Single a single standalone module for guardian

bin/test.bash

@@ -31,9 +31,24 @@ fi
 
 # shellcheck disable=SC2068
 # Double-quoting array expansion here causes ginkgo to fail
+# grootfs is tested separately below with its own storage setup
 #runc
-go run github.com/onsi/ginkgo/v2/ginkgo ${@}
+go run github.com/onsi/ginkgo/v2/ginkgo --skip-package=grootfs ${@}
 #containerd
-CONTAINERD_ENABLED=true go run github.com/onsi/ginkgo/v2/ginkgo ${@}
+CONTAINERD_ENABLED=true go run github.com/onsi/ginkgo/v2/ginkgo --skip-package=grootfs ${@}
 #containerd and cpu-throttling
-CONTAINERD_ENABLED=true CPU_THROTTLING_ENABLED=true go run github.com/onsi/ginkgo/v2/ginkgo ${@}
+CONTAINERD_ENABLED=true CPU_THROTTLING_ENABLED=true go run github.com/onsi/ginkgo/v2/ginkgo --skip-package=grootfs ${@}
+
+# grootfs tests
+: "DOCKER_REGISTRY_USERNAME: ${DOCKER_REGISTRY_USERNAME:?Need to set DOCKER_REGISTRY_USERNAME}"
+: "DOCKER_REGISTRY_PASSWORD: ${DOCKER_REGISTRY_PASSWORD:?Need to set DOCKER_REGISTRY_PASSWORD}"
+
+(
+  trap filesystem_unmount_storage EXIT
+  filesystem_mount_storage
+
+  export GROOTFS_USER="nonroot"
+  pushd grootfs
+  GROOTFS_TEST_UID=0 GROOTFS_TEST_GID=0 go run github.com/onsi/ginkgo/v2/ginkgo ${@}
+  popd
+)

cmd/dadoo/main_linux.go

@@ -241,6 +241,7 @@ func setupTTYSocket(stdin io.Reader, stdout io.Writer, winszFifo io.Reader, pidF
 		defer socket.Close()
 
 		// Get the master file descriptor from runC.
+		//lint:ignore SA1019 cmsg.RecvFile is deprecated but its replacement is internal to runc
 		master, err := cmsg.RecvFile(socket)
 		if err != nil {
 			return

cmd/init/init.go

@@ -0,0 +1,5 @@
+//go:build ignore
+
+// Package init_ contains the C source for the init binary, which guardian
+// bind-mounts into containers as the container init process.
+package init_

gardener/gardener_test.go

@@ -1,3 +1,5 @@
+//lint:file-ignore SA1019 - we still specify LimitInShares to make the deprecated logic work until we get rid of the code in garden
+
 package gardener_test
 
 import (
@@ -1877,15 +1879,13 @@ var _ = Describe("Gardener", func() {
 			containerizer.InfoReturns(spec.ActualContainerSpec{
 				Limits: garden.Limits{
 					CPU: garden.CPULimits{
-						//lint:ignore SA1019 - we still specify this to make the deprecated logic work until we get rid of the code in garden
 						LimitInShares: 10,
 					},
 				},
 			}, nil)
 
 			currentCPULimits, err := container.CurrentCPULimits()
 			Expect(err).ToNot(HaveOccurred())
-			//lint:ignore SA1019 - we still specify this to make the deprecated logic work until we get rid of the code in garden
 			Expect(currentCPULimits.LimitInShares).To(BeEquivalentTo(10))
 		})
 

go.mod

@@ -3,9 +3,6 @@ module code.cloudfoundry.org/guardian
 go 1.26.3
 
 replace (
-	code.cloudfoundry.org/garden => ../garden
-	code.cloudfoundry.org/grootfs => ../grootfs
-	code.cloudfoundry.org/idmapper => ../idmapper
 	github.com/cilium/ebpf => github.com/cilium/ebpf v0.17.3
 	github.com/jessevdk/go-flags => github.com/jessevdk/go-flags v1.4.0
 )
@@ -16,12 +13,15 @@ require (
 	code.cloudfoundry.org/commandrunner v0.72.0
 	code.cloudfoundry.org/debugserver v0.107.0
 	code.cloudfoundry.org/garden v0.0.0-20260729020900-a0441c36f7b5
-	code.cloudfoundry.org/grootfs v0.30.0
-	code.cloudfoundry.org/idmapper v0.0.0-20260722021010-9c84232f2761
 	code.cloudfoundry.org/lager/v3 v3.80.0
 	code.cloudfoundry.org/localip v0.82.0
 	github.com/BurntSushi/toml v1.6.0
 	github.com/cloudfoundry/dropsonde v1.1.0
+	github.com/containers/image/v5 v5.36.2
+	github.com/containers/storage v1.59.1
+	github.com/docker/distribution v2.8.3+incompatible
+	github.com/docker/docker v28.5.2+incompatible
+	github.com/ventu-io/go-shortid v0.0.0-20201117134242-e59966efd125
 	github.com/cloudfoundry/gosigar v1.3.125
 	github.com/containerd/cgroups/v3 v3.1.3
 	github.com/containerd/containerd/api v1.11.1
@@ -78,8 +78,13 @@ require (
 	github.com/coreos/go-systemd/v22 v22.7.0 // indirect
 	github.com/cpuguy83/go-md2man/v2 v2.0.7 // indirect
 	github.com/cyphar/filepath-securejoin v0.7.0 // indirect
+	github.com/containers/libtrust v0.0.0-20230121012942-c1716e8a8d01 // indirect
+	github.com/containers/ocicrypt v1.3.2 // indirect
 	github.com/distribution/reference v0.6.0 // indirect
+	github.com/docker/docker-credential-helpers v0.9.8 // indirect
+	github.com/docker/go-connections v0.8.1 // indirect
 	github.com/docker/go-units v0.5.0 // indirect
+	github.com/gorilla/mux v1.8.1 // indirect
 	github.com/felixge/httpsnoop v1.1.0 // indirect
 	github.com/go-logr/logr v1.4.4 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
@@ -104,6 +109,7 @@ require (
 	github.com/seccomp/libseccomp-golang v0.11.1 // indirect
 	github.com/tedsuo/rata v1.0.0 // indirect
 	github.com/urfave/cli v1.22.17 // indirect
+	github.com/teris-io/shortid v0.0.0-20201117134242-e59966efd125 // indirect
 	github.com/xrash/smetrics v0.0.0-20250705151800-55b8f293f342 // indirect
 	go.opencensus.io v0.24.0 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
@@ -112,6 +118,7 @@ require (
 	go.opentelemetry.io/otel/metric v1.44.0 // indirect
 	go.opentelemetry.io/otel/trace v1.44.0 // indirect
 	go.yaml.in/yaml/v3 v3.0.5 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
 	golang.org/x/mod v0.38.0 // indirect
 	golang.org/x/net v0.57.0 // indirect
 	golang.org/x/sync v0.22.0 // indirect

gqt/create_linux_test.go

@@ -1,3 +1,5 @@
+//lint:file-ignore SA1019 - we still specify LimitInShares to make the deprecated logic work until we get rid of the code in garden
+
 package gqt_test
 
 import (
@@ -417,8 +419,7 @@ var _ = Describe("Creating a Container", func() {
 		createContainerWithCpuConfig := func(weight, shares uint64) (garden.Container, error) {
 			limits := garden.Limits{
 				CPU: garden.CPULimits{
-					Weight: weight,
-					//lint:ignore SA1019 - we still specify this to make the deprecated logic work until we get rid of the code in garden
+					Weight:        weight,
 					LimitInShares: shares,
 				},
 			}

gqt/limits_test.go

@@ -1,3 +1,5 @@
+//lint:file-ignore SA1019 - we still specify LimitInShares to make the deprecated logic work until we get rid of the code in garden
+
 package gqt_test
 
 import (
@@ -108,7 +110,6 @@ var _ = Describe("Limits", func() {
 
 		Context("CPU Limits", func() {
 			BeforeEach(func() {
-				//lint:ignore SA1019 - we still specify this to make the deprecated logic work until we get rid of the code in garden
 				limits = garden.Limits{CPU: garden.CPULimits{LimitInShares: 128}}
 				cgroupType = "cpu"
 			})

gqt/peas_linux_test.go

@@ -1,3 +1,5 @@
+//lint:file-ignore SA1019 - we still specify LimitInShares to make the deprecated logic work until we get rid of the code in garden
+
 package gqt_test
 
 import (
@@ -201,7 +203,6 @@ var _ = Describe("Partially shared containers (peas)", func() {
 						Args:  []string{"-c", "cat /proc/self/cgroup && echo done && sleep 3600"},
 						Image: garden.ImageRef{URI: "raw://" + peaRootfs},
 						OverrideContainerLimits: &garden.ProcessLimits{
-							//lint:ignore SA1019 - we still specify this to make the deprecated logic work until we get rid of the code in garden
 							CPU: garden.CPULimits{LimitInShares: 128},
 						},
 					}, garden.ProcessIO{
@@ -267,7 +268,6 @@ var _ = Describe("Partially shared containers (peas)", func() {
 						Args:  []string{"-c", "cat /proc/self/cgroup && echo done && sleep 3600"},
 						Image: garden.ImageRef{URI: "raw://" + peaRootfs},
 						OverrideContainerLimits: &garden.ProcessLimits{
-							//lint:ignore SA1019 - we still specify this to make the deprecated logic work until we get rid of the code in garden
 							CPU: garden.CPULimits{LimitInShares: 128},
 						},
 					}, garden.ProcessIO{

gqt/rootfs_test.go

@@ -14,7 +14,7 @@ import (
 	"code.cloudfoundry.org/guardian/gqt/runner"
 	yaml "gopkg.in/yaml.v2"
 
-	grootconf "code.cloudfoundry.org/grootfs/commands/config"
+	grootconf "code.cloudfoundry.org/guardian/grootfs/commands/config"
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
 	"github.com/onsi/gomega/types"

gqt/runtime_plugin_test.go

@@ -1,3 +1,5 @@
+//lint:file-ignore SA1019 - we still specify LimitInShares to make the deprecated logic work until we get rid of the code in garden
+
 package gqt_test
 
 import (
@@ -85,7 +87,6 @@ var _ = Describe("Runtime Plugin", func() {
 							LimitInBytes: 1 * 1024 * 1024,
 						},
 						CPU: garden.CPULimits{
-							//lint:ignore SA1019 - we still specify this to make the deprecated logic work until we get rid of the code in garden
 							LimitInShares: 10,
 						},
 						Pid: garden.PidLimits{

grootfs/.gitattributes

@@ -0,0 +1,11 @@
+integration/assets/oci-test-image/cflinuxfs3/blobs/sha256/ece5c7afdf59afce7dbcea5b41313af52adf4939f85f904eca78101e99e80b15 filter=lfs diff=lfs merge=lfs -text
+integration/assets/oci-test-image/cflinuxfs3/blobs/sha256/f4d8eb99c9c2cec4bf31413913780b7fd3aa20997f4c00a9361d306d37a0a95c filter=lfs diff=lfs merge=lfs -text
+integration/assets/oci-test-image/cflinuxfs3/blobs/sha256/7a03c41d629ac20bcd10aef6a23d8786e412fdad0ea39bda53f97e6646420b8f filter=lfs diff=lfs merge=lfs -text
+integration/assets/oci-test-image/cflinuxfs3/blobs/sha256/a7da48e9d2ea655e1b6b5f00d33726f97f1b67ff732808a988e20d47c490d4d2 filter=lfs diff=lfs merge=lfs -text
+integration/assets/oci-test-image/cflinuxfs3/blobs/sha256/d61bb334da913d83a609745bc5ef4ee3e7640ab811a3685f8939ffff1498d832 filter=lfs diff=lfs merge=lfs -text
+integration/assets/oci-test-image/cflinuxfs3/blobs/sha256/9c5d293e491a4d67a6f060e04d8d1256adb2565038875936df4a49581dd1e36c filter=lfs diff=lfs merge=lfs -text
+integration/assets/oci-test-image/cflinuxfs3/blobs/sha256/a56ca4c2782254d87f1778322ac19e7efdb1519515a8f8d07e30b415acce58bf filter=lfs diff=lfs merge=lfs -text
+integration/assets/oci-test-image/cflinuxfs3/blobs/sha256/cd9745847562bbee0b4ce83acdb05c34ec0671b3a3159714e4b5c24f64ae463d filter=lfs diff=lfs merge=lfs -text
+integration/assets/oci-test-image/cflinuxfs3/blobs/sha256/0bcb283305e91b239f25d655b56f3b6c618f1b45b5295b59fef48f22ddeccdee filter=lfs diff=lfs merge=lfs -text
+integration/assets/oci-test-image/cflinuxfs3/blobs/sha256/2b6208622eeaf257c4784520d3641480d7ad3254d566c0ae2d044e390282aab5 filter=lfs diff=lfs merge=lfs -text
+integration/assets/oci-test-image/cflinuxfs3/blobs/sha256/6280eb4a2cfbdb88436ee2b62bb47830cc97a0a1cafd50ab2ff6f1313dab8913 filter=lfs diff=lfs merge=lfs -text

grootfs/.gitignore

@@ -0,0 +1,15 @@
+# Artifacts
+/grootfs
+/grootfs.exe
+/drax
+/tardis
+playground/grootfs
+playground/drax
+tags
+build
+!/vendor/github.com/onsi/ginkgo/v2/ginkgo/build
+
+# OSX
+.DS_Store
+
+grootfs.iml