Fix a few typos

.codespellrc

@@ -0,0 +1,3 @@
+[codespell]
+skip = ./.git,tags,go.mod,go.sum,./test/image/latin10k.txt,./website/assets/images
+ignore-words-list = savable,adin

Makefile

@@ -97,7 +97,7 @@ endif
 ##
 ## Development helpers and tooling.
 ##
-##   These targets faciliate local development by automatically
+##   These targets facilitate local development by automatically
 ##   installing and configuring a runtime. Several variables may
 ##   be used here to tweak the installation:
 ##     RUNTIME         - The name of the installed runtime (default: $BRANCH_NAME).
@@ -755,3 +755,7 @@ release: $(RELEASE_KEY) $(RELEASE_ARTIFACTS)/$(ARCH)
 tag: ## Creates and pushes a release tag.
 	@tools/tag_release.sh "$(RELEASE_COMMIT)" "$(RELEASE_NAME)" "$(RELEASE_NOTES)"
 .PHONY: tag
+
+codespell:
+	codespell
+.PHONY: codespell

WORKSPACE

@@ -3,7 +3,7 @@ load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive", "http_file"
 
 # Root certificates.
 #
-# Note that the sha256 hash is ommitted here intentionally. This should not be
+# Note that the sha256 hash is omitted here intentionally. This should not be
 # used in any part of the build other than as certificates present in images.
 http_file(
     name = "google_root_pem",

pkg/sentry/kernel/auth/capability_set_test.go

@@ -22,7 +22,7 @@ import (
 	"gvisor.dev/gvisor/pkg/errors/linuxerr"
 )
 
-// capsEquals returns trun when the given creds' capabilities match the given caps.
+// capsEquals returns true when the given creds' capabilities match the given caps.
 func capsEquals(creds *Credentials, caps TaskCapabilities) bool {
 	return creds.PermittedCaps == caps.PermittedCaps &&
 		creds.InheritableCaps == caps.InheritableCaps &&

pkg/sentry/kernel/kernel_restore.go

@@ -30,7 +30,7 @@ type Saver interface {
 // +stateify savable
 type CheckpointGeneration struct {
 	// Count is incremented every time a checkpoint is triggered, even if the
-	// chekpoint failed.
+	// checkpoint failed.
 	Count uint32
 	// Restore indicates if the current instance resumed after the checkpoint or
 	// it was restored from a checkpoint.

pkg/sentry/platform/platform.go

@@ -273,7 +273,7 @@ type Context interface {
 	// Release() releases any resources associated with this context.
 	Release()
 
-	// PrepareSleep() is called when the tread switches to the
+	// PrepareSleep() is called when the thread switches to the
 	// interruptible sleep state.
 	PrepareSleep()
 }

pkg/sentry/seccheck/sinks/remote/test/server.go

@@ -80,7 +80,7 @@ func (s *Server) Count() int {
 	return len(s.points)
 }
 
-// Reset throws aways all points received so far and returns the number of
+// Reset throws away all points received so far and returns the number of
 // points discarded.
 func (s *Server) Reset() int {
 	s.cond.L.Lock()

pkg/sentry/socket/netlink/route/protocol.go

@@ -162,7 +162,7 @@ func (p *Protocol) getLink(ctx context.Context, s *netlink.Socket, msg *nlmsg.Me
 	return nil
 }
 
-// newLink handles RTM_NEWLINK reqeusts.
+// newLink handles RTM_NEWLINK requests.
 func (p *Protocol) newLink(ctx context.Context, s *netlink.Socket, msg *nlmsg.Message, ms *nlmsg.MessageSet) *syserr.Error {
 	stack := s.Stack()
 	if stack == nil {

pkg/sentry/socket/netstack/stack.go

@@ -184,7 +184,7 @@ func (s *Stack) SetInterface(ctx context.Context, msg *nlmsg.Message) *syserr.Er
 }
 
 func (s *Stack) setLink(ctx context.Context, id tcpip.NICID, linkAttrs map[uint16]nlmsg.BytesView) *syserr.Error {
-	// IFLA_NET_NS_FD has to be handled first, because other parameters may be reseted.
+	// IFLA_NET_NS_FD has to be handled first, because other parameters may be reset.
 	if v, ok := linkAttrs[linux.IFLA_NET_NS_FD]; ok {
 		fd, ok := v.Uint32()
 		if !ok {

pkg/sentry/socket/plugin/stack/notifier.go

@@ -99,7 +99,7 @@ func (n *Notifier) UpdateFD(fd uint32) {
 // object. Once notifications arrive, they are dispatched to the
 // registered queue.
 func (n *Notifier) waitAndNotify(ioInit chan int32) error {
-	// plugin stack leverages TLS varaibles, so bind this goroutine with
+	// plugin stack leverages TLS variables, so bind this goroutine with
 	// one specific OS thread
 	runtime.LockOSThread()
 

pkg/tcpip/stack/bridge.go

@@ -283,8 +283,8 @@ func (b *BridgeEndpoint) Close() {}
 // SetOnCloseAction implements stack.LinkEndpoint.Close.
 func (b *BridgeEndpoint) SetOnCloseAction(func()) {}
 
-// Add a new FDBEntry by learning. The learning happens when a packaet
-// is recevied by a bridge port, the bridge will use the port for the future
+// Add a new FDBEntry by learning. The learning happens when a packet
+// is received by a bridge port, the bridge will use the port for the future
 // deliveries to the NIC device.
 // The addr is the key when it looks for the entry.
 //

pkg/tcpip/stack/registration.go

@@ -1149,7 +1149,7 @@ type NetworkLinkEndpoint interface {
 	// Close is called when the endpoint is removed from a stack.
 	Close()
 
-	// SetOnCloseAction sets the action that will be exected before closing the
+	// SetOnCloseAction sets the action that will be executed before closing the
 	// endpoint. It is used to destroy a network device when its endpoint
 	// is closed. Endpoints that are closed only after destroying their
 	// network devices can implement this method as no-op.

runsc/BUILD

@@ -42,7 +42,7 @@ go_binary(
 # The runsc-race target is a race-compatible BUILD target. This must be built
 # via: bazel build --features=race :runsc-race
 #
-# This is neccessary because the race feature must apply to all dependencies
+# This is necessary because the race feature must apply to all dependencies
 # due a bug in gazelle file selection.  The pure attribute must be off because
 # the race detector requires linking with non-Go components, although we still
 # require a static binary.

runsc/boot/portforward/portforward_hostinet.go

@@ -33,7 +33,7 @@ var (
 )
 
 // hostInetConn allows reading and writing to a local host socket for hostinet.
-// hostInetConn implments proxyConn.
+// hostInetConn implements proxyConn.
 type hostInetConn struct {
 	// wq is the WaitQueue registered with fdnotifier for this fd.
 	wq waiter.Queue

runsc/boot/portforward/portforward_hostinet_test.go

@@ -64,7 +64,7 @@ func TestLocalHostSocket(t *testing.T) {
 		}
 
 		if !slices.Equal(data[:recLen], clientData) {
-			return fmt.Errorf("server mismatch data recieved: got: %s want: %s", data[:recLen], clientData)
+			return fmt.Errorf("server mismatch data received: got: %s want: %s", data[:recLen], clientData)
 		}
 
 		sentLen, err := conn.Write(serverData)

runsc/boot/procfs/dump.go

@@ -96,7 +96,7 @@ type ProcessProcfsDump struct {
 	StartTime int64 `json:"clone_ts,omitempty"`
 	// Root is /proc/[pid]/root.
 	Root string `json:"root,omitempty"`
-	// Limits constains resource limits for this process. Currently only
+	// Limits constrains resource limits for this process. Currently only
 	// RLIMIT_NOFILE is supported.
 	Limits map[string]limits.Limit `json:"limits,omitempty"`
 	// Cgroup is /proc/[pid]/cgroup split into an array.

runsc/boot/vfs.go

@@ -1006,7 +1006,7 @@ func (c *containerMounter) mountTmp(ctx context.Context, spec *specs.Spec, conf
 	for _, m := range c.mounts {
 		// m.Destination has been cleaned, so it's to use equality here.
 		if m.Destination == "/tmp" {
-			log.Debugf(`Explict "/tmp" mount found, skipping internal tmpfs, mount: %+v`, m)
+			log.Debugf(`Explicit "/tmp" mount found, skipping internal tmpfs, mount: %+v`, m)
 			return nil
 		}
 	}

runsc/cgroup/systemd_test.go

@@ -56,7 +56,7 @@ func TestIsValidSlice(t *testing.T) {
 			err:   ErrInvalidSlice,
 		},
 		{
-			name:  "has path seperators",
+			name:  "has path separators",
 			slice: "systemd.slice/child.slice",
 			err:   ErrInvalidSlice,
 		},

runsc/cmd/boot.go

@@ -585,7 +585,7 @@ func (b *Boot) Execute(_ context.Context, f *flag.FlagSet, args ...any) subcomma
 // prepareArgs returns the args that can be used to re-execute the current
 // program. It manipulates the flags of the subcommands.Command identified by
 // subCmdName and fSet is the flag.FlagSet of this subcommand. It applies the
-// flags specified by override map. In case of conflict, flag is overriden.
+// flags specified by override map. In case of conflict, flag is overridden.
 //
 // Postcondition: prepareArgs() takes ownership of override map.
 func prepareArgs(subCmdName string, fSet *flag.FlagSet, override map[string]string) []string {

runsc/cmd/debug.go

@@ -147,7 +147,7 @@ func (d *Debug) Execute(_ context.Context, f *flag.FlagSet, args ...any) subcomm
 		pid := c.Sandbox.Getpid()
 		util.Infof("Sending signal %d to process: %d", d.signal, pid)
 		if err := unix.Kill(pid, unix.Signal(d.signal)); err != nil {
-			return util.Errorf("failed to send signal %d to processs %d", d.signal, pid)
+			return util.Errorf("failed to send signal %d to process %d", d.signal, pid)
 		}
 	}
 	if d.stacks {