Close gofer filestore FDs in failure cases.

This is consistent with how other FDs are closed. This is so we don't leak FDs
if they are not consumed.

PiperOrigin-RevId: 578638281

runsc/boot/controller.go

@@ -346,6 +346,11 @@ func (cm *containerManager) StartSubcontainer(args *StartArgs, _ *struct{}) erro
 		goferFilestoreFDs = append(goferFilestoreFDs, goferFilestoreFD)
 	}
 	goferFiles = goferFiles[args.NumGoferFilestoreFDs:]
+	defer func() {
+		for _, fd := range goferFilestoreFDs {
+			_ = fd.Close()
+		}
+	}()
 
 	goferFDs, err := fd.NewFromFiles(goferFiles)
 	if err != nil {

runsc/boot/loader.go

@@ -598,9 +598,9 @@ func (l *Loader) Destroy() {
 	// Release any dangling tcp connections.
 	tcpip.ReleaseDanglingEndpoints()
 
-	// In the success case, stdioFDs and goferFDs will only contain
-	// released/closed FDs that ownership has been passed over to host FDs and
-	// gofer sessions. Close them here in case of failure.
+	// In the success case, all FDs in l.root will only contain released/closed
+	// FDs whose ownership has been passed over to host FDs and gofer sessions.
+	// Close them here in case of failure.
 	for _, f := range l.root.stdioFDs {
 		_ = f.Close()
 	}
@@ -610,6 +610,9 @@ func (l *Loader) Destroy() {
 	for _, f := range l.root.goferFDs {
 		_ = f.Close()
 	}
+	for _, f := range l.root.goferFilestoreFDs {
+		_ = f.Close()
+	}
 
 	l.stopProfiling()
 }

runsc/container/container.go

@@ -467,6 +467,9 @@ func (c *Container) Start(conf *config.Config) error {
 				for _, f := range goferFiles {
 					_ = f.Close()
 				}
+				for _, f := range goferFilestores {
+					_ = f.Close()
+				}
 			}()
 
 			cleanMounts, err := specutils.ReadMounts(mountsFile)