Fix a few typos

.codespellrc

@@ -0,0 +1,3 @@
+[codespell]
+skip = ./.git,tags,go.mod,go.sum,./test/image/latin10k.txt,./website/assets/images
+ignore-words-list = savable,adin

Makefile

@@ -97,7 +97,7 @@ endif
 ##
 ## Development helpers and tooling.
 ##
-##   These targets faciliate local development by automatically
+##   These targets facilitate local development by automatically
 ##   installing and configuring a runtime. Several variables may
 ##   be used here to tweak the installation:
 ##     RUNTIME         - The name of the installed runtime (default: $BRANCH_NAME).
@@ -755,3 +755,7 @@ release: $(RELEASE_KEY) $(RELEASE_ARTIFACTS)/$(ARCH)
 tag: ## Creates and pushes a release tag.
 	@tools/tag_release.sh "$(RELEASE_COMMIT)" "$(RELEASE_NAME)" "$(RELEASE_NOTES)"
 .PHONY: tag
+
+codespell:
+	codespell
+.PHONY: codespell

WORKSPACE

@@ -3,7 +3,7 @@ load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive", "http_file"
 
 # Root certificates.
 #
-# Note that the sha256 hash is ommitted here intentionally. This should not be
+# Note that the sha256 hash is omitted here intentionally. This should not be
 # used in any part of the build other than as certificates present in images.
 http_file(
     name = "google_root_pem",

pkg/sentry/kernel/auth/capability_set_test.go

@@ -22,7 +22,7 @@ import (
 	"gvisor.dev/gvisor/pkg/errors/linuxerr"
 )
 
-// capsEquals returns trun when the given creds' capabilities match the given caps.
+// capsEquals returns true when the given creds' capabilities match the given caps.
 func capsEquals(creds *Credentials, caps TaskCapabilities) bool {
 	return creds.PermittedCaps == caps.PermittedCaps &&
 		creds.InheritableCaps == caps.InheritableCaps &&

pkg/sentry/kernel/kernel_restore.go

@@ -30,7 +30,7 @@ type Saver interface {
 // +stateify savable
 type CheckpointGeneration struct {
 	// Count is incremented every time a checkpoint is triggered, even if the
-	// chekpoint failed.
+	// checkpoint failed.
 	Count uint32
 	// Restore indicates if the current instance resumed after the checkpoint or
 	// it was restored from a checkpoint.

pkg/sentry/platform/platform.go

@@ -273,7 +273,7 @@ type Context interface {
 	// Release() releases any resources associated with this context.
 	Release()
 
-	// PrepareSleep() is called when the tread switches to the
+	// PrepareSleep() is called when the thread switches to the
 	// interruptible sleep state.
 	PrepareSleep()
 }

pkg/sentry/seccheck/sinks/remote/test/server.go

@@ -80,7 +80,7 @@ func (s *Server) Count() int {
 	return len(s.points)
 }
 
-// Reset throws aways all points received so far and returns the number of
+// Reset throws away all points received so far and returns the number of
 // points discarded.
 func (s *Server) Reset() int {
 	s.cond.L.Lock()

pkg/sentry/socket/netlink/route/protocol.go

@@ -162,7 +162,7 @@ func (p *Protocol) getLink(ctx context.Context, s *netlink.Socket, msg *nlmsg.Me
 	return nil
 }
 
-// newLink handles RTM_NEWLINK reqeusts.
+// newLink handles RTM_NEWLINK requests.
 func (p *Protocol) newLink(ctx context.Context, s *netlink.Socket, msg *nlmsg.Message, ms *nlmsg.MessageSet) *syserr.Error {
 	stack := s.Stack()
 	if stack == nil {

pkg/sentry/socket/netstack/stack.go

@@ -184,7 +184,7 @@ func (s *Stack) SetInterface(ctx context.Context, msg *nlmsg.Message) *syserr.Er
 }
 
 func (s *Stack) setLink(ctx context.Context, id tcpip.NICID, linkAttrs map[uint16]nlmsg.BytesView) *syserr.Error {
-	// IFLA_NET_NS_FD has to be handled first, because other parameters may be reseted.
+	// IFLA_NET_NS_FD has to be handled first, because other parameters may be reset.
 	if v, ok := linkAttrs[linux.IFLA_NET_NS_FD]; ok {
 		fd, ok := v.Uint32()
 		if !ok {

pkg/sentry/socket/plugin/stack/notifier.go

@@ -99,7 +99,7 @@ func (n *Notifier) UpdateFD(fd uint32) {
 // object. Once notifications arrive, they are dispatched to the
 // registered queue.
 func (n *Notifier) waitAndNotify(ioInit chan int32) error {
-	// plugin stack leverages TLS varaibles, so bind this goroutine with
+	// plugin stack leverages TLS variables, so bind this goroutine with
 	// one specific OS thread
 	runtime.LockOSThread()
 

pkg/tcpip/stack/bridge.go

@@ -283,8 +283,8 @@ func (b *BridgeEndpoint) Close() {}
 // SetOnCloseAction implements stack.LinkEndpoint.Close.
 func (b *BridgeEndpoint) SetOnCloseAction(func()) {}
 
-// Add a new FDBEntry by learning. The learning happens when a packaet
-// is recevied by a bridge port, the bridge will use the port for the future
+// Add a new FDBEntry by learning. The learning happens when a packet
+// is received by a bridge port, the bridge will use the port for the future
 // deliveries to the NIC device.
 // The addr is the key when it looks for the entry.
 //

pkg/tcpip/stack/registration.go

@@ -1149,7 +1149,7 @@ type NetworkLinkEndpoint interface {
 	// Close is called when the endpoint is removed from a stack.
 	Close()
 
-	// SetOnCloseAction sets the action that will be exected before closing the
+	// SetOnCloseAction sets the action that will be executed before closing the
 	// endpoint. It is used to destroy a network device when its endpoint
 	// is closed. Endpoints that are closed only after destroying their
 	// network devices can implement this method as no-op.

runsc/BUILD

@@ -42,7 +42,7 @@ go_binary(
 # The runsc-race target is a race-compatible BUILD target. This must be built
 # via: bazel build --features=race :runsc-race
 #
-# This is neccessary because the race feature must apply to all dependencies
+# This is necessary because the race feature must apply to all dependencies
 # due a bug in gazelle file selection.  The pure attribute must be off because
 # the race detector requires linking with non-Go components, although we still
 # require a static binary.

runsc/boot/portforward/portforward_hostinet.go

@@ -33,7 +33,7 @@ var (
 )
 
 // hostInetConn allows reading and writing to a local host socket for hostinet.
-// hostInetConn implments proxyConn.
+// hostInetConn implements proxyConn.
 type hostInetConn struct {
 	// wq is the WaitQueue registered with fdnotifier for this fd.
 	wq waiter.Queue

runsc/boot/portforward/portforward_hostinet_test.go

@@ -64,7 +64,7 @@ func TestLocalHostSocket(t *testing.T) {
 		}
 
 		if !slices.Equal(data[:recLen], clientData) {
-			return fmt.Errorf("server mismatch data recieved: got: %s want: %s", data[:recLen], clientData)
+			return fmt.Errorf("server mismatch data received: got: %s want: %s", data[:recLen], clientData)
 		}
 
 		sentLen, err := conn.Write(serverData)

runsc/boot/procfs/dump.go

@@ -96,7 +96,7 @@ type ProcessProcfsDump struct {
 	StartTime int64 `json:"clone_ts,omitempty"`
 	// Root is /proc/[pid]/root.
 	Root string `json:"root,omitempty"`
-	// Limits constains resource limits for this process. Currently only
+	// Limits constrains resource limits for this process. Currently only
 	// RLIMIT_NOFILE is supported.
 	Limits map[string]limits.Limit `json:"limits,omitempty"`
 	// Cgroup is /proc/[pid]/cgroup split into an array.

runsc/boot/vfs.go

@@ -1006,7 +1006,7 @@ func (c *containerMounter) mountTmp(ctx context.Context, spec *specs.Spec, conf
 	for _, m := range c.mounts {
 		// m.Destination has been cleaned, so it's to use equality here.
 		if m.Destination == "/tmp" {
-			log.Debugf(`Explict "/tmp" mount found, skipping internal tmpfs, mount: %+v`, m)
+			log.Debugf(`Explicit "/tmp" mount found, skipping internal tmpfs, mount: %+v`, m)
 			return nil
 		}
 	}

runsc/cgroup/systemd_test.go

@@ -56,7 +56,7 @@ func TestIsValidSlice(t *testing.T) {
 			err:   ErrInvalidSlice,
 		},
 		{
-			name:  "has path seperators",
+			name:  "has path separators",
 			slice: "systemd.slice/child.slice",
 			err:   ErrInvalidSlice,
 		},

runsc/cmd/boot.go

@@ -585,7 +585,7 @@ func (b *Boot) Execute(_ context.Context, f *flag.FlagSet, args ...any) subcomma
 // prepareArgs returns the args that can be used to re-execute the current
 // program. It manipulates the flags of the subcommands.Command identified by
 // subCmdName and fSet is the flag.FlagSet of this subcommand. It applies the
-// flags specified by override map. In case of conflict, flag is overriden.
+// flags specified by override map. In case of conflict, flag is overridden.
 //
 // Postcondition: prepareArgs() takes ownership of override map.
 func prepareArgs(subCmdName string, fSet *flag.FlagSet, override map[string]string) []string {

runsc/cmd/debug.go

@@ -147,7 +147,7 @@ func (d *Debug) Execute(_ context.Context, f *flag.FlagSet, args ...any) subcomm
 		pid := c.Sandbox.Getpid()
 		util.Infof("Sending signal %d to process: %d", d.signal, pid)
 		if err := unix.Kill(pid, unix.Signal(d.signal)); err != nil {
-			return util.Errorf("failed to send signal %d to processs %d", d.signal, pid)
+			return util.Errorf("failed to send signal %d to process %d", d.signal, pid)
 		}
 	}
 	if d.stacks {

runsc/cmd/do.go

@@ -206,7 +206,7 @@ func (c *Do) Execute(_ context.Context, f *flag.FlagSet, args ...any) subcommand
 			conf.Network = config.NetworkHost
 
 		case nil:
-			// Setup successfull.
+			// Setup successful.
 			defer clean()
 
 		default:

runsc/cmd/gofer.go

@@ -596,7 +596,7 @@ func shouldExposeNvidiaDevice(path string) bool {
 }
 
 // shouldExposeVfioDevice returns true if path refers to an VFIO device
-// which shuold be exposed to the container.
+// which should be exposed to the container.
 func shouldExposeVFIODevice(path string) bool {
 	return strings.HasPrefix(path, filepath.Dir(vfio.VFIOPath))
 }

runsc/cmd/install.go

@@ -92,7 +92,7 @@ func (i *Install) Execute(_ context.Context, f *flag.FlagSet, _ ...any) subcomma
 	// Extract the executable.
 	path, err := os.Executable()
 	if err != nil {
-		log.Fatalf("Error reading current exectuable: %v", err)
+		log.Fatalf("Error reading current executable: %v", err)
 	}
 
 	i.executablePath = path

runsc/cmd/mitigate.go

@@ -88,7 +88,7 @@ func (m *Mitigate) Execute(_ context.Context, f *flag.FlagSet, args ...any) subc
 	return m.execute()
 }
 
-// execute executes mitigate operations. Seperate from Execute method for
+// execute executes mitigate operations. Separate from Execute method for
 // easier mocking.
 func (m *Mitigate) execute() subcommands.ExitStatus {
 	beforeSet, err := m.control.getCPUs()

runsc/cmd/portforward.go

@@ -79,7 +79,7 @@ OPTIONS:
 
 // SetFlags implements subcommands.Command.SetFlags.
 func (p *PortForward) SetFlags(f *flag.FlagSet) {
-	f.StringVar(&p.stream, "stream", "", "Stream mode - a Unix doman socket")
+	f.StringVar(&p.stream, "stream", "", "Stream mode - a Unix domain socket")
 }
 
 // Execute implements subcommands.Command.Execute.

runsc/cmd/statefile.go

@@ -52,7 +52,7 @@ func (*Statefile) Usage() string {
 
 // SetFlags implements subcommands.Command.
 func (s *Statefile) SetFlags(f *flag.FlagSet) {
-	f.BoolVar(&s.list, "list", false, "lists the metdata in the statefile.")
+	f.BoolVar(&s.list, "list", false, "lists the metadata in the statefile.")
 	f.StringVar(&s.get, "get", "", "extracts the given metadata key.")
 	f.StringVar(&s.key, "key", "", "the integrity key for the file.")
 	f.StringVar(&s.output, "output", "", "target to write the result.")

runsc/config/config.go

@@ -1139,7 +1139,7 @@ const (
 	// Linux network stack.
 	XDPModeRedirect
 
-	// XDPModeTunnel uses XDP_REDIRECT to redirect packets directy from the
+	// XDPModeTunnel uses XDP_REDIRECT to redirect packets directly from the
 	// host NIC to the VETH device inside the container's network
 	// namespace. Packets are read from the VETH via AF_XDP, as in
 	// XDPModeNS.

runsc/container/console_test.go

@@ -33,7 +33,7 @@ import (
 )
 
 // socketPath creates a path inside bundleDir and ensures that the returned
-// path is under 108 charactors (the unix socket path length limit),
+// path is under 108 characters (the unix socket path length limit),
 // relativizing the path if necessary.
 func socketPath(bundleDir string) (string, error) {
 	num := rand.Intn(10000)

runsc/container/container_test.go

@@ -885,7 +885,7 @@ func TestExec(t *testing.T) {
 }
 
 // TestExecProcList verifies that a container can exec a new program and it
-// shows correcly in the process list.
+// shows correctly in the process list.
 func TestExecProcList(t *testing.T) {
 	for name, conf := range configs(t, false /* noOverlay */) {
 		t.Run(name, func(t *testing.T) {
@@ -2007,7 +2007,7 @@ func TestAbbreviatedIDs(t *testing.T) {
 		defer cont.Destroy()
 	}
 
-	// These should all be unambigious.
+	// These should all be unambiguous.
 	unambiguous := map[string]string{
 		"f":     cids[0],
 		cids[0]: cids[0],

runsc/container/gofer_to_host_rpc.go

@@ -83,7 +83,7 @@ func (rpc *goferToHostRPC) OpenMount(m *specs.Mount, res *OpenMountResult) error
 		rpc.openMountRequests = make(chan *openMountRequest)
 		go func() {
 			// This goroutine holds the current threads forever. It
-			// never exits, because child proccesses can set
+			// never exits, because child processes can set
 			// PDEATHSIG. It can't serve other go-routines, because
 			// it does unshare CLONE_FS.
 			runtime.LockOSThread()

runsc/container/multi_container_test.go

@@ -478,7 +478,7 @@ func TestMultiPIDNSKill(t *testing.T) {
 			// Wait until all processes are created.
 			for _, c := range containers {
 				if err := waitForProcessCount(c, processes); err != nil {
-					t.Fatalf("error waitting for processes: %v", err)
+					t.Fatalf("error waiting for processes: %v", err)
 				}
 			}
 
@@ -496,7 +496,7 @@ func TestMultiPIDNSKill(t *testing.T) {
 				}
 				// Wait for the process to get killed.
 				if err := waitForProcessCount(c, processes-1); err != nil {
-					t.Fatalf("error waitting for processes: %v", err)
+					t.Fatalf("error waiting for processes: %v", err)
 				}
 				procs, err = c.Processes()
 				if err != nil {
@@ -1038,7 +1038,7 @@ func TestMultiContainerKillAll(t *testing.T) {
 		// Wait until all processes are created.
 		rootProcCount := int(math.Pow(2, 3) - 1)
 		if err := waitForProcessCount(containers[0], rootProcCount); err != nil {
-			t.Fatalf("error waitting for processes: %v", err)
+			t.Fatalf("error waiting for processes: %v", err)
 		}
 		procCount := int(math.Pow(2, 5) - 1)
 		if err := waitForProcessCount(containers[1], procCount); err != nil {

runsc/container/shared_volume_test.go

@@ -240,7 +240,7 @@ func TestSharedVolumeFile(t *testing.T) {
 	// read inside.
 	f, err := os.OpenFile(filename, os.O_APPEND|os.O_WRONLY, 0)
 	if err != nil {
-		t.Fatalf("Error openning file %q: %v", filename, err)
+		t.Fatalf("Error opening file %q: %v", filename, err)
 	}
 	defer f.Close()
 	if _, err := f.Write([]byte("host")); err != nil {

runsc/container/trace_test.go

@@ -345,7 +345,7 @@ func TestProcfsDump(t *testing.T) {
 
 	// Check that bin/sleep is part of the executable path.
 	if wantExeSubStr := "bin/sleep"; !strings.HasSuffix(procfsDump[0].Exe, wantExeSubStr) {
-		t.Errorf("expected %q to be part of execuable path %q", wantExeSubStr, procfsDump[0].Exe)
+		t.Errorf("expected %q to be part of executable path %q", wantExeSubStr, procfsDump[0].Exe)
 	}
 
 	if len(procfsDump[0].Args) != 2 {

runsc/mitigate/mitigate.go

@@ -46,7 +46,7 @@ type CPUSet []*CPU
 // NewCPUSet creates a CPUSet from data read from /proc/cpuinfo.
 func NewCPUSet(data string) (CPUSet, error) {
 	// Each processor entry should start with the
-	// processor key. Find the beginings of each.
+	// processor key. Find the beginnings of each.
 	r := buildRegex(processorKey)
 	indices := r.FindAllStringIndex(data, -1)
 
@@ -59,7 +59,7 @@ func NewCPUSet(data string) (CPUSet, error) {
 
 	// Valid cpus are now defined by strings in between
 	// indexes (e.g. data[index[i], index[i+1]]).
-	// There should be len(indicies) - 1 CPUs
+	// There should be len(indices) - 1 CPUs
 	// since the last index is the end of the string.
 	var set CPUSet
 	// Find each string that represents a CPU. These begin "processor".

runsc/sandbox/sandbox.go

@@ -847,7 +847,7 @@ func (s *Sandbox) createSandboxProcess(conf *config.Config, args *Args, startSyn
 	// shown as `exe`.
 	cmd.Args[0] = "runsc-sandbox"
 
-	// Tranfer FDs that need to be present before the "boot" command.
+	// Transfer FDs that need to be present before the "boot" command.
 	// Start at 3 because 0, 1, and 2 are taken by stdin/out/err.
 	nextFD := donations.Transfer(cmd, 3)