Merge branch 'main' into main

Author: zhaixiaojuan

.cirrus.yml

@@ -12,7 +12,7 @@ task:
     HOME: /root
     CIRRUS_WORKING_DIR: /home/runc
     GO_VER_PREFIX: "1.24."
-    BATS_VERSION: "v1.11.0"
+    BATS_VERSION: "v1.11.1"
     RPMS: gcc git-core iptables jq glibc-static libseccomp-devel make criu fuse-sshfs container-selinux
     # yamllint disable rule:key-duplicates
     matrix:

.github/workflows/test.yml

@@ -94,6 +94,7 @@ jobs:
           https://github.com/checkpoint-restore/criu.git ~/criu
         (cd ~/criu && sudo make -j $(nproc) install-criu)
         rm -rf ~/criu
+        criu --version
 
     - name: install go ${{ matrix.go-version }}
       uses: actions/setup-go@v6
@@ -107,7 +108,7 @@ jobs:
     - name: Setup Bats and bats libs
       uses: bats-core/[email protected]
       with:
-        bats-version: 1.9.0
+        bats-version: 1.11.1 # Known as BATS_VERSION in other places.
         support-install: false
         assert-install: false
         detik-install: false

.github/workflows/validate.yml

@@ -42,9 +42,9 @@ jobs:
       - uses: golangci/golangci-lint-action@v8
         with:
           version: v2.5
-      # Extra linters, only checking new code from a pull request.
+      # Extra linters, only checking new code from a pull request to main.
       - name: lint-extra
-        if: github.event_name == 'pull_request'
+        if: github.event_name == 'pull_request' && github.base_ref == 'main'
         run: |
           golangci-lint run --config .golangci-extra.yml --new-from-rev=HEAD~1
 

Dockerfile

@@ -1,5 +1,5 @@
 ARG GO_VERSION=1.24
-ARG BATS_VERSION=v1.11.0
+ARG BATS_VERSION=v1.11.1
 ARG LIBSECCOMP_VERSION=2.5.6
 
 FROM golang:${GO_VERSION}-bookworm

libcontainer/process_linux.go

@@ -352,31 +352,38 @@ func (p *setnsProcess) prepareCgroupFD() (*os.File, error) {
 	return fd, nil
 }
 
-func (p *setnsProcess) start() (retErr error) {
-	defer p.comm.closeParent()
+// startWithCgroupFD starts a process via clone3 with CLONE_INTO_CGROUP,
+// with a fallback if it fails (e.g. not available).
+func (p *setnsProcess) startWithCgroupFD() error {
+	// Close the child side of the pipes.
+	defer p.comm.closeChild()
 
 	fd, err := p.prepareCgroupFD()
 	if err != nil {
 		return err
 	}
-
-	// Get the "before" value of oom kill count.
-	oom, _ := p.manager.OOMKillCount()
-
-	err = p.startWithCPUAffinity()
 	if fd != nil {
-		fd.Close()
+		defer fd.Close()
 	}
+
+	err = p.startWithCPUAffinity()
 	if err != nil && p.cmd.SysProcAttr.UseCgroupFD {
 		logrus.Debugf("exec with CLONE_INTO_CGROUP failed: %v; retrying without", err)
 		// SysProcAttr.CgroupFD is never used when UseCgroupFD is unset.
 		p.cmd.SysProcAttr.UseCgroupFD = false
 		err = p.startWithCPUAffinity()
 	}
 
-	// Close the child-side of the pipes (controlled by child).
-	p.comm.closeChild()
-	if err != nil {
+	return err
+}
+
+func (p *setnsProcess) start() (retErr error) {
+	defer p.comm.closeParent()
+
+	// Get the "before" value of oom kill count.
+	oom, _ := p.manager.OOMKillCount()
+
+	if err := p.startWithCgroupFD(); err != nil {
 		return fmt.Errorf("error starting setns process: %w", err)
 	}