vendor: bump runc to 1.0.1

The commands used were (roughly):

	hack/pin-dependency.sh github.com/opencontainers/runc v1.0.1
	hack/lint-dependencies.sh
	# Follow its recommendations.
	hack/pin-dependency.sh github.com/cilium/ebpf v0.6.2
	hack/pin-dependency.sh github.com/opencontainers/selinux v1.8.2
	hack/pin-dependency.sh github.com/sirupsen/logrus v1.8.1
	# Recheck.
	hack/lint-dependencies.sh
	GO111MODULE=on go mod edit -dropreplace github.com/willf/bitset
	hack/update-vendor.sh
	# Recheck.
	hack/lint-dependencies.sh
	hack/update-internal-modules.sh
	# Recheck.
	hack/lint-dependencies.sh

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>

vendor/github.com/opencontainers/runc/libcontainer/cgroups/fs2/cpu.go

@@ -23,7 +23,7 @@ func setCpu(dirPath string, r *configs.Resources) error {
 
 	// NOTE: .CpuShares is not used here. Conversion is the caller's responsibility.
 	if r.CpuWeight != 0 {
-		if err := fscommon.WriteFile(dirPath, "cpu.weight", strconv.FormatUint(r.CpuWeight, 10)); err != nil {
+		if err := cgroups.WriteFile(dirPath, "cpu.weight", strconv.FormatUint(r.CpuWeight, 10)); err != nil {
 			return err
 		}
 	}
@@ -40,15 +40,16 @@ func setCpu(dirPath string, r *configs.Resources) error {
 			period = 100000
 		}
 		str += " " + strconv.FormatUint(period, 10)
-		if err := fscommon.WriteFile(dirPath, "cpu.max", str); err != nil {
+		if err := cgroups.WriteFile(dirPath, "cpu.max", str); err != nil {
 			return err
 		}
 	}
 
 	return nil
 }
+
 func statCpu(dirPath string, stats *cgroups.Stats) error {
-	f, err := fscommon.OpenFile(dirPath, "cpu.stat", os.O_RDONLY)
+	f, err := cgroups.OpenFile(dirPath, "cpu.stat", os.O_RDONLY)
 	if err != nil {
 		return err
 	}

vendor/github.com/opencontainers/runc/libcontainer/cgroups/fs2/cpuset.go

@@ -3,7 +3,7 @@
 package fs2
 
 import (
-	"github.com/opencontainers/runc/libcontainer/cgroups/fscommon"
+	"github.com/opencontainers/runc/libcontainer/cgroups"
 	"github.com/opencontainers/runc/libcontainer/configs"
 )
 
@@ -17,12 +17,12 @@ func setCpuset(dirPath string, r *configs.Resources) error {
 	}
 
 	if r.CpusetCpus != "" {
-		if err := fscommon.WriteFile(dirPath, "cpuset.cpus", r.CpusetCpus); err != nil {
+		if err := cgroups.WriteFile(dirPath, "cpuset.cpus", r.CpusetCpus); err != nil {
 			return err
 		}
 	}
 	if r.CpusetMems != "" {
-		if err := fscommon.WriteFile(dirPath, "cpuset.mems", r.CpusetMems); err != nil {
+		if err := cgroups.WriteFile(dirPath, "cpuset.mems", r.CpusetMems); err != nil {
 			return err
 		}
 	}

vendor/github.com/opencontainers/runc/libcontainer/cgroups/fs2/create.go

@@ -6,12 +6,12 @@ import (
 	"path/filepath"
 	"strings"
 
-	"github.com/opencontainers/runc/libcontainer/cgroups/fscommon"
+	"github.com/opencontainers/runc/libcontainer/cgroups"
 	"github.com/opencontainers/runc/libcontainer/configs"
 )
 
 func supportedControllers() (string, error) {
-	return fscommon.ReadFile(UnifiedMountpoint, "/cgroup.controllers")
+	return cgroups.ReadFile(UnifiedMountpoint, "/cgroup.controllers")
 }
 
 // needAnyControllers returns whether we enable some supported controllers or not,
@@ -92,7 +92,7 @@ func CreateCgroupPath(path string, c *configs.Cgroup) (Err error) {
 	for i, e := range elements {
 		current = filepath.Join(current, e)
 		if i > 0 {
-			if err := os.Mkdir(current, 0755); err != nil {
+			if err := os.Mkdir(current, 0o755); err != nil {
 				if !os.IsExist(err) {
 					return err
 				}
@@ -105,7 +105,7 @@ func CreateCgroupPath(path string, c *configs.Cgroup) (Err error) {
 					}
 				}()
 			}
-			cgType, _ := fscommon.ReadFile(current, cgTypeFile)
+			cgType, _ := cgroups.ReadFile(current, cgTypeFile)
 			cgType = strings.TrimSpace(cgType)
 			switch cgType {
 			// If the cgroup is in an invalid mode (usually this means there's an internal
@@ -122,7 +122,7 @@ func CreateCgroupPath(path string, c *configs.Cgroup) (Err error) {
 					// since that means we're a properly delegated cgroup subtree) but in
 					// this case there's not much we can do and it's better than giving an
 					// error.
-					_ = fscommon.WriteFile(current, cgTypeFile, "threaded")
+					_ = cgroups.WriteFile(current, cgTypeFile, "threaded")
 				}
 			// If the cgroup is in (threaded) or (domain threaded) mode, we can only use thread-aware controllers
 			// (and you cannot usually take a cgroup out of threaded mode).
@@ -136,11 +136,11 @@ func CreateCgroupPath(path string, c *configs.Cgroup) (Err error) {
 		}
 		// enable all supported controllers
 		if i < len(elements)-1 {
-			if err := fscommon.WriteFile(current, cgStCtlFile, res); err != nil {
+			if err := cgroups.WriteFile(current, cgStCtlFile, res); err != nil {
 				// try write one by one
 				allCtrs := strings.Split(res, " ")
 				for _, ctr := range allCtrs {
-					_ = fscommon.WriteFile(current, cgStCtlFile, ctr)
+					_ = cgroups.WriteFile(current, cgStCtlFile, ctr)
 				}
 			}
 			// Some controllers might not be enabled when rootless or containerized,

vendor/github.com/opencontainers/runc/libcontainer/cgroups/fs2/defaultpath.go

@@ -82,9 +82,7 @@ func parseCgroupFile(path string) (string, error) {
 }
 
 func parseCgroupFromReader(r io.Reader) (string, error) {
-	var (
-		s = bufio.NewScanner(r)
-	)
+	s := bufio.NewScanner(r)
 	for s.Scan() {
 		var (
 			text  = s.Text()

vendor/github.com/opencontainers/runc/libcontainer/cgroups/fs2/devices.go

@@ -58,29 +58,15 @@ func setDevices(dirPath string, r *configs.Resources) error {
 	if r.SkipDevices {
 		return nil
 	}
-	// XXX: This is currently a white-list (but all callers pass a blacklist of
-	//      devices). This is bad for a whole variety of reasons, but will need
-	//      to be fixed with co-ordinated effort with downstreams.
 	insts, license, err := devicefilter.DeviceFilter(r.Devices)
 	if err != nil {
 		return err
 	}
-	dirFD, err := unix.Open(dirPath, unix.O_DIRECTORY|unix.O_RDONLY, 0600)
+	dirFD, err := unix.Open(dirPath, unix.O_DIRECTORY|unix.O_RDONLY, 0o600)
 	if err != nil {
 		return errors.Errorf("cannot get dir FD for %s", dirPath)
 	}
 	defer unix.Close(dirFD)
-	// XXX: This code is currently incorrect when it comes to updating an
-	//      existing cgroup with new rules (new rulesets are just appended to
-	//      the program list because this uses BPF_F_ALLOW_MULTI). If we didn't
-	//      use BPF_F_ALLOW_MULTI we could actually atomically swap the
-	//      programs.
-	//
-	//      The real issue is that BPF_F_ALLOW_MULTI makes it hard to have a
-	//      race-free blacklist because it acts as a whitelist by default, and
-	//      having a deny-everything program cannot be overridden by other
-	//      programs. You could temporarily insert a deny-everything program
-	//      but that would result in spurrious failures during updates.
 	if _, err := ebpf.LoadAttachCgroupDeviceFilter(insts, license, dirFD); err != nil {
 		if !canSkipEBPFError(r) {
 			return err

vendor/github.com/opencontainers/runc/libcontainer/cgroups/fs2/freezer.go

@@ -3,27 +3,20 @@
 package fs2
 
 import (
+	"bufio"
 	stdErrors "errors"
+	"fmt"
 	"os"
 	"strings"
+	"time"
 
-	"github.com/opencontainers/runc/libcontainer/cgroups/fscommon"
+	"github.com/opencontainers/runc/libcontainer/cgroups"
 	"github.com/opencontainers/runc/libcontainer/configs"
 	"github.com/pkg/errors"
 	"golang.org/x/sys/unix"
 )
 
 func setFreezer(dirPath string, state configs.FreezerState) error {
-	if err := supportsFreezer(dirPath); err != nil {
-		// We can ignore this request as long as the user didn't ask us to
-		// freeze the container (since without the freezer cgroup, that's a
-		// no-op).
-		if state == configs.Undefined || state == configs.Thawed {
-			return nil
-		}
-		return errors.Wrap(err, "freezer not supported")
-	}
-
 	var stateStr string
 	switch state {
 	case configs.Undefined:
@@ -36,11 +29,23 @@ func setFreezer(dirPath string, state configs.FreezerState) error {
 		return errors.Errorf("invalid freezer state %q requested", state)
 	}
 
-	if err := fscommon.WriteFile(dirPath, "cgroup.freeze", stateStr); err != nil {
+	fd, err := cgroups.OpenFile(dirPath, "cgroup.freeze", unix.O_RDWR)
+	if err != nil {
+		// We can ignore this request as long as the user didn't ask us to
+		// freeze the container (since without the freezer cgroup, that's a
+		// no-op).
+		if state != configs.Frozen {
+			return nil
+		}
+		return errors.Wrap(err, "freezer not supported")
+	}
+	defer fd.Close()
+
+	if _, err := fd.WriteString(stateStr); err != nil {
 		return err
 	}
 	// Confirm that the cgroup did actually change states.
-	if actualState, err := getFreezer(dirPath); err != nil {
+	if actualState, err := readFreezer(dirPath, fd); err != nil {
 		return err
 	} else if actualState != state {
 		return errors.Errorf(`expected "cgroup.freeze" to be in state %q but was in %q`, state, actualState)
@@ -48,13 +53,8 @@ func setFreezer(dirPath string, state configs.FreezerState) error {
 	return nil
 }
 
-func supportsFreezer(dirPath string) error {
-	_, err := fscommon.ReadFile(dirPath, "cgroup.freeze")
-	return err
-}
-
 func getFreezer(dirPath string) (configs.FreezerState, error) {
-	state, err := fscommon.ReadFile(dirPath, "cgroup.freeze")
+	fd, err := cgroups.OpenFile(dirPath, "cgroup.freeze", unix.O_RDONLY)
 	if err != nil {
 		// If the kernel is too old, then we just treat the freezer as being in
 		// an "undefined" state.
@@ -63,12 +63,67 @@ func getFreezer(dirPath string) (configs.FreezerState, error) {
 		}
 		return configs.Undefined, err
 	}
-	switch strings.TrimSpace(state) {
-	case "0":
+	defer fd.Close()
+
+	return readFreezer(dirPath, fd)
+}
+
+func readFreezer(dirPath string, fd *os.File) (configs.FreezerState, error) {
+	if _, err := fd.Seek(0, 0); err != nil {
+		return configs.Undefined, err
+	}
+	state := make([]byte, 2)
+	if _, err := fd.Read(state); err != nil {
+		return configs.Undefined, err
+	}
+	switch string(state) {
+	case "0\n":
 		return configs.Thawed, nil
-	case "1":
-		return configs.Frozen, nil
+	case "1\n":
+		return waitFrozen(dirPath)
 	default:
 		return configs.Undefined, errors.Errorf(`unknown "cgroup.freeze" state: %q`, state)
 	}
 }
+
+// waitFrozen polls cgroup.events until it sees "frozen 1" in it.
+func waitFrozen(dirPath string) (configs.FreezerState, error) {
+	fd, err := cgroups.OpenFile(dirPath, "cgroup.events", unix.O_RDONLY)
+	if err != nil {
+		return configs.Undefined, err
+	}
+	defer fd.Close()
+
+	// XXX: Simple wait/read/retry is used here. An implementation
+	// based on poll(2) or inotify(7) is possible, but it makes the code
+	// much more complicated. Maybe address this later.
+	const (
+		// Perform maxIter with waitTime in between iterations.
+		waitTime = 10 * time.Millisecond
+		maxIter  = 1000
+	)
+	scanner := bufio.NewScanner(fd)
+	for i := 0; scanner.Scan(); {
+		if i == maxIter {
+			return configs.Undefined, fmt.Errorf("timeout of %s reached waiting for the cgroup to freeze", waitTime*maxIter)
+		}
+		line := scanner.Text()
+		val := strings.TrimPrefix(line, "frozen ")
+		if val != line { // got prefix
+			if val[0] == '1' {
+				return configs.Frozen, nil
+			}
+
+			i++
+			// wait, then re-read
+			time.Sleep(waitTime)
+			_, err := fd.Seek(0, 0)
+			if err != nil {
+				return configs.Undefined, err
+			}
+		}
+	}
+	// Should only reach here either on read error,
+	// or if the file does not contain "frozen " line.
+	return configs.Undefined, scanner.Err()
+}

vendor/github.com/opencontainers/runc/libcontainer/cgroups/fs2/fs2.go

@@ -51,7 +51,7 @@ func (m *manager) getControllers() error {
 		return nil
 	}
 
-	data, err := fscommon.ReadFile(m.dirPath, "cgroup.controllers")
+	data, err := cgroups.ReadFile(m.dirPath, "cgroup.controllers")
 	if err != nil {
 		if m.rootless && m.config.Path == "" {
 			return nil
@@ -98,9 +98,7 @@ func (m *manager) GetAllPids() ([]int, error) {
 }
 
 func (m *manager) GetStats() (*cgroups.Stats, error) {
-	var (
-		errs []error
-	)
+	var errs []error
 
 	st := cgroups.NewStats()
 
@@ -199,7 +197,7 @@ func (m *manager) setUnified(res map[string]string) error {
 		if strings.Contains(k, "/") {
 			return fmt.Errorf("unified resource %q must be a file name (no slashes)", k)
 		}
-		if err := fscommon.WriteFile(m.dirPath, k, v); err != nil {
+		if err := cgroups.WriteFile(m.dirPath, k, v); err != nil {
 			errC := errors.Cause(err)
 			// Check for both EPERM and ENOENT since O_CREAT is used by WriteFile.
 			if errors.Is(errC, os.ErrPermission) || errors.Is(errC, os.ErrNotExist) {

vendor/github.com/opencontainers/runc/libcontainer/cgroups/fs2/hugetlb.go

@@ -21,7 +21,7 @@ func setHugeTlb(dirPath string, r *configs.Resources) error {
 		return nil
 	}
 	for _, hugetlb := range r.HugetlbLimit {
-		if err := fscommon.WriteFile(dirPath, "hugetlb."+hugetlb.Pagesize+".max", strconv.FormatUint(hugetlb.Limit, 10)); err != nil {
+		if err := cgroups.WriteFile(dirPath, "hugetlb."+hugetlb.Pagesize+".max", strconv.FormatUint(hugetlb.Limit, 10)); err != nil {
 			return err
 		}
 	}

vendor/github.com/opencontainers/runc/libcontainer/cgroups/fs2/io.go

@@ -4,60 +4,95 @@ package fs2
 
 import (
 	"bufio"
+	"bytes"
+	"fmt"
 	"os"
 	"strconv"
 	"strings"
 
+	"github.com/sirupsen/logrus"
+
 	"github.com/opencontainers/runc/libcontainer/cgroups"
-	"github.com/opencontainers/runc/libcontainer/cgroups/fscommon"
 	"github.com/opencontainers/runc/libcontainer/configs"
 )
 
 func isIoSet(r *configs.Resources) bool {
 	return r.BlkioWeight != 0 ||
+		len(r.BlkioWeightDevice) > 0 ||
 		len(r.BlkioThrottleReadBpsDevice) > 0 ||
 		len(r.BlkioThrottleWriteBpsDevice) > 0 ||
 		len(r.BlkioThrottleReadIOPSDevice) > 0 ||
 		len(r.BlkioThrottleWriteIOPSDevice) > 0
 }
 
+// bfqDeviceWeightSupported checks for per-device BFQ weight support (added
+// in kernel v5.4, commit 795fe54c2a8) by reading from "io.bfq.weight".
+func bfqDeviceWeightSupported(bfq *os.File) bool {
+	if bfq == nil {
+		return false
+	}
+	_, _ = bfq.Seek(0, 0)
+	buf := make([]byte, 32)
+	_, _ = bfq.Read(buf)
+	// If only a single number (default weight) if read back, we have older kernel.
+	_, err := strconv.ParseInt(string(bytes.TrimSpace(buf)), 10, 64)
+	return err != nil
+}
+
 func setIo(dirPath string, r *configs.Resources) error {
 	if !isIoSet(r) {
 		return nil
 	}
 
+	// If BFQ IO scheduler is available, use it.
+	var bfq *os.File
+	if r.BlkioWeight != 0 || len(r.BlkioWeightDevice) > 0 {
+		var err error
+		bfq, err = cgroups.OpenFile(dirPath, "io.bfq.weight", os.O_RDWR)
+		if err == nil {
+			defer bfq.Close()
+		} else if !os.IsNotExist(err) {
+			return err
+		}
+	}
+
 	if r.BlkioWeight != 0 {
-		filename := "io.bfq.weight"
-		if err := fscommon.WriteFile(dirPath, filename,
-			strconv.FormatUint(uint64(r.BlkioWeight), 10)); err != nil {
-			// if io.bfq.weight does not exist, then bfq module is not loaded.
-			// Fallback to use io.weight with a conversion scheme
-			if !os.IsNotExist(err) {
+		if bfq != nil { // Use BFQ.
+			if _, err := bfq.WriteString(strconv.FormatUint(uint64(r.BlkioWeight), 10)); err != nil {
 				return err
 			}
+		} else {
+			// Fallback to io.weight with a conversion scheme.
 			v := cgroups.ConvertBlkIOToIOWeightValue(r.BlkioWeight)
-			if err := fscommon.WriteFile(dirPath, "io.weight", strconv.FormatUint(v, 10)); err != nil {
+			if err := cgroups.WriteFile(dirPath, "io.weight", strconv.FormatUint(v, 10)); err != nil {
 				return err
 			}
 		}
 	}
+	if bfqDeviceWeightSupported(bfq) {
+		for _, wd := range r.BlkioWeightDevice {
+			if _, err := bfq.WriteString(wd.WeightString() + "\n"); err != nil {
+				return fmt.Errorf("setting device weight %q: %w", wd.WeightString(), err)
+			}
+		}
+	}
 	for _, td := range r.BlkioThrottleReadBpsDevice {
-		if err := fscommon.WriteFile(dirPath, "io.max", td.StringName("rbps")); err != nil {
+		if err := cgroups.WriteFile(dirPath, "io.max", td.StringName("rbps")); err != nil {
 			return err
 		}
 	}
 	for _, td := range r.BlkioThrottleWriteBpsDevice {
-		if err := fscommon.WriteFile(dirPath, "io.max", td.StringName("wbps")); err != nil {
+		if err := cgroups.WriteFile(dirPath, "io.max", td.StringName("wbps")); err != nil {
 			return err
 		}
 	}
 	for _, td := range r.BlkioThrottleReadIOPSDevice {
-		if err := fscommon.WriteFile(dirPath, "io.max", td.StringName("riops")); err != nil {
+		if err := cgroups.WriteFile(dirPath, "io.max", td.StringName("riops")); err != nil {
 			return err
 		}
 	}
 	for _, td := range r.BlkioThrottleWriteIOPSDevice {
-		if err := fscommon.WriteFile(dirPath, "io.max", td.StringName("wiops")); err != nil {
+		if err := cgroups.WriteFile(dirPath, "io.max", td.StringName("wiops")); err != nil {
 			return err
 		}
 	}
@@ -67,7 +102,7 @@ func setIo(dirPath string, r *configs.Resources) error {
 
 func readCgroup2MapFile(dirPath string, name string) (map[string][]string, error) {
 	ret := map[string][]string{}
-	f, err := fscommon.OpenFile(dirPath, name, os.O_RDONLY)
+	f, err := cgroups.OpenFile(dirPath, name, os.O_RDONLY)
 	if err != nil {
 		return nil, err
 	}
@@ -88,22 +123,22 @@ func readCgroup2MapFile(dirPath string, name string) (map[string][]string, error
 }
 
 func statIo(dirPath string, stats *cgroups.Stats) error {
-	// more details on the io.stat file format: https://www.kernel.org/doc/Documentation/cgroup-v2.txt
-	var ioServiceBytesRecursive []cgroups.BlkioStatEntry
 	values, err := readCgroup2MapFile(dirPath, "io.stat")
 	if err != nil {
 		return err
 	}
+	// more details on the io.stat file format: https://www.kernel.org/doc/Documentation/cgroup-v2.txt
+	var parsedStats cgroups.BlkioStats
 	for k, v := range values {
 		d := strings.Split(k, ":")
 		if len(d) != 2 {
 			continue
 		}
-		major, err := strconv.ParseUint(d[0], 10, 0)
+		major, err := strconv.ParseUint(d[0], 10, 64)
 		if err != nil {
 			return err
 		}
-		minor, err := strconv.ParseUint(d[1], 10, 0)
+		minor, err := strconv.ParseUint(d[1], 10, 64)
 		if err != nil {
 			return err
 		}
@@ -115,15 +150,32 @@ func statIo(dirPath string, stats *cgroups.Stats) error {
 			}
 			op := d[0]
 
-			// Accommodate the cgroup v1 naming
+			// Map to the cgroupv1 naming and layout (in separate tables).
+			var targetTable *[]cgroups.BlkioStatEntry
 			switch op {
+			// Equivalent to cgroupv1's blkio.io_service_bytes.
 			case "rbytes":
-				op = "read"
+				op = "Read"
+				targetTable = &parsedStats.IoServiceBytesRecursive
 			case "wbytes":
-				op = "write"
+				op = "Write"
+				targetTable = &parsedStats.IoServiceBytesRecursive
+			// Equivalent to cgroupv1's blkio.io_serviced.
+			case "rios":
+				op = "Read"
+				targetTable = &parsedStats.IoServicedRecursive
+			case "wios":
+				op = "Write"
+				targetTable = &parsedStats.IoServicedRecursive
+			default:
+				// Skip over entries we cannot map to cgroupv1 stats for now.
+				// In the future we should expand the stats struct to include
+				// them.
+				logrus.Debugf("cgroupv2 io stats: skipping over unmappable %s entry", item)
+				continue
 			}
 
-			value, err := strconv.ParseUint(d[1], 10, 0)
+			value, err := strconv.ParseUint(d[1], 10, 64)
 			if err != nil {
 				return err
 			}
@@ -134,9 +186,9 @@ func statIo(dirPath string, stats *cgroups.Stats) error {
 				Minor: minor,
 				Value: value,
 			}
-			ioServiceBytesRecursive = append(ioServiceBytesRecursive, entry)
+			*targetTable = append(*targetTable, entry)
 		}
 	}
-	stats.BlkioStats = cgroups.BlkioStats{IoServiceBytesRecursive: ioServiceBytesRecursive}
+	stats.BlkioStats = parsedStats
 	return nil
 }

vendor/github.com/opencontainers/runc/libcontainer/cgroups/fs2/memory.go

@@ -52,13 +52,13 @@ func setMemory(dirPath string, r *configs.Resources) error {
 	}
 	// never write empty string to `memory.swap.max`, it means set to 0.
 	if swapStr != "" {
-		if err := fscommon.WriteFile(dirPath, "memory.swap.max", swapStr); err != nil {
+		if err := cgroups.WriteFile(dirPath, "memory.swap.max", swapStr); err != nil {
 			return err
 		}
 	}
 
 	if val := numToStr(r.Memory); val != "" {
-		if err := fscommon.WriteFile(dirPath, "memory.max", val); err != nil {
+		if err := cgroups.WriteFile(dirPath, "memory.max", val); err != nil {
 			return err
 		}
 	}
@@ -66,7 +66,7 @@ func setMemory(dirPath string, r *configs.Resources) error {
 	// cgroup.Resources.KernelMemory is ignored
 
 	if val := numToStr(r.MemoryReservation); val != "" {
-		if err := fscommon.WriteFile(dirPath, "memory.low", val); err != nil {
+		if err := cgroups.WriteFile(dirPath, "memory.low", val); err != nil {
 			return err
 		}
 	}
@@ -76,7 +76,7 @@ func setMemory(dirPath string, r *configs.Resources) error {
 
 func statMemory(dirPath string, stats *cgroups.Stats) error {
 	// Set stats from memory.stat.
-	statsFile, err := fscommon.OpenFile(dirPath, "memory.stat", os.O_RDONLY)
+	statsFile, err := cgroups.OpenFile(dirPath, "memory.stat", os.O_RDONLY)
 	if err != nil {
 		return err
 	}

vendor/github.com/opencontainers/runc/libcontainer/cgroups/fs2/pids.go

@@ -23,7 +23,7 @@ func setPids(dirPath string, r *configs.Resources) error {
 		return nil
 	}
 	if val := numToStr(r.PidsLimit); val != "" {
-		if err := fscommon.WriteFile(dirPath, "pids.max", val); err != nil {
+		if err := cgroups.WriteFile(dirPath, "pids.max", val); err != nil {
 			return err
 		}
 	}
@@ -34,9 +34,9 @@ func setPids(dirPath string, r *configs.Resources) error {
 func statPidsFromCgroupProcs(dirPath string, stats *cgroups.Stats) error {
 	// if the controller is not enabled, let's read PIDS from cgroups.procs
 	// (or threads if cgroup.threads is enabled)
-	contents, err := fscommon.ReadFile(dirPath, "cgroup.procs")
+	contents, err := cgroups.ReadFile(dirPath, "cgroup.procs")
 	if errors.Is(err, unix.ENOTSUP) {
-		contents, err = fscommon.ReadFile(dirPath, "cgroup.threads")
+		contents, err = cgroups.ReadFile(dirPath, "cgroup.threads")
 	}
 	if err != nil {
 		return err