Add mon groups for resctrl.

.cirrus.yml

@@ -30,12 +30,12 @@ task:
 
   host_info_script: |
     uname -a
-    echo "-----"
+    # -----
     cat /etc/os-release
-    echo "-----"
-    cat /proc/cpuinfo
-    echo "-----"
+    # -----
     df -T
+    # -----
+    cat /proc/cpuinfo
   install_libvirt_vagrant_script: |
     apt-get update
     apt-get install -y libvirt-daemon libvirt-daemon-system vagrant vagrant-libvirt
@@ -50,7 +50,9 @@ task:
     mkdir -p -m 0700 /root/.ssh
     vagrant ssh-config >> /root/.ssh/config
   guest_info_script: |
-    ssh default 'sh -exc "uname -a && systemctl --version && df -T && cat /etc/os-release"'
+    ssh default 'sh -exc "uname -a && systemctl --version && df -T && cat /etc/os-release && go version"'
+  check_config_script: |
+    ssh default /vagrant/script/check-config.sh
   unit_tests_script: |
     ssh default 'sudo -i make -C /vagrant localunittest'
   integration_systemd_script: |
@@ -68,12 +70,14 @@ task:
   env:
     HOME: /root
     CIRRUS_WORKING_DIR: /home/runc
-    GO_VERSION: "1.17.3"
-    BATS_VERSION: "v1.3.0"
+    GO_VERSION: "1.19"
+    BATS_VERSION: "v1.8.2"
+    RPMS: gcc git iptables jq glibc-static libseccomp-devel make criu fuse-sshfs
     # yamllint disable rule:key-duplicates
     matrix:
       DISTRO: centos-7
       DISTRO: centos-stream-8
+      DISTRO: centos-stream-9
 
   name: ci / $DISTRO
 
@@ -88,22 +92,36 @@ task:
     case $DISTRO in
     centos-7)
       (cd /etc/yum.repos.d && curl -O https://copr.fedorainfracloud.org/coprs/adrian/criu-el7/repo/epel-7/adrian-criu-el7-epel-7.repo)
+      # EPEL is needed for jq and fuse-sshfs.
+      rpm -q epel-release || rpm -Uvh https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm
       # sysctl
       echo "user.max_user_namespaces=15076" > /etc/sysctl.d/userns.conf
       sysctl --system
       ;;
     centos-stream-8)
       yum config-manager --set-enabled powertools # for glibc-static
       ;;
+    centos-stream-9)
+      dnf config-manager --set-enabled crb # for glibc-static
+      dnf -y install epel-release epel-next-release # for fuse-sshfs
+      ;;
     esac
     # Work around dnf mirror failures by retrying a few times.
     for i in $(seq 0 2); do
       sleep $i
-      yum install -y -q gcc git iptables jq glibc-static libseccomp-devel make criu fuse-sshfs && break
+      yum install -y $RPMS && break
     done
     [ $? -eq 0 ] # fail if yum failed
+
+    # Double check that all rpms were installed (yum from CentOS 7
+    # does not exit with an error if some packages were not found).
+    # Use --whatprovides since some packages are renamed.
+    rpm -q --whatprovides $RPMS
     # install Go
-    curl -fsSL "https://dl.google.com/go/go${GO_VERSION}.linux-amd64.tar.gz" | tar Cxz /usr/local
+    PREFIX="https://go.dev/dl/"
+    # Find out the latest minor release URL.
+    eval $(curl -fsSL "${PREFIX}?mode=json" | jq -r  --arg Ver "$GO_VERSION" '.[] | select(.version | startswith("go\($Ver)")) | .files[] | select(.os == "linux" and .arch == "amd64" and .kind == "archive") | "filename=\"" + .filename + "\""')
+    curl -fsSL "$PREFIX$filename" | tar Cxz /usr/local
     # install bats
     cd /tmp
     git clone https://github.com/bats-core/bats-core
@@ -131,14 +149,18 @@ task:
     systemctl restart sshd
   host_info_script: |
     uname -a
-    echo "-----"
+    # -----
+    /usr/local/go/bin/go version
+    # -----
+    systemctl --version
+    # -----
     cat /etc/os-release
-    echo "-----"
-    cat /proc/cpuinfo
-    echo "-----"
+    # -----
     df -T
-    echo "-----"
-    systemctl --version
+    # -----
+    cat /proc/cpuinfo
+  check_config_script: |
+    /home/runc/script/check-config.sh
   unit_tests_script: |
     ssh -tt localhost "make -C /home/runc localunittest"
   integration_systemd_script: |

.clang-format

@@ -0,0 +1,8 @@
+---
+# We use GNU indent from the Makefile to format C code in this project. Alas,
+# there is no way to map indent options to clang-format style options in a way
+# to achieve identical results for both formatters.
+#
+# Therefore, let's disable clang-format entirely.
+DisableFormat: true
+...

.codespellrc

@@ -1,3 +1,3 @@
 [codespell]
-skip = ./vendor,./.git
-ignore-words-list = clos,creat
+skip = ./vendor,./.git,./go.sum
+ignore-words-list = clos,creat,ro,complies

.editorconfig

@@ -0,0 +1,8 @@
+# This file is used by shfmt. See https://EditorConfig.org
+
+# This is a top-most EditorConfig file.
+root = true
+
+# Ignore the entire "vendor" directory.
+[vendor/**]
+ignore = true

.github/ISSUE_TEMPLATE/bug_report.yaml

@@ -0,0 +1,54 @@
+# Forked from https://github.com/containerd/nerdctl/blob/v1.2.1/.github/ISSUE_TEMPLATE/bug_report.yaml
+name: Bug report
+description: Create a bug report to help improve runc
+labels: kind/unconfirmed-bug-claim
+body:
+  - type: markdown
+    attributes:
+      value: |
+        If you are reporting a new issue, make sure that we do not have any duplicates
+        already open. You can ensure this by searching the issue list for this
+        repository. If there is a duplicate, please close your issue and add a comment
+        to the existing issue instead.
+
+        When reporting a security issue, do not create an issue or file a pull request on GitHub.
+        See [`opencontainers/.github/SECURITY.md`](https://github.com/opencontainers/.github/blob/master/SECURITY.md).
+
+  - type: textarea
+    attributes:
+      label: Description
+      description: |
+        Briefly describe the problem you are having in a few paragraphs.
+    validations:
+      required: true
+
+  - type: textarea
+    attributes:
+      label: Steps to reproduce the issue
+      value: |
+        1.
+        2.
+        3.
+
+  - type: textarea
+    attributes:
+      label: Describe the results you received and expected
+    validations:
+      required: true
+
+  - type: textarea
+    attributes:
+      label: What version of runc are you using?
+      placeholder: runc --version
+    validations:
+      required: true
+
+  - type: textarea
+    attributes:
+      label: Host OS information
+      placeholder: cat /etc/os-release
+
+  - type: textarea
+    attributes:
+      label: Host kernel information
+      placeholder: uname -a

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,17 @@
+# Forked from https://github.com/containerd/nerdctl/blob/main/.github/ISSUE_TEMPLATE/config.yml
+blank_issues_enabled: true
+contact_links:
+  - name: Ask a question (GitHub Discussions)
+    url: https://github.com/opencontainers/runc/discussions
+    about: |
+      Please do not submit "a bug report" for asking a question.
+      In most cases, GitHub Discussions is the best place to ask a question.
+      If you are not sure whether you are going to report a bug or ask a question,
+      please consider asking in GitHub Discussions first.
+  - name: Slack (opencontainers.slack.com)
+    url: https://communityinviter.com/apps/opencontainers/join-the-oci-community
+    # GitHub requires the `about` property to be set
+    about: Slack
+  - name: Mailing list
+    url: https://groups.google.com/a/opencontainers.org/forum/#!forum/dev
+    about: Mailing list

.github/workflows/test.yml

@@ -7,42 +7,47 @@ on:
     tags:
       - v*
     branches:
-      - master
+      - main
       - release-*
   pull_request:
+permissions:
+  contents: read
 
 env:
   # Don't ignore C warnings. Note that the output of "go env CGO_CFLAGS" by default is "-g -O2", so we keep them.
   CGO_CFLAGS: -g -O2 -Werror
 
 jobs:
   test:
-    runs-on: ubuntu-20.04
     strategy:
       fail-fast: false
       matrix:
-        go-version: [1.16.x, 1.17.x]
+        os: [ubuntu-20.04, ubuntu-22.04]
+        go-version: [1.19.x, 1.20.x]
         rootless: ["rootless", ""]
         race: ["-race", ""]
-        criu: [""]
-        include:
-          # Also test against latest criu-dev
-          - go-version: 1.17.x
-            rootless: ""
-            race: ""
-            criu: "criu-dev"
+        criu: ["", "criu-dev"]
+        exclude:
+          - criu: criu-dev
+            rootless: rootless
+          - criu: criu-dev
+            go-version: 1.19.x
+          - criu: criu-dev
+            race: -race
+    runs-on: ${{ matrix.os }}
 
     steps:
 
     - name: checkout
-      uses: actions/checkout@v2
+      uses: actions/checkout@v3
 
     - name: install deps
       if: matrix.criu == ''
       env:
-        REPO: https://download.opensuse.org/repositories/devel:/tools:/criu/xUbuntu_20.04
+        PREFIX: https://download.opensuse.org/repositories/devel:/tools:/criu/xUbuntu
       run: |
         # criu repo
+        REPO=${PREFIX}_$(echo ${{ matrix.os }} | sed 's/.*-//')
         curl -fSsl $REPO/Release.key | sudo apt-key add -
         echo "deb $REPO/ /" | sudo tee /etc/apt/sources.list.d/criu.list
         sudo apt update
@@ -60,9 +65,9 @@ jobs:
         rm -rf ~/criu
 
     - name: install go ${{ matrix.go-version }}
-      uses: actions/setup-go@v2
+      uses: actions/setup-go@v4
       with:
-        stable: '!contains(${{ matrix.go-version }}, "beta") && !contains(${{ matrix.go-version }}, "rc")'
+        cache: false # https://github.com/actions/setup-go/issues/368
         go-version: ${{ matrix.go-version }}
 
     - name: build
@@ -71,7 +76,7 @@ jobs:
     - name: install bats
       uses: mig4/setup-bats@v1
       with:
-        bats-version: 1.3.0
+        bats-version: 1.8.2
 
     - name: unit test
       if: matrix.rootless != 'rootless'
@@ -87,6 +92,7 @@ jobs:
         sudo cp $HOME/rootless.key /home/rootless/.ssh/id_ecdsa
         sudo cp $HOME/rootless.key.pub /home/rootless/.ssh/authorized_keys
         sudo chown -R rootless.rootless /home/rootless
+        sudo chmod a+X $HOME # for Ubuntu 22.04
 
     - name: integration test (fs driver)
       run: sudo -E PATH="$PATH" script -e -c 'make local${{ matrix.rootless }}integration'
@@ -100,12 +106,12 @@ jobs:
   # However, we do not have 32-bit ARM CI, so we use i386 for testing 32bit stuff.
   # We are not interested in providing official support for i386.
   cross-i386:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-22.04
 
     steps:
 
     - name: checkout
-      uses: actions/checkout@v2
+      uses: actions/checkout@v3
 
     - name: install deps
       run: |
@@ -120,10 +126,10 @@ jobs:
         sudo apt -q install libseccomp-dev libseccomp-dev:i386 gcc-multilib criu
 
     - name: install go
-      uses: actions/setup-go@v2
+      uses: actions/setup-go@v4
       with:
         go-version: 1.x # Latest stable
 
     - name: unit test
-      # cgo is disabled by default when cross-compiling
-      run: sudo -E PATH="$PATH" -- make GOARCH=386 CGO_ENABLED=1 localunittest
+      # See https://go-review.googlesource.com/c/go/+/421935
+      run: sudo -E PATH="$PATH" -- make GOARCH=386 CGO_CFLAGS=-fno-stack-protector localunittest