Prepare to make directfs the default in runsc.

We plan on making --directfs=true the default for runsc. That will be a
risky change which might need rollbacks. This change is in preparation for
that so that the breaking change has a small delta.

PiperOrigin-RevId: 532670826

.buildkite/pipeline.yaml

@@ -401,8 +401,8 @@ steps:
     <<: *source_test
     label: ":podman: Podman"
     commands:
-      - sudo ./test/podman/run.sh
-      - sudo RUNTIME_ARGS=--directfs ./test/podman/run.sh
+      - sudo RUNTIME_ARGS=--directfs=false ./test/podman/run.sh
+      - sudo RUNTIME_ARGS=--directfs=true ./test/podman/run.sh
     agents:
       <<: *ubuntu_agents
       cgroup: "v2"
@@ -439,7 +439,7 @@ steps:
   - <<: *common
     <<: *docker
     label: ":php: PHP runtime tests"
-    command: make php8.1.1-runtime-tests
+    command: make php8.1.1-runtime-tests RUNTIME_ARGS=--directfs
     parallelism: 10
     agents:
       <<: *platform_specific_agents
@@ -448,7 +448,7 @@ steps:
   - <<: *common
     <<: *docker
     label: ":java: Java runtime tests"
-    command: make java17-runtime-tests
+    command: make java17-runtime-tests RUNTIME_ARGS=--directfs
     parallelism: 40
     agents:
       <<: *platform_specific_agents
@@ -457,7 +457,7 @@ steps:
   - <<: *common
     <<: *docker
     label: ":golang: Go runtime tests"
-    command: make go1.20-runtime-tests
+    command: make go1.20-runtime-tests RUNTIME_ARGS=--directfs
     parallelism: 10
     agents:
       <<: *platform_specific_agents
@@ -466,7 +466,7 @@ steps:
   - <<: *common
     <<: *docker
     label: ":node: NodeJS runtime tests"
-    command: make nodejs16.13.2-runtime-tests
+    command: make nodejs16.13.2-runtime-tests RUNTIME_ARGS=--directfs
     parallelism: 10
     agents:
       <<: *platform_specific_agents
@@ -475,18 +475,18 @@ steps:
   - <<: *common
     <<: *docker
     label: ":python: Python runtime tests"
-    command: make python3.10.2-runtime-tests
+    command: make python3.10.2-runtime-tests RUNTIME_ARGS=--directfs
     parallelism: 10
     agents:
       <<: *platform_specific_agents
       <<: *ubuntu_agents
       arch: "amd64"
 
-  # Runtime tests (directfs).
+  # Runtime tests (goferfs). Continuous only.
   - <<: *common
     <<: *docker
-    label: ":php: PHP runtime tests (directfs)"
-    command: make php8.1.1-runtime-tests RUNTIME_ARGS=--directfs
+    label: ":php: PHP runtime tests (goferfs)"
+    command: make php8.1.1-runtime-tests RUNTIME_ARGS=--directfs=false
     parallelism: 10
     if: build.branch == "master"
     agents:
@@ -495,8 +495,8 @@ steps:
       arch: "amd64"
   - <<: *common
     <<: *docker
-    label: ":java: Java runtime tests (directfs)"
-    command: make java17-runtime-tests RUNTIME_ARGS=--directfs
+    label: ":java: Java runtime tests (goferfs)"
+    command: make java17-runtime-tests RUNTIME_ARGS=--directfs=false
     parallelism: 40
     if: build.branch == "master"
     agents:
@@ -505,8 +505,8 @@ steps:
       arch: "amd64"
   - <<: *common
     <<: *docker
-    label: ":golang: Go runtime tests (directfs)"
-    command: make go1.20-runtime-tests RUNTIME_ARGS=--directfs
+    label: ":golang: Go runtime tests (goferfs)"
+    command: make go1.20-runtime-tests RUNTIME_ARGS=--directfs=false
     parallelism: 10
     if: build.branch == "master"
     agents:
@@ -515,8 +515,8 @@ steps:
       arch: "amd64"
   - <<: *common
     <<: *docker
-    label: ":node: NodeJS runtime tests (directfs)"
-    command: make nodejs16.13.2-runtime-tests RUNTIME_ARGS=--directfs
+    label: ":node: NodeJS runtime tests (goferfs)"
+    command: make nodejs16.13.2-runtime-tests RUNTIME_ARGS=--directfs=false
     parallelism: 10
     if: build.branch == "master"
     agents:
@@ -525,8 +525,8 @@ steps:
       arch: "amd64"
   - <<: *common
     <<: *docker
-    label: ":python: Python runtime tests (directfs)"
-    command: make python3.10.2-runtime-tests RUNTIME_ARGS=--directfs
+    label: ":python: Python runtime tests (goferfs)"
+    command: make python3.10.2-runtime-tests RUNTIME_ARGS=--directfs=false
     parallelism: 10
     if: build.branch == "master"
     agents:

runsc/boot/loader_test.go

@@ -77,7 +77,7 @@ func testSpec() *specs.Spec {
 // startGofer starts a new gofer routine serving 'root' path. It returns the
 // sandbox side of the connection, and a function that when called will stop the
 // gofer.
-func startGofer(root string) (int, func(), error) {
+func startGofer(root string, conf *config.Config) (int, func(), error) {
 	fds, err := unix.Socketpair(unix.AF_UNIX, unix.SOCK_STREAM|unix.SOCK_CLOEXEC, 0)
 	if err != nil {
 		return 0, nil, err
@@ -90,7 +90,11 @@ func startGofer(root string) (int, func(), error) {
 		unix.Close(goferEnd)
 		return 0, nil, fmt.Errorf("error creating server on FD %d: %v", goferEnd, err)
 	}
-	server := fsgofer.NewLisafsServer(fsgofer.Config{})
+	server := fsgofer.NewLisafsServer(fsgofer.Config{
+		HostUDS:            conf.GetHostUDS(),
+		HostFifo:           conf.HostFifo,
+		DonateMountPointFD: conf.DirectFS,
+	})
 	c, err := server.CreateConnection(socket, root, true /* readonly */)
 	if err != nil {
 		return 0, nil, err
@@ -113,7 +117,7 @@ func createLoader(conf *config.Config, spec *specs.Spec) (*Loader, func(), error
 	if err != nil {
 		return nil, nil, err
 	}
-	sandEnd, cleanup, err := startGofer(spec.Root.Path)
+	sandEnd, cleanup, err := startGofer(spec.Root.Path, conf)
 	if err != nil {
 		return nil, nil, err
 	}

runsc/cmd/capability_test.go

@@ -70,6 +70,11 @@ func checkCaps(which capability.CapType, curCaps capability.Capabilities, wantCa
 }
 
 func TestCapabilities(t *testing.T) {
+	t.Run("directfs", func(t *testing.T) { testCapabilities(t, true) })
+	t.Run("lisafs", func(t *testing.T) { testCapabilities(t, false) })
+}
+
+func testCapabilities(t *testing.T, directfs bool) {
 	stop := testutil.StartReaper()
 	defer stop()
 
@@ -86,6 +91,7 @@ func TestCapabilities(t *testing.T) {
 	}
 
 	conf := testutil.TestConfig(t)
+	conf.DirectFS = directfs
 
 	// Use --network=host to make sandbox use spec's capabilities.
 	conf.Network = config.NetworkHost
@@ -111,8 +117,13 @@ func TestCapabilities(t *testing.T) {
 		t.Fatalf("error starting container: %v", err)
 	}
 
+	wantSandboxCaps := spec.Process.Capabilities
+	if directfs {
+		// With directfs, the sandbox has additional capabilities.
+		wantSandboxCaps = specutils.MergeCapabilities(wantSandboxCaps, directfsSandboxLinuxCaps)
+	}
 	// Check that sandbox and gofer have the proper capabilities.
-	if err := checkProcessCaps(c.Sandbox.Getpid(), spec.Process.Capabilities); err != nil {
+	if err := checkProcessCaps(c.Sandbox.Getpid(), wantSandboxCaps); err != nil {
 		t.Error(err)
 	}
 	if err := checkProcessCaps(c.GoferPid, goferCaps); err != nil {

test/runner/main.go

@@ -271,6 +271,8 @@ func runRunsc(tc *gtest.TestCase, spec *specs.Spec) error {
 	}
 	if *directfs {
 		args = append(args, "-directfs")
+	} else {
+		args = append(args, "-directfs=false")
 	}
 
 	testLogDir := ""