Drop Go 1.15 support

.github/workflows/test.yml

@@ -21,7 +21,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        go-version: [1.15.x, 1.16.x, 1.17.x]
+        go-version: [1.16.x, 1.17.x]
         rootless: ["rootless", ""]
         race: ["-race", ""]
         criu: [""]
@@ -119,7 +119,9 @@ jobs:
         sudo apt -q install libseccomp-dev libseccomp-dev:i386 gcc-multilib criu
 
     - name: install go
-      uses: actions/setup-go@v2 # use default Go version
+      uses: actions/setup-go@v2
+      with:
+        go-version: 1.x # Latest stable
 
     - name: unit test
       # cgo is disabled by default when cross-compiling

.github/workflows/validate.yml

@@ -30,6 +30,10 @@ jobs:
       CGO_CFLAGS: -g -O2 -Werror
     steps:
       - uses: actions/checkout@v2
+      - name: install go
+        uses: actions/setup-go@v2
+        with:
+          go-version: 1.x # Latest stable
       - name: compile with no build tags
         run: make BUILDTAGS=""
 
@@ -93,6 +97,10 @@ jobs:
     runs-on: ubuntu-20.04
     steps:
     - uses: actions/checkout@v2
+    - name: install go
+      uses: actions/setup-go@v2
+      with:
+        go-version: 1.x # Latest stable
     - name: cache go mod and $GOCACHE
       uses: actions/cache@v2
       with:

README.md

@@ -23,7 +23,7 @@ A third party security audit was performed by Cure53, you can see the full repor
 
 ## Building
 
-`runc` only supports Linux. It must be built with Go version 1.15 or higher.
+`runc` only supports Linux. It must be built with Go version 1.16 or higher.
 
 In order to enable seccomp support you will need to install `libseccomp` on your platform.
 > e.g. `libseccomp-devel` for CentOS, or `libseccomp-dev` for Ubuntu
@@ -110,7 +110,7 @@ You can run a test using your container engine's flags by setting `CONTAINER_ENG
 
 `runc` uses [Go Modules](https://github.com/golang/go/wiki/Modules) for dependencies management.
 Please refer to [Go Modules](https://github.com/golang/go/wiki/Modules) for how to add or update
-new dependencies. When updating dependencies, be sure that you are running Go `1.14` or newer.
+new dependencies.
 
 ```
 # Update vendored dependencies

contrib/cmd/recvtty/recvtty.go

@@ -20,7 +20,6 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"net"
 	"os"
 	"strings"
@@ -177,7 +176,7 @@ func handleNull(path string) error {
 				return
 			}
 
-			_, _ = io.Copy(ioutil.Discard, master)
+			_, _ = io.Copy(io.Discard, master)
 		}(conn)
 	}
 }
@@ -225,7 +224,7 @@ func main() {
 		pidPath := ctx.String("pid-file")
 		if pidPath != "" {
 			pid := fmt.Sprintf("%d\n", os.Getpid())
-			if err := ioutil.WriteFile(pidPath, []byte(pid), 0o644); err != nil {
+			if err := os.WriteFile(pidPath, []byte(pid), 0o644); err != nil {
 				return err
 			}
 		}

contrib/cmd/seccompagent/seccompagent.go

@@ -9,7 +9,6 @@ import (
 	"errors"
 	"flag"
 	"fmt"
-	"io/ioutil"
 	"net"
 	"os"
 	"path/filepath"
@@ -246,7 +245,7 @@ func main() {
 
 	if pidFile != "" {
 		pid := fmt.Sprintf("%d", os.Getpid())
-		if err := ioutil.WriteFile(pidFile, []byte(pid), 0o644); err != nil {
+		if err := os.WriteFile(pidFile, []byte(pid), 0o644); err != nil {
 			logrus.Fatalf("Cannot write pid file: %v", err)
 		}
 	}

go.mod

@@ -1,6 +1,6 @@
 module github.com/opencontainers/runc
 
-go 1.15
+go 1.16
 
 require (
 	github.com/checkpoint-restore/go-criu/v5 v5.1.0

libcontainer/apparmor/apparmor_linux.go

@@ -3,7 +3,6 @@ package apparmor
 import (
 	"errors"
 	"fmt"
-	"io/ioutil"
 	"os"
 	"sync"
 
@@ -19,7 +18,7 @@ var (
 func isEnabled() bool {
 	checkAppArmor.Do(func() {
 		if _, err := os.Stat("/sys/kernel/security/apparmor"); err == nil {
-			buf, err := ioutil.ReadFile("/sys/module/apparmor/parameters/enabled")
+			buf, err := os.ReadFile("/sys/module/apparmor/parameters/enabled")
 			appArmorEnabled = err == nil && len(buf) > 1 && buf[0] == 'Y'
 		}
 	})

libcontainer/capabilities/capabilities_linux_test.go

@@ -1,7 +1,7 @@
 package capabilities
 
 import (
-	"io/ioutil"
+	"io"
 	"os"
 	"testing"
 
@@ -24,7 +24,7 @@ func TestNew(t *testing.T) {
 	hook := test.NewGlobal()
 	defer hook.Reset()
 
-	logrus.SetOutput(ioutil.Discard)
+	logrus.SetOutput(io.Discard)
 	caps, err := New(&conf)
 	logrus.SetOutput(os.Stderr)
 

libcontainer/cgroups/fs/blkio_test.go

@@ -258,7 +258,7 @@ func TestBlkioSetMultipleWeightDevice(t *testing.T) {
 
 	wd1 := configs.NewWeightDevice(8, 0, 500, 0)
 	wd2 := configs.NewWeightDevice(8, 16, 500, 0)
-	// we cannot actually set and check both because normal ioutil.WriteFile
+	// we cannot actually set and check both because normal os.WriteFile
 	// when writing to cgroup file will overwrite the whole file content instead
 	// of updating it as the kernel is doing. Just check the second device
 	// is present will suffice for the test to ensure multiple writes are done.

libcontainer/cgroups/fs2/io_test.go

@@ -1,7 +1,7 @@
 package fs2
 
 import (
-	"io/ioutil"
+	"os"
 	"path/filepath"
 	"reflect"
 	"sort"
@@ -62,7 +62,7 @@ func TestStatIo(t *testing.T) {
 	fakeCgroupDir := t.TempDir()
 	statPath := filepath.Join(fakeCgroupDir, "io.stat")
 
-	if err := ioutil.WriteFile(statPath, []byte(exampleIoStatData), 0o644); err != nil {
+	if err := os.WriteFile(statPath, []byte(exampleIoStatData), 0o644); err != nil {
 		t.Fatal(err)
 	}
 

libcontainer/cgroups/fscommon/utils_test.go

@@ -1,7 +1,6 @@
 package fscommon
 
 import (
-	"io/ioutil"
 	"math"
 	"os"
 	"path/filepath"
@@ -27,7 +26,7 @@ func TestGetCgroupParamsInt(t *testing.T) {
 	tempFile := filepath.Join(tempDir, cgroupFile)
 
 	// Success.
-	if err := ioutil.WriteFile(tempFile, []byte(floatString), 0o755); err != nil {
+	if err := os.WriteFile(tempFile, []byte(floatString), 0o755); err != nil {
 		t.Fatal(err)
 	}
 	value, err := GetCgroupParamUint(tempDir, cgroupFile)
@@ -38,7 +37,7 @@ func TestGetCgroupParamsInt(t *testing.T) {
 	}
 
 	// Success with new line.
-	err = ioutil.WriteFile(tempFile, []byte(floatString+"\n"), 0o755)
+	err = os.WriteFile(tempFile, []byte(floatString+"\n"), 0o755)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -50,7 +49,7 @@ func TestGetCgroupParamsInt(t *testing.T) {
 	}
 
 	// Success with negative values
-	err = ioutil.WriteFile(tempFile, []byte("-12345"), 0o755)
+	err = os.WriteFile(tempFile, []byte("-12345"), 0o755)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -63,7 +62,7 @@ func TestGetCgroupParamsInt(t *testing.T) {
 
 	// Success with negative values lesser than min int64
 	s := strconv.FormatFloat(math.MinInt64, 'f', -1, 64)
-	err = ioutil.WriteFile(tempFile, []byte(s), 0o755)
+	err = os.WriteFile(tempFile, []byte(s), 0o755)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -75,7 +74,7 @@ func TestGetCgroupParamsInt(t *testing.T) {
 	}
 
 	// Not a float.
-	err = ioutil.WriteFile(tempFile, []byte("not-a-float"), 0o755)
+	err = os.WriteFile(tempFile, []byte("not-a-float"), 0o755)
 	if err != nil {
 		t.Fatal(err)
 	}

libcontainer/cgroups/utils.go

@@ -5,7 +5,6 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"strconv"
@@ -243,7 +242,7 @@ func RemovePath(path string) error {
 		return nil
 	}
 
-	infos, err := ioutil.ReadDir(path)
+	infos, err := os.ReadDir(path)
 	if err != nil {
 		if os.IsNotExist(err) {
 			err = nil

libcontainer/configs/config_test.go

@@ -3,7 +3,6 @@ package configs_test
 import (
 	"encoding/json"
 	"fmt"
-	"io/ioutil"
 	"os"
 	"reflect"
 	"testing"
@@ -190,7 +189,7 @@ exit 0
 	verifyCommand := fmt.Sprintf(verifyCommandTemplate, stateJson)
 	filename := "/tmp/runc-hooktest.sh"
 	os.Remove(filename)
-	if err := ioutil.WriteFile(filename, []byte(verifyCommand), 0o700); err != nil {
+	if err := os.WriteFile(filename, []byte(verifyCommand), 0o700); err != nil {
 		t.Fatalf("Failed to create tmp file: %v", err)
 	}
 	defer os.Remove(filename)

libcontainer/container_linux.go

@@ -6,7 +6,6 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"net"
 	"os"
 	"os/exec"
@@ -286,7 +285,7 @@ func (c *linuxContainer) exec() error {
 }
 
 func readFromExecFifo(execFifo io.Reader) error {
-	data, err := ioutil.ReadAll(execFifo)
+	data, err := io.ReadAll(execFifo)
 	if err != nil {
 		return err
 	}
@@ -1151,7 +1150,7 @@ func (c *linuxContainer) Checkpoint(criuOpts *CriuOpts) error {
 			return err
 		}
 
-		err = ioutil.WriteFile(filepath.Join(criuOpts.ImagesDirectory, descriptorsFilename), fdsJSON, 0o600)
+		err = os.WriteFile(filepath.Join(criuOpts.ImagesDirectory, descriptorsFilename), fdsJSON, 0o600)
 		if err != nil {
 			return err
 		}
@@ -1455,7 +1454,7 @@ func (c *linuxContainer) Restore(process *Process, criuOpts *CriuOpts) error {
 		fds    []string
 		fdJSON []byte
 	)
-	if fdJSON, err = ioutil.ReadFile(filepath.Join(criuOpts.ImagesDirectory, descriptorsFilename)); err != nil {
+	if fdJSON, err = os.ReadFile(filepath.Join(criuOpts.ImagesDirectory, descriptorsFilename)); err != nil {
 		return err
 	}
 
@@ -1850,7 +1849,7 @@ func (c *linuxContainer) updateState(process parentProcess) (*State, error) {
 }
 
 func (c *linuxContainer) saveState(s *State) (retErr error) {
-	tmpFile, err := ioutil.TempFile(c.root, "state-")
+	tmpFile, err := os.CreateTemp(c.root, "state-")
 	if err != nil {
 		return err
 	}
@@ -2150,13 +2149,11 @@ func ignoreTerminateErrors(err error) error {
 	if errors.As(err, &exitErr) {
 		return nil
 	}
-	// TODO: use errors.Is(err, os.ErrProcessDone) here and
-	// remove "process already finished" string comparison below
-	// once go 1.16 is minimally supported version.
-
+	if errors.Is(err, os.ErrProcessDone) {
+		return nil
+	}
 	s := err.Error()
-	if strings.Contains(s, "process already finished") ||
-		strings.Contains(s, "Wait was already called") {
+	if strings.Contains(s, "Wait was already called") {
 		return nil
 	}
 	return err

libcontainer/devices/device_unix.go

@@ -5,7 +5,6 @@ package devices
 
 import (
 	"errors"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 
@@ -17,8 +16,8 @@ var ErrNotADevice = errors.New("not a device node")
 
 // Testing dependencies
 var (
-	unixLstat     = unix.Lstat
-	ioutilReadDir = ioutil.ReadDir
+	unixLstat = unix.Lstat
+	osReadDir = os.ReadDir
 )
 
 func mkDev(d *Rule) (uint64, error) {
@@ -77,7 +76,7 @@ func HostDevices() ([]*Device, error) {
 // GetDevices recursively traverses a directory specified by path
 // and returns all devices found there.
 func GetDevices(path string) ([]*Device, error) {
-	files, err := ioutilReadDir(path)
+	files, err := osReadDir(path)
 	if err != nil {
 		return nil, err
 	}

libcontainer/devices/device_unix_go116_test.go

@@ -0,0 +1,39 @@
+//go:build !go1.17
+// +build !go1.17
+
+package devices
+
+import "io/fs"
+
+// The following code is adapted from go1.17.1/src/io/fs/readdir.go
+// to compensate for the lack of fs.FileInfoToDirEntry in Go 1.16.
+
+// dirInfo is a DirEntry based on a FileInfo.
+type dirInfo struct {
+	fileInfo fs.FileInfo
+}
+
+func (di dirInfo) IsDir() bool {
+	return di.fileInfo.IsDir()
+}
+
+func (di dirInfo) Type() fs.FileMode {
+	return di.fileInfo.Mode().Type()
+}
+
+func (di dirInfo) Info() (fs.FileInfo, error) {
+	return di.fileInfo, nil
+}
+
+func (di dirInfo) Name() string {
+	return di.fileInfo.Name()
+}
+
+// fileInfoToDirEntry returns a DirEntry that returns information from info.
+// If info is nil, FileInfoToDirEntry returns nil.
+func fileInfoToDirEntry(info fs.FileInfo) fs.DirEntry {
+	if info == nil {
+		return nil
+	}
+	return dirInfo{fileInfo: info}
+}

libcontainer/devices/device_unix_go117_test.go

@@ -0,0 +1,8 @@
+//go:build go1.17
+// +build go1.17
+
+package devices
+
+import "io/fs"
+
+var fileInfoToDirEntry = fs.FileInfoToDirEntry