libcontainer cannot be build due to runc-dmz (as a Go library for third party projects) : `dmz_linux.go:21:12: pattern runc-dmz: no matching files found`

[mythi]

Description

With the latest main, projects using libcontainer cannot build unless they set -tags runc_nodmz flag.

Steps to reproduce the issue

1. pull latest go get github.com/opencontainers/runc@main
2. build

Describe the results you received and expected

Result:
../../../../../pkg/mod/github.com/opencontainers/runc@v1.1.1-0.20231025141802-edd00eb3cbd2/libcontainer/dmz/dmz_linux.go:21:12: pattern runc-dmz: no matching files found

This can work when adding runc_nodmz to build flags but is it expected that all libcontainer consumers do this?

What version of runc are you using?

github.com/opencontainers/runc v1.1.1-0.20231025141802-edd00eb3cbd2

Host OS information

No response

Host kernel information

No response

[AkihiroSuda]

What's your arch?

Also, please make sure to use make, not go build (go install)

[mythi]

What's your arch?

GOARCH="amd64"

Also, please make sure to use make, not go build (go install)

I'm not building runc but trying to update libcontainer to cAdvisor.

[zhujintao]

alpine linux same problem。

[cyphar]

This can work when adding runc_nodmz to build flags but is it expected that all libcontainer consumers do this?

It should be noted that libcontainer is not meant to be used outside of runc, so while we do try to avoid causing issues if necessary, if there isn't a workable solution outside of build-tags then we will have to go with those. That being said, if there is a nice solution that makes everyone happy, great.

The core issue is that go:embed doesn't have a way to allow an empty set (no files matching the pattern) to be allowed. The "simple" solution -- which I tried when I was working on #3987 -- would be to check in an empty file called runc-dmz into git, which will be pulled in by go get. Unfortunately, this would also mean that git commit -a would automatically include the binary file once we build it (you cannot .gitignore a tracked path AFAIK) which would make development more annoying and so is a no-go.

The other alternative is to create an empty file with a different name, and then to use go:embed runc-dmz dummy-file.txt (or something similar). This would work AFAICS, but it might look a bit ugly. I'll give this a shot.

[cyphar]

Does #4101 fix the issue for you?