Skip to content

build: improve builds for runc#327

Merged
cyphar merged 5 commits intomainfrom
runc-builds
Feb 10, 2026
Merged

build: improve builds for runc#327
cyphar merged 5 commits intomainfrom
runc-builds

Conversation

@cyphar
Copy link
Copy Markdown
Owner

@cyphar cyphar commented Feb 5, 2026

It turns out our builds were not working well with what runc needs (in particular, staticlib contained duplicate symbols because of our version scripts).

@cyphar cyphar marked this pull request as draft February 5, 2026 00:42
@cyphar cyphar changed the title build: improve builds for runcRunc builds build: improve builds for runc Feb 5, 2026
@codecov
Copy link
Copy Markdown

codecov bot commented Feb 5, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

@cyphar cyphar force-pushed the runc-builds branch 2 times, most recently from f760030 to 5cad37a Compare February 7, 2026 01:01
@cyphar cyphar added this to the 0.2.4 milestone Feb 7, 2026
@cyphar cyphar force-pushed the runc-builds branch 2 times, most recently from f2b6634 to de08013 Compare February 7, 2026 12:19
@cyphar cyphar marked this pull request as ready for review February 7, 2026 23:14
@cyphar cyphar force-pushed the runc-builds branch 2 times, most recently from e80ce99 to 6368721 Compare February 8, 2026 23:00
@cyphar cyphar added the target/runc Requirement to port runc to libpathrs. label Feb 10, 2026
Some builders want to specify extra cargo or rustc flags when building,
so making this be built-in is far more preferable.

Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
When doing cross-compliation (for runc), the binaries are put into a
different directory and we need to support using those alternative build
directories as sources of installation.

Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
Outputting .symver entries for staticlib builds leads to "multiple
definition" errors when linking statically, so we need to only output
.symver (and our version script) when building a cdylib.

Unfortunately, Rust provides no built-in mechanism to do this nicely.
There is no way to get the crate type using #[cfg(...)] and even an
explicit --cfg on the command-line does not show up in build.rs. The
only real "Rust-y" solution would be to create a separate feature for
cdylib but that is really ugly.

The solution I went with was passing an environment variable during the
build (LIBPATHRS_CAPI_BUILDMODE) which acts as a proxy for --crate-type
(in the hopes that this might be supported properly in the future).
build.rs then configures the #[cfg(cdylib)] used to control the output
of .symver and only outputs a version script. We even get to use
cargo:rerun-if-env-changed to make sure that the build script is
actually rebuilt for every crate type change. An unset
LIBPATHRS_CAPI_BUILDMODE (such as during tests) is treated like
staticlib.

Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
There were two separate issues when building on i386:

 * We used C.ulong rather than C.size_t internally when calling into
   readlink-related libpathrs APIs, which are different widths on i386.
   The solution is to just use C.size_t, which we should've used in the
   first place.

 * There was a comparison between int and 1<<31, which would overflow on
   i386. The solution is to cast to uint64, though this happens to cause
   a spurious G115 lint error from gosec which we need to mask.

Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
If we assign ProcfsHandleRef::open_base to a variable then Rust will
only drop it once we exit the scope, which is fine in general but causes
issues with runc's CI.

runc's CI checks for fd leaks in "runc create" (which blocks on a
re-open of a FIFO) and so having an additional temporary file descriptor
open at that stage leads to regressions in runc's CI. We could add this
file descriptor to the allow-list but it's much nicer to just always use
it as a temporary (sadly there isn't a way to mark the return value in a
way that would cause a clippy lint, as far as I can see).

Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
@cyphar cyphar merged commit 645eb1d into main Feb 10, 2026
117 checks passed
@cyphar cyphar deleted the runc-builds branch February 10, 2026 06:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

target/runc Requirement to port runc to libpathrs.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant