integrate libcontainer/userns into moby/sys/user

[thaJeztah]

• relates to libct/userns: split userns detection from internal userns code  opencontainers/runc#4331
• relates to move most packages into internal opencontainers/runc#3028

---

integrate libcontainer/userns into moby/sys/user

This integrates the userns package from libcontainer (runc) at commit;
3778ae603c706494fd1e2c2faf83b406e38d687d (1).

Code was originally added through runc@c0ad40c (2), and located in the
libcontainer/system package; history of this code from before it was moved
can be found through 3 and 4.

Migration was done using the following steps:

# install filter-repo (https://github.com/newren/git-filter-repo/blob/main/INSTALL.md)
brew install git-filter-repo

# create a temporary clone of docker
cd ~/Projects
git clone https://github.com/opencontainers/runc.git runc_temp
cd runc_temp

# commit taken from
git rev-parse --verify HEAD
3778ae603c706494fd1e2c2faf83b406e38d687d

git filter-repo --analyze

# remove all code, except for 'libcontainer/userns/', and rename to /user/userns
git filter-repo \
  --path 'libcontainer/userns/userns.go' \
  --path 'libcontainer/userns/userns_linux.go' \
  --path 'libcontainer/userns/userns_fuzzer.go' \
  --path 'libcontainer/userns/userns_linux_fuzzer.go' \
  --path 'libcontainer/userns/userns_linux_test.go' \
  --path 'libcontainer/userns/userns_unsupported.go' \
  --path-rename libcontainer/userns:user/userns

# go to the target github.com/moby/sys repository
cd ~/go/src/github.com/moby/sys

# create a branch to work with
git checkout -b integrate_libcontainer_userns_take2

# add the temporary repository as an upstream and make sure it's up-to-date
git remote add libcontainer_userns ~/Projects/runc_temp
git fetch libcontainer_userns

# merge the upstream code
git merge --allow-unrelated-histories --signoff -S libcontainer_userns/main

[thaJeztah]

/cc @AkihiroSuda @kolyshkin @cyphar @lifubang PTAL if this LGTY (related PR in runc is opencontainers/runc#4350)

[AkihiroSuda]

No need to support Go <= 1.20

[thaJeztah]

The other modules still have go1.17 as minimum version; I didn't want to change that as part of this PR, but we can revisit that in a follow up

[kolyshkin]

nit: we should probably refer to runc, too.

[thaJeztah]

Added a mention of runc (both here, and in the package description)

[kolyshkin]

It looks like git history here begins when the code was moved in runc, and contains some drastic changes (like additon and removal of a big portion of C code). IOW it's not very useful (I tried to answer simple questions like "why do we use bytes.Buffer?" or "who added the constant 4294967295?" using git blame and git log, and it's not possible to do so).

Given that git history serves a main purpose of figuring out why (or when, or by whom) things were written the way they are written, and that this git history is:

1. quite lengthy (esp. compared to the amount of code added), yet
2. doesn't work for the above purpose,

I'm not sure it makes sense to retain it.

I think it's better to just copy and commit the code @ specific commit with a clean git history, and refer to older runc history in the docs (like we did when it was copied from lxc).

[thaJeztah]

@kolyshkin I gave this another go, and used more specific filters so that the unrelated commits don't get included. History now contains all history since the code was moved, but the merge-commit contains a link to the commits that moved it.

Let me know if this looks better 🤞

[thaJeztah]

@kolyshkin ptal 🤗

[cyphar]

LGTM

[thaJeztah]

oh! need to rebase after #142 was merged done! ✅

[laurazard]

LGTM

[tianon]

I'm a little late to the party (sorry 😭), but I'm actually a bit confused by this. As far as I can tell, the only thing the "user" and "userns" packages have in common is the name, so this seems like an odd grouping IMO

[tianon]

I'm also missing the justification for the bump to go1.21? 5cd502c#r144637064

(and in fact, #140 (comment) seems to directly contradict doing so 🤔)

[thaJeztah]

@tianon Arf, sorry for ghosting you; I saw your comment on my phone, and wanted to bring it up in one of the calls, but I didn't make both of them, then forgot.

I'm a little late to the party (sorry 😭), but I'm actually a bit confused by this. As far as I can tell, the only thing the "user" and "userns" packages have in common is the name, so this seems like an odd grouping IMO

That, hm, is a valid point. I think I initially put it as a separate module, but then (maybe incorrectly?) recalled that there was a discussion to move this, as well as possibly the idtools bit into the same module. But maybe I my memory fails me here (it's been leaky a bit recently).

FWIW; to my knowledge none of the current consumers (moby, buildkit, containerd) have included this change in a release, so there's still a potential to change this to a separate module if we think that's better

I'm also missing the justification for the bump to go1.21? 5cd502c#r144637064

The code in userns uses sync.OnceFunc, which requires go1.21

(and in fact, #140 (comment) seems to directly contradict doing so 🤔)

Ah, right, so the comment was about the added check in make test; GitHub actions runs on go1.18, go1.21.x and go1.22.x; the lines added are to skip the user module on go1.18, but still test the other modules (mount, mountinfo, sequential, signal, symlink) on that version.

[tianon]

The context for why I even care is that I'm a downstream user of github.com/moby/sys/user who will never touch userns, so this change has me strongly considering the Go Proverb "A little copying is better than a little dependency." (but "a little dependency" is part of why github.com/moby/sys/user was created / exists in the first place) 😅 🙈

[tianon]

So that's the long way of saying I'm very much in favor of a git mv user/userns userns

[thaJeztah]

I opened a PR to move this to a separate module;

• user: move userns package to separate module, and retract v0.2.0 #145