0xbc, 0x27,
-	0x35, 0x4b, 0x18, 0x73, 0x97, 0x52, 0x1b, 0x95, 0x67, 0xf8, 0x0b, 0x69, 0x6e, 0x1a, 0xaa, 0x07,
-	0xf9, 0x66, 0xb7, 0xff, 0xf7, 0x12, 0x69, 0xdd, 0xde, 0x81, 0xdf, 0x60, 0x1a, 0xbe, 0xcb, 0xb5,
-	0xcf, 0x72, 0x27, 0x20, 0xaa, 0xb2, 0x5c, 0xfb, 0x8f, 0xa7, 0x13, 0x00, 0x5d, 0x2a, 0xeb, 0xbf,
-	0xe6, 0x0d, 0xee, 0x04, 0x28, 0x2b, 0xb3, 0x3e, 0x77, 0x3f, 0xa4, 0x8a, 0x2f, 0x58, 0x2f, 0xc3,
-	0x09, 0xfc, 0xe9, 0x62, 0x20, 0xab, 0xdc, 0x09, 0xf0, 0x95, 0x81, 0x5e, 0x89, 0xb1, 0x6b, 0x70,
-	0x5c, 0xef, 0x0b, 0x6f, 0x97, 0x1f, 0x01, 0x94, 0x90, 0xda, 0xe4, 0xcd, 0xc9, 0x94, 0x8f, 0xba,
-	0x1f, 0xd1, 0x26, 0xa9, 0x1f, 0xbc, 0x11, 0x27, 0xd3, 0x93, 0x51, 0xb7, 0x44, 0x1b, 0xa4, 0x3a,
-	0xe3, 0xd3, 0xd9, 0xbc, 0x5b, 0xa6, 0x01, 0xa9, 0xcc, 0xa7, 0xe3, 0xd3, 0xee, 0x16, 0xac, 0xc6,
-	0x67, 0x47, 0x47, 0xdd, 0x0a, 0x9c, 0x9b, 0x9f, 0xf2, 0xc9, 0xc1, 0x69, 0xb7, 0x0a, 0xe7, 0x0e,
-	0x47, 0xe3, 0xd7, 0x67, 0x47, 0xa7, 0xdd, 0xda, 0xfe, 0x3f, 0x4a, 0xbe, 0x04, 0x37, 0x99, 0x05,
-	0x37, 0x8d, 0x8e, 0x67, 0xa7, 0x3f, 0x76, 0x3f, 0x82, 0xf3, 0x87, 0x67, 0xc7, 0xb3, 0x6e, 0x09,
-	0xce, 0xf0, 0xd1, 0xfc, 0x14, 0x1e, 0x2e, 0x83, 0xc6, 0xc1, 0x5f, 0x46, 0x07, 0x3f, 0x74, 0xb7,
-	0x68, 0x8b, 0x04, 0x33, 0x3e, 0x12, 0xa8, 0x55, 0xa1, 0xf7, 0x48, 0x73, 0xf6, 0xfa, 0xcd, 0x48,
-	0xcc, 0x47, 0xfc, 0xed, 0x88, 0x77, 0xab, 0xf0, 0xec, 0xc9, 0xf4, 0x74, 0x32, 0xfe, 0xb1, 0x5b,
-	0xa3, 0x5d, 0xd2, 0x3a, 0x98, 0x9d, 0x4d, 0x4e, 0xc6, 0x53, 0xa7, 0x5e, 0xa7, 0xdb, 0xa4, 0xbd,
-	0x41, 0xdc, 0x7d, 0x01, 0x40, 0xe3, 0xd1, 0xeb, 0xd3, 0x33, 0x3e, 0xf2, 0x50, 0x03, 0x9e, 0x7e,
-	0x3b, 0xe2, 0xf3, 0xc9, 0xf4, 0xa4, 0x4b, 0xfe, 0x13, 0x00, 0x00, 0xff, 0xff, 0x5f, 0x2a, 0xaf,
-	0x49, 0x5b, 0x0d, 0x00, 0x00,
-}

vendor/github.com/opencontainers/runc/libcontainer/criurpc/criurpc.proto

@@ -1,5 +1,3 @@
-syntax = "proto2";
-
 message criu_page_server_info {
 	optional string		address	= 1;
 	optional int32		port	= 2;
@@ -17,12 +15,6 @@ message ext_mount_map {
 	required string		val	= 2;
 };
 
-message join_namespace {
-	required string		ns		= 1;
-	required string		ns_file		= 2;
-	optional string		extra_opt	= 3;
-}
-
 message inherit_fd {
 	required string		key	= 1;
 	required int32		fd	= 2;
@@ -39,7 +31,7 @@ message unix_sk {
 
 enum criu_cg_mode {
 	IGNORE	= 0;
-	CG_NONE	= 1;
+	NONE	= 1;
 	PROPS	= 2;
 	SOFT	= 3;
 	FULL	= 4;
@@ -71,13 +63,13 @@ message criu_opts {
 
 	optional int32			work_dir_fd	= 17;
 	optional bool			link_remap	= 18;
-	repeated criu_veth_pair		veths		= 19; /* DEPRECATED, use external instead */
+	repeated criu_veth_pair		veths		= 19;
 
 	optional uint32			cpu_cap		= 20 [default = 0xffffffff];
 	optional bool			force_irmap	= 21;
 	repeated string			exec_cmd	= 22;
 
-	repeated ext_mount_map		ext_mnt		= 23; /* DEPRECATED, use external instead */
+	repeated ext_mount_map		ext_mnt		= 23;
 	optional bool			manage_cgroups	= 24; /* backward compatibility */
 	repeated cgroup_root		cg_root		= 25;
 
@@ -91,26 +83,14 @@ message criu_opts {
 	repeated string			skip_mnt	= 31;
 	repeated string			enable_fs	= 32;
 
-	repeated unix_sk                unix_sk_ino     = 33; /* DEPRECATED, use external instead */
+	repeated unix_sk                unix_sk_ino     = 33;
 
 	optional criu_cg_mode		manage_cgroups_mode = 34;
 	optional uint32			ghost_limit	= 35 [default = 0x100000];
 	repeated string			irmap_scan_paths = 36;
 	repeated string			external	= 37;
 	optional uint32			empty_ns	= 38;
-	repeated join_namespace		join_ns		= 39;
-
-	optional string			cgroup_props		= 41;
-	optional string			cgroup_props_file	= 42;
-	repeated string			cgroup_dump_controller	= 43;
-
-	optional string			freeze_cgroup		= 44;
-	optional uint32			timeout			= 45;
-	optional bool			tcp_skip_in_flight	= 46;
-	optional bool			weak_sysctls		= 47;
-	optional bool			lazy_pages		= 48;
-	optional int32			status_fd		= 49;
-	optional bool			orphan_pts_master	= 50;
+	optional bool			no_seccomp	= 39;
 }
 
 message criu_dump_resp {
@@ -140,8 +120,6 @@ enum criu_req_type {
 	CPUINFO_CHECK	= 8;
 
 	FEATURE_CHECK	= 9;
-
-	VERSION		= 10;
 }
 
 /*
@@ -150,7 +128,6 @@ enum criu_req_type {
  */
 message criu_features {
 	optional bool			mem_track	= 1;
-	optional bool			lazy_pages	= 2;
 }
 
 /*
@@ -194,16 +171,4 @@ message criu_resp {
 
 	optional int32			cr_errno	= 7;
 	optional criu_features		features	= 8;
-	optional string			cr_errmsg	= 9;
-	optional criu_version		version		= 10;
-}
-
-/* Answer for criu_req_type.VERSION requests */
-message criu_version {
-	required int32			major		= 1;
-	required int32			minor		= 2;
-	optional string			gitid		= 3;
-	optional int32			sublevel	= 4;
-	optional int32			extra		= 5;
-	optional string			name		= 6;
 }

vendor/github.com/opencontainers/runc/libcontainer/devices/devices_test.go

@@ -6,16 +6,14 @@ import (
 	"errors"
 	"os"
 	"testing"
-
-	"golang.org/x/sys/unix"
 )
 
 func TestDeviceFromPathLstatFailure(t *testing.T) {
 	testError := errors.New("test error")
 
-	// Override unix.Lstat to inject error.
-	unixLstat = func(path string, stat *unix.Stat_t) error {
-		return testError
+	// Override os.Lstat to inject error.
+	osLstat = func(path string) (os.FileInfo, error) {
+		return nil, testError
 	}
 
 	_, err := DeviceFromPath("", "")

vendor/github.com/opencontainers/runc/libcontainer/devices/devices_unix.go

@@ -1,14 +1,16 @@
+// +build linux freebsd
+
 package devices
 
 import (
 	"errors"
+	"fmt"
 	"io/ioutil"
 	"os"
 	"path/filepath"
+	"syscall"
 
 	"github.com/opencontainers/runc/libcontainer/configs"
-
-	"golang.org/x/sys/unix"
 )
 
 var (
@@ -17,45 +19,45 @@ var (
 
 // Testing dependencies
 var (
-	unixLstat     = unix.Lstat
+	osLstat       = os.Lstat
 	ioutilReadDir = ioutil.ReadDir
 )
 
-// Given the path to a device and its cgroup_permissions(which cannot be easily queried) look up the information about a linux device and return that information as a Device struct.
+// Given the path to a device and it's cgroup_permissions(which cannot be easily queried) look up the information about a linux device and return that information as a Device struct.
 func DeviceFromPath(path, permissions string) (*configs.Device, error) {
-	var stat unix.Stat_t
-	err := unixLstat(path, &stat)
+	fileInfo, err := osLstat(path)
 	if err != nil {
 		return nil, err
 	}
-
 	var (
-		devNumber = int(stat.Rdev)
-		major     = Major(devNumber)
-	)
-	if major == 0 {
-		return nil, ErrNotADevice
-	}
-
-	var (
-		devType rune
-		mode    = stat.Mode
+		devType                rune
+		mode                   = fileInfo.Mode()
+		fileModePermissionBits = os.FileMode.Perm(mode)
 	)
 	switch {
-	case mode&unix.S_IFBLK == unix.S_IFBLK:
-		devType = 'b'
-	case mode&unix.S_IFCHR == unix.S_IFCHR:
+	case mode&os.ModeDevice == 0:
+		return nil, ErrNotADevice
+	case mode&os.ModeCharDevice != 0:
+		fileModePermissionBits |= syscall.S_IFCHR
 		devType = 'c'
+	default:
+		fileModePermissionBits |= syscall.S_IFBLK
+		devType = 'b'
 	}
+	stat_t, ok := fileInfo.Sys().(*syscall.Stat_t)
+	if !ok {
+		return nil, fmt.Errorf("cannot determine the device number for device %s", path)
+	}
+	devNumber := int(stat_t.Rdev)
 	return &configs.Device{
 		Type:        devType,
 		Path:        path,
-		Major:       major,
+		Major:       Major(devNumber),
 		Minor:       Minor(devNumber),
 		Permissions: permissions,
-		FileMode:    os.FileMode(mode),
-		Uid:         stat.Uid,
-		Gid:         stat.Gid,
+		FileMode:    fileModePermissionBits,
+		Uid:         stat_t.Uid,
+		Gid:         stat_t.Gid,
 	}, nil
 }
 
@@ -73,8 +75,7 @@ func getDevices(path string) ([]*configs.Device, error) {
 		switch {
 		case f.IsDir():
 			switch f.Name() {
-			// ".lxc" & ".lxd-mounts" added to address https://github.com/lxc/lxd/issues/2825
-			case "pts", "shm", "fd", "mqueue", ".lxc", ".lxd-mounts":
+			case "pts", "shm", "fd", "mqueue":
 				continue
 			default:
 				sub, err := getDevices(filepath.Join(path, f.Name()))
@@ -93,9 +94,6 @@ func getDevices(path string) ([]*configs.Device, error) {
 			if err == ErrNotADevice {
 				continue
 			}
-			if os.IsNotExist(err) {
-				continue
-			}
 			return nil, err
 		}
 		out = append(out, device)

vendor/github.com/opencontainers/runc/libcontainer/devices/devices_unsupported.go

@@ -1,3 +1,3 @@
-// +build !linux
+// +build windows
 
 package devices

vendor/github.com/opencontainers/runc/libcontainer/error.go

@@ -2,7 +2,7 @@ package libcontainer
 
 import "io"
 
-// ErrorCode is the API error code type.
+// API error code type.
 type ErrorCode int
 
 // API error codes.
@@ -56,13 +56,13 @@ func (c ErrorCode) String() string {
 	}
 }
 
-// Error is the API error type.
+// API Error type.
 type Error interface {
 	error
 
-	// Returns an error if it failed to write the detail of the Error to w.
-	// The detail of the Error may include the error message and a
-	// representation of the stack trace.
+	// Returns a verbose string including the error message
+	// and a representation of the stack trace suitable for
+	// printing.
 	Detail(w io.Writer) error
 
 	// Returns the error code for this error.

vendor/github.com/opencontainers/runc/libcontainer/error_test.go

@@ -4,17 +4,12 @@ import "testing"
 
 func TestErrorCode(t *testing.T) {
 	codes := map[ErrorCode]string{
-		IdInUse:             "Id already in use",
-		InvalidIdFormat:     "Invalid format",
-		ContainerPaused:     "Container paused",
-		ConfigInvalid:       "Invalid configuration",
-		SystemError:         "System error",
-		ContainerNotExists:  "Container does not exist",
-		ContainerNotStopped: "Container is not stopped",
-		ContainerNotRunning: "Container is not running",
-		ConsoleExists:       "Console exists for process",
-		ContainerNotPaused:  "Container is not paused",
-		NoProcessOps:        "No process operations",
+		IdInUse:            "Id already in use",
+		InvalidIdFormat:    "Invalid format",
+		ContainerPaused:    "Container paused",
+		ConfigInvalid:      "Invalid configuration",
+		SystemError:        "System error",
+		ContainerNotExists: "Container does not exist",
 	}
 
 	for code, expected := range codes {

vendor/github.com/opencontainers/runc/libcontainer/factory.go

@@ -10,7 +10,7 @@ type Factory interface {
 	// between 1 and 1024 characters, inclusive.
 	//
 	// The id must not already be in use by an existing container. Containers created using
-	// a factory with the same path (and filesystem) must have distinct ids.
+	// a factory with the same path (and file system) must have distinct ids.
 	//
 	// Returns the new container with a running process.
 	//
@@ -28,6 +28,7 @@ type Factory interface {
 	//
 	// errors:
 	// Path does not exist
+	// Container is stopped
 	// System error
 	Load(id string) (Container, error)
 

vendor/github.com/opencontainers/runc/libcontainer/factory_linux.go

@@ -6,42 +6,58 @@ import (
 	"encoding/json"
 	"fmt"
 	"os"
+	"os/exec"
 	"path/filepath"
 	"regexp"
 	"runtime/debug"
 	"strconv"
+	"syscall"
 
 	"github.com/docker/docker/pkg/mount"
 	"github.com/opencontainers/runc/libcontainer/cgroups"
 	"github.com/opencontainers/runc/libcontainer/cgroups/fs"
-	"github.com/opencontainers/runc/libcontainer/cgroups/rootless"
 	"github.com/opencontainers/runc/libcontainer/cgroups/systemd"
 	"github.com/opencontainers/runc/libcontainer/configs"
 	"github.com/opencontainers/runc/libcontainer/configs/validate"
 	"github.com/opencontainers/runc/libcontainer/utils"
-
-	"golang.org/x/sys/unix"
 )
 
 const (
-	stateFilename    = "state.json"
-	execFifoFilename = "exec.fifo"
+	stateFilename = "state.json"
 )
 
-var idRegex = regexp.MustCompile(`^[\w+-\.]+$`)
+var (
+	idRegex  = regexp.MustCompile(`^[\w-\.]+$`)
+	maxIdLen = 1024
+)
 
 // InitArgs returns an options func to configure a LinuxFactory with the
-// provided init binary path and arguments.
+// provided init arguments.
 func InitArgs(args ...string) func(*LinuxFactory) error {
-	return func(l *LinuxFactory) (err error) {
-		if len(args) > 0 {
-			// Resolve relative paths to ensure that its available
-			// after directory changes.
-			if args[0], err = filepath.Abs(args[0]); err != nil {
-				return newGenericError(err, ConfigInvalid)
+	return func(l *LinuxFactory) error {
+		name := args[0]
+		if filepath.Base(name) == name {
+			if lp, err := exec.LookPath(name); err == nil {
+				name = lp
 			}
+		} else {
+			abs, err := filepath.Abs(name)
+			if err != nil {
+				return err
+			}
+			name = abs
 		}
+		l.InitPath = "/proc/self/exe"
+		l.InitArgs = append([]string{name}, args[1:]...)
+		return nil
+	}
+}
 
+// InitPath returns an options func to configure a LinuxFactory with the
+// provided absolute path to the init binary and arguements.
+func InitPath(path string, args ...string) func(*LinuxFactory) error {
+	return func(l *LinuxFactory) error {
+		l.InitPath = path
 		l.InitArgs = args
 		return nil
 	}
@@ -72,20 +88,6 @@ func Cgroupfs(l *LinuxFactory) error {
 	return nil
 }
 
-// RootlessCgroups is an options func to configure a LinuxFactory to
-// return containers that use the "rootless" cgroup manager, which will
-// fail to do any operations not possible to do with an unprivileged user.
-// It should only be used in conjunction with rootless containers.
-func RootlessCgroups(l *LinuxFactory) error {
-	l.NewCgroupsManager = func(config *configs.Cgroup, paths map[string]string) cgroups.Manager {
-		return &rootless.Manager{
-			Cgroups: config,
-			Paths:   paths,
-		}
-	}
-	return nil
-}
-
 // TmpfsRoot is an option func to mount LinuxFactory.Root to tmpfs.
 func TmpfsRoot(l *LinuxFactory) error {
 	mounted, err := mount.Mounted(l.Root)
@@ -93,22 +95,13 @@ func TmpfsRoot(l *LinuxFactory) error {
 		return err
 	}
 	if !mounted {
-		if err := unix.Mount("tmpfs", l.Root, "tmpfs", 0, ""); err != nil {
+		if err := syscall.Mount("tmpfs", l.Root, "tmpfs", 0, ""); err != nil {
 			return err
 		}
 	}
 	return nil
 }
 
-// CriuPath returns an option func to configure a LinuxFactory with the
-// provided criupath
-func CriuPath(criupath string) func(*LinuxFactory) error {
-	return func(l *LinuxFactory) error {
-		l.CriuPath = criupath
-		return nil
-	}
-}
-
 // New returns a linux based container factory based in the root directory and
 // configures the factory with the provided option funcs.
 func New(root string, options ...func(*LinuxFactory) error) (Factory, error) {
@@ -119,10 +112,10 @@ func New(root string, options ...func(*LinuxFactory) error) (Factory, error) {
 	}
 	l := &LinuxFactory{
 		Root:      root,
-		InitArgs:  []string{"/proc/self/exe", "init"},
 		Validator: validate.New(),
 		CriuPath:  "criu",
 	}
+	InitArgs(os.Args[0], "init")(l)
 	Cgroupfs(l)
 	for _, opt := range options {
 		if err := opt(l); err != nil {
@@ -137,6 +130,9 @@ type LinuxFactory struct {
 	// Root directory for the factory to store state.
 	Root string
 
+	// InitPath is the absolute path to the init binary.
+	InitPath string
+
 	// InitArgs are arguments for calling the init responsibilities for spawning
 	// a container.
 	InitArgs []string
@@ -168,19 +164,14 @@ func (l *LinuxFactory) Create(id string, config *configs.Config) (Container, err
 	} else if !os.IsNotExist(err) {
 		return nil, newGenericError(err, SystemError)
 	}
-	if err := os.MkdirAll(containerRoot, 0711); err != nil {
+	if err := os.MkdirAll(containerRoot, 0700); err != nil {
 		return nil, newGenericError(err, SystemError)
 	}
-	if err := os.Chown(containerRoot, unix.Geteuid(), unix.Getegid()); err != nil {
-		return nil, newGenericError(err, SystemError)
-	}
-	if config.Rootless {
-		RootlessCgroups(l)
-	}
 	c := &linuxContainer{
 		id:            id,
 		root:          containerRoot,
 		config:        config,
+		initPath:      l.InitPath,
 		initArgs:      l.InitArgs,
 		criuPath:      l.CriuPath,
 		cgroupManager: l.NewCgroupsManager(config.Cgroups, nil),
@@ -194,7 +185,7 @@ func (l *LinuxFactory) Load(id string) (Container, error) {
 		return nil, newGenericError(fmt.Errorf("invalid root"), ConfigInvalid)
 	}
 	containerRoot := filepath.Join(l.Root, id)
-	state, err := l.loadState(containerRoot, id)
+	state, err := l.loadState(containerRoot)
 	if err != nil {
 		return nil, err
 	}
@@ -203,22 +194,18 @@ func (l *LinuxFactory) Load(id string) (Container, error) {
 		processStartTime: state.InitProcessStartTime,
 		fds:              state.ExternalDescriptors,
 	}
-	// We have to use the RootlessManager.
-	if state.Rootless {
-		RootlessCgroups(l)
-	}
 	c := &linuxContainer{
-		initProcess:          r,
-		initProcessStartTime: state.InitProcessStartTime,
-		id:                   id,
-		config:               &state.Config,
-		initArgs:             l.InitArgs,
-		criuPath:             l.CriuPath,
-		cgroupManager:        l.NewCgroupsManager(state.Config.Cgroups, state.CgroupPaths),
-		root:                 containerRoot,
-		created:              state.Created,
+		initProcess:   r,
+		id:            id,
+		config:        &state.Config,
+		initPath:      l.InitPath,
+		initArgs:      l.InitArgs,
+		criuPath:      l.CriuPath,
+		cgroupManager: l.NewCgroupsManager(state.Config.Cgroups, state.CgroupPaths),
+		root:          containerRoot,
+		created:       state.Created,
 	}
-	c.state = &loadedState{c: c}
+	c.state = &createdState{c: c, s: Created}
 	if err := c.refreshState(); err != nil {
 		return nil, err
 	}
@@ -232,79 +219,55 @@ func (l *LinuxFactory) Type() string {
 // StartInitialization loads a container by opening the pipe fd from the parent to read the configuration and state
 // This is a low level implementation detail of the reexec and should not be consumed externally
 func (l *LinuxFactory) StartInitialization() (err error) {
-	var (
-		pipefd, rootfd int
-		consoleSocket  *os.File
-		envInitPipe    = os.Getenv("_LIBCONTAINER_INITPIPE")
-		envStateDir    = os.Getenv("_LIBCONTAINER_STATEDIR")
-		envConsole     = os.Getenv("_LIBCONTAINER_CONSOLE")
-	)
-
-	// Get the INITPIPE.
-	pipefd, err = strconv.Atoi(envInitPipe)
+	fdStr := os.Getenv("_LIBCONTAINER_INITPIPE")
+	pipefd, err := strconv.Atoi(fdStr)
 	if err != nil {
-		return fmt.Errorf("unable to convert _LIBCONTAINER_INITPIPE=%s to int: %s", envInitPipe, err)
+		return fmt.Errorf("error converting env var _LIBCONTAINER_INITPIPE(%q) to an int: %s", fdStr, err)
 	}
-
 	var (
 		pipe = os.NewFile(uintptr(pipefd), "pipe")
 		it   = initType(os.Getenv("_LIBCONTAINER_INITTYPE"))
 	)
-	defer pipe.Close()
-
-	// Only init processes have STATEDIR.
-	rootfd = -1
-	if it == initStandard {
-		if rootfd, err = strconv.Atoi(envStateDir); err != nil {
-			return fmt.Errorf("unable to convert _LIBCONTAINER_STATEDIR=%s to int: %s", envStateDir, err)
-		}
-	}
-
-	if envConsole != "" {
-		console, err := strconv.Atoi(envConsole)
-		if err != nil {
-			return fmt.Errorf("unable to convert _LIBCONTAINER_CONSOLE=%s to int: %s", envConsole, err)
-		}
-		consoleSocket = os.NewFile(uintptr(console), "console-socket")
-		defer consoleSocket.Close()
-	}
-
 	// clear the current process's environment to clean any libcontainer
 	// specific env vars.
 	os.Clearenv()
-
+	var i initer
 	defer func() {
 		// We have an error during the initialization of the container's init,
 		// send it back to the parent process in the form of an initError.
-		if werr := utils.WriteJSON(pipe, syncT{procError}); werr != nil {
-			fmt.Fprintln(os.Stderr, err)
-			return
+		// If container's init successed, syscall.Exec will not return, hence
+		// this defer function will never be called.
+		if _, ok := i.(*linuxStandardInit); ok {
+			//  Synchronisation only necessary for standard init.
+			if err := utils.WriteJSON(pipe, syncT{procError}); err != nil {
+				panic(err)
+			}
 		}
-		if werr := utils.WriteJSON(pipe, newSystemError(err)); werr != nil {
-			fmt.Fprintln(os.Stderr, err)
-			return
+		if err := utils.WriteJSON(pipe, newSystemError(err)); err != nil {
+			panic(err)
 		}
+		// ensure that this pipe is always closed
+		pipe.Close()
 	}()
+
 	defer func() {
 		if e := recover(); e != nil {
 			err = fmt.Errorf("panic from initialization: %v, %v", e, string(debug.Stack()))
 		}
 	}()
 
-	i, err := newContainerInit(it, pipe, consoleSocket, rootfd)
+	i, err = newContainerInit(it, pipe)
 	if err != nil {
 		return err
 	}
-
-	// If Init succeeds, syscall.Exec will not return, hence none of the defers will be called.
 	return i.Init()
 }
 
-func (l *LinuxFactory) loadState(root, id string) (*State, error) {
+func (l *LinuxFactory) loadState(root string) (*State, error) {
 	f, err := os.Open(filepath.Join(root, stateFilename))
 	if err != nil {
 		if os.IsNotExist(err) {
-			return nil, newGenericError(fmt.Errorf("container %q does not exist", id), ContainerNotExists)
+			return nil, newGenericError(err, ContainerNotExists)
 		}
 		return nil, newGenericError(err, SystemError)
 	}
@@ -320,6 +283,8 @@ func (l *LinuxFactory) validateID(id string) error {
 	if !idRegex.MatchString(id) {
 		return newGenericError(fmt.Errorf("invalid id format: %v", id), InvalidIdFormat)
 	}
-
+	if len(id) > maxIdLen {
+		return newGenericError(fmt.Errorf("invalid id format: %v", id), InvalidIdFormat)
+	}
 	return nil
 }

vendor/github.com/opencontainers/runc/libcontainer/factory_linux_test.go

@@ -7,13 +7,12 @@ import (
 	"os"
 	"path/filepath"
 	"reflect"
+	"syscall"
 	"testing"
 
 	"github.com/docker/docker/pkg/mount"
 	"github.com/opencontainers/runc/libcontainer/configs"
 	"github.com/opencontainers/runc/libcontainer/utils"
-
-	"golang.org/x/sys/unix"
 )
 
 func newTestRoot() (string, error) {
@@ -100,7 +99,7 @@ func TestFactoryNewTmpfs(t *testing.T) {
 	if !found {
 		t.Fatalf("Factory Root is not listed in mounts list")
 	}
-	defer unix.Unmount(root, unix.MNT_DETACH)
+	defer syscall.Unmount(root, syscall.MNT_DETACH)
 }
 
 func TestFactoryLoadNotExists(t *testing.T) {

vendor/github.com/opencontainers/runc/libcontainer/generic_error.go

@@ -1,7 +1,6 @@
 package libcontainer
 
 import (
-	"fmt"
 	"io"
 	"text/template"
 	"time"
@@ -9,6 +8,20 @@ import (
 	"github.com/opencontainers/runc/libcontainer/stacktrace"
 )
 
+type syncType uint8
+
+const (
+	procReady syncType = iota
+	procError
+	procRun
+	procHooks
+	procResume
+)
+
+type syncT struct {
+	Type syncType `json:"type"`
+}
+
 var errorTemplate = template.Must(template.New("error").Parse(`Timestamp: {{.Timestamp}}
 Code: {{.ECode}}
 {{if .Message }}
@@ -38,27 +51,14 @@ func newGenericError(err error, c ErrorCode) Error {
 }
 
 func newSystemError(err error) Error {
-	return createSystemError(err, "")
-}
-
-func newSystemErrorWithCausef(err error, cause string, v ...interface{}) Error {
-	return createSystemError(err, fmt.Sprintf(cause, v...))
-}
-
-func newSystemErrorWithCause(err error, cause string) Error {
-	return createSystemError(err, cause)
-}
-
-// createSystemError creates the specified error with the correct number of
-// stack frames skipped. This is only to be called by the other functions for
-// formatting the error.
-func createSystemError(err error, cause string) Error {
+	if le, ok := err.(Error); ok {
+		return le
+	}
 	gerr := &genericError{
 		Timestamp: time.Now(),
 		Err:       err,
 		ECode:     SystemError,
-		Cause:     cause,
-		Stack:     stacktrace.Capture(2),
+		Stack:     stacktrace.Capture(1),
 	}
 	if err != nil {
 		gerr.Message = err.Error()
@@ -70,17 +70,12 @@ type genericError struct {
 	Timestamp time.Time
 	ECode     ErrorCode
 	Err       error `json:"-"`
-	Cause     string
 	Message   string
 	Stack     stacktrace.Stacktrace
 }
 
 func (e *genericError) Error() string {
-	if e.Cause == "" {
-		return e.Message
-	}
-	frame := e.Stack.Frames[0]
-	return fmt.Sprintf("%s:%d: %s caused %q", frame.File, frame.Line, e.Cause, e.Message)
+	return e.Message
 }
 
 func (e *genericError) Code() ErrorCode {

vendor/github.com/opencontainers/runc/libcontainer/generic_error_test.go

@@ -12,38 +12,3 @@ func TestErrorDetail(t *testing.T) {
 		t.Fatal(derr)
 	}
 }
-
-func TestErrorWithCode(t *testing.T) {
-	err := newGenericError(fmt.Errorf("test error"), SystemError)
-	if code := err.Code(); code != SystemError {
-		t.Fatalf("expected err code %q but %q", SystemError, code)
-	}
-}
-
-func TestErrorWithError(t *testing.T) {
-	cc := []struct {
-		errmsg string
-		cause  string
-	}{
-		{
-			errmsg: "test error",
-		},
-		{
-			errmsg: "test error",
-			cause:  "test",
-		},
-	}
-
-	for _, v := range cc {
-		err := newSystemErrorWithCause(fmt.Errorf(v.errmsg), v.cause)
-
-		msg := err.Error()
-		if v.cause == "" && msg != v.errmsg {
-			t.Fatalf("expected err(%q) equal errmsg(%q)", msg, v.errmsg)
-		}
-		if v.cause != "" && msg == v.errmsg {
-			t.Fatalf("unexpected err(%q) equal errmsg(%q)", msg, v.errmsg)
-		}
-
-	}
-}

vendor/github.com/opencontainers/runc/libcontainer/init_linux.go

@@ -6,21 +6,20 @@ import (
 	"encoding/json"
 	"fmt"
 	"io"
+	"io/ioutil"
 	"net"
 	"os"
+	"strconv"
 	"strings"
-	"syscall" // only for Errno
-	"unsafe"
+	"syscall"
 
+	"github.com/Sirupsen/logrus"
 	"github.com/opencontainers/runc/libcontainer/cgroups"
 	"github.com/opencontainers/runc/libcontainer/configs"
 	"github.com/opencontainers/runc/libcontainer/system"
 	"github.com/opencontainers/runc/libcontainer/user"
 	"github.com/opencontainers/runc/libcontainer/utils"
-
-	"github.com/sirupsen/logrus"
 	"github.com/vishvananda/netlink"
-	"golang.org/x/sys/unix"
 )
 
 type initType string
@@ -31,8 +30,7 @@ const (
 )
 
 type pid struct {
-	Pid           int `json:"pid"`
-	PidFirstChild int `json:"pid_first"`
+	Pid int `json:"pid"`
 }
 
 // network is an internal struct used to setup container networks.
@@ -46,29 +44,27 @@ type network struct {
 
 // initConfig is used for transferring parameters from Exec() to Init()
 type initConfig struct {
-	Args             []string              `json:"args"`
-	Env              []string              `json:"env"`
-	Cwd              string                `json:"cwd"`
-	Capabilities     *configs.Capabilities `json:"capabilities"`
-	ProcessLabel     string                `json:"process_label"`
-	AppArmorProfile  string                `json:"apparmor_profile"`
-	NoNewPrivileges  bool                  `json:"no_new_privileges"`
-	User             string                `json:"user"`
-	AdditionalGroups []string              `json:"additional_groups"`
-	Config           *configs.Config       `json:"config"`
-	Networks         []*network            `json:"network"`
-	PassedFilesCount int                   `json:"passed_files_count"`
-	ContainerId      string                `json:"containerid"`
-	Rlimits          []configs.Rlimit      `json:"rlimits"`
-	CreateConsole    bool                  `json:"create_console"`
-	Rootless         bool                  `json:"rootless"`
+	Args             []string         `json:"args"`
+	Env              []string         `json:"env"`
+	Cwd              string           `json:"cwd"`
+	Capabilities     []string         `json:"capabilities"`
+	ProcessLabel     string           `json:"process_label"`
+	AppArmorProfile  string           `json:"apparmor_profile"`
+	NoNewPrivileges  bool             `json:"no_new_privileges"`
+	User             string           `json:"user"`
+	Config           *configs.Config  `json:"config"`
+	Console          string           `json:"console"`
+	Networks         []*network       `json:"network"`
+	PassedFilesCount int              `json:"passed_files_count"`
+	ContainerId      string           `json:"containerid"`
+	Rlimits          []configs.Rlimit `json:"rlimits"`
 }
 
 type initer interface {
 	Init() error
 }
 
-func newContainerInit(t initType, pipe *os.File, consoleSocket *os.File, stateDirFD int) (initer, error) {
+func newContainerInit(t initType, pipe *os.File) (initer, error) {
 	var config *initConfig
 	if err := json.NewDecoder(pipe).Decode(&config); err != nil {
 		return nil, err
@@ -79,17 +75,13 @@ func newContainerInit(t initType, pipe *os.File, consoleSocket *os.File, stateDi
 	switch t {
 	case initSetns:
 		return &linuxSetnsInit{
-			pipe:          pipe,
-			consoleSocket: consoleSocket,
-			config:        config,
+			config: config,
 		}, nil
 	case initStandard:
 		return &linuxStandardInit{
-			pipe:          pipe,
-			consoleSocket: consoleSocket,
-			parentPid:     unix.Getppid(),
-			config:        config,
-			stateDirFD:    stateDirFD,
+			pipe:      pipe,
+			parentPid: syscall.Getppid(),
+			config:    config,
 		}, nil
 	}
 	return nil, fmt.Errorf("unknown init type %q", t)
@@ -121,18 +113,16 @@ func finalizeNamespace(config *initConfig) error {
 		return err
 	}
 
-	capabilities := &configs.Capabilities{}
+	capabilities := config.Config.Capabilities
 	if config.Capabilities != nil {
 		capabilities = config.Capabilities
-	} else if config.Config.Capabilities != nil {
-		capabilities = config.Config.Capabilities
 	}
-	w, err := newContainerCapList(capabilities)
+	w, err := newCapWhitelist(capabilities)
 	if err != nil {
 		return err
 	}
 	// drop capabilities in bounding set before changing user
-	if err := w.ApplyBoundingSet(); err != nil {
+	if err := w.dropBoundingSet(); err != nil {
 		return err
 	}
 	// preserve existing capabilities while we change users
@@ -145,54 +135,16 @@ func finalizeNamespace(config *initConfig) error {
 	if err := system.ClearKeepCaps(); err != nil {
 		return err
 	}
-	if err := w.ApplyCaps(); err != nil {
+	// drop all other capabilities
+	if err := w.drop(); err != nil {
 		return err
 	}
 	if config.Cwd != "" {
-		if err := unix.Chdir(config.Cwd); err != nil {
-			return fmt.Errorf("chdir to cwd (%q) set in config.json failed: %v", config.Cwd, err)
-		}
-	}
-	return nil
-}
-
-// setupConsole sets up the console from inside the container, and sends the
-// master pty fd to the config.Pipe (using cmsg). This is done to ensure that
-// consoles are scoped to a container properly (see runc#814 and the many
-// issues related to that). This has to be run *after* we've pivoted to the new
-// rootfs (and the users' configuration is entirely set up).
-func setupConsole(socket *os.File, config *initConfig, mount bool) error {
-	defer socket.Close()
-	// At this point, /dev/ptmx points to something that we would expect. We
-	// used to change the owner of the slave path, but since the /dev/pts mount
-	// can have gid=X set (at the users' option). So touching the owner of the
-	// slave PTY is not necessary, as the kernel will handle that for us. Note
-	// however, that setupUser (specifically fixStdioPermissions) *will* change
-	// the UID owner of the console to be the user the process will run as (so
-	// they can actually control their console).
-	console, err := newConsole()
-	if err != nil {
-		return err
-	}
-	// After we return from here, we don't need the console anymore.
-	defer console.Close()
-
-	linuxConsole, ok := console.(*linuxConsole)
-	if !ok {
-		return fmt.Errorf("failed to cast console to *linuxConsole")
-	}
-	// Mount the console inside our rootfs.
-	if mount {
-		if err := linuxConsole.mount(); err != nil {
+		if err := syscall.Chdir(config.Cwd); err != nil {
 			return err
 		}
 	}
-	// While we can access console.master, using the API is a good idea.
-	if err := utils.SendFd(socket, linuxConsole.File()); err != nil {
-		return err
-	}
-	// Now, dup over all the things.
-	return linuxConsole.dupStdio()
+	return nil
 }
 
 // syncParentReady sends to the given pipe a JSON payload which indicates that
@@ -200,15 +152,19 @@ func setupConsole(socket *os.File, config *initConfig, mount bool) error {
 // indicate that it is cleared to Exec.
 func syncParentReady(pipe io.ReadWriter) error {
 	// Tell parent.
-	if err := writeSync(pipe, procReady); err != nil {
+	if err := utils.WriteJSON(pipe, syncT{procReady}); err != nil {
 		return err
 	}
-
 	// Wait for parent to give the all-clear.
-	if err := readSync(pipe, procRun); err != nil {
-		return err
+	var procSync syncT
+	if err := json.NewDecoder(pipe).Decode(&procSync); err != nil {
+		if err == io.EOF {
+			return fmt.Errorf("parent closed synchronisation channel")
+		}
+		if procSync.Type != procRun {
+			return fmt.Errorf("invalid synchronisation flag from parent")
+		}
 	}
-
 	return nil
 }
 
@@ -217,15 +173,19 @@ func syncParentReady(pipe io.ReadWriter) error {
 // indicate that it is cleared to resume.
 func syncParentHooks(pipe io.ReadWriter) error {
 	// Tell parent.
-	if err := writeSync(pipe, procHooks); err != nil {
+	if err := utils.WriteJSON(pipe, syncT{procHooks}); err != nil {
 		return err
 	}
-
 	// Wait for parent to give the all-clear.
-	if err := readSync(pipe, procResume); err != nil {
-		return err
+	var procSync syncT
+	if err := json.NewDecoder(pipe).Decode(&procSync); err != nil {
+		if err == io.EOF {
+			return fmt.Errorf("parent closed synchronisation channel")
+		}
+		if procSync.Type != procResume {
+			return fmt.Errorf("invalid synchronisation flag from parent")
+		}
 	}
-
 	return nil
 }
 
@@ -233,76 +193,46 @@ func syncParentHooks(pipe io.ReadWriter) error {
 func setupUser(config *initConfig) error {
 	// Set up defaults.
 	defaultExecUser := user.ExecUser{
-		Uid:  0,
-		Gid:  0,
+		Uid:  syscall.Getuid(),
+		Gid:  syscall.Getgid(),
 		Home: "/",
 	}
-
 	passwdPath, err := user.GetPasswdPath()
 	if err != nil {
 		return err
 	}
-
 	groupPath, err := user.GetGroupPath()
 	if err != nil {
 		return err
 	}
-
 	execUser, err := user.GetExecUserPath(config.User, &defaultExecUser, passwdPath, groupPath)
 	if err != nil {
 		return err
 	}
 
 	var addGroups []int
-	if len(config.AdditionalGroups) > 0 {
-		addGroups, err = user.GetAdditionalGroupsPath(config.AdditionalGroups, groupPath)
+	if len(config.Config.AdditionalGroups) > 0 {
+		addGroups, err = user.GetAdditionalGroupsPath(config.Config.AdditionalGroups, groupPath)
 		if err != nil {
 			return err
 		}
 	}
-
-	if config.Rootless {
-		if execUser.Uid != 0 {
-			return fmt.Errorf("cannot run as a non-root user in a rootless container")
-		}
-
-		if execUser.Gid != 0 {
-			return fmt.Errorf("cannot run as a non-root group in a rootless container")
-		}
-
-		// We cannot set any additional groups in a rootless container and thus we
-		// bail if the user asked us to do so. TODO: We currently can't do this
-		// earlier, but if libcontainer.Process.User was typesafe this might work.
-		if len(addGroups) > 0 {
-			return fmt.Errorf("cannot set any additional groups in a rootless container")
-		}
-	}
-
 	// before we change to the container's user make sure that the processes STDIO
 	// is correctly owned by the user that we are switching to.
-	if err := fixStdioPermissions(config, execUser); err != nil {
+	if err := fixStdioPermissions(execUser); err != nil {
 		return err
 	}
-
-	// This isn't allowed in an unprivileged user namespace since Linux 3.19.
-	// There's nothing we can do about /etc/group entries, so we silently
-	// ignore setting groups here (since the user didn't explicitly ask us to
-	// set the group).
-	if !config.Rootless {
-		suppGroups := append(execUser.Sgids, addGroups...)
-		if err := unix.Setgroups(suppGroups); err != nil {
-			return err
-		}
+	suppGroups := append(execUser.Sgids, addGroups...)
+	if err := syscall.Setgroups(suppGroups); err != nil {
+		return err
 	}
 
 	if err := system.Setgid(execUser.Gid); err != nil {
 		return err
 	}
-
 	if err := system.Setuid(execUser.Uid); err != nil {
 		return err
 	}
-
 	// if we didn't get HOME already, set it based on the user's HOME
 	if envHome := os.Getenv("HOME"); envHome == "" {
 		if err := os.Setenv("HOME", execUser.Home); err != nil {
@@ -315,9 +245,9 @@ func setupUser(config *initConfig) error {
 // fixStdioPermissions fixes the permissions of PID 1's STDIO within the container to the specified user.
 // The ownership needs to match because it is created outside of the container and needs to be
 // localized.
-func fixStdioPermissions(config *initConfig, u *user.ExecUser) error {
-	var null unix.Stat_t
-	if err := unix.Stat("/dev/null", &null); err != nil {
+func fixStdioPermissions(u *user.ExecUser) error {
+	var null syscall.Stat_t
+	if err := syscall.Stat("/dev/null", &null); err != nil {
 		return err
 	}
 	for _, fd := range []uintptr{
@@ -325,31 +255,15 @@ func fixStdioPermissions(config *initConfig, u *user.ExecUser) error {
 		os.Stderr.Fd(),
 		os.Stdout.Fd(),
 	} {
-		var s unix.Stat_t
-		if err := unix.Fstat(int(fd), &s); err != nil {
+		var s syscall.Stat_t
+		if err := syscall.Fstat(int(fd), &s); err != nil {
 			return err
 		}
-
-		// Skip chown of /dev/null if it was used as one of the STDIO fds.
+		// skip chown of /dev/null if it was used as one of the STDIO fds.
 		if s.Rdev == null.Rdev {
 			continue
 		}
-
-		// Skip chown if s.Gid is actually an unmapped gid in the host. While
-		// this is a bit dodgy if it just so happens that the console _is_
-		// owned by overflow_gid, there's no way for us to disambiguate this as
-		// a userspace program.
-		if _, err := config.Config.HostGID(int(s.Gid)); err != nil {
-			continue
-		}
-
-		// We only change the uid owner (as it is possible for the mount to
-		// prefer a different gid, and there's no reason for us to change it).
-		// The reason why we don't just leave the default uid=X mount setup is
-		// that users expect to be able to actually use their console. Without
-		// this code, you couldn't effectively run as a non-root user inside a
-		// container and also have a console set up.
-		if err := unix.Fchown(int(fd), u.Uid, int(s.Gid)); err != nil {
+		if err := syscall.Fchown(int(fd), u.Uid, u.Gid); err != nil {
 			return err
 		}
 	}
@@ -404,58 +318,23 @@ func setupRoute(config *configs.Config) error {
 
 func setupRlimits(limits []configs.Rlimit, pid int) error {
 	for _, rlimit := range limits {
-		if err := system.Prlimit(pid, rlimit.Type, unix.Rlimit{Max: rlimit.Hard, Cur: rlimit.Soft}); err != nil {
+		if err := system.Prlimit(pid, rlimit.Type, syscall.Rlimit{Max: rlimit.Hard, Cur: rlimit.Soft}); err != nil {
 			return fmt.Errorf("error setting rlimit type %v: %v", rlimit.Type, err)
 		}
 	}
 	return nil
 }
 
-const _P_PID = 1
+func setOomScoreAdj(oomScoreAdj int, pid int) error {
+	path := fmt.Sprintf("/proc/%d/oom_score_adj", pid)
 
-type siginfo struct {
-	si_signo int32
-	si_errno int32
-	si_code  int32
-	// below here is a union; si_pid is the only field we use
-	si_pid int32
-	// Pad to 128 bytes as detailed in blockUntilWaitable
-	pad [96]byte
+	return ioutil.WriteFile(path, []byte(strconv.Itoa(oomScoreAdj)), 0600)
 }
 
-// isWaitable returns true if the process has exited false otherwise.
-// Its based off blockUntilWaitable in src/os/wait_waitid.go
-func isWaitable(pid int) (bool, error) {
-	si := &siginfo{}
-	_, _, e := unix.Syscall6(unix.SYS_WAITID, _P_PID, uintptr(pid), uintptr(unsafe.Pointer(si)), unix.WEXITED|unix.WNOWAIT|unix.WNOHANG, 0, 0)
-	if e != 0 {
-		return false, os.NewSyscallError("waitid", e)
-	}
-
-	return si.si_pid != 0, nil
-}
-
-// isNoChildren returns true if err represents a unix.ECHILD (formerly syscall.ECHILD) false otherwise
-func isNoChildren(err error) bool {
-	switch err := err.(type) {
-	case syscall.Errno:
-		if err == unix.ECHILD {
-			return true
-		}
-	case *os.SyscallError:
-		if err.Err == unix.ECHILD {
-			return true
-		}
-	}
-	return false
-}
-
-// signalAllProcesses freezes then iterates over all the processes inside the
-// manager's cgroups sending the signal s to them.
-// If s is SIGKILL then it will wait for each process to exit.
-// For all other signals it will check if the process is ready to report its
-// exit status and only if it is will a wait be performed.
-func signalAllProcesses(m cgroups.Manager, s os.Signal) error {
+// killCgroupProcesses freezes then iterates over all the processes inside the
+// manager's cgroups sending a SIGKILL to each process then waiting for them to
+// exit.
+func killCgroupProcesses(m cgroups.Manager) error {
 	var procs []*os.Process
 	if err := m.Freeze(configs.Frozen); err != nil {
 		logrus.Warn(err)
@@ -472,31 +351,16 @@ func signalAllProcesses(m cgroups.Manager, s os.Signal) error {
 			continue
 		}
 		procs = append(procs, p)
-		if err := p.Signal(s); err != nil {
+		if err := p.Kill(); err != nil {
 			logrus.Warn(err)
 		}
 	}
 	if err := m.Freeze(configs.Thawed); err != nil {
 		logrus.Warn(err)
 	}
-
 	for _, p := range procs {
-		if s != unix.SIGKILL {
-			if ok, err := isWaitable(p.Pid); err != nil {
-				if !isNoChildren(err) {
-					logrus.Warn("signalAllProcesses: ", p.Pid, err)
-				}
-				continue
-			} else if !ok {
-				// Not ready to report so don't wait
-				continue
-			}
-		}
-
 		if _, err := p.Wait(); err != nil {
-			if !isNoChildren(err) {
-				logrus.Warn("wait: ", err)
-			}
+			logrus.Warn(err)
 		}
 	}
 	return nil

vendor/github.com/opencontainers/runc/libcontainer/integration/checkpoint_test.go

@@ -5,15 +5,13 @@ import (
 	"bytes"
 	"io/ioutil"
 	"os"
-	"os/exec"
 	"path/filepath"
 	"strings"
+	"syscall"
 	"testing"
 
 	"github.com/opencontainers/runc/libcontainer"
 	"github.com/opencontainers/runc/libcontainer/configs"
-
-	"golang.org/x/sys/unix"
 )
 
 func showFile(t *testing.T, fname string) error {
@@ -40,22 +38,7 @@ func showFile(t *testing.T, fname string) error {
 	return nil
 }
 
-func TestUsernsCheckpoint(t *testing.T) {
-	if _, err := os.Stat("/proc/self/ns/user"); os.IsNotExist(err) {
-		t.Skip("userns is unsupported")
-	}
-	cmd := exec.Command("criu", "check", "--feature", "userns")
-	if err := cmd.Run(); err != nil {
-		t.Skip("Unable to c/r a container with userns")
-	}
-	testCheckpoint(t, true)
-}
-
 func TestCheckpoint(t *testing.T) {
-	testCheckpoint(t, false)
-}
-
-func testCheckpoint(t *testing.T, userns bool) {
 	if testing.Short() {
 		return
 	}
@@ -76,15 +59,9 @@ func testCheckpoint(t *testing.T, userns bool) {
 	config.Mounts = append(config.Mounts, &configs.Mount{
 		Destination: "/sys/fs/cgroup",
 		Device:      "cgroup",
-		Flags:       defaultMountFlags | unix.MS_RDONLY,
+		Flags:       defaultMountFlags | syscall.MS_RDONLY,
 	})
 
-	if userns {
-		config.UidMappings = []configs.IDMap{{HostID: 0, ContainerID: 0, Size: 1000}}
-		config.GidMappings = []configs.IDMap{{HostID: 0, ContainerID: 0, Size: 1000}}
-		config.Namespaces = append(config.Namespaces, configs.Namespace{Type: configs.NEWUSER})
-	}
-
 	factory, err := libcontainer.New(root, libcontainer.Cgroupfs)
 
 	if err != nil {
@@ -112,7 +89,7 @@ func testCheckpoint(t *testing.T, userns bool) {
 		Stdout: &stdout,
 	}
 
-	err = container.Run(&pconfig)
+	err = container.Start(&pconfig)
 	stdinR.Close()
 	defer stdinW.Close()
 	if err != nil {
@@ -129,33 +106,6 @@ func testCheckpoint(t *testing.T, userns bool) {
 		t.Fatal(err)
 	}
 
-	parentDir, err := ioutil.TempDir("", "criu-parent")
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer os.RemoveAll(parentDir)
-
-	preDumpOpts := &libcontainer.CriuOpts{
-		ImagesDirectory: parentDir,
-		WorkDirectory:   parentDir,
-		PreDump:         true,
-	}
-	preDumpLog := filepath.Join(preDumpOpts.WorkDirectory, "dump.log")
-
-	if err := container.Checkpoint(preDumpOpts); err != nil {
-		showFile(t, preDumpLog)
-		t.Fatal(err)
-	}
-
-	state, err := container.Status()
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	if state != libcontainer.Running {
-		t.Fatal("Unexpected preDump state: ", state)
-	}
-
 	imagesDir, err := ioutil.TempDir("", "criu")
 	if err != nil {
 		t.Fatal(err)
@@ -165,7 +115,6 @@ func testCheckpoint(t *testing.T, userns bool) {
 	checkpointOpts := &libcontainer.CriuOpts{
 		ImagesDirectory: imagesDir,
 		WorkDirectory:   imagesDir,
-		ParentImage:     "../criu-parent",
 	}
 	dumpLog := filepath.Join(checkpointOpts.WorkDirectory, "dump.log")
 	restoreLog := filepath.Join(checkpointOpts.WorkDirectory, "restore.log")
@@ -175,12 +124,12 @@ func testCheckpoint(t *testing.T, userns bool) {
 		t.Fatal(err)
 	}
 
-	state, err = container.Status()
+	state, err := container.Status()
 	if err != nil {
 		t.Fatal(err)
 	}
 
-	if state != libcontainer.Stopped {
+	if state != libcontainer.Running {
 		t.Fatal("Unexpected state checkpoint: ", state)
 	}
 

vendor/github.com/opencontainers/runc/libcontainer/integration/exec_test.go

@@ -2,7 +2,6 @@ package integration
 
 import (
 	"bytes"
-	"encoding/json"
 	"fmt"
 	"io/ioutil"
 	"os"
@@ -11,13 +10,12 @@ import (
 	"reflect"
 	"strconv"
 	"strings"
+	"syscall"
 	"testing"
 
 	"github.com/opencontainers/runc/libcontainer"
 	"github.com/opencontainers/runc/libcontainer/cgroups/systemd"
 	"github.com/opencontainers/runc/libcontainer/configs"
-
-	"golang.org/x/sys/unix"
 )
 
 func TestExecPS(t *testing.T) {
@@ -40,12 +38,12 @@ func testExecPS(t *testing.T, userns bool) {
 	defer remove(rootfs)
 	config := newTemplateConfig(rootfs)
 	if userns {
-		config.UidMappings = []configs.IDMap{{HostID: 0, ContainerID: 0, Size: 1000}}
-		config.GidMappings = []configs.IDMap{{HostID: 0, ContainerID: 0, Size: 1000}}
+		config.UidMappings = []configs.IDMap{{0, 0, 1000}}
+		config.GidMappings = []configs.IDMap{{0, 0, 1000}}
 		config.Namespaces = append(config.Namespaces, configs.Namespace{Type: configs.NEWUSER})
 	}
 
-	buffers, exitCode, err := runContainer(config, "", "ps", "-o", "pid,user,comm")
+	buffers, exitCode, err := runContainer(config, "", "ps")
 	if err != nil {
 		t.Fatalf("%s: %s", buffers, err)
 	}
@@ -182,14 +180,14 @@ func testRlimit(t *testing.T, userns bool) {
 
 	config := newTemplateConfig(rootfs)
 	if userns {
-		config.UidMappings = []configs.IDMap{{HostID: 0, ContainerID: 0, Size: 1000}}
-		config.GidMappings = []configs.IDMap{{HostID: 0, ContainerID: 0, Size: 1000}}
+		config.UidMappings = []configs.IDMap{{0, 0, 1000}}
+		config.GidMappings = []configs.IDMap{{0, 0, 1000}}
 		config.Namespaces = append(config.Namespaces, configs.Namespace{Type: configs.NEWUSER})
 	}
 
 	// ensure limit is lower than what the config requests to test that in a user namespace
 	// the Setrlimit call happens early enough that we still have permissions to raise the limit.
-	ok(t, unix.Setrlimit(unix.RLIMIT_NOFILE, &unix.Rlimit{
+	ok(t, syscall.Setrlimit(syscall.RLIMIT_NOFILE, &syscall.Rlimit{
 		Max: 1024,
 		Cur: 1024,
 	}))
@@ -201,6 +199,17 @@ func testRlimit(t *testing.T, userns bool) {
 	}
 }
 
+func newTestRoot() (string, error) {
+	dir, err := ioutil.TempDir("", "libcontainer")
+	if err != nil {
+		return "", err
+	}
+	if err := os.MkdirAll(dir, 0700); err != nil {
+		return "", err
+	}
+	return dir, nil
+}
+
 func TestEnter(t *testing.T) {
 	if testing.Short() {
 		return
@@ -232,7 +241,7 @@ func TestEnter(t *testing.T) {
 		Stdin:  stdinR,
 		Stdout: &stdout,
 	}
-	err = container.Run(&pconfig)
+	err = container.Start(&pconfig)
 	stdinR.Close()
 	defer stdinW.Close()
 	ok(t, err)
@@ -250,7 +259,7 @@ func TestEnter(t *testing.T) {
 	pconfig2.Stdin = stdinR2
 	pconfig2.Stdout = &stdout2
 
-	err = container.Run(&pconfig2)
+	err = container.Start(&pconfig2)
 	stdinR2.Close()
 	defer stdinW2.Close()
 	ok(t, err)
@@ -321,7 +330,7 @@ func TestProcessEnv(t *testing.T) {
 		Stdin:  nil,
 		Stdout: &stdout,
 	}
-	err = container.Run(&pconfig)
+	err = container.Start(&pconfig)
 	ok(t, err)
 
 	// Wait for process
@@ -340,57 +349,6 @@ func TestProcessEnv(t *testing.T) {
 	}
 }
 
-func TestProcessEmptyCaps(t *testing.T) {
-	if testing.Short() {
-		return
-	}
-	root, err := newTestRoot()
-	ok(t, err)
-	defer os.RemoveAll(root)
-
-	rootfs, err := newRootfs()
-	ok(t, err)
-	defer remove(rootfs)
-
-	config := newTemplateConfig(rootfs)
-	config.Capabilities = nil
-
-	container, err := factory.Create("test", config)
-	ok(t, err)
-	defer container.Destroy()
-
-	var stdout bytes.Buffer
-	pconfig := libcontainer.Process{
-		Cwd:    "/",
-		Args:   []string{"sh", "-c", "cat /proc/self/status"},
-		Env:    standardEnvironment,
-		Stdin:  nil,
-		Stdout: &stdout,
-	}
-	err = container.Run(&pconfig)
-	ok(t, err)
-
-	// Wait for process
-	waitProcess(&pconfig, t)
-
-	outputStatus := string(stdout.Bytes())
-
-	lines := strings.Split(outputStatus, "\n")
-
-	effectiveCapsLine := ""
-	for _, l := range lines {
-		line := strings.TrimSpace(l)
-		if strings.Contains(line, "CapEff:") {
-			effectiveCapsLine = line
-			break
-		}
-	}
-
-	if effectiveCapsLine == "" {
-		t.Fatal("Couldn't find effective caps: ", outputStatus)
-	}
-}
-
 func TestProcessCaps(t *testing.T) {
 	if testing.Short() {
 		return
@@ -409,20 +367,18 @@ func TestProcessCaps(t *testing.T) {
 	ok(t, err)
 	defer container.Destroy()
 
+	processCaps := append(config.Capabilities, "CAP_NET_ADMIN")
+
 	var stdout bytes.Buffer
 	pconfig := libcontainer.Process{
 		Cwd:          "/",
 		Args:         []string{"sh", "-c", "cat /proc/self/status"},
 		Env:          standardEnvironment,
+		Capabilities: processCaps,
 		Stdin:        nil,
 		Stdout:       &stdout,
-		Capabilities: &configs.Capabilities{},
 	}
-	pconfig.Capabilities.Bounding = append(config.Capabilities.Bounding, "CAP_NET_ADMIN")
-	pconfig.Capabilities.Permitted = append(config.Capabilities.Permitted, "CAP_NET_ADMIN")
-	pconfig.Capabilities.Effective = append(config.Capabilities.Effective, "CAP_NET_ADMIN")
-	pconfig.Capabilities.Inheritable = append(config.Capabilities.Inheritable, "CAP_NET_ADMIN")
-	err = container.Run(&pconfig)
+	err = container.Start(&pconfig)
 	ok(t, err)
 
 	// Wait for process
@@ -475,6 +431,7 @@ func TestAdditionalGroups(t *testing.T) {
 	defer remove(rootfs)
 
 	config := newTemplateConfig(rootfs)
+	config.AdditionalGroups = []string{"plugdev", "audio"}
 
 	factory, err := libcontainer.New(root, libcontainer.Cgroupfs)
 	ok(t, err)
@@ -485,14 +442,13 @@ func TestAdditionalGroups(t *testing.T) {
 
 	var stdout bytes.Buffer
 	pconfig := libcontainer.Process{
-		Cwd:              "/",
-		Args:             []string{"sh", "-c", "id", "-Gn"},
-		Env:              standardEnvironment,
-		Stdin:            nil,
-		Stdout:           &stdout,
-		AdditionalGroups: []string{"plugdev", "audio"},
+		Cwd:    "/",
+		Args:   []string{"sh", "-c", "id", "-Gn"},
+		Env:    standardEnvironment,
+		Stdin:  nil,
+		Stdout: &stdout,
 	}
-	err = container.Run(&pconfig)
+	err = container.Start(&pconfig)
 	ok(t, err)
 
 	// Wait for process
@@ -552,7 +508,7 @@ func testFreeze(t *testing.T, systemd bool) {
 		Env:   standardEnvironment,
 		Stdin: stdinR,
 	}
-	err = container.Run(pconfig)
+	err = container.Start(pconfig)
 	stdinR.Close()
 	defer stdinW.Close()
 	ok(t, err)
@@ -657,7 +613,7 @@ func testPids(t *testing.T, systemd bool) {
 	}
 
 	// Enforce a restrictive limit. 64 * /bin/true + 1 * shell should cause this
-	// to fail reliability.
+	// to fail reliabily.
 	config.Cgroups.Resources.PidsLimit = 64
 	out, _, err := runContainer(config, "", "/bin/sh", "-c", `
 	/bin/true | /bin/true | /bin/true | /bin/true | /bin/true | /bin/true | bin/true | /bin/true |
@@ -763,7 +719,7 @@ func TestContainerState(t *testing.T) {
 		Env:   standardEnvironment,
 		Stdin: stdinR,
 	}
-	err = container.Run(p)
+	err = container.Start(p)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -807,13 +763,7 @@ func TestPassExtraFiles(t *testing.T) {
 
 	var stdout bytes.Buffer
 	pipeout1, pipein1, err := os.Pipe()
-	if err != nil {
-		t.Fatal(err)
-	}
 	pipeout2, pipein2, err := os.Pipe()
-	if err != nil {
-		t.Fatal(err)
-	}
 	process := libcontainer.Process{
 		Cwd:        "/",
 		Args:       []string{"sh", "-c", "cd /proc/$$/fd; echo -n *; echo -n 1 >3; echo -n 2 >4"},
@@ -822,7 +772,7 @@ func TestPassExtraFiles(t *testing.T) {
 		Stdin:      nil,
 		Stdout:     &stdout,
 	}
-	err = container.Run(&process)
+	err = container.Start(&process)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -881,7 +831,7 @@ func TestMountCmds(t *testing.T) {
 		Source:      tmpDir,
 		Destination: "/tmp",
 		Device:      "bind",
-		Flags:       unix.MS_BIND | unix.MS_REC,
+		Flags:       syscall.MS_BIND | syscall.MS_REC,
 		PremountCmds: []configs.Command{
 			{Path: "touch", Args: []string{filepath.Join(tmpDir, "hello")}},
 			{Path: "touch", Args: []string{filepath.Join(tmpDir, "world")}},
@@ -903,7 +853,7 @@ func TestMountCmds(t *testing.T) {
 		Args: []string{"sh", "-c", "env"},
 		Env:  standardEnvironment,
 	}
-	err = container.Run(&pconfig)
+	err = container.Start(&pconfig)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -952,7 +902,7 @@ func TestSysctl(t *testing.T) {
 		Stdin:  nil,
 		Stdout: &stdout,
 	}
-	err = container.Run(&pconfig)
+	err = container.Start(&pconfig)
 	ok(t, err)
 
 	// Wait for process
@@ -976,7 +926,7 @@ func TestMountCgroupRO(t *testing.T) {
 	config.Mounts = append(config.Mounts, &configs.Mount{
 		Destination: "/sys/fs/cgroup",
 		Device:      "cgroup",
-		Flags:       defaultMountFlags | unix.MS_RDONLY,
+		Flags:       defaultMountFlags | syscall.MS_RDONLY,
 	})
 
 	buffers, exitCode, err := runContainer(config, "", "mount")
@@ -1092,7 +1042,7 @@ func TestOomScoreAdj(t *testing.T) {
 		Stdin:  nil,
 		Stdout: &stdout,
 	}
-	err = container.Run(&pconfig)
+	err = container.Start(&pconfig)
 	ok(t, err)
 
 	// Wait for process
@@ -1109,44 +1059,25 @@ func TestHook(t *testing.T) {
 	if testing.Short() {
 		return
 	}
-
-	bundle, err := newTestBundle()
+	root, err := newTestRoot()
 	ok(t, err)
-	defer remove(bundle)
+	defer os.RemoveAll(root)
 
 	rootfs, err := newRootfs()
 	ok(t, err)
 	defer remove(rootfs)
 
 	config := newTemplateConfig(rootfs)
-	expectedBundle := bundle
-	config.Labels = append(config.Labels, fmt.Sprintf("bundle=%s", expectedBundle))
-
-	getRootfsFromBundle := func(bundle string) (string, error) {
-		f, err := os.Open(filepath.Join(bundle, "config.json"))
-		if err != nil {
-			return "", err
-		}
-
-		var config configs.Config
-		if err = json.NewDecoder(f).Decode(&config); err != nil {
-			return "", err
-		}
-		return config.Rootfs, nil
-	}
-
+	expectedBundlePath := "/path/to/bundle/path"
+	config.Labels = append(config.Labels, fmt.Sprintf("bundle=%s", expectedBundlePath))
 	config.Hooks = &configs.Hooks{
 		Prestart: []configs.Hook{
 			configs.NewFunctionHook(func(s configs.HookState) error {
-				if s.Bundle != expectedBundle {
-					t.Fatalf("Expected prestart hook bundlePath '%s'; got '%s'", expectedBundle, s.Bundle)
+				if s.BundlePath != expectedBundlePath {
+					t.Fatalf("Expected prestart hook bundlePath '%s'; got '%s'", expectedBundlePath, s.BundlePath)
 				}
 
-				root, err := getRootfsFromBundle(s.Bundle)
-				if err != nil {
-					return err
-				}
-				f, err := os.Create(filepath.Join(root, "test"))
+				f, err := os.Create(filepath.Join(s.Root, "test"))
 				if err != nil {
 					return err
 				}
@@ -1155,37 +1086,23 @@ func TestHook(t *testing.T) {
 		},
 		Poststart: []configs.Hook{
 			configs.NewFunctionHook(func(s configs.HookState) error {
-				if s.Bundle != expectedBundle {
-					t.Fatalf("Expected poststart hook bundlePath '%s'; got '%s'", expectedBundle, s.Bundle)
+				if s.BundlePath != expectedBundlePath {
+					t.Fatalf("Expected poststart hook bundlePath '%s'; got '%s'", expectedBundlePath, s.BundlePath)
 				}
 
-				root, err := getRootfsFromBundle(s.Bundle)
-				if err != nil {
-					return err
-				}
-				return ioutil.WriteFile(filepath.Join(root, "test"), []byte("hello world"), 0755)
+				return ioutil.WriteFile(filepath.Join(s.Root, "test"), []byte("hello world"), 0755)
 			}),
 		},
 		Poststop: []configs.Hook{
 			configs.NewFunctionHook(func(s configs.HookState) error {
-				if s.Bundle != expectedBundle {
-					t.Fatalf("Expected poststop hook bundlePath '%s'; got '%s'", expectedBundle, s.Bundle)
+				if s.BundlePath != expectedBundlePath {
+					t.Fatalf("Expected poststop hook bundlePath '%s'; got '%s'", expectedBundlePath, s.BundlePath)
 				}
 
-				root, err := getRootfsFromBundle(s.Bundle)
-				if err != nil {
-					return err
-				}
-				return os.RemoveAll(filepath.Join(root, "test"))
+				return os.RemoveAll(filepath.Join(s.Root, "test"))
 			}),
 		},
 	}
-
-	// write config of json format into config.json under bundle
-	f, err := os.OpenFile(filepath.Join(bundle, "config.json"), os.O_CREATE|os.O_RDWR, 0644)
-	ok(t, err)
-	ok(t, json.NewEncoder(f).Encode(config))
-
 	container, err := factory.Create("test", config)
 	ok(t, err)
 
@@ -1197,7 +1114,7 @@ func TestHook(t *testing.T) {
 		Stdin:  nil,
 		Stdout: &stdout,
 	}
-	err = container.Run(&pconfig)
+	err = container.Start(&pconfig)
 	ok(t, err)
 
 	// Wait for process
@@ -1222,7 +1139,7 @@ func TestHook(t *testing.T) {
 	}
 
 	if err := container.Destroy(); err != nil {
-		t.Fatalf("container destroy %s", err)
+		t.Fatalf("container destory %s", err)
 	}
 	fi, err := os.Stat(filepath.Join(rootfs, "test"))
 	if err == nil || !os.IsNotExist(err) {
@@ -1251,7 +1168,7 @@ func TestSTDIOPermissions(t *testing.T) {
 }
 
 func unmountOp(path string) error {
-	if err := unix.Unmount(path, unix.MNT_DETACH); err != nil {
+	if err := syscall.Unmount(path, syscall.MNT_DETACH); err != nil {
 		return err
 	}
 	return nil
@@ -1276,7 +1193,7 @@ func TestRootfsPropagationSlaveMount(t *testing.T) {
 	defer remove(rootfs)
 	config := newTemplateConfig(rootfs)
 
-	config.RootPropagation = unix.MS_SLAVE | unix.MS_REC
+	config.RootPropagation = syscall.MS_SLAVE | syscall.MS_REC
 
 	// Bind mount a volume
 	dir1host, err := ioutil.TempDir("", "mnt1host")
@@ -1285,9 +1202,9 @@ func TestRootfsPropagationSlaveMount(t *testing.T) {
 
 	// Make this dir a "shared" mount point. This will make sure a
 	// slave relationship can be established in container.
-	err = unix.Mount(dir1host, dir1host, "bind", unix.MS_BIND|unix.MS_REC, "")
+	err = syscall.Mount(dir1host, dir1host, "bind", syscall.MS_BIND|syscall.MS_REC, "")
 	ok(t, err)
-	err = unix.Mount("", dir1host, "", unix.MS_SHARED|unix.MS_REC, "")
+	err = syscall.Mount("", dir1host, "", syscall.MS_SHARED|syscall.MS_REC, "")
 	ok(t, err)
 	defer unmountOp(dir1host)
 
@@ -1295,7 +1212,7 @@ func TestRootfsPropagationSlaveMount(t *testing.T) {
 		Source:      dir1host,
 		Destination: dir1cont,
 		Device:      "bind",
-		Flags:       unix.MS_BIND | unix.MS_REC})
+		Flags:       syscall.MS_BIND | syscall.MS_REC})
 
 	// TODO: systemd specific processing
 	f := factory
@@ -1314,7 +1231,7 @@ func TestRootfsPropagationSlaveMount(t *testing.T) {
 		Stdin: stdinR,
 	}
 
-	err = container.Run(pconfig)
+	err = container.Start(pconfig)
 	stdinR.Close()
 	defer stdinW.Close()
 	ok(t, err)
@@ -1325,7 +1242,7 @@ func TestRootfsPropagationSlaveMount(t *testing.T) {
 	ok(t, err)
 	defer os.RemoveAll(dir2host)
 
-	err = unix.Mount(dir2host, dir2host, "bind", unix.MS_BIND, "")
+	err = syscall.Mount(dir2host, dir2host, "bind", syscall.MS_BIND, "")
 	defer unmountOp(dir2host)
 	ok(t, err)
 
@@ -1343,7 +1260,7 @@ func TestRootfsPropagationSlaveMount(t *testing.T) {
 		Stdout: &stdout2,
 	}
 
-	err = container.Run(pconfig2)
+	err = container.Start(pconfig2)
 	stdinR2.Close()
 	defer stdinW2.Close()
 	ok(t, err)
@@ -1393,7 +1310,7 @@ func TestRootfsPropagationSharedMount(t *testing.T) {
 	ok(t, err)
 	defer remove(rootfs)
 	config := newTemplateConfig(rootfs)
-	config.RootPropagation = unix.MS_PRIVATE
+	config.RootPropagation = syscall.MS_PRIVATE
 
 	// Bind mount a volume
 	dir1host, err := ioutil.TempDir("", "mnt1host")
@@ -1402,9 +1319,9 @@ func TestRootfsPropagationSharedMount(t *testing.T) {
 
 	// Make this dir a "shared" mount point. This will make sure a
 	// shared relationship can be established in container.
-	err = unix.Mount(dir1host, dir1host, "bind", unix.MS_BIND|unix.MS_REC, "")
+	err = syscall.Mount(dir1host, dir1host, "bind", syscall.MS_BIND|syscall.MS_REC, "")
 	ok(t, err)
-	err = unix.Mount("", dir1host, "", unix.MS_SHARED|unix.MS_REC, "")
+	err = syscall.Mount("", dir1host, "", syscall.MS_SHARED|syscall.MS_REC, "")
 	ok(t, err)
 	defer unmountOp(dir1host)
 
@@ -1412,7 +1329,7 @@ func TestRootfsPropagationSharedMount(t *testing.T) {
 		Source:      dir1host,
 		Destination: dir1cont,
 		Device:      "bind",
-		Flags:       unix.MS_BIND | unix.MS_REC})
+		Flags:       syscall.MS_BIND | syscall.MS_REC})
 
 	// TODO: systemd specific processing
 	f := factory
@@ -1431,7 +1348,7 @@ func TestRootfsPropagationSharedMount(t *testing.T) {
 		Stdin: stdinR,
 	}
 
-	err = container.Run(pconfig)
+	err = container.Start(pconfig)
 	stdinR.Close()
 	defer stdinW.Close()
 	ok(t, err)
@@ -1451,22 +1368,19 @@ func TestRootfsPropagationSharedMount(t *testing.T) {
 	stdinR2, stdinW2, err := os.Pipe()
 	ok(t, err)
 
+	// Provide CAP_SYS_ADMIN
+	processCaps := append(config.Capabilities, "CAP_SYS_ADMIN")
+
 	pconfig2 := &libcontainer.Process{
 		Cwd:          "/",
 		Args:         []string{"mount", "--bind", dir2cont, dir2cont},
 		Env:          standardEnvironment,
 		Stdin:        stdinR2,
 		Stdout:       &stdout2,
-		Capabilities: &configs.Capabilities{},
+		Capabilities: processCaps,
 	}
 
-	// Provide CAP_SYS_ADMIN
-	pconfig2.Capabilities.Bounding = append(config.Capabilities.Bounding, "CAP_SYS_ADMIN")
-	pconfig2.Capabilities.Permitted = append(config.Capabilities.Permitted, "CAP_SYS_ADMIN")
-	pconfig2.Capabilities.Effective = append(config.Capabilities.Effective, "CAP_SYS_ADMIN")
-	pconfig2.Capabilities.Inheritable = append(config.Capabilities.Inheritable, "CAP_SYS_ADMIN")
-
-	err = container.Run(pconfig2)
+	err = container.Start(pconfig2)
 	stdinR2.Close()
 	defer stdinW2.Close()
 	ok(t, err)
@@ -1538,7 +1452,7 @@ func TestInitJoinPID(t *testing.T) {
 		Env:   standardEnvironment,
 		Stdin: stdinR1,
 	}
-	err = container1.Run(init1)
+	err = container1.Start(init1)
 	stdinR1.Close()
 	defer stdinW1.Close()
 	ok(t, err)
@@ -1548,7 +1462,7 @@ func TestInitJoinPID(t *testing.T) {
 	ok(t, err)
 	pidns1 := state1.NamespacePaths[configs.NEWPID]
 
-	// Run a container inside the existing pidns but with different cgroups
+	// Start a container inside the existing pidns but with different cgroups
 	config2 := newTemplateConfig(rootfs)
 	config2.Namespaces.Add(configs.NEWPID, pidns1)
 	config2.Cgroups.Path = "integration/test2"
@@ -1564,7 +1478,7 @@ func TestInitJoinPID(t *testing.T) {
 		Env:   standardEnvironment,
 		Stdin: stdinR2,
 	}
-	err = container2.Run(init2)
+	err = container2.Start(init2)
 	stdinR2.Close()
 	defer stdinW2.Close()
 	ok(t, err)
@@ -1594,7 +1508,7 @@ func TestInitJoinPID(t *testing.T) {
 		Env:    standardEnvironment,
 		Stdout: buffers.Stdout,
 	}
-	err = container1.Run(ps)
+	err = container1.Start(ps)
 	ok(t, err)
 	waitProcess(ps, t)
 
@@ -1628,8 +1542,8 @@ func TestInitJoinNetworkAndUser(t *testing.T) {
 
 	// Execute a long-running container
 	config1 := newTemplateConfig(rootfs)
-	config1.UidMappings = []configs.IDMap{{HostID: 0, ContainerID: 0, Size: 1000}}
-	config1.GidMappings = []configs.IDMap{{HostID: 0, ContainerID: 0, Size: 1000}}
+	config1.UidMappings = []configs.IDMap{{0, 0, 1000}}
+	config1.GidMappings = []configs.IDMap{{0, 0, 1000}}
 	config1.Namespaces = append(config1.Namespaces, configs.Namespace{Type: configs.NEWUSER})
 	container1, err := newContainer(config1)
 	ok(t, err)
@@ -1643,7 +1557,7 @@ func TestInitJoinNetworkAndUser(t *testing.T) {
 		Env:   standardEnvironment,
 		Stdin: stdinR1,
 	}
-	err = container1.Run(init1)
+	err = container1.Start(init1)
 	stdinR1.Close()
 	defer stdinW1.Close()
 	ok(t, err)
@@ -1654,14 +1568,14 @@ func TestInitJoinNetworkAndUser(t *testing.T) {
 	netns1 := state1.NamespacePaths[configs.NEWNET]
 	userns1 := state1.NamespacePaths[configs.NEWUSER]
 
-	// Run a container inside the existing pidns but with different cgroups
+	// Start a container inside the existing pidns but with different cgroups
 	rootfs2, err := newRootfs()
 	ok(t, err)
 	defer remove(rootfs2)
 
 	config2 := newTemplateConfig(rootfs2)
-	config2.UidMappings = []configs.IDMap{{HostID: 0, ContainerID: 0, Size: 1000}}
-	config2.GidMappings = []configs.IDMap{{HostID: 0, ContainerID: 0, Size: 1000}}
+	config2.UidMappings = []configs.IDMap{{0, 0, 1000}}
+	config2.GidMappings = []configs.IDMap{{0, 0, 1000}}
 	config2.Namespaces.Add(configs.NEWNET, netns1)
 	config2.Namespaces.Add(configs.NEWUSER, userns1)
 	config2.Cgroups.Path = "integration/test2"
@@ -1677,7 +1591,7 @@ func TestInitJoinNetworkAndUser(t *testing.T) {
 		Env:   standardEnvironment,
 		Stdin: stdinR2,
 	}
-	err = container2.Run(init2)
+	err = container2.Start(init2)
 	stdinR2.Close()
 	defer stdinW2.Close()
 	ok(t, err)
@@ -1708,52 +1622,3 @@ func TestInitJoinNetworkAndUser(t *testing.T) {
 	stdinW1.Close()
 	waitProcess(init1, t)
 }
-
-func TestTmpfsCopyUp(t *testing.T) {
-	if testing.Short() {
-		return
-	}
-	root, err := newTestRoot()
-	ok(t, err)
-	defer os.RemoveAll(root)
-
-	rootfs, err := newRootfs()
-	ok(t, err)
-	defer remove(rootfs)
-
-	config := newTemplateConfig(rootfs)
-
-	config.Mounts = append(config.Mounts, &configs.Mount{
-		Source:      "tmpfs",
-		Destination: "/etc",
-		Device:      "tmpfs",
-		Extensions:  configs.EXT_COPYUP,
-	})
-
-	factory, err := libcontainer.New(root, libcontainer.Cgroupfs)
-	ok(t, err)
-
-	container, err := factory.Create("test", config)
-	ok(t, err)
-	defer container.Destroy()
-
-	var stdout bytes.Buffer
-	pconfig := libcontainer.Process{
-		Args:   []string{"ls", "/etc/passwd"},
-		Env:    standardEnvironment,
-		Stdin:  nil,
-		Stdout: &stdout,
-	}
-	err = container.Run(&pconfig)
-	ok(t, err)
-
-	// Wait for process
-	waitProcess(&pconfig, t)
-
-	outputLs := string(stdout.Bytes())
-
-	// Check that the ls output has /etc/passwd
-	if !strings.Contains(outputLs, "/etc/passwd") {
-		t.Fatalf("/etc/passwd not copied up as expected: %v", outputLs)
-	}
-}

vendor/github.com/opencontainers/runc/libcontainer/integration/execin_test.go

@@ -7,14 +7,12 @@ import (
 	"os"
 	"strconv"
 	"strings"
+	"syscall"
 	"testing"
 	"time"
 
 	"github.com/opencontainers/runc/libcontainer"
 	"github.com/opencontainers/runc/libcontainer/configs"
-	"github.com/opencontainers/runc/libcontainer/utils"
-
-	"golang.org/x/sys/unix"
 )
 
 func TestExecIn(t *testing.T) {
@@ -38,7 +36,7 @@ func TestExecIn(t *testing.T) {
 		Env:   standardEnvironment,
 		Stdin: stdinR,
 	}
-	err = container.Run(process)
+	err = container.Start(process)
 	stdinR.Close()
 	defer stdinW.Close()
 	ok(t, err)
@@ -53,7 +51,7 @@ func TestExecIn(t *testing.T) {
 		Stderr: buffers.Stderr,
 	}
 
-	err = container.Run(ps)
+	err = container.Start(ps)
 	ok(t, err)
 	waitProcess(ps, t)
 	stdinW.Close()
@@ -63,9 +61,6 @@ func TestExecIn(t *testing.T) {
 	if !strings.Contains(out, "cat") || !strings.Contains(out, "ps") {
 		t.Fatalf("unexpected running process, output %q", out)
 	}
-	if strings.Contains(out, "\r") {
-		t.Fatalf("unexpected carriage-return in output")
-	}
 }
 
 func TestExecInUsernsRlimit(t *testing.T) {
@@ -91,8 +86,8 @@ func testExecInRlimit(t *testing.T, userns bool) {
 
 	config := newTemplateConfig(rootfs)
 	if userns {
-		config.UidMappings = []configs.IDMap{{HostID: 0, ContainerID: 0, Size: 1000}}
-		config.GidMappings = []configs.IDMap{{HostID: 0, ContainerID: 0, Size: 1000}}
+		config.UidMappings = []configs.IDMap{{0, 0, 1000}}
+		config.GidMappings = []configs.IDMap{{0, 0, 1000}}
 		config.Namespaces = append(config.Namespaces, configs.Namespace{Type: configs.NEWUSER})
 	}
 
@@ -108,7 +103,7 @@ func testExecInRlimit(t *testing.T, userns bool) {
 		Env:   standardEnvironment,
 		Stdin: stdinR,
 	}
-	err = container.Run(process)
+	err = container.Start(process)
 	stdinR.Close()
 	defer stdinW.Close()
 	ok(t, err)
@@ -123,10 +118,10 @@ func testExecInRlimit(t *testing.T, userns bool) {
 		Stderr: buffers.Stderr,
 		Rlimits: []configs.Rlimit{
 			// increase process rlimit higher than container rlimit to test per-process limit
-			{Type: unix.RLIMIT_NOFILE, Hard: 1026, Soft: 1026},
+			{Type: syscall.RLIMIT_NOFILE, Hard: 1026, Soft: 1026},
 		},
 	}
-	err = container.Run(ps)
+	err = container.Start(ps)
 	ok(t, err)
 	waitProcess(ps, t)
 
@@ -139,64 +134,6 @@ func testExecInRlimit(t *testing.T, userns bool) {
 	}
 }
 
-func TestExecInAdditionalGroups(t *testing.T) {
-	if testing.Short() {
-		return
-	}
-
-	rootfs, err := newRootfs()
-	ok(t, err)
-	defer remove(rootfs)
-
-	config := newTemplateConfig(rootfs)
-	container, err := newContainer(config)
-	ok(t, err)
-	defer container.Destroy()
-
-	// Execute a first process in the container
-	stdinR, stdinW, err := os.Pipe()
-	ok(t, err)
-	process := &libcontainer.Process{
-		Cwd:   "/",
-		Args:  []string{"cat"},
-		Env:   standardEnvironment,
-		Stdin: stdinR,
-	}
-	err = container.Run(process)
-	stdinR.Close()
-	defer stdinW.Close()
-	ok(t, err)
-
-	var stdout bytes.Buffer
-	pconfig := libcontainer.Process{
-		Cwd:              "/",
-		Args:             []string{"sh", "-c", "id", "-Gn"},
-		Env:              standardEnvironment,
-		Stdin:            nil,
-		Stdout:           &stdout,
-		AdditionalGroups: []string{"plugdev", "audio"},
-	}
-	err = container.Run(&pconfig)
-	ok(t, err)
-
-	// Wait for process
-	waitProcess(&pconfig, t)
-
-	stdinW.Close()
-	waitProcess(process, t)
-
-	outputGroups := string(stdout.Bytes())
-
-	// Check that the groups output has the groups that we specified
-	if !strings.Contains(outputGroups, "audio") {
-		t.Fatalf("Listed groups do not contain the audio group as expected: %v", outputGroups)
-	}
-
-	if !strings.Contains(outputGroups, "plugdev") {
-		t.Fatalf("Listed groups do not contain the plugdev group as expected: %v", outputGroups)
-	}
-}
-
 func TestExecInError(t *testing.T) {
 	if testing.Short() {
 		return
@@ -218,7 +155,7 @@ func TestExecInError(t *testing.T) {
 		Env:   standardEnvironment,
 		Stdin: stdinR,
 	}
-	err = container.Run(process)
+	err = container.Start(process)
 	stdinR.Close()
 	defer func() {
 		stdinW.Close()
@@ -234,9 +171,9 @@ func TestExecInError(t *testing.T) {
 			Cwd:    "/",
 			Args:   []string{"unexistent"},
 			Env:    standardEnvironment,
-			Stderr: &out,
+			Stdout: &out,
 		}
-		err = container.Run(unexistent)
+		err = container.Start(unexistent)
 		if err == nil {
 			t.Fatal("Should be an error")
 		}
@@ -270,7 +207,7 @@ func TestExecInTTY(t *testing.T) {
 		Env:   standardEnvironment,
 		Stdin: stdinR,
 	}
-	err = container.Run(process)
+	err = container.Start(process)
 	stdinR.Close()
 	defer stdinW.Close()
 	ok(t, err)
@@ -281,43 +218,15 @@ func TestExecInTTY(t *testing.T) {
 		Args: []string{"ps"},
 		Env:  standardEnvironment,
 	}
-	parent, child, err := utils.NewSockPair("console")
-	if err != nil {
-		ok(t, err)
-	}
-	defer parent.Close()
-	defer child.Close()
-	ps.ConsoleSocket = child
-	type cdata struct {
-		c   libcontainer.Console
-		err error
-	}
-	dc := make(chan *cdata, 1)
-	go func() {
-		f, err := utils.RecvFd(parent)
-		if err != nil {
-			dc <- &cdata{
-				err: err,
-			}
-		}
-		libcontainer.SaneTerminal(f)
-		dc <- &cdata{
-			c: libcontainer.ConsoleFromFile(f),
-		}
-	}()
-	err = container.Run(ps)
-	ok(t, err)
-	data := <-dc
-	if data.err != nil {
-		ok(t, data.err)
-	}
-	console := data.c
+	console, err := ps.NewConsole(0)
 	copy := make(chan struct{})
 	go func() {
 		io.Copy(&stdout, console)
 		close(copy)
 	}()
 	ok(t, err)
+	err = container.Start(ps)
+	ok(t, err)
 	select {
 	case <-time.After(5 * time.Second):
 		t.Fatal("Waiting for copy timed out")
@@ -329,12 +238,9 @@ func TestExecInTTY(t *testing.T) {
 	waitProcess(process, t)
 
 	out := stdout.String()
-	if !strings.Contains(out, "cat") || !strings.Contains(out, "ps") {
+	if !strings.Contains(out, "cat") || !strings.Contains(string(out), "ps") {
 		t.Fatalf("unexpected running process, output %q", out)
 	}
-	if strings.Contains(out, "\r") {
-		t.Fatalf("unexpected carriage-return in output")
-	}
 }
 
 func TestExecInEnvironment(t *testing.T) {
@@ -358,7 +264,7 @@ func TestExecInEnvironment(t *testing.T) {
 		Env:   standardEnvironment,
 		Stdin: stdinR,
 	}
-	err = container.Run(process)
+	err = container.Start(process)
 	stdinR.Close()
 	defer stdinW.Close()
 	ok(t, err)
@@ -377,7 +283,7 @@ func TestExecInEnvironment(t *testing.T) {
 		Stdout: buffers.Stdout,
 		Stderr: buffers.Stderr,
 	}
-	err = container.Run(process2)
+	err = container.Start(process2)
 	ok(t, err)
 	waitProcess(process2, t)
 
@@ -422,7 +328,7 @@ func TestExecinPassExtraFiles(t *testing.T) {
 		Env:   standardEnvironment,
 		Stdin: stdinR,
 	}
-	err = container.Run(process)
+	err = container.Start(process)
 	stdinR.Close()
 	defer stdinW.Close()
 	if err != nil {
@@ -431,13 +337,7 @@ func TestExecinPassExtraFiles(t *testing.T) {
 
 	var stdout bytes.Buffer
 	pipeout1, pipein1, err := os.Pipe()
-	if err != nil {
-		t.Fatal(err)
-	}
 	pipeout2, pipein2, err := os.Pipe()
-	if err != nil {
-		t.Fatal(err)
-	}
 	inprocess := &libcontainer.Process{
 		Cwd:        "/",
 		Args:       []string{"sh", "-c", "cd /proc/$$/fd; echo -n *; echo -n 1 >3; echo -n 2 >4"},
@@ -446,7 +346,7 @@ func TestExecinPassExtraFiles(t *testing.T) {
 		Stdin:      nil,
 		Stdout:     &stdout,
 	}
-	err = container.Run(inprocess)
+	err = container.Start(inprocess)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -501,7 +401,7 @@ func TestExecInOomScoreAdj(t *testing.T) {
 		Env:   standardEnvironment,
 		Stdin: stdinR,
 	}
-	err = container.Run(process)
+	err = container.Start(process)
 	stdinR.Close()
 	defer stdinW.Close()
 	ok(t, err)
@@ -515,7 +415,7 @@ func TestExecInOomScoreAdj(t *testing.T) {
 		Stdout: buffers.Stdout,
 		Stderr: buffers.Stderr,
 	}
-	err = container.Run(ps)
+	err = container.Start(ps)
 	ok(t, err)
 	waitProcess(ps, t)
 
@@ -539,8 +439,8 @@ func TestExecInUserns(t *testing.T) {
 	ok(t, err)
 	defer remove(rootfs)
 	config := newTemplateConfig(rootfs)
-	config.UidMappings = []configs.IDMap{{HostID: 0, ContainerID: 0, Size: 1000}}
-	config.GidMappings = []configs.IDMap{{HostID: 0, ContainerID: 0, Size: 1000}}
+	config.UidMappings = []configs.IDMap{{0, 0, 1000}}
+	config.GidMappings = []configs.IDMap{{0, 0, 1000}}
 	config.Namespaces = append(config.Namespaces, configs.Namespace{Type: configs.NEWUSER})
 	container, err := newContainer(config)
 	ok(t, err)
@@ -556,7 +456,7 @@ func TestExecInUserns(t *testing.T) {
 		Env:   standardEnvironment,
 		Stdin: stdinR,
 	}
-	err = container.Run(process)
+	err = container.Start(process)
 	stdinR.Close()
 	defer stdinW.Close()
 	ok(t, err)
@@ -576,7 +476,7 @@ func TestExecInUserns(t *testing.T) {
 		Stdout: buffers.Stdout,
 		Stderr: os.Stderr,
 	}
-	err = container.Run(process2)
+	err = container.Start(process2)
 	ok(t, err)
 	waitProcess(process2, t)
 	stdinW.Close()

vendor/github.com/opencontainers/runc/libcontainer/integration/init_test.go

@@ -5,11 +5,10 @@ import (
 	"runtime"
 	"testing"
 
+	"github.com/Sirupsen/logrus"
 	"github.com/opencontainers/runc/libcontainer"
 	"github.com/opencontainers/runc/libcontainer/cgroups/systemd"
 	_ "github.com/opencontainers/runc/libcontainer/nsenter"
-
-	"github.com/sirupsen/logrus"
 )
 
 // init runs the libcontainer initialization code because of the busybox style needs
@@ -37,19 +36,19 @@ var (
 func TestMain(m *testing.M) {
 	var (
 		err error
-		ret int
+		ret int = 0
 	)
 
 	logrus.SetOutput(os.Stderr)
 	logrus.SetLevel(logrus.InfoLevel)
 
-	factory, err = libcontainer.New("/run/libctTests", libcontainer.Cgroupfs)
+	factory, err = libcontainer.New(".", libcontainer.Cgroupfs)
 	if err != nil {
 		logrus.Error(err)
 		os.Exit(1)
 	}
 	if systemd.UseSystemd() {
-		systemdFactory, err = libcontainer.New("/run/libctTests", libcontainer.SystemdCgroups)
+		systemdFactory, err = libcontainer.New(".", libcontainer.SystemdCgroups)
 		if err != nil {
 			logrus.Error(err)
 			os.Exit(1)

vendor/github.com/opencontainers/runc/libcontainer/integration/seccomp_test.go

@@ -50,7 +50,7 @@ func TestSeccompDenyGetcwd(t *testing.T) {
 		Stderr: buffers.Stderr,
 	}
 
-	err = container.Run(pwd)
+	err = container.Start(pwd)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -101,8 +101,8 @@ func TestSeccompPermitWriteConditional(t *testing.T) {
 				Args: []*configs.Arg{
 					{
 						Index: 0,
-						Value: 2,
-						Op:    configs.EqualTo,
+						Value: 1,
+						Op:    configs.GreaterThan,
 					},
 				},
 			},
@@ -125,7 +125,7 @@ func TestSeccompPermitWriteConditional(t *testing.T) {
 		Stderr: buffers.Stderr,
 	}
 
-	err = container.Run(dmesg)
+	err = container.Start(dmesg)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -162,8 +162,8 @@ func TestSeccompDenyWriteConditional(t *testing.T) {
 				Args: []*configs.Arg{
 					{
 						Index: 0,
-						Value: 2,
-						Op:    configs.EqualTo,
+						Value: 1,
+						Op:    configs.GreaterThan,
 					},
 				},
 			},
@@ -186,7 +186,7 @@ func TestSeccompDenyWriteConditional(t *testing.T) {
 		Stderr: buffers.Stderr,
 	}
 
-	err = container.Run(dmesg)
+	err = container.Start(dmesg)
 	if err != nil {
 		t.Fatal(err)
 	}

vendor/github.com/opencontainers/runc/libcontainer/integration/template_test.go

@@ -1,9 +1,9 @@
 package integration
 
 import (
-	"github.com/opencontainers/runc/libcontainer/configs"
+	"syscall"
 
-	"golang.org/x/sys/unix"
+	"github.com/opencontainers/runc/libcontainer/configs"
 )
 
 var standardEnvironment = []string{
@@ -13,97 +13,30 @@ var standardEnvironment = []string{
 	"TERM=xterm",
 }
 
-const defaultMountFlags = unix.MS_NOEXEC | unix.MS_NOSUID | unix.MS_NODEV
+const defaultMountFlags = syscall.MS_NOEXEC | syscall.MS_NOSUID | syscall.MS_NODEV
 
 // newTemplateConfig returns a base template for running a container
 //
 // it uses a network strategy of just setting a loopback interface
 // and the default setup for devices
 func newTemplateConfig(rootfs string) *configs.Config {
-	allowAllDevices := false
 	return &configs.Config{
 		Rootfs: rootfs,
-		Capabilities: &configs.Capabilities{
-			Bounding: []string{
-				"CAP_CHOWN",
-				"CAP_DAC_OVERRIDE",
-				"CAP_FSETID",
-				"CAP_FOWNER",
-				"CAP_MKNOD",
-				"CAP_NET_RAW",
-				"CAP_SETGID",
-				"CAP_SETUID",
-				"CAP_SETFCAP",
-				"CAP_SETPCAP",
-				"CAP_NET_BIND_SERVICE",
-				"CAP_SYS_CHROOT",
-				"CAP_KILL",
-				"CAP_AUDIT_WRITE",
-			},
-			Permitted: []string{
-				"CAP_CHOWN",
-				"CAP_DAC_OVERRIDE",
-				"CAP_FSETID",
-				"CAP_FOWNER",
-				"CAP_MKNOD",
-				"CAP_NET_RAW",
-				"CAP_SETGID",
-				"CAP_SETUID",
-				"CAP_SETFCAP",
-				"CAP_SETPCAP",
-				"CAP_NET_BIND_SERVICE",
-				"CAP_SYS_CHROOT",
-				"CAP_KILL",
-				"CAP_AUDIT_WRITE",
-			},
-			Inheritable: []string{
-				"CAP_CHOWN",
-				"CAP_DAC_OVERRIDE",
-				"CAP_FSETID",
-				"CAP_FOWNER",
-				"CAP_MKNOD",
-				"CAP_NET_RAW",
-				"CAP_SETGID",
-				"CAP_SETUID",
-				"CAP_SETFCAP",
-				"CAP_SETPCAP",
-				"CAP_NET_BIND_SERVICE",
-				"CAP_SYS_CHROOT",
-				"CAP_KILL",
-				"CAP_AUDIT_WRITE",
-			},
-			Ambient: []string{
-				"CAP_CHOWN",
-				"CAP_DAC_OVERRIDE",
-				"CAP_FSETID",
-				"CAP_FOWNER",
-				"CAP_MKNOD",
-				"CAP_NET_RAW",
-				"CAP_SETGID",
-				"CAP_SETUID",
-				"CAP_SETFCAP",
-				"CAP_SETPCAP",
-				"CAP_NET_BIND_SERVICE",
-				"CAP_SYS_CHROOT",
-				"CAP_KILL",
-				"CAP_AUDIT_WRITE",
-			},
-			Effective: []string{
-				"CAP_CHOWN",
-				"CAP_DAC_OVERRIDE",
-				"CAP_FSETID",
-				"CAP_FOWNER",
-				"CAP_MKNOD",
-				"CAP_NET_RAW",
-				"CAP_SETGID",
-				"CAP_SETUID",
-				"CAP_SETFCAP",
-				"CAP_SETPCAP",
-				"CAP_NET_BIND_SERVICE",
-				"CAP_SYS_CHROOT",
-				"CAP_KILL",
-				"CAP_AUDIT_WRITE",
-			},
+		Capabilities: []string{
+			"CAP_CHOWN",
+			"CAP_DAC_OVERRIDE",
+			"CAP_FSETID",
+			"CAP_FOWNER",
+			"CAP_MKNOD",
+			"CAP_NET_RAW",
+			"CAP_SETGID",
+			"CAP_SETUID",
+			"CAP_SETFCAP",
+			"CAP_SETPCAP",
+			"CAP_NET_BIND_SERVICE",
+			"CAP_SYS_CHROOT",
+			"CAP_KILL",
+			"CAP_AUDIT_WRITE",
 		},
 		Namespaces: configs.Namespaces([]configs.Namespace{
 			{Type: configs.NEWNS},
@@ -116,13 +49,12 @@ func newTemplateConfig(rootfs string) *configs.Config {
 			Path: "integration/test",
 			Resources: &configs.Resources{
 				MemorySwappiness: nil,
-				AllowAllDevices:  &allowAllDevices,
+				AllowAllDevices:  false,
 				AllowedDevices:   configs.DefaultAllowedDevices,
 			},
 		},
 		MaskPaths: []string{
 			"/proc/kcore",
-			"/sys/firmware",
 		},
 		ReadonlyPaths: []string{
 			"/proc/sys", "/proc/sysrq-trigger", "/proc/irq", "/proc/bus",
@@ -140,14 +72,14 @@ func newTemplateConfig(rootfs string) *configs.Config {
 				Source:      "tmpfs",
 				Destination: "/dev",
 				Device:      "tmpfs",
-				Flags:       unix.MS_NOSUID | unix.MS_STRICTATIME,
+				Flags:       syscall.MS_NOSUID | syscall.MS_STRICTATIME,
 				Data:        "mode=755",
 			},
 			{
 				Source:      "devpts",
 				Destination: "/dev/pts",
 				Device:      "devpts",
-				Flags:       unix.MS_NOSUID | unix.MS_NOEXEC,
+				Flags:       syscall.MS_NOSUID | syscall.MS_NOEXEC,
 				Data:        "newinstance,ptmxmode=0666,mode=0620,gid=5",
 			},
 			{
@@ -157,20 +89,17 @@ func newTemplateConfig(rootfs string) *configs.Config {
 				Data:        "mode=1777,size=65536k",
 				Flags:       defaultMountFlags,
 			},
-			/*
-				            CI is broken on the debian based kernels with this
-							{
-								Source:      "mqueue",
-								Destination: "/dev/mqueue",
-								Device:      "mqueue",
-								Flags:       defaultMountFlags,
-							},
-			*/
+			{
+				Source:      "mqueue",
+				Destination: "/dev/mqueue",
+				Device:      "mqueue",
+				Flags:       defaultMountFlags,
+			},
 			{
 				Source:      "sysfs",
 				Destination: "/sys",
 				Device:      "sysfs",
-				Flags:       defaultMountFlags | unix.MS_RDONLY,
+				Flags:       defaultMountFlags | syscall.MS_RDONLY,
 			},
 		},
 		Networks: []*configs.Network{
@@ -182,7 +111,7 @@ func newTemplateConfig(rootfs string) *configs.Config {
 		},
 		Rlimits: []configs.Rlimit{
 			{
-				Type: unix.RLIMIT_NOFILE,
+				Type: syscall.RLIMIT_NOFILE,
 				Hard: uint64(1025),
 				Soft: uint64(1025),
 			},

vendor/github.com/opencontainers/runc/libcontainer/integration/utils_test.go

@@ -2,8 +2,6 @@ package integration
 
 import (
 	"bytes"
-	"crypto/md5"
-	"encoding/hex"
 	"fmt"
 	"io/ioutil"
 	"os"
@@ -13,7 +11,6 @@ import (
 	"strings"
 	"syscall"
 	"testing"
-	"time"
 
 	"github.com/opencontainers/runc/libcontainer"
 	"github.com/opencontainers/runc/libcontainer/configs"
@@ -65,28 +62,6 @@ func waitProcess(p *libcontainer.Process, t *testing.T) {
 	}
 }
 
-func newTestRoot() (string, error) {
-	dir, err := ioutil.TempDir("", "libcontainer")
-	if err != nil {
-		return "", err
-	}
-	if err := os.MkdirAll(dir, 0700); err != nil {
-		return "", err
-	}
-	return dir, nil
-}
-
-func newTestBundle() (string, error) {
-	dir, err := ioutil.TempDir("", "bundle")
-	if err != nil {
-		return "", err
-	}
-	if err := os.MkdirAll(dir, 0700); err != nil {
-		return "", err
-	}
-	return dir, nil
-}
-
 // newRootfs creates a new tmp directory and copies the busybox root filesystem
 func newRootfs() (string, error) {
 	dir, err := ioutil.TempDir("", "")
@@ -117,9 +92,7 @@ func copyBusybox(dest string) error {
 }
 
 func newContainer(config *configs.Config) (libcontainer.Container, error) {
-	h := md5.New()
-	h.Write([]byte(time.Now().String()))
-	return newContainerWithName(hex.EncodeToString(h.Sum(nil)), config)
+	return newContainerWithName("testCT", config)
 }
 
 func newContainerWithName(name string, config *configs.Config) (libcontainer.Container, error) {
@@ -150,7 +123,7 @@ func runContainer(config *configs.Config, console string, args ...string) (buffe
 		Stderr: buffers.Stderr,
 	}
 
-	err = container.Run(process)
+	err = container.Start(process)
 	if err != nil {
 		return buffers, -1, err
 	}

vendor/github.com/opencontainers/runc/libcontainer/keys/keyctl.go

@@ -1,31 +1,47 @@
 // +build linux
 
-package keys
+package keyctl
 
 import (
 	"fmt"
-	"strconv"
+	"syscall"
 	"strings"
-
-	"golang.org/x/sys/unix"
+	"strconv"
+	"unsafe"
 )
 
+const KEYCTL_JOIN_SESSION_KEYRING = 1
+const KEYCTL_SETPERM = 5
+const KEYCTL_DESCRIBE = 6
+
 type KeySerial uint32
 
 func JoinSessionKeyring(name string) (KeySerial, error) {
-	sessKeyId, err := unix.KeyctlJoinSessionKeyring(name)
-	if err != nil {
-		return 0, fmt.Errorf("could not create session key: %v", err)
+	var _name *byte = nil
+	var err error
+
+	if len(name) > 0 {
+		_name, err = syscall.BytePtrFromString(name)
+		if err != nil {
+			return KeySerial(0), err
+		}
+	}
+
+	sessKeyId, _, errn := syscall.Syscall(syscall.SYS_KEYCTL, KEYCTL_JOIN_SESSION_KEYRING, uintptr(unsafe.Pointer(_name)), 0)
+	if errn != 0 {
+		return 0, fmt.Errorf("could not create session key: %v", errn)
 	}
 	return KeySerial(sessKeyId), nil
 }
 
-// ModKeyringPerm modifies permissions on a keyring by reading the current permissions,
+// modify permissions on a keyring by reading the current permissions,
 // anding the bits with the given mask (clearing permissions) and setting
 // additional permission bits
 func ModKeyringPerm(ringId KeySerial, mask, setbits uint32) error {
-	dest, err := unix.KeyctlString(unix.KEYCTL_DESCRIBE, int(ringId))
-	if err != nil {
+	dest := make([]byte, 1024)
+	destBytes := unsafe.Pointer(&dest[0])
+
+	if _, _, err := syscall.Syscall6(syscall.SYS_KEYCTL, uintptr(KEYCTL_DESCRIBE), uintptr(ringId), uintptr(destBytes), uintptr(len(dest)), 0, 0); err != 0 {
 		return err
 	}
 
@@ -42,9 +58,10 @@ func ModKeyringPerm(ringId KeySerial, mask, setbits uint32) error {
 
 	perm := (uint32(perm64) & mask) | setbits
 
-	if err := unix.KeyctlSetperm(int(ringId), perm); err != nil {
+	if _, _, err := syscall.Syscall(syscall.SYS_KEYCTL, uintptr(KEYCTL_SETPERM), uintptr(ringId), uintptr(perm)); err != 0 {
 		return err
 	}
 
 	return nil
 }
+

vendor/github.com/opencontainers/runc/libcontainer/label/label.go

@@ -0,0 +1,80 @@
+// +build !selinux !linux
+
+package label
+
+// InitLabels returns the process label and file labels to be used within
+// the container.  A list of options can be passed into this function to alter
+// the labels.
+func InitLabels(options []string) (string, string, error) {
+	return "", "", nil
+}
+
+func GenLabels(options string) (string, string, error) {
+	return "", "", nil
+}
+
+func FormatMountLabel(src string, mountLabel string) string {
+	return src
+}
+
+func SetProcessLabel(processLabel string) error {
+	return nil
+}
+
+func GetFileLabel(path string) (string, error) {
+	return "", nil
+}
+
+func SetFileLabel(path string, fileLabel string) error {
+	return nil
+}
+
+func SetFileCreateLabel(fileLabel string) error {
+	return nil
+}
+
+func Relabel(path string, fileLabel string, shared bool) error {
+	return nil
+}
+
+func GetPidLabel(pid int) (string, error) {
+	return "", nil
+}
+
+func Init() {
+}
+
+func ReserveLabel(label string) error {
+	return nil
+}
+
+func UnreserveLabel(label string) error {
+	return nil
+}
+
+// DupSecOpt takes a process label and returns security options that
+// can be used to set duplicate labels on future container processes
+func DupSecOpt(src string) []string {
+	return nil
+}
+
+// DisableSecOpt returns a security opt that can disable labeling
+// support for future container processes
+func DisableSecOpt() []string {
+	return nil
+}
+
+// Validate checks that the label does not include unexpected options
+func Validate(label string) error {
+	return nil
+}
+
+// RelabelNeeded checks whether the user requested a relabel
+func RelabelNeeded(label string) bool {
+	return false
+}
+
+// IsShared checks that the label includes a "shared" mark
+func IsShared(label string) bool {
+	return false
+}

vendor/github.com/opencontainers/runc/libcontainer/label/label_selinux.go

@@ -0,0 +1,197 @@
+// +build selinux,linux
+
+package label
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/opencontainers/runc/libcontainer/selinux"
+)
+
+// Valid Label Options
+var validOptions = map[string]bool{
+	"disable": true,
+	"type":    true,
+	"user":    true,
+	"role":    true,
+	"level":   true,
+}
+
+var ErrIncompatibleLabel = fmt.Errorf("Bad SELinux option z and Z can not be used together")
+
+// InitLabels returns the process label and file labels to be used within
+// the container.  A list of options can be passed into this function to alter
+// the labels.  The labels returned will include a random MCS String, that is
+// guaranteed to be unique.
+func InitLabels(options []string) (string, string, error) {
+	if !selinux.SelinuxEnabled() {
+		return "", "", nil
+	}
+	processLabel, mountLabel := selinux.GetLxcContexts()
+	if processLabel != "" {
+		pcon := selinux.NewContext(processLabel)
+		mcon := selinux.NewContext(mountLabel)
+		for _, opt := range options {
+			if opt == "disable" {
+				return "", "", nil
+			}
+			if i := strings.Index(opt, ":"); i == -1 {
+				return "", "", fmt.Errorf("Bad label option %q, valid options 'disable' or \n'user, role, level, type' followed by ':' and a value", opt)
+			}
+			con := strings.SplitN(opt, ":", 2)
+			if !validOptions[con[0]] {
+				return "", "", fmt.Errorf("Bad label option %q, valid options 'disable, user, role, level, type'", con[0])
+
+			}
+			pcon[con[0]] = con[1]
+			if con[0] == "level" || con[0] == "user" {
+				mcon[con[0]] = con[1]
+			}
+		}
+		processLabel = pcon.Get()
+		mountLabel = mcon.Get()
+	}
+	return processLabel, mountLabel, nil
+}
+
+// DEPRECATED: The GenLabels function is only to be used during the transition to the official API.
+func GenLabels(options string) (string, string, error) {
+	return InitLabels(strings.Fields(options))
+}
+
+// FormatMountLabel returns a string to be used by the mount command.
+// The format of this string will be used to alter the labeling of the mountpoint.
+// The string returned is suitable to be used as the options field of the mount command.
+// If you need to have additional mount point options, you can pass them in as
+// the first parameter.  Second parameter is the label that you wish to apply
+// to all content in the mount point.
+func FormatMountLabel(src, mountLabel string) string {
+	if mountLabel != "" {
+		switch src {
+		case "":
+			src = fmt.Sprintf("context=%q", mountLabel)
+		default:
+			src = fmt.Sprintf("%s,context=%q", src, mountLabel)
+		}
+	}
+	return src
+}
+
+// SetProcessLabel takes a process label and tells the kernel to assign the
+// label to the next program executed by the current process.
+func SetProcessLabel(processLabel string) error {
+	if processLabel == "" {
+		return nil
+	}
+	return selinux.Setexeccon(processLabel)
+}
+
+// GetProcessLabel returns the process label that the kernel will assign
+// to the next program executed by the current process.  If "" is returned
+// this indicates that the default labeling will happen for the process.
+func GetProcessLabel() (string, error) {
+	return selinux.Getexeccon()
+}
+
+// GetFileLabel returns the label for specified path
+func GetFileLabel(path string) (string, error) {
+	return selinux.Getfilecon(path)
+}
+
+// SetFileLabel modifies the "path" label to the specified file label
+func SetFileLabel(path string, fileLabel string) error {
+	if selinux.SelinuxEnabled() && fileLabel != "" {
+		return selinux.Setfilecon(path, fileLabel)
+	}
+	return nil
+}
+
+// Tell the kernel the label for all files to be created
+func SetFileCreateLabel(fileLabel string) error {
+	if selinux.SelinuxEnabled() {
+		return selinux.Setfscreatecon(fileLabel)
+	}
+	return nil
+}
+
+// Change the label of path to the filelabel string.
+// It changes the MCS label to s0 if shared is true.
+// This will allow all containers to share the content.
+func Relabel(path string, fileLabel string, shared bool) error {
+	if !selinux.SelinuxEnabled() {
+		return nil
+	}
+
+	if fileLabel == "" {
+		return nil
+	}
+
+	exclude_paths := map[string]bool{"/": true, "/usr": true, "/etc": true}
+	if exclude_paths[path] {
+		return fmt.Errorf("Relabeling of %s is not allowed", path)
+	}
+
+	if shared {
+		c := selinux.NewContext(fileLabel)
+		c["level"] = "s0"
+		fileLabel = c.Get()
+	}
+	return selinux.Chcon(path, fileLabel, true)
+}
+
+// GetPidLabel will return the label of the process running with the specified pid
+func GetPidLabel(pid int) (string, error) {
+	return selinux.Getpidcon(pid)
+}
+
+// Init initialises the labeling system
+func Init() {
+	selinux.SelinuxEnabled()
+}
+
+// ReserveLabel will record the fact that the MCS label has already been used.
+// This will prevent InitLabels from using the MCS label in a newly created
+// container
+func ReserveLabel(label string) error {
+	selinux.ReserveLabel(label)
+	return nil
+}
+
+// UnreserveLabel will remove the reservation of the MCS label.
+// This will allow InitLabels to use the MCS label in a newly created
+// containers
+func UnreserveLabel(label string) error {
+	selinux.FreeLxcContexts(label)
+	return nil
+}
+
+// DupSecOpt takes an process label and returns security options that
+// can be used to set duplicate labels on future container processes
+func DupSecOpt(src string) []string {
+	return selinux.DupSecOpt(src)
+}
+
+// DisableSecOpt returns a security opt that can disable labeling
+// support for future container processes
+func DisableSecOpt() []string {
+	return selinux.DisableSecOpt()
+}
+
+// Validate checks that the label does not include unexpected options
+func Validate(label string) error {
+	if strings.Contains(label, "z") && strings.Contains(label, "Z") {
+		return ErrIncompatibleLabel
+	}
+	return nil
+}
+
+// RelabelNeeded checks whether the user requested a relabel
+func RelabelNeeded(label string) bool {
+	return strings.Contains(label, "z") || strings.Contains(label, "Z")
+}
+
+// IsShared checks that the label includes a "shared" mark
+func IsShared(label string) bool {
+	return strings.Contains(label, "z")
+}

vendor/github.com/opencontainers/runc/libcontainer/label/label_selinux_test.go

@@ -0,0 +1,143 @@
+// +build selinux,linux
+
+package label
+
+import (
+	"os"
+	"strings"
+	"testing"
+
+	"github.com/opencontainers/runc/libcontainer/selinux"
+)
+
+func TestInit(t *testing.T) {
+	if selinux.SelinuxEnabled() {
+		var testNull []string
+		plabel, mlabel, err := InitLabels(testNull)
+		if err != nil {
+			t.Log("InitLabels Failed")
+			t.Fatal(err)
+		}
+		testDisabled := []string{"disable"}
+		plabel, mlabel, err = InitLabels(testDisabled)
+		if err != nil {
+			t.Log("InitLabels Disabled Failed")
+			t.Fatal(err)
+		}
+		if plabel != "" {
+			t.Log("InitLabels Disabled Failed")
+			t.Fatal()
+		}
+		testUser := []string{"user:user_u", "role:user_r", "type:user_t", "level:s0:c1,c15"}
+		plabel, mlabel, err = InitLabels(testUser)
+		if err != nil {
+			t.Log("InitLabels User Failed")
+			t.Fatal(err)
+		}
+		if plabel != "user_u:user_r:user_t:s0:c1,c15" || mlabel != "user_u:object_r:svirt_sandbox_file_t:s0:c1,c15" {
+			t.Log("InitLabels User Match Failed")
+			t.Log(plabel, mlabel)
+			t.Fatal(err)
+		}
+
+		testBadData := []string{"user", "role:user_r", "type:user_t", "level:s0:c1,c15"}
+		if _, _, err = InitLabels(testBadData); err == nil {
+			t.Log("InitLabels Bad Failed")
+			t.Fatal(err)
+		}
+	}
+}
+func TestDuplicateLabel(t *testing.T) {
+	secopt := DupSecOpt("system_u:system_r:svirt_lxc_net_t:s0:c1,c2")
+	t.Log(secopt)
+	for _, opt := range secopt {
+		con := strings.SplitN(opt, ":", 3)
+		if len(con) != 3 || con[0] != "label" {
+			t.Errorf("Invalid DupSecOpt return value")
+			continue
+		}
+		if con[1] == "user" {
+			if con[2] != "system_u" {
+				t.Errorf("DupSecOpt Failed user incorrect")
+			}
+			continue
+		}
+		if con[1] == "role" {
+			if con[2] != "system_r" {
+				t.Errorf("DupSecOpt Failed role incorrect")
+			}
+			continue
+		}
+		if con[1] == "type" {
+			if con[2] != "svirt_lxc_net_t" {
+				t.Errorf("DupSecOpt Failed type incorrect")
+			}
+			continue
+		}
+		if con[1] == "level" {
+			if con[2] != "s0:c1,c2" {
+				t.Errorf("DupSecOpt Failed level incorrect")
+			}
+			continue
+		}
+		t.Errorf("DupSecOpt Failed invalid field %q", con[1])
+	}
+	secopt = DisableSecOpt()
+	if secopt[0] != "label:disable" {
+		t.Errorf("DisableSecOpt Failed level incorrect")
+	}
+}
+func TestRelabel(t *testing.T) {
+	testdir := "/tmp/test"
+	if err := os.Mkdir(testdir, 0755); err != nil {
+		t.Fatal(err)
+	}
+	defer os.RemoveAll(testdir)
+	label := "system_u:system_r:svirt_sandbox_file_t:s0:c1,c2"
+	if err := Relabel(testdir, "", true); err != nil {
+		t.Fatal("Relabel with no label failed: %v", err)
+	}
+	if err := Relabel(testdir, label, true); err != nil {
+		t.Fatal("Relabel shared failed: %v", err)
+	}
+	if err := Relabel(testdir, label, false); err != nil {
+		t.Fatal("Relabel unshared failed: %v", err)
+	}
+	if err := Relabel("/etc", label, false); err == nil {
+		t.Fatal("Relabel /etc succeeded")
+	}
+	if err := Relabel("/", label, false); err == nil {
+		t.Fatal("Relabel / succeeded")
+	}
+	if err := Relabel("/usr", label, false); err == nil {
+		t.Fatal("Relabel /usr succeeded")
+	}
+}
+
+func TestValidate(t *testing.T) {
+	if err := Validate("zZ"); err != ErrIncompatibleLabel {
+		t.Fatalf("Expected incompatible error, got %v", err)
+	}
+	if err := Validate("Z"); err != nil {
+		t.Fatal(err)
+	}
+	if err := Validate("z"); err != nil {
+		t.Fatal(err)
+	}
+	if err := Validate(""); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestIsShared(t *testing.T) {
+	if shared := IsShared("Z"); shared {
+		t.Fatal("Expected label `Z` to not be shared, got %v", shared)
+	}
+	if shared := IsShared("z"); !shared {
+		t.Fatal("Expected label `z` to be shared, got %v", shared)
+	}
+	if shared := IsShared("Zz"); !shared {
+		t.Fatal("Expected label `Zz` to be shared, got %v", shared)
+	}
+
+}

vendor/github.com/opencontainers/runc/libcontainer/message_linux.go

@@ -3,8 +3,9 @@
 package libcontainer
 
 import (
+	"syscall"
+
 	"github.com/vishvananda/netlink/nl"
-	"golang.org/x/sys/unix"
 )
 
 // list of known message types we want to send to bootstrap program
@@ -12,12 +13,13 @@ import (
 const (
 	InitMsg         uint16 = 62000
 	CloneFlagsAttr  uint16 = 27281
-	NsPathsAttr     uint16 = 27282
-	UidmapAttr      uint16 = 27283
-	GidmapAttr      uint16 = 27284
-	SetgroupAttr    uint16 = 27285
-	OomScoreAdjAttr uint16 = 27286
-	RootlessAttr    uint16 = 27287
+	ConsolePathAttr uint16 = 27282
+	NsPathsAttr     uint16 = 27283
+	UidmapAttr      uint16 = 27284
+	GidmapAttr      uint16 = 27285
+	SetgroupAttr    uint16 = 27286
+	// When syscall.NLA_HDRLEN is in gccgo, take this out.
+	syscall_NLA_HDRLEN = (syscall.SizeofNlAttr + syscall.NLA_ALIGNTO - 1) & ^(syscall.NLA_ALIGNTO - 1)
 )
 
 type Int32msg struct {
@@ -25,8 +27,7 @@ type Int32msg struct {
 	Value uint32
 }
 
-// Serialize serializes the message.
-// Int32msg has the following representation
+// int32msg has the following representation
 // | nlattr len | nlattr type |
 // | uint32 value             |
 func (msg *Int32msg) Serialize() []byte {
@@ -39,10 +40,10 @@ func (msg *Int32msg) Serialize() []byte {
 }
 
 func (msg *Int32msg) Len() int {
-	return unix.NLA_HDRLEN + 4
+	return syscall_NLA_HDRLEN + 4
 }
 
-// Bytemsg has the following representation
+// bytemsg has the following representation
 // | nlattr len | nlattr type |
 // | value              | pad |
 type Bytemsg struct {
@@ -52,7 +53,7 @@ type Bytemsg struct {
 
 func (msg *Bytemsg) Serialize() []byte {
 	l := msg.Len()
-	buf := make([]byte, (l+unix.NLA_ALIGNTO-1) & ^(unix.NLA_ALIGNTO-1))
+	buf := make([]byte, (l+syscall.NLA_ALIGNTO-1) & ^(syscall.NLA_ALIGNTO-1))
 	native := nl.NativeEndian()
 	native.PutUint16(buf[0:2], uint16(l))
 	native.PutUint16(buf[2:4], msg.Type)
@@ -61,7 +62,7 @@ func (msg *Bytemsg) Serialize() []byte {
 }
 
 func (msg *Bytemsg) Len() int {
-	return unix.NLA_HDRLEN + len(msg.Value) + 1 // null-terminated
+	return syscall_NLA_HDRLEN + len(msg.Value) + 1 // null-terminated
 }
 
 type Boolmsg struct {
@@ -83,5 +84,5 @@ func (msg *Boolmsg) Serialize() []byte {
 }
 
 func (msg *Boolmsg) Len() int {
-	return unix.NLA_HDRLEN + 1
+	return syscall_NLA_HDRLEN + 1
 }

vendor/github.com/opencontainers/runc/libcontainer/notify_linux.go

@@ -7,8 +7,7 @@ import (
 	"io/ioutil"
 	"os"
 	"path/filepath"
-
-	"golang.org/x/sys/unix"
+	"syscall"
 )
 
 const oomCgroupName = "memory"
@@ -26,13 +25,13 @@ func registerMemoryEvent(cgDir string, evName string, arg string) (<-chan struct
 	if err != nil {
 		return nil, err
 	}
-	fd, err := unix.Eventfd(0, unix.EFD_CLOEXEC)
-	if err != nil {
+	fd, _, syserr := syscall.RawSyscall(syscall.SYS_EVENTFD2, 0, syscall.FD_CLOEXEC, 0)
+	if syserr != 0 {
 		evFile.Close()
-		return nil, err
+		return nil, syserr
 	}
 
-	eventfd := os.NewFile(uintptr(fd), "eventfd")
+	eventfd := os.NewFile(fd, "eventfd")
 
 	eventControlPath := filepath.Join(cgDir, "cgroup.event_control")
 	data := fmt.Sprintf("%d %d %s", eventfd.Fd(), evFile.Fd(), arg)
@@ -44,9 +43,9 @@ func registerMemoryEvent(cgDir string, evName string, arg string) (<-chan struct
 	ch := make(chan struct{})
 	go func() {
 		defer func() {
+			close(ch)
 			eventfd.Close()
 			evFile.Close()
-			close(ch)
 		}()
 		buf := make([]byte, 8)
 		for {

vendor/github.com/opencontainers/runc/libcontainer/notify_linux_test.go

@@ -8,10 +8,9 @@ import (
 	"io/ioutil"
 	"os"
 	"path/filepath"
+	"syscall"
 	"testing"
 	"time"
-
-	"golang.org/x/sys/unix"
 )
 
 type notifyFunc func(paths map[string]string) (<-chan struct{}, error)
@@ -53,17 +52,21 @@ func testMemoryNotification(t *testing.T, evName string, notify notifyFunc, targ
 		t.Fatalf("invalid control data %q: %s", data, err)
 	}
 
-	// dup the eventfd
-	efd, err := unix.Dup(eventFd)
+	// re-open the eventfd
+	efd, err := syscall.Dup(eventFd)
 	if err != nil {
-		t.Fatal("unable to dup eventfd:", err)
+		t.Fatal("unable to reopen eventfd:", err)
+	}
+	defer syscall.Close(efd)
+
+	if err != nil {
+		t.Fatal("unable to dup event fd:", err)
 	}
-	defer unix.Close(efd)
 
 	buf := make([]byte, 8)
 	binary.LittleEndian.PutUint64(buf, 1)
 
-	if _, err := unix.Write(efd, buf); err != nil {
+	if _, err := syscall.Write(efd, buf); err != nil {
 		t.Fatal("unable to write to eventfd:", err)
 	}
 
@@ -78,7 +81,7 @@ func testMemoryNotification(t *testing.T, evName string, notify notifyFunc, targ
 	if err := os.RemoveAll(memoryPath); err != nil {
 		t.Fatal(err)
 	}
-	if _, err := unix.Write(efd, buf); err != nil {
+	if _, err := syscall.Write(efd, buf); err != nil {
 		t.Fatal("unable to write to eventfd:", err)
 	}
 
@@ -89,15 +92,14 @@ func testMemoryNotification(t *testing.T, evName string, notify notifyFunc, targ
 			t.Fatal("expected no notification to be triggered")
 		}
 	case <-time.After(100 * time.Millisecond):
-		t.Fatal("channel not closed after 100ms")
 	}
 
-	if _, _, err := unix.Syscall(unix.SYS_FCNTL, uintptr(evFd), unix.F_GETFD, 0); err != unix.EBADF {
-		t.Errorf("expected event control to be closed, but received error %s", err.Error())
+	if _, _, err := syscall.Syscall(syscall.SYS_FCNTL, uintptr(evFd), syscall.F_GETFD, 0); err != syscall.EBADF {
+		t.Error("expected event control to be closed")
 	}
 
-	if _, _, err := unix.Syscall(unix.SYS_FCNTL, uintptr(eventFd), unix.F_GETFD, 0); err != unix.EBADF {
-		t.Errorf("expected event fd to be closed, but received error %s", err.Error())
+	if _, _, err := syscall.Syscall(syscall.SYS_FCNTL, uintptr(eventFd), syscall.F_GETFD, 0); err != syscall.EBADF {
+		t.Error("expected event fd to be closed")
 	}
 }
 

vendor/github.com/opencontainers/runc/libcontainer/nsenter/README.md

@@ -10,35 +10,16 @@ The `nsenter` package will `import "C"` and it uses [cgo](https://golang.org/cmd
 package. In cgo, if the import of "C" is immediately preceded by a comment, that comment, 
 called the preamble, is used as a header when compiling the C parts of the package.
 So every time we  import package `nsenter`, the C code function `nsexec()` would be 
-called. And package `nsenter` is now only imported in `main_unix.go`, so every time
-before we call `cmd.Start` on linux, that C code would run.
-
-Because `nsexec()` must be run before the Go runtime in order to use the
-Linux kernel namespace, you must `import` this library into a package if
-you plan to use `libcontainer` directly. Otherwise Go will not execute
-the `nsexec()` constructor, which means that the re-exec will not cause
-the namespaces to be joined. You can import it like this:
-
-```go
-import _ "github.com/opencontainers/runc/libcontainer/nsenter"
-```
-
-`nsexec()` will first get the file descriptor number for the init pipe
-from the environment variable `_LIBCONTAINER_INITPIPE` (which was opened
-by the parent and kept open across the fork-exec of the `nsexec()` init
-process). The init pipe is used to read bootstrap data (namespace paths,
-clone flags, uid and gid mappings, and the console path) from the parent
-process. `nsexec()` will then call `setns(2)` to join the namespaces
-provided in the bootstrap data (if available), `clone(2)` a child process
-with the provided clone flags, update the user and group ID mappings, do
-some further miscellaneous setup steps, and then send the PID of the
-child process to the parent of the `nsexec()` "caller". Finally,
-the parent `nsexec()` will exit and the child `nsexec()` process will
-return to allow the Go runtime take over.
-
-NOTE: We do both `setns(2)` and `clone(2)` even if we don't have any
-CLONE_NEW* clone flags because we must fork a new process in order to
-enter the PID namespace.
+called. And package `nsenter` is now only imported in Docker execdriver, so every time 
+before we call `execdriver.Exec()`, that C code would run.
 
+`nsexec()` will first check the environment variable `_LIBCONTAINER_INITPID` 
+which will give the process of the container that should be joined. Namespaces fd will 
+be found from `/proc/[pid]/ns` and set by `setns` syscall.
 
+And then get the pipe number from `_LIBCONTAINER_INITPIPE`, error message could
+be transfered through it. If tty is added, `_LIBCONTAINER_CONSOLE_PATH` will 
+have value and start a console for output.
 
+Finally, `nsexec()` will clone a child process , exit the parent process and let 
+the Go runtime take over.

vendor/github.com/opencontainers/runc/libcontainer/nsenter/namespace.h

@@ -1,32 +0,0 @@
-#ifndef NSENTER_NAMESPACE_H
-#define NSENTER_NAMESPACE_H
-
-#ifndef _GNU_SOURCE
-#	define _GNU_SOURCE
-#endif
-#include <sched.h>
-
-/* All of these are taken from include/uapi/linux/sched.h */
-#ifndef CLONE_NEWNS
-#	define CLONE_NEWNS 0x00020000 /* New mount namespace group */
-#endif
-#ifndef CLONE_NEWCGROUP
-#	define CLONE_NEWCGROUP 0x02000000 /* New cgroup namespace */
-#endif
-#ifndef CLONE_NEWUTS
-#	define CLONE_NEWUTS 0x04000000 /* New utsname namespace */
-#endif
-#ifndef CLONE_NEWIPC
-#	define CLONE_NEWIPC 0x08000000 /* New ipc namespace */
-#endif
-#ifndef CLONE_NEWUSER
-#	define CLONE_NEWUSER 0x10000000 /* New user namespace */
-#endif
-#ifndef CLONE_NEWPID
-#	define CLONE_NEWPID 0x20000000 /* New pid namespace */
-#endif
-#ifndef CLONE_NEWNET
-#	define CLONE_NEWNET 0x40000000 /* New network namespace */
-#endif
-
-#endif /* NSENTER_NAMESPACE_H */