Copy go-systemd/activation.Files code to avoid bringing in crypto/tls

vendor/github.com/coreos/go-systemd/v22/activation/files_unix.go → internal/third_party/systemd/activation/files_unix.go

@@ -15,6 +15,10 @@
 //go:build !windows
 
 // Package activation implements primitives for systemd socket activation.
+//
+// It is a partial copy of https://github.com/coreos/go-systemd/v22/activation
+// (https://github.com/coreos/go-systemd/blob/ce60782c0aabb616faa8e60f91e639d91f631e99/activation/files_unix.go),
+// to avoid bringing in crypto/tls dependency.
 package activation
 
 import (
@@ -29,29 +33,18 @@ const (
 	listenFdsStart = 3
 )
 
-// Files returns a slice containing a `os.File` object for each
+// Files returns a slice containing a os.File object for each
 // file descriptor passed to this process via systemd fd-passing protocol.
 //
 // The order of the file descriptors is preserved in the returned slice.
-// `unsetEnv` is typically set to `true` in order to avoid clashes in
-// fd usage and to avoid leaking environment flags to child processes.
-func Files(unsetEnv bool) []*os.File {
-	if unsetEnv {
-		defer func() {
-			// Unsetenv implementation for unix never returns an error.
-			_ = os.Unsetenv("LISTEN_PID")
-			_ = os.Unsetenv("LISTEN_FDS")
-			_ = os.Unsetenv("LISTEN_FDNAMES")
-		}()
-	}
-
+func Files() []*os.File {
 	pid, err := strconv.Atoi(os.Getenv("LISTEN_PID"))
 	if err != nil || pid != os.Getpid() {
 		return nil
 	}
 
 	nfds, err := strconv.Atoi(os.Getenv("LISTEN_FDS"))
-	if err != nil || nfds == 0 {
+	if err != nil || nfds <= 0 {
 		return nil
 	}
 

utils_linux.go

@@ -9,14 +9,14 @@ import (
 	"path/filepath"
 	"strconv"
 
-	"github.com/coreos/go-systemd/v22/activation"
 	"github.com/opencontainers/runtime-spec/specs-go"
 	selinux "github.com/opencontainers/selinux/go-selinux"
 	"github.com/sirupsen/logrus"
 	"github.com/urfave/cli"
 	"golang.org/x/sys/unix"
 
 	"github.com/opencontainers/runc/internal/pathrs"
+	"github.com/opencontainers/runc/internal/third_party/systemd/activation"
 	"github.com/opencontainers/runc/libcontainer"
 	"github.com/opencontainers/runc/libcontainer/configs"
 	"github.com/opencontainers/runc/libcontainer/specconv"
@@ -399,17 +399,11 @@ func startContainer(context *cli.Context, action CtAct, criuOpts *libcontainer.C
 		}
 	}
 
-	// Support on-demand socket activation by passing file descriptors into the container init process.
-	listenFDs := []*os.File{}
-	if os.Getenv("LISTEN_FDS") != "" {
-		listenFDs = activation.Files(false)
-	}
-
 	r := &runner{
 		enableSubreaper: !context.Bool("no-subreaper"),
 		shouldDestroy:   !context.Bool("keep"),
 		container:       container,
-		listenFDs:       listenFDs,
+		listenFDs:       activation.Files(), // On-demand socket activation.
 		notifySocket:    notifySocket,
 		consoleSocket:   context.String("console-socket"),
 		pidfdSocket:     context.String("pidfd-socket"),

vendor/modules.txt

@@ -28,7 +28,6 @@ github.com/cilium/ebpf/link
 github.com/containerd/console
 # github.com/coreos/go-systemd/v22 v22.6.0
 ## explicit; go 1.23
-github.com/coreos/go-systemd/v22/activation
 github.com/coreos/go-systemd/v22/dbus
 # github.com/cpuguy83/go-md2man/v2 v2.0.7
 ## explicit; go 1.12