Bump Go min version to Go 1.23

.github/workflows/build.yaml

@@ -14,7 +14,7 @@ jobs:
     strategy:
       matrix:
         os: ['ubuntu-20.04', 'ubuntu-22.04']
-        go: ['1.21', '1.22']
+        go: ['1.23', '1.24']
       # Build all variants regardless of failures
       fail-fast: false
 

.golangci.yml

@@ -5,8 +5,8 @@ linters:
   disable-all: true
   enable:
     - govet
+    - copyloopvar
     - staticcheck
-#    - unused
     - gosimple
     - ineffassign
     - typecheck
@@ -19,15 +19,29 @@ linters:
     - gocritic
     - gofmt
     - revive
-    - exportloopref
 
 issues:
   exclude-use-default: false
   exclude:
     - G104 # Errors unhandled
     - G103 # Use of unsafe calls should be audited
+    - G114 # Use of net/http serve function without timeouts.
+    - G115 # Integer overflow conversion should be audited
     - G204 # Subprocess launched with variable
+    - G301 # Expect directory permissions to be 0750 or less
     - G304 # Potential file inclusion via variable
     - G306 # WriteFile permissions 0600 or less to be audited
     - G307 # Deferring unsafe method "Close" on type "*os.File" to be audited
-    - 
+    - G404 # Use of weak random number generator
+  exclude-rules:
+    - linters:
+      - govet
+      text: "copylocks"
+    - linters:
+      - revive
+      text: package-comments
+    - linters:
+      - staticcheck
+      text: "Do not rely on the global seed"
+  exclude-dirs:
+    - snapshotter/internal/integtest/stargz # Code copied from upstream stargz

Makefile

@@ -28,7 +28,7 @@ SUBMODULES=_submodules
 UID:=$(shell id -u)
 GID:=$(shell id -g)
 
-FIRECRACKER_CONTAINERD_BUILDER_IMAGE?=golang:1.21-bullseye
+FIRECRACKER_CONTAINERD_BUILDER_IMAGE?=golang:1.23-bullseye
 export FIRECRACKER_CONTAINERD_TEST_IMAGE?=localhost/firecracker-containerd-test
 export GO_CACHE_VOLUME_NAME?=gocache
 
@@ -136,7 +136,7 @@ tidy:
 	./tools/tidy.sh
 
 $(BINPATH)/golangci-lint:
-	GOBIN=$(BINPATH) go install github.com/golangci/golangci-lint/cmd/golangci-lint@v1.57.2
+	GOBIN=$(BINPATH) go install github.com/golangci/golangci-lint/cmd/golangci-lint@v1.64.2
 	$(BINPATH)/golangci-lint --version
 
 $(BINPATH)/git-validation:

agent/drive_handler.go

@@ -21,9 +21,9 @@ import (
 	"strings"
 	"time"
 
-	"github.com/containerd/containerd/log"
 	"github.com/containerd/containerd/mount"
 	"github.com/containerd/containerd/protobuf/types"
+	"github.com/containerd/log"
 	"github.com/firecracker-microvm/firecracker-containerd/internal"
 	drivemount "github.com/firecracker-microvm/firecracker-containerd/proto/service/drivemount/ttrpc"
 )
@@ -214,7 +214,7 @@ func (dh driveHandler) MountDrive(ctx context.Context, req *drivemount.MountDriv
 	return nil, fmt.Errorf("exhausted retries mounting drive from %q to %q", drive.Path(), req.DestinationPath)
 }
 
-func (dh driveHandler) UnmountDrive(ctx context.Context, req *drivemount.UnmountDriveRequest) (*types.Empty, error) {
+func (dh driveHandler) UnmountDrive(_ context.Context, req *drivemount.UnmountDriveRequest) (*types.Empty, error) {
 	drive, ok := dh.GetDrive(req.DriveID)
 	if !ok {
 		return nil, fmt.Errorf("drive %q could not be found", req.DriveID)

agent/error_test.go

@@ -55,7 +55,6 @@ func TestIsRetryableMountError(t *testing.T) {
 	}
 
 	for _, c := range cases {
-		c := c // see https://github.com/kyoh86/scopelint/issues/4
 		t.Run(c.Name, func(t *testing.T) {
 			assert.Equal(t, c.Expected, isRetryableMountError(c.Error))
 		})

agent/ioproxy_handler.go

@@ -17,8 +17,8 @@ import (
 	"context"
 
 	task "github.com/containerd/containerd/api/runtime/task/v2"
-	"github.com/containerd/containerd/log"
 	"github.com/containerd/containerd/protobuf/types"
+	"github.com/containerd/log"
 	"github.com/firecracker-microvm/firecracker-containerd/internal/vm"
 	ioproxy "github.com/firecracker-microvm/firecracker-containerd/proto/service/ioproxy/ttrpc"
 )

agent/main.go

@@ -23,9 +23,9 @@ import (
 
 	taskAPI "github.com/containerd/containerd/api/runtime/task/v2"
 	"github.com/containerd/containerd/events/exchange"
-	"github.com/containerd/containerd/log"
 	"github.com/containerd/containerd/namespaces"
 	"github.com/containerd/containerd/sys/reaper"
+	"github.com/containerd/log"
 	"github.com/containerd/ttrpc"
 	"github.com/firecracker-microvm/firecracker-go-sdk/vsock"
 	"github.com/opencontainers/runc/libcontainer/system"

agent/service.go

@@ -25,11 +25,11 @@ import (
 	taskAPI "github.com/containerd/containerd/api/runtime/task/v2"
 	"github.com/containerd/containerd/cio"
 	"github.com/containerd/containerd/identifiers"
-	"github.com/containerd/containerd/log"
 	"github.com/containerd/containerd/mount"
 	"github.com/containerd/containerd/protobuf/types"
 	runc "github.com/containerd/containerd/runtime/v2/runc/v2"
 	"github.com/containerd/containerd/runtime/v2/shim"
+	"github.com/containerd/log"
 	"github.com/hashicorp/go-multierror"
 	"github.com/sirupsen/logrus"
 	"golang.org/x/sys/unix"

docs/getting-started.md

@@ -40,7 +40,7 @@ You need to have the following things in order to use firecracker-containerd:
 * git
 * gcc, required by the Firecracker agent for building
 * A recent installation of [Docker CE](https://docker.com).
-* Go 1.21 or later, which you can download from [here](https://golang.org/dl/).
+* Go 1.23 or later, which you can download from [here](https://golang.org/dl/).
 
 ## Setup
 

docs/quickstart.md

@@ -28,14 +28,14 @@ files into `/usr/local/bin`.
 
 cd ~
 
-# Install git, Go 1.21, make, curl
+# Install git, Go 1.23, make, curl
 sudo mkdir -p /etc/apt/sources.list.d
 echo "deb http://ftp.debian.org/debian bullseye-backports main" | \
   sudo tee /etc/apt/sources.list.d/bullseye-backports.list
 sudo DEBIAN_FRONTEND=noninteractive apt-get update
 sudo DEBIAN_FRONTEND=noninteractive apt-get \
   install --yes \
-  golang-1.21 \
+  golang-1.23 \
   make \
   git \
   curl \
@@ -44,8 +44,8 @@ sudo DEBIAN_FRONTEND=noninteractive apt-get \
   bc \
   gnupg
 
-# Debian's Go 1.21 package installs "go" command under /usr/lib/go-1.21/bin
-export PATH=/usr/lib/go-1.21/bin:$PATH
+# Debian's Go 1.23 package installs "go" command under /usr/lib/go-1.23/bin
+export PATH=/usr/lib/go-1.23/bin:$PATH
 
 cd ~
 
@@ -93,7 +93,7 @@ sudo yum -y install \
 # need to source environment variables afterwards for the existing shell session.
 curl -LO https://get.golang.org/$(uname)/go_installer && \
   chmod +x go_installer && \
-  ./go_installer -version 1.21 && \
+  ./go_installer -version 1.23 && \
   rm go_installer && \
   source .bash_profile
 

docs/remote-snapshotter-getting-started.md

@@ -16,7 +16,7 @@ You will need the following to use firecracker-containerd with support for remot
 
 * git
 
-* Go 1.21 or later
+* Go 1.23 or later
 
 * This repository cloned onto your local machine
 

eventbridge/eventbridge.go

@@ -89,7 +89,7 @@ func (s *getterService) GetEvent(ctx context.Context) (*eventapi.Envelope, error
 // RegisterGetterService adds the Getter service as a method to the provided TTRPC server.
 func RegisterGetterService(srv *ttrpc.Server, svc Getter) {
 	srv.Register(getterServiceName, map[string]ttrpc.Method{
-		getEventMethodName: func(ctx context.Context, unmarshal func(interface{}) error) (interface{}, error) {
+		getEventMethodName: func(ctx context.Context, _ func(any) error) (any, error) {
 			return svc.GetEvent(ctx)
 		},
 	})

eventbridge/eventbridge_test.go

@@ -79,12 +79,13 @@ func verifyPublishAndReceive(ctx context.Context, t *testing.T, source eventtype
 	topic := "/just/container/things"
 	sinkEventCh, sinkErrorCh := sink.Subscribe(ctx, fmt.Sprintf(`topic=="%s"`, topic))
 
-	for i := 0; i < 100; i++ {
+	const taskLimit uint32 = 100
+	for i := range taskLimit {
 		taskExitEvent := &events.TaskExit{
 			ContainerID: fmt.Sprintf("container-%d", i),
 			ID:          fmt.Sprintf("id-%d", i),
-			Pid:         uint32(i),
-			ExitStatus:  uint32(i + 1),
+			Pid:         i,
+			ExitStatus:  i + 1,
 			ExitedAt:    protobuf.ToTimestamp(time.Now().UTC()),
 		}
 

examples/cmd/remote-snapshotter/go.mod

@@ -1,6 +1,6 @@
 module github.com/firecracker-microvm/firecracker-containerd/example/remote-snapshotter
 
-go 1.21
+go 1.23.0
 
 require (
 	github.com/containerd/containerd v1.7.16
@@ -48,7 +48,7 @@ require (
 	golang.org/x/mod v0.18.0 // indirect
 	golang.org/x/net v0.33.0 // indirect
 	golang.org/x/sync v0.10.0 // indirect
-	golang.org/x/sys v0.28.0 // indirect
+	golang.org/x/sys v0.31.0 // indirect
 	golang.org/x/text v0.21.0 // indirect
 	golang.org/x/tools v0.22.0 // indirect
 	google.golang.org/genproto v0.0.0-20240123012728-ef4313101c80 // indirect

examples/cmd/remote-snapshotter/go.sum

@@ -1167,8 +1167,8 @@ golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220114195835-da31bd327af9/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.28.0 h1:Fksou7UEQUWlKvIdsqzJmUmCX3cZuD2+P3XyyzwMhlA=
-golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.31.0 h1:ioabZlmFYtWhL+TRYpcnNlLwhyxaM9kWTDEmfnprqik=
+golang.org/x/sys v0.31.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
 golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210220032956-6a3ed077a48d/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=

firecracker-control/cmd/containerd/main.go

@@ -18,6 +18,7 @@ import (
 	"os"
 
 	"github.com/containerd/containerd/cmd/containerd/command"
+
 	"github.com/containerd/containerd/pkg/seed"
 
 	// Register containerd builtins

firecracker-control/local.go

@@ -25,12 +25,12 @@ import (
 	"time"
 
 	"github.com/containerd/containerd/identifiers"
-	"github.com/containerd/containerd/log"
 	"github.com/containerd/containerd/namespaces"
 	"github.com/containerd/containerd/plugin"
 	"github.com/containerd/containerd/protobuf/types"
 	"github.com/containerd/containerd/runtime/v2/shim"
 	"github.com/containerd/containerd/sys"
+	"github.com/containerd/log"
 	"github.com/hashicorp/go-multierror"
 	"github.com/sirupsen/logrus"
 	"google.golang.org/grpc/codes"

firecracker-control/service.go

@@ -17,9 +17,9 @@ import (
 	"context"
 	"fmt"
 
-	"github.com/containerd/containerd/log"
 	"github.com/containerd/containerd/plugin"
 	"github.com/containerd/containerd/protobuf/types"
+	"github.com/containerd/log"
 	"github.com/containerd/ttrpc"
 
 	"github.com/firecracker-microvm/firecracker-containerd/proto"

go.mod

@@ -1,13 +1,14 @@
 module github.com/firecracker-microvm/firecracker-containerd
 
-go 1.21
+go 1.23.0
 
 require (
 	github.com/awslabs/tc-redirect-tap v0.0.0-20211025175357-e30dfca224c2
 	github.com/containerd/containerd v1.7.16
 	github.com/containerd/continuity v0.4.2
 	github.com/containerd/fifo v1.1.0
 	github.com/containerd/go-runc v1.0.0
+	github.com/containerd/log v0.1.0
 	github.com/containerd/ttrpc v1.2.3
 	github.com/containerd/typeurl/v2 v2.1.1
 	github.com/containernetworking/cni v1.2.0
@@ -27,7 +28,7 @@ require (
 	github.com/vishvananda/netlink v1.2.1-beta.2
 	go.uber.org/goleak v1.1.12
 	golang.org/x/sync v0.10.0
-	golang.org/x/sys v0.28.0
+	golang.org/x/sys v0.31.0
 	google.golang.org/grpc v1.64.1
 	google.golang.org/protobuf v1.34.1
 )
@@ -50,7 +51,6 @@ require (
 	github.com/containerd/console v1.0.3 // indirect
 	github.com/containerd/go-cni v1.1.9 // indirect
 	github.com/containerd/imgcrypt v1.1.7 // indirect
-	github.com/containerd/log v0.1.0 // indirect
 	github.com/containerd/nri v0.6.1 // indirect
 	github.com/containerd/typeurl v1.0.2 // indirect
 	github.com/containers/ocicrypt v1.1.6 // indirect

go.sum

@@ -1430,8 +1430,8 @@ golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220908164124-27713097b956/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.28.0 h1:Fksou7UEQUWlKvIdsqzJmUmCX3cZuD2+P3XyyzwMhlA=
-golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.31.0 h1:ioabZlmFYtWhL+TRYpcnNlLwhyxaM9kWTDEmfnprqik=
+golang.org/x/sys v0.31.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
 golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210220032956-6a3ed077a48d/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=

internal/cmd/test-bridged-tap/main.go

@@ -38,8 +38,12 @@ import (
 )
 
 func main() {
-	skel.PluginMain(add, check, del,
-		// support CNI versions that support plugin chaining
+	skel.PluginMainFuncs(
+		skel.CNIFuncs{
+			Add:   add,
+			Check: check,
+			Del:   del,
+		},
 		version.PluginSupports("0.3.0", "0.3.1", version.Current()),
 		buildversion.BuildString("test-bridged-tap"),
 	)
@@ -188,10 +192,10 @@ func getCurrentResult(args *skel.CmdArgs) (*current.Result, error) {
 	return currentResult, nil
 }
 
-func del(args *skel.CmdArgs) error {
+func del(_ *skel.CmdArgs) error {
 	return nil
 }
 
-func check(args *skel.CmdArgs) error {
+func check(_ *skel.CmdArgs) error {
 	return nil
 }

internal/common_test.go

@@ -56,7 +56,6 @@ func TestIsStubDrive(t *testing.T) {
 	}
 
 	for _, c := range cases {
-		c := c // see https://github.com/kyoh86/scopelint/issues/4
 		t.Run(c.name, func(t *testing.T) {
 			if e, a := c.expected, IsStubDrive(c.r); e != a {
 				t.Errorf("expected %t, but received %t", e, a)

internal/network_test_utils.go

@@ -127,7 +127,7 @@ func (l localNetworkServices) Serve(ctx context.Context) error {
 	errGroup.Go(func() error {
 		for path, contents := range l.webpages {
 			webpage := contents
-			http.HandleFunc("/"+path, func(w http.ResponseWriter, r *http.Request) {
+			http.HandleFunc("/"+path, func(w http.ResponseWriter, _ *http.Request) {
 				io.WriteString(w, webpage)
 			})
 		}

internal/vm/agent.go

@@ -45,7 +45,7 @@ func NewNullIOProxy() IOProxy {
 	return &nullIOProxy{}
 }
 
-func (*nullIOProxy) start(proc *vmProc) (ioInitDone <-chan error, ioCopyDone <-chan error) {
+func (*nullIOProxy) start(_ *vmProc) (ioInitDone <-chan error, ioCopyDone <-chan error) {
 	initCh := make(chan error)
 	close(initCh)
 

internal/vm/agent_test.go

@@ -17,7 +17,7 @@ import (
 	"testing"
 
 	"github.com/containerd/containerd/cio"
-	"github.com/containerd/containerd/log"
+	"github.com/containerd/log"
 	"github.com/stretchr/testify/assert"
 )
 

internal/vm/fifo.go

@@ -23,7 +23,7 @@ import (
 
 // fifoConnector adapts containerd's fifo package to the IOConnector interface
 func fifoConnector(path string, flag int) IOConnector {
-	return func(procCtx context.Context, logger *logrus.Entry) <-chan IOConnectorResult {
+	return func(procCtx context.Context, _ *logrus.Entry) <-chan IOConnectorResult {
 		returnCh := make(chan IOConnectorResult, 1)
 		defer close(returnCh)
 

internal/vm/ioproxy_test.go

@@ -25,7 +25,7 @@ import (
 )
 
 func fileConnector(path string, flag int) IOConnector {
-	return func(procCtx context.Context, logger *logrus.Entry) <-chan IOConnectorResult {
+	return func(_ context.Context, _ *logrus.Entry) <-chan IOConnectorResult {
 		returnCh := make(chan IOConnectorResult, 1)
 		defer close(returnCh)