Repository: opencontainers/runc
Pull request #4577 (2025-01-04 03:18:06)

libct/devices: move config to libct/cg/devices/config
_This is the next step to facilitate separation of libct/cgroups as per https://github.com/opencontainers/tob/blob/main/proposals/cgroups.md_

Currently, libcontainer/devices contains two things:
    
1. Device-related configuration data structures and accompanying
    methods. Those are used by runc itself, mostly by libct/cgroups.
    
2. A few functions (HostDevices, DeviceFromPath, GetDevices).
   Those are not used by runc directly, but have some external users
   (cri-o, microsoft/hcsshim), and they also have a few forks
   (containerd/pkg/oci, podman/pkg/util).
    
This commit moves (1) to a new separate package, `config` (under
`libcontainer/cgroups/devices`), adding a backward-compatible aliases
(marked as deprecated so we will be able to remove those later).

(As for (2), I think something like https://github.com/moby/sys/issues/181 should be done)


kolyshkin: So,
1. this CAN NOT be moved to `libcontainer/cgroups` (like we did with the rest of cgroups-related configs in #4472) because some IDs (`Type`, `Rule`, `Permissions`) are too generic, and renaming them (to `DeviceType`, `DeviceRule`,  DevicePermissions`) will break backward compatibility (mostly due to `Rule` being embedded into `Device`);
2. this CAN NOT be moved to `libcontainer/cgroups/devices` as it is a special package (importing it enables cgroup managers to manage devices (see https://github.com/opencontainers/runc/blob/main/libcontainer/cgroups/devices/devices.go) and makes binaries larger due to more dependencies like cilium/ebpf);
3. this CAN be moved to any other new package under libct/cgroups, e.g. `libcontainer/cgroups/devconfig` or something like this) -- please let me know it it's better than `devices/config`;
4. this COULD HAVE BEEN moved to `libcontainer/cgroups/configs` but in  #4472 we've decided to go without this package (although I should have thought about devices at that time, and I missed it).

So, it's either the way it is now in this PR, or we can break the backward compatibility and go with 1, or we go with 3.

WDYT @thaJeztah ?
kolyshkin: I want libcontainer/cgroups to be moved to https://github.com/opencontainers/cgroups before we hit v1.3.0, and this is a necessary step. PTAL @opencontainers/runc-maintainers :pray:


Patch:
diff --git a/libcontainer/cgroups/config_linux.go b/libcontainer/cgroups/config_linux.go
index f1e8a157..3052ef50 100644
--- a/libcontainer/cgroups/config_linux.go
+++ b/libcontainer/cgroups/config_linux.go
@@ -2,7 +2,7 @@ package cgroups
 
 import (
 	systemdDbus "github.com/coreos/go-systemd/v22/dbus"
-	"github.com/opencontainers/runc/libcontainer/devices"
+	devices "github.com/opencontainers/runc/libcontainer/cgroups/devices/config"
 )
 
 type FreezerState string
diff --git a/libcontainer/devices/device.go b/libcontainer/cgroups/devices/config/device.go
similarity index 99%
rename from libcontainer/devices/device.go
rename to libcontainer/cgroups/devices/config/device.go
index c2c2b3bb..05ad3ef8 100644
--- a/libcontainer/devices/device.go
+++ b/libcontainer/cgroups/devices/config/device.go
@@ -1,4 +1,4 @@
-package devices
+package config
 
 import (
 	"fmt"
diff --git a/libcontainer/cgroups/devices/config/mknod_unix.go b/libcontainer/cgroups/devices/config/mknod_unix.go
new file mode 100644
index 00000000..98cdc6e2
--- /dev/null
+++ b/libcontainer/cgroups/devices/config/mknod_unix.go
@@ -0,0 +1,14 @@
+package config
+
+import (
+	"errors"
+
+	"golang.org/x/sys/unix"
+)
+
+func mkDev(d *Rule) (uint64, error) {
+	if d.Major == Wildcard || d.Minor == Wildcard {
+		return 0, errors.New("cannot mkdev() device with wildcards")
+	}
+	return unix.Mkdev(uint32(d.Major), uint32(d.Minor)), nil
+}
diff --git a/libcontainer/cgroups/devices/devicefilter.go b/libcontainer/cgroups/devices/devicefilter.go
index 5f59352b..416c7f27 100644
--- a/libcontainer/cgroups/devices/devicefilter.go
+++ b/libcontainer/cgroups/devices/devicefilter.go
@@ -13,7 +13,7 @@ import (
 	"strconv"
 
 	"github.com/cilium/ebpf/asm"
-	"github.com/opencontainers/runc/libcontainer/devices"
+	devices "github.com/opencontainers/runc/libcontainer/cgroups/devices/config"
 	"golang.org/x/sys/unix"
 )
 
diff --git a/libcontainer/cgroups/devices/devices_emulator.go b/libcontainer/cgroups/devices/devices_emulator.go
index 3e1f49f0..81ff206a 100644
--- a/libcontainer/cgroups/devices/devices_emulator.go
+++ b/libcontainer/cgroups/devices/devices_emulator.go
@@ -26,7 +26,7 @@ import (
 	"strconv"
 	"strings"
 
-	"github.com/opencontainers/runc/libcontainer/devices"
+	devices "github.com/opencontainers/runc/libcontainer/cgroups/devices/config"
 )
 
 // deviceMeta is a Rule without the Allow or Permissions fields, and no
diff --git a/libcontainer/cgroups/devices/systemd.go b/libcontainer/cgroups/devices/systemd.go
index e1251c5f..4851b561 100644
--- a/libcontainer/cgroups/devices/systemd.go
+++ b/libcontainer/cgroups/devices/systemd.go
@@ -12,7 +12,7 @@ import (
 	"github.com/sirupsen/logrus"
 
 	"github.com/opencontainers/runc/libcontainer/cgroups"
-	"github.com/opencontainers/runc/libcontainer/devices"
+	devices "github.com/opencontainers/runc/libcontainer/cgroups/devices/config"
 )
 
 // systemdProperties takes the configured device rules and generates a
diff --git a/libcontainer/cgroups/devices/v1.go b/libcontainer/cgroups/devices/v1.go
index 17e11847..27a7ab29 100644
--- a/libcontainer/cgroups/devices/v1.go
+++ b/libcontainer/cgroups/devices/v1.go
@@ -7,7 +7,7 @@ import (
 
 	"github.com/moby/sys/userns"
 	"github.com/opencontainers/runc/libcontainer/cgroups"
-	"github.com/opencontainers/runc/libcontainer/devices"
+	devices "github.com/opencontainers/runc/libcontainer/cgroups/devices/config"
 )
 
 var testingSkipFinalCheck bool
diff --git a/libcontainer/cgroups/devices/v2.go b/libcontainer/cgroups/devices/v2.go
index 23ac09f7..911d1ce2 100644
--- a/libcontainer/cgroups/devices/v2.go
+++ b/libcontainer/cgroups/devices/v2.go
@@ -7,7 +7,7 @@ import (
 	"golang.org/x/sys/unix"
 
 	"github.com/opencontainers/runc/libcontainer/cgroups"
-	"github.com/opencontainers/runc/libcontainer/devices"
+	devices "github.com/opencontainers/runc/libcontainer/cgroups/devices/config"
 )
 
 func isRWM(perms devices.Permissions) bool {
diff --git a/libcontainer/configs/config.go b/libcontainer/configs/config.go
index 0e0ba57b..746c7190 100644
--- a/libcontainer/configs/config.go
+++ b/libcontainer/configs/config.go
@@ -10,7 +10,7 @@ import (
 	"github.com/sirupsen/logrus"
 	"golang.org/x/sys/unix"
 
-	"github.com/opencontainers/runc/libcontainer/devices"
+	devices "github.com/opencontainers/runc/libcontainer/cgroups/devices/config"
 	"github.com/opencontainers/runtime-spec/specs-go"
 )
 
diff --git a/libcontainer/devices/device_deprecated.go b/libcontainer/devices/device_deprecated.go
new file mode 100644
index 00000000..6e960a42
--- /dev/null
+++ b/libcontainer/devices/device_deprecated.go
@@ -0,0 +1,20 @@
+package devices
+
+import "github.com/opencontainers/runc/libcontainer/cgroups/devices/config"
+
+// Deprecated: use [github.com/opencontainers/runc/libcontainer/cgroups/devices/config].
+const (
+	Wildcard       = config.Wildcard
+	WildcardDevice = config.WildcardDevice
+	BlockDevice    = config.BlockDevice
+	CharDevice     = config.CharDevice
+	FifoDevice     = config.FifoDevice
+)
+
+// Deprecated: use [github.com/opencontainers/runc/libcontainer/cgroups/devices/config].
+type (
+	Device      = config.Device
+	Permissions = config.Permissions
+	Type        = config.Type
+	Rule        = config.Rule
+)
diff --git a/libcontainer/devices/device_unix.go b/libcontainer/devices/device_unix.go
index d00775f5..c533eb1c 100644
--- a/libcontainer/devices/device_unix.go
+++ b/libcontainer/devices/device_unix.go
@@ -19,13 +19,6 @@ var (
 	osReadDir = os.ReadDir
 )
 
-func mkDev(d *Rule) (uint64, error) {
-	if d.Major == Wildcard || d.Minor == Wildcard {
-		return 0, errors.New("cannot mkdev() device with wildcards")
-	}
-	return unix.Mkdev(uint32(d.Major), uint32(d.Minor)), nil
-}
-
 // DeviceFromPath takes the path to a device and its cgroup_permissions (which
 // cannot be easily queried) to look up the information about a linux device
 // and returns that information as a Device struct.
diff --git a/libcontainer/rootfs_linux.go b/libcontainer/rootfs_linux.go
index 158e03c5..012b0506 100644
--- a/libcontainer/rootfs_linux.go
+++ b/libcontainer/rootfs_linux.go
@@ -22,9 +22,9 @@ import (
 	"golang.org/x/sys/unix"
 
 	"github.com/opencontainers/runc/libcontainer/cgroups"
+	devices "github.com/opencontainers/runc/libcontainer/cgroups/devices/config"
 	"github.com/opencontainers/runc/libcontainer/cgroups/fs2"
 	"github.com/opencontainers/runc/libcontainer/configs"
-	"github.com/opencontainers/runc/libcontainer/devices"
 	"github.com/opencontainers/runc/libcontainer/utils"
 )
 
diff --git a/libcontainer/specconv/spec_linux.go b/libcontainer/specconv/spec_linux.go
index 6e3e5bde..c8446a56 100644
--- a/libcontainer/specconv/spec_linux.go
+++ b/libcontainer/specconv/spec_linux.go
@@ -15,8 +15,8 @@ import (
 	systemdDbus "github.com/coreos/go-systemd/v22/dbus"
 	dbus "github.com/godbus/dbus/v5"
 	"github.com/opencontainers/runc/libcontainer/cgroups"
+	devices "github.com/opencontainers/runc/libcontainer/cgroups/devices/config"
 	"github.com/opencontainers/runc/libcontainer/configs"
-	"github.com/opencontainers/runc/libcontainer/devices"
 	"github.com/opencontainers/runc/libcontainer/internal/userns"
 	"github.com/opencontainers/runc/libcontainer/seccomp"
 	libcontainerUtils "github.com/opencontainers/runc/libcontainer/utils"


Test patch:
diff --git a/libcontainer/cgroups/devices/devicefilter_test.go b/libcontainer/cgroups/devices/devicefilter_test.go
index 23ad92ea..197039a7 100644
--- a/libcontainer/cgroups/devices/devicefilter_test.go
+++ b/libcontainer/cgroups/devices/devicefilter_test.go
@@ -4,7 +4,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/opencontainers/runc/libcontainer/devices"
+	devices "github.com/opencontainers/runc/libcontainer/cgroups/devices/config"
 	"github.com/opencontainers/runc/libcontainer/specconv"
 )
 
diff --git a/libcontainer/cgroups/devices/devices_emulator_test.go b/libcontainer/cgroups/devices/devices_emulator_test.go
index 51c1f521..c107618c 100644
--- a/libcontainer/cgroups/devices/devices_emulator_test.go
+++ b/libcontainer/cgroups/devices/devices_emulator_test.go
@@ -25,7 +25,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/opencontainers/runc/libcontainer/devices"
+	devices "github.com/opencontainers/runc/libcontainer/cgroups/devices/config"
 )
 
 func TestDeviceEmulatorLoad(t *testing.T) {
diff --git a/libcontainer/cgroups/devices/systemd_test.go b/libcontainer/cgroups/devices/systemd_test.go
index ef802007..0b3e3d4e 100644
--- a/libcontainer/cgroups/devices/systemd_test.go
+++ b/libcontainer/cgroups/devices/systemd_test.go
@@ -9,8 +9,8 @@ import (
 	"testing"
 
 	"github.com/opencontainers/runc/libcontainer/cgroups"
+	devices "github.com/opencontainers/runc/libcontainer/cgroups/devices/config"
 	"github.com/opencontainers/runc/libcontainer/cgroups/systemd"
-	"github.com/opencontainers/runc/libcontainer/devices"
 )
 
 // TestPodSkipDevicesUpdate checks that updating a pod having SkipDevices: true
diff --git a/libcontainer/cgroups/devices/v1_test.go b/libcontainer/cgroups/devices/v1_test.go
index 2deb56c6..5781169b 100644
--- a/libcontainer/cgroups/devices/v1_test.go
+++ b/libcontainer/cgroups/devices/v1_test.go
@@ -8,8 +8,8 @@ import (
 	"github.com/moby/sys/userns"
 
 	"github.com/opencontainers/runc/libcontainer/cgroups"
+	devices "github.com/opencontainers/runc/libcontainer/cgroups/devices/config"
 	"github.com/opencontainers/runc/libcontainer/cgroups/fscommon"
-	"github.com/opencontainers/runc/libcontainer/devices"
 )
 
 func init() {
diff --git a/libcontainer/integration/template_test.go b/libcontainer/integration/template_test.go
index 9c5e18c6..4d31acb0 100644
--- a/libcontainer/integration/template_test.go
+++ b/libcontainer/integration/template_test.go
@@ -7,8 +7,8 @@ import (
 	"time"
 
 	"github.com/opencontainers/runc/libcontainer/cgroups"
+	devices "github.com/opencontainers/runc/libcontainer/cgroups/devices/config"
 	"github.com/opencontainers/runc/libcontainer/configs"
-	"github.com/opencontainers/runc/libcontainer/devices"
 	"github.com/opencontainers/runc/libcontainer/specconv"
 	"golang.org/x/sys/unix"
 )
diff --git a/libcontainer/integration/update_test.go b/libcontainer/integration/update_test.go
index 5678b6f6..68e77b5d 100644
--- a/libcontainer/integration/update_test.go
+++ b/libcontainer/integration/update_test.go
@@ -7,8 +7,8 @@ import (
 	"testing"
 
 	"github.com/opencontainers/runc/libcontainer"
+	devices "github.com/opencontainers/runc/libcontainer/cgroups/devices/config"
 	"github.com/opencontainers/runc/libcontainer/cgroups/systemd"
-	"github.com/opencontainers/runc/libcontainer/devices"
 )
 
 func testUpdateDevices(t *testing.T, systemd bool) {
diff --git a/libcontainer/specconv/spec_linux_test.go b/libcontainer/specconv/spec_linux_test.go
index 8c7fb774..c8d4ae46 100644
--- a/libcontainer/specconv/spec_linux_test.go
+++ b/libcontainer/specconv/spec_linux_test.go
@@ -6,9 +6,9 @@ import (
 	"testing"
 
 	dbus "github.com/godbus/dbus/v5"
+	devices "github.com/opencontainers/runc/libcontainer/cgroups/devices/config"
 	"github.com/opencontainers/runc/libcontainer/configs"
 	"github.com/opencontainers/runc/libcontainer/configs/validate"
-	"github.com/opencontainers/runc/libcontainer/devices"
 	"github.com/opencontainers/runtime-spec/specs-go"
 	"golang.org/x/sys/unix"
 )