Update to runc rc92

config/blobs.yml

@@ -10,10 +10,18 @@ pkg-config/pkg-config-0.29.2.tar.gz:
   size: 2016830
   object_id: 68ebd5e6-b02b-49fb-4fd2-a594125b3808
   sha: 76e501663b29cb7580245720edfb6106164fad2b
+runc/libseccomp-2.4.3.tar.gz:
+  size: 598147
+  object_id: 5fc81130-9e5e-4246-7efe-1ba40afe1fc0
+  sha: sha256:cf15d1421997fac45b936515af61d209c4fd788af11005d212b3d0fd71e7991d
 runc/runc-1.0.0-rc10.tar.gz:
   size: 1927069
   object_id: 4fb46e34-33d6-476e-5bc8-c8af73827ae7
   sha: sha256:6b44985023347fb9c5a2cc6f761df8c41cc2c84a7a68a6e6acf834dff6653a9a
+runc/runc-1.0.0-rc92.tar.gz:
+  size: 2061469
+  object_id: 35b0f6e7-1a0d-40e1-410a-db3810dd0d83
+  sha: sha256:28378df983a3c586ed3ec8c76a774a9b10f36a0c323590a284b801cce95cc61f
 tini/tini-0.18.0.tar.gz:
   size: 32152
   object_id: 71944e0b-7d0e-411a-5600-1ea5eeb9f433

packages/bpm-runc/packaging

@@ -26,14 +26,14 @@ set -eu
 # broken in the case that Git is not installed on the system because of quoting
 # mishaps.
 
-RUNC_VERSION=1.0.0-rc10
+RUNC_VERSION=1.0.0-rc92
 
 PKG_CONFIG_VERSION=0.29.2
 PKG_CONFIG_PREFIX="$(mktemp -d)"
 
 LIBSECCOMP_PREFIX="${BOSH_INSTALL_TARGET}/lib/libseccomp"
 LIBSECCOMP_RUNTIME_PATH=/var/vcap/packages/bpm/lib/libseccomp/lib
-LIBSECCOMP_VERSION=2.4.2
+LIBSECCOMP_VERSION=2.4.3
 
 RUNC_PACKAGE_PATH=github.com/opencontainers/runc
 

packages/bpm-runc/spec

@@ -5,6 +5,6 @@ dependencies:
 - golang
 
 files:
-- runc/runc-1.0.0-rc10.tar.gz
+- runc/runc-1.0.0-rc92.tar.gz
 - pkg-config/pkg-config-0.29.2.tar.gz
-- libseccomp/libseccomp-2.4.2.tar.gz
+- libseccomp/libseccomp-2.4.3.tar.gz

src/bpm/cgroups/cgroup.go

@@ -22,15 +22,15 @@ import (
 	"path/filepath"
 	"strings"
 
+	"github.com/moby/sys/mountinfo"
 	"github.com/opencontainers/runc/libcontainer/cgroups"
-	"github.com/opencontainers/runc/libcontainer/mount"
 	"golang.org/x/sys/unix"
 )
 
 const cgroupRoot = "/sys/fs/cgroup"
 
 func Setup() error {
-	mnts, err := mount.GetMounts()
+	mnts, err := mountinfo.GetMounts(mountinfo.ParentsFilter(cgroupRoot))
 	if err != nil {
 		return err
 	}
@@ -95,7 +95,7 @@ func subsystemGrouping(f io.Reader, subsystem string) (string, error) {
 	return subsystem, nil
 }
 
-func mountCgroupTmpfsIfNotPresent(mnts []*mount.Info) error {
+func mountCgroupTmpfsIfNotPresent(mnts []*mountinfo.Info) error {
 	for _, mnt := range mnts {
 		if mnt.Mountpoint == cgroupRoot {
 			return nil

src/bpm/go.mod

@@ -6,17 +6,31 @@ require (
 	code.cloudfoundry.org/bytefmt v0.0.0-20190819182555-854d396b647c
 	code.cloudfoundry.org/clock v0.0.0-20180518195852-02e53af36e6c
 	code.cloudfoundry.org/lager v2.0.0+incompatible
+	github.com/checkpoint-restore/go-criu/v4 v4.1.0 // indirect
+	github.com/cilium/ebpf v0.0.0-20200702112145-1c8d4c9ef775 // indirect
+	github.com/containerd/console v1.0.0 // indirect
+	github.com/coreos/go-systemd/v22 v22.1.0 // indirect
+	github.com/cyphar/filepath-securejoin v0.2.2 // indirect
 	github.com/docker/go-units v0.4.0 // indirect
 	github.com/golang/mock v1.4.1-0.20200222213444-b48cb6623c04
+	github.com/golang/protobuf v1.4.2 // indirect
 	github.com/kr/pty v1.1.8
+	github.com/moby/sys/mountinfo v0.1.3
+	github.com/mrunalp/fileutils v0.0.0-20200520151820-abd8a0e76976 // indirect
 	github.com/onsi/ginkgo v1.10.2
 	github.com/onsi/gomega v1.7.0
-	github.com/opencontainers/runc v1.0.0-rc9
-	github.com/opencontainers/runtime-spec v1.0.1
+	github.com/opencontainers/runc v1.0.0-rc92
+	github.com/opencontainers/runtime-spec v1.0.3-0.20200728170252-4d89ac9fbff6
+	github.com/opencontainers/selinux v1.6.0 // indirect
 	github.com/satori/go.uuid v1.2.0
-	github.com/sirupsen/logrus v1.4.2 // indirect
+	github.com/seccomp/libseccomp-golang v0.9.1 // indirect
+	github.com/sirupsen/logrus v1.6.0 // indirect
 	github.com/spf13/cobra v0.0.5
+	github.com/stretchr/objx v0.1.1 // indirect
+	github.com/syndtr/gocapability v0.0.0-20180916011248-d98352740cb2 // indirect
 	github.com/tedsuo/ifrit v0.0.0-20191009134036-9a97d0632f00 // indirect
-	golang.org/x/sys v0.0.0-20191009170203-06d7bd2c5f4f
+	github.com/urfave/cli v1.22.1 // indirect
+	github.com/vishvananda/netlink v1.1.0 // indirect
+	golang.org/x/sys v0.0.0-20200819091447-39769834ee22
 	gopkg.in/yaml.v2 v2.2.4
 )

src/bpm/integration/list_test.go

@@ -28,6 +28,8 @@ import (
 	"github.com/onsi/gomega/gexec"
 	uuid "github.com/satori/go.uuid"
 
+	specs "github.com/opencontainers/runtime-spec/specs-go"
+
 	"bpm/config"
 	"bpm/jobid"
 	"bpm/models"
@@ -109,8 +111,8 @@ var _ = Describe("list", func() {
 		startJob(boshRoot, bpmPath, job)
 		startJob(boshRoot, bpmPath, failedJob)
 
-		Eventually(func() string { return runcState(runcRoot, containerID).Status }).Should(Equal("running"))
-		Eventually(func() string { return runcState(runcRoot, failedContainerID).Status }).Should(Equal("stopped"))
+		Eventually(func() specs.ContainerState { return runcState(runcRoot, containerID).Status }).Should(Equal(specs.StateRunning))
+		Eventually(func() specs.ContainerState { return runcState(runcRoot, failedContainerID).Status }).Should(Equal(specs.StateStopped))
 
 		session, err := gexec.Start(command, GinkgoWriter, GinkgoWriter)
 		Expect(err).ShouldNot(HaveOccurred())

src/bpm/integration/pid_test.go

@@ -26,6 +26,7 @@ import (
 	. "github.com/onsi/gomega"
 	"github.com/onsi/gomega/gbytes"
 	"github.com/onsi/gomega/gexec"
+	specs "github.com/opencontainers/runtime-spec/specs-go"
 	uuid "github.com/satori/go.uuid"
 
 	"bpm/config"
@@ -87,9 +88,9 @@ var _ = Describe("pid", func() {
 	Context("when the container is failed", func() {
 		BeforeEach(func() {
 			startJob(boshRoot, bpmPath, job)
-			Eventually(func() string { return runcState(runcRoot, containerID).Status }).Should(Equal("running"))
+			Eventually(func() specs.ContainerState { return runcState(runcRoot, containerID).Status }).Should(Equal(specs.StateRunning))
 			Expect(runcCommand(runcRoot, "kill", containerID, "KILL").Run()).To(Succeed())
-			Eventually(func() string { return runcState(runcRoot, containerID).Status }).Should(Equal("stopped"))
+			Eventually(func() specs.ContainerState { return runcState(runcRoot, containerID).Status }).Should(Equal(specs.StateStopped))
 		})
 
 		It("returns an error", func() {

src/bpm/integration/resource_limits_test.go

@@ -28,6 +28,7 @@ import (
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/gomega"
 	"github.com/onsi/gomega/gexec"
+	specs "github.com/opencontainers/runtime-spec/specs-go"
 	uuid "github.com/satori/go.uuid"
 
 	"bpm/bosh"
@@ -115,7 +116,7 @@ var _ = Describe("resource limits", func() {
 			Expect(err).NotTo(HaveOccurred())
 			<-session.Exited
 			Expect(session).To(gexec.Exit(0))
-			Eventually(func() string { return runcState(runcRoot, containerID).Status }).Should(Equal("running"))
+			Eventually(func() specs.ContainerState { return runcState(runcRoot, containerID).Status }).Should(Equal(specs.StateRunning))
 
 			eventsCmd := runcCommand(runcRoot, "events", containerID)
 			stdout, err := eventsCmd.StdoutPipe()
@@ -145,7 +146,7 @@ var _ = Describe("resource limits", func() {
 			<-session.Exited
 			Expect(session).To(gexec.Exit(0))
 
-			Eventually(func() string { return runcState(runcRoot, containerID).Status }).Should(Equal("running"))
+			Eventually(func() specs.ContainerState { return runcState(runcRoot, containerID).Status }).Should(Equal(specs.StateRunning))
 			Expect(runcCommand(runcRoot, "kill", containerID).Run()).To(Succeed())
 			Eventually(fileContents(stderr)).Should(ContainSubstring("Too many open files"))
 		})
@@ -165,7 +166,7 @@ var _ = Describe("resource limits", func() {
 
 			Expect(session).To(gexec.Exit(0))
 
-			Eventually(func() string { return runcState(runcRoot, containerID).Status }).Should(Equal("running"))
+			Eventually(func() specs.ContainerState { return runcState(runcRoot, containerID).Status }).Should(Equal(specs.StateRunning))
 			Expect(runcCommand(runcRoot, "kill", containerID).Run()).To(Succeed())
 			Eventually(fileContents(stderr)).Should(ContainSubstring("fork: retry: Resource temporarily unavailable"))
 		})

src/bpm/integration/start_test.go

@@ -28,6 +28,7 @@ import (
 	. "github.com/onsi/gomega"
 	"github.com/onsi/gomega/gbytes"
 	"github.com/onsi/gomega/gexec"
+	specs "github.com/opencontainers/runtime-spec/specs-go"
 	uuid "github.com/satori/go.uuid"
 
 	"bpm/bosh"
@@ -97,7 +98,7 @@ var _ = Describe("start", func() {
 		Expect(session).To(gexec.Exit(0))
 
 		state := runcState(runcRoot, containerID)
-		Expect(state.Status).To(Equal("running"))
+		Expect(state.Status).To(Equal(specs.StateRunning))
 		pidText, err := ioutil.ReadFile(pidFile)
 		Expect(err).NotTo(HaveOccurred())
 
@@ -189,7 +190,7 @@ var _ = Describe("start", func() {
 			Expect(session).To(gexec.Exit(0))
 
 			state := runcState(runcRoot, containerID)
-			Expect(state.Status).To(Equal("running"))
+			Expect(state.Status).To(Equal(specs.StateRunning))
 			pidText, err := ioutil.ReadFile(pidFile)
 			Expect(err).NotTo(HaveOccurred())
 
@@ -284,7 +285,7 @@ var _ = Describe("start", func() {
 			Expect(session).To(gexec.Exit(0))
 
 			state := runcState(runcRoot, containerID)
-			Expect(state.Status).To(Equal("running"))
+			Expect(state.Status).To(Equal(specs.StateRunning))
 			existingPid = state.Pid
 		})
 
@@ -317,7 +318,7 @@ var _ = Describe("start", func() {
 			<-session.Exited
 
 			Expect(session).To(gexec.Exit(0))
-			Eventually(func() string { return runcState(runcRoot, containerID).Status }, 20*time.Second).Should(Equal("stopped"))
+			Eventually(func() specs.ContainerState { return runcState(runcRoot, containerID).Status }, 20*time.Second).Should(Equal(specs.StateStopped))
 
 			err = ioutil.WriteFile(filepath.Join(runcRoot, containerID, "state.json"), nil, 0600)
 			Expect(err).ToNot(HaveOccurred())
@@ -335,7 +336,7 @@ var _ = Describe("start", func() {
 			Expect(session).To(gexec.Exit(0))
 
 			state := runcState(runcRoot, containerID)
-			Expect(state.Status).To(Equal("running"))
+			Expect(state.Status).To(Equal(specs.StateRunning))
 		})
 	})
 
@@ -351,7 +352,7 @@ var _ = Describe("start", func() {
 			<-session.Exited
 
 			Expect(session).To(gexec.Exit(0))
-			Eventually(func() string { return runcState(runcRoot, containerID).Status }).Should(Equal("stopped"))
+			Eventually(func() specs.ContainerState { return runcState(runcRoot, containerID).Status }).Should(Equal(specs.StateStopped))
 		})
 
 		It("`bpm start` cleans up the associated container and artifacts and starts it", func() {
@@ -364,7 +365,7 @@ var _ = Describe("start", func() {
 			Expect(session).To(gexec.Exit(0))
 
 			state := runcState(runcRoot, containerID)
-			Expect(state.Status).To(Equal("running"))
+			Expect(state.Status).To(Equal(specs.StateRunning))
 		})
 
 		Context("and the pid file does not exist", func() {
@@ -384,7 +385,7 @@ var _ = Describe("start", func() {
 				Expect(session).To(gexec.Exit(0))
 
 				state := runcState(runcRoot, containerID)
-				Expect(state.Status).To(Equal("running"))
+				Expect(state.Status).To(Equal(specs.StateRunning))
 			})
 		})
 	})

src/bpm/integration/trace_test.go

@@ -26,6 +26,7 @@ import (
 	. "github.com/onsi/gomega"
 	"github.com/onsi/gomega/gbytes"
 	"github.com/onsi/gomega/gexec"
+	specs "github.com/opencontainers/runtime-spec/specs-go"
 	uuid "github.com/satori/go.uuid"
 
 	"bpm/config"
@@ -89,9 +90,9 @@ var _ = Describe("trace", func() {
 	Context("when the container is failed", func() {
 		BeforeEach(func() {
 			startJob(boshRoot, bpmPath, job)
-			Eventually(func() string { return runcState(runcRoot, containerID).Status }).Should(Equal("running"))
+			Eventually(func() specs.ContainerState { return runcState(runcRoot, containerID).Status }).Should(Equal(specs.StateRunning))
 			Expect(runcCommand(runcRoot, "kill", containerID, "KILL").Run()).To(Succeed())
-			Eventually(func() string { return runcState(runcRoot, containerID).Status }).Should(Equal("stopped"))
+			Eventually(func() specs.ContainerState { return runcState(runcRoot, containerID).Status }).Should(Equal(specs.StateStopped))
 		})
 
 		It("returns an error", func() {

src/bpm/models/models.go

@@ -16,9 +16,11 @@
 package models
 
 const (
-	ProcessStateFailed  = "failed"
-	ProcessStateRunning = "running"
-	ProcessStateStopped = "stopped"
+	ProcessStateFailed   = "failed"
+	ProcessStateRunning  = "running"
+	ProcessStateStopped  = "stopped"
+	ProcessStateCreating = "creating"
+	ProcessStateCreated  = "created"
 )
 
 type Process struct {

src/bpm/runc/client/client.go

@@ -151,6 +151,8 @@ func (c *RuncClient) Exec(containerID, command string, stdin io.Reader, stdout,
 //   (e.g. the container is running but in an unreachable state)
 func (c *RuncClient) ContainerState(containerID string) (*specs.State, error) {
 	runcCmd := c.buildCmd(
+		"--log-format",
+		"json",
 		"state",
 		containerID,
 	)
@@ -170,8 +172,15 @@ func (c *RuncClient) ContainerState(containerID string) (*specs.State, error) {
 }
 
 func decodeContainerStateErr(b []byte, err error) error {
+	var jsonErr struct {
+		Msg string
+	}
+	e := json.Unmarshal(b, &jsonErr)
+	if e != nil {
+		return err
+	}
 	r := regexp.MustCompile(`\s*container "[^"]*" does not exist\s*`)
-	if r.MatchString(string(b)) {
+	if r.MatchString(jsonErr.Msg) {
 		return nil
 	}
 	return err

src/bpm/runc/lifecycle/lifecycle.go

@@ -223,7 +223,7 @@ func (j *RuncLifecycle) ListProcesses() ([]*models.Process, error) {
 	for _, c := range containers {
 		processes = append(processes, newProcessFromContainerState(
 			c.ID,
-			c.Status,
+			containerStateFromString(c.Status),
 			c.InitProcessPid,
 		))
 	}
@@ -288,19 +288,45 @@ func (j *RuncLifecycle) RemoveProcess(logger lager.Logger, cfg *config.BPMConfig
 	return j.deleteFile(cfg.PidFile().External())
 }
 
-func newProcessFromContainerState(id, status string, pid int) *models.Process {
-	if status == ContainerStateStopped {
-		status = "failed"
-	}
-
+func newProcessFromContainerState(id string, status specs.ContainerState, pid int) *models.Process {
 	return &models.Process{
 		Name:   id,
 		Pid:    pid,
-		Status: status,
+		Status: containerStateToString(status),
 	}
 }
 
 type commandRunner struct{}
 
 func NewCommandRunner() CommandRunner          { return &commandRunner{} }
 func (*commandRunner) Run(cmd *exec.Cmd) error { return cmd.Run() }
+
+func containerStateToString(cs specs.ContainerState) string {
+	switch cs {
+	case specs.StateCreating:
+		return models.ProcessStateCreating
+	case specs.StateCreated:
+		return models.ProcessStateCreated
+	case specs.StateRunning:
+		return models.ProcessStateRunning
+	case specs.StateStopped:
+		return models.ProcessStateFailed
+	default:
+		return models.ProcessStateFailed
+	}
+}
+
+func containerStateFromString(status string) specs.ContainerState {
+	switch status {
+	case models.ProcessStateCreating:
+		return specs.StateCreating
+	case models.ProcessStateCreated:
+		return specs.StateCreated
+	case models.ProcessStateRunning:
+		return specs.StateRunning
+	case models.ProcessStateFailed:
+		return specs.StateStopped
+	default:
+		return models.ProcessStateFailed
+	}
+}