Limit container start time to system boot

On some systems, root cgroup might report the time when creating the
folder /sys/fs/cgroup/subsys, so limit to boot time.

container/common/helpers.go

@@ -30,6 +30,7 @@ import (
 	"github.com/karrick/godirwalk"
 	"github.com/opencontainers/runc/libcontainer/cgroups"
 	"github.com/pkg/errors"
+	"golang.org/x/sys/unix"
 
 	"k8s.io/klog/v2"
 )
@@ -97,6 +98,14 @@ func GetSpec(cgroupPaths map[string]string, machineInfoFactory info.MachineInfoF
 			lowestTime = fi.ModTime()
 		}
 	}
+	var info unix.Sysinfo_t
+	if err := unix.Sysinfo(&info); err == nil {
+		sinceBoot := time.Duration(info.Uptime) * time.Second
+		// If time is before boot, use boot time instead
+		if now.Sub(lowestTime) > sinceBoot {
+			lowestTime = now.Add(-1 * sinceBoot)
+		}
+	}
 
 	if lowestTime != now {
 		spec.CreationTime = lowestTime