build(deps): bump golang.org/x/net to v0.57.0, require Go 1.25

Also bump golang.org/x/sys to v0.47.0. Both modules now require
Go 1.25, so raise the go directive in go.mod from 1.23.0 to 1.25.0
and drop Go 1.23 from the CI test matrix.

Starting with Go 1.25, the runtime opens the cgroup CPU limit files
(cpu.cfs_quota_us and cpu.cfs_period_us on cgroup v1, cpu.max on
cgroup v2) and keeps them open to periodically re-evaluate GOMAXPROCS
(https://go.dev/cl/670497\). As a result, a container's init process
now legitimately holds these file descriptors, which the fd leak
integration test used to flag as a leak. Add them to the test's
whitelist of allowed fd targets.

Signed-off-by: Sopho Merkviladze <smerkviladze@mirantis.com>

Author: smerkviladze

.github/workflows/test.yml

@@ -25,22 +25,18 @@ jobs:
       fail-fast: false
       matrix:
         os: [ubuntu-24.04, ubuntu-24.04-arm]
-        go-version: [1.23.x, 1.25.x, 1.26.x]
+        go-version: [1.25.x, 1.26.x]
         rootless: ["rootless", ""]
         race: ["-race", ""]
         criu: ["", "criu-dev"]
         exclude:
           # Disable most of criu-dev jobs, as they are expensive
           # (need to compile criu) and don't add much value/coverage.
-          - criu: criu-dev
-            go-version: 1.23.x
           - criu: criu-dev
             go-version: 1.25.x
           - criu: criu-dev
             rootless: rootless
           # Do race detection only with latest stable Go version.
-          - race: -race
-            go-version: 1.23.x
           - race: -race
             go-version: 1.25.x
 

go.mod

@@ -1,6 +1,6 @@
 module github.com/opencontainers/runc
 
-go 1.23.0
+go 1.25.0
 
 require (
 	github.com/checkpoint-restore/go-criu/v6 v6.3.0
@@ -21,8 +21,8 @@ require (
 	github.com/sirupsen/logrus v1.9.3
 	github.com/urfave/cli v1.22.16
 	github.com/vishvananda/netlink v1.3.0
-	golang.org/x/net v0.35.0
-	golang.org/x/sys v0.30.0
+	golang.org/x/net v0.57.0
+	golang.org/x/sys v0.47.0
 	google.golang.org/protobuf v1.36.5
 )
 

go.sum

@@ -83,17 +83,17 @@ github.com/vishvananda/netlink v1.3.0 h1:X7l42GfcV4S6E4vHTsw48qbrV+9PVojNfIhZcwQ
 github.com/vishvananda/netlink v1.3.0/go.mod h1:i6NetklAujEcC6fK0JPjT8qSwWyO0HLn4UKG+hGqeJs=
 github.com/vishvananda/netns v0.0.4 h1:Oeaw1EM2JMxD51g9uhtC0D7erkIjgmj8+JZc26m1YX8=
 github.com/vishvananda/netns v0.0.4/go.mod h1:SpkAiCQRtJ6TvvxPnOSyH3BMl6unz3xZlaprSwhNNJM=
-golang.org/x/net v0.35.0 h1:T5GQRQb2y08kTAByq9L4/bz8cipCdA8FbRTXewonqY8=
-golang.org/x/net v0.35.0/go.mod h1:EglIi67kWsHKlRzzVMUD93VMSWGFOMSZgxFjparz1Qk=
+golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
+golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
 golang.org/x/sync v0.1.0 h1:wsuoTGHzEhffawBOhz5CYhcrV4IdKZbEyZjBMuTp12o=
 golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.10.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.30.0 h1:QjkSwP/36a20jFYWkSue1YwXzLmsV5Gfq7Eiy72C1uc=
-golang.org/x/sys v0.30.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
+golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.28.1/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=

tests/integration/create.bats

@@ -38,7 +38,11 @@ is_allowed_fdtarget() {
 			# overlayfs binary reference (CVE-2019-5736)
 			grep -Ex "/runc" <<<"$target" ||
 			# memfd cloned binary (CVE-2019-5736)
-			grep -Fx "/memfd:runc_cloned:/proc/self/exe (deleted)" <<<"$target"
+			grep -Fx "/memfd:runc_cloned:/proc/self/exe (deleted)" <<<"$target" ||
+			# Go 1.25+ runtime opens these cgroup v1 files (see https://go.dev/cl/670497).
+			grep -Ex ".*/cpu.cfs_(quota|period)_us" <<<"$target" ||
+			# Ditto for the cgroup v2 equivalent.
+			grep -Ex ".*/cpu.max" <<<"$target"
 	} >/dev/null
 	return "$?"
 }