From ac7909922ed52820e3c4e2c53b05b41e218a50f3 Mon Sep 17 00:00:00 2001
From: Aleksa Sarai <cyphar@cyphar.com>
Date: Mon, 2 Feb 2026 13:04:50 +0100
Subject: [PATCH] [1.4] build: rename /opt/libseccomp cdylib directory

In a future patch this will contain other cdylibs so it deserves a
slightly more general name.

Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
(cherry picked from commit 8292574e7ab4cf78246ccbe1eaf64c2eb883fefe)
Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
---
 Dockerfile              | 10 ++++++----
 script/release_build.sh | 23 +++++++++--------------
 2 files changed, 15 insertions(+), 18 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index f97f3036b..9f5bbc096 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -54,14 +54,16 @@ RUN cd /tmp \
     && ./install.sh /usr/local \
     && rm -rf /tmp/bats-core
 
+ENV DYLIB_DIR=/opt/runc-dylibs
+
 # install libseccomp
 ARG LIBSECCOMP_VERSION
 COPY script/seccomp.sh script/lib.sh /tmp/script/
-RUN mkdir -p /opt/libseccomp \
-    && /tmp/script/seccomp.sh "$LIBSECCOMP_VERSION" /opt/libseccomp 386 amd64 arm64 armel armhf ppc64le riscv64 s390x
+RUN mkdir -p $DYLIB_DIR \
+    && /tmp/script/seccomp.sh "$LIBSECCOMP_VERSION" $DYLIB_DIR 386 amd64 arm64 armel armhf ppc64le riscv64 s390x
 ENV LIBSECCOMP_VERSION=$LIBSECCOMP_VERSION
-ENV LD_LIBRARY_PATH=/opt/libseccomp/lib
-ENV PKG_CONFIG_PATH=/opt/libseccomp/lib/pkgconfig
+ENV LD_LIBRARY_PATH=$DYLIB_DIR/lib
+ENV PKG_CONFIG_PATH=$DYLIB_DIR/lib/pkgconfig
 
 # Prevent the "fatal: detected dubious ownership in repository" git complain during build.
 RUN git config --global --add safe.directory /go/src/github.com/opencontainers/runc
diff --git a/script/release_build.sh b/script/release_build.sh
index 5e0b90773..8e0b6c661 100755
--- a/script/release_build.sh
+++ b/script/release_build.sh
@@ -40,14 +40,14 @@ function build_project() {
 	shift
 	local arches=("$@")
 
-	# Assume that if /opt/libseccomp exists, then we are run
-	# via Dockerfile, and seccomp is already built.
-	local seccompdir=/opt/libseccomp temp_dir
-	if [ ! -d "$seccompdir" ]; then
-		temp_dir="$(mktemp -d)"
-		seccompdir="$temp_dir"
+	# Assume that if /opt/runc-dylibs exists, then we are running via
+	# Dockerfile, and thus seccomp is already built. Otherwise, build it now.
+	local dylibdir=/opt/runc-dylibs
+	if ! [ -d "$dylibdir" ]; then
+		trap 'rm -rf "$dylibdir"' EXIT
+		dylibdir="$(mktemp -d)"
 		# Download and build libseccomp.
-		"$root/script/seccomp.sh" "$LIBSECCOMP_VERSION" "$seccompdir" "${arches[@]}"
+		"$root/script/seccomp.sh" "$LIBSECCOMP_VERSION" "$dylibdir" "${arches[@]}"
 	fi
 
 	# For reproducible builds, add these to EXTRA_LDFLAGS:
@@ -70,7 +70,7 @@ function build_project() {
 		CFLAGS="$original_cflags"
 		set_cross_vars "$arch"
 		make -C "$root" \
-			PKG_CONFIG_PATH="$seccompdir/$arch/lib/pkgconfig" \
+			PKG_CONFIG_PATH="$dylibdir/$arch/lib/pkgconfig" \
 			"${make_args[@]}"
 		"$STRIP" "$root/$project"
 		mv "$root/$project" "$builddir/$project.$arch"
@@ -85,12 +85,7 @@ function build_project() {
 	fi
 
 	# Copy libseccomp source tarball.
-	cp "$seccompdir"/src/* "$builddir"
-
-	# Clean up.
-	if [ -n "$tempdir" ]; then
-		rm -rf "$tempdir"
-	fi
+	cp "$dylibdir"/src/* "$builddir"
 }
 
 # End of the easy-to-configure portion.