deps: bump go-criu to v8.2.0

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
(cherry picked from commit 269405107f)
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>

go.mod

@@ -3,7 +3,7 @@ module github.com/opencontainers/runc
 go 1.25.0
 
 require (
-	github.com/checkpoint-restore/go-criu/v7 v7.2.0
+	github.com/checkpoint-restore/go-criu/v8 v8.2.0
 	github.com/containerd/console v1.0.5
 	github.com/coreos/go-systemd/v22 v22.7.0
 	github.com/cyphar/filepath-securejoin v0.6.1

go.sum

@@ -1,8 +1,8 @@
 cyphar.com/go-pathrs v0.2.4 h1:iD/mge36swa1UFKdINkr1Frkpp6wZsy3YYEildj9cLY=
 cyphar.com/go-pathrs v0.2.4/go.mod h1:y8f1EMG7r+hCuFf/rXsKqMJrJAUoADZGNh5/vZPKcGc=
 github.com/BurntSushi/toml v1.5.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
-github.com/checkpoint-restore/go-criu/v7 v7.2.0 h1:qGiWA4App1gGlEfIJ68WR9jbezV9J7yZdjzglezcqKo=
+github.com/checkpoint-restore/go-criu/v8 v8.2.0 h1:dsgMgj/eJtZNKn3qn/+Ri0b4bd0uo6o2zt1yd8Nj2NI=
-github.com/checkpoint-restore/go-criu/v7 v7.2.0/go.mod h1:u0LCWLg0w4yqqu14aXhiB4YD3a1qd8EcCEg7vda5dwo=
+github.com/checkpoint-restore/go-criu/v8 v8.2.0/go.mod h1:HVKJ1dK+bowJcFI1MtdL2ECIuY+/AtRMHzD9Lqa4uA4=
 github.com/cilium/ebpf v0.17.3 h1:FnP4r16PWYSE4ux6zN+//jMcW4nMVRvuTLVTvCjyyjg=
 github.com/cilium/ebpf v0.17.3/go.mod h1:G5EDHij8yiLzaqn0WjyfJHvRa+3aDlReIaLVRMvOyJk=
 github.com/containerd/console v1.0.5 h1:R0ymNeydRqH2DmakFNdmjR2k0t7UPuiOV/N/27/qqsc=

libcontainer/criu_linux.go

@@ -17,8 +17,8 @@ import (
 	"time"
 	"unicode"
 
-	"github.com/checkpoint-restore/go-criu/v7"
+	"github.com/checkpoint-restore/go-criu/v8"
-	criurpc "github.com/checkpoint-restore/go-criu/v7/rpc"
+	criurpc "github.com/checkpoint-restore/go-criu/v8/rpc"
 	securejoin "github.com/cyphar/filepath-securejoin"
 	"github.com/sirupsen/logrus"
 	"golang.org/x/sys/unix"

vendor/github.com/checkpoint-restore/go-criu/v7/.golangci.yml

@@ -1,22 +0,0 @@
-linters:
-  presets:
-    - bugs
-    - performance
-    - unused
-    - format
-  disable:
-    - musttag
-  enable:
-    - whitespace
-    - misspell
-    - dupl
-    - gosimple
-    - stylecheck
-
-linters-settings:
-  exhaustive:
-    default-signifies-exhaustive: true
-  gosec:
-    excludes:
-      # https://github.com/securego/gosec/issues/1185
-      - G115

vendor/github.com/checkpoint-restore/go-criu/v7/README.md

@@ -1,112 +0,0 @@
-<!-- markdownlint-configure-file { "no-hard-tabs": { "code_blocks": false } } -->
-# go-criu -- Go bindings for CRIU
-
-[![test](https://github.com/checkpoint-restore/go-criu/workflows/ci/badge.svg?branch=master)](https://github.com/checkpoint-restore/go-criu/actions?query=workflow%3Aci)
-[![verify](https://github.com/checkpoint-restore/go-criu/workflows/verify/badge.svg?branch=master)](https://github.com/checkpoint-restore/go-criu/actions?query=workflow%3Averify)
-[![Go Reference](https://pkg.go.dev/badge/github.com/checkpoint-restore/go-criu.svg)](https://pkg.go.dev/github.com/checkpoint-restore/go-criu)
-
-This repository provides Go bindings for [CRIU](https://criu.org/).
-The code is based on the Go-based PHaul implementation from the CRIU repository.
-For easier inclusion into other Go projects, the CRIU Go bindings have been
-moved to this repository.
-
-## CRIU
-
-The Go bindings provide an easy way to use the CRIU RPC calls from Go without
-the need to set up all the infrastructure to make the actual RPC connection to CRIU.
-
-The following example would print the version of CRIU:
-
-```go
-import (
-	"log"
-
-	"github.com/checkpoint-restore/go-criu/v7"
-)
-
-func main() {
-	c := criu.MakeCriu()
-	version, err := c.GetCriuVersion()
-	if err != nil {
-		log.Fatalln(err)
-	}
-	log.Println(version)
-}
-```
-
-or to just check if at least a certain CRIU version is installed:
-
-```go
-	c := criu.MakeCriu()
-	result, err := c.IsCriuAtLeast(31100)
-```
-
-## CRIT
-
-The `crit` package provides bindings to decode, encode, and manipulate
-CRIU image files natively within Go. It also provides a CLI tool similar
-to the original CRIT Python tool. To get started with this, see the docs
-at [CRIT (Go library)](https://criu.org/CRIT_%28Go_library%29).
-
-## Releases
-
-The first go-criu release was 3.11 based on CRIU 3.11. The initial plan
-was to follow CRIU so that go-criu would carry the same version number as
-CRIU.
-
-As go-criu is imported in other projects and as Go modules are expected
-to follow Semantic Versioning go-criu will also follow Semantic Versioning
-starting with the 4.0.0 release.
-
-The following table shows the relation between go-criu and criu versions:
-
-| Major version  | Latest release | CRIU version |
-| -------------- | -------------- | ------------ |
-| v7             | 7.2.0          | 3.19         |
-| v7             | 7.0.0          | 3.18         |
-| v6             | 6.3.0          | 3.17         |
-| v5             | 5.3.0          | 3.16         |
-| v5             | 5.0.0          | 3.15         |
-| v4             | 4.1.0          | 3.14         |
-
-## How to contribute
-
-While bug fixes can first be identified via an "issue", that is not required.
-It's ok to just open up a PR with the fix, but make sure you include the same
-information you would have included in an issue - like how to reproduce it.
-
-PRs for new features should include some background on what use cases the
-new code is trying to address. When possible and when it makes sense, try to
-break-up larger PRs into smaller ones - it's easier to review smaller
-code changes. But only if those smaller ones make sense as stand-alone PRs.
-
-Regardless of the type of PR, all PRs should include:
-
-* well documented code changes
-* additional testcases. Ideally, they should fail w/o your code change applied
-* documentation changes
-
-Squash your commits into logical pieces of work that might want to be reviewed
-separate from the rest of the PRs. Ideally, each commit should implement a
-single idea, and the PR branch should pass the tests at every commit. GitHub
-makes it easy to review the cumulative effect of many commits; so, when in
-doubt, use smaller commits.
-
-PRs that fix issues should include a reference like `Closes #XXXX` in the
-commit message so that github will automatically close the referenced issue
-when the PR is merged.
-
-Contributors must assert that they are in compliance with the [Developer
-Certificate of Origin 1.1](http://developercertificate.org/). This is achieved
-by adding a "Signed-off-by" line containing the contributor's name and e-mail
-to every commit message. Your signature certifies that you wrote the patch or
-otherwise have the right to pass it on as an open-source patch.
-
-## License and copyright
-
-Unless mentioned otherwise in a specific file's header, all code in
-this project is released under the Apache 2.0 license.
-
-The author of a change remains the copyright holder of their code
-(no copyright assignment). The list of authors and contributors can be
-retrieved from the git commit history and in some cases, the file headers.

vendor/github.com/checkpoint-restore/go-criu/v8/.golangci.yml

@@ -0,0 +1,46 @@
+version: "2"
+
+linters:
+  enable:
+    - bodyclose
+    - dupl
+    - durationcheck
+    - errcheck
+    - errorlint
+    - exhaustive
+    - gosec
+    - govet
+    - misspell
+    - nilerr
+    - prealloc
+    - rowserrcheck
+    - sqlclosecheck
+    - staticcheck
+    - unconvert
+    - unparam
+    - unused
+    - whitespace
+  disable:
+    - musttag
+    - noctx
+  exclusions:
+    generated: lax
+    presets:
+      - comments
+      - common-false-positives
+      - legacy
+      - std-error-handling
+  settings:
+    exhaustive:
+      default-signifies-exhaustive: true
+    gosec:
+      excludes:
+        # https://github.com/securego/gosec/issues/1185
+        - G115
+
+formatters:
+  enable:
+    - gofmt
+    - goimports
+  exclusions:
+    generated: lax

vendor/github.com/checkpoint-restore/go-criu/v8/CONTRIBUTING.md

@@ -0,0 +1,53 @@
+# How to contribute
+
+While bug fixes can first be identified via an "issue", that is not required.
+It's ok to just open up a PR with the fix, but make sure you include the same
+information you would have included in an issue - like how to reproduce it.
+
+PRs for new features should include some background on what use cases the
+new code is trying to address. When possible and when it makes sense, try to
+break-up larger PRs into smaller ones - it's easier to review smaller
+code changes. But only if those smaller ones make sense as stand-alone PRs.
+
+Regardless of the type of PR, all PRs should include:
+
+* well documented code changes;
+* additional testcases: ideally, they should fail w/o your code change applied;
+* documentation changes.
+
+Squash your commits into logical pieces of work that might want to be reviewed
+separate from the rest of the PRs. Ideally, each commit should implement a
+single idea, and the PR branch should pass the tests at every commit. GitHub
+makes it easy to review the cumulative effect of many commits; so, when in
+doubt, use smaller commits.
+
+This project tries to follow CRIU's commit message conventions, although they
+are not strictly enforced. For guidance on writing clear and effective commit
+messages, see [How to Write a Git Commit Message][git-commit].
+
+PRs that fix issues should include a reference like `Closes #XXXX` in the
+commit message so that github will automatically close the referenced issue
+when the PR is merged.
+
+Contributors must assert that they are in compliance with the [Developer
+Certificate of Origin 1.1](http://developercertificate.org/). This is achieved
+by adding a "Signed-off-by" line containing the contributor's name and e-mail
+to every commit message. Your signature certifies that you wrote the patch or
+otherwise have the right to pass it on as an open-source patch.
+
+The use of AI tools is welcome but should be correctly attributed, especially
+for substantial changes. You can use one of the following in your commit
+message:
+
+* `Assisted-by: <AI tool>`
+* `Co-authored-by: <AI tool>`
+* `Generated-by: <AI tool>`
+* Or mention it in the commit message body, e.g., "Generated with <AI tool>"
+
+Marking AI-assisted contributions helps preserve both legal clarity and
+community trust, and makes it easier for reviewers to evaluate the code
+in context. For more information, see [AI-assisted development and open source:
+Navigating the legal issues][ai-legal].
+
+[ai-legal]: https://www.redhat.com/en/blog/ai-assisted-development-and-open-source-navigating-legal-issues
+[git-commit]: https://chris.beams.io/posts/git-commit/

vendor/github.com/checkpoint-restore/go-criu/v8/README.md

@@ -0,0 +1,85 @@
+<!-- markdownlint-configure-file { "no-hard-tabs": { "code_blocks": false } } -->
+# go-criu -- Go bindings for CRIU
+
+[![ci](https://github.com/checkpoint-restore/go-criu/actions/workflows/main.yml/badge.svg)](https://github.com/checkpoint-restore/go-criu/actions/workflows/main.yml)
+[![verify](https://github.com/checkpoint-restore/go-criu/actions/workflows/verify.yml/badge.svg)](https://github.com/checkpoint-restore/go-criu/actions/workflows/verify.yml)
+[![Go Reference](https://pkg.go.dev/badge/github.com/checkpoint-restore/go-criu.svg)](https://pkg.go.dev/github.com/checkpoint-restore/go-criu)
+
+This repository provides Go bindings for [CRIU](https://criu.org/).
+The code is based on the Go-based PHaul implementation from the CRIU repository.
+For easier inclusion into other Go projects, the CRIU Go bindings have been
+moved to this repository.
+
+## CRIU
+
+The Go bindings provide an easy way to use the CRIU RPC calls from Go without
+the need to set up all the infrastructure to make the actual RPC connection to CRIU.
+
+The following example would print the version of CRIU:
+
+```go
+import (
+	"log"
+
+	"github.com/checkpoint-restore/go-criu/v8"
+)
+
+func main() {
+	c := criu.MakeCriu()
+	version, err := c.GetCriuVersion()
+	if err != nil {
+		log.Fatalln(err)
+	}
+	log.Println(version)
+}
+```
+
+or to just check if at least a certain CRIU version is installed:
+
+```go
+	c := criu.MakeCriu()
+	result, err := c.IsCriuAtLeast(31100)
+```
+
+## CRIT
+
+The `crit` package provides bindings to decode, encode, and manipulate
+CRIU image files natively within Go. It also provides a CLI tool similar
+to the original CRIT Python tool. To get started with this, see the docs
+at [CRIT (Go library)](https://criu.org/CRIT_%28Go_library%29).
+
+## Releases
+
+The first go-criu release was 3.11 based on CRIU 3.11. The initial plan
+was to follow CRIU so that go-criu would carry the same version number as
+CRIU.
+
+As go-criu is imported in other projects and as Go modules are expected
+to follow Semantic Versioning go-criu will also follow Semantic Versioning
+starting with the 4.0.0 release.
+
+The following table shows the relation between go-criu and criu versions:
+
+| Major version  | Latest release | CRIU version |
+| -------------- | -------------- | ------------ |
+| v8             | 8.2.0          | 4.2          |
+| v7             | 7.2.0          | 3.19         |
+| v7             | 7.0.0          | 3.18         |
+| v6             | 6.3.0          | 3.17         |
+| v5             | 5.3.0          | 3.16         |
+| v5             | 5.0.0          | 3.15         |
+| v4             | 4.1.0          | 3.14         |
+
+## How to contribute
+
+See [CONTRIBUTING.md](CONTRIBUTING.md) for details on how to contribute to this
+project.
+
+## License and copyright
+
+Unless mentioned otherwise in a specific file's header, all code in
+this project is released under the Apache 2.0 license.
+
+The author of a change remains the copyright holder of their code
+(no copyright assignment). The list of authors and contributors can be
+retrieved from the git commit history and in some cases, the file headers.

vendor/github.com/checkpoint-restore/go-criu/v8/features.go

@@ -3,7 +3,7 @@ package criu
 import (
 	"errors"
 
-	"github.com/checkpoint-restore/go-criu/v7/rpc"
+	"github.com/checkpoint-restore/go-criu/v8/rpc"
 )
 
 // Feature checking in go-criu is based on the libcriu feature checking function.

vendor/github.com/checkpoint-restore/go-criu/v8/main.go

@@ -5,18 +5,24 @@ import (
 	"fmt"
 	"os"
 	"os/exec"
+	"sort"
 	"strconv"
 	"syscall"
 
-	"github.com/checkpoint-restore/go-criu/v7/rpc"
+	"github.com/checkpoint-restore/go-criu/v8/rpc"
 	"google.golang.org/protobuf/proto"
 )
 
+// extraFilesStartFd is the first fd number assigned to cmd.ExtraFiles by os/exec.
+// As documented in os/exec: "entry i becomes file descriptor 3+i"
+const extraFilesStartFd = 3
+
 // Criu struct
 type Criu struct {
-	swrkCmd  *exec.Cmd
+	swrkCmd    *exec.Cmd
-	swrkSk   *os.File
+	swrkSk     *os.File
-	swrkPath string
+	swrkPath   string
+	inheritFds map[string]*os.File
 }
 
 // MakeCriu returns the Criu object required for most operations
@@ -32,8 +38,52 @@ func (c *Criu) SetCriuPath(path string) {
 	c.swrkPath = path
 }
 
+// AddInheritFd registers a file descriptor to be passed to CRIU.
+// If opts.InheritFd is not set for an operation, it will be populated
+// from these registrations using the same key order.
+func (c *Criu) AddInheritFd(key string, file *os.File) {
+	if c.inheritFds == nil {
+		c.inheritFds = make(map[string]*os.File)
+	}
+	c.inheritFds[key] = file
+}
+
+func (c *Criu) inheritFdKeys() []string {
+	if len(c.inheritFds) == 0 {
+		return nil
+	}
+	keys := make([]string, 0, len(c.inheritFds))
+	for k := range c.inheritFds {
+		keys = append(keys, k)
+	}
+	sort.Strings(keys)
+	return keys
+}
+
+func (c *Criu) ensureInheritFd(opts *rpc.CriuOpts) {
+	if opts == nil || len(opts.GetInheritFd()) > 0 || len(c.inheritFds) == 0 {
+		return
+	}
+	keys := c.inheritFdKeys()
+	if len(keys) == 0 {
+		return
+	}
+	opts.InheritFd = make([]*rpc.InheritFd, 0, len(keys))
+	for i, key := range keys {
+		fd := int32(extraFilesStartFd + i)
+		opts.InheritFd = append(opts.InheritFd, &rpc.InheritFd{
+			Key: proto.String(key),
+			Fd:  proto.Int32(fd),
+		})
+	}
+}
+
 // Prepare sets up everything for the RPC communication to CRIU
 func (c *Criu) Prepare() error {
+	return c.doPrepare(nil)
+}
+
+func (c *Criu) doPrepare(opts *rpc.CriuOpts) error {
 	fds, err := syscall.Socketpair(syscall.AF_LOCAL, syscall.SOCK_SEQPACKET, 0)
 	if err != nil {
 		return err
@@ -42,15 +92,28 @@ func (c *Criu) Prepare() error {
 	cln := os.NewFile(uintptr(fds[0]), "criu-xprt-cln")
 	syscall.CloseOnExec(fds[0])
 	srv := os.NewFile(uintptr(fds[1]), "criu-xprt-srv")
-	defer srv.Close()
+	defer func() { _ = srv.Close() }()
 
 	args := []string{"swrk", strconv.Itoa(fds[1])}
 	// #nosec G204
 	cmd := exec.Command(c.swrkPath, args...)
 
+	// Collect file descriptors to pass to child
+	inheritKeys := c.inheritFdKeys()
+	extraFiles := make([]*os.File, 0, len(inheritKeys))
+
+	// Add fds from AddInheritFd (sorted for stable ordering)
+	for _, k := range inheritKeys {
+		extraFiles = append(extraFiles, c.inheritFds[k])
+	}
+
+	c.ensureInheritFd(opts)
+
+	cmd.ExtraFiles = extraFiles
+
 	err = cmd.Start()
 	if err != nil {
-		cln.Close()
+		_ = cln.Close()
 		return err
 	}
 
@@ -106,6 +169,8 @@ func (c *Criu) doSwrk(reqType rpc.CriuReqType, opts *rpc.CriuOpts, nfy Notify) e
 }
 
 func (c *Criu) doSwrkWithResp(reqType rpc.CriuReqType, opts *rpc.CriuOpts, nfy Notify, features *rpc.CriuFeatures) (resp *rpc.CriuResp, retErr error) {
+	c.ensureInheritFd(opts)
+
 	req := rpc.CriuReq{
 		Type: &reqType,
 		Opts: opts,
@@ -120,7 +185,7 @@ func (c *Criu) doSwrkWithResp(reqType rpc.CriuReqType, opts *rpc.CriuOpts, nfy N
 	}
 
 	if c.swrkCmd == nil {
-		err := c.Prepare()
+		err := c.doPrepare(opts)
 		if err != nil {
 			return nil, err
 		}

vendor/modules.txt

@@ -4,10 +4,10 @@ cyphar.com/go-pathrs
 cyphar.com/go-pathrs/internal/fdutils
 cyphar.com/go-pathrs/internal/libpathrs
 cyphar.com/go-pathrs/procfs
-# github.com/checkpoint-restore/go-criu/v7 v7.2.0
+# github.com/checkpoint-restore/go-criu/v8 v8.2.0
-## explicit; go 1.20
+## explicit; go 1.24.0
-github.com/checkpoint-restore/go-criu/v7
+github.com/checkpoint-restore/go-criu/v8
-github.com/checkpoint-restore/go-criu/v7/rpc
+github.com/checkpoint-restore/go-criu/v8/rpc
 # github.com/cilium/ebpf v0.17.3
 ## explicit; go 1.22
 github.com/cilium/ebpf