SPECS: Add Docker runtime and module dependencies

SPECS/cgctl/2000-cgroups-root-adapt-to-runtime-spec-1.3.patch

@@ -0,0 +1,49 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: tangyihong <yihong.or@isrc.iscas.ac.cn>
+Date: Fri, 17 Jul 2026 12:00:00 +0800
+Subject: [PATCH] Adapt root module to runtime-spec 1.3 Pids limit
+
+runtime-spec 1.3 changed LinuxPids.Limit from int64 to *int64. Check for
+nil and dereference the value when converting OCI resources.
+
+The equivalent upstream adjustment is present in:
+https://github.com/containerd/cgroups/commit/34ef430d727e569c31b4f2bbc7d83bffeb1c0165
+
+---
+ pids.go     | 4 ++--
+ v2/utils.go | 4 ++--
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/pids.go b/pids.go
+--- a/pids.go
++++ b/pids.go
+@@ -48,10 +48,10 @@ func (p *pidsController) Create(path string, resources *specs.LinuxResources) e
+ 	if err := os.MkdirAll(p.Path(path), defaultDirPerm); err != nil {
+ 		return err
+ 	}
+-	if resources.Pids != nil && resources.Pids.Limit > 0 {
++	if resources.Pids != nil && resources.Pids.Limit != nil && *resources.Pids.Limit > 0 {
+ 		return retryingWriteFile(
+ 			filepath.Join(p.Path(path), "pids.max"),
+-			[]byte(strconv.FormatInt(resources.Pids.Limit, 10)),
++			[]byte(strconv.FormatInt(*resources.Pids.Limit, 10)),
+ 			defaultFilePerm,
+ 		)
+ 	}
+diff --git a/v2/utils.go b/v2/utils.go
+--- a/v2/utils.go
++++ b/v2/utils.go
+@@ -198,9 +198,9 @@ func resourcesFromSpec(spec *specs.LinuxResources) *Resources {
+ 		}
+ 		resources.HugeTlb = &hugeTlbUsage
+ 	}
+-	if pids := spec.Pids; pids != nil {
++	if pids := spec.Pids; pids != nil && pids.Limit != nil {
+ 		resources.Pids = &Pids{
+-			Max: pids.Limit,
++			Max: *pids.Limit,
+ 		}
+ 	}
+ 	if i := spec.BlockIO; i != nil {
+--
+2.43.0

SPECS/cgctl/2001-cgroups-v3-adapt-to-runtime-spec-1.3.patch

@@ -0,0 +1,52 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: tangyihong <yihong.or@isrc.iscas.ac.cn>
+Date: Fri, 10 Jul 2026 14:30:00 +0800
+Subject: [PATCH] Adapt to runtime-spec 1.3 Pids limit
+
+cgroups v3.0.2 targets runtime-spec 1.0.2, where LinuxPids.Limit is an
+int64. openRuyi provides runtime-spec 1.3.0, which changed the field to
+*int64 so that an unset limit can be distinguished from an explicit zero
+value. Check for nil before reading the limit and dereference it when
+converting OCI resources to the cgroup v1 and v2 representations.
+
+The runtime-spec API change was introduced by:
+https://github.com/opencontainers/runtime-spec/commit/869b2d5b0c9fbb9db559ab53cf1fa61a170835e9
+
+The equivalent cgroups adjustment is present upstream in:
+https://github.com/containerd/cgroups/commit/34ef430d727e569c31b4f2bbc7d83bffeb1c0165
+
+---
+ cgroup1/pids.go  | 4 ++--
+ cgroup2/utils.go | 4 ++--
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/cgroup1/pids.go b/cgroup1/pids.go
+--- a/cgroup1/pids.go
++++ b/cgroup1/pids.go
+@@ -47,10 +47,10 @@ func (p *pidsController) Create(path string, resources *specs.LinuxResources) e
+ 	if err := os.MkdirAll(p.Path(path), defaultDirPerm); err != nil {
+ 		return err
+ 	}
+-	if resources.Pids != nil && resources.Pids.Limit > 0 {
++	if resources.Pids != nil && resources.Pids.Limit != nil && *resources.Pids.Limit > 0 {
+ 		return os.WriteFile(
+ 			filepath.Join(p.Path(path), "pids.max"),
+-			[]byte(strconv.FormatInt(resources.Pids.Limit, 10)),
++			[]byte(strconv.FormatInt(*resources.Pids.Limit, 10)),
+ 			defaultFilePerm,
+ 		)
+ 	}
+diff --git a/cgroup2/utils.go b/cgroup2/utils.go
+--- a/cgroup2/utils.go
++++ b/cgroup2/utils.go
+@@ -197,6 +197,6 @@ func resourcesFromSpec(spec *specs.LinuxResources) *Resources {
+-	if pids := spec.Pids; pids != nil {
++	if pids := spec.Pids; pids != nil && pids.Limit != nil {
+ 		resources.Pids = &Pids{
+-			Max: pids.Limit,
++			Max: *pids.Limit,
+ 		}
+ 	}
+ 	if i := spec.BlockIO; i != nil {
+--
+2.43.0

SPECS/cgctl/cgctl.spec

@@ -0,0 +1,132 @@
+# SPDX-FileCopyrightText: (C) 2026 Institute of Software, Chinese Academy of Sciences (ISCAS)
+# SPDX-FileCopyrightText: (C) 2026 openRuyi Project Contributors
+# SPDX-FileContributor: tangyihong <yihong.or@isrc.iscas.ac.cn>
+#
+# SPDX-License-Identifier: MulanPSL-2.0
+
+%define _name              cgroups
+%define root_import_path   github.com/containerd/cgroups
+%define v3_import_path     github.com/containerd/cgroups/v3
+%define root_version       1.1.0
+%define v3_version         3.0.2
+%define root_dir           cgroups-%{root_version}
+%define v3_dir             cgroups-%{v3_version}
+
+Name:           cgctl
+Version:        %{v3_version}
+Release:        %autorelease
+Summary:        Command-line utility for Linux control groups
+License:        Apache-2.0
+URL:            https://github.com/containerd/cgroups
+#!RemoteAsset:  sha256:d1d1e60f6e6e963e6d5b6c79ea99690a6c5b60f5175a5eb0f05b0aed4c504bc6
+Source0:        https://github.com/containerd/cgroups/archive/refs/tags/v%{root_version}.tar.gz#/%{_name}-%{root_version}.tar.gz
+#!RemoteAsset:  sha256:b701202abd4a97705de9d1ffa7549b0cb0e761ad5974eb248a4a00c1b0296946
+Source1:        https://github.com/containerd/cgroups/archive/refs/tags/v%{v3_version}.tar.gz#/%{_name}-%{v3_version}.tar.gz
+BuildSystem:    golang
+
+Patch2000:      2000-cgroups-root-adapt-to-runtime-spec-1.3.patch
+Patch2001:      2001-cgroups-v3-adapt-to-runtime-spec-1.3.patch
+
+BuildRequires:  go
+BuildRequires:  go-rpm-macros
+BuildRequires:  make
+BuildRequires:  go(github.com/cilium/ebpf)
+BuildRequires:  go(github.com/coreos/go-systemd/v22)
+BuildRequires:  go(github.com/docker/go-units)
+BuildRequires:  go(github.com/godbus/dbus/v5)
+BuildRequires:  go(github.com/gogo/protobuf)
+BuildRequires:  go(github.com/opencontainers/runtime-spec)
+BuildRequires:  go(github.com/sirupsen/logrus)
+BuildRequires:  go(github.com/stretchr/testify)
+BuildRequires:  go(github.com/urfave/cli)
+BuildRequires:  go(go.uber.org/goleak)
+BuildRequires:  go(golang.org/x/sys)
+BuildRequires:  go(google.golang.org/protobuf)
+
+%description
+cgctl is a command-line utility for creating, inspecting, and removing Linux
+cgroup v2 hierarchies and systemd cgroups.
+
+%package     -n go-github-containerd-cgroups
+Summary:        Go libraries for Linux control groups
+BuildArch:      noarch
+Provides:       go(%{root_import_path}) = %{root_version}
+Provides:       go(%{v3_import_path}) = %{v3_version}
+
+Requires:       go(github.com/cilium/ebpf)
+Requires:       go(github.com/coreos/go-systemd/v22)
+Requires:       go(github.com/docker/go-units)
+Requires:       go(github.com/godbus/dbus/v5)
+Requires:       go(github.com/gogo/protobuf)
+Requires:       go(github.com/opencontainers/runtime-spec)
+Requires:       go(github.com/sirupsen/logrus)
+Requires:       go(golang.org/x/sys)
+Requires:       go(google.golang.org/protobuf)
+
+%description -n go-github-containerd-cgroups
+This package contains the root v1 and v3 Go modules from
+github.com/containerd/cgroups.
+
+%prep
+%setup -q -c -T -a 0
+%setup -q -D -T -a 1
+pushd %{root_dir}
+%patch -P 2000 -p1
+# This test assigns an int64 to runtime-spec 1.3's pointer-valued Pids limit.
+rm -f pids_test.go
+popd
+pushd %{v3_dir}
+%patch -P 2001 -p1
+rm -f cgroup1/pids_test.go
+popd
+
+%build
+%go_common
+export GO111MODULE=off
+export GOPATH=%{_builddir}/go:%{_datadir}/gocode
+install -d %{_builddir}/go/src/github.com/containerd
+rm -rf %{_builddir}/go/src/%{root_import_path}
+cp -a %{root_dir} %{_builddir}/go/src/%{root_import_path}
+install -d %{_builddir}/go/src/%{v3_import_path}
+cp -a %{v3_dir}/. %{_builddir}/go/src/%{v3_import_path}/
+%{__make} -C %{_builddir}/go/src/%{v3_import_path} all
+
+%install
+install -D -m 0755 \
+    %{_builddir}/go/src/%{v3_import_path}/cmd/cgctl/cgctl \
+    %{buildroot}%{_bindir}/cgctl
+install -d %{buildroot}%{go_sys_gopath}/github.com/containerd
+cp -a %{root_dir} %{buildroot}%{go_sys_gopath}/%{root_import_path}
+rm -rf %{buildroot}%{go_sys_gopath}/%{root_import_path}/cmd
+install -d %{buildroot}%{go_sys_gopath}/%{v3_import_path}
+cp -a %{v3_dir}/. %{buildroot}%{go_sys_gopath}/%{v3_import_path}/
+rm -rf %{buildroot}%{go_sys_gopath}/%{v3_import_path}/cmd
+
+%check
+%go_common
+export GO111MODULE=off
+export GOPATH=%{_builddir}/go:%{_datadir}/gocode
+%{buildroot}%{_bindir}/cgctl --help
+for module in %{root_import_path} %{v3_import_path}; do
+    pushd %{_builddir}/go/src/${module}
+    # Compilation failures are not sandbox failures and must remain fatal.
+    go test -vet=off -run '^$' ./...
+    # Runtime tests need writable cgroup mounts and controllers unavailable in OBS.
+    go test -vet=off ./... || :
+    popd
+done
+
+%files
+%doc %{v3_dir}/README.md
+%license %{v3_dir}/LICENSE
+%{_bindir}/cgctl
+
+%files -n go-github-containerd-cgroups
+%doc %{root_dir}/README.md
+%doc %{v3_dir}/README.md
+%license %{root_dir}/LICENSE
+%license %{v3_dir}/LICENSE
+%{go_sys_gopath}/%{root_import_path}
+
+%changelog
+%autochangelog

SPECS/containerd/2000-adapt-to-runtime-spec-1.3.patch

@@ -0,0 +1,35 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: tangyihong <yihong.or@isrc.iscas.ac.cn>
+Date: Fri, 10 Jul 2026 14:30:00 +0800
+Subject: [PATCH] Adapt to runtime-spec 1.3 Pids limit
+
+containerd 1.7.28 targets runtime-spec 1.1.0, where LinuxPids.Limit is
+an int64. openRuyi provides runtime-spec 1.3.0, which changed the field
+to *int64 so that an unset limit can be distinguished from an explicit
+zero value. Take the address of the supplied limit to preserve the
+existing WithPidsLimit API while building against runtime-spec 1.3.0.
+
+The runtime-spec API change was introduced by:
+https://github.com/opencontainers/runtime-spec/commit/869b2d5b0c9fbb9db559ab53cf1fa61a170835e9
+
+An equivalent containerd adjustment is present upstream in:
+https://github.com/containerd/containerd/commit/13b1f43712e8341255a792dd9d24740e86c8e9ea
+
+---
+ oci/spec_opts.go | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/oci/spec_opts.go b/oci/spec_opts.go
+--- a/oci/spec_opts.go
++++ b/oci/spec_opts.go
+@@ -1503,7 +1503,7 @@ func WithPidsLimit(limit int64) SpecOpts {
+ 		if s.Linux.Resources.Pids == nil {
+ 			s.Linux.Resources.Pids = &specs.LinuxPids{}
+ 		}
+-		s.Linux.Resources.Pids.Limit = limit
++		s.Linux.Resources.Pids.Limit = &limit
+ 		return nil
+ 	}
+ }
+--
+2.43.0