Remove unused runc files

We no longer use runc code to read network I/O usage. This lets
us remove a lot of vendored code.

Signed-off-by: Matthew Heon <matthew.heon@gmail.com>

Closes: #425
Approved by: rhatdan

62 files changed, 0 insertions, 11759 deletions

diff --git a/vendor/github.com/opencontainers/runc/libcontainer/apparmor/apparmor.go b/vendor/github.com/opencontainers/runc/libcontainer/apparmor/apparmor.go
deleted file mode 100644
index 7fff0627f..000000000
--- a/vendor/github.com/opencontainers/runc/libcontainer/apparmor/apparmor.go
+++ /dev/null
@@ -1,54 +0,0 @@
-// +build apparmor,linux
-
-package apparmor
-
-import (
-	"fmt"
-	"io/ioutil"
-	"os"
-)
-
-// IsEnabled returns true if apparmor is enabled for the host.
-func IsEnabled() bool {
-	if _, err := os.Stat("/sys/kernel/security/apparmor"); err == nil && os.Getenv("container") == "" {
-		if _, err = os.Stat("/sbin/apparmor_parser"); err == nil {
-			buf, err := ioutil.ReadFile("/sys/module/apparmor/parameters/enabled")
-			return err == nil && len(buf) > 1 && buf[0] == 'Y'
-		}
-	}
-	return false
-}
-
-func setprocattr(attr, value string) error {
-	// Under AppArmor you can only change your own attr, so use /proc/self/
-	// instead of /proc/<tid>/ like libapparmor does
-	path := fmt.Sprintf("/proc/self/attr/%s", attr)
-
-	f, err := os.OpenFile(path, os.O_WRONLY, 0)
-	if err != nil {
-		return err
-	}
-	defer f.Close()
-
-	_, err = fmt.Fprintf(f, "%s", value)
-	return err
-}
-
-// changeOnExec reimplements aa_change_onexec from libapparmor in Go
-func changeOnExec(name string) error {
-	value := "exec " + name
-	if err := setprocattr("exec", value); err != nil {
-		return fmt.Errorf("apparmor failed to apply profile: %s", err)
-	}
-	return nil
-}
-
-// ApplyProfile will apply the profile with the specified name to the process after
-// the next exec.
-func ApplyProfile(name string) error {
-	if name == "" {
-		return nil
-	}
-
-	return changeOnExec(name)
-}
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/apparmor/apparmor_disabled.go b/vendor/github.com/opencontainers/runc/libcontainer/apparmor/apparmor_disabled.go
deleted file mode 100644
index d4110cf0b..000000000
--- a/vendor/github.com/opencontainers/runc/libcontainer/apparmor/apparmor_disabled.go
+++ /dev/null
@@ -1,20 +0,0 @@
-// +build !apparmor !linux
-
-package apparmor
-
-import (
-	"errors"
-)
-
-var ErrApparmorNotEnabled = errors.New("apparmor: config provided but apparmor not supported")
-
-func IsEnabled() bool {
-	return false
-}
-
-func ApplyProfile(name string) error {
-	if name != "" {
-		return ErrApparmorNotEnabled
-	}
-	return nil
-}
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/capabilities_linux.go b/vendor/github.com/opencontainers/runc/libcontainer/capabilities_linux.go
deleted file mode 100644
index 8981b2a2f..000000000
--- a/vendor/github.com/opencontainers/runc/libcontainer/capabilities_linux.go
+++ /dev/null
@@ -1,114 +0,0 @@
-// +build linux
-
-package libcontainer
-
-import (
-	"fmt"
-	"os"
-	"strings"
-
-	"github.com/opencontainers/runc/libcontainer/configs"
-	"github.com/syndtr/gocapability/capability"
-)
-
-const allCapabilityTypes = capability.CAPS | capability.BOUNDS | capability.AMBS
-
-var capabilityMap map[string]capability.Cap
-
-func init() {
-	capabilityMap = make(map[string]capability.Cap)
-	last := capability.CAP_LAST_CAP
-	// workaround for RHEL6 which has no /proc/sys/kernel/cap_last_cap
-	if last == capability.Cap(63) {
-		last = capability.CAP_BLOCK_SUSPEND
-	}
-	for _, cap := range capability.List() {
-		if cap > last {
-			continue
-		}
-		capKey := fmt.Sprintf("CAP_%s", strings.ToUpper(cap.String()))
-		capabilityMap[capKey] = cap
-	}
-}
-
-func newContainerCapList(capConfig *configs.Capabilities) (*containerCapabilities, error) {
-	bounding := []capability.Cap{}
-	for _, c := range capConfig.Bounding {
-		v, ok := capabilityMap[c]
-		if !ok {
-			return nil, fmt.Errorf("unknown capability %q", c)
-		}
-		bounding = append(bounding, v)
-	}
-	effective := []capability.Cap{}
-	for _, c := range capConfig.Effective {
-		v, ok := capabilityMap[c]
-		if !ok {
-			return nil, fmt.Errorf("unknown capability %q", c)
-		}
-		effective = append(effective, v)
-	}
-	inheritable := []capability.Cap{}
-	for _, c := range capConfig.Inheritable {
-		v, ok := capabilityMap[c]
-		if !ok {
-			return nil, fmt.Errorf("unknown capability %q", c)
-		}
-		inheritable = append(inheritable, v)
-	}
-	permitted := []capability.Cap{}
-	for _, c := range capConfig.Permitted {
-		v, ok := capabilityMap[c]
-		if !ok {
-			return nil, fmt.Errorf("unknown capability %q", c)
-		}
-		permitted = append(permitted, v)
-	}
-	ambient := []capability.Cap{}
-	for _, c := range capConfig.Ambient {
-		v, ok := capabilityMap[c]
-		if !ok {
-			return nil, fmt.Errorf("unknown capability %q", c)
-		}
-		ambient = append(ambient, v)
-	}
-	pid, err := capability.NewPid(os.Getpid())
-	if err != nil {
-		return nil, err
-	}
-	return &containerCapabilities{
-		bounding:    bounding,
-		effective:   effective,
-		inheritable: inheritable,
-		permitted:   permitted,
-		ambient:     ambient,
-		pid:         pid,
-	}, nil
-}
-
-type containerCapabilities struct {
-	pid         capability.Capabilities
-	bounding    []capability.Cap
-	effective   []capability.Cap
-	inheritable []capability.Cap
-	permitted   []capability.Cap
-	ambient     []capability.Cap
-}
-
-// ApplyBoundingSet sets the capability bounding set to those specified in the whitelist.
-func (c *containerCapabilities) ApplyBoundingSet() error {
-	c.pid.Clear(capability.BOUNDS)
-	c.pid.Set(capability.BOUNDS, c.bounding...)
-	return c.pid.Apply(capability.BOUNDS)
-}
-
-// Apply sets all the capabilities for the current process in the config.
-func (c *containerCapabilities) ApplyCaps() error {
-	c.pid.Clear(allCapabilityTypes)
-	c.pid.Set(capability.BOUNDS, c.bounding...)
-	c.pid.Set(capability.PERMITTED, c.permitted...)
-	c.pid.Set(capability.INHERITABLE, c.inheritable...)
-	c.pid.Set(capability.EFFECTIVE, c.effective...)
-	c.pid.Set(capability.AMBIENT, c.ambient...)
-	return c.pid.Apply(allCapabilityTypes)
-}
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/cgroups/fs/apply_raw.go b/vendor/github.com/opencontainers/runc/libcontainer/cgroups/fs/apply_raw.go
deleted file mode 100644
index 43bdccf3e..000000000
--- a/vendor/github.com/opencontainers/runc/libcontainer/cgroups/fs/apply_raw.go
+++ /dev/null
@@ -1,373 +0,0 @@
-// +build linux
-
-package fs
-
-import (
-	"errors"
-	"fmt"
-	"io"
-	"io/ioutil"
-	"os"
-	"path/filepath"
-	"sync"
-
-	"github.com/opencontainers/runc/libcontainer/cgroups"
-	"github.com/opencontainers/runc/libcontainer/configs"
-	libcontainerUtils "github.com/opencontainers/runc/libcontainer/utils"
-)
-
-var (
-	subsystems = subsystemSet{
-		&CpusetGroup{},
-		&DevicesGroup{},
-		&MemoryGroup{},
-		&CpuGroup{},
-		&CpuacctGroup{},
-		&PidsGroup{},
-		&BlkioGroup{},
-		&HugetlbGroup{},
-		&NetClsGroup{},
-		&NetPrioGroup{},
-		&PerfEventGroup{},
-		&FreezerGroup{},
-		&NameGroup{GroupName: "name=systemd", Join: true},
-	}
-	HugePageSizes, _ = cgroups.GetHugePageSize()
-)
-
-var errSubsystemDoesNotExist = errors.New("cgroup: subsystem does not exist")
-
-type subsystemSet []subsystem
-
-func (s subsystemSet) Get(name string) (subsystem, error) {
-	for _, ss := range s {
-		if ss.Name() == name {
-			return ss, nil
-		}
-	}
-	return nil, errSubsystemDoesNotExist
-}
-
-type subsystem interface {
-	// Name returns the name of the subsystem.
-	Name() string
-	// Returns the stats, as 'stats', corresponding to the cgroup under 'path'.
-	GetStats(path string, stats *cgroups.Stats) error
-	// Removes the cgroup represented by 'cgroupData'.
-	Remove(*cgroupData) error
-	// Creates and joins the cgroup represented by 'cgroupData'.
-	Apply(*cgroupData) error
-	// Set the cgroup represented by cgroup.
-	Set(path string, cgroup *configs.Cgroup) error
-}
-
-type Manager struct {
-	mu      sync.Mutex
-	Cgroups *configs.Cgroup
-	Paths   map[string]string
-}
-
-// The absolute path to the root of the cgroup hierarchies.
-var cgroupRootLock sync.Mutex
-var cgroupRoot string
-
-// Gets the cgroupRoot.
-func getCgroupRoot() (string, error) {
-	cgroupRootLock.Lock()
-	defer cgroupRootLock.Unlock()
-
-	if cgroupRoot != "" {
-		return cgroupRoot, nil
-	}
-
-	root, err := cgroups.FindCgroupMountpointDir()
-	if err != nil {
-		return "", err
-	}
-
-	if _, err := os.Stat(root); err != nil {
-		return "", err
-	}
-
-	cgroupRoot = root
-	return cgroupRoot, nil
-}
-
-type cgroupData struct {
-	root      string
-	innerPath string
-	config    *configs.Cgroup
-	pid       int
-}
-
-func (m *Manager) Apply(pid int) (err error) {
-	if m.Cgroups == nil {
-		return nil
-	}
-	m.mu.Lock()
-	defer m.mu.Unlock()
-
-	var c = m.Cgroups
-
-	d, err := getCgroupData(m.Cgroups, pid)
-	if err != nil {
-		return err
-	}
-
-	m.Paths = make(map[string]string)
-	if c.Paths != nil {
-		for name, path := range c.Paths {
-			_, err := d.path(name)
-			if err != nil {
-				if cgroups.IsNotFound(err) {
-					continue
-				}
-				return err
-			}
-			m.Paths[name] = path
-		}
-		return cgroups.EnterPid(m.Paths, pid)
-	}
-
-	for _, sys := range subsystems {
-		// TODO: Apply should, ideally, be reentrant or be broken up into a separate
-		// create and join phase so that the cgroup hierarchy for a container can be
-		// created then join consists of writing the process pids to cgroup.procs
-		p, err := d.path(sys.Name())
-		if err != nil {
-			// The non-presence of the devices subsystem is
-			// considered fatal for security reasons.
-			if cgroups.IsNotFound(err) && sys.Name() != "devices" {
-				continue
-			}
-			return err
-		}
-		m.Paths[sys.Name()] = p
-
-		if err := sys.Apply(d); err != nil {
-			if os.IsPermission(err) && m.Cgroups.Path == "" {
-				// If we didn't set a cgroup path, then let's defer the error here
-				// until we know whether we have set limits or not.
-				// If we hadn't set limits, then it's ok that we couldn't join this cgroup, because
-				// it will have the same limits as its parent.
-				delete(m.Paths, sys.Name())
-				continue
-			}
-			return err
-		}
-
-	}
-	return nil
-}
-
-func (m *Manager) Destroy() error {
-	if m.Cgroups.Paths != nil {
-		return nil
-	}
-	m.mu.Lock()
-	defer m.mu.Unlock()
-	if err := cgroups.RemovePaths(m.Paths); err != nil {
-		return err
-	}
-	m.Paths = make(map[string]string)
-	return nil
-}
-
-func (m *Manager) GetPaths() map[string]string {
-	m.mu.Lock()
-	paths := m.Paths
-	m.mu.Unlock()
-	return paths
-}
-
-func (m *Manager) GetStats() (*cgroups.Stats, error) {
-	m.mu.Lock()
-	defer m.mu.Unlock()
-	stats := cgroups.NewStats()
-	for name, path := range m.Paths {
-		sys, err := subsystems.Get(name)
-		if err == errSubsystemDoesNotExist || !cgroups.PathExists(path) {
-			continue
-		}
-		if err := sys.GetStats(path, stats); err != nil {
-			return nil, err
-		}
-	}
-	return stats, nil
-}
-
-func (m *Manager) Set(container *configs.Config) error {
-	// If Paths are set, then we are just joining cgroups paths
-	// and there is no need to set any values.
-	if m.Cgroups.Paths != nil {
-		return nil
-	}
-
-	paths := m.GetPaths()
-	for _, sys := range subsystems {
-		path := paths[sys.Name()]
-		if err := sys.Set(path, container.Cgroups); err != nil {
-			if path == "" {
-				// cgroup never applied
-				return fmt.Errorf("cannot set limits on the %s cgroup, as the container has not joined it", sys.Name())
-			}
-			return err
-		}
-	}
-
-	if m.Paths["cpu"] != "" {
-		if err := CheckCpushares(m.Paths["cpu"], container.Cgroups.Resources.CpuShares); err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-// Freeze toggles the container's freezer cgroup depending on the state
-// provided
-func (m *Manager) Freeze(state configs.FreezerState) error {
-	paths := m.GetPaths()
-	dir := paths["freezer"]
-	prevState := m.Cgroups.Resources.Freezer
-	m.Cgroups.Resources.Freezer = state
-	freezer, err := subsystems.Get("freezer")
-	if err != nil {
-		return err
-	}
-	err = freezer.Set(dir, m.Cgroups)
-	if err != nil {
-		m.Cgroups.Resources.Freezer = prevState
-		return err
-	}
-	return nil
-}
-
-func (m *Manager) GetPids() ([]int, error) {
-	paths := m.GetPaths()
-	return cgroups.GetPids(paths["devices"])
-}
-
-func (m *Manager) GetAllPids() ([]int, error) {
-	paths := m.GetPaths()
-	return cgroups.GetAllPids(paths["devices"])
-}
-
-func getCgroupData(c *configs.Cgroup, pid int) (*cgroupData, error) {
-	root, err := getCgroupRoot()
-	if err != nil {
-		return nil, err
-	}
-
-	if (c.Name != "" || c.Parent != "") && c.Path != "" {
-		return nil, fmt.Errorf("cgroup: either Path or Name and Parent should be used")
-	}
-
-	// XXX: Do not remove this code. Path safety is important! -- cyphar
-	cgPath := libcontainerUtils.CleanPath(c.Path)
-	cgParent := libcontainerUtils.CleanPath(c.Parent)
-	cgName := libcontainerUtils.CleanPath(c.Name)
-
-	innerPath := cgPath
-	if innerPath == "" {
-		innerPath = filepath.Join(cgParent, cgName)
-	}
-
-	return &cgroupData{
-		root:      root,
-		innerPath: innerPath,
-		config:    c,
-		pid:       pid,
-	}, nil
-}
-
-func (raw *cgroupData) path(subsystem string) (string, error) {
-	mnt, err := cgroups.FindCgroupMountpoint(subsystem)
-	// If we didn't mount the subsystem, there is no point we make the path.
-	if err != nil {
-		return "", err
-	}
-
-	// If the cgroup name/path is absolute do not look relative to the cgroup of the init process.
-	if filepath.IsAbs(raw.innerPath) {
-		// Sometimes subsystems can be mounted together as 'cpu,cpuacct'.
-		return filepath.Join(raw.root, filepath.Base(mnt), raw.innerPath), nil
-	}
-
-	// Use GetOwnCgroupPath instead of GetInitCgroupPath, because the creating
-	// process could in container and shared pid namespace with host, and
-	// /proc/1/cgroup could point to whole other world of cgroups.
-	parentPath, err := cgroups.GetOwnCgroupPath(subsystem)
-	if err != nil {
-		return "", err
-	}
-
-	return filepath.Join(parentPath, raw.innerPath), nil
-}
-
-func (raw *cgroupData) join(subsystem string) (string, error) {
-	path, err := raw.path(subsystem)
-	if err != nil {
-		return "", err
-	}
-	if err := os.MkdirAll(path, 0755); err != nil {
-		return "", err
-	}
-	if err := cgroups.WriteCgroupProc(path, raw.pid); err != nil {
-		return "", err
-	}
-	return path, nil
-}
-
-func writeFile(dir, file, data string) error {
-	// Normally dir should not be empty, one case is that cgroup subsystem
-	// is not mounted, we will get empty dir, and we want it fail here.
-	if dir == "" {
-		return fmt.Errorf("no such directory for %s", file)
-	}
-	if err := ioutil.WriteFile(filepath.Join(dir, file), []byte(data), 0700); err != nil {
-		return fmt.Errorf("failed to write %v to %v: %v", data, file, err)
-	}
-	return nil
-}
-
-func readFile(dir, file string) (string, error) {
-	data, err := ioutil.ReadFile(filepath.Join(dir, file))
-	return string(data), err
-}
-
-func removePath(p string, err error) error {
-	if err != nil {
-		return err
-	}
-	if p != "" {
-		return os.RemoveAll(p)
-	}
-	return nil
-}
-
-func CheckCpushares(path string, c uint64) error {
-	var cpuShares uint64
-
-	if c == 0 {
-		return nil
-	}
-
-	fd, err := os.Open(filepath.Join(path, "cpu.shares"))
-	if err != nil {
-		return err
-	}
-	defer fd.Close()
-
-	_, err = fmt.Fscanf(fd, "%d", &cpuShares)
-	if err != nil && err != io.EOF {
-		return err
-	}
-
-	if c > cpuShares {
-		return fmt.Errorf("The maximum allowed cpu-shares is %d", cpuShares)
-	} else if c < cpuShares {
-		return fmt.Errorf("The minimum allowed cpu-shares is %d", cpuShares)
-	}
-
-	return nil
-}
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/cgroups/fs/blkio.go b/vendor/github.com/opencontainers/runc/libcontainer/cgroups/fs/blkio.go
deleted file mode 100644
index a142cb991..000000000
--- a/vendor/github.com/opencontainers/runc/libcontainer/cgroups/fs/blkio.go
+++ /dev/null
@@ -1,237 +0,0 @@
-// +build linux
-
-package fs
-
-import (
-	"bufio"
-	"fmt"
-	"os"
-	"path/filepath"
-	"strconv"
-	"strings"
-
-	"github.com/opencontainers/runc/libcontainer/cgroups"
-	"github.com/opencontainers/runc/libcontainer/configs"
-)
-
-type BlkioGroup struct {
-}
-
-func (s *BlkioGroup) Name() string {
-	return "blkio"
-}
-
-func (s *BlkioGroup) Apply(d *cgroupData) error {
-	_, err := d.join("blkio")
-	if err != nil && !cgroups.IsNotFound(err) {
-		return err
-	}
-	return nil
-}
-
-func (s *BlkioGroup) Set(path string, cgroup *configs.Cgroup) error {
-	if cgroup.Resources.BlkioWeight != 0 {
-		if err := writeFile(path, "blkio.weight", strconv.FormatUint(uint64(cgroup.Resources.BlkioWeight), 10)); err != nil {
-			return err
-		}
-	}
-
-	if cgroup.Resources.BlkioLeafWeight != 0 {
-		if err := writeFile(path, "blkio.leaf_weight", strconv.FormatUint(uint64(cgroup.Resources.BlkioLeafWeight), 10)); err != nil {
-			return err
-		}
-	}
-	for _, wd := range cgroup.Resources.BlkioWeightDevice {
-		if err := writeFile(path, "blkio.weight_device", wd.WeightString()); err != nil {
-			return err
-		}
-		if err := writeFile(path, "blkio.leaf_weight_device", wd.LeafWeightString()); err != nil {
-			return err
-		}
-	}
-	for _, td := range cgroup.Resources.BlkioThrottleReadBpsDevice {
-		if err := writeFile(path, "blkio.throttle.read_bps_device", td.String()); err != nil {
-			return err
-		}
-	}
-	for _, td := range cgroup.Resources.BlkioThrottleWriteBpsDevice {
-		if err := writeFile(path, "blkio.throttle.write_bps_device", td.String()); err != nil {
-			return err
-		}
-	}
-	for _, td := range cgroup.Resources.BlkioThrottleReadIOPSDevice {
-		if err := writeFile(path, "blkio.throttle.read_iops_device", td.String()); err != nil {
-			return err
-		}
-	}
-	for _, td := range cgroup.Resources.BlkioThrottleWriteIOPSDevice {
-		if err := writeFile(path, "blkio.throttle.write_iops_device", td.String()); err != nil {
-			return err
-		}
-	}
-
-	return nil
-}
-
-func (s *BlkioGroup) Remove(d *cgroupData) error {
-	return removePath(d.path("blkio"))
-}
-
-/*
-examples:
-
-    blkio.sectors
-    8:0 6792
-
-    blkio.io_service_bytes
-    8:0 Read 1282048
-    8:0 Write 2195456
-    8:0 Sync 2195456
-    8:0 Async 1282048
-    8:0 Total 3477504
-    Total 3477504
-
-    blkio.io_serviced
-    8:0 Read 124
-    8:0 Write 104
-    8:0 Sync 104
-    8:0 Async 124
-    8:0 Total 228
-    Total 228
-
-    blkio.io_queued
-    8:0 Read 0
-    8:0 Write 0
-    8:0 Sync 0
-    8:0 Async 0
-    8:0 Total 0
-    Total 0
-*/
-
-func splitBlkioStatLine(r rune) bool {
-	return r == ' ' || r == ':'
-}
-
-func getBlkioStat(path string) ([]cgroups.BlkioStatEntry, error) {
-	var blkioStats []cgroups.BlkioStatEntry
-	f, err := os.Open(path)
-	if err != nil {
-		if os.IsNotExist(err) {
-			return blkioStats, nil
-		}
-		return nil, err
-	}
-	defer f.Close()
-
-	sc := bufio.NewScanner(f)
-	for sc.Scan() {
-		// format: dev type amount
-		fields := strings.FieldsFunc(sc.Text(), splitBlkioStatLine)
-		if len(fields) < 3 {
-			if len(fields) == 2 && fields[0] == "Total" {
-				// skip total line
-				continue
-			} else {
-				return nil, fmt.Errorf("Invalid line found while parsing %s: %s", path, sc.Text())
-			}
-		}
-
-		v, err := strconv.ParseUint(fields[0], 10, 64)
-		if err != nil {
-			return nil, err
-		}
-		major := v
-
-		v, err = strconv.ParseUint(fields[1], 10, 64)
-		if err != nil {
-			return nil, err
-		}
-		minor := v
-
-		op := ""
-		valueField := 2
-		if len(fields) == 4 {
-			op = fields[2]
-			valueField = 3
-		}
-		v, err = strconv.ParseUint(fields[valueField], 10, 64)
-		if err != nil {
-			return nil, err
-		}
-		blkioStats = append(blkioStats, cgroups.BlkioStatEntry{Major: major, Minor: minor, Op: op, Value: v})
-	}
-
-	return blkioStats, nil
-}
-
-func (s *BlkioGroup) GetStats(path string, stats *cgroups.Stats) error {
-	// Try to read CFQ stats available on all CFQ enabled kernels first
-	if blkioStats, err := getBlkioStat(filepath.Join(path, "blkio.io_serviced_recursive")); err == nil && blkioStats != nil {
-		return getCFQStats(path, stats)
-	}
-	return getStats(path, stats) // Use generic stats as fallback
-}
-
-func getCFQStats(path string, stats *cgroups.Stats) error {
-	var blkioStats []cgroups.BlkioStatEntry
-	var err error
-
-	if blkioStats, err = getBlkioStat(filepath.Join(path, "blkio.sectors_recursive")); err != nil {
-		return err
-	}
-	stats.BlkioStats.SectorsRecursive = blkioStats
-
-	if blkioStats, err = getBlkioStat(filepath.Join(path, "blkio.io_service_bytes_recursive")); err != nil {
-		return err
-	}
-	stats.BlkioStats.IoServiceBytesRecursive = blkioStats
-
-	if blkioStats, err = getBlkioStat(filepath.Join(path, "blkio.io_serviced_recursive")); err != nil {
-		return err
-	}
-	stats.BlkioStats.IoServicedRecursive = blkioStats
-
-	if blkioStats, err = getBlkioStat(filepath.Join(path, "blkio.io_queued_recursive")); err != nil {
-		return err
-	}
-	stats.BlkioStats.IoQueuedRecursive = blkioStats
-
-	if blkioStats, err = getBlkioStat(filepath.Join(path, "blkio.io_service_time_recursive")); err != nil {
-		return err
-	}
-	stats.BlkioStats.IoServiceTimeRecursive = blkioStats
-
-	if blkioStats, err = getBlkioStat(filepath.Join(path, "blkio.io_wait_time_recursive")); err != nil {
-		return err
-	}
-	stats.BlkioStats.IoWaitTimeRecursive = blkioStats
-
-	if blkioStats, err = getBlkioStat(filepath.Join(path, "blkio.io_merged_recursive")); err != nil {
-		return err
-	}
-	stats.BlkioStats.IoMergedRecursive = blkioStats
-
-	if blkioStats, err = getBlkioStat(filepath.Join(path, "blkio.time_recursive")); err != nil {
-		return err
-	}
-	stats.BlkioStats.IoTimeRecursive = blkioStats
-
-	return nil
-}
-
-func getStats(path string, stats *cgroups.Stats) error {
-	var blkioStats []cgroups.BlkioStatEntry
-	var err error
-
-	if blkioStats, err = getBlkioStat(filepath.Join(path, "blkio.throttle.io_service_bytes")); err != nil {
-		return err
-	}
-	stats.BlkioStats.IoServiceBytesRecursive = blkioStats
-
-	if blkioStats, err = getBlkioStat(filepath.Join(path, "blkio.throttle.io_serviced")); err != nil {
-		return err
-	}
-	stats.BlkioStats.IoServicedRecursive = blkioStats
-
-	return nil
-}
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/cgroups/fs/cpu.go b/vendor/github.com/opencontainers/runc/libcontainer/cgroups/fs/cpu.go
deleted file mode 100644
index b712bd0b1..000000000
--- a/vendor/github.com/opencontainers/runc/libcontainer/cgroups/fs/cpu.go
+++ /dev/null
@@ -1,125 +0,0 @@
-// +build linux
-
-package fs
-
-import (
-	"bufio"
-	"os"
-	"path/filepath"
-	"strconv"
-
-	"github.com/opencontainers/runc/libcontainer/cgroups"
-	"github.com/opencontainers/runc/libcontainer/configs"
-)
-
-type CpuGroup struct {
-}
-
-func (s *CpuGroup) Name() string {
-	return "cpu"
-}
-
-func (s *CpuGroup) Apply(d *cgroupData) error {
-	// We always want to join the cpu group, to allow fair cpu scheduling
-	// on a container basis
-	path, err := d.path("cpu")
-	if err != nil && !cgroups.IsNotFound(err) {
-		return err
-	}
-	return s.ApplyDir(path, d.config, d.pid)
-}
-
-func (s *CpuGroup) ApplyDir(path string, cgroup *configs.Cgroup, pid int) error {
-	// This might happen if we have no cpu cgroup mounted.
-	// Just do nothing and don't fail.
-	if path == "" {
-		return nil
-	}
-	if err := os.MkdirAll(path, 0755); err != nil {
-		return err
-	}
-	// We should set the real-Time group scheduling settings before moving
-	// in the process because if the process is already in SCHED_RR mode
-	// and no RT bandwidth is set, adding it will fail.
-	if err := s.SetRtSched(path, cgroup); err != nil {
-		return err
-	}
-	// because we are not using d.join we need to place the pid into the procs file
-	// unlike the other subsystems
-	if err := cgroups.WriteCgroupProc(path, pid); err != nil {
-		return err
-	}
-
-	return nil
-}
-
-func (s *CpuGroup) SetRtSched(path string, cgroup *configs.Cgroup) error {
-	if cgroup.Resources.CpuRtPeriod != 0 {
-		if err := writeFile(path, "cpu.rt_period_us", strconv.FormatUint(cgroup.Resources.CpuRtPeriod, 10)); err != nil {
-			return err
-		}
-	}
-	if cgroup.Resources.CpuRtRuntime != 0 {
-		if err := writeFile(path, "cpu.rt_runtime_us", strconv.FormatInt(cgroup.Resources.CpuRtRuntime, 10)); err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-func (s *CpuGroup) Set(path string, cgroup *configs.Cgroup) error {
-	if cgroup.Resources.CpuShares != 0 {
-		if err := writeFile(path, "cpu.shares", strconv.FormatUint(cgroup.Resources.CpuShares, 10)); err != nil {
-			return err
-		}
-	}
-	if cgroup.Resources.CpuPeriod != 0 {
-		if err := writeFile(path, "cpu.cfs_period_us", strconv.FormatUint(cgroup.Resources.CpuPeriod, 10)); err != nil {
-			return err
-		}
-	}
-	if cgroup.Resources.CpuQuota != 0 {
-		if err := writeFile(path, "cpu.cfs_quota_us", strconv.FormatInt(cgroup.Resources.CpuQuota, 10)); err != nil {
-			return err
-		}
-	}
-	if err := s.SetRtSched(path, cgroup); err != nil {
-		return err
-	}
-
-	return nil
-}
-
-func (s *CpuGroup) Remove(d *cgroupData) error {
-	return removePath(d.path("cpu"))
-}
-
-func (s *CpuGroup) GetStats(path string, stats *cgroups.Stats) error {
-	f, err := os.Open(filepath.Join(path, "cpu.stat"))
-	if err != nil {
-		if os.IsNotExist(err) {
-			return nil
-		}
-		return err
-	}
-	defer f.Close()
-
-	sc := bufio.NewScanner(f)
-	for sc.Scan() {
-		t, v, err := getCgroupParamKeyValue(sc.Text())
-		if err != nil {
-			return err
-		}
-		switch t {
-		case "nr_periods":
-			stats.CpuStats.ThrottlingData.Periods = v
-
-		case "nr_throttled":
-			stats.CpuStats.ThrottlingData.ThrottledPeriods = v
-
-		case "throttled_time":
-			stats.CpuStats.ThrottlingData.ThrottledTime = v
-		}
-	}
-	return nil
-}
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/cgroups/fs/cpuacct.go b/vendor/github.com/opencontainers/runc/libcontainer/cgroups/fs/cpuacct.go
deleted file mode 100644
index 53afbaddf..000000000
--- a/vendor/github.com/opencontainers/runc/libcontainer/cgroups/fs/cpuacct.go
+++ /dev/null
@@ -1,121 +0,0 @@
-// +build linux
-
-package fs
-
-import (
-	"fmt"
-	"io/ioutil"
-	"path/filepath"
-	"strconv"
-	"strings"
-
-	"github.com/opencontainers/runc/libcontainer/cgroups"
-	"github.com/opencontainers/runc/libcontainer/configs"
-	"github.com/opencontainers/runc/libcontainer/system"
-)
-
-const (
-	cgroupCpuacctStat   = "cpuacct.stat"
-	nanosecondsInSecond = 1000000000
-)
-
-var clockTicks = uint64(system.GetClockTicks())
-
-type CpuacctGroup struct {
-}
-
-func (s *CpuacctGroup) Name() string {
-	return "cpuacct"
-}
-
-func (s *CpuacctGroup) Apply(d *cgroupData) error {
-	// we just want to join this group even though we don't set anything
-	if _, err := d.join("cpuacct"); err != nil && !cgroups.IsNotFound(err) {
-		return err
-	}
-
-	return nil
-}
-
-func (s *CpuacctGroup) Set(path string, cgroup *configs.Cgroup) error {
-	return nil
-}
-
-func (s *CpuacctGroup) Remove(d *cgroupData) error {
-	return removePath(d.path("cpuacct"))
-}
-
-func (s *CpuacctGroup) GetStats(path string, stats *cgroups.Stats) error {
-	userModeUsage, kernelModeUsage, err := getCpuUsageBreakdown(path)
-	if err != nil {
-		return err
-	}
-
-	totalUsage, err := getCgroupParamUint(path, "cpuacct.usage")
-	if err != nil {
-		return err
-	}
-
-	percpuUsage, err := getPercpuUsage(path)
-	if err != nil {
-		return err
-	}
-
-	stats.CpuStats.CpuUsage.TotalUsage = totalUsage
-	stats.CpuStats.CpuUsage.PercpuUsage = percpuUsage
-	stats.CpuStats.CpuUsage.UsageInUsermode = userModeUsage
-	stats.CpuStats.CpuUsage.UsageInKernelmode = kernelModeUsage
-	return nil
-}
-
-// Returns user and kernel usage breakdown in nanoseconds.
-func getCpuUsageBreakdown(path string) (uint64, uint64, error) {
-	userModeUsage := uint64(0)
-	kernelModeUsage := uint64(0)
-	const (
-		userField   = "user"
-		systemField = "system"
-	)
-
-	// Expected format:
-	// user <usage in ticks>
-	// system <usage in ticks>
-	data, err := ioutil.ReadFile(filepath.Join(path, cgroupCpuacctStat))
-	if err != nil {
-		return 0, 0, err
-	}
-	fields := strings.Fields(string(data))
-	if len(fields) != 4 {
-		return 0, 0, fmt.Errorf("failure - %s is expected to have 4 fields", filepath.Join(path, cgroupCpuacctStat))
-	}
-	if fields[0] != userField {
-		return 0, 0, fmt.Errorf("unexpected field %q in %q, expected %q", fields[0], cgroupCpuacctStat, userField)
-	}
-	if fields[2] != systemField {
-		return 0, 0, fmt.Errorf("unexpected field %q in %q, expected %q", fields[2], cgroupCpuacctStat, systemField)
-	}
-	if userModeUsage, err = strconv.ParseUint(fields[1], 10, 64); err != nil {
-		return 0, 0, err
-	}
-	if kernelModeUsage, err = strconv.ParseUint(fields[3], 10, 64); err != nil {
-		return 0, 0, err
-	}
-
-	return (userModeUsage * nanosecondsInSecond) / clockTicks, (kernelModeUsage * nanosecondsInSecond) / clockTicks, nil
-}
-
-func getPercpuUsage(path string) ([]uint64, error) {
-	percpuUsage := []uint64{}
-	data, err := ioutil.ReadFile(filepath.Join(path, "cpuacct.usage_percpu"))
-	if err != nil {
-		return percpuUsage, err
-	}
-	for _, value := range strings.Fields(string(data)) {
-		value, err := strconv.ParseUint(value, 10, 64)
-		if err != nil {
-			return percpuUsage, fmt.Errorf("Unable to convert param value to uint64: %s", err)
-		}
-		percpuUsage = append(percpuUsage, value)
-	}
-	return percpuUsage, nil
-}
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/cgroups/fs/cpuset.go b/vendor/github.com/opencontainers/runc/libcontainer/cgroups/fs/cpuset.go
deleted file mode 100644
index 20c9eafac..000000000
--- a/vendor/github.com/opencontainers/runc/libcontainer/cgroups/fs/cpuset.go
+++ /dev/null
@@ -1,163 +0,0 @@
-// +build linux
-
-package fs
-
-import (
-	"bytes"
-	"fmt"
-	"io/ioutil"
-	"os"
-	"path/filepath"
-
-	"github.com/opencontainers/runc/libcontainer/cgroups"
-	"github.com/opencontainers/runc/libcontainer/configs"
-	libcontainerUtils "github.com/opencontainers/runc/libcontainer/utils"
-)
-
-type CpusetGroup struct {
-}
-
-func (s *CpusetGroup) Name() string {
-	return "cpuset"
-}
-
-func (s *CpusetGroup) Apply(d *cgroupData) error {
-	dir, err := d.path("cpuset")
-	if err != nil && !cgroups.IsNotFound(err) {
-		return err
-	}
-	return s.ApplyDir(dir, d.config, d.pid)
-}
-
-func (s *CpusetGroup) Set(path string, cgroup *configs.Cgroup) error {
-	if cgroup.Resources.CpusetCpus != "" {
-		if err := writeFile(path, "cpuset.cpus", cgroup.Resources.CpusetCpus); err != nil {
-			return err
-		}
-	}
-	if cgroup.Resources.CpusetMems != "" {
-		if err := writeFile(path, "cpuset.mems", cgroup.Resources.CpusetMems); err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-func (s *CpusetGroup) Remove(d *cgroupData) error {
-	return removePath(d.path("cpuset"))
-}
-
-func (s *CpusetGroup) GetStats(path string, stats *cgroups.Stats) error {
-	return nil
-}
-
-func (s *CpusetGroup) ApplyDir(dir string, cgroup *configs.Cgroup, pid int) error {
-	// This might happen if we have no cpuset cgroup mounted.
-	// Just do nothing and don't fail.
-	if dir == "" {
-		return nil
-	}
-	mountInfo, err := ioutil.ReadFile("/proc/self/mountinfo")
-	if err != nil {
-		return err
-	}
-	root := filepath.Dir(cgroups.GetClosestMountpointAncestor(dir, string(mountInfo)))
-	// 'ensureParent' start with parent because we don't want to
-	// explicitly inherit from parent, it could conflict with
-	// 'cpuset.cpu_exclusive'.
-	if err := s.ensureParent(filepath.Dir(dir), root); err != nil {
-		return err
-	}
-	if err := os.MkdirAll(dir, 0755); err != nil {
-		return err
-	}
-	// We didn't inherit cpuset configs from parent, but we have
-	// to ensure cpuset configs are set before moving task into the
-	// cgroup.
-	// The logic is, if user specified cpuset configs, use these
-	// specified configs, otherwise, inherit from parent. This makes
-	// cpuset configs work correctly with 'cpuset.cpu_exclusive', and
-	// keep backward compatbility.
-	if err := s.ensureCpusAndMems(dir, cgroup); err != nil {
-		return err
-	}
-
-	// because we are not using d.join we need to place the pid into the procs file
-	// unlike the other subsystems
-	if err := cgroups.WriteCgroupProc(dir, pid); err != nil {
-		return err
-	}
-
-	return nil
-}
-
-func (s *CpusetGroup) getSubsystemSettings(parent string) (cpus []byte, mems []byte, err error) {
-	if cpus, err = ioutil.ReadFile(filepath.Join(parent, "cpuset.cpus")); err != nil {
-		return
-	}
-	if mems, err = ioutil.ReadFile(filepath.Join(parent, "cpuset.mems")); err != nil {
-		return
-	}
-	return cpus, mems, nil
-}
-
-// ensureParent makes sure that the parent directory of current is created
-// and populated with the proper cpus and mems files copied from
-// it's parent.
-func (s *CpusetGroup) ensureParent(current, root string) error {
-	parent := filepath.Dir(current)
-	if libcontainerUtils.CleanPath(parent) == root {
-		return nil
-	}
-	// Avoid infinite recursion.
-	if parent == current {
-		return fmt.Errorf("cpuset: cgroup parent path outside cgroup root")
-	}
-	if err := s.ensureParent(parent, root); err != nil {
-		return err
-	}
-	if err := os.MkdirAll(current, 0755); err != nil {
-		return err
-	}
-	return s.copyIfNeeded(current, parent)
-}
-
-// copyIfNeeded copies the cpuset.cpus and cpuset.mems from the parent
-// directory to the current directory if the file's contents are 0
-func (s *CpusetGroup) copyIfNeeded(current, parent string) error {
-	var (
-		err                      error
-		currentCpus, currentMems []byte
-		parentCpus, parentMems   []byte
-	)
-
-	if currentCpus, currentMems, err = s.getSubsystemSettings(current); err != nil {
-		return err
-	}
-	if parentCpus, parentMems, err = s.getSubsystemSettings(parent); err != nil {
-		return err
-	}
-
-	if s.isEmpty(currentCpus) {
-		if err := writeFile(current, "cpuset.cpus", string(parentCpus)); err != nil {
-			return err
-		}
-	}
-	if s.isEmpty(currentMems) {
-		if err := writeFile(current, "cpuset.mems", string(parentMems)); err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-func (s *CpusetGroup) isEmpty(b []byte) bool {
-	return len(bytes.Trim(b, "\n")) == 0
-}
-
-func (s *CpusetGroup) ensureCpusAndMems(path string, cgroup *configs.Cgroup) error {
-	if err := s.Set(path, cgroup); err != nil {
-		return err
-	}
-	return s.copyIfNeeded(path, filepath.Dir(path))
-}
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/cgroups/fs/devices.go b/vendor/github.com/opencontainers/runc/libcontainer/cgroups/fs/devices.go
deleted file mode 100644
index 0ac5b4ed7..000000000
--- a/vendor/github.com/opencontainers/runc/libcontainer/cgroups/fs/devices.go
+++ /dev/null
@@ -1,80 +0,0 @@
-// +build linux
-
-package fs
-
-import (
-	"github.com/opencontainers/runc/libcontainer/cgroups"
-	"github.com/opencontainers/runc/libcontainer/configs"
-	"github.com/opencontainers/runc/libcontainer/system"
-)
-
-type DevicesGroup struct {
-}
-
-func (s *DevicesGroup) Name() string {
-	return "devices"
-}
-
-func (s *DevicesGroup) Apply(d *cgroupData) error {
-	_, err := d.join("devices")
-	if err != nil {
-		// We will return error even it's `not found` error, devices
-		// cgroup is hard requirement for container's security.
-		return err
-	}
-	return nil
-}
-
-func (s *DevicesGroup) Set(path string, cgroup *configs.Cgroup) error {
-	if system.RunningInUserNS() {
-		return nil
-	}
-
-	devices := cgroup.Resources.Devices
-	if len(devices) > 0 {
-		for _, dev := range devices {
-			file := "devices.deny"
-			if dev.Allow {
-				file = "devices.allow"
-			}
-			if err := writeFile(path, file, dev.CgroupString()); err != nil {
-				return err
-			}
-		}
-		return nil
-	}
-	if cgroup.Resources.AllowAllDevices != nil {
-		if *cgroup.Resources.AllowAllDevices == false {
-			if err := writeFile(path, "devices.deny", "a"); err != nil {
-				return err
-			}
-
-			for _, dev := range cgroup.Resources.AllowedDevices {
-				if err := writeFile(path, "devices.allow", dev.CgroupString()); err != nil {
-					return err
-				}
-			}
-			return nil
-		}
-
-		if err := writeFile(path, "devices.allow", "a"); err != nil {
-			return err
-		}
-	}
-
-	for _, dev := range cgroup.Resources.DeniedDevices {
-		if err := writeFile(path, "devices.deny", dev.CgroupString()); err != nil {
-			return err
-		}
-	}
-
-	return nil
-}
-
-func (s *DevicesGroup) Remove(d *cgroupData) error {
-	return removePath(d.path("devices"))
-}
-
-func (s *DevicesGroup) GetStats(path string, stats *cgroups.Stats) error {
-	return nil
-}
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/cgroups/fs/freezer.go b/vendor/github.com/opencontainers/runc/libcontainer/cgroups/fs/freezer.go
deleted file mode 100644
index 4b19f8a97..000000000
--- a/vendor/github.com/opencontainers/runc/libcontainer/cgroups/fs/freezer.go
+++ /dev/null
@@ -1,66 +0,0 @@
-// +build linux
-
-package fs
-
-import (
-	"fmt"
-	"strings"
-	"time"
-
-	"github.com/opencontainers/runc/libcontainer/cgroups"
-	"github.com/opencontainers/runc/libcontainer/configs"
-)
-
-type FreezerGroup struct {
-}
-
-func (s *FreezerGroup) Name() string {
-	return "freezer"
-}
-
-func (s *FreezerGroup) Apply(d *cgroupData) error {
-	_, err := d.join("freezer")
-	if err != nil && !cgroups.IsNotFound(err) {
-		return err
-	}
-	return nil
-}
-
-func (s *FreezerGroup) Set(path string, cgroup *configs.Cgroup) error {
-	switch cgroup.Resources.Freezer {
-	case configs.Frozen, configs.Thawed:
-		for {
-			// In case this loop does not exit because it doesn't get the expected
-			// state, let's write again this state, hoping it's going to be properly
-			// set this time. Otherwise, this loop could run infinitely, waiting for
-			// a state change that would never happen.
-			if err := writeFile(path, "freezer.state", string(cgroup.Resources.Freezer)); err != nil {
-				return err
-			}
-
-			state, err := readFile(path, "freezer.state")
-			if err != nil {
-				return err
-			}
-			if strings.TrimSpace(state) == string(cgroup.Resources.Freezer) {
-				break
-			}
-
-			time.Sleep(1 * time.Millisecond)
-		}
-	case configs.Undefined:
-		return nil
-	default:
-		return fmt.Errorf("Invalid argument '%s' to freezer.state", string(cgroup.Resources.Freezer))
-	}
-
-	return nil
-}
-
-func (s *FreezerGroup) Remove(d *cgroupData) error {
-	return removePath(d.path("freezer"))
-}
-
-func (s *FreezerGroup) GetStats(path string, stats *cgroups.Stats) error {
-	return nil
-}
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/cgroups/fs/fs_unsupported.go b/vendor/github.com/opencontainers/runc/libcontainer/cgroups/fs/fs_unsupported.go
deleted file mode 100644
index 3ef9e0315..000000000
--- a/vendor/github.com/opencontainers/runc/libcontainer/cgroups/fs/fs_unsupported.go
+++ /dev/null
@@ -1,3 +0,0 @@
-// +build !linux
-
-package fs
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/cgroups/fs/hugetlb.go b/vendor/github.com/opencontainers/runc/libcontainer/cgroups/fs/hugetlb.go
deleted file mode 100644
index 2f9727719..000000000
--- a/vendor/github.com/opencontainers/runc/libcontainer/cgroups/fs/hugetlb.go
+++ /dev/null
@@ -1,71 +0,0 @@
-// +build linux
-
-package fs
-
-import (
-	"fmt"
-	"strconv"
-	"strings"
-
-	"github.com/opencontainers/runc/libcontainer/cgroups"
-	"github.com/opencontainers/runc/libcontainer/configs"
-)
-
-type HugetlbGroup struct {
-}
-
-func (s *HugetlbGroup) Name() string {
-	return "hugetlb"
-}
-
-func (s *HugetlbGroup) Apply(d *cgroupData) error {
-	_, err := d.join("hugetlb")
-	if err != nil && !cgroups.IsNotFound(err) {
-		return err
-	}
-	return nil
-}
-
-func (s *HugetlbGroup) Set(path string, cgroup *configs.Cgroup) error {
-	for _, hugetlb := range cgroup.Resources.HugetlbLimit {
-		if err := writeFile(path, strings.Join([]string{"hugetlb", hugetlb.Pagesize, "limit_in_bytes"}, "."), strconv.FormatUint(hugetlb.Limit, 10)); err != nil {
-			return err
-		}
-	}
-
-	return nil
-}
-
-func (s *HugetlbGroup) Remove(d *cgroupData) error {
-	return removePath(d.path("hugetlb"))
-}
-
-func (s *HugetlbGroup) GetStats(path string, stats *cgroups.Stats) error {
-	hugetlbStats := cgroups.HugetlbStats{}
-	for _, pageSize := range HugePageSizes {
-		usage := strings.Join([]string{"hugetlb", pageSize, "usage_in_bytes"}, ".")
-		value, err := getCgroupParamUint(path, usage)
-		if err != nil {
-			return fmt.Errorf("failed to parse %s - %v", usage, err)
-		}
-		hugetlbStats.Usage = value
-
-		maxUsage := strings.Join([]string{"hugetlb", pageSize, "max_usage_in_bytes"}, ".")
-		value, err = getCgroupParamUint(path, maxUsage)
-		if err != nil {
-			return fmt.Errorf("failed to parse %s - %v", maxUsage, err)
-		}
-		hugetlbStats.MaxUsage = value
-
-		failcnt := strings.Join([]string{"hugetlb", pageSize, "failcnt"}, ".")
-		value, err = getCgroupParamUint(path, failcnt)
-		if err != nil {
-			return fmt.Errorf("failed to parse %s - %v", failcnt, err)
-		}
-		hugetlbStats.Failcnt = value
-
-		stats.HugetlbStats[pageSize] = hugetlbStats
-	}
-
-	return nil
-}
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/cgroups/fs/memory.go b/vendor/github.com/opencontainers/runc/libcontainer/cgroups/fs/memory.go
deleted file mode 100644
index ad395a5d6..000000000
--- a/vendor/github.com/opencontainers/runc/libcontainer/cgroups/fs/memory.go
+++ /dev/null
@@ -1,313 +0,0 @@
-// +build linux
-
-package fs
-
-import (
-	"bufio"
-	"fmt"
-	"io/ioutil"
-	"os"
-	"path/filepath"
-	"strconv"
-	"strings"
-	"syscall" // only for Errno
-
-	"github.com/opencontainers/runc/libcontainer/cgroups"
-	"github.com/opencontainers/runc/libcontainer/configs"
-
-	"golang.org/x/sys/unix"
-)
-
-const (
-	cgroupKernelMemoryLimit = "memory.kmem.limit_in_bytes"
-	cgroupMemorySwapLimit   = "memory.memsw.limit_in_bytes"
-	cgroupMemoryLimit       = "memory.limit_in_bytes"
-)
-
-type MemoryGroup struct {
-}
-
-func (s *MemoryGroup) Name() string {
-	return "memory"
-}
-
-func (s *MemoryGroup) Apply(d *cgroupData) (err error) {
-	path, err := d.path("memory")
-	if err != nil && !cgroups.IsNotFound(err) {
-		return err
-	} else if path == "" {
-		return nil
-	}
-	if memoryAssigned(d.config) {
-		if _, err := os.Stat(path); os.IsNotExist(err) {
-			if err := os.MkdirAll(path, 0755); err != nil {
-				return err
-			}
-			// Only enable kernel memory accouting when this cgroup
-			// is created by libcontainer, otherwise we might get
-			// error when people use `cgroupsPath` to join an existed
-			// cgroup whose kernel memory is not initialized.
-			if err := EnableKernelMemoryAccounting(path); err != nil {
-				return err
-			}
-		}
-	}
-	defer func() {
-		if err != nil {
-			os.RemoveAll(path)
-		}
-	}()
-
-	// We need to join memory cgroup after set memory limits, because
-	// kmem.limit_in_bytes can only be set when the cgroup is empty.
-	_, err = d.join("memory")
-	if err != nil && !cgroups.IsNotFound(err) {
-		return err
-	}
-	return nil
-}
-
-func EnableKernelMemoryAccounting(path string) error {
-	// Check if kernel memory is enabled
-	// We have to limit the kernel memory here as it won't be accounted at all
-	// until a limit is set on the cgroup and limit cannot be set once the
-	// cgroup has children, or if there are already tasks in the cgroup.
-	for _, i := range []int64{1, -1} {
-		if err := setKernelMemory(path, i); err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-func setKernelMemory(path string, kernelMemoryLimit int64) error {
-	if path == "" {
-		return fmt.Errorf("no such directory for %s", cgroupKernelMemoryLimit)
-	}
-	if !cgroups.PathExists(filepath.Join(path, cgroupKernelMemoryLimit)) {
-		// kernel memory is not enabled on the system so we should do nothing
-		return nil
-	}
-	if err := ioutil.WriteFile(filepath.Join(path, cgroupKernelMemoryLimit), []byte(strconv.FormatInt(kernelMemoryLimit, 10)), 0700); err != nil {
-		// Check if the error number returned by the syscall is "EBUSY"
-		// The EBUSY signal is returned on attempts to write to the
-		// memory.kmem.limit_in_bytes file if the cgroup has children or
-		// once tasks have been attached to the cgroup
-		if pathErr, ok := err.(*os.PathError); ok {
-			if errNo, ok := pathErr.Err.(syscall.Errno); ok {
-				if errNo == unix.EBUSY {
-					return fmt.Errorf("failed to set %s, because either tasks have already joined this cgroup or it has children", cgroupKernelMemoryLimit)
-				}
-			}
-		}
-		return fmt.Errorf("failed to write %v to %v: %v", kernelMemoryLimit, cgroupKernelMemoryLimit, err)
-	}
-	return nil
-}
-
-func setMemoryAndSwap(path string, cgroup *configs.Cgroup) error {
-	// If the memory update is set to -1 we should also
-	// set swap to -1, it means unlimited memory.
-	if cgroup.Resources.Memory == -1 {
-		// Only set swap if it's enabled in kernel
-		if cgroups.PathExists(filepath.Join(path, cgroupMemorySwapLimit)) {
-			cgroup.Resources.MemorySwap = -1
-		}
-	}
-
-	// When memory and swap memory are both set, we need to handle the cases
-	// for updating container.
-	if cgroup.Resources.Memory != 0 && cgroup.Resources.MemorySwap != 0 {
-		memoryUsage, err := getMemoryData(path, "")
-		if err != nil {
-			return err
-		}
-
-		// When update memory limit, we should adapt the write sequence
-		// for memory and swap memory, so it won't fail because the new
-		// value and the old value don't fit kernel's validation.
-		if cgroup.Resources.MemorySwap == -1 || memoryUsage.Limit < uint64(cgroup.Resources.MemorySwap) {
-			if err := writeFile(path, cgroupMemorySwapLimit, strconv.FormatInt(cgroup.Resources.MemorySwap, 10)); err != nil {
-				return err
-			}
-			if err := writeFile(path, cgroupMemoryLimit, strconv.FormatInt(cgroup.Resources.Memory, 10)); err != nil {
-				return err
-			}
-		} else {
-			if err := writeFile(path, cgroupMemoryLimit, strconv.FormatInt(cgroup.Resources.Memory, 10)); err != nil {
-				return err
-			}
-			if err := writeFile(path, cgroupMemorySwapLimit, strconv.FormatInt(cgroup.Resources.MemorySwap, 10)); err != nil {
-				return err
-			}
-		}
-	} else {
-		if cgroup.Resources.Memory != 0 {
-			if err := writeFile(path, cgroupMemoryLimit, strconv.FormatInt(cgroup.Resources.Memory, 10)); err != nil {
-				return err
-			}
-		}
-		if cgroup.Resources.MemorySwap != 0 {
-			if err := writeFile(path, cgroupMemorySwapLimit, strconv.FormatInt(cgroup.Resources.MemorySwap, 10)); err != nil {
-				return err
-			}
-		}
-	}
-
-	return nil
-}
-
-func (s *MemoryGroup) Set(path string, cgroup *configs.Cgroup) error {
-	if err := setMemoryAndSwap(path, cgroup); err != nil {
-		return err
-	}
-
-	if cgroup.Resources.KernelMemory != 0 {
-		if err := setKernelMemory(path, cgroup.Resources.KernelMemory); err != nil {
-			return err
-		}
-	}
-
-	if cgroup.Resources.MemoryReservation != 0 {
-		if err := writeFile(path, "memory.soft_limit_in_bytes", strconv.FormatInt(cgroup.Resources.MemoryReservation, 10)); err != nil {
-			return err
-		}
-	}
-
-	if cgroup.Resources.KernelMemoryTCP != 0 {
-		if err := writeFile(path, "memory.kmem.tcp.limit_in_bytes", strconv.FormatInt(cgroup.Resources.KernelMemoryTCP, 10)); err != nil {
-			return err
-		}
-	}
-	if cgroup.Resources.OomKillDisable {
-		if err := writeFile(path, "memory.oom_control", "1"); err != nil {
-			return err
-		}
-	}
-	if cgroup.Resources.MemorySwappiness == nil || int64(*cgroup.Resources.MemorySwappiness) == -1 {
-		return nil
-	} else if *cgroup.Resources.MemorySwappiness <= 100 {
-		if err := writeFile(path, "memory.swappiness", strconv.FormatUint(*cgroup.Resources.MemorySwappiness, 10)); err != nil {
-			return err
-		}
-	} else {
-		return fmt.Errorf("invalid value:%d. valid memory swappiness range is 0-100", *cgroup.Resources.MemorySwappiness)
-	}
-
-	return nil
-}
-
-func (s *MemoryGroup) Remove(d *cgroupData) error {
-	return removePath(d.path("memory"))
-}
-
-func (s *MemoryGroup) GetStats(path string, stats *cgroups.Stats) error {
-	// Set stats from memory.stat.
-	statsFile, err := os.Open(filepath.Join(path, "memory.stat"))
-	if err != nil {
-		if os.IsNotExist(err) {
-			return nil
-		}
-		return err
-	}
-	defer statsFile.Close()
-
-	sc := bufio.NewScanner(statsFile)
-	for sc.Scan() {
-		t, v, err := getCgroupParamKeyValue(sc.Text())
-		if err != nil {
-			return fmt.Errorf("failed to parse memory.stat (%q) - %v", sc.Text(), err)
-		}
-		stats.MemoryStats.Stats[t] = v
-	}
-	stats.MemoryStats.Cache = stats.MemoryStats.Stats["cache"]
-
-	memoryUsage, err := getMemoryData(path, "")
-	if err != nil {
-		return err
-	}
-	stats.MemoryStats.Usage = memoryUsage
-	swapUsage, err := getMemoryData(path, "memsw")
-	if err != nil {
-		return err
-	}
-	stats.MemoryStats.SwapUsage = swapUsage
-	kernelUsage, err := getMemoryData(path, "kmem")
-	if err != nil {
-		return err
-	}
-	stats.MemoryStats.KernelUsage = kernelUsage
-	kernelTCPUsage, err := getMemoryData(path, "kmem.tcp")
-	if err != nil {
-		return err
-	}
-	stats.MemoryStats.KernelTCPUsage = kernelTCPUsage
-
-	useHierarchy := strings.Join([]string{"memory", "use_hierarchy"}, ".")
-	value, err := getCgroupParamUint(path, useHierarchy)
-	if err != nil {
-		return err
-	}
-	if value == 1 {
-		stats.MemoryStats.UseHierarchy = true
-	}
-	return nil
-}
-
-func memoryAssigned(cgroup *configs.Cgroup) bool {
-	return cgroup.Resources.Memory != 0 ||
-		cgroup.Resources.MemoryReservation != 0 ||
-		cgroup.Resources.MemorySwap > 0 ||
-		cgroup.Resources.KernelMemory > 0 ||
-		cgroup.Resources.KernelMemoryTCP > 0 ||
-		cgroup.Resources.OomKillDisable ||
-		(cgroup.Resources.MemorySwappiness != nil && int64(*cgroup.Resources.MemorySwappiness) != -1)
-}
-
-func getMemoryData(path, name string) (cgroups.MemoryData, error) {
-	memoryData := cgroups.MemoryData{}
-
-	moduleName := "memory"
-	if name != "" {
-		moduleName = strings.Join([]string{"memory", name}, ".")
-	}
-	usage := strings.Join([]string{moduleName, "usage_in_bytes"}, ".")
-	maxUsage := strings.Join([]string{moduleName, "max_usage_in_bytes"}, ".")
-	failcnt := strings.Join([]string{moduleName, "failcnt"}, ".")
-	limit := strings.Join([]string{moduleName, "limit_in_bytes"}, ".")
-
-	value, err := getCgroupParamUint(path, usage)
-	if err != nil {
-		if moduleName != "memory" && os.IsNotExist(err) {
-			return cgroups.MemoryData{}, nil
-		}
-		return cgroups.MemoryData{}, fmt.Errorf("failed to parse %s - %v", usage, err)
-	}
-	memoryData.Usage = value
-	value, err = getCgroupParamUint(path, maxUsage)
-	if err != nil {
-		if moduleName != "memory" && os.IsNotExist(err) {
-			return cgroups.MemoryData{}, nil
-		}
-		return cgroups.MemoryData{}, fmt.Errorf("failed to parse %s - %v", maxUsage, err)
-	}
-	memoryData.MaxUsage = value
-	value, err = getCgroupParamUint(path, failcnt)
-	if err != nil {
-		if moduleName != "memory" && os.IsNotExist(err) {
-			return cgroups.MemoryData{}, nil
-		}
-		return cgroups.MemoryData{}, fmt.Errorf("failed to parse %s - %v", failcnt, err)
-	}
-	memoryData.Failcnt = value
-	value, err = getCgroupParamUint(path, limit)
-	if err != nil {
-		if moduleName != "memory" && os.IsNotExist(err) {
-			return cgroups.MemoryData{}, nil
-		}
-		return cgroups.MemoryData{}, fmt.Errorf("failed to parse %s - %v", limit, err)
-	}
-	memoryData.Limit = value
-
-	return memoryData, nil
-}
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/cgroups/fs/name.go b/vendor/github.com/opencontainers/runc/libcontainer/cgroups/fs/name.go
deleted file mode 100644
index d8cf1d87c..000000000
--- a/vendor/github.com/opencontainers/runc/libcontainer/cgroups/fs/name.go
+++ /dev/null
@@ -1,40 +0,0 @@
-// +build linux
-
-package fs
-
-import (
-	"github.com/opencontainers/runc/libcontainer/cgroups"
-	"github.com/opencontainers/runc/libcontainer/configs"
-)
-
-type NameGroup struct {
-	GroupName string
-	Join      bool
-}
-
-func (s *NameGroup) Name() string {
-	return s.GroupName
-}
-
-func (s *NameGroup) Apply(d *cgroupData) error {
-	if s.Join {
-		// ignore errors if the named cgroup does not exist
-		d.join(s.GroupName)
-	}
-	return nil
-}
-
-func (s *NameGroup) Set(path string, cgroup *configs.Cgroup) error {
-	return nil
-}
-
-func (s *NameGroup) Remove(d *cgroupData) error {
-	if s.Join {
-		removePath(d.path(s.GroupName))
-	}
-	return nil
-}
-
-func (s *NameGroup) GetStats(path string, stats *cgroups.Stats) error {
-	return nil
-}
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/cgroups/fs/net_cls.go b/vendor/github.com/opencontainers/runc/libcontainer/cgroups/fs/net_cls.go
deleted file mode 100644
index 8e74b645e..000000000
--- a/vendor/github.com/opencontainers/runc/libcontainer/cgroups/fs/net_cls.go
+++ /dev/null
@@ -1,43 +0,0 @@
-// +build linux
-
-package fs
-
-import (
-	"strconv"
-
-	"github.com/opencontainers/runc/libcontainer/cgroups"
-	"github.com/opencontainers/runc/libcontainer/configs"
-)
-
-type NetClsGroup struct {
-}
-
-func (s *NetClsGroup) Name() string {
-	return "net_cls"
-}
-
-func (s *NetClsGroup) Apply(d *cgroupData) error {
-	_, err := d.join("net_cls")
-	if err != nil && !cgroups.IsNotFound(err) {
-		return err
-	}
-	return nil
-}
-
-func (s *NetClsGroup) Set(path string, cgroup *configs.Cgroup) error {
-	if cgroup.Resources.NetClsClassid != 0 {
-		if err := writeFile(path, "net_cls.classid", strconv.FormatUint(uint64(cgroup.Resources.NetClsClassid), 10)); err != nil {
-			return err
-		}
-	}
-
-	return nil
-}
-
-func (s *NetClsGroup) Remove(d *cgroupData) error {
-	return removePath(d.path("net_cls"))
-}
-
-func (s *NetClsGroup) GetStats(path string, stats *cgroups.Stats) error {
-	return nil
-}
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/cgroups/fs/net_prio.go b/vendor/github.com/opencontainers/runc/libcontainer/cgroups/fs/net_prio.go
deleted file mode 100644
index d0ab2af89..000000000
--- a/vendor/github.com/opencontainers/runc/libcontainer/cgroups/fs/net_prio.go
+++ /dev/null
@@ -1,41 +0,0 @@
-// +build linux
-
-package fs
-
-import (
-	"github.com/opencontainers/runc/libcontainer/cgroups"
-	"github.com/opencontainers/runc/libcontainer/configs"
-)
-
-type NetPrioGroup struct {
-}
-
-func (s *NetPrioGroup) Name() string {
-	return "net_prio"
-}
-
-func (s *NetPrioGroup) Apply(d *cgroupData) error {
-	_, err := d.join("net_prio")
-	if err != nil && !cgroups.IsNotFound(err) {
-		return err
-	}
-	return nil
-}
-
-func (s *NetPrioGroup) Set(path string, cgroup *configs.Cgroup) error {
-	for _, prioMap := range cgroup.Resources.NetPrioIfpriomap {
-		if err := writeFile(path, "net_prio.ifpriomap", prioMap.CgroupString()); err != nil {
-			return err
-		}
-	}
-
-	return nil
-}
-
-func (s *NetPrioGroup) Remove(d *cgroupData) error {
-	return removePath(d.path("net_prio"))
-}
-
-func (s *NetPrioGroup) GetStats(path string, stats *cgroups.Stats) error {
-	return nil
-}
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/cgroups/fs/perf_event.go b/vendor/github.com/opencontainers/runc/libcontainer/cgroups/fs/perf_event.go
deleted file mode 100644
index 5693676d3..000000000
--- a/vendor/github.com/opencontainers/runc/libcontainer/cgroups/fs/perf_event.go
+++ /dev/null
@@ -1,35 +0,0 @@
-// +build linux
-
-package fs
-
-import (
-	"github.com/opencontainers/runc/libcontainer/cgroups"
-	"github.com/opencontainers/runc/libcontainer/configs"
-)
-
-type PerfEventGroup struct {
-}
-
-func (s *PerfEventGroup) Name() string {
-	return "perf_event"
-}
-
-func (s *PerfEventGroup) Apply(d *cgroupData) error {
-	// we just want to join this group even though we don't set anything
-	if _, err := d.join("perf_event"); err != nil && !cgroups.IsNotFound(err) {
-		return err
-	}
-	return nil
-}
-
-func (s *PerfEventGroup) Set(path string, cgroup *configs.Cgroup) error {
-	return nil
-}
-
-func (s *PerfEventGroup) Remove(d *cgroupData) error {
-	return removePath(d.path("perf_event"))
-}
-
-func (s *PerfEventGroup) GetStats(path string, stats *cgroups.Stats) error {
-	return nil
-}
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/cgroups/fs/pids.go b/vendor/github.com/opencontainers/runc/libcontainer/cgroups/fs/pids.go
deleted file mode 100644
index f1e372055..000000000
--- a/vendor/github.com/opencontainers/runc/libcontainer/cgroups/fs/pids.go
+++ /dev/null
@@ -1,73 +0,0 @@
-// +build linux
-
-package fs
-
-import (
-	"fmt"
-	"path/filepath"
-	"strconv"
-
-	"github.com/opencontainers/runc/libcontainer/cgroups"
-	"github.com/opencontainers/runc/libcontainer/configs"
-)
-
-type PidsGroup struct {
-}
-
-func (s *PidsGroup) Name() string {
-	return "pids"
-}
-
-func (s *PidsGroup) Apply(d *cgroupData) error {
-	_, err := d.join("pids")
-	if err != nil && !cgroups.IsNotFound(err) {
-		return err
-	}
-	return nil
-}
-
-func (s *PidsGroup) Set(path string, cgroup *configs.Cgroup) error {
-	if cgroup.Resources.PidsLimit != 0 {
-		// "max" is the fallback value.
-		limit := "max"
-
-		if cgroup.Resources.PidsLimit > 0 {
-			limit = strconv.FormatInt(cgroup.Resources.PidsLimit, 10)
-		}
-
-		if err := writeFile(path, "pids.max", limit); err != nil {
-			return err
-		}
-	}
-
-	return nil
-}
-
-func (s *PidsGroup) Remove(d *cgroupData) error {
-	return removePath(d.path("pids"))
-}
-
-func (s *PidsGroup) GetStats(path string, stats *cgroups.Stats) error {
-	current, err := getCgroupParamUint(path, "pids.current")
-	if err != nil {
-		return fmt.Errorf("failed to parse pids.current - %s", err)
-	}
-
-	maxString, err := getCgroupParamString(path, "pids.max")
-	if err != nil {
-		return fmt.Errorf("failed to parse pids.max - %s", err)
-	}
-
-	// Default if pids.max == "max" is 0 -- which represents "no limit".
-	var max uint64
-	if maxString != "max" {
-		max, err = parseUint(maxString, 10, 64)
-		if err != nil {
-			return fmt.Errorf("failed to parse pids.max - unable to parse %q as a uint from Cgroup file %q", maxString, filepath.Join(path, "pids.max"))
-		}
-	}
-
-	stats.PidsStats.Current = current
-	stats.PidsStats.Limit = max
-	return nil
-}
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/cgroups/fs/utils.go b/vendor/github.com/opencontainers/runc/libcontainer/cgroups/fs/utils.go
deleted file mode 100644
index 5ff0a1615..000000000
--- a/vendor/github.com/opencontainers/runc/libcontainer/cgroups/fs/utils.go
+++ /dev/null
@@ -1,78 +0,0 @@
-// +build linux
-
-package fs
-
-import (
-	"errors"
-	"fmt"
-	"io/ioutil"
-	"path/filepath"
-	"strconv"
-	"strings"
-)
-
-var (
-	ErrNotValidFormat = errors.New("line is not a valid key value format")
-)
-
-// Saturates negative values at zero and returns a uint64.
-// Due to kernel bugs, some of the memory cgroup stats can be negative.
-func parseUint(s string, base, bitSize int) (uint64, error) {
-	value, err := strconv.ParseUint(s, base, bitSize)
-	if err != nil {
-		intValue, intErr := strconv.ParseInt(s, base, bitSize)
-		// 1. Handle negative values greater than MinInt64 (and)
-		// 2. Handle negative values lesser than MinInt64
-		if intErr == nil && intValue < 0 {
-			return 0, nil
-		} else if intErr != nil && intErr.(*strconv.NumError).Err == strconv.ErrRange && intValue < 0 {
-			return 0, nil
-		}
-
-		return value, err
-	}
-
-	return value, nil
-}
-
-// Parses a cgroup param and returns as name, value
-//  i.e. "io_service_bytes 1234" will return as io_service_bytes, 1234
-func getCgroupParamKeyValue(t string) (string, uint64, error) {
-	parts := strings.Fields(t)
-	switch len(parts) {
-	case 2:
-		value, err := parseUint(parts[1], 10, 64)
-		if err != nil {
-			return "", 0, fmt.Errorf("unable to convert param value (%q) to uint64: %v", parts[1], err)
-		}
-
-		return parts[0], value, nil
-	default:
-		return "", 0, ErrNotValidFormat
-	}
-}
-
-// Gets a single uint64 value from the specified cgroup file.
-func getCgroupParamUint(cgroupPath, cgroupFile string) (uint64, error) {
-	fileName := filepath.Join(cgroupPath, cgroupFile)
-	contents, err := ioutil.ReadFile(fileName)
-	if err != nil {
-		return 0, err
-	}
-
-	res, err := parseUint(strings.TrimSpace(string(contents)), 10, 64)
-	if err != nil {
-		return res, fmt.Errorf("unable to parse %q as a uint from Cgroup file %q", string(contents), fileName)
-	}
-	return res, nil
-}
-
-// Gets a string value from the specified cgroup file
-func getCgroupParamString(cgroupPath, cgroupFile string) (string, error) {
-	contents, err := ioutil.ReadFile(filepath.Join(cgroupPath, cgroupFile))
-	if err != nil {
-		return "", err
-	}
-
-	return strings.TrimSpace(string(contents)), nil
-}
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/cgroups/systemd/apply_nosystemd.go b/vendor/github.com/opencontainers/runc/libcontainer/cgroups/systemd/apply_nosystemd.go
deleted file mode 100644
index a65d8e443..000000000
--- a/vendor/github.com/opencontainers/runc/libcontainer/cgroups/systemd/apply_nosystemd.go
+++ /dev/null
@@ -1,55 +0,0 @@
-// +build !linux static_build
-
-package systemd
-
-import (
-	"fmt"
-
-	"github.com/opencontainers/runc/libcontainer/cgroups"
-	"github.com/opencontainers/runc/libcontainer/configs"
-)
-
-type Manager struct {
-	Cgroups *configs.Cgroup
-	Paths   map[string]string
-}
-
-func UseSystemd() bool {
-	return false
-}
-
-func (m *Manager) Apply(pid int) error {
-	return fmt.Errorf("Systemd not supported")
-}
-
-func (m *Manager) GetPids() ([]int, error) {
-	return nil, fmt.Errorf("Systemd not supported")
-}
-
-func (m *Manager) GetAllPids() ([]int, error) {
-	return nil, fmt.Errorf("Systemd not supported")
-}
-
-func (m *Manager) Destroy() error {
-	return fmt.Errorf("Systemd not supported")
-}
-
-func (m *Manager) GetPaths() map[string]string {
-	return nil
-}
-
-func (m *Manager) GetStats() (*cgroups.Stats, error) {
-	return nil, fmt.Errorf("Systemd not supported")
-}
-
-func (m *Manager) Set(container *configs.Config) error {
-	return fmt.Errorf("Systemd not supported")
-}
-
-func (m *Manager) Freeze(state configs.FreezerState) error {
-	return fmt.Errorf("Systemd not supported")
-}
-
-func Freeze(c *configs.Cgroup, state configs.FreezerState) error {
-	return fmt.Errorf("Systemd not supported")
-}
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/cgroups/systemd/apply_systemd.go b/vendor/github.com/opencontainers/runc/libcontainer/cgroups/systemd/apply_systemd.go
deleted file mode 100644
index 45bd3acce..000000000
--- a/vendor/github.com/opencontainers/runc/libcontainer/cgroups/systemd/apply_systemd.go
+++ /dev/null
@@ -1,563 +0,0 @@
-// +build linux,!static_build
-
-package systemd
-
-import (
-	"errors"
-	"fmt"
-	"os"
-	"path/filepath"
-	"strings"
-	"sync"
-	"time"
-
-	systemdDbus "github.com/coreos/go-systemd/dbus"
-	systemdUtil "github.com/coreos/go-systemd/util"
-	"github.com/godbus/dbus"
-	"github.com/opencontainers/runc/libcontainer/cgroups"
-	"github.com/opencontainers/runc/libcontainer/cgroups/fs"
-	"github.com/opencontainers/runc/libcontainer/configs"
-)
-
-type Manager struct {
-	mu      sync.Mutex
-	Cgroups *configs.Cgroup
-	Paths   map[string]string
-}
-
-type subsystem interface {
-	// Name returns the name of the subsystem.
-	Name() string
-	// Returns the stats, as 'stats', corresponding to the cgroup under 'path'.
-	GetStats(path string, stats *cgroups.Stats) error
-	// Set the cgroup represented by cgroup.
-	Set(path string, cgroup *configs.Cgroup) error
-}
-
-var errSubsystemDoesNotExist = errors.New("cgroup: subsystem does not exist")
-
-type subsystemSet []subsystem
-
-func (s subsystemSet) Get(name string) (subsystem, error) {
-	for _, ss := range s {
-		if ss.Name() == name {
-			return ss, nil
-		}
-	}
-	return nil, errSubsystemDoesNotExist
-}
-
-var subsystems = subsystemSet{
-	&fs.CpusetGroup{},
-	&fs.DevicesGroup{},
-	&fs.MemoryGroup{},
-	&fs.CpuGroup{},
-	&fs.CpuacctGroup{},
-	&fs.PidsGroup{},
-	&fs.BlkioGroup{},
-	&fs.HugetlbGroup{},
-	&fs.PerfEventGroup{},
-	&fs.FreezerGroup{},
-	&fs.NetPrioGroup{},
-	&fs.NetClsGroup{},
-	&fs.NameGroup{GroupName: "name=systemd"},
-}
-
-const (
-	testScopeWait = 4
-	testSliceWait = 4
-)
-
-var (
-	connLock                        sync.Mutex
-	theConn                         *systemdDbus.Conn
-	hasStartTransientUnit           bool
-	hasStartTransientSliceUnit      bool
-	hasTransientDefaultDependencies bool
-	hasDelegate                     bool
-)
-
-func newProp(name string, units interface{}) systemdDbus.Property {
-	return systemdDbus.Property{
-		Name:  name,
-		Value: dbus.MakeVariant(units),
-	}
-}
-
-func UseSystemd() bool {
-	if !systemdUtil.IsRunningSystemd() {
-		return false
-	}
-
-	connLock.Lock()
-	defer connLock.Unlock()
-
-	if theConn == nil {
-		var err error
-		theConn, err = systemdDbus.New()
-		if err != nil {
-			return false
-		}
-
-		// Assume we have StartTransientUnit
-		hasStartTransientUnit = true
-
-		// But if we get UnknownMethod error we don't
-		if _, err := theConn.StartTransientUnit("test.scope", "invalid", nil, nil); err != nil {
-			if dbusError, ok := err.(dbus.Error); ok {
-				if dbusError.Name == "org.freedesktop.DBus.Error.UnknownMethod" {
-					hasStartTransientUnit = false
-					return hasStartTransientUnit
-				}
-			}
-		}
-
-		// Ensure the scope name we use doesn't exist. Use the Pid to
-		// avoid collisions between multiple libcontainer users on a
-		// single host.
-		scope := fmt.Sprintf("libcontainer-%d-systemd-test-default-dependencies.scope", os.Getpid())
-		testScopeExists := true
-		for i := 0; i <= testScopeWait; i++ {
-			if _, err := theConn.StopUnit(scope, "replace", nil); err != nil {
-				if dbusError, ok := err.(dbus.Error); ok {
-					if strings.Contains(dbusError.Name, "org.freedesktop.systemd1.NoSuchUnit") {
-						testScopeExists = false
-						break
-					}
-				}
-			}
-			time.Sleep(time.Millisecond)
-		}
-
-		// Bail out if we can't kill this scope without testing for DefaultDependencies
-		if testScopeExists {
-			return hasStartTransientUnit
-		}
-
-		// Assume StartTransientUnit on a scope allows DefaultDependencies
-		hasTransientDefaultDependencies = true
-		ddf := newProp("DefaultDependencies", false)
-		if _, err := theConn.StartTransientUnit(scope, "replace", []systemdDbus.Property{ddf}, nil); err != nil {
-			if dbusError, ok := err.(dbus.Error); ok {
-				if strings.Contains(dbusError.Name, "org.freedesktop.DBus.Error.PropertyReadOnly") {
-					hasTransientDefaultDependencies = false
-				}
-			}
-		}
-
-		// Not critical because of the stop unit logic above.
-		theConn.StopUnit(scope, "replace", nil)
-
-		// Assume StartTransientUnit on a scope allows Delegate
-		hasDelegate = true
-		dl := newProp("Delegate", true)
-		if _, err := theConn.StartTransientUnit(scope, "replace", []systemdDbus.Property{dl}, nil); err != nil {
-			if dbusError, ok := err.(dbus.Error); ok {
-				if strings.Contains(dbusError.Name, "org.freedesktop.DBus.Error.PropertyReadOnly") {
-					hasDelegate = false
-				}
-			}
-		}
-
-		// Assume we have the ability to start a transient unit as a slice
-		// This was broken until systemd v229, but has been back-ported on RHEL environments >= 219
-		// For details, see: https://bugzilla.redhat.com/show_bug.cgi?id=1370299
-		hasStartTransientSliceUnit = true
-
-		// To ensure simple clean-up, we create a slice off the root with no hierarchy
-		slice := fmt.Sprintf("libcontainer_%d_systemd_test_default.slice", os.Getpid())
-		if _, err := theConn.StartTransientUnit(slice, "replace", nil, nil); err != nil {
-			if _, ok := err.(dbus.Error); ok {
-				hasStartTransientSliceUnit = false
-			}
-		}
-
-		for i := 0; i <= testSliceWait; i++ {
-			if _, err := theConn.StopUnit(slice, "replace", nil); err != nil {
-				if dbusError, ok := err.(dbus.Error); ok {
-					if strings.Contains(dbusError.Name, "org.freedesktop.systemd1.NoSuchUnit") {
-						hasStartTransientSliceUnit = false
-						break
-					}
-				}
-			} else {
-				break
-			}
-			time.Sleep(time.Millisecond)
-		}
-
-		// Not critical because of the stop unit logic above.
-		theConn.StopUnit(scope, "replace", nil)
-		theConn.StopUnit(slice, "replace", nil)
-	}
-	return hasStartTransientUnit
-}
-
-func (m *Manager) Apply(pid int) error {
-	var (
-		c          = m.Cgroups
-		unitName   = getUnitName(c)
-		slice      = "system.slice"
-		properties []systemdDbus.Property
-	)
-
-	if c.Paths != nil {
-		paths := make(map[string]string)
-		for name, path := range c.Paths {
-			_, err := getSubsystemPath(m.Cgroups, name)
-			if err != nil {
-				// Don't fail if a cgroup hierarchy was not found, just skip this subsystem
-				if cgroups.IsNotFound(err) {
-					continue
-				}
-				return err
-			}
-			paths[name] = path
-		}
-		m.Paths = paths
-		return cgroups.EnterPid(m.Paths, pid)
-	}
-
-	if c.Parent != "" {
-		slice = c.Parent
-	}
-
-	properties = append(properties, systemdDbus.PropDescription("libcontainer container "+c.Name))
-
-	// if we create a slice, the parent is defined via a Wants=
-	if strings.HasSuffix(unitName, ".slice") {
-		// This was broken until systemd v229, but has been back-ported on RHEL environments >= 219
-		if !hasStartTransientSliceUnit {
-			return fmt.Errorf("systemd version does not support ability to start a slice as transient unit")
-		}
-		properties = append(properties, systemdDbus.PropWants(slice))
-	} else {
-		// otherwise, we use Slice=
-		properties = append(properties, systemdDbus.PropSlice(slice))
-	}
-
-	// only add pid if its valid, -1 is used w/ general slice creation.
-	if pid != -1 {
-		properties = append(properties, newProp("PIDs", []uint32{uint32(pid)}))
-	}
-
-	if hasDelegate {
-		// This is only supported on systemd versions 218 and above.
-		properties = append(properties, newProp("Delegate", true))
-	}
-
-	// Always enable accounting, this gets us the same behaviour as the fs implementation,
-	// plus the kernel has some problems with joining the memory cgroup at a later time.
-	properties = append(properties,
-		newProp("MemoryAccounting", true),
-		newProp("CPUAccounting", true),
-		newProp("BlockIOAccounting", true))
-
-	if hasTransientDefaultDependencies {
-		properties = append(properties,
-			newProp("DefaultDependencies", false))
-	}
-
-	if c.Resources.Memory != 0 {
-		properties = append(properties,
-			newProp("MemoryLimit", uint64(c.Resources.Memory)))
-	}
-
-	if c.Resources.CpuShares != 0 {
-		properties = append(properties,
-			newProp("CPUShares", c.Resources.CpuShares))
-	}
-
-	// cpu.cfs_quota_us and cpu.cfs_period_us are controlled by systemd.
-	if c.Resources.CpuQuota != 0 && c.Resources.CpuPeriod != 0 {
-		cpuQuotaPerSecUSec := uint64(c.Resources.CpuQuota*1000000) / c.Resources.CpuPeriod
-		// systemd converts CPUQuotaPerSecUSec (microseconds per CPU second) to CPUQuota
-		// (integer percentage of CPU) internally.  This means that if a fractional percent of
-		// CPU is indicated by Resources.CpuQuota, we need to round up to the nearest
-		// 10ms (1% of a second) such that child cgroups can set the cpu.cfs_quota_us they expect.
-		if cpuQuotaPerSecUSec%10000 != 0 {
-			cpuQuotaPerSecUSec = ((cpuQuotaPerSecUSec / 10000) + 1) * 10000
-		}
-		properties = append(properties,
-			newProp("CPUQuotaPerSecUSec", cpuQuotaPerSecUSec))
-	}
-
-	if c.Resources.BlkioWeight != 0 {
-		properties = append(properties,
-			newProp("BlockIOWeight", uint64(c.Resources.BlkioWeight)))
-	}
-
-	// We have to set kernel memory here, as we can't change it once
-	// processes have been attached to the cgroup.
-	if c.Resources.KernelMemory != 0 {
-		if err := setKernelMemory(c); err != nil {
-			return err
-		}
-	}
-
-	statusChan := make(chan string)
-	if _, err := theConn.StartTransientUnit(unitName, "replace", properties, statusChan); err != nil && !isUnitExists(err) {
-		return err
-	}
-
-	<-statusChan
-
-	if err := joinCgroups(c, pid); err != nil {
-		return err
-	}
-
-	paths := make(map[string]string)
-	for _, s := range subsystems {
-		subsystemPath, err := getSubsystemPath(m.Cgroups, s.Name())
-		if err != nil {
-			// Don't fail if a cgroup hierarchy was not found, just skip this subsystem
-			if cgroups.IsNotFound(err) {
-				continue
-			}
-			return err
-		}
-		paths[s.Name()] = subsystemPath
-	}
-	m.Paths = paths
-	return nil
-}
-
-func (m *Manager) Destroy() error {
-	if m.Cgroups.Paths != nil {
-		return nil
-	}
-	m.mu.Lock()
-	defer m.mu.Unlock()
-	theConn.StopUnit(getUnitName(m.Cgroups), "replace", nil)
-	if err := cgroups.RemovePaths(m.Paths); err != nil {
-		return err
-	}
-	m.Paths = make(map[string]string)
-	return nil
-}
-
-func (m *Manager) GetPaths() map[string]string {
-	m.mu.Lock()
-	paths := m.Paths
-	m.mu.Unlock()
-	return paths
-}
-
-func join(c *configs.Cgroup, subsystem string, pid int) (string, error) {
-	path, err := getSubsystemPath(c, subsystem)
-	if err != nil {
-		return "", err
-	}
-	if err := os.MkdirAll(path, 0755); err != nil {
-		return "", err
-	}
-	if err := cgroups.WriteCgroupProc(path, pid); err != nil {
-		return "", err
-	}
-	return path, nil
-}
-
-func joinCgroups(c *configs.Cgroup, pid int) error {
-	for _, sys := range subsystems {
-		name := sys.Name()
-		switch name {
-		case "name=systemd":
-			// let systemd handle this
-		case "cpuset":
-			path, err := getSubsystemPath(c, name)
-			if err != nil && !cgroups.IsNotFound(err) {
-				return err
-			}
-			s := &fs.CpusetGroup{}
-			if err := s.ApplyDir(path, c, pid); err != nil {
-				return err
-			}
-		default:
-			_, err := join(c, name, pid)
-			if err != nil {
-				// Even if it's `not found` error, we'll return err
-				// because devices cgroup is hard requirement for
-				// container security.
-				if name == "devices" {
-					return err
-				}
-				// For other subsystems, omit the `not found` error
-				// because they are optional.
-				if !cgroups.IsNotFound(err) {
-					return err
-				}
-			}
-		}
-	}
-
-	return nil
-}
-
-// systemd represents slice hierarchy using `-`, so we need to follow suit when
-// generating the path of slice. Essentially, test-a-b.slice becomes
-// test.slice/test-a.slice/test-a-b.slice.
-func ExpandSlice(slice string) (string, error) {
-	suffix := ".slice"
-	// Name has to end with ".slice", but can't be just ".slice".
-	if len(slice) < len(suffix) || !strings.HasSuffix(slice, suffix) {
-		return "", fmt.Errorf("invalid slice name: %s", slice)
-	}
-
-	// Path-separators are not allowed.
-	if strings.Contains(slice, "/") {
-		return "", fmt.Errorf("invalid slice name: %s", slice)
-	}
-
-	var path, prefix string
-	sliceName := strings.TrimSuffix(slice, suffix)
-	// if input was -.slice, we should just return root now
-	if sliceName == "-" {
-		return "/", nil
-	}
-	for _, component := range strings.Split(sliceName, "-") {
-		// test--a.slice isn't permitted, nor is -test.slice.
-		if component == "" {
-			return "", fmt.Errorf("invalid slice name: %s", slice)
-		}
-
-		// Append the component to the path and to the prefix.
-		path += prefix + component + suffix + "/"
-		prefix += component + "-"
-	}
-
-	return path, nil
-}
-
-func getSubsystemPath(c *configs.Cgroup, subsystem string) (string, error) {
-	mountpoint, err := cgroups.FindCgroupMountpoint(subsystem)
-	if err != nil {
-		return "", err
-	}
-
-	initPath, err := cgroups.GetInitCgroup(subsystem)
-	if err != nil {
-		return "", err
-	}
-	// if pid 1 is systemd 226 or later, it will be in init.scope, not the root
-	initPath = strings.TrimSuffix(filepath.Clean(initPath), "init.scope")
-
-	slice := "system.slice"
-	if c.Parent != "" {
-		slice = c.Parent
-	}
-
-	slice, err = ExpandSlice(slice)
-	if err != nil {
-		return "", err
-	}
-
-	return filepath.Join(mountpoint, initPath, slice, getUnitName(c)), nil
-}
-
-func (m *Manager) Freeze(state configs.FreezerState) error {
-	path, err := getSubsystemPath(m.Cgroups, "freezer")
-	if err != nil {
-		return err
-	}
-	prevState := m.Cgroups.Resources.Freezer
-	m.Cgroups.Resources.Freezer = state
-	freezer, err := subsystems.Get("freezer")
-	if err != nil {
-		return err
-	}
-	err = freezer.Set(path, m.Cgroups)
-	if err != nil {
-		m.Cgroups.Resources.Freezer = prevState
-		return err
-	}
-	return nil
-}
-
-func (m *Manager) GetPids() ([]int, error) {
-	path, err := getSubsystemPath(m.Cgroups, "devices")
-	if err != nil {
-		return nil, err
-	}
-	return cgroups.GetPids(path)
-}
-
-func (m *Manager) GetAllPids() ([]int, error) {
-	path, err := getSubsystemPath(m.Cgroups, "devices")
-	if err != nil {
-		return nil, err
-	}
-	return cgroups.GetAllPids(path)
-}
-
-func (m *Manager) GetStats() (*cgroups.Stats, error) {
-	m.mu.Lock()
-	defer m.mu.Unlock()
-	stats := cgroups.NewStats()
-	for name, path := range m.Paths {
-		sys, err := subsystems.Get(name)
-		if err == errSubsystemDoesNotExist || !cgroups.PathExists(path) {
-			continue
-		}
-		if err := sys.GetStats(path, stats); err != nil {
-			return nil, err
-		}
-	}
-
-	return stats, nil
-}
-
-func (m *Manager) Set(container *configs.Config) error {
-	// If Paths are set, then we are just joining cgroups paths
-	// and there is no need to set any values.
-	if m.Cgroups.Paths != nil {
-		return nil
-	}
-	for _, sys := range subsystems {
-		// Get the subsystem path, but don't error out for not found cgroups.
-		path, err := getSubsystemPath(container.Cgroups, sys.Name())
-		if err != nil && !cgroups.IsNotFound(err) {
-			return err
-		}
-
-		if err := sys.Set(path, container.Cgroups); err != nil {
-			return err
-		}
-	}
-
-	if m.Paths["cpu"] != "" {
-		if err := fs.CheckCpushares(m.Paths["cpu"], container.Cgroups.Resources.CpuShares); err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-func getUnitName(c *configs.Cgroup) string {
-	// by default, we create a scope unless the user explicitly asks for a slice.
-	if !strings.HasSuffix(c.Name, ".slice") {
-		return fmt.Sprintf("%s-%s.scope", c.ScopePrefix, c.Name)
-	}
-	return c.Name
-}
-
-func setKernelMemory(c *configs.Cgroup) error {
-	path, err := getSubsystemPath(c, "memory")
-	if err != nil && !cgroups.IsNotFound(err) {
-		return err
-	}
-
-	if err := os.MkdirAll(path, 0755); err != nil {
-		return err
-	}
-	return fs.EnableKernelMemoryAccounting(path)
-}
-
-// isUnitExists returns true if the error is that a systemd unit already exists.
-func isUnitExists(err error) bool {
-	if err != nil {
-		if dbusError, ok := err.(dbus.Error); ok {
-			return strings.Contains(dbusError.Name, "org.freedesktop.systemd1.UnitExists")
-		}
-	}
-	return false
-}
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/configs/validate/rootless.go b/vendor/github.com/opencontainers/runc/libcontainer/configs/validate/rootless.go
deleted file mode 100644
index 7a9f33b71..000000000
--- a/vendor/github.com/opencontainers/runc/libcontainer/configs/validate/rootless.go
+++ /dev/null
@@ -1,117 +0,0 @@
-package validate
-
-import (
-	"fmt"
-	"os"
-	"reflect"
-	"strings"
-
-	"github.com/opencontainers/runc/libcontainer/configs"
-)
-
-var (
-	geteuid = os.Geteuid
-	getegid = os.Getegid
-)
-
-func (v *ConfigValidator) rootless(config *configs.Config) error {
-	if err := rootlessMappings(config); err != nil {
-		return err
-	}
-	if err := rootlessMount(config); err != nil {
-		return err
-	}
-
-	// XXX: We currently can't verify the user config at all, because
-	//      configs.Config doesn't store the user-related configs. So this
-	//      has to be verified by setupUser() in init_linux.go.
-
-	return nil
-}
-
-func hasIDMapping(id int, mappings []configs.IDMap) bool {
-	for _, m := range mappings {
-		if id >= m.ContainerID && id < m.ContainerID+m.Size {
-			return true
-		}
-	}
-	return false
-}
-
-func rootlessMappings(config *configs.Config) error {
-	if euid := geteuid(); euid != 0 {
-		if !config.Namespaces.Contains(configs.NEWUSER) {
-			return fmt.Errorf("rootless containers require user namespaces")
-		}
-	}
-
-	if len(config.UidMappings) == 0 {
-		return fmt.Errorf("rootless containers requires at least one UID mapping")
-	}
-	if len(config.GidMappings) == 0 {
-		return fmt.Errorf("rootless containers requires at least one UID mapping")
-	}
-
-	return nil
-}
-
-// cgroup verifies that the user isn't trying to set any cgroup limits or paths.
-func rootlessCgroup(config *configs.Config) error {
-	// Nothing set at all.
-	if config.Cgroups == nil || config.Cgroups.Resources == nil {
-		return nil
-	}
-
-	// Used for comparing to the zero value.
-	left := reflect.ValueOf(*config.Cgroups.Resources)
-	right := reflect.Zero(left.Type())
-
-	// This is all we need to do, since specconv won't add cgroup options in
-	// rootless mode.
-	if !reflect.DeepEqual(left.Interface(), right.Interface()) {
-		return fmt.Errorf("cannot specify resource limits in rootless container")
-	}
-
-	return nil
-}
-
-// mount verifies that the user isn't trying to set up any mounts they don't have
-// the rights to do. In addition, it makes sure that no mount has a `uid=` or
-// `gid=` option that doesn't resolve to root.
-func rootlessMount(config *configs.Config) error {
-	// XXX: We could whitelist allowed devices at this point, but I'm not
-	//      convinced that's a good idea. The kernel is the best arbiter of
-	//      access control.
-
-	for _, mount := range config.Mounts {
-		// Check that the options list doesn't contain any uid= or gid= entries
-		// that don't resolve to root.
-		for _, opt := range strings.Split(mount.Data, ",") {
-			if strings.HasPrefix(opt, "uid=") {
-				var uid int
-				n, err := fmt.Sscanf(opt, "uid=%d", &uid)
-				if n != 1 || err != nil {
-					// Ignore unknown mount options.
-					continue
-				}
-				if !hasIDMapping(uid, config.UidMappings) {
-					return fmt.Errorf("cannot specify uid= mount options for unmapped uid in rootless containers")
-				}
-			}
-
-			if strings.HasPrefix(opt, "gid=") {
-				var gid int
-				n, err := fmt.Sscanf(opt, "gid=%d", &gid)
-				if n != 1 || err != nil {
-					// Ignore unknown mount options.
-					continue
-				}
-				if !hasIDMapping(gid, config.GidMappings) {
-					return fmt.Errorf("cannot specify gid= mount options for unmapped gid in rootless containers")
-				}
-			}
-		}
-	}
-
-	return nil
-}
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/configs/validate/validator.go b/vendor/github.com/opencontainers/runc/libcontainer/configs/validate/validator.go
deleted file mode 100644
index cbbba9a03..000000000
--- a/vendor/github.com/opencontainers/runc/libcontainer/configs/validate/validator.go
+++ /dev/null
@@ -1,212 +0,0 @@
-package validate
-
-import (
-	"fmt"
-	"os"
-	"path/filepath"
-	"strings"
-
-	"github.com/opencontainers/runc/libcontainer/configs"
-	"github.com/opencontainers/runc/libcontainer/intelrdt"
-	selinux "github.com/opencontainers/selinux/go-selinux"
-)
-
-type Validator interface {
-	Validate(*configs.Config) error
-}
-
-func New() Validator {
-	return &ConfigValidator{}
-}
-
-type ConfigValidator struct {
-}
-
-func (v *ConfigValidator) Validate(config *configs.Config) error {
-	if err := v.rootfs(config); err != nil {
-		return err
-	}
-	if err := v.network(config); err != nil {
-		return err
-	}
-	if err := v.hostname(config); err != nil {
-		return err
-	}
-	if err := v.security(config); err != nil {
-		return err
-	}
-	if err := v.usernamespace(config); err != nil {
-		return err
-	}
-	if err := v.sysctl(config); err != nil {
-		return err
-	}
-	if err := v.intelrdt(config); err != nil {
-		return err
-	}
-	if config.Rootless {
-		if err := v.rootless(config); err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-// rootfs validates if the rootfs is an absolute path and is not a symlink
-// to the container's root filesystem.
-func (v *ConfigValidator) rootfs(config *configs.Config) error {
-	if _, err := os.Stat(config.Rootfs); err != nil {
-		if os.IsNotExist(err) {
-			return fmt.Errorf("rootfs (%s) does not exist", config.Rootfs)
-		}
-		return err
-	}
-	cleaned, err := filepath.Abs(config.Rootfs)
-	if err != nil {
-		return err
-	}
-	if cleaned, err = filepath.EvalSymlinks(cleaned); err != nil {
-		return err
-	}
-	if filepath.Clean(config.Rootfs) != cleaned {
-		return fmt.Errorf("%s is not an absolute path or is a symlink", config.Rootfs)
-	}
-	return nil
-}
-
-func (v *ConfigValidator) network(config *configs.Config) error {
-	if !config.Namespaces.Contains(configs.NEWNET) {
-		if len(config.Networks) > 0 || len(config.Routes) > 0 {
-			return fmt.Errorf("unable to apply network settings without a private NET namespace")
-		}
-	}
-	return nil
-}
-
-func (v *ConfigValidator) hostname(config *configs.Config) error {
-	if config.Hostname != "" && !config.Namespaces.Contains(configs.NEWUTS) {
-		return fmt.Errorf("unable to set hostname without a private UTS namespace")
-	}
-	return nil
-}
-
-func (v *ConfigValidator) security(config *configs.Config) error {
-	// restrict sys without mount namespace
-	if (len(config.MaskPaths) > 0 || len(config.ReadonlyPaths) > 0) &&
-		!config.Namespaces.Contains(configs.NEWNS) {
-		return fmt.Errorf("unable to restrict sys entries without a private MNT namespace")
-	}
-	if config.ProcessLabel != "" && !selinux.GetEnabled() {
-		return fmt.Errorf("selinux label is specified in config, but selinux is disabled or not supported")
-	}
-
-	return nil
-}
-
-func (v *ConfigValidator) usernamespace(config *configs.Config) error {
-	if config.Namespaces.Contains(configs.NEWUSER) {
-		if _, err := os.Stat("/proc/self/ns/user"); os.IsNotExist(err) {
-			return fmt.Errorf("USER namespaces aren't enabled in the kernel")
-		}
-	} else {
-		if config.UidMappings != nil || config.GidMappings != nil {
-			return fmt.Errorf("User namespace mappings specified, but USER namespace isn't enabled in the config")
-		}
-	}
-	return nil
-}
-
-// sysctl validates that the specified sysctl keys are valid or not.
-// /proc/sys isn't completely namespaced and depending on which namespaces
-// are specified, a subset of sysctls are permitted.
-func (v *ConfigValidator) sysctl(config *configs.Config) error {
-	validSysctlMap := map[string]bool{
-		"kernel.msgmax":          true,
-		"kernel.msgmnb":          true,
-		"kernel.msgmni":          true,
-		"kernel.sem":             true,
-		"kernel.shmall":          true,
-		"kernel.shmmax":          true,
-		"kernel.shmmni":          true,
-		"kernel.shm_rmid_forced": true,
-	}
-
-	for s := range config.Sysctl {
-		if validSysctlMap[s] || strings.HasPrefix(s, "fs.mqueue.") {
-			if config.Namespaces.Contains(configs.NEWIPC) {
-				continue
-			} else {
-				return fmt.Errorf("sysctl %q is not allowed in the hosts ipc namespace", s)
-			}
-		}
-		if strings.HasPrefix(s, "net.") {
-			if config.Namespaces.Contains(configs.NEWNET) {
-				if path := config.Namespaces.PathOf(configs.NEWNET); path != "" {
-					if err := checkHostNs(s, path); err != nil {
-						return err
-					}
-				}
-				continue
-			} else {
-				return fmt.Errorf("sysctl %q is not allowed in the hosts network namespace", s)
-			}
-		}
-		return fmt.Errorf("sysctl %q is not in a separate kernel namespace", s)
-	}
-
-	return nil
-}
-
-func (v *ConfigValidator) intelrdt(config *configs.Config) error {
-	if config.IntelRdt != nil {
-		if !intelrdt.IsEnabled() {
-			return fmt.Errorf("intelRdt is specified in config, but Intel RDT feature is not supported or enabled")
-		}
-		if config.IntelRdt.L3CacheSchema == "" {
-			return fmt.Errorf("intelRdt is specified in config, but intelRdt.l3CacheSchema is empty")
-		}
-	}
-
-	return nil
-}
-
-func isSymbolicLink(path string) (bool, error) {
-	fi, err := os.Lstat(path)
-	if err != nil {
-		return false, err
-	}
-
-	return fi.Mode()&os.ModeSymlink == os.ModeSymlink, nil
-}
-
-// checkHostNs checks whether network sysctl is used in host namespace.
-func checkHostNs(sysctlConfig string, path string) error {
-	var currentProcessNetns = "/proc/self/ns/net"
-	// readlink on the current processes network namespace
-	destOfCurrentProcess, err := os.Readlink(currentProcessNetns)
-	if err != nil {
-		return fmt.Errorf("read soft link %q error", currentProcessNetns)
-	}
-
-	// First check if the provided path is a symbolic link
-	symLink, err := isSymbolicLink(path)
-	if err != nil {
-		return fmt.Errorf("could not check that %q is a symlink: %v", path, err)
-	}
-
-	if symLink == false {
-		// The provided namespace is not a symbolic link,
-		// it is not the host namespace.
-		return nil
-	}
-
-	// readlink on the path provided in the struct
-	destOfContainer, err := os.Readlink(path)
-	if err != nil {
-		return fmt.Errorf("read soft link %q error", path)
-	}
-	if destOfContainer == destOfCurrentProcess {
-		return fmt.Errorf("sysctl %q is not allowed in the hosts network namespace", sysctlConfig)
-	}
-	return nil
-}
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/console_linux.go b/vendor/github.com/opencontainers/runc/libcontainer/console_linux.go
deleted file mode 100644
index 9997e93ed..000000000
--- a/vendor/github.com/opencontainers/runc/libcontainer/console_linux.go
+++ /dev/null
@@ -1,41 +0,0 @@
-package libcontainer
-
-import (
-	"os"
-
-	"golang.org/x/sys/unix"
-)
-
-// mount initializes the console inside the rootfs mounting with the specified mount label
-// and applying the correct ownership of the console.
-func mountConsole(slavePath string) error {
-	oldMask := unix.Umask(0000)
-	defer unix.Umask(oldMask)
-	f, err := os.Create("/dev/console")
-	if err != nil && !os.IsExist(err) {
-		return err
-	}
-	if f != nil {
-		f.Close()
-	}
-	return unix.Mount(slavePath, "/dev/console", "bind", unix.MS_BIND, "")
-}
-
-// dupStdio opens the slavePath for the console and dups the fds to the current
-// processes stdio, fd 0,1,2.
-func dupStdio(slavePath string) error {
-	fd, err := unix.Open(slavePath, unix.O_RDWR, 0)
-	if err != nil {
-		return &os.PathError{
-			Op:   "open",
-			Path: slavePath,
-			Err:  err,
-		}
-	}
-	for _, i := range []int{0, 1, 2} {
-		if err := unix.Dup3(fd, i, 0); err != nil {
-			return err
-		}
-	}
-	return nil
-}
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/container.go b/vendor/github.com/opencontainers/runc/libcontainer/container.go
deleted file mode 100644
index 2e31b4d4f..000000000
--- a/vendor/github.com/opencontainers/runc/libcontainer/container.go
+++ /dev/null
@@ -1,166 +0,0 @@
-// Package libcontainer provides a native Go implementation for creating containers
-// with namespaces, cgroups, capabilities, and filesystem access controls.
-// It allows you to manage the lifecycle of the container performing additional operations
-// after the container is created.
-package libcontainer
-
-import (
-	"os"
-	"time"
-
-	"github.com/opencontainers/runc/libcontainer/configs"
-)
-
-// Status is the status of a container.
-type Status int
-
-const (
-	// Created is the status that denotes the container exists but has not been run yet.
-	Created Status = iota
-	// Running is the status that denotes the container exists and is running.
-	Running
-	// Pausing is the status that denotes the container exists, it is in the process of being paused.
-	Pausing
-	// Paused is the status that denotes the container exists, but all its processes are paused.
-	Paused
-	// Stopped is the status that denotes the container does not have a created or running process.
-	Stopped
-)
-
-func (s Status) String() string {
-	switch s {
-	case Created:
-		return "created"
-	case Running:
-		return "running"
-	case Pausing:
-		return "pausing"
-	case Paused:
-		return "paused"
-	case Stopped:
-		return "stopped"
-	default:
-		return "unknown"
-	}
-}
-
-// BaseState represents the platform agnostic pieces relating to a
-// running container's state
-type BaseState struct {
-	// ID is the container ID.
-	ID string `json:"id"`
-
-	// InitProcessPid is the init process id in the parent namespace.
-	InitProcessPid int `json:"init_process_pid"`
-
-	// InitProcessStartTime is the init process start time in clock cycles since boot time.
-	InitProcessStartTime uint64 `json:"init_process_start"`
-
-	// Created is the unix timestamp for the creation time of the container in UTC
-	Created time.Time `json:"created"`
-
-	// Config is the container's configuration.
-	Config configs.Config `json:"config"`
-}
-
-// BaseContainer is a libcontainer container object.
-//
-// Each container is thread-safe within the same process. Since a container can
-// be destroyed by a separate process, any function may return that the container
-// was not found. BaseContainer includes methods that are platform agnostic.
-type BaseContainer interface {
-	// Returns the ID of the container
-	ID() string
-
-	// Returns the current status of the container.
-	//
-	// errors:
-	// ContainerNotExists - Container no longer exists,
-	// Systemerror - System error.
-	Status() (Status, error)
-
-	// State returns the current container's state information.
-	//
-	// errors:
-	// SystemError - System error.
-	State() (*State, error)
-
-	// Returns the current config of the container.
-	Config() configs.Config
-
-	// Returns the PIDs inside this container. The PIDs are in the namespace of the calling process.
-	//
-	// errors:
-	// ContainerNotExists - Container no longer exists,
-	// Systemerror - System error.
-	//
-	// Some of the returned PIDs may no longer refer to processes in the Container, unless
-	// the Container state is PAUSED in which case every PID in the slice is valid.
-	Processes() ([]int, error)
-
-	// Returns statistics for the container.
-	//
-	// errors:
-	// ContainerNotExists - Container no longer exists,
-	// Systemerror - System error.
-	Stats() (*Stats, error)
-
-	// Set resources of container as configured
-	//
-	// We can use this to change resources when containers are running.
-	//
-	// errors:
-	// SystemError - System error.
-	Set(config configs.Config) error
-
-	// Start a process inside the container. Returns error if process fails to
-	// start. You can track process lifecycle with passed Process structure.
-	//
-	// errors:
-	// ContainerNotExists - Container no longer exists,
-	// ConfigInvalid - config is invalid,
-	// ContainerPaused - Container is paused,
-	// SystemError - System error.
-	Start(process *Process) (err error)
-
-	// Run immediately starts the process inside the container.  Returns error if process
-	// fails to start.  It does not block waiting for the exec fifo  after start returns but
-	// opens the fifo after start returns.
-	//
-	// errors:
-	// ContainerNotExists - Container no longer exists,
-	// ConfigInvalid - config is invalid,
-	// ContainerPaused - Container is paused,
-	// SystemError - System error.
-	Run(process *Process) (err error)
-
-	// Destroys the container, if its in a valid state, after killing any
-	// remaining running processes.
-	//
-	// Any event registrations are removed before the container is destroyed.
-	// No error is returned if the container is already destroyed.
-	//
-	// Running containers must first be stopped using Signal(..).
-	// Paused containers must first be resumed using Resume(..).
-	//
-	// errors:
-	// ContainerNotStopped - Container is still running,
-	// ContainerPaused - Container is paused,
-	// SystemError - System error.
-	Destroy() error
-
-	// Signal sends the provided signal code to the container's initial process.
-	//
-	// If all is specified the signal is sent to all processes in the container
-	// including the initial process.
-	//
-	// errors:
-	// SystemError - System error.
-	Signal(s os.Signal, all bool) error
-
-	// Exec signals the container to exec the users process at the end of the init.
-	//
-	// errors:
-	// SystemError - System error.
-	Exec() error
-}
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/container_linux.go b/vendor/github.com/opencontainers/runc/libcontainer/container_linux.go
deleted file mode 100644
index cfb05b43a..000000000
--- a/vendor/github.com/opencontainers/runc/libcontainer/container_linux.go
+++ /dev/null
@@ -1,1849 +0,0 @@
-// +build linux
-
-package libcontainer
-
-import (
-	"bytes"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"io"
-	"io/ioutil"
-	"net"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"reflect"
-	"strings"
-	"sync"
-	"syscall" // only for SysProcAttr and Signal
-	"time"
-
-	"github.com/opencontainers/runc/libcontainer/cgroups"
-	"github.com/opencontainers/runc/libcontainer/configs"
-	"github.com/opencontainers/runc/libcontainer/criurpc"
-	"github.com/opencontainers/runc/libcontainer/intelrdt"
-	"github.com/opencontainers/runc/libcontainer/system"
-	"github.com/opencontainers/runc/libcontainer/utils"
-
-	"github.com/golang/protobuf/proto"
-	"github.com/sirupsen/logrus"
-	"github.com/syndtr/gocapability/capability"
-	"github.com/vishvananda/netlink/nl"
-	"golang.org/x/sys/unix"
-)
-
-const stdioFdCount = 3
-
-type linuxContainer struct {
-	id                   string
-	root                 string
-	config               *configs.Config
-	cgroupManager        cgroups.Manager
-	intelRdtManager      intelrdt.Manager
-	initPath             string
-	initArgs             []string
-	initProcess          parentProcess
-	initProcessStartTime uint64
-	criuPath             string
-	newuidmapPath        string
-	newgidmapPath        string
-	m                    sync.Mutex
-	criuVersion          int
-	state                containerState
-	created              time.Time
-}
-
-// State represents a running container's state
-type State struct {
-	BaseState
-
-	// Platform specific fields below here
-
-	// Specifies if the container was started under the rootless mode.
-	Rootless bool `json:"rootless"`
-
-	// Path to all the cgroups setup for a container. Key is cgroup subsystem name
-	// with the value as the path.
-	CgroupPaths map[string]string `json:"cgroup_paths"`
-
-	// NamespacePaths are filepaths to the container's namespaces. Key is the namespace type
-	// with the value as the path.
-	NamespacePaths map[configs.NamespaceType]string `json:"namespace_paths"`
-
-	// Container's standard descriptors (std{in,out,err}), needed for checkpoint and restore
-	ExternalDescriptors []string `json:"external_descriptors,omitempty"`
-
-	// Intel RDT "resource control" filesystem path
-	IntelRdtPath string `json:"intel_rdt_path"`
-}
-
-// Container is a libcontainer container object.
-//
-// Each container is thread-safe within the same process. Since a container can
-// be destroyed by a separate process, any function may return that the container
-// was not found.
-type Container interface {
-	BaseContainer
-
-	// Methods below here are platform specific
-
-	// Checkpoint checkpoints the running container's state to disk using the criu(8) utility.
-	//
-	// errors:
-	// Systemerror - System error.
-	Checkpoint(criuOpts *CriuOpts) error
-
-	// Restore restores the checkpointed container to a running state using the criu(8) utility.
-	//
-	// errors:
-	// Systemerror - System error.
-	Restore(process *Process, criuOpts *CriuOpts) error
-
-	// If the Container state is RUNNING or CREATED, sets the Container state to PAUSING and pauses
-	// the execution of any user processes. Asynchronously, when the container finished being paused the
-	// state is changed to PAUSED.
-	// If the Container state is PAUSED, do nothing.
-	//
-	// errors:
-	// ContainerNotExists - Container no longer exists,
-	// ContainerNotRunning - Container not running or created,
-	// Systemerror - System error.
-	Pause() error
-
-	// If the Container state is PAUSED, resumes the execution of any user processes in the
-	// Container before setting the Container state to RUNNING.
-	// If the Container state is RUNNING, do nothing.
-	//
-	// errors:
-	// ContainerNotExists - Container no longer exists,
-	// ContainerNotPaused - Container is not paused,
-	// Systemerror - System error.
-	Resume() error
-
-	// NotifyOOM returns a read-only channel signaling when the container receives an OOM notification.
-	//
-	// errors:
-	// Systemerror - System error.
-	NotifyOOM() (<-chan struct{}, error)
-
-	// NotifyMemoryPressure returns a read-only channel signaling when the container reaches a given pressure level
-	//
-	// errors:
-	// Systemerror - System error.
-	NotifyMemoryPressure(level PressureLevel) (<-chan struct{}, error)
-}
-
-// ID returns the container's unique ID
-func (c *linuxContainer) ID() string {
-	return c.id
-}
-
-// Config returns the container's configuration
-func (c *linuxContainer) Config() configs.Config {
-	return *c.config
-}
-
-func (c *linuxContainer) Status() (Status, error) {
-	c.m.Lock()
-	defer c.m.Unlock()
-	return c.currentStatus()
-}
-
-func (c *linuxContainer) State() (*State, error) {
-	c.m.Lock()
-	defer c.m.Unlock()
-	return c.currentState()
-}
-
-func (c *linuxContainer) Processes() ([]int, error) {
-	pids, err := c.cgroupManager.GetAllPids()
-	if err != nil {
-		return nil, newSystemErrorWithCause(err, "getting all container pids from cgroups")
-	}
-	return pids, nil
-}
-
-func (c *linuxContainer) Stats() (*Stats, error) {
-	var (
-		err   error
-		stats = &Stats{}
-	)
-	if stats.CgroupStats, err = c.cgroupManager.GetStats(); err != nil {
-		return stats, newSystemErrorWithCause(err, "getting container stats from cgroups")
-	}
-	if c.intelRdtManager != nil {
-		if stats.IntelRdtStats, err = c.intelRdtManager.GetStats(); err != nil {
-			return stats, newSystemErrorWithCause(err, "getting container's Intel RDT stats")
-		}
-	}
-	for _, iface := range c.config.Networks {
-		switch iface.Type {
-		case "veth":
-			istats, err := getNetworkInterfaceStats(iface.HostInterfaceName)
-			if err != nil {
-				return stats, newSystemErrorWithCausef(err, "getting network stats for interface %q", iface.HostInterfaceName)
-			}
-			stats.Interfaces = append(stats.Interfaces, istats)
-		}
-	}
-	return stats, nil
-}
-
-func (c *linuxContainer) Set(config configs.Config) error {
-	c.m.Lock()
-	defer c.m.Unlock()
-	status, err := c.currentStatus()
-	if err != nil {
-		return err
-	}
-	if status == Stopped {
-		return newGenericError(fmt.Errorf("container not running"), ContainerNotRunning)
-	}
-	if err := c.cgroupManager.Set(&config); err != nil {
-		// Set configs back
-		if err2 := c.cgroupManager.Set(c.config); err2 != nil {
-			logrus.Warnf("Setting back cgroup configs failed due to error: %v, your state.json and actual configs might be inconsistent.", err2)
-		}
-		return err
-	}
-	if c.intelRdtManager != nil {
-		if err := c.intelRdtManager.Set(&config); err != nil {
-			// Set configs back
-			if err2 := c.intelRdtManager.Set(c.config); err2 != nil {
-				logrus.Warnf("Setting back intelrdt configs failed due to error: %v, your state.json and actual configs might be inconsistent.", err2)
-			}
-			return err
-		}
-	}
-	// After config setting succeed, update config and states
-	c.config = &config
-	_, err = c.updateState(nil)
-	return err
-}
-
-func (c *linuxContainer) Start(process *Process) error {
-	c.m.Lock()
-	defer c.m.Unlock()
-	status, err := c.currentStatus()
-	if err != nil {
-		return err
-	}
-	if status == Stopped {
-		if err := c.createExecFifo(); err != nil {
-			return err
-		}
-	}
-	if err := c.start(process, status == Stopped); err != nil {
-		if status == Stopped {
-			c.deleteExecFifo()
-		}
-		return err
-	}
-	return nil
-}
-
-func (c *linuxContainer) Run(process *Process) error {
-	c.m.Lock()
-	status, err := c.currentStatus()
-	if err != nil {
-		c.m.Unlock()
-		return err
-	}
-	c.m.Unlock()
-	if err := c.Start(process); err != nil {
-		return err
-	}
-	if status == Stopped {
-		return c.exec()
-	}
-	return nil
-}
-
-func (c *linuxContainer) Exec() error {
-	c.m.Lock()
-	defer c.m.Unlock()
-	return c.exec()
-}
-
-func (c *linuxContainer) exec() error {
-	path := filepath.Join(c.root, execFifoFilename)
-
-	fifoOpen := make(chan struct{})
-	select {
-	case <-awaitProcessExit(c.initProcess.pid(), fifoOpen):
-		return errors.New("container process is already dead")
-	case result := <-awaitFifoOpen(path):
-		close(fifoOpen)
-		if result.err != nil {
-			return result.err
-		}
-		f := result.file
-		defer f.Close()
-		if err := readFromExecFifo(f); err != nil {
-			return err
-		}
-		return os.Remove(path)
-	}
-}
-
-func readFromExecFifo(execFifo io.Reader) error {
-	data, err := ioutil.ReadAll(execFifo)
-	if err != nil {
-		return err
-	}
-	if len(data) <= 0 {
-		return fmt.Errorf("cannot start an already running container")
-	}
-	return nil
-}
-
-func awaitProcessExit(pid int, exit <-chan struct{}) <-chan struct{} {
-	isDead := make(chan struct{})
-	go func() {
-		for {
-			select {
-			case <-exit:
-				return
-			case <-time.After(time.Millisecond * 100):
-				stat, err := system.Stat(pid)
-				if err != nil || stat.State == system.Zombie {
-					close(isDead)
-					return
-				}
-			}
-		}
-	}()
-	return isDead
-}
-
-func awaitFifoOpen(path string) <-chan openResult {
-	fifoOpened := make(chan openResult)
-	go func() {
-		f, err := os.OpenFile(path, os.O_RDONLY, 0)
-		if err != nil {
-			fifoOpened <- openResult{err: newSystemErrorWithCause(err, "open exec fifo for reading")}
-			return
-		}
-		fifoOpened <- openResult{file: f}
-	}()
-	return fifoOpened
-}
-
-type openResult struct {
-	file *os.File
-	err  error
-}
-
-func (c *linuxContainer) start(process *Process, isInit bool) error {
-	parent, err := c.newParentProcess(process, isInit)
-	if err != nil {
-		return newSystemErrorWithCause(err, "creating new parent process")
-	}
-	if err := parent.start(); err != nil {
-		// terminate the process to ensure that it properly is reaped.
-		if err := ignoreTerminateErrors(parent.terminate()); err != nil {
-			logrus.Warn(err)
-		}
-		return newSystemErrorWithCause(err, "starting container process")
-	}
-	// generate a timestamp indicating when the container was started
-	c.created = time.Now().UTC()
-	if isInit {
-		c.state = &createdState{
-			c: c,
-		}
-		state, err := c.updateState(parent)
-		if err != nil {
-			return err
-		}
-		c.initProcessStartTime = state.InitProcessStartTime
-
-		if c.config.Hooks != nil {
-			bundle, annotations := utils.Annotations(c.config.Labels)
-			s := configs.HookState{
-				Version:     c.config.Version,
-				ID:          c.id,
-				Pid:         parent.pid(),
-				Bundle:      bundle,
-				Annotations: annotations,
-			}
-			for i, hook := range c.config.Hooks.Poststart {
-				if err := hook.Run(s); err != nil {
-					if err := ignoreTerminateErrors(parent.terminate()); err != nil {
-						logrus.Warn(err)
-					}
-					return newSystemErrorWithCausef(err, "running poststart hook %d", i)
-				}
-			}
-		}
-	} else {
-		c.state = &runningState{
-			c: c,
-		}
-	}
-	return nil
-}
-
-func (c *linuxContainer) Signal(s os.Signal, all bool) error {
-	if all {
-		return signalAllProcesses(c.cgroupManager, s)
-	}
-	if err := c.initProcess.signal(s); err != nil {
-		return newSystemErrorWithCause(err, "signaling init process")
-	}
-	return nil
-}
-
-func (c *linuxContainer) createExecFifo() error {
-	rootuid, err := c.Config().HostRootUID()
-	if err != nil {
-		return err
-	}
-	rootgid, err := c.Config().HostRootGID()
-	if err != nil {
-		return err
-	}
-
-	fifoName := filepath.Join(c.root, execFifoFilename)
-	if _, err := os.Stat(fifoName); err == nil {
-		return fmt.Errorf("exec fifo %s already exists", fifoName)
-	}
-	oldMask := unix.Umask(0000)
-	if err := unix.Mkfifo(fifoName, 0622); err != nil {
-		unix.Umask(oldMask)
-		return err
-	}
-	unix.Umask(oldMask)
-	if err := os.Chown(fifoName, rootuid, rootgid); err != nil {
-		return err
-	}
-	return nil
-}
-
-func (c *linuxContainer) deleteExecFifo() {
-	fifoName := filepath.Join(c.root, execFifoFilename)
-	os.Remove(fifoName)
-}
-
-// includeExecFifo opens the container's execfifo as a pathfd, so that the
-// container cannot access the statedir (and the FIFO itself remains
-// un-opened). It then adds the FifoFd to the given exec.Cmd as an inherited
-// fd, with _LIBCONTAINER_FIFOFD set to its fd number.
-func (c *linuxContainer) includeExecFifo(cmd *exec.Cmd) error {
-	fifoName := filepath.Join(c.root, execFifoFilename)
-	fifoFd, err := unix.Open(fifoName, unix.O_PATH|unix.O_CLOEXEC, 0)
-	if err != nil {
-		return err
-	}
-
-	cmd.ExtraFiles = append(cmd.ExtraFiles, os.NewFile(uintptr(fifoFd), fifoName))
-	cmd.Env = append(cmd.Env,
-		fmt.Sprintf("_LIBCONTAINER_FIFOFD=%d", stdioFdCount+len(cmd.ExtraFiles)-1))
-	return nil
-}
-
-func (c *linuxContainer) newParentProcess(p *Process, doInit bool) (parentProcess, error) {
-	parentPipe, childPipe, err := utils.NewSockPair("init")
-	if err != nil {
-		return nil, newSystemErrorWithCause(err, "creating new init pipe")
-	}
-	cmd, err := c.commandTemplate(p, childPipe)
-	if err != nil {
-		return nil, newSystemErrorWithCause(err, "creating new command template")
-	}
-	if !doInit {
-		return c.newSetnsProcess(p, cmd, parentPipe, childPipe)
-	}
-
-	// We only set up fifoFd if we're not doing a `runc exec`. The historic
-	// reason for this is that previously we would pass a dirfd that allowed
-	// for container rootfs escape (and not doing it in `runc exec` avoided
-	// that problem), but we no longer do that. However, there's no need to do
-	// this for `runc exec` so we just keep it this way to be safe.
-	if err := c.includeExecFifo(cmd); err != nil {
-		return nil, newSystemErrorWithCause(err, "including execfifo in cmd.Exec setup")
-	}
-	return c.newInitProcess(p, cmd, parentPipe, childPipe)
-}
-
-func (c *linuxContainer) commandTemplate(p *Process, childPipe *os.File) (*exec.Cmd, error) {
-	cmd := exec.Command(c.initPath, c.initArgs[1:]...)
-	cmd.Args[0] = c.initArgs[0]
-	cmd.Stdin = p.Stdin
-	cmd.Stdout = p.Stdout
-	cmd.Stderr = p.Stderr
-	cmd.Dir = c.config.Rootfs
-	if cmd.SysProcAttr == nil {
-		cmd.SysProcAttr = &syscall.SysProcAttr{}
-	}
-	cmd.ExtraFiles = append(cmd.ExtraFiles, p.ExtraFiles...)
-	if p.ConsoleSocket != nil {
-		cmd.ExtraFiles = append(cmd.ExtraFiles, p.ConsoleSocket)
-		cmd.Env = append(cmd.Env,
-			fmt.Sprintf("_LIBCONTAINER_CONSOLE=%d", stdioFdCount+len(cmd.ExtraFiles)-1),
-		)
-	}
-	cmd.ExtraFiles = append(cmd.ExtraFiles, childPipe)
-	cmd.Env = append(cmd.Env,
-		fmt.Sprintf("_LIBCONTAINER_INITPIPE=%d", stdioFdCount+len(cmd.ExtraFiles)-1),
-	)
-	// NOTE: when running a container with no PID namespace and the parent process spawning the container is
-	// PID1 the pdeathsig is being delivered to the container's init process by the kernel for some reason
-	// even with the parent still running.
-	if c.config.ParentDeathSignal > 0 {
-		cmd.SysProcAttr.Pdeathsig = syscall.Signal(c.config.ParentDeathSignal)
-	}
-	return cmd, nil
-}
-
-func (c *linuxContainer) newInitProcess(p *Process, cmd *exec.Cmd, parentPipe, childPipe *os.File) (*initProcess, error) {
-	cmd.Env = append(cmd.Env, "_LIBCONTAINER_INITTYPE="+string(initStandard))
-	nsMaps := make(map[configs.NamespaceType]string)
-	for _, ns := range c.config.Namespaces {
-		if ns.Path != "" {
-			nsMaps[ns.Type] = ns.Path
-		}
-	}
-	_, sharePidns := nsMaps[configs.NEWPID]
-	data, err := c.bootstrapData(c.config.Namespaces.CloneFlags(), nsMaps)
-	if err != nil {
-		return nil, err
-	}
-	return &initProcess{
-		cmd:             cmd,
-		childPipe:       childPipe,
-		parentPipe:      parentPipe,
-		manager:         c.cgroupManager,
-		intelRdtManager: c.intelRdtManager,
-		config:          c.newInitConfig(p),
-		container:       c,
-		process:         p,
-		bootstrapData:   data,
-		sharePidns:      sharePidns,
-	}, nil
-}
-
-func (c *linuxContainer) newSetnsProcess(p *Process, cmd *exec.Cmd, parentPipe, childPipe *os.File) (*setnsProcess, error) {
-	cmd.Env = append(cmd.Env, "_LIBCONTAINER_INITTYPE="+string(initSetns))
-	state, err := c.currentState()
-	if err != nil {
-		return nil, newSystemErrorWithCause(err, "getting container's current state")
-	}
-	// for setns process, we don't have to set cloneflags as the process namespaces
-	// will only be set via setns syscall
-	data, err := c.bootstrapData(0, state.NamespacePaths)
-	if err != nil {
-		return nil, err
-	}
-	return &setnsProcess{
-		cmd:           cmd,
-		cgroupPaths:   c.cgroupManager.GetPaths(),
-		intelRdtPath:  state.IntelRdtPath,
-		childPipe:     childPipe,
-		parentPipe:    parentPipe,
-		config:        c.newInitConfig(p),
-		process:       p,
-		bootstrapData: data,
-	}, nil
-}
-
-func (c *linuxContainer) newInitConfig(process *Process) *initConfig {
-	cfg := &initConfig{
-		Config:           c.config,
-		Args:             process.Args,
-		Env:              process.Env,
-		User:             process.User,
-		AdditionalGroups: process.AdditionalGroups,
-		Cwd:              process.Cwd,
-		Capabilities:     process.Capabilities,
-		PassedFilesCount: len(process.ExtraFiles),
-		ContainerId:      c.ID(),
-		NoNewPrivileges:  c.config.NoNewPrivileges,
-		Rootless:         c.config.Rootless,
-		AppArmorProfile:  c.config.AppArmorProfile,
-		ProcessLabel:     c.config.ProcessLabel,
-		Rlimits:          c.config.Rlimits,
-	}
-	if process.NoNewPrivileges != nil {
-		cfg.NoNewPrivileges = *process.NoNewPrivileges
-	}
-	if process.AppArmorProfile != "" {
-		cfg.AppArmorProfile = process.AppArmorProfile
-	}
-	if process.Label != "" {
-		cfg.ProcessLabel = process.Label
-	}
-	if len(process.Rlimits) > 0 {
-		cfg.Rlimits = process.Rlimits
-	}
-	cfg.CreateConsole = process.ConsoleSocket != nil
-	cfg.ConsoleWidth = process.ConsoleWidth
-	cfg.ConsoleHeight = process.ConsoleHeight
-	return cfg
-}
-
-func (c *linuxContainer) Destroy() error {
-	c.m.Lock()
-	defer c.m.Unlock()
-	return c.state.destroy()
-}
-
-func (c *linuxContainer) Pause() error {
-	c.m.Lock()
-	defer c.m.Unlock()
-	status, err := c.currentStatus()
-	if err != nil {
-		return err
-	}
-	switch status {
-	case Running, Created:
-		if err := c.cgroupManager.Freeze(configs.Frozen); err != nil {
-			return err
-		}
-		return c.state.transition(&pausedState{
-			c: c,
-		})
-	}
-	return newGenericError(fmt.Errorf("container not running or created: %s", status), ContainerNotRunning)
-}
-
-func (c *linuxContainer) Resume() error {
-	c.m.Lock()
-	defer c.m.Unlock()
-	status, err := c.currentStatus()
-	if err != nil {
-		return err
-	}
-	if status != Paused {
-		return newGenericError(fmt.Errorf("container not paused"), ContainerNotPaused)
-	}
-	if err := c.cgroupManager.Freeze(configs.Thawed); err != nil {
-		return err
-	}
-	return c.state.transition(&runningState{
-		c: c,
-	})
-}
-
-func (c *linuxContainer) NotifyOOM() (<-chan struct{}, error) {
-	// XXX(cyphar): This requires cgroups.
-	if c.config.Rootless {
-		return nil, fmt.Errorf("cannot get OOM notifications from rootless container")
-	}
-	return notifyOnOOM(c.cgroupManager.GetPaths())
-}
-
-func (c *linuxContainer) NotifyMemoryPressure(level PressureLevel) (<-chan struct{}, error) {
-	// XXX(cyphar): This requires cgroups.
-	if c.config.Rootless {
-		return nil, fmt.Errorf("cannot get memory pressure notifications from rootless container")
-	}
-	return notifyMemoryPressure(c.cgroupManager.GetPaths(), level)
-}
-
-var criuFeatures *criurpc.CriuFeatures
-
-func (c *linuxContainer) checkCriuFeatures(criuOpts *CriuOpts, rpcOpts *criurpc.CriuOpts, criuFeat *criurpc.CriuFeatures) error {
-
-	var t criurpc.CriuReqType
-	t = criurpc.CriuReqType_FEATURE_CHECK
-
-	// criu 1.8 => 10800
-	if err := c.checkCriuVersion(10800); err != nil {
-		// Feature checking was introduced with CRIU 1.8.
-		// Ignore the feature check if an older CRIU version is used
-		// and just act as before.
-		// As all automated PR testing is done using CRIU 1.7 this
-		// code will not be tested by automated PR testing.
-		return nil
-	}
-
-	// make sure the features we are looking for are really not from
-	// some previous check
-	criuFeatures = nil
-
-	req := &criurpc.CriuReq{
-		Type: &t,
-		// Theoretically this should not be necessary but CRIU
-		// segfaults if Opts is empty.
-		// Fixed in CRIU  2.12
-		Opts:     rpcOpts,
-		Features: criuFeat,
-	}
-
-	err := c.criuSwrk(nil, req, criuOpts, false)
-	if err != nil {
-		logrus.Debugf("%s", err)
-		return fmt.Errorf("CRIU feature check failed")
-	}
-
-	logrus.Debugf("Feature check says: %s", criuFeatures)
-	missingFeatures := false
-
-	// The outer if checks if the fields actually exist
-	if (criuFeat.MemTrack != nil) &&
-		(criuFeatures.MemTrack != nil) {
-		// The inner if checks if they are set to true
-		if *criuFeat.MemTrack && !*criuFeatures.MemTrack {
-			missingFeatures = true
-			logrus.Debugf("CRIU does not support MemTrack")
-		}
-	}
-
-	// This needs to be repeated for every new feature check.
-	// Is there a way to put this in a function. Reflection?
-	if (criuFeat.LazyPages != nil) &&
-		(criuFeatures.LazyPages != nil) {
-		if *criuFeat.LazyPages && !*criuFeatures.LazyPages {
-			missingFeatures = true
-			logrus.Debugf("CRIU does not support LazyPages")
-		}
-	}
-
-	if missingFeatures {
-		return fmt.Errorf("CRIU is missing features")
-	}
-
-	return nil
-}
-
-func parseCriuVersion(path string) (int, error) {
-	var x, y, z int
-
-	out, err := exec.Command(path, "-V").Output()
-	if err != nil {
-		return 0, fmt.Errorf("Unable to execute CRIU command: %s", path)
-	}
-
-	x = 0
-	y = 0
-	z = 0
-	if ep := strings.Index(string(out), "-"); ep >= 0 {
-		// criu Git version format
-		var version string
-		if sp := strings.Index(string(out), "GitID"); sp > 0 {
-			version = string(out)[sp:ep]
-		} else {
-			return 0, fmt.Errorf("Unable to parse the CRIU version: %s", path)
-		}
-
-		n, err := fmt.Sscanf(version, "GitID: v%d.%d.%d", &x, &y, &z) // 1.5.2
-		if err != nil {
-			n, err = fmt.Sscanf(version, "GitID: v%d.%d", &x, &y) // 1.6
-			y++
-		} else {
-			z++
-		}
-		if n < 2 || err != nil {
-			return 0, fmt.Errorf("Unable to parse the CRIU version: %s %d %s", version, n, err)
-		}
-	} else {
-		// criu release version format
-		n, err := fmt.Sscanf(string(out), "Version: %d.%d.%d\n", &x, &y, &z) // 1.5.2
-		if err != nil {
-			n, err = fmt.Sscanf(string(out), "Version: %d.%d\n", &x, &y) // 1.6
-		}
-		if n < 2 || err != nil {
-			return 0, fmt.Errorf("Unable to parse the CRIU version: %s %d %s", out, n, err)
-		}
-	}
-
-	return x*10000 + y*100 + z, nil
-}
-
-func compareCriuVersion(criuVersion int, minVersion int) error {
-	// simple function to perform the actual version compare
-	if criuVersion < minVersion {
-		return fmt.Errorf("CRIU version %d must be %d or higher", criuVersion, minVersion)
-	}
-
-	return nil
-}
-
-// This is used to store the result of criu version RPC
-var criuVersionRPC *criurpc.CriuVersion
-
-// checkCriuVersion checks Criu version greater than or equal to minVersion
-func (c *linuxContainer) checkCriuVersion(minVersion int) error {
-
-	// If the version of criu has already been determined there is no need
-	// to ask criu for the version again. Use the value from c.criuVersion.
-	if c.criuVersion != 0 {
-		return compareCriuVersion(c.criuVersion, minVersion)
-	}
-
-	// First try if this version of CRIU support the version RPC.
-	// The CRIU version RPC was introduced with CRIU 3.0.
-
-	// First, reset the variable for the RPC answer to nil
-	criuVersionRPC = nil
-
-	var t criurpc.CriuReqType
-	t = criurpc.CriuReqType_VERSION
-	req := &criurpc.CriuReq{
-		Type: &t,
-	}
-
-	err := c.criuSwrk(nil, req, nil, false)
-	if err != nil {
-		return fmt.Errorf("CRIU version check failed: %s", err)
-	}
-
-	if criuVersionRPC != nil {
-		logrus.Debugf("CRIU version: %s", criuVersionRPC)
-		// major and minor are always set
-		c.criuVersion = int(*criuVersionRPC.Major) * 10000
-		c.criuVersion += int(*criuVersionRPC.Minor) * 100
-		if criuVersionRPC.Sublevel != nil {
-			c.criuVersion += int(*criuVersionRPC.Sublevel)
-		}
-		if criuVersionRPC.Gitid != nil {
-			// runc's convention is that a CRIU git release is
-			// always the same as increasing the minor by 1
-			c.criuVersion -= (c.criuVersion % 100)
-			c.criuVersion += 100
-		}
-		return compareCriuVersion(c.criuVersion, minVersion)
-	}
-
-	// This is CRIU without the version RPC and therefore
-	// older than 3.0. Parsing the output is required.
-
-	// This can be remove once runc does not work with criu older than 3.0
-
-	c.criuVersion, err = parseCriuVersion(c.criuPath)
-	if err != nil {
-		return err
-	}
-
-	return compareCriuVersion(c.criuVersion, minVersion)
-}
-
-const descriptorsFilename = "descriptors.json"
-
-func (c *linuxContainer) addCriuDumpMount(req *criurpc.CriuReq, m *configs.Mount) {
-	mountDest := m.Destination
-	if strings.HasPrefix(mountDest, c.config.Rootfs) {
-		mountDest = mountDest[len(c.config.Rootfs):]
-	}
-
-	extMnt := &criurpc.ExtMountMap{
-		Key: proto.String(mountDest),
-		Val: proto.String(mountDest),
-	}
-	req.Opts.ExtMnt = append(req.Opts.ExtMnt, extMnt)
-}
-
-func (c *linuxContainer) addMaskPaths(req *criurpc.CriuReq) error {
-	for _, path := range c.config.MaskPaths {
-		fi, err := os.Stat(fmt.Sprintf("/proc/%d/root/%s", c.initProcess.pid(), path))
-		if err != nil {
-			if os.IsNotExist(err) {
-				continue
-			}
-			return err
-		}
-		if fi.IsDir() {
-			continue
-		}
-
-		extMnt := &criurpc.ExtMountMap{
-			Key: proto.String(path),
-			Val: proto.String("/dev/null"),
-		}
-		req.Opts.ExtMnt = append(req.Opts.ExtMnt, extMnt)
-	}
-	return nil
-}
-
-func waitForCriuLazyServer(r *os.File, status string) error {
-
-	data := make([]byte, 1)
-	_, err := r.Read(data)
-	if err != nil {
-		return err
-	}
-	fd, err := os.OpenFile(status, os.O_TRUNC|os.O_WRONLY, os.ModeAppend)
-	if err != nil {
-		return err
-	}
-	_, err = fd.Write(data)
-	if err != nil {
-		return err
-	}
-	fd.Close()
-
-	return nil
-}
-
-func (c *linuxContainer) Checkpoint(criuOpts *CriuOpts) error {
-	c.m.Lock()
-	defer c.m.Unlock()
-
-	// TODO(avagin): Figure out how to make this work nicely. CRIU 2.0 has
-	//               support for doing unprivileged dumps, but the setup of
-	//               rootless containers might make this complicated.
-	if c.config.Rootless {
-		return fmt.Errorf("cannot checkpoint a rootless container")
-	}
-
-	// criu 1.5.2 => 10502
-	if err := c.checkCriuVersion(10502); err != nil {
-		return err
-	}
-
-	if criuOpts.ImagesDirectory == "" {
-		return fmt.Errorf("invalid directory to save checkpoint")
-	}
-
-	// Since a container can be C/R'ed multiple times,
-	// the checkpoint directory may already exist.
-	if err := os.Mkdir(criuOpts.ImagesDirectory, 0755); err != nil && !os.IsExist(err) {
-		return err
-	}
-
-	if criuOpts.WorkDirectory == "" {
-		criuOpts.WorkDirectory = filepath.Join(c.root, "criu.work")
-	}
-
-	if err := os.Mkdir(criuOpts.WorkDirectory, 0755); err != nil && !os.IsExist(err) {
-		return err
-	}
-
-	workDir, err := os.Open(criuOpts.WorkDirectory)
-	if err != nil {
-		return err
-	}
-	defer workDir.Close()
-
-	imageDir, err := os.Open(criuOpts.ImagesDirectory)
-	if err != nil {
-		return err
-	}
-	defer imageDir.Close()
-
-	rpcOpts := criurpc.CriuOpts{
-		ImagesDirFd:     proto.Int32(int32(imageDir.Fd())),
-		WorkDirFd:       proto.Int32(int32(workDir.Fd())),
-		LogLevel:        proto.Int32(4),
-		LogFile:         proto.String("dump.log"),
-		Root:            proto.String(c.config.Rootfs),
-		ManageCgroups:   proto.Bool(true),
-		NotifyScripts:   proto.Bool(true),
-		Pid:             proto.Int32(int32(c.initProcess.pid())),
-		ShellJob:        proto.Bool(criuOpts.ShellJob),
-		LeaveRunning:    proto.Bool(criuOpts.LeaveRunning),
-		TcpEstablished:  proto.Bool(criuOpts.TcpEstablished),
-		ExtUnixSk:       proto.Bool(criuOpts.ExternalUnixConnections),
-		FileLocks:       proto.Bool(criuOpts.FileLocks),
-		EmptyNs:         proto.Uint32(criuOpts.EmptyNs),
-		OrphanPtsMaster: proto.Bool(true),
-		AutoDedup:       proto.Bool(criuOpts.AutoDedup),
-		LazyPages:       proto.Bool(criuOpts.LazyPages),
-	}
-
-	fcg := c.cgroupManager.GetPaths()["freezer"]
-	if fcg != "" {
-		rpcOpts.FreezeCgroup = proto.String(fcg)
-	}
-
-	// append optional criu opts, e.g., page-server and port
-	if criuOpts.PageServer.Address != "" && criuOpts.PageServer.Port != 0 {
-		rpcOpts.Ps = &criurpc.CriuPageServerInfo{
-			Address: proto.String(criuOpts.PageServer.Address),
-			Port:    proto.Int32(criuOpts.PageServer.Port),
-		}
-	}
-
-	//pre-dump may need parentImage param to complete iterative migration
-	if criuOpts.ParentImage != "" {
-		rpcOpts.ParentImg = proto.String(criuOpts.ParentImage)
-		rpcOpts.TrackMem = proto.Bool(true)
-	}
-
-	// append optional manage cgroups mode
-	if criuOpts.ManageCgroupsMode != 0 {
-		// criu 1.7 => 10700
-		if err := c.checkCriuVersion(10700); err != nil {
-			return err
-		}
-		mode := criurpc.CriuCgMode(criuOpts.ManageCgroupsMode)
-		rpcOpts.ManageCgroupsMode = &mode
-	}
-
-	var t criurpc.CriuReqType
-	if criuOpts.PreDump {
-		feat := criurpc.CriuFeatures{
-			MemTrack: proto.Bool(true),
-		}
-
-		if err := c.checkCriuFeatures(criuOpts, &rpcOpts, &feat); err != nil {
-			return err
-		}
-
-		t = criurpc.CriuReqType_PRE_DUMP
-	} else {
-		t = criurpc.CriuReqType_DUMP
-	}
-	req := &criurpc.CriuReq{
-		Type: &t,
-		Opts: &rpcOpts,
-	}
-
-	if criuOpts.LazyPages {
-		// lazy migration requested; check if criu supports it
-		feat := criurpc.CriuFeatures{
-			LazyPages: proto.Bool(true),
-		}
-
-		if err := c.checkCriuFeatures(criuOpts, &rpcOpts, &feat); err != nil {
-			return err
-		}
-
-		statusRead, statusWrite, err := os.Pipe()
-		if err != nil {
-			return err
-		}
-		rpcOpts.StatusFd = proto.Int32(int32(statusWrite.Fd()))
-		go waitForCriuLazyServer(statusRead, criuOpts.StatusFd)
-	}
-
-	//no need to dump these information in pre-dump
-	if !criuOpts.PreDump {
-		for _, m := range c.config.Mounts {
-			switch m.Device {
-			case "bind":
-				c.addCriuDumpMount(req, m)
-			case "cgroup":
-				binds, err := getCgroupMounts(m)
-				if err != nil {
-					return err
-				}
-				for _, b := range binds {
-					c.addCriuDumpMount(req, b)
-				}
-			}
-		}
-
-		if err := c.addMaskPaths(req); err != nil {
-			return err
-		}
-
-		for _, node := range c.config.Devices {
-			m := &configs.Mount{Destination: node.Path, Source: node.Path}
-			c.addCriuDumpMount(req, m)
-		}
-
-		// Write the FD info to a file in the image directory
-		fdsJSON, err := json.Marshal(c.initProcess.externalDescriptors())
-		if err != nil {
-			return err
-		}
-
-		err = ioutil.WriteFile(filepath.Join(criuOpts.ImagesDirectory, descriptorsFilename), fdsJSON, 0655)
-		if err != nil {
-			return err
-		}
-	}
-
-	err = c.criuSwrk(nil, req, criuOpts, false)
-	if err != nil {
-		return err
-	}
-	return nil
-}
-
-func (c *linuxContainer) addCriuRestoreMount(req *criurpc.CriuReq, m *configs.Mount) {
-	mountDest := m.Destination
-	if strings.HasPrefix(mountDest, c.config.Rootfs) {
-		mountDest = mountDest[len(c.config.Rootfs):]
-	}
-
-	extMnt := &criurpc.ExtMountMap{
-		Key: proto.String(mountDest),
-		Val: proto.String(m.Source),
-	}
-	req.Opts.ExtMnt = append(req.Opts.ExtMnt, extMnt)
-}
-
-func (c *linuxContainer) restoreNetwork(req *criurpc.CriuReq, criuOpts *CriuOpts) {
-	for _, iface := range c.config.Networks {
-		switch iface.Type {
-		case "veth":
-			veth := new(criurpc.CriuVethPair)
-			veth.IfOut = proto.String(iface.HostInterfaceName)
-			veth.IfIn = proto.String(iface.Name)
-			req.Opts.Veths = append(req.Opts.Veths, veth)
-		case "loopback":
-			// Do nothing
-		}
-	}
-	for _, i := range criuOpts.VethPairs {
-		veth := new(criurpc.CriuVethPair)
-		veth.IfOut = proto.String(i.HostInterfaceName)
-		veth.IfIn = proto.String(i.ContainerInterfaceName)
-		req.Opts.Veths = append(req.Opts.Veths, veth)
-	}
-}
-
-func (c *linuxContainer) Restore(process *Process, criuOpts *CriuOpts) error {
-	c.m.Lock()
-	defer c.m.Unlock()
-
-	// TODO(avagin): Figure out how to make this work nicely. CRIU doesn't have
-	//               support for unprivileged restore at the moment.
-	if c.config.Rootless {
-		return fmt.Errorf("cannot restore a rootless container")
-	}
-
-	// criu 1.5.2 => 10502
-	if err := c.checkCriuVersion(10502); err != nil {
-		return err
-	}
-	if criuOpts.WorkDirectory == "" {
-		criuOpts.WorkDirectory = filepath.Join(c.root, "criu.work")
-	}
-	// Since a container can be C/R'ed multiple times,
-	// the work directory may already exist.
-	if err := os.Mkdir(criuOpts.WorkDirectory, 0655); err != nil && !os.IsExist(err) {
-		return err
-	}
-	workDir, err := os.Open(criuOpts.WorkDirectory)
-	if err != nil {
-		return err
-	}
-	defer workDir.Close()
-	if criuOpts.ImagesDirectory == "" {
-		return fmt.Errorf("invalid directory to restore checkpoint")
-	}
-	imageDir, err := os.Open(criuOpts.ImagesDirectory)
-	if err != nil {
-		return err
-	}
-	defer imageDir.Close()
-	// CRIU has a few requirements for a root directory:
-	// * it must be a mount point
-	// * its parent must not be overmounted
-	// c.config.Rootfs is bind-mounted to a temporary directory
-	// to satisfy these requirements.
-	root := filepath.Join(c.root, "criu-root")
-	if err := os.Mkdir(root, 0755); err != nil {
-		return err
-	}
-	defer os.Remove(root)
-	root, err = filepath.EvalSymlinks(root)
-	if err != nil {
-		return err
-	}
-	err = unix.Mount(c.config.Rootfs, root, "", unix.MS_BIND|unix.MS_REC, "")
-	if err != nil {
-		return err
-	}
-	defer unix.Unmount(root, unix.MNT_DETACH)
-	t := criurpc.CriuReqType_RESTORE
-	req := &criurpc.CriuReq{
-		Type: &t,
-		Opts: &criurpc.CriuOpts{
-			ImagesDirFd:     proto.Int32(int32(imageDir.Fd())),
-			WorkDirFd:       proto.Int32(int32(workDir.Fd())),
-			EvasiveDevices:  proto.Bool(true),
-			LogLevel:        proto.Int32(4),
-			LogFile:         proto.String("restore.log"),
-			RstSibling:      proto.Bool(true),
-			Root:            proto.String(root),
-			ManageCgroups:   proto.Bool(true),
-			NotifyScripts:   proto.Bool(true),
-			ShellJob:        proto.Bool(criuOpts.ShellJob),
-			ExtUnixSk:       proto.Bool(criuOpts.ExternalUnixConnections),
-			TcpEstablished:  proto.Bool(criuOpts.TcpEstablished),
-			FileLocks:       proto.Bool(criuOpts.FileLocks),
-			EmptyNs:         proto.Uint32(criuOpts.EmptyNs),
-			OrphanPtsMaster: proto.Bool(true),
-			AutoDedup:       proto.Bool(criuOpts.AutoDedup),
-			LazyPages:       proto.Bool(criuOpts.LazyPages),
-		},
-	}
-
-	for _, m := range c.config.Mounts {
-		switch m.Device {
-		case "bind":
-			c.addCriuRestoreMount(req, m)
-		case "cgroup":
-			binds, err := getCgroupMounts(m)
-			if err != nil {
-				return err
-			}
-			for _, b := range binds {
-				c.addCriuRestoreMount(req, b)
-			}
-		}
-	}
-
-	if len(c.config.MaskPaths) > 0 {
-		m := &configs.Mount{Destination: "/dev/null", Source: "/dev/null"}
-		c.addCriuRestoreMount(req, m)
-	}
-
-	for _, node := range c.config.Devices {
-		m := &configs.Mount{Destination: node.Path, Source: node.Path}
-		c.addCriuRestoreMount(req, m)
-	}
-
-	if criuOpts.EmptyNs&unix.CLONE_NEWNET == 0 {
-		c.restoreNetwork(req, criuOpts)
-	}
-
-	// append optional manage cgroups mode
-	if criuOpts.ManageCgroupsMode != 0 {
-		// criu 1.7 => 10700
-		if err := c.checkCriuVersion(10700); err != nil {
-			return err
-		}
-		mode := criurpc.CriuCgMode(criuOpts.ManageCgroupsMode)
-		req.Opts.ManageCgroupsMode = &mode
-	}
-
-	var (
-		fds    []string
-		fdJSON []byte
-	)
-	if fdJSON, err = ioutil.ReadFile(filepath.Join(criuOpts.ImagesDirectory, descriptorsFilename)); err != nil {
-		return err
-	}
-
-	if err := json.Unmarshal(fdJSON, &fds); err != nil {
-		return err
-	}
-	for i := range fds {
-		if s := fds[i]; strings.Contains(s, "pipe:") {
-			inheritFd := new(criurpc.InheritFd)
-			inheritFd.Key = proto.String(s)
-			inheritFd.Fd = proto.Int32(int32(i))
-			req.Opts.InheritFd = append(req.Opts.InheritFd, inheritFd)
-		}
-	}
-	return c.criuSwrk(process, req, criuOpts, true)
-}
-
-func (c *linuxContainer) criuApplyCgroups(pid int, req *criurpc.CriuReq) error {
-	// XXX: Do we need to deal with this case? AFAIK criu still requires root.
-	if err := c.cgroupManager.Apply(pid); err != nil {
-		return err
-	}
-
-	if err := c.cgroupManager.Set(c.config); err != nil {
-		return newSystemError(err)
-	}
-
-	path := fmt.Sprintf("/proc/%d/cgroup", pid)
-	cgroupsPaths, err := cgroups.ParseCgroupFile(path)
-	if err != nil {
-		return err
-	}
-
-	for c, p := range cgroupsPaths {
-		cgroupRoot := &criurpc.CgroupRoot{
-			Ctrl: proto.String(c),
-			Path: proto.String(p),
-		}
-		req.Opts.CgRoot = append(req.Opts.CgRoot, cgroupRoot)
-	}
-
-	return nil
-}
-
-func (c *linuxContainer) criuSwrk(process *Process, req *criurpc.CriuReq, opts *CriuOpts, applyCgroups bool) error {
-	fds, err := unix.Socketpair(unix.AF_LOCAL, unix.SOCK_SEQPACKET|unix.SOCK_CLOEXEC, 0)
-	if err != nil {
-		return err
-	}
-
-	var logPath string
-	if opts != nil {
-		logPath = filepath.Join(opts.WorkDirectory, req.GetOpts().GetLogFile())
-	} else {
-		// For the VERSION RPC 'opts' is set to 'nil' and therefore
-		// opts.WorkDirectory does not exist. Set logPath to "".
-		logPath = ""
-	}
-	criuClient := os.NewFile(uintptr(fds[0]), "criu-transport-client")
-	criuClientFileCon, err := net.FileConn(criuClient)
-	criuClient.Close()
-	if err != nil {
-		return err
-	}
-
-	criuClientCon := criuClientFileCon.(*net.UnixConn)
-	defer criuClientCon.Close()
-
-	criuServer := os.NewFile(uintptr(fds[1]), "criu-transport-server")
-	defer criuServer.Close()
-
-	args := []string{"swrk", "3"}
-	if c.criuVersion != 0 {
-		// If the CRIU Version is still '0' then this is probably
-		// the initial CRIU run to detect the version. Skip it.
-		logrus.Debugf("Using CRIU %d at: %s", c.criuVersion, c.criuPath)
-	}
-	logrus.Debugf("Using CRIU with following args: %s", args)
-	cmd := exec.Command(c.criuPath, args...)
-	if process != nil {
-		cmd.Stdin = process.Stdin
-		cmd.Stdout = process.Stdout
-		cmd.Stderr = process.Stderr
-	}
-	cmd.ExtraFiles = append(cmd.ExtraFiles, criuServer)
-
-	if err := cmd.Start(); err != nil {
-		return err
-	}
-	criuServer.Close()
-
-	defer func() {
-		criuClientCon.Close()
-		_, err := cmd.Process.Wait()
-		if err != nil {
-			return
-		}
-	}()
-
-	if applyCgroups {
-		err := c.criuApplyCgroups(cmd.Process.Pid, req)
-		if err != nil {
-			return err
-		}
-	}
-
-	var extFds []string
-	if process != nil {
-		extFds, err = getPipeFds(cmd.Process.Pid)
-		if err != nil {
-			return err
-		}
-	}
-
-	logrus.Debugf("Using CRIU in %s mode", req.GetType().String())
-	// In the case of criurpc.CriuReqType_FEATURE_CHECK req.GetOpts()
-	// should be empty. For older CRIU versions it still will be
-	// available but empty. criurpc.CriuReqType_VERSION actually
-	// has no req.GetOpts().
-	if !(req.GetType() == criurpc.CriuReqType_FEATURE_CHECK ||
-		req.GetType() == criurpc.CriuReqType_VERSION) {
-
-		val := reflect.ValueOf(req.GetOpts())
-		v := reflect.Indirect(val)
-		for i := 0; i < v.NumField(); i++ {
-			st := v.Type()
-			name := st.Field(i).Name
-			if strings.HasPrefix(name, "XXX_") {
-				continue
-			}
-			value := val.MethodByName("Get" + name).Call([]reflect.Value{})
-			logrus.Debugf("CRIU option %s with value %v", name, value[0])
-		}
-	}
-	data, err := proto.Marshal(req)
-	if err != nil {
-		return err
-	}
-	_, err = criuClientCon.Write(data)
-	if err != nil {
-		return err
-	}
-
-	buf := make([]byte, 10*4096)
-	oob := make([]byte, 4096)
-	for true {
-		n, oobn, _, _, err := criuClientCon.ReadMsgUnix(buf, oob)
-		if err != nil {
-			return err
-		}
-		if n == 0 {
-			return fmt.Errorf("unexpected EOF")
-		}
-		if n == len(buf) {
-			return fmt.Errorf("buffer is too small")
-		}
-
-		resp := new(criurpc.CriuResp)
-		err = proto.Unmarshal(buf[:n], resp)
-		if err != nil {
-			return err
-		}
-		if !resp.GetSuccess() {
-			typeString := req.GetType().String()
-			if typeString == "VERSION" {
-				// If the VERSION RPC fails this probably means that the CRIU
-				// version is too old for this RPC. Just return 'nil'.
-				return nil
-			}
-			return fmt.Errorf("criu failed: type %s errno %d\nlog file: %s", typeString, resp.GetCrErrno(), logPath)
-		}
-
-		t := resp.GetType()
-		switch {
-		case t == criurpc.CriuReqType_VERSION:
-			logrus.Debugf("CRIU version: %s", resp)
-			criuVersionRPC = resp.GetVersion()
-			break
-		case t == criurpc.CriuReqType_FEATURE_CHECK:
-			logrus.Debugf("Feature check says: %s", resp)
-			criuFeatures = resp.GetFeatures()
-		case t == criurpc.CriuReqType_NOTIFY:
-			if err := c.criuNotifications(resp, process, opts, extFds, oob[:oobn]); err != nil {
-				return err
-			}
-			t = criurpc.CriuReqType_NOTIFY
-			req = &criurpc.CriuReq{
-				Type:          &t,
-				NotifySuccess: proto.Bool(true),
-			}
-			data, err = proto.Marshal(req)
-			if err != nil {
-				return err
-			}
-			_, err = criuClientCon.Write(data)
-			if err != nil {
-				return err
-			}
-			continue
-		case t == criurpc.CriuReqType_RESTORE:
-		case t == criurpc.CriuReqType_DUMP:
-		case t == criurpc.CriuReqType_PRE_DUMP:
-		default:
-			return fmt.Errorf("unable to parse the response %s", resp.String())
-		}
-
-		break
-	}
-
-	criuClientCon.CloseWrite()
-	// cmd.Wait() waits cmd.goroutines which are used for proxying file descriptors.
-	// Here we want to wait only the CRIU process.
-	st, err := cmd.Process.Wait()
-	if err != nil {
-		return err
-	}
-
-	// In pre-dump mode CRIU is in a loop and waits for
-	// the final DUMP command.
-	// The current runc pre-dump approach, however, is
-	// start criu in PRE_DUMP once for a single pre-dump
-	// and not the whole series of pre-dump, pre-dump, ...m, dump
-	// If we got the message CriuReqType_PRE_DUMP it means
-	// CRIU was successful and we need to forcefully stop CRIU
-	if !st.Success() && *req.Type != criurpc.CriuReqType_PRE_DUMP {
-		return fmt.Errorf("criu failed: %s\nlog file: %s", st.String(), logPath)
-	}
-	return nil
-}
-
-// block any external network activity
-func lockNetwork(config *configs.Config) error {
-	for _, config := range config.Networks {
-		strategy, err := getStrategy(config.Type)
-		if err != nil {
-			return err
-		}
-
-		if err := strategy.detach(config); err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-func unlockNetwork(config *configs.Config) error {
-	for _, config := range config.Networks {
-		strategy, err := getStrategy(config.Type)
-		if err != nil {
-			return err
-		}
-		if err = strategy.attach(config); err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-func (c *linuxContainer) criuNotifications(resp *criurpc.CriuResp, process *Process, opts *CriuOpts, fds []string, oob []byte) error {
-	notify := resp.GetNotify()
-	if notify == nil {
-		return fmt.Errorf("invalid response: %s", resp.String())
-	}
-	logrus.Debugf("notify: %s\n", notify.GetScript())
-	switch {
-	case notify.GetScript() == "post-dump":
-		f, err := os.Create(filepath.Join(c.root, "checkpoint"))
-		if err != nil {
-			return err
-		}
-		f.Close()
-	case notify.GetScript() == "network-unlock":
-		if err := unlockNetwork(c.config); err != nil {
-			return err
-		}
-	case notify.GetScript() == "network-lock":
-		if err := lockNetwork(c.config); err != nil {
-			return err
-		}
-	case notify.GetScript() == "setup-namespaces":
-		if c.config.Hooks != nil {
-			bundle, annotations := utils.Annotations(c.config.Labels)
-			s := configs.HookState{
-				Version:     c.config.Version,
-				ID:          c.id,
-				Pid:         int(notify.GetPid()),
-				Bundle:      bundle,
-				Annotations: annotations,
-			}
-			for i, hook := range c.config.Hooks.Prestart {
-				if err := hook.Run(s); err != nil {
-					return newSystemErrorWithCausef(err, "running prestart hook %d", i)
-				}
-			}
-		}
-	case notify.GetScript() == "post-restore":
-		pid := notify.GetPid()
-		r, err := newRestoredProcess(int(pid), fds)
-		if err != nil {
-			return err
-		}
-		process.ops = r
-		if err := c.state.transition(&restoredState{
-			imageDir: opts.ImagesDirectory,
-			c:        c,
-		}); err != nil {
-			return err
-		}
-		// create a timestamp indicating when the restored checkpoint was started
-		c.created = time.Now().UTC()
-		if _, err := c.updateState(r); err != nil {
-			return err
-		}
-		if err := os.Remove(filepath.Join(c.root, "checkpoint")); err != nil {
-			if !os.IsNotExist(err) {
-				logrus.Error(err)
-			}
-		}
-	case notify.GetScript() == "orphan-pts-master":
-		scm, err := unix.ParseSocketControlMessage(oob)
-		if err != nil {
-			return err
-		}
-		fds, err := unix.ParseUnixRights(&scm[0])
-		if err != nil {
-			return err
-		}
-
-		master := os.NewFile(uintptr(fds[0]), "orphan-pts-master")
-		defer master.Close()
-
-		// While we can access console.master, using the API is a good idea.
-		if err := utils.SendFd(process.ConsoleSocket, master.Name(), master.Fd()); err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-func (c *linuxContainer) updateState(process parentProcess) (*State, error) {
-	if process != nil {
-		c.initProcess = process
-	}
-	state, err := c.currentState()
-	if err != nil {
-		return nil, err
-	}
-	err = c.saveState(state)
-	if err != nil {
-		return nil, err
-	}
-	return state, nil
-}
-
-func (c *linuxContainer) saveState(s *State) error {
-	f, err := os.Create(filepath.Join(c.root, stateFilename))
-	if err != nil {
-		return err
-	}
-	defer f.Close()
-	return utils.WriteJSON(f, s)
-}
-
-func (c *linuxContainer) deleteState() error {
-	return os.Remove(filepath.Join(c.root, stateFilename))
-}
-
-func (c *linuxContainer) currentStatus() (Status, error) {
-	if err := c.refreshState(); err != nil {
-		return -1, err
-	}
-	return c.state.status(), nil
-}
-
-// refreshState needs to be called to verify that the current state on the
-// container is what is true.  Because consumers of libcontainer can use it
-// out of process we need to verify the container's status based on runtime
-// information and not rely on our in process info.
-func (c *linuxContainer) refreshState() error {
-	paused, err := c.isPaused()
-	if err != nil {
-		return err
-	}
-	if paused {
-		return c.state.transition(&pausedState{c: c})
-	}
-	t, err := c.runType()
-	if err != nil {
-		return err
-	}
-	switch t {
-	case Created:
-		return c.state.transition(&createdState{c: c})
-	case Running:
-		return c.state.transition(&runningState{c: c})
-	}
-	return c.state.transition(&stoppedState{c: c})
-}
-
-func (c *linuxContainer) runType() (Status, error) {
-	if c.initProcess == nil {
-		return Stopped, nil
-	}
-	pid := c.initProcess.pid()
-	stat, err := system.Stat(pid)
-	if err != nil {
-		return Stopped, nil
-	}
-	if stat.StartTime != c.initProcessStartTime || stat.State == system.Zombie || stat.State == system.Dead {
-		return Stopped, nil
-	}
-	// We'll create exec fifo and blocking on it after container is created,
-	// and delete it after start container.
-	if _, err := os.Stat(filepath.Join(c.root, execFifoFilename)); err == nil {
-		return Created, nil
-	}
-	return Running, nil
-}
-
-func (c *linuxContainer) isPaused() (bool, error) {
-	fcg := c.cgroupManager.GetPaths()["freezer"]
-	if fcg == "" {
-		// A container doesn't have a freezer cgroup
-		return false, nil
-	}
-	data, err := ioutil.ReadFile(filepath.Join(fcg, "freezer.state"))
-	if err != nil {
-		// If freezer cgroup is not mounted, the container would just be not paused.
-		if os.IsNotExist(err) {
-			return false, nil
-		}
-		return false, newSystemErrorWithCause(err, "checking if container is paused")
-	}
-	return bytes.Equal(bytes.TrimSpace(data), []byte("FROZEN")), nil
-}
-
-func (c *linuxContainer) currentState() (*State, error) {
-	var (
-		startTime           uint64
-		externalDescriptors []string
-		pid                 = -1
-	)
-	if c.initProcess != nil {
-		pid = c.initProcess.pid()
-		startTime, _ = c.initProcess.startTime()
-		externalDescriptors = c.initProcess.externalDescriptors()
-	}
-	intelRdtPath, err := intelrdt.GetIntelRdtPath(c.ID())
-	if err != nil {
-		intelRdtPath = ""
-	}
-	state := &State{
-		BaseState: BaseState{
-			ID:                   c.ID(),
-			Config:               *c.config,
-			InitProcessPid:       pid,
-			InitProcessStartTime: startTime,
-			Created:              c.created,
-		},
-		Rootless:            c.config.Rootless,
-		CgroupPaths:         c.cgroupManager.GetPaths(),
-		IntelRdtPath:        intelRdtPath,
-		NamespacePaths:      make(map[configs.NamespaceType]string),
-		ExternalDescriptors: externalDescriptors,
-	}
-	if pid > 0 {
-		for _, ns := range c.config.Namespaces {
-			state.NamespacePaths[ns.Type] = ns.GetPath(pid)
-		}
-		for _, nsType := range configs.NamespaceTypes() {
-			if !configs.IsNamespaceSupported(nsType) {
-				continue
-			}
-			if _, ok := state.NamespacePaths[nsType]; !ok {
-				ns := configs.Namespace{Type: nsType}
-				state.NamespacePaths[ns.Type] = ns.GetPath(pid)
-			}
-		}
-	}
-	return state, nil
-}
-
-// orderNamespacePaths sorts namespace paths into a list of paths that we
-// can setns in order.
-func (c *linuxContainer) orderNamespacePaths(namespaces map[configs.NamespaceType]string) ([]string, error) {
-	paths := []string{}
-
-	for _, ns := range configs.NamespaceTypes() {
-
-		// Remove namespaces that we don't need to join.
-		if !c.config.Namespaces.Contains(ns) {
-			continue
-		}
-
-		if p, ok := namespaces[ns]; ok && p != "" {
-			// check if the requested namespace is supported
-			if !configs.IsNamespaceSupported(ns) {
-				return nil, newSystemError(fmt.Errorf("namespace %s is not supported", ns))
-			}
-			// only set to join this namespace if it exists
-			if _, err := os.Lstat(p); err != nil {
-				return nil, newSystemErrorWithCausef(err, "running lstat on namespace path %q", p)
-			}
-			// do not allow namespace path with comma as we use it to separate
-			// the namespace paths
-			if strings.ContainsRune(p, ',') {
-				return nil, newSystemError(fmt.Errorf("invalid path %s", p))
-			}
-			paths = append(paths, fmt.Sprintf("%s:%s", configs.NsName(ns), p))
-		}
-
-	}
-
-	return paths, nil
-}
-
-func encodeIDMapping(idMap []configs.IDMap) ([]byte, error) {
-	data := bytes.NewBuffer(nil)
-	for _, im := range idMap {
-		line := fmt.Sprintf("%d %d %d\n", im.ContainerID, im.HostID, im.Size)
-		if _, err := data.WriteString(line); err != nil {
-			return nil, err
-		}
-	}
-	return data.Bytes(), nil
-}
-
-// bootstrapData encodes the necessary data in netlink binary format
-// as a io.Reader.
-// Consumer can write the data to a bootstrap program
-// such as one that uses nsenter package to bootstrap the container's
-// init process correctly, i.e. with correct namespaces, uid/gid
-// mapping etc.
-func (c *linuxContainer) bootstrapData(cloneFlags uintptr, nsMaps map[configs.NamespaceType]string) (io.Reader, error) {
-	// create the netlink message
-	r := nl.NewNetlinkRequest(int(InitMsg), 0)
-
-	// write cloneFlags
-	r.AddData(&Int32msg{
-		Type:  CloneFlagsAttr,
-		Value: uint32(cloneFlags),
-	})
-
-	// write custom namespace paths
-	if len(nsMaps) > 0 {
-		nsPaths, err := c.orderNamespacePaths(nsMaps)
-		if err != nil {
-			return nil, err
-		}
-		r.AddData(&Bytemsg{
-			Type:  NsPathsAttr,
-			Value: []byte(strings.Join(nsPaths, ",")),
-		})
-	}
-
-	// write namespace paths only when we are not joining an existing user ns
-	_, joinExistingUser := nsMaps[configs.NEWUSER]
-	if !joinExistingUser {
-		// write uid mappings
-		if len(c.config.UidMappings) > 0 {
-			if c.config.Rootless && c.newuidmapPath != "" {
-				r.AddData(&Bytemsg{
-					Type:  UidmapPathAttr,
-					Value: []byte(c.newuidmapPath),
-				})
-			}
-			b, err := encodeIDMapping(c.config.UidMappings)
-			if err != nil {
-				return nil, err
-			}
-			r.AddData(&Bytemsg{
-				Type:  UidmapAttr,
-				Value: b,
-			})
-		}
-
-		// write gid mappings
-		if len(c.config.GidMappings) > 0 {
-			b, err := encodeIDMapping(c.config.GidMappings)
-			if err != nil {
-				return nil, err
-			}
-			r.AddData(&Bytemsg{
-				Type:  GidmapAttr,
-				Value: b,
-			})
-			if c.config.Rootless && c.newgidmapPath != "" {
-				r.AddData(&Bytemsg{
-					Type:  GidmapPathAttr,
-					Value: []byte(c.newgidmapPath),
-				})
-			}
-			// The following only applies if we are root.
-			if !c.config.Rootless {
-				// check if we have CAP_SETGID to setgroup properly
-				pid, err := capability.NewPid(os.Getpid())
-				if err != nil {
-					return nil, err
-				}
-				if !pid.Get(capability.EFFECTIVE, capability.CAP_SETGID) {
-					r.AddData(&Boolmsg{
-						Type:  SetgroupAttr,
-						Value: true,
-					})
-				}
-			}
-		}
-	}
-
-	// write oom_score_adj
-	r.AddData(&Bytemsg{
-		Type:  OomScoreAdjAttr,
-		Value: []byte(fmt.Sprintf("%d", c.config.OomScoreAdj)),
-	})
-
-	// write rootless
-	r.AddData(&Boolmsg{
-		Type:  RootlessAttr,
-		Value: c.config.Rootless,
-	})
-
-	return bytes.NewReader(r.Serialize()), nil
-}
-
-// ignoreTerminateErrors returns nil if the given err matches an error known
-// to indicate that the terminate occurred successfully or err was nil, otherwise
-// err is returned unaltered.
-func ignoreTerminateErrors(err error) error {
-	if err == nil {
-		return nil
-	}
-	s := err.Error()
-	switch {
-	case strings.Contains(s, "process already finished"), strings.Contains(s, "Wait was already called"):
-		return nil
-	}
-	return err
-}
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/criu_opts_linux.go b/vendor/github.com/opencontainers/runc/libcontainer/criu_opts_linux.go
deleted file mode 100644
index a2e344fc4..000000000
--- a/vendor/github.com/opencontainers/runc/libcontainer/criu_opts_linux.go
+++ /dev/null
@@ -1,40 +0,0 @@
-package libcontainer
-
-// cgroup restoring strategy provided by criu
-type cgMode uint32
-
-const (
-	CRIU_CG_MODE_SOFT    cgMode = 3 + iota // restore cgroup properties if only dir created by criu
-	CRIU_CG_MODE_FULL                      // always restore all cgroups and their properties
-	CRIU_CG_MODE_STRICT                    // restore all, requiring them to not present in the system
-	CRIU_CG_MODE_DEFAULT                   // the same as CRIU_CG_MODE_SOFT
-)
-
-type CriuPageServerInfo struct {
-	Address string // IP address of CRIU page server
-	Port    int32  // port number of CRIU page server
-}
-
-type VethPairName struct {
-	ContainerInterfaceName string
-	HostInterfaceName      string
-}
-
-type CriuOpts struct {
-	ImagesDirectory         string             // directory for storing image files
-	WorkDirectory           string             // directory to cd and write logs/pidfiles/stats to
-	ParentImage             string             // directory for storing parent image files in pre-dump and dump
-	LeaveRunning            bool               // leave container in running state after checkpoint
-	TcpEstablished          bool               // checkpoint/restore established TCP connections
-	ExternalUnixConnections bool               // allow external unix connections
-	ShellJob                bool               // allow to dump and restore shell jobs
-	FileLocks               bool               // handle file locks, for safety
-	PreDump                 bool               // call criu predump to perform iterative checkpoint
-	PageServer              CriuPageServerInfo // allow to dump to criu page server
-	VethPairs               []VethPairName     // pass the veth to criu when restore
-	ManageCgroupsMode       cgMode             // dump or restore cgroup mode
-	EmptyNs                 uint32             // don't c/r properties for namespace from this mask
-	AutoDedup               bool               // auto deduplication for incremental dumps
-	LazyPages               bool               // restore memory pages lazily using userfaultfd
-	StatusFd                string             // fd for feedback when lazy server is ready
-}
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/criurpc/criurpc.pb.go b/vendor/github.com/opencontainers/runc/libcontainer/criurpc/criurpc.pb.go
deleted file mode 100644
index 21af9db97..000000000
--- a/vendor/github.com/opencontainers/runc/libcontainer/criurpc/criurpc.pb.go
+++ /dev/null
@@ -1,1178 +0,0 @@
-// Code generated by protoc-gen-go.
-// source: criurpc.proto
-// DO NOT EDIT!
-
-/*
-Package criurpc is a generated protocol buffer package.
-
-It is generated from these files:
-	criurpc.proto
-
-It has these top-level messages:
-	CriuPageServerInfo
-	CriuVethPair
-	ExtMountMap
-	JoinNamespace
-	InheritFd
-	CgroupRoot
-	UnixSk
-	CriuOpts
-	CriuDumpResp
-	CriuRestoreResp
-	CriuNotify
-	CriuFeatures
-	CriuReq
-	CriuResp
-	CriuVersion
-*/
-package criurpc
-
-import proto "github.com/golang/protobuf/proto"
-import fmt "fmt"
-import math "math"
-
-// Reference imports to suppress errors if they are not otherwise used.
-var _ = proto.Marshal
-var _ = fmt.Errorf
-var _ = math.Inf
-
-// This is a compile-time assertion to ensure that this generated file
-// is compatible with the proto package it is being compiled against.
-// A compilation error at this line likely means your copy of the
-// proto package needs to be updated.
-const _ = proto.ProtoPackageIsVersion2 // please upgrade the proto package
-
-type CriuCgMode int32
-
-const (
-	CriuCgMode_IGNORE  CriuCgMode = 0
-	CriuCgMode_CG_NONE CriuCgMode = 1
-	CriuCgMode_PROPS   CriuCgMode = 2
-	CriuCgMode_SOFT    CriuCgMode = 3
-	CriuCgMode_FULL    CriuCgMode = 4
-	CriuCgMode_STRICT  CriuCgMode = 5
-	CriuCgMode_DEFAULT CriuCgMode = 6
-)
-
-var CriuCgMode_name = map[int32]string{
-	0: "IGNORE",
-	1: "CG_NONE",
-	2: "PROPS",
-	3: "SOFT",
-	4: "FULL",
-	5: "STRICT",
-	6: "DEFAULT",
-}
-var CriuCgMode_value = map[string]int32{
-	"IGNORE":  0,
-	"CG_NONE": 1,
-	"PROPS":   2,
-	"SOFT":    3,
-	"FULL":    4,
-	"STRICT":  5,
-	"DEFAULT": 6,
-}
-
-func (x CriuCgMode) Enum() *CriuCgMode {
-	p := new(CriuCgMode)
-	*p = x
-	return p
-}
-func (x CriuCgMode) String() string {
-	return proto.EnumName(CriuCgMode_name, int32(x))
-}
-func (x *CriuCgMode) UnmarshalJSON(data []byte) error {
-	value, err := proto.UnmarshalJSONEnum(CriuCgMode_value, data, "CriuCgMode")
-	if err != nil {
-		return err
-	}
-	*x = CriuCgMode(value)
-	return nil
-}
-func (CriuCgMode) EnumDescriptor() ([]byte, []int) { return fileDescriptor0, []int{0} }
-
-type CriuReqType int32
-
-const (
-	CriuReqType_EMPTY         CriuReqType = 0
-	CriuReqType_DUMP          CriuReqType = 1
-	CriuReqType_RESTORE       CriuReqType = 2
-	CriuReqType_CHECK         CriuReqType = 3
-	CriuReqType_PRE_DUMP      CriuReqType = 4
-	CriuReqType_PAGE_SERVER   CriuReqType = 5
-	CriuReqType_NOTIFY        CriuReqType = 6
-	CriuReqType_CPUINFO_DUMP  CriuReqType = 7
-	CriuReqType_CPUINFO_CHECK CriuReqType = 8
-	CriuReqType_FEATURE_CHECK CriuReqType = 9
-	CriuReqType_VERSION       CriuReqType = 10
-)
-
-var CriuReqType_name = map[int32]string{
-	0:  "EMPTY",
-	1:  "DUMP",
-	2:  "RESTORE",
-	3:  "CHECK",
-	4:  "PRE_DUMP",
-	5:  "PAGE_SERVER",
-	6:  "NOTIFY",
-	7:  "CPUINFO_DUMP",
-	8:  "CPUINFO_CHECK",
-	9:  "FEATURE_CHECK",
-	10: "VERSION",
-}
-var CriuReqType_value = map[string]int32{
-	"EMPTY":         0,
-	"DUMP":          1,
-	"RESTORE":       2,
-	"CHECK":         3,
-	"PRE_DUMP":      4,
-	"PAGE_SERVER":   5,
-	"NOTIFY":        6,
-	"CPUINFO_DUMP":  7,
-	"CPUINFO_CHECK": 8,
-	"FEATURE_CHECK": 9,
-	"VERSION":       10,
-}
-
-func (x CriuReqType) Enum() *CriuReqType {
-	p := new(CriuReqType)
-	*p = x
-	return p
-}
-func (x CriuReqType) String() string {
-	return proto.EnumName(CriuReqType_name, int32(x))
-}
-func (x *CriuReqType) UnmarshalJSON(data []byte) error {
-	value, err := proto.UnmarshalJSONEnum(CriuReqType_value, data, "CriuReqType")
-	if err != nil {
-		return err
-	}
-	*x = CriuReqType(value)
-	return nil
-}
-func (CriuReqType) EnumDescriptor() ([]byte, []int) { return fileDescriptor0, []int{1} }
-
-type CriuPageServerInfo struct {
-	Address          *string `protobuf:"bytes,1,opt,name=address" json:"address,omitempty"`
-	Port             *int32  `protobuf:"varint,2,opt,name=port" json:"port,omitempty"`
-	Pid              *int32  `protobuf:"varint,3,opt,name=pid" json:"pid,omitempty"`
-	Fd               *int32  `protobuf:"varint,4,opt,name=fd" json:"fd,omitempty"`
-	XXX_unrecognized []byte  `json:"-"`
-}
-
-func (m *CriuPageServerInfo) Reset()                    { *m = CriuPageServerInfo{} }
-func (m *CriuPageServerInfo) String() string            { return proto.CompactTextString(m) }
-func (*CriuPageServerInfo) ProtoMessage()               {}
-func (*CriuPageServerInfo) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{0} }
-
-func (m *CriuPageServerInfo) GetAddress() string {
-	if m != nil && m.Address != nil {
-		return *m.Address
-	}
-	return ""
-}
-
-func (m *CriuPageServerInfo) GetPort() int32 {
-	if m != nil && m.Port != nil {
-		return *m.Port
-	}
-	return 0
-}
-
-func (m *CriuPageServerInfo) GetPid() int32 {
-	if m != nil && m.Pid != nil {
-		return *m.Pid
-	}
-	return 0
-}
-
-func (m *CriuPageServerInfo) GetFd() int32 {
-	if m != nil && m.Fd != nil {
-		return *m.Fd
-	}
-	return 0
-}
-
-type CriuVethPair struct {
-	IfIn             *string `protobuf:"bytes,1,req,name=if_in,json=ifIn" json:"if_in,omitempty"`
-	IfOut            *string `protobuf:"bytes,2,req,name=if_out,json=ifOut" json:"if_out,omitempty"`
-	XXX_unrecognized []byte  `json:"-"`
-}
-
-func (m *CriuVethPair) Reset()                    { *m = CriuVethPair{} }
-func (m *CriuVethPair) String() string            { return proto.CompactTextString(m) }
-func (*CriuVethPair) ProtoMessage()               {}
-func (*CriuVethPair) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{1} }
-
-func (m *CriuVethPair) GetIfIn() string {
-	if m != nil && m.IfIn != nil {
-		return *m.IfIn
-	}
-	return ""
-}
-
-func (m *CriuVethPair) GetIfOut() string {
-	if m != nil && m.IfOut != nil {
-		return *m.IfOut
-	}
-	return ""
-}
-
-type ExtMountMap struct {
-	Key              *string `protobuf:"bytes,1,req,name=key" json:"key,omitempty"`
-	Val              *string `protobuf:"bytes,2,req,name=val" json:"val,omitempty"`
-	XXX_unrecognized []byte  `json:"-"`
-}
-
-func (m *ExtMountMap) Reset()                    { *m = ExtMountMap{} }
-func (m *ExtMountMap) String() string            { return proto.CompactTextString(m) }
-func (*ExtMountMap) ProtoMessage()               {}
-func (*ExtMountMap) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{2} }
-
-func (m *ExtMountMap) GetKey() string {
-	if m != nil && m.Key != nil {
-		return *m.Key
-	}
-	return ""
-}
-
-func (m *ExtMountMap) GetVal() string {
-	if m != nil && m.Val != nil {
-		return *m.Val
-	}
-	return ""
-}
-
-type JoinNamespace struct {
-	Ns               *string `protobuf:"bytes,1,req,name=ns" json:"ns,omitempty"`
-	NsFile           *string `protobuf:"bytes,2,req,name=ns_file,json=nsFile" json:"ns_file,omitempty"`
-	ExtraOpt         *string `protobuf:"bytes,3,opt,name=extra_opt,json=extraOpt" json:"extra_opt,omitempty"`
-	XXX_unrecognized []byte  `json:"-"`
-}
-
-func (m *JoinNamespace) Reset()                    { *m = JoinNamespace{} }
-func (m *JoinNamespace) String() string            { return proto.CompactTextString(m) }
-func (*JoinNamespace) ProtoMessage()               {}
-func (*JoinNamespace) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{3} }
-
-func (m *JoinNamespace) GetNs() string {
-	if m != nil && m.Ns != nil {
-		return *m.Ns
-	}
-	return ""
-}
-
-func (m *JoinNamespace) GetNsFile() string {
-	if m != nil && m.NsFile != nil {
-		return *m.NsFile
-	}
-	return ""
-}
-
-func (m *JoinNamespace) GetExtraOpt() string {
-	if m != nil && m.ExtraOpt != nil {
-		return *m.ExtraOpt
-	}
-	return ""
-}
-
-type InheritFd struct {
-	Key              *string `protobuf:"bytes,1,req,name=key" json:"key,omitempty"`
-	Fd               *int32  `protobuf:"varint,2,req,name=fd" json:"fd,omitempty"`
-	XXX_unrecognized []byte  `json:"-"`
-}
-
-func (m *InheritFd) Reset()                    { *m = InheritFd{} }
-func (m *InheritFd) String() string            { return proto.CompactTextString(m) }
-func (*InheritFd) ProtoMessage()               {}
-func (*InheritFd) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{4} }
-
-func (m *InheritFd) GetKey() string {
-	if m != nil && m.Key != nil {
-		return *m.Key
-	}
-	return ""
-}
-
-func (m *InheritFd) GetFd() int32 {
-	if m != nil && m.Fd != nil {
-		return *m.Fd
-	}
-	return 0
-}
-
-type CgroupRoot struct {
-	Ctrl             *string `protobuf:"bytes,1,opt,name=ctrl" json:"ctrl,omitempty"`
-	Path             *string `protobuf:"bytes,2,req,name=path" json:"path,omitempty"`
-	XXX_unrecognized []byte  `json:"-"`
-}
-
-func (m *CgroupRoot) Reset()                    { *m = CgroupRoot{} }
-func (m *CgroupRoot) String() string            { return proto.CompactTextString(m) }
-func (*CgroupRoot) ProtoMessage()               {}
-func (*CgroupRoot) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{5} }
-
-func (m *CgroupRoot) GetCtrl() string {
-	if m != nil && m.Ctrl != nil {
-		return *m.Ctrl
-	}
-	return ""
-}
-
-func (m *CgroupRoot) GetPath() string {
-	if m != nil && m.Path != nil {
-		return *m.Path
-	}
-	return ""
-}
-
-type UnixSk struct {
-	Inode            *uint32 `protobuf:"varint,1,req,name=inode" json:"inode,omitempty"`
-	XXX_unrecognized []byte  `json:"-"`
-}
-
-func (m *UnixSk) Reset()                    { *m = UnixSk{} }
-func (m *UnixSk) String() string            { return proto.CompactTextString(m) }
-func (*UnixSk) ProtoMessage()               {}
-func (*UnixSk) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{6} }
-
-func (m *UnixSk) GetInode() uint32 {
-	if m != nil && m.Inode != nil {
-		return *m.Inode
-	}
-	return 0
-}
-
-type CriuOpts struct {
-	ImagesDirFd          *int32              `protobuf:"varint,1,req,name=images_dir_fd,json=imagesDirFd" json:"images_dir_fd,omitempty"`
-	Pid                  *int32              `protobuf:"varint,2,opt,name=pid" json:"pid,omitempty"`
-	LeaveRunning         *bool               `protobuf:"varint,3,opt,name=leave_running,json=leaveRunning" json:"leave_running,omitempty"`
-	ExtUnixSk            *bool               `protobuf:"varint,4,opt,name=ext_unix_sk,json=extUnixSk" json:"ext_unix_sk,omitempty"`
-	TcpEstablished       *bool               `protobuf:"varint,5,opt,name=tcp_established,json=tcpEstablished" json:"tcp_established,omitempty"`
-	EvasiveDevices       *bool               `protobuf:"varint,6,opt,name=evasive_devices,json=evasiveDevices" json:"evasive_devices,omitempty"`
-	ShellJob             *bool               `protobuf:"varint,7,opt,name=shell_job,json=shellJob" json:"shell_job,omitempty"`
-	FileLocks            *bool               `protobuf:"varint,8,opt,name=file_locks,json=fileLocks" json:"file_locks,omitempty"`
-	LogLevel             *int32              `protobuf:"varint,9,opt,name=log_level,json=logLevel,def=2" json:"log_level,omitempty"`
-	LogFile              *string             `protobuf:"bytes,10,opt,name=log_file,json=logFile" json:"log_file,omitempty"`
-	Ps                   *CriuPageServerInfo `protobuf:"bytes,11,opt,name=ps" json:"ps,omitempty"`
-	NotifyScripts        *bool               `protobuf:"varint,12,opt,name=notify_scripts,json=notifyScripts" json:"notify_scripts,omitempty"`
-	Root                 *string             `protobuf:"bytes,13,opt,name=root" json:"root,omitempty"`
-	ParentImg            *string             `protobuf:"bytes,14,opt,name=parent_img,json=parentImg" json:"parent_img,omitempty"`
-	TrackMem             *bool               `protobuf:"varint,15,opt,name=track_mem,json=trackMem" json:"track_mem,omitempty"`
-	AutoDedup            *bool               `protobuf:"varint,16,opt,name=auto_dedup,json=autoDedup" json:"auto_dedup,omitempty"`
-	WorkDirFd            *int32              `protobuf:"varint,17,opt,name=work_dir_fd,json=workDirFd" json:"work_dir_fd,omitempty"`
-	LinkRemap            *bool               `protobuf:"varint,18,opt,name=link_remap,json=linkRemap" json:"link_remap,omitempty"`
-	Veths                []*CriuVethPair     `protobuf:"bytes,19,rep,name=veths" json:"veths,omitempty"`
-	CpuCap               *uint32             `protobuf:"varint,20,opt,name=cpu_cap,json=cpuCap,def=4294967295" json:"cpu_cap,omitempty"`
-	ForceIrmap           *bool               `protobuf:"varint,21,opt,name=force_irmap,json=forceIrmap" json:"force_irmap,omitempty"`
-	ExecCmd              []string            `protobuf:"bytes,22,rep,name=exec_cmd,json=execCmd" json:"exec_cmd,omitempty"`
-	ExtMnt               []*ExtMountMap      `protobuf:"bytes,23,rep,name=ext_mnt,json=extMnt" json:"ext_mnt,omitempty"`
-	ManageCgroups        *bool               `protobuf:"varint,24,opt,name=manage_cgroups,json=manageCgroups" json:"manage_cgroups,omitempty"`
-	CgRoot               []*CgroupRoot       `protobuf:"bytes,25,rep,name=cg_root,json=cgRoot" json:"cg_root,omitempty"`
-	RstSibling           *bool               `protobuf:"varint,26,opt,name=rst_sibling,json=rstSibling" json:"rst_sibling,omitempty"`
-	InheritFd            []*InheritFd        `protobuf:"bytes,27,rep,name=inherit_fd,json=inheritFd" json:"inherit_fd,omitempty"`
-	AutoExtMnt           *bool               `protobuf:"varint,28,opt,name=auto_ext_mnt,json=autoExtMnt" json:"auto_ext_mnt,omitempty"`
-	ExtSharing           *bool               `protobuf:"varint,29,opt,name=ext_sharing,json=extSharing" json:"ext_sharing,omitempty"`
-	ExtMasters           *bool               `protobuf:"varint,30,opt,name=ext_masters,json=extMasters" json:"ext_masters,omitempty"`
-	SkipMnt              []string            `protobuf:"bytes,31,rep,name=skip_mnt,json=skipMnt" json:"skip_mnt,omitempty"`
-	EnableFs             []string            `protobuf:"bytes,32,rep,name=enable_fs,json=enableFs" json:"enable_fs,omitempty"`
-	UnixSkIno            []*UnixSk           `protobuf:"bytes,33,rep,name=unix_sk_ino,json=unixSkIno" json:"unix_sk_ino,omitempty"`
-	ManageCgroupsMode    *CriuCgMode         `protobuf:"varint,34,opt,name=manage_cgroups_mode,json=manageCgroupsMode,enum=CriuCgMode" json:"manage_cgroups_mode,omitempty"`
-	GhostLimit           *uint32             `protobuf:"varint,35,opt,name=ghost_limit,json=ghostLimit,def=1048576" json:"ghost_limit,omitempty"`
-	IrmapScanPaths       []string            `protobuf:"bytes,36,rep,name=irmap_scan_paths,json=irmapScanPaths" json:"irmap_scan_paths,omitempty"`
-	External             []string            `protobuf:"bytes,37,rep,name=external" json:"external,omitempty"`
-	EmptyNs              *uint32             `protobuf:"varint,38,opt,name=empty_ns,json=emptyNs" json:"empty_ns,omitempty"`
-	JoinNs               []*JoinNamespace    `protobuf:"bytes,39,rep,name=join_ns,json=joinNs" json:"join_ns,omitempty"`
-	CgroupProps          *string             `protobuf:"bytes,41,opt,name=cgroup_props,json=cgroupProps" json:"cgroup_props,omitempty"`
-	CgroupPropsFile      *string             `protobuf:"bytes,42,opt,name=cgroup_props_file,json=cgroupPropsFile" json:"cgroup_props_file,omitempty"`
-	CgroupDumpController []string            `protobuf:"bytes,43,rep,name=cgroup_dump_controller,json=cgroupDumpController" json:"cgroup_dump_controller,omitempty"`
-	FreezeCgroup         *string             `protobuf:"bytes,44,opt,name=freeze_cgroup,json=freezeCgroup" json:"freeze_cgroup,omitempty"`
-	Timeout              *uint32             `protobuf:"varint,45,opt,name=timeout" json:"timeout,omitempty"`
-	TcpSkipInFlight      *bool               `protobuf:"varint,46,opt,name=tcp_skip_in_flight,json=tcpSkipInFlight" json:"tcp_skip_in_flight,omitempty"`
-	WeakSysctls          *bool               `protobuf:"varint,47,opt,name=weak_sysctls,json=weakSysctls" json:"weak_sysctls,omitempty"`
-	LazyPages            *bool               `protobuf:"varint,48,opt,name=lazy_pages,json=lazyPages" json:"lazy_pages,omitempty"`
-	StatusFd             *int32              `protobuf:"varint,49,opt,name=status_fd,json=statusFd" json:"status_fd,omitempty"`
-	OrphanPtsMaster      *bool               `protobuf:"varint,50,opt,name=orphan_pts_master,json=orphanPtsMaster" json:"orphan_pts_master,omitempty"`
-	XXX_unrecognized     []byte              `json:"-"`
-}
-
-func (m *CriuOpts) Reset()                    { *m = CriuOpts{} }
-func (m *CriuOpts) String() string            { return proto.CompactTextString(m) }
-func (*CriuOpts) ProtoMessage()               {}
-func (*CriuOpts) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{7} }
-
-const Default_CriuOpts_LogLevel int32 = 2
-const Default_CriuOpts_CpuCap uint32 = 4294967295
-const Default_CriuOpts_GhostLimit uint32 = 1048576
-
-func (m *CriuOpts) GetImagesDirFd() int32 {
-	if m != nil && m.ImagesDirFd != nil {
-		return *m.ImagesDirFd
-	}
-	return 0
-}
-
-func (m *CriuOpts) GetPid() int32 {
-	if m != nil && m.Pid != nil {
-		return *m.Pid
-	}
-	return 0
-}
-
-func (m *CriuOpts) GetLeaveRunning() bool {
-	if m != nil && m.LeaveRunning != nil {
-		return *m.LeaveRunning
-	}
-	return false
-}
-
-func (m *CriuOpts) GetExtUnixSk() bool {
-	if m != nil && m.ExtUnixSk != nil {
-		return *m.ExtUnixSk
-	}
-	return false
-}
-
-func (m *CriuOpts) GetTcpEstablished() bool {
-	if m != nil && m.TcpEstablished != nil {
-		return *m.TcpEstablished
-	}
-	return false
-}
-
-func (m *CriuOpts) GetEvasiveDevices() bool {
-	if m != nil && m.EvasiveDevices != nil {
-		return *m.EvasiveDevices
-	}
-	return false
-}
-
-func (m *CriuOpts) GetShellJob() bool {
-	if m != nil && m.ShellJob != nil {
-		return *m.ShellJob
-	}
-	return false
-}
-
-func (m *CriuOpts) GetFileLocks() bool {
-	if m != nil && m.FileLocks != nil {
-		return *m.FileLocks
-	}
-	return false
-}
-
-func (m *CriuOpts) GetLogLevel() int32 {
-	if m != nil && m.LogLevel != nil {
-		return *m.LogLevel
-	}
-	return Default_CriuOpts_LogLevel
-}
-
-func (m *CriuOpts) GetLogFile() string {
-	if m != nil && m.LogFile != nil {
-		return *m.LogFile
-	}
-	return ""
-}
-
-func (m *CriuOpts) GetPs() *CriuPageServerInfo {
-	if m != nil {
-		return m.Ps
-	}
-	return nil
-}
-
-func (m *CriuOpts) GetNotifyScripts() bool {
-	if m != nil && m.NotifyScripts != nil {
-		return *m.NotifyScripts
-	}
-	return false
-}
-
-func (m *CriuOpts) GetRoot() string {
-	if m != nil && m.Root != nil {
-		return *m.Root
-	}
-	return ""
-}
-
-func (m *CriuOpts) GetParentImg() string {
-	if m != nil && m.ParentImg != nil {
-		return *m.ParentImg
-	}
-	return ""
-}
-
-func (m *CriuOpts) GetTrackMem() bool {
-	if m != nil && m.TrackMem != nil {
-		return *m.TrackMem
-	}
-	return false
-}
-
-func (m *CriuOpts) GetAutoDedup() bool {
-	if m != nil && m.AutoDedup != nil {
-		return *m.AutoDedup
-	}
-	return false
-}
-
-func (m *CriuOpts) GetWorkDirFd() int32 {
-	if m != nil && m.WorkDirFd != nil {
-		return *m.WorkDirFd
-	}
-	return 0
-}
-
-func (m *CriuOpts) GetLinkRemap() bool {
-	if m != nil && m.LinkRemap != nil {
-		return *m.LinkRemap
-	}
-	return false
-}
-
-func (m *CriuOpts) GetVeths() []*CriuVethPair {
-	if m != nil {
-		return m.Veths
-	}
-	return nil
-}
-
-func (m *CriuOpts) GetCpuCap() uint32 {
-	if m != nil && m.CpuCap != nil {
-		return *m.CpuCap
-	}
-	return Default_CriuOpts_CpuCap
-}
-
-func (m *CriuOpts) GetForceIrmap() bool {
-	if m != nil && m.ForceIrmap != nil {
-		return *m.ForceIrmap
-	}
-	return false
-}
-
-func (m *CriuOpts) GetExecCmd() []string {
-	if m != nil {
-		return m.ExecCmd
-	}
-	return nil
-}
-
-func (m *CriuOpts) GetExtMnt() []*ExtMountMap {
-	if m != nil {
-		return m.ExtMnt
-	}
-	return nil
-}
-
-func (m *CriuOpts) GetManageCgroups() bool {
-	if m != nil && m.ManageCgroups != nil {
-		return *m.ManageCgroups
-	}
-	return false
-}
-
-func (m *CriuOpts) GetCgRoot() []*CgroupRoot {
-	if m != nil {
-		return m.CgRoot
-	}
-	return nil
-}
-
-func (m *CriuOpts) GetRstSibling() bool {
-	if m != nil && m.RstSibling != nil {
-		return *m.RstSibling
-	}
-	return false
-}
-
-func (m *CriuOpts) GetInheritFd() []*InheritFd {
-	if m != nil {
-		return m.InheritFd
-	}
-	return nil
-}
-
-func (m *CriuOpts) GetAutoExtMnt() bool {
-	if m != nil && m.AutoExtMnt != nil {
-		return *m.AutoExtMnt
-	}
-	return false
-}
-
-func (m *CriuOpts) GetExtSharing() bool {
-	if m != nil && m.ExtSharing != nil {
-		return *m.ExtSharing
-	}
-	return false
-}
-
-func (m *CriuOpts) GetExtMasters() bool {
-	if m != nil && m.ExtMasters != nil {
-		return *m.ExtMasters
-	}
-	return false
-}
-
-func (m *CriuOpts) GetSkipMnt() []string {
-	if m != nil {
-		return m.SkipMnt
-	}
-	return nil
-}
-
-func (m *CriuOpts) GetEnableFs() []string {
-	if m != nil {
-		return m.EnableFs
-	}
-	return nil
-}
-
-func (m *CriuOpts) GetUnixSkIno() []*UnixSk {
-	if m != nil {
-		return m.UnixSkIno
-	}
-	return nil
-}
-
-func (m *CriuOpts) GetManageCgroupsMode() CriuCgMode {
-	if m != nil && m.ManageCgroupsMode != nil {
-		return *m.ManageCgroupsMode
-	}
-	return CriuCgMode_IGNORE
-}
-
-func (m *CriuOpts) GetGhostLimit() uint32 {
-	if m != nil && m.GhostLimit != nil {
-		return *m.GhostLimit
-	}
-	return Default_CriuOpts_GhostLimit
-}
-
-func (m *CriuOpts) GetIrmapScanPaths() []string {
-	if m != nil {
-		return m.IrmapScanPaths
-	}
-	return nil
-}
-
-func (m *CriuOpts) GetExternal() []string {
-	if m != nil {
-		return m.External
-	}
-	return nil
-}
-
-func (m *CriuOpts) GetEmptyNs() uint32 {
-	if m != nil && m.EmptyNs != nil {
-		return *m.EmptyNs
-	}
-	return 0
-}
-
-func (m *CriuOpts) GetJoinNs() []*JoinNamespace {
-	if m != nil {
-		return m.JoinNs
-	}
-	return nil
-}
-
-func (m *CriuOpts) GetCgroupProps() string {
-	if m != nil && m.CgroupProps != nil {
-		return *m.CgroupProps
-	}
-	return ""
-}
-
-func (m *CriuOpts) GetCgroupPropsFile() string {
-	if m != nil && m.CgroupPropsFile != nil {
-		return *m.CgroupPropsFile
-	}
-	return ""
-}
-
-func (m *CriuOpts) GetCgroupDumpController() []string {
-	if m != nil {
-		return m.CgroupDumpController
-	}
-	return nil
-}
-
-func (m *CriuOpts) GetFreezeCgroup() string {
-	if m != nil && m.FreezeCgroup != nil {
-		return *m.FreezeCgroup
-	}
-	return ""
-}
-
-func (m *CriuOpts) GetTimeout() uint32 {
-	if m != nil && m.Timeout != nil {
-		return *m.Timeout
-	}
-	return 0
-}
-
-func (m *CriuOpts) GetTcpSkipInFlight() bool {
-	if m != nil && m.TcpSkipInFlight != nil {
-		return *m.TcpSkipInFlight
-	}
-	return false
-}
-
-func (m *CriuOpts) GetWeakSysctls() bool {
-	if m != nil && m.WeakSysctls != nil {
-		return *m.WeakSysctls
-	}
-	return false
-}
-
-func (m *CriuOpts) GetLazyPages() bool {
-	if m != nil && m.LazyPages != nil {
-		return *m.LazyPages
-	}
-	return false
-}
-
-func (m *CriuOpts) GetStatusFd() int32 {
-	if m != nil && m.StatusFd != nil {
-		return *m.StatusFd
-	}
-	return 0
-}
-
-func (m *CriuOpts) GetOrphanPtsMaster() bool {
-	if m != nil && m.OrphanPtsMaster != nil {
-		return *m.OrphanPtsMaster
-	}
-	return false
-}
-
-type CriuDumpResp struct {
-	Restored         *bool  `protobuf:"varint,1,opt,name=restored" json:"restored,omitempty"`
-	XXX_unrecognized []byte `json:"-"`
-}
-
-func (m *CriuDumpResp) Reset()                    { *m = CriuDumpResp{} }
-func (m *CriuDumpResp) String() string            { return proto.CompactTextString(m) }
-func (*CriuDumpResp) ProtoMessage()               {}
-func (*CriuDumpResp) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{8} }
-
-func (m *CriuDumpResp) GetRestored() bool {
-	if m != nil && m.Restored != nil {
-		return *m.Restored
-	}
-	return false
-}
-
-type CriuRestoreResp struct {
-	Pid              *int32 `protobuf:"varint,1,req,name=pid" json:"pid,omitempty"`
-	XXX_unrecognized []byte `json:"-"`
-}
-
-func (m *CriuRestoreResp) Reset()                    { *m = CriuRestoreResp{} }
-func (m *CriuRestoreResp) String() string            { return proto.CompactTextString(m) }
-func (*CriuRestoreResp) ProtoMessage()               {}
-func (*CriuRestoreResp) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{9} }
-
-func (m *CriuRestoreResp) GetPid() int32 {
-	if m != nil && m.Pid != nil {
-		return *m.Pid
-	}
-	return 0
-}
-
-type CriuNotify struct {
-	Script           *string `protobuf:"bytes,1,opt,name=script" json:"script,omitempty"`
-	Pid              *int32  `protobuf:"varint,2,opt,name=pid" json:"pid,omitempty"`
-	XXX_unrecognized []byte  `json:"-"`
-}
-
-func (m *CriuNotify) Reset()                    { *m = CriuNotify{} }
-func (m *CriuNotify) String() string            { return proto.CompactTextString(m) }
-func (*CriuNotify) ProtoMessage()               {}
-func (*CriuNotify) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{10} }
-
-func (m *CriuNotify) GetScript() string {
-	if m != nil && m.Script != nil {
-		return *m.Script
-	}
-	return ""
-}
-
-func (m *CriuNotify) GetPid() int32 {
-	if m != nil && m.Pid != nil {
-		return *m.Pid
-	}
-	return 0
-}
-
-//
-// List of features which can queried via
-// CRIU_REQ_TYPE__FEATURE_CHECK
-type CriuFeatures struct {
-	MemTrack         *bool  `protobuf:"varint,1,opt,name=mem_track,json=memTrack" json:"mem_track,omitempty"`
-	LazyPages        *bool  `protobuf:"varint,2,opt,name=lazy_pages,json=lazyPages" json:"lazy_pages,omitempty"`
-	XXX_unrecognized []byte `json:"-"`
-}
-
-func (m *CriuFeatures) Reset()                    { *m = CriuFeatures{} }
-func (m *CriuFeatures) String() string            { return proto.CompactTextString(m) }
-func (*CriuFeatures) ProtoMessage()               {}
-func (*CriuFeatures) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{11} }
-
-func (m *CriuFeatures) GetMemTrack() bool {
-	if m != nil && m.MemTrack != nil {
-		return *m.MemTrack
-	}
-	return false
-}
-
-func (m *CriuFeatures) GetLazyPages() bool {
-	if m != nil && m.LazyPages != nil {
-		return *m.LazyPages
-	}
-	return false
-}
-
-type CriuReq struct {
-	Type          *CriuReqType `protobuf:"varint,1,req,name=type,enum=CriuReqType" json:"type,omitempty"`
-	Opts          *CriuOpts    `protobuf:"bytes,2,opt,name=opts" json:"opts,omitempty"`
-	NotifySuccess *bool        `protobuf:"varint,3,opt,name=notify_success,json=notifySuccess" json:"notify_success,omitempty"`
-	//
-	// When set service won't close the connection but
-	// will wait for more req-s to appear. Works not
-	// for all request types.
-	KeepOpen *bool `protobuf:"varint,4,opt,name=keep_open,json=keepOpen" json:"keep_open,omitempty"`
-	//
-	// 'features' can be used to query which features
-	// are supported by the installed criu/kernel
-	// via RPC.
-	Features         *CriuFeatures `protobuf:"bytes,5,opt,name=features" json:"features,omitempty"`
-	XXX_unrecognized []byte        `json:"-"`
-}
-
-func (m *CriuReq) Reset()                    { *m = CriuReq{} }
-func (m *CriuReq) String() string            { return proto.CompactTextString(m) }
-func (*CriuReq) ProtoMessage()               {}
-func (*CriuReq) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{12} }
-
-func (m *CriuReq) GetType() CriuReqType {
-	if m != nil && m.Type != nil {
-		return *m.Type
-	}
-	return CriuReqType_EMPTY
-}
-
-func (m *CriuReq) GetOpts() *CriuOpts {
-	if m != nil {
-		return m.Opts
-	}
-	return nil
-}
-
-func (m *CriuReq) GetNotifySuccess() bool {
-	if m != nil && m.NotifySuccess != nil {
-		return *m.NotifySuccess
-	}
-	return false
-}
-
-func (m *CriuReq) GetKeepOpen() bool {
-	if m != nil && m.KeepOpen != nil {
-		return *m.KeepOpen
-	}
-	return false
-}
-
-func (m *CriuReq) GetFeatures() *CriuFeatures {
-	if m != nil {
-		return m.Features
-	}
-	return nil
-}
-
-type CriuResp struct {
-	Type             *CriuReqType        `protobuf:"varint,1,req,name=type,enum=CriuReqType" json:"type,omitempty"`
-	Success          *bool               `protobuf:"varint,2,req,name=success" json:"success,omitempty"`
-	Dump             *CriuDumpResp       `protobuf:"bytes,3,opt,name=dump" json:"dump,omitempty"`
-	Restore          *CriuRestoreResp    `protobuf:"bytes,4,opt,name=restore" json:"restore,omitempty"`
-	Notify           *CriuNotify         `protobuf:"bytes,5,opt,name=notify" json:"notify,omitempty"`
-	Ps               *CriuPageServerInfo `protobuf:"bytes,6,opt,name=ps" json:"ps,omitempty"`
-	CrErrno          *int32              `protobuf:"varint,7,opt,name=cr_errno,json=crErrno" json:"cr_errno,omitempty"`
-	Features         *CriuFeatures       `protobuf:"bytes,8,opt,name=features" json:"features,omitempty"`
-	CrErrmsg         *string             `protobuf:"bytes,9,opt,name=cr_errmsg,json=crErrmsg" json:"cr_errmsg,omitempty"`
-	Version          *CriuVersion        `protobuf:"bytes,10,opt,name=version" json:"version,omitempty"`
-	XXX_unrecognized []byte              `json:"-"`
-}
-
-func (m *CriuResp) Reset()                    { *m = CriuResp{} }
-func (m *CriuResp) String() string            { return proto.CompactTextString(m) }
-func (*CriuResp) ProtoMessage()               {}
-func (*CriuResp) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{13} }
-
-func (m *CriuResp) GetType() CriuReqType {
-	if m != nil && m.Type != nil {
-		return *m.Type
-	}
-	return CriuReqType_EMPTY
-}
-
-func (m *CriuResp) GetSuccess() bool {
-	if m != nil && m.Success != nil {
-		return *m.Success
-	}
-	return false
-}
-
-func (m *CriuResp) GetDump() *CriuDumpResp {
-	if m != nil {
-		return m.Dump
-	}
-	return nil
-}
-
-func (m *CriuResp) GetRestore() *CriuRestoreResp {
-	if m != nil {
-		return m.Restore
-	}
-	return nil
-}
-
-func (m *CriuResp) GetNotify() *CriuNotify {
-	if m != nil {
-		return m.Notify
-	}
-	return nil
-}
-
-func (m *CriuResp) GetPs() *CriuPageServerInfo {
-	if m != nil {
-		return m.Ps
-	}
-	return nil
-}
-
-func (m *CriuResp) GetCrErrno() int32 {
-	if m != nil && m.CrErrno != nil {
-		return *m.CrErrno
-	}
-	return 0
-}
-
-func (m *CriuResp) GetFeatures() *CriuFeatures {
-	if m != nil {
-		return m.Features
-	}
-	return nil
-}
-
-func (m *CriuResp) GetCrErrmsg() string {
-	if m != nil && m.CrErrmsg != nil {
-		return *m.CrErrmsg
-	}
-	return ""
-}
-
-func (m *CriuResp) GetVersion() *CriuVersion {
-	if m != nil {
-		return m.Version
-	}
-	return nil
-}
-
-// Answer for criu_req_type.VERSION requests
-type CriuVersion struct {
-	Major            *int32  `protobuf:"varint,1,req,name=major" json:"major,omitempty"`
-	Minor            *int32  `protobuf:"varint,2,req,name=minor" json:"minor,omitempty"`
-	Gitid            *string `protobuf:"bytes,3,opt,name=gitid" json:"gitid,omitempty"`
-	Sublevel         *int32  `protobuf:"varint,4,opt,name=sublevel" json:"sublevel,omitempty"`
-	Extra            *int32  `protobuf:"varint,5,opt,name=extra" json:"extra,omitempty"`
-	Name             *string `protobuf:"bytes,6,opt,name=name" json:"name,omitempty"`
-	XXX_unrecognized []byte  `json:"-"`
-}
-
-func (m *CriuVersion) Reset()                    { *m = CriuVersion{} }
-func (m *CriuVersion) String() string            { return proto.CompactTextString(m) }
-func (*CriuVersion) ProtoMessage()               {}
-func (*CriuVersion) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{14} }
-
-func (m *CriuVersion) GetMajor() int32 {
-	if m != nil && m.Major != nil {
-		return *m.Major
-	}
-	return 0
-}
-
-func (m *CriuVersion) GetMinor() int32 {
-	if m != nil && m.Minor != nil {
-		return *m.Minor
-	}
-	return 0
-}
-
-func (m *CriuVersion) GetGitid() string {
-	if m != nil && m.Gitid != nil {
-		return *m.Gitid
-	}
-	return ""
-}
-
-func (m *CriuVersion) GetSublevel() int32 {
-	if m != nil && m.Sublevel != nil {
-		return *m.Sublevel
-	}
-	return 0
-}
-
-func (m *CriuVersion) GetExtra() int32 {
-	if m != nil && m.Extra != nil {
-		return *m.Extra
-	}
-	return 0
-}
-
-func (m *CriuVersion) GetName() string {
-	if m != nil && m.Name != nil {
-		return *m.Name
-	}
-	return ""
-}
-
-func init() {
-	proto.RegisterType((*CriuPageServerInfo)(nil), "criu_page_server_info")
-	proto.RegisterType((*CriuVethPair)(nil), "criu_veth_pair")
-	proto.RegisterType((*ExtMountMap)(nil), "ext_mount_map")
-	proto.RegisterType((*JoinNamespace)(nil), "join_namespace")
-	proto.RegisterType((*InheritFd)(nil), "inherit_fd")
-	proto.RegisterType((*CgroupRoot)(nil), "cgroup_root")
-	proto.RegisterType((*UnixSk)(nil), "unix_sk")
-	proto.RegisterType((*CriuOpts)(nil), "criu_opts")
-	proto.RegisterType((*CriuDumpResp)(nil), "criu_dump_resp")
-	proto.RegisterType((*CriuRestoreResp)(nil), "criu_restore_resp")
-	proto.RegisterType((*CriuNotify)(nil), "criu_notify")
-	proto.RegisterType((*CriuFeatures)(nil), "criu_features")
-	proto.RegisterType((*CriuReq)(nil), "criu_req")
-	proto.RegisterType((*CriuResp)(nil), "criu_resp")
-	proto.RegisterType((*CriuVersion)(nil), "criu_version")
-	proto.RegisterEnum("CriuCgMode", CriuCgMode_name, CriuCgMode_value)
-	proto.RegisterEnum("CriuReqType", CriuReqType_name, CriuReqType_value)
-}
-
-func init() { proto.RegisterFile("criurpc.proto", fileDescriptor0) }
-
-var fileDescriptor0 = []byte{
-	// 1781 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x8c, 0x56, 0xdd, 0x72, 0x5b, 0xb7,
-	0x11, 0x0e, 0x29, 0xfe, 0x1c, 0x82, 0x3f, 0xa6, 0x10, 0xdb, 0x81, 0x93, 0xda, 0x62, 0xe8, 0x28,
-	0x51, 0x15, 0x97, 0x4d, 0x58, 0x3b, 0xae, 0x33, 0xed, 0x85, 0x47, 0x22, 0x5d, 0x36, 0x92, 0xc8,
-	0x01, 0x25, 0xcf, 0xe4, 0x0a, 0x73, 0x74, 0x0e, 0x48, 0xc1, 0x3c, 0x7f, 0x05, 0x40, 0x45, 0xf2,
-	0x83, 0xf4, 0x29, 0xfa, 0x0c, 0x7d, 0x84, 0xbe, 0x4e, 0x6f, 0x3b, 0xbb, 0x00, 0x65, 0x29, 0xc9,
-	0xb4, 0xbd, 0xc3, 0x7e, 0x58, 0x00, 0xbb, 0xfb, 0xed, 0x0f, 0x48, 0x3b, 0xd2, 0x6a, 0xad, 0x8b,
-	0x68, 0x50, 0xe8, 0xdc, 0xe6, 0xfd, 0x25, 0x79, 0x00, 0x80, 0x28, 0xc2, 0xa5, 0x14, 0x46, 0xea,
-	0x4b, 0xa9, 0x85, 0xca, 0x16, 0x39, 0x65, 0xa4, 0x1e, 0xc6, 0xb1, 0x96, 0xc6, 0xb0, 0x52, 0xaf,
-	0xb4, 0xd7, 0xe0, 0x1b, 0x91, 0x52, 0x52, 0x29, 0x72, 0x6d, 0x59, 0xb9, 0x57, 0xda, 0xab, 0x72,
-	0x5c, 0xd3, 0x2e, 0xd9, 0x2a, 0x54, 0xcc, 0xb6, 0x10, 0x82, 0x25, 0xed, 0x90, 0xf2, 0x22, 0x66,
-	0x15, 0x04, 0xca, 0x8b, 0xb8, 0xff, 0x27, 0xd2, 0xc1, 0x87, 0x2e, 0xa5, 0xbd, 0x10, 0x45, 0xa8,
-	0x34, 0xfd, 0x98, 0x54, 0xd5, 0x42, 0xa8, 0x8c, 0x95, 0x7a, 0xe5, 0xbd, 0x06, 0xaf, 0xa8, 0xc5,
-	0x24, 0xa3, 0x0f, 0x48, 0x4d, 0x2d, 0x44, 0xbe, 0x86, 0xeb, 0x01, 0xad, 0xaa, 0xc5, 0x74, 0x6d,
-	0xfb, 0x7f, 0x20, 0x6d, 0x79, 0x65, 0x45, 0x9a, 0xaf, 0x33, 0x2b, 0xd2, 0xb0, 0x80, 0x07, 0x57,
-	0xf2, 0xda, 0x1f, 0x85, 0x25, 0x20, 0x97, 0x61, 0xe2, 0x8f, 0xc1, 0xb2, 0xff, 0x96, 0x74, 0xde,
-	0xe5, 0x2a, 0x13, 0x59, 0x98, 0x4a, 0x53, 0x84, 0x91, 0x04, 0xa3, 0x32, 0xe3, 0x0f, 0x95, 0x33,
-	0x43, 0x3f, 0x21, 0xf5, 0xcc, 0x88, 0x85, 0x4a, 0xa4, 0x3f, 0x57, 0xcb, 0xcc, 0x58, 0x25, 0x92,
-	0x7e, 0x46, 0x1a, 0xf2, 0xca, 0xea, 0x50, 0xe4, 0x85, 0x45, 0xaf, 0x1a, 0x3c, 0x40, 0x60, 0x5a,
-	0xd8, 0xfe, 0x80, 0x10, 0x95, 0x5d, 0x48, 0xad, 0xac, 0x58, 0xc4, 0xbf, 0x62, 0x89, 0x73, 0x1d,
-	0x2e, 0x74, 0xae, 0xbf, 0x20, 0xcd, 0x68, 0xa9, 0xf3, 0x75, 0x21, 0x74, 0x9e, 0x5b, 0x88, 0x5f,
-	0x64, 0x75, 0xe2, 0xc3, 0x8a, 0x6b, 0x8c, 0x69, 0x68, 0x2f, 0xbc, 0x15, 0xb8, 0xee, 0xef, 0x90,
-	0xfa, 0x3a, 0x53, 0x57, 0xc2, 0xac, 0xe8, 0x7d, 0x52, 0x55, 0x59, 0x1e, 0x4b, 0x7c, 0xa5, 0xcd,
-	0x9d, 0xd0, 0xff, 0x57, 0x9b, 0x34, 0x30, 0xa6, 0x79, 0x61, 0x0d, 0xed, 0x93, 0xb6, 0x4a, 0xc3,
-	0xa5, 0x34, 0x22, 0x56, 0x5a, 0x2c, 0x62, 0xd4, 0xad, 0xf2, 0xa6, 0x03, 0x0f, 0x95, 0x1e, 0xc7,
-	0x1b, 0x9a, 0xca, 0x1f, 0x68, 0x7a, 0x4a, 0xda, 0x89, 0x0c, 0x2f, 0xa5, 0xd0, 0xeb, 0x2c, 0x53,
-	0xd9, 0x12, 0x9d, 0x0d, 0x78, 0x0b, 0x41, 0xee, 0x30, 0xfa, 0x84, 0x34, 0x21, 0xfa, 0xde, 0x1a,
-	0x24, 0x35, 0xe0, 0x10, 0xa0, 0xb3, 0x4c, 0x5d, 0xcd, 0x57, 0xf4, 0x2b, 0x72, 0xcf, 0x46, 0x85,
-	0x90, 0xc6, 0x86, 0xe7, 0x89, 0x32, 0x17, 0x32, 0x66, 0x55, 0xd4, 0xe9, 0xd8, 0xa8, 0x18, 0x7d,
-	0x40, 0x41, 0x51, 0x5e, 0x86, 0x46, 0x5d, 0x4a, 0x11, 0xcb, 0x4b, 0x15, 0x49, 0xc3, 0x6a, 0x4e,
-	0xd1, 0xc3, 0x87, 0x0e, 0x85, 0xf8, 0x9b, 0x0b, 0x99, 0x24, 0xe2, 0x5d, 0x7e, 0xce, 0xea, 0xa8,
-	0x12, 0x20, 0xf0, 0xd7, 0xfc, 0x9c, 0x3e, 0x26, 0x04, 0x28, 0x13, 0x49, 0x1e, 0xad, 0x0c, 0x0b,
-	0x9c, 0x35, 0x80, 0x1c, 0x01, 0x40, 0x9f, 0x90, 0x46, 0x92, 0x2f, 0x45, 0x22, 0x2f, 0x65, 0xc2,
-	0x1a, 0xe0, 0xea, 0xf7, 0xa5, 0x21, 0x0f, 0x92, 0x7c, 0x79, 0x04, 0x10, 0x7d, 0x44, 0x60, 0xed,
-	0x58, 0x27, 0x2e, 0xb5, 0x93, 0x7c, 0x89, 0xb4, 0x7f, 0x49, 0xca, 0x85, 0x61, 0xcd, 0x5e, 0x69,
-	0xaf, 0x39, 0x7c, 0x38, 0xf8, 0xd5, 0xc2, 0xe0, 0xe5, 0xc2, 0xd0, 0x5d, 0xd2, 0xc9, 0x72, 0xab,
-	0x16, 0xd7, 0xc2, 0x44, 0x5a, 0x15, 0xd6, 0xb0, 0x16, 0x5a, 0xd1, 0x76, 0xe8, 0xdc, 0x81, 0xc0,
-	0x2a, 0x30, 0xce, 0xda, 0x8e, 0x69, 0x64, 0xff, 0x31, 0x21, 0x45, 0xa8, 0x65, 0x66, 0x85, 0x4a,
-	0x97, 0xac, 0x83, 0x3b, 0x0d, 0x87, 0x4c, 0xd2, 0x25, 0x38, 0x6e, 0x75, 0x18, 0xad, 0x44, 0x2a,
-	0x53, 0x76, 0xcf, 0x39, 0x8e, 0xc0, 0xb1, 0x4c, 0xe1, 0x6c, 0xb8, 0xb6, 0xb9, 0x88, 0x65, 0xbc,
-	0x2e, 0x58, 0xd7, 0x39, 0x0e, 0xc8, 0x21, 0x00, 0x40, 0xd3, 0x4f, 0xb9, 0x5e, 0x6d, 0xf8, 0xdf,
-	0x46, 0x96, 0x1b, 0x00, 0x39, 0xf6, 0x1f, 0x13, 0x92, 0xa8, 0x6c, 0x25, 0xb4, 0x4c, 0xc3, 0x82,
-	0x51, 0x77, 0x1c, 0x10, 0x0e, 0x00, 0xdd, 0x25, 0x55, 0x28, 0x4e, 0xc3, 0x3e, 0xee, 0x6d, 0xed,
-	0x35, 0x87, 0xf7, 0x06, 0x77, 0xeb, 0x95, 0xbb, 0x5d, 0xfa, 0x94, 0xd4, 0xa3, 0x62, 0x2d, 0xa2,
-	0xb0, 0x60, 0xf7, 0x7b, 0xa5, 0xbd, 0xf6, 0xf7, 0xe4, 0xf9, 0xf0, 0xd5, 0xf3, 0x57, 0xdf, 0xbd,
-	0x1c, 0xbe, 0x7a, 0xc1, 0x6b, 0x51, 0xb1, 0x3e, 0x08, 0x0b, 0xba, 0x43, 0x9a, 0x8b, 0x5c, 0x47,
-	0x52, 0x28, 0x0d, 0x6f, 0x3d, 0xc0, 0xb7, 0x08, 0x42, 0x13, 0x40, 0x80, 0x04, 0x79, 0x25, 0x23,
-	0x11, 0xa5, 0x31, 0x7b, 0xd8, 0xdb, 0x02, 0x12, 0x40, 0x3e, 0x48, 0x21, 0x49, 0xea, 0x58, 0xeb,
-	0x99, 0x65, 0x9f, 0xa0, 0x25, 0x9d, 0xc1, 0x9d, 0xda, 0xe7, 0x35, 0x79, 0x65, 0x8f, 0x33, 0x0b,
-	0x2c, 0xa4, 0x61, 0x06, 0xfc, 0xb8, 0xf2, 0x32, 0x8c, 0x39, 0x16, 0x1c, 0x7a, 0xe0, 0x40, 0xba,
-	0x4b, 0xea, 0xd1, 0x12, 0x4b, 0x8f, 0x3d, 0xc2, 0xfb, 0x5a, 0x83, 0x5b, 0xe5, 0xc8, 0x6b, 0xd1,
-	0x92, 0x03, 0x31, 0x3b, 0xa4, 0xa9, 0x8d, 0x15, 0x46, 0x9d, 0x27, 0x50, 0x07, 0x9f, 0x3a, 0x93,
-	0xb5, 0xb1, 0x73, 0x87, 0xd0, 0xfd, 0xdb, 0x65, 0xcf, 0x3e, 0xc3, 0xab, 0x9a, 0x83, 0x0f, 0x10,
-	0x6f, 0xf8, 0xf5, 0x38, 0xa6, 0x3d, 0xd2, 0x42, 0xa6, 0x36, 0x8e, 0xfc, 0xc6, 0xdd, 0x06, 0xd8,
-	0xc8, 0x19, 0xbf, 0xe3, 0x6a, 0xca, 0x5c, 0x84, 0x1a, 0x9e, 0x7b, 0xec, 0x14, 0xe4, 0x95, 0x9d,
-	0x3b, 0x64, 0xa3, 0x90, 0x86, 0xc6, 0x4a, 0x6d, 0xd8, 0x93, 0x1b, 0x85, 0x63, 0x87, 0x40, 0x08,
-	0xcd, 0x4a, 0x15, 0x78, 0xff, 0x8e, 0x0b, 0x21, 0xc8, 0x70, 0x39, 0xb4, 0xaf, 0x2c, 0x3c, 0x4f,
-	0xa4, 0x58, 0x18, 0xd6, 0xc3, 0xbd, 0xc0, 0x01, 0x63, 0x43, 0xf7, 0x48, 0xd3, 0x57, 0xb2, 0x50,
-	0x59, 0xce, 0x3e, 0x47, 0x47, 0x82, 0x81, 0xc7, 0x78, 0x63, 0x8d, 0x45, 0x3d, 0xc9, 0x72, 0xfa,
-	0x67, 0xf2, 0xf1, 0xdd, 0x00, 0x8b, 0x14, 0x9a, 0x50, 0xbf, 0x57, 0xda, 0xeb, 0x0c, 0xdb, 0x2e,
-	0x3f, 0xa2, 0x25, 0x82, 0x7c, 0xfb, 0x4e, 0xd0, 0x8f, 0xf3, 0x58, 0xc2, 0x43, 0xcb, 0x8b, 0xdc,
-	0x58, 0x91, 0xa8, 0x54, 0x59, 0xf6, 0x14, 0xb3, 0xa5, 0xfe, 0xed, 0x37, 0xcf, 0xff, 0xf8, 0xe2,
-	0xe5, 0x77, 0x9c, 0xe0, 0xde, 0x11, 0x6c, 0xd1, 0x3d, 0xd2, 0xc5, 0x44, 0x11, 0x26, 0x0a, 0x33,
-	0x01, 0xdd, 0xcf, 0xb0, 0x2f, 0xd0, 0xec, 0x0e, 0xe2, 0xf3, 0x28, 0xcc, 0x66, 0x80, 0xd2, 0x4f,
-	0x21, 0x6f, 0xac, 0xd4, 0x59, 0x98, 0xb0, 0x5d, 0xef, 0x98, 0x97, 0x31, 0xa7, 0xd2, 0xc2, 0x5e,
-	0x8b, 0xcc, 0xb0, 0x2f, 0xe1, 0x31, 0x5e, 0x47, 0xf9, 0x04, 0x7c, 0xae, 0xbb, 0x51, 0x60, 0xd8,
-	0x57, 0x3e, 0xbb, 0xef, 0x8e, 0x06, 0x5e, 0x03, 0xf9, 0xc4, 0xd0, 0xcf, 0x49, 0xcb, 0x67, 0x47,
-	0xa1, 0xf3, 0xc2, 0xb0, 0xdf, 0x62, 0x85, 0xfa, 0x06, 0x3e, 0x03, 0x88, 0xee, 0x93, 0xed, 0xdb,
-	0x2a, 0xae, 0x93, 0xec, 0xa3, 0xde, 0xbd, 0x5b, 0x7a, 0xd8, 0x51, 0x9e, 0x93, 0x87, 0x5e, 0x37,
-	0x5e, 0xa7, 0x85, 0x88, 0xf2, 0xcc, 0xea, 0x3c, 0x49, 0xa4, 0x66, 0x5f, 0xa3, 0xf5, 0xf7, 0xdd,
-	0xee, 0xe1, 0x3a, 0x2d, 0x0e, 0x6e, 0xf6, 0xa0, 0x2b, 0x2f, 0xb4, 0x94, 0xef, 0x37, 0x81, 0x67,
-	0xcf, 0xf0, 0xf6, 0x96, 0x03, 0x5d, 0x8c, 0x61, 0x42, 0x5b, 0x95, 0x4a, 0x98, 0x95, 0xbf, 0x73,
-	0xde, 0x7a, 0x91, 0x7e, 0x4d, 0x28, 0xf4, 0x63, 0xcc, 0x0e, 0x95, 0x89, 0x45, 0xa2, 0x96, 0x17,
-	0x96, 0x0d, 0x30, 0x83, 0xa0, 0x53, 0xcf, 0x57, 0xaa, 0x98, 0x64, 0x63, 0x84, 0xc1, 0xe1, 0x9f,
-	0x64, 0xb8, 0x12, 0xe6, 0xda, 0x44, 0x36, 0x31, 0xec, 0xf7, 0xa8, 0xd6, 0x04, 0x6c, 0xee, 0x20,
-	0x6c, 0x1c, 0xe1, 0xfb, 0x6b, 0xec, 0x85, 0x86, 0x7d, 0xe3, 0x1b, 0x47, 0xf8, 0xfe, 0x7a, 0x06,
-	0x00, 0x36, 0x6b, 0x1b, 0xda, 0xb5, 0x81, 0xba, 0xf8, 0x16, 0xbb, 0x4e, 0xe0, 0x80, 0x71, 0x0c,
-	0xc1, 0xca, 0x75, 0x71, 0x01, 0xb4, 0x5a, 0xe3, 0xb3, 0x99, 0x0d, 0x9d, 0x29, 0x6e, 0x63, 0x66,
-	0x8d, 0x4b, 0xe9, 0xfe, 0x33, 0xff, 0x47, 0xc0, 0x50, 0x69, 0x69, 0x0a, 0xa0, 0x5b, 0x4b, 0x63,
-	0x73, 0x2d, 0x63, 0x9c, 0x97, 0x01, 0xbf, 0x91, 0xfb, 0xbb, 0x64, 0x1b, 0xb5, 0x3d, 0xe0, 0x0e,
-	0xf8, 0x09, 0xe7, 0x66, 0x1f, 0x2c, 0xfb, 0x2f, 0x49, 0x13, 0xd5, 0x5c, 0x6b, 0xa6, 0x0f, 0x49,
-	0xcd, 0xf5, 0x6c, 0x3f, 0x7f, 0xbd, 0xf4, 0xcb, 0xd1, 0xd8, 0xff, 0xc1, 0xfd, 0x95, 0xc4, 0x42,
-	0x86, 0x76, 0xad, 0x9d, 0x9f, 0xa9, 0x4c, 0x05, 0xb6, 0xe3, 0x8d, 0x35, 0xa9, 0x4c, 0x4f, 0x41,
-	0xfe, 0x59, 0x8c, 0xca, 0x3f, 0x8b, 0x51, 0xff, 0x9f, 0x25, 0x12, 0x78, 0x6b, 0xff, 0x46, 0xfb,
-	0xa4, 0x62, 0xaf, 0x0b, 0x37, 0xcd, 0x3b, 0xc3, 0xce, 0x60, 0xb3, 0x21, 0x00, 0xe5, 0xb8, 0x47,
-	0x9f, 0x90, 0x0a, 0x8c, 0x75, 0xbc, 0xa9, 0x39, 0x24, 0x83, 0x9b, 0x41, 0xcf, 0x11, 0xbf, 0x3d,
-	0x82, 0xd6, 0x51, 0x04, 0xdf, 0xb4, 0xad, 0x3b, 0x23, 0xc8, 0x81, 0x60, 0xf3, 0x4a, 0xca, 0x42,
-	0xe4, 0x85, 0xcc, 0xfc, 0xe0, 0x0e, 0x00, 0x98, 0x16, 0x32, 0xa3, 0xfb, 0x24, 0xd8, 0x38, 0x87,
-	0x03, 0xbb, 0xb9, 0xb1, 0x65, 0x83, 0xf2, 0x9b, 0xfd, 0xfe, 0xbf, 0xcb, 0xfe, 0xb3, 0x81, 0x61,
-	0xfe, 0x7f, 0x3c, 0x60, 0xa4, 0xbe, 0x31, 0x0d, 0xbe, 0x35, 0x01, 0xdf, 0x88, 0xf4, 0x29, 0xa9,
-	0x00, 0xc5, 0x68, 0xf1, 0xcd, 0xa0, 0xb9, 0x21, 0x9d, 0xe3, 0x26, 0x7d, 0x46, 0xea, 0x9e, 0x59,
-	0xb4, 0xbb, 0x39, 0xa4, 0x83, 0x5f, 0xd0, 0xcd, 0x37, 0x2a, 0xf4, 0x0b, 0x52, 0x73, 0x8e, 0x7b,
-	0x47, 0x5a, 0x83, 0x5b, 0xa4, 0x73, 0xbf, 0xe7, 0xe7, 0x7b, 0xed, 0x7f, 0xce, 0xf7, 0x47, 0x40,
-	0x96, 0x90, 0x5a, 0x67, 0x39, 0xfe, 0x3e, 0xaa, 0xbc, 0x1e, 0xe9, 0x11, 0x88, 0x77, 0x62, 0x16,
-	0xfc, 0xf7, 0x98, 0x41, 0xf0, 0xdd, 0x35, 0xa9, 0x59, 0xe2, 0x4f, 0xa4, 0xc1, 0x03, 0xbc, 0x27,
-	0x35, 0x4b, 0x18, 0x73, 0x97, 0x52, 0x1b, 0x95, 0x67, 0xf8, 0x0b, 0x69, 0x6e, 0x1a, 0xaa, 0x07,
-	0xf9, 0x66, 0xb7, 0xff, 0xf7, 0x12, 0x69, 0xdd, 0xde, 0x81, 0xdf, 0x60, 0x1a, 0xbe, 0xcb, 0xb5,
-	0xcf, 0x72, 0x27, 0x20, 0xaa, 0xb2, 0x5c, 0xfb, 0x8f, 0xa7, 0x13, 0x00, 0x5d, 0x2a, 0xeb, 0xbf,
-	0xe6, 0x0d, 0xee, 0x04, 0x28, 0x2b, 0xb3, 0x3e, 0x77, 0x3f, 0xa4, 0x8a, 0x2f, 0x58, 0x2f, 0xc3,
-	0x09, 0xfc, 0xe9, 0x62, 0x20, 0xab, 0xdc, 0x09, 0xf0, 0x95, 0x81, 0x5e, 0x89, 0xb1, 0x6b, 0x70,
-	0x5c, 0xef, 0x0b, 0x6f, 0x97, 0x1f, 0x01, 0x94, 0x90, 0xda, 0xe4, 0xcd, 0xc9, 0x94, 0x8f, 0xba,
-	0x1f, 0xd1, 0x26, 0xa9, 0x1f, 0xbc, 0x11, 0x27, 0xd3, 0x93, 0x51, 0xb7, 0x44, 0x1b, 0xa4, 0x3a,
-	0xe3, 0xd3, 0xd9, 0xbc, 0x5b, 0xa6, 0x01, 0xa9, 0xcc, 0xa7, 0xe3, 0xd3, 0xee, 0x16, 0xac, 0xc6,
-	0x67, 0x47, 0x47, 0xdd, 0x0a, 0x9c, 0x9b, 0x9f, 0xf2, 0xc9, 0xc1, 0x69, 0xb7, 0x0a, 0xe7, 0x0e,
-	0x47, 0xe3, 0xd7, 0x67, 0x47, 0xa7, 0xdd, 0xda, 0xfe, 0x3f, 0x4a, 0xbe, 0x04, 0x37, 0x99, 0x05,
-	0x37, 0x8d, 0x8e, 0x67, 0xa7, 0x3f, 0x76, 0x3f, 0x82, 0xf3, 0x87, 0x67, 0xc7, 0xb3, 0x6e, 0x09,
-	0xce, 0xf0, 0xd1, 0xfc, 0x14, 0x1e, 0x2e, 0x83, 0xc6, 0xc1, 0x5f, 0x46, 0x07, 0x3f, 0x74, 0xb7,
-	0x68, 0x8b, 0x04, 0x33, 0x3e, 0x12, 0xa8, 0x55, 0xa1, 0xf7, 0x48, 0x73, 0xf6, 0xfa, 0xcd, 0x48,
-	0xcc, 0x47, 0xfc, 0xed, 0x88, 0x77, 0xab, 0xf0, 0xec, 0xc9, 0xf4, 0x74, 0x32, 0xfe, 0xb1, 0x5b,
-	0xa3, 0x5d, 0xd2, 0x3a, 0x98, 0x9d, 0x4d, 0x4e, 0xc6, 0x53, 0xa7, 0x5e, 0xa7, 0xdb, 0xa4, 0xbd,
-	0x41, 0xdc, 0x7d, 0x01, 0x40, 0xe3, 0xd1, 0xeb, 0xd3, 0x33, 0x3e, 0xf2, 0x50, 0x03, 0x9e, 0x7e,
-	0x3b, 0xe2, 0xf3, 0xc9, 0xf4, 0xa4, 0x4b, 0xfe, 0x13, 0x00, 0x00, 0xff, 0xff, 0x5f, 0x2a, 0xaf,
-	0x49, 0x5b, 0x0d, 0x00, 0x00,
-}
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/criurpc/criurpc.proto b/vendor/github.com/opencontainers/runc/libcontainer/criurpc/criurpc.proto
deleted file mode 100644
index 48e42e26e..000000000
--- a/vendor/github.com/opencontainers/runc/libcontainer/criurpc/criurpc.proto
+++ /dev/null
@@ -1,209 +0,0 @@
-syntax = "proto2";
-
-message criu_page_server_info {
-	optional string		address	= 1;
-	optional int32		port	= 2;
-	optional int32		pid	= 3;
-	optional int32		fd	= 4;
-}
-
-message criu_veth_pair {
-	required string		if_in	= 1;
-	required string		if_out	= 2;
-};
-
-message ext_mount_map {
-	required string		key	= 1;
-	required string		val	= 2;
-};
-
-message join_namespace {
-	required string		ns		= 1;
-	required string		ns_file		= 2;
-	optional string		extra_opt	= 3;
-}
-
-message inherit_fd {
-	required string		key	= 1;
-	required int32		fd	= 2;
-};
-
-message cgroup_root {
-	optional string		ctrl	= 1;
-	required string		path	= 2;
-};
-
-message unix_sk {
-	required uint32		inode 	= 1;
-};
-
-enum criu_cg_mode {
-	IGNORE	= 0;
-	CG_NONE	= 1;
-	PROPS	= 2;
-	SOFT	= 3;
-	FULL	= 4;
-	STRICT	= 5;
-	DEFAULT = 6;
-};
-
-message criu_opts {
-	required int32			images_dir_fd	= 1;
-	optional int32			pid		= 2; /* if not set on dump, will dump requesting process */
-
-	optional bool			leave_running	= 3;
-	optional bool			ext_unix_sk	= 4;
-	optional bool			tcp_established	= 5;
-	optional bool			evasive_devices	= 6;
-	optional bool			shell_job	= 7;
-	optional bool			file_locks	= 8;
-	optional int32			log_level	= 9 [default = 2];
-	optional string			log_file	= 10; /* No subdirs are allowed. Consider using work-dir */
-
-	optional criu_page_server_info	ps		= 11;
-
-	optional bool			notify_scripts	= 12;
-
-	optional string			root		= 13;
-	optional string			parent_img	= 14;
-	optional bool			track_mem	= 15;
-	optional bool			auto_dedup	= 16;
-
-	optional int32			work_dir_fd	= 17;
-	optional bool			link_remap	= 18;
-	repeated criu_veth_pair		veths		= 19; /* DEPRECATED, use external instead */
-
-	optional uint32			cpu_cap		= 20 [default = 0xffffffff];
-	optional bool			force_irmap	= 21;
-	repeated string			exec_cmd	= 22;
-
-	repeated ext_mount_map		ext_mnt		= 23; /* DEPRECATED, use external instead */
-	optional bool			manage_cgroups	= 24; /* backward compatibility */
-	repeated cgroup_root		cg_root		= 25;
-
-	optional bool			rst_sibling	= 26; /* swrk only */
-	repeated inherit_fd		inherit_fd	= 27; /* swrk only */
-
-	optional bool			auto_ext_mnt	= 28;
-	optional bool			ext_sharing 	= 29;
-	optional bool			ext_masters	= 30;
-
-	repeated string			skip_mnt	= 31;
-	repeated string			enable_fs	= 32;
-
-	repeated unix_sk                unix_sk_ino     = 33; /* DEPRECATED, use external instead */
-
-	optional criu_cg_mode		manage_cgroups_mode = 34;
-	optional uint32			ghost_limit	= 35 [default = 0x100000];
-	repeated string			irmap_scan_paths = 36;
-	repeated string			external	= 37;
-	optional uint32			empty_ns	= 38;
-	repeated join_namespace		join_ns		= 39;
-
-	optional string			cgroup_props		= 41;
-	optional string			cgroup_props_file	= 42;
-	repeated string			cgroup_dump_controller	= 43;
-
-	optional string			freeze_cgroup		= 44;
-	optional uint32			timeout			= 45;
-	optional bool			tcp_skip_in_flight	= 46;
-	optional bool			weak_sysctls		= 47;
-	optional bool			lazy_pages		= 48;
-	optional int32			status_fd		= 49;
-	optional bool			orphan_pts_master	= 50;
-}
-
-message criu_dump_resp {
-	optional bool restored		= 1;
-}
-
-message criu_restore_resp {
-	required int32 pid		= 1;
-}
-
-message criu_notify {
-	optional string script		= 1;
-	optional int32	pid		= 2;
-}
-
-enum criu_req_type {
-	EMPTY		= 0;
-	DUMP		= 1;
-	RESTORE		= 2;
-	CHECK		= 3;
-	PRE_DUMP	= 4;
-	PAGE_SERVER	= 5;
-
-	NOTIFY		= 6;
-
-	CPUINFO_DUMP	= 7;
-	CPUINFO_CHECK	= 8;
-
-	FEATURE_CHECK	= 9;
-
-	VERSION		= 10;
-}
-
-/*
- * List of features which can queried via
- * CRIU_REQ_TYPE__FEATURE_CHECK
- */
-message criu_features {
-	optional bool			mem_track	= 1;
-	optional bool			lazy_pages	= 2;
-}
-
-/*
- * Request -- each type corresponds to must-be-there
- * request arguments of respective type
- */
-
-message criu_req {
-	required criu_req_type		type		= 1;
-
-	optional criu_opts		opts		= 2;
-	optional bool			notify_success	= 3;
-
-	/*
-	 * When set service won't close the connection but
-	 * will wait for more req-s to appear. Works not
-	 * for all request types.
-	 */
-	optional bool			keep_open	= 4;
-	/*
-	 * 'features' can be used to query which features
-	 * are supported by the installed criu/kernel
-	 * via RPC.
-	 */
-	optional criu_features		features	= 5;
-}
-
-/*
- * Response -- it states whether the request was served
- * and additional request-specific information
- */
-
-message criu_resp {
-	required criu_req_type		type		= 1;
-	required bool			success		= 2;
-
-	optional criu_dump_resp		dump		= 3;
-	optional criu_restore_resp	restore		= 4;
-	optional criu_notify		notify		= 5;
-	optional criu_page_server_info	ps		= 6;
-
-	optional int32			cr_errno	= 7;
-	optional criu_features		features	= 8;
-	optional string			cr_errmsg	= 9;
-	optional criu_version		version		= 10;
-}
-
-/* Answer for criu_req_type.VERSION requests */
-message criu_version {
-	required int32			major		= 1;
-	required int32			minor		= 2;
-	optional string			gitid		= 3;
-	optional int32			sublevel	= 4;
-	optional int32			extra		= 5;
-	optional string			name		= 6;
-}
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/error.go b/vendor/github.com/opencontainers/runc/libcontainer/error.go
deleted file mode 100644
index 21a3789ba..000000000
--- a/vendor/github.com/opencontainers/runc/libcontainer/error.go
+++ /dev/null
@@ -1,70 +0,0 @@
-package libcontainer
-
-import "io"
-
-// ErrorCode is the API error code type.
-type ErrorCode int
-
-// API error codes.
-const (
-	// Factory errors
-	IdInUse ErrorCode = iota
-	InvalidIdFormat
-
-	// Container errors
-	ContainerNotExists
-	ContainerPaused
-	ContainerNotStopped
-	ContainerNotRunning
-	ContainerNotPaused
-
-	// Process errors
-	NoProcessOps
-
-	// Common errors
-	ConfigInvalid
-	ConsoleExists
-	SystemError
-)
-
-func (c ErrorCode) String() string {
-	switch c {
-	case IdInUse:
-		return "Id already in use"
-	case InvalidIdFormat:
-		return "Invalid format"
-	case ContainerPaused:
-		return "Container paused"
-	case ConfigInvalid:
-		return "Invalid configuration"
-	case SystemError:
-		return "System error"
-	case ContainerNotExists:
-		return "Container does not exist"
-	case ContainerNotStopped:
-		return "Container is not stopped"
-	case ContainerNotRunning:
-		return "Container is not running"
-	case ConsoleExists:
-		return "Console exists for process"
-	case ContainerNotPaused:
-		return "Container is not paused"
-	case NoProcessOps:
-		return "No process operations"
-	default:
-		return "Unknown error"
-	}
-}
-
-// Error is the API error type.
-type Error interface {
-	error
-
-	// Returns an error if it failed to write the detail of the Error to w.
-	// The detail of the Error may include the error message and a
-	// representation of the stack trace.
-	Detail(w io.Writer) error
-
-	// Returns the error code for this error.
-	Code() ErrorCode
-}
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/factory.go b/vendor/github.com/opencontainers/runc/libcontainer/factory.go
deleted file mode 100644
index 0986cd77e..000000000
--- a/vendor/github.com/opencontainers/runc/libcontainer/factory.go
+++ /dev/null
@@ -1,44 +0,0 @@
-package libcontainer
-
-import (
-	"github.com/opencontainers/runc/libcontainer/configs"
-)
-
-type Factory interface {
-	// Creates a new container with the given id and starts the initial process inside it.
-	// id must be a string containing only letters, digits and underscores and must contain
-	// between 1 and 1024 characters, inclusive.
-	//
-	// The id must not already be in use by an existing container. Containers created using
-	// a factory with the same path (and filesystem) must have distinct ids.
-	//
-	// Returns the new container with a running process.
-	//
-	// errors:
-	// IdInUse - id is already in use by a container
-	// InvalidIdFormat - id has incorrect format
-	// ConfigInvalid - config is invalid
-	// Systemerror - System error
-	//
-	// On error, any partially created container parts are cleaned up (the operation is atomic).
-	Create(id string, config *configs.Config) (Container, error)
-
-	// Load takes an ID for an existing container and returns the container information
-	// from the state.  This presents a read only view of the container.
-	//
-	// errors:
-	// Path does not exist
-	// System error
-	Load(id string) (Container, error)
-
-	// StartInitialization is an internal API to libcontainer used during the reexec of the
-	// container.
-	//
-	// Errors:
-	// Pipe connection error
-	// System error
-	StartInitialization() error
-
-	// Type returns info string about factory type (e.g. lxc, libcontainer...)
-	Type() string
-}
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/factory_linux.go b/vendor/github.com/opencontainers/runc/libcontainer/factory_linux.go
deleted file mode 100644
index 7d53d5e04..000000000
--- a/vendor/github.com/opencontainers/runc/libcontainer/factory_linux.go
+++ /dev/null
@@ -1,364 +0,0 @@
-// +build linux
-
-package libcontainer
-
-import (
-	"encoding/json"
-	"fmt"
-	"os"
-	"path/filepath"
-	"regexp"
-	"runtime/debug"
-	"strconv"
-
-	"github.com/opencontainers/runc/libcontainer/cgroups"
-	"github.com/opencontainers/runc/libcontainer/cgroups/fs"
-	"github.com/opencontainers/runc/libcontainer/cgroups/systemd"
-	"github.com/opencontainers/runc/libcontainer/configs"
-	"github.com/opencontainers/runc/libcontainer/configs/validate"
-	"github.com/opencontainers/runc/libcontainer/intelrdt"
-	"github.com/opencontainers/runc/libcontainer/mount"
-	"github.com/opencontainers/runc/libcontainer/utils"
-
-	"golang.org/x/sys/unix"
-)
-
-const (
-	stateFilename    = "state.json"
-	execFifoFilename = "exec.fifo"
-)
-
-var idRegex = regexp.MustCompile(`^[\w+-\.]+$`)
-
-// InitArgs returns an options func to configure a LinuxFactory with the
-// provided init binary path and arguments.
-func InitArgs(args ...string) func(*LinuxFactory) error {
-	return func(l *LinuxFactory) (err error) {
-		if len(args) > 0 {
-			// Resolve relative paths to ensure that its available
-			// after directory changes.
-			if args[0], err = filepath.Abs(args[0]); err != nil {
-				return newGenericError(err, ConfigInvalid)
-			}
-		}
-
-		l.InitArgs = args
-		return nil
-	}
-}
-
-// SystemdCgroups is an options func to configure a LinuxFactory to return
-// containers that use systemd to create and manage cgroups.
-func SystemdCgroups(l *LinuxFactory) error {
-	l.NewCgroupsManager = func(config *configs.Cgroup, paths map[string]string) cgroups.Manager {
-		return &systemd.Manager{
-			Cgroups: config,
-			Paths:   paths,
-		}
-	}
-	return nil
-}
-
-// Cgroupfs is an options func to configure a LinuxFactory to return
-// containers that use the native cgroups filesystem implementation to
-// create and manage cgroups.
-func Cgroupfs(l *LinuxFactory) error {
-	l.NewCgroupsManager = func(config *configs.Cgroup, paths map[string]string) cgroups.Manager {
-		return &fs.Manager{
-			Cgroups: config,
-			Paths:   paths,
-		}
-	}
-	return nil
-}
-
-// IntelRdtfs is an options func to configure a LinuxFactory to return
-// containers that use the Intel RDT "resource control" filesystem to
-// create and manage Intel Xeon platform shared resources (e.g., L3 cache).
-func IntelRdtFs(l *LinuxFactory) error {
-	l.NewIntelRdtManager = func(config *configs.Config, id string, path string) intelrdt.Manager {
-		return &intelrdt.IntelRdtManager{
-			Config: config,
-			Id:     id,
-			Path:   path,
-		}
-	}
-	return nil
-}
-
-// TmpfsRoot is an option func to mount LinuxFactory.Root to tmpfs.
-func TmpfsRoot(l *LinuxFactory) error {
-	mounted, err := mount.Mounted(l.Root)
-	if err != nil {
-		return err
-	}
-	if !mounted {
-		if err := unix.Mount("tmpfs", l.Root, "tmpfs", 0, ""); err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-// CriuPath returns an option func to configure a LinuxFactory with the
-// provided criupath
-func CriuPath(criupath string) func(*LinuxFactory) error {
-	return func(l *LinuxFactory) error {
-		l.CriuPath = criupath
-		return nil
-	}
-}
-
-// New returns a linux based container factory based in the root directory and
-// configures the factory with the provided option funcs.
-func New(root string, options ...func(*LinuxFactory) error) (Factory, error) {
-	if root != "" {
-		if err := os.MkdirAll(root, 0700); err != nil {
-			return nil, newGenericError(err, SystemError)
-		}
-	}
-	l := &LinuxFactory{
-		Root:      root,
-		InitPath:  "/proc/self/exe",
-		InitArgs:  []string{os.Args[0], "init"},
-		Validator: validate.New(),
-		CriuPath:  "criu",
-	}
-	Cgroupfs(l)
-	for _, opt := range options {
-		if opt == nil {
-			continue
-		}
-		if err := opt(l); err != nil {
-			return nil, err
-		}
-	}
-	return l, nil
-}
-
-// LinuxFactory implements the default factory interface for linux based systems.
-type LinuxFactory struct {
-	// Root directory for the factory to store state.
-	Root string
-
-	// InitPath is the path for calling the init responsibilities for spawning
-	// a container.
-	InitPath string
-
-	// InitArgs are arguments for calling the init responsibilities for spawning
-	// a container.
-	InitArgs []string
-
-	// CriuPath is the path to the criu binary used for checkpoint and restore of
-	// containers.
-	CriuPath string
-
-	// New{u,g}uidmapPath is the path to the binaries used for mapping with
-	// rootless containers.
-	NewuidmapPath string
-	NewgidmapPath string
-
-	// Validator provides validation to container configurations.
-	Validator validate.Validator
-
-	// NewCgroupsManager returns an initialized cgroups manager for a single container.
-	NewCgroupsManager func(config *configs.Cgroup, paths map[string]string) cgroups.Manager
-
-	// NewIntelRdtManager returns an initialized Intel RDT manager for a single container.
-	NewIntelRdtManager func(config *configs.Config, id string, path string) intelrdt.Manager
-}
-
-func (l *LinuxFactory) Create(id string, config *configs.Config) (Container, error) {
-	if l.Root == "" {
-		return nil, newGenericError(fmt.Errorf("invalid root"), ConfigInvalid)
-	}
-	if err := l.validateID(id); err != nil {
-		return nil, err
-	}
-	if err := l.Validator.Validate(config); err != nil {
-		return nil, newGenericError(err, ConfigInvalid)
-	}
-	containerRoot := filepath.Join(l.Root, id)
-	if _, err := os.Stat(containerRoot); err == nil {
-		return nil, newGenericError(fmt.Errorf("container with id exists: %v", id), IdInUse)
-	} else if !os.IsNotExist(err) {
-		return nil, newGenericError(err, SystemError)
-	}
-	if err := os.MkdirAll(containerRoot, 0711); err != nil {
-		return nil, newGenericError(err, SystemError)
-	}
-	if err := os.Chown(containerRoot, unix.Geteuid(), unix.Getegid()); err != nil {
-		return nil, newGenericError(err, SystemError)
-	}
-	c := &linuxContainer{
-		id:            id,
-		root:          containerRoot,
-		config:        config,
-		initPath:      l.InitPath,
-		initArgs:      l.InitArgs,
-		criuPath:      l.CriuPath,
-		newuidmapPath: l.NewuidmapPath,
-		newgidmapPath: l.NewgidmapPath,
-		cgroupManager: l.NewCgroupsManager(config.Cgroups, nil),
-	}
-	if intelrdt.IsEnabled() {
-		c.intelRdtManager = l.NewIntelRdtManager(config, id, "")
-	}
-	c.state = &stoppedState{c: c}
-	return c, nil
-}
-
-func (l *LinuxFactory) Load(id string) (Container, error) {
-	if l.Root == "" {
-		return nil, newGenericError(fmt.Errorf("invalid root"), ConfigInvalid)
-	}
-	containerRoot := filepath.Join(l.Root, id)
-	state, err := l.loadState(containerRoot, id)
-	if err != nil {
-		return nil, err
-	}
-	r := &nonChildProcess{
-		processPid:       state.InitProcessPid,
-		processStartTime: state.InitProcessStartTime,
-		fds:              state.ExternalDescriptors,
-	}
-	c := &linuxContainer{
-		initProcess:          r,
-		initProcessStartTime: state.InitProcessStartTime,
-		id:                   id,
-		config:               &state.Config,
-		initPath:             l.InitPath,
-		initArgs:             l.InitArgs,
-		criuPath:             l.CriuPath,
-		newuidmapPath:        l.NewuidmapPath,
-		newgidmapPath:        l.NewgidmapPath,
-		cgroupManager:        l.NewCgroupsManager(state.Config.Cgroups, state.CgroupPaths),
-		root:                 containerRoot,
-		created:              state.Created,
-	}
-	c.state = &loadedState{c: c}
-	if err := c.refreshState(); err != nil {
-		return nil, err
-	}
-	if intelrdt.IsEnabled() {
-		c.intelRdtManager = l.NewIntelRdtManager(&state.Config, id, state.IntelRdtPath)
-	}
-	return c, nil
-}
-
-func (l *LinuxFactory) Type() string {
-	return "libcontainer"
-}
-
-// StartInitialization loads a container by opening the pipe fd from the parent to read the configuration and state
-// This is a low level implementation detail of the reexec and should not be consumed externally
-func (l *LinuxFactory) StartInitialization() (err error) {
-	var (
-		pipefd, fifofd int
-		consoleSocket  *os.File
-		envInitPipe    = os.Getenv("_LIBCONTAINER_INITPIPE")
-		envFifoFd      = os.Getenv("_LIBCONTAINER_FIFOFD")
-		envConsole     = os.Getenv("_LIBCONTAINER_CONSOLE")
-	)
-
-	// Get the INITPIPE.
-	pipefd, err = strconv.Atoi(envInitPipe)
-	if err != nil {
-		return fmt.Errorf("unable to convert _LIBCONTAINER_INITPIPE=%s to int: %s", envInitPipe, err)
-	}
-
-	var (
-		pipe = os.NewFile(uintptr(pipefd), "pipe")
-		it   = initType(os.Getenv("_LIBCONTAINER_INITTYPE"))
-	)
-	defer pipe.Close()
-
-	// Only init processes have FIFOFD.
-	fifofd = -1
-	if it == initStandard {
-		if fifofd, err = strconv.Atoi(envFifoFd); err != nil {
-			return fmt.Errorf("unable to convert _LIBCONTAINER_FIFOFD=%s to int: %s", envFifoFd, err)
-		}
-	}
-
-	if envConsole != "" {
-		console, err := strconv.Atoi(envConsole)
-		if err != nil {
-			return fmt.Errorf("unable to convert _LIBCONTAINER_CONSOLE=%s to int: %s", envConsole, err)
-		}
-		consoleSocket = os.NewFile(uintptr(console), "console-socket")
-		defer consoleSocket.Close()
-	}
-
-	// clear the current process's environment to clean any libcontainer
-	// specific env vars.
-	os.Clearenv()
-
-	defer func() {
-		// We have an error during the initialization of the container's init,
-		// send it back to the parent process in the form of an initError.
-		if werr := utils.WriteJSON(pipe, syncT{procError}); werr != nil {
-			fmt.Fprintln(os.Stderr, err)
-			return
-		}
-		if werr := utils.WriteJSON(pipe, newSystemError(err)); werr != nil {
-			fmt.Fprintln(os.Stderr, err)
-			return
-		}
-	}()
-	defer func() {
-		if e := recover(); e != nil {
-			err = fmt.Errorf("panic from initialization: %v, %v", e, string(debug.Stack()))
-		}
-	}()
-
-	i, err := newContainerInit(it, pipe, consoleSocket, fifofd)
-	if err != nil {
-		return err
-	}
-
-	// If Init succeeds, syscall.Exec will not return, hence none of the defers will be called.
-	return i.Init()
-}
-
-func (l *LinuxFactory) loadState(root, id string) (*State, error) {
-	f, err := os.Open(filepath.Join(root, stateFilename))
-	if err != nil {
-		if os.IsNotExist(err) {
-			return nil, newGenericError(fmt.Errorf("container %q does not exist", id), ContainerNotExists)
-		}
-		return nil, newGenericError(err, SystemError)
-	}
-	defer f.Close()
-	var state *State
-	if err := json.NewDecoder(f).Decode(&state); err != nil {
-		return nil, newGenericError(err, SystemError)
-	}
-	return state, nil
-}
-
-func (l *LinuxFactory) validateID(id string) error {
-	if !idRegex.MatchString(id) {
-		return newGenericError(fmt.Errorf("invalid id format: %v", id), InvalidIdFormat)
-	}
-
-	return nil
-}
-
-// NewuidmapPath returns an option func to configure a LinuxFactory with the
-// provided ..
-func NewuidmapPath(newuidmapPath string) func(*LinuxFactory) error {
-	return func(l *LinuxFactory) error {
-		l.NewuidmapPath = newuidmapPath
-		return nil
-	}
-}
-
-// NewgidmapPath returns an option func to configure a LinuxFactory with the
-// provided ..
-func NewgidmapPath(newgidmapPath string) func(*LinuxFactory) error {
-	return func(l *LinuxFactory) error {
-		l.NewgidmapPath = newgidmapPath
-		return nil
-	}
-}
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/generic_error.go b/vendor/github.com/opencontainers/runc/libcontainer/generic_error.go
deleted file mode 100644
index 6e7de2fe7..000000000
--- a/vendor/github.com/opencontainers/runc/libcontainer/generic_error.go
+++ /dev/null
@@ -1,92 +0,0 @@
-package libcontainer
-
-import (
-	"fmt"
-	"io"
-	"text/template"
-	"time"
-
-	"github.com/opencontainers/runc/libcontainer/stacktrace"
-)
-
-var errorTemplate = template.Must(template.New("error").Parse(`Timestamp: {{.Timestamp}}
-Code: {{.ECode}}
-{{if .Message }}
-Message: {{.Message}}
-{{end}}
-Frames:{{range $i, $frame := .Stack.Frames}}
----
-{{$i}}: {{$frame.Function}}
-Package: {{$frame.Package}}
-File: {{$frame.File}}@{{$frame.Line}}{{end}}
-`))
-
-func newGenericError(err error, c ErrorCode) Error {
-	if le, ok := err.(Error); ok {
-		return le
-	}
-	gerr := &genericError{
-		Timestamp: time.Now(),
-		Err:       err,
-		ECode:     c,
-		Stack:     stacktrace.Capture(1),
-	}
-	if err != nil {
-		gerr.Message = err.Error()
-	}
-	return gerr
-}
-
-func newSystemError(err error) Error {
-	return createSystemError(err, "")
-}
-
-func newSystemErrorWithCausef(err error, cause string, v ...interface{}) Error {
-	return createSystemError(err, fmt.Sprintf(cause, v...))
-}
-
-func newSystemErrorWithCause(err error, cause string) Error {
-	return createSystemError(err, cause)
-}
-
-// createSystemError creates the specified error with the correct number of
-// stack frames skipped. This is only to be called by the other functions for
-// formatting the error.
-func createSystemError(err error, cause string) Error {
-	gerr := &genericError{
-		Timestamp: time.Now(),
-		Err:       err,
-		ECode:     SystemError,
-		Cause:     cause,
-		Stack:     stacktrace.Capture(2),
-	}
-	if err != nil {
-		gerr.Message = err.Error()
-	}
-	return gerr
-}
-
-type genericError struct {
-	Timestamp time.Time
-	ECode     ErrorCode
-	Err       error `json:"-"`
-	Cause     string
-	Message   string
-	Stack     stacktrace.Stacktrace
-}
-
-func (e *genericError) Error() string {
-	if e.Cause == "" {
-		return e.Message
-	}
-	frame := e.Stack.Frames[0]
-	return fmt.Sprintf("%s:%d: %s caused %q", frame.File, frame.Line, e.Cause, e.Message)
-}
-
-func (e *genericError) Code() ErrorCode {
-	return e.ECode
-}
-
-func (e *genericError) Detail(w io.Writer) error {
-	return errorTemplate.Execute(w, e)
-}
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/init_linux.go b/vendor/github.com/opencontainers/runc/libcontainer/init_linux.go
deleted file mode 100644
index 2770be307..000000000
--- a/vendor/github.com/opencontainers/runc/libcontainer/init_linux.go
+++ /dev/null
@@ -1,534 +0,0 @@
-// +build linux
-
-package libcontainer
-
-import (
-	"encoding/json"
-	"fmt"
-	"io"
-	"net"
-	"os"
-	"strings"
-	"syscall" // only for Errno
-	"unsafe"
-
-	"golang.org/x/sys/unix"
-
-	"github.com/containerd/console"
-	"github.com/opencontainers/runc/libcontainer/cgroups"
-	"github.com/opencontainers/runc/libcontainer/configs"
-	"github.com/opencontainers/runc/libcontainer/system"
-	"github.com/opencontainers/runc/libcontainer/user"
-	"github.com/opencontainers/runc/libcontainer/utils"
-	"github.com/sirupsen/logrus"
-	"github.com/vishvananda/netlink"
-)
-
-type initType string
-
-const (
-	initSetns    initType = "setns"
-	initStandard initType = "standard"
-)
-
-type pid struct {
-	Pid           int `json:"pid"`
-	PidFirstChild int `json:"pid_first"`
-}
-
-// network is an internal struct used to setup container networks.
-type network struct {
-	configs.Network
-
-	// TempVethPeerName is a unique temporary veth peer name that was placed into
-	// the container's namespace.
-	TempVethPeerName string `json:"temp_veth_peer_name"`
-}
-
-// initConfig is used for transferring parameters from Exec() to Init()
-type initConfig struct {
-	Args             []string              `json:"args"`
-	Env              []string              `json:"env"`
-	Cwd              string                `json:"cwd"`
-	Capabilities     *configs.Capabilities `json:"capabilities"`
-	ProcessLabel     string                `json:"process_label"`
-	AppArmorProfile  string                `json:"apparmor_profile"`
-	NoNewPrivileges  bool                  `json:"no_new_privileges"`
-	User             string                `json:"user"`
-	AdditionalGroups []string              `json:"additional_groups"`
-	Config           *configs.Config       `json:"config"`
-	Networks         []*network            `json:"network"`
-	PassedFilesCount int                   `json:"passed_files_count"`
-	ContainerId      string                `json:"containerid"`
-	Rlimits          []configs.Rlimit      `json:"rlimits"`
-	CreateConsole    bool                  `json:"create_console"`
-	ConsoleWidth     uint16                `json:"console_width"`
-	ConsoleHeight    uint16                `json:"console_height"`
-	Rootless         bool                  `json:"rootless"`
-}
-
-type initer interface {
-	Init() error
-}
-
-func newContainerInit(t initType, pipe *os.File, consoleSocket *os.File, fifoFd int) (initer, error) {
-	var config *initConfig
-	if err := json.NewDecoder(pipe).Decode(&config); err != nil {
-		return nil, err
-	}
-	if err := populateProcessEnvironment(config.Env); err != nil {
-		return nil, err
-	}
-	switch t {
-	case initSetns:
-		return &linuxSetnsInit{
-			pipe:          pipe,
-			consoleSocket: consoleSocket,
-			config:        config,
-		}, nil
-	case initStandard:
-		return &linuxStandardInit{
-			pipe:          pipe,
-			consoleSocket: consoleSocket,
-			parentPid:     unix.Getppid(),
-			config:        config,
-			fifoFd:        fifoFd,
-		}, nil
-	}
-	return nil, fmt.Errorf("unknown init type %q", t)
-}
-
-// populateProcessEnvironment loads the provided environment variables into the
-// current processes's environment.
-func populateProcessEnvironment(env []string) error {
-	for _, pair := range env {
-		p := strings.SplitN(pair, "=", 2)
-		if len(p) < 2 {
-			return fmt.Errorf("invalid environment '%v'", pair)
-		}
-		if err := os.Setenv(p[0], p[1]); err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-// finalizeNamespace drops the caps, sets the correct user
-// and working dir, and closes any leaked file descriptors
-// before executing the command inside the namespace
-func finalizeNamespace(config *initConfig) error {
-	// Ensure that all unwanted fds we may have accidentally
-	// inherited are marked close-on-exec so they stay out of the
-	// container
-	if err := utils.CloseExecFrom(config.PassedFilesCount + 3); err != nil {
-		return err
-	}
-
-	capabilities := &configs.Capabilities{}
-	if config.Capabilities != nil {
-		capabilities = config.Capabilities
-	} else if config.Config.Capabilities != nil {
-		capabilities = config.Config.Capabilities
-	}
-	w, err := newContainerCapList(capabilities)
-	if err != nil {
-		return err
-	}
-	// drop capabilities in bounding set before changing user
-	if err := w.ApplyBoundingSet(); err != nil {
-		return err
-	}
-	// preserve existing capabilities while we change users
-	if err := system.SetKeepCaps(); err != nil {
-		return err
-	}
-	if err := setupUser(config); err != nil {
-		return err
-	}
-	if err := system.ClearKeepCaps(); err != nil {
-		return err
-	}
-	if err := w.ApplyCaps(); err != nil {
-		return err
-	}
-	if config.Cwd != "" {
-		if err := unix.Chdir(config.Cwd); err != nil {
-			return fmt.Errorf("chdir to cwd (%q) set in config.json failed: %v", config.Cwd, err)
-		}
-	}
-	return nil
-}
-
-// setupConsole sets up the console from inside the container, and sends the
-// master pty fd to the config.Pipe (using cmsg). This is done to ensure that
-// consoles are scoped to a container properly (see runc#814 and the many
-// issues related to that). This has to be run *after* we've pivoted to the new
-// rootfs (and the users' configuration is entirely set up).
-func setupConsole(socket *os.File, config *initConfig, mount bool) error {
-	defer socket.Close()
-	// At this point, /dev/ptmx points to something that we would expect. We
-	// used to change the owner of the slave path, but since the /dev/pts mount
-	// can have gid=X set (at the users' option). So touching the owner of the
-	// slave PTY is not necessary, as the kernel will handle that for us. Note
-	// however, that setupUser (specifically fixStdioPermissions) *will* change
-	// the UID owner of the console to be the user the process will run as (so
-	// they can actually control their console).
-
-	pty, slavePath, err := console.NewPty()
-	if err != nil {
-		return err
-	}
-
-	if config.ConsoleHeight != 0 && config.ConsoleWidth != 0 {
-		err = pty.Resize(console.WinSize{
-			Height: config.ConsoleHeight,
-			Width:  config.ConsoleWidth,
-		})
-
-		if err != nil {
-			return err
-		}
-	}
-
-	// After we return from here, we don't need the console anymore.
-	defer pty.Close()
-
-	// Mount the console inside our rootfs.
-	if mount {
-		if err := mountConsole(slavePath); err != nil {
-			return err
-		}
-	}
-	// While we can access console.master, using the API is a good idea.
-	if err := utils.SendFd(socket, pty.Name(), pty.Fd()); err != nil {
-		return err
-	}
-	// Now, dup over all the things.
-	return dupStdio(slavePath)
-}
-
-// syncParentReady sends to the given pipe a JSON payload which indicates that
-// the init is ready to Exec the child process. It then waits for the parent to
-// indicate that it is cleared to Exec.
-func syncParentReady(pipe io.ReadWriter) error {
-	// Tell parent.
-	if err := writeSync(pipe, procReady); err != nil {
-		return err
-	}
-
-	// Wait for parent to give the all-clear.
-	if err := readSync(pipe, procRun); err != nil {
-		return err
-	}
-
-	return nil
-}
-
-// syncParentHooks sends to the given pipe a JSON payload which indicates that
-// the parent should execute pre-start hooks. It then waits for the parent to
-// indicate that it is cleared to resume.
-func syncParentHooks(pipe io.ReadWriter) error {
-	// Tell parent.
-	if err := writeSync(pipe, procHooks); err != nil {
-		return err
-	}
-
-	// Wait for parent to give the all-clear.
-	if err := readSync(pipe, procResume); err != nil {
-		return err
-	}
-
-	return nil
-}
-
-// setupUser changes the groups, gid, and uid for the user inside the container
-func setupUser(config *initConfig) error {
-	// Set up defaults.
-	defaultExecUser := user.ExecUser{
-		Uid:  0,
-		Gid:  0,
-		Home: "/",
-	}
-
-	passwdPath, err := user.GetPasswdPath()
-	if err != nil {
-		return err
-	}
-
-	groupPath, err := user.GetGroupPath()
-	if err != nil {
-		return err
-	}
-
-	execUser, err := user.GetExecUserPath(config.User, &defaultExecUser, passwdPath, groupPath)
-	if err != nil {
-		return err
-	}
-
-	var addGroups []int
-	if len(config.AdditionalGroups) > 0 {
-		addGroups, err = user.GetAdditionalGroupsPath(config.AdditionalGroups, groupPath)
-		if err != nil {
-			return err
-		}
-	}
-
-	// Rather than just erroring out later in setuid(2) and setgid(2), check
-	// that the user is mapped here.
-	if _, err := config.Config.HostUID(execUser.Uid); err != nil {
-		return fmt.Errorf("cannot set uid to unmapped user in user namespace")
-	}
-	if _, err := config.Config.HostGID(execUser.Gid); err != nil {
-		return fmt.Errorf("cannot set gid to unmapped user in user namespace")
-	}
-
-	if config.Rootless {
-		// We cannot set any additional groups in a rootless container and thus
-		// we bail if the user asked us to do so. TODO: We currently can't do
-		// this check earlier, but if libcontainer.Process.User was typesafe
-		// this might work.
-		if len(addGroups) > 0 {
-			return fmt.Errorf("cannot set any additional groups in a rootless container")
-		}
-	}
-
-	// Before we change to the container's user make sure that the processes
-	// STDIO is correctly owned by the user that we are switching to.
-	if err := fixStdioPermissions(config, execUser); err != nil {
-		return err
-	}
-
-	// This isn't allowed in an unprivileged user namespace since Linux 3.19.
-	// There's nothing we can do about /etc/group entries, so we silently
-	// ignore setting groups here (since the user didn't explicitly ask us to
-	// set the group).
-	if !config.Rootless {
-		suppGroups := append(execUser.Sgids, addGroups...)
-		if err := unix.Setgroups(suppGroups); err != nil {
-			return err
-		}
-	}
-
-	if err := system.Setgid(execUser.Gid); err != nil {
-		return err
-	}
-	if err := system.Setuid(execUser.Uid); err != nil {
-		return err
-	}
-
-	// if we didn't get HOME already, set it based on the user's HOME
-	if envHome := os.Getenv("HOME"); envHome == "" {
-		if err := os.Setenv("HOME", execUser.Home); err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-// fixStdioPermissions fixes the permissions of PID 1's STDIO within the container to the specified user.
-// The ownership needs to match because it is created outside of the container and needs to be
-// localized.
-func fixStdioPermissions(config *initConfig, u *user.ExecUser) error {
-	var null unix.Stat_t
-	if err := unix.Stat("/dev/null", &null); err != nil {
-		return err
-	}
-	for _, fd := range []uintptr{
-		os.Stdin.Fd(),
-		os.Stderr.Fd(),
-		os.Stdout.Fd(),
-	} {
-		var s unix.Stat_t
-		if err := unix.Fstat(int(fd), &s); err != nil {
-			return err
-		}
-
-		// Skip chown of /dev/null if it was used as one of the STDIO fds.
-		if s.Rdev == null.Rdev {
-			continue
-		}
-
-		// We only change the uid owner (as it is possible for the mount to
-		// prefer a different gid, and there's no reason for us to change it).
-		// The reason why we don't just leave the default uid=X mount setup is
-		// that users expect to be able to actually use their console. Without
-		// this code, you couldn't effectively run as a non-root user inside a
-		// container and also have a console set up.
-		if err := unix.Fchown(int(fd), u.Uid, int(s.Gid)); err != nil {
-			// If we've hit an EINVAL then s.Gid isn't mapped in the user
-			// namespace. If we've hit an EPERM then the inode's current owner
-			// is not mapped in our user namespace (in particular,
-			// privileged_wrt_inode_uidgid() has failed). In either case, we
-			// are in a configuration where it's better for us to just not
-			// touch the stdio rather than bail at this point.
-			if err == unix.EINVAL || err == unix.EPERM {
-				continue
-			}
-			return err
-		}
-	}
-	return nil
-}
-
-// setupNetwork sets up and initializes any network interface inside the container.
-func setupNetwork(config *initConfig) error {
-	for _, config := range config.Networks {
-		strategy, err := getStrategy(config.Type)
-		if err != nil {
-			return err
-		}
-		if err := strategy.initialize(config); err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-func setupRoute(config *configs.Config) error {
-	for _, config := range config.Routes {
-		_, dst, err := net.ParseCIDR(config.Destination)
-		if err != nil {
-			return err
-		}
-		src := net.ParseIP(config.Source)
-		if src == nil {
-			return fmt.Errorf("Invalid source for route: %s", config.Source)
-		}
-		gw := net.ParseIP(config.Gateway)
-		if gw == nil {
-			return fmt.Errorf("Invalid gateway for route: %s", config.Gateway)
-		}
-		l, err := netlink.LinkByName(config.InterfaceName)
-		if err != nil {
-			return err
-		}
-		route := &netlink.Route{
-			Scope:     netlink.SCOPE_UNIVERSE,
-			Dst:       dst,
-			Src:       src,
-			Gw:        gw,
-			LinkIndex: l.Attrs().Index,
-		}
-		if err := netlink.RouteAdd(route); err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-func setupRlimits(limits []configs.Rlimit, pid int) error {
-	for _, rlimit := range limits {
-		if err := system.Prlimit(pid, rlimit.Type, unix.Rlimit{Max: rlimit.Hard, Cur: rlimit.Soft}); err != nil {
-			return fmt.Errorf("error setting rlimit type %v: %v", rlimit.Type, err)
-		}
-	}
-	return nil
-}
-
-const _P_PID = 1
-
-type siginfo struct {
-	si_signo int32
-	si_errno int32
-	si_code  int32
-	// below here is a union; si_pid is the only field we use
-	si_pid int32
-	// Pad to 128 bytes as detailed in blockUntilWaitable
-	pad [96]byte
-}
-
-// isWaitable returns true if the process has exited false otherwise.
-// Its based off blockUntilWaitable in src/os/wait_waitid.go
-func isWaitable(pid int) (bool, error) {
-	si := &siginfo{}
-	_, _, e := unix.Syscall6(unix.SYS_WAITID, _P_PID, uintptr(pid), uintptr(unsafe.Pointer(si)), unix.WEXITED|unix.WNOWAIT|unix.WNOHANG, 0, 0)
-	if e != 0 {
-		return false, os.NewSyscallError("waitid", e)
-	}
-
-	return si.si_pid != 0, nil
-}
-
-// isNoChildren returns true if err represents a unix.ECHILD (formerly syscall.ECHILD) false otherwise
-func isNoChildren(err error) bool {
-	switch err := err.(type) {
-	case syscall.Errno:
-		if err == unix.ECHILD {
-			return true
-		}
-	case *os.SyscallError:
-		if err.Err == unix.ECHILD {
-			return true
-		}
-	}
-	return false
-}
-
-// signalAllProcesses freezes then iterates over all the processes inside the
-// manager's cgroups sending the signal s to them.
-// If s is SIGKILL then it will wait for each process to exit.
-// For all other signals it will check if the process is ready to report its
-// exit status and only if it is will a wait be performed.
-func signalAllProcesses(m cgroups.Manager, s os.Signal) error {
-	var procs []*os.Process
-	if err := m.Freeze(configs.Frozen); err != nil {
-		logrus.Warn(err)
-	}
-	pids, err := m.GetAllPids()
-	if err != nil {
-		m.Freeze(configs.Thawed)
-		return err
-	}
-	for _, pid := range pids {
-		p, err := os.FindProcess(pid)
-		if err != nil {
-			logrus.Warn(err)
-			continue
-		}
-		procs = append(procs, p)
-		if err := p.Signal(s); err != nil {
-			logrus.Warn(err)
-		}
-	}
-	if err := m.Freeze(configs.Thawed); err != nil {
-		logrus.Warn(err)
-	}
-
-	subreaper, err := system.GetSubreaper()
-	if err != nil {
-		// The error here means that PR_GET_CHILD_SUBREAPER is not
-		// supported because this code might run on a kernel older
-		// than 3.4. We don't want to throw an error in that case,
-		// and we simplify things, considering there is no subreaper
-		// set.
-		subreaper = 0
-	}
-
-	for _, p := range procs {
-		if s != unix.SIGKILL {
-			if ok, err := isWaitable(p.Pid); err != nil {
-				if !isNoChildren(err) {
-					logrus.Warn("signalAllProcesses: ", p.Pid, err)
-				}
-				continue
-			} else if !ok {
-				// Not ready to report so don't wait
-				continue
-			}
-		}
-
-		// In case a subreaper has been setup, this code must not
-		// wait for the process. Otherwise, we cannot be sure the
-		// current process will be reaped by the subreaper, while
-		// the subreaper might be waiting for this process in order
-		// to retrieve its exit code.
-		if subreaper == 0 {
-			if _, err := p.Wait(); err != nil {
-				if !isNoChildren(err) {
-					logrus.Warn("wait: ", err)
-				}
-			}
-		}
-	}
-	return nil
-}
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/intelrdt/intelrdt.go b/vendor/github.com/opencontainers/runc/libcontainer/intelrdt/intelrdt.go
deleted file mode 100644
index 487c630af..000000000
--- a/vendor/github.com/opencontainers/runc/libcontainer/intelrdt/intelrdt.go
+++ /dev/null
@@ -1,553 +0,0 @@
-// +build linux
-
-package intelrdt
-
-import (
-	"bufio"
-	"fmt"
-	"io/ioutil"
-	"os"
-	"path/filepath"
-	"strconv"
-	"strings"
-	"sync"
-
-	"github.com/opencontainers/runc/libcontainer/configs"
-)
-
-/*
- * About Intel RDT/CAT feature:
- * Intel platforms with new Xeon CPU support Resource Director Technology (RDT).
- * Intel Cache Allocation Technology (CAT) is a sub-feature of RDT. Currently L3
- * Cache is the only resource that is supported in RDT.
- *
- * This feature provides a way for the software to restrict cache allocation to a
- * defined 'subset' of L3 cache which may be overlapping with other 'subsets'.
- * The different subsets are identified by class of service (CLOS) and each CLOS
- * has a capacity bitmask (CBM).
- *
- * For more information about Intel RDT/CAT can be found in the section 17.17
- * of Intel Software Developer Manual.
- *
- * About Intel RDT/CAT kernel interface:
- * In Linux 4.10 kernel or newer, the interface is defined and exposed via
- * "resource control" filesystem, which is a "cgroup-like" interface.
- *
- * Comparing with cgroups, it has similar process management lifecycle and
- * interfaces in a container. But unlike cgroups' hierarchy, it has single level
- * filesystem layout.
- *
- * Intel RDT "resource control" filesystem hierarchy:
- * mount -t resctrl resctrl /sys/fs/resctrl
- * tree /sys/fs/resctrl
- * /sys/fs/resctrl/
- * |-- info
- * |   |-- L3
- * |       |-- cbm_mask
- * |       |-- min_cbm_bits
- * |       |-- num_closids
- * |-- cpus
- * |-- schemata
- * |-- tasks
- * |-- <container_id>
- *     |-- cpus
- *     |-- schemata
- *     |-- tasks
- *
- * For runc, we can make use of `tasks` and `schemata` configuration for L3 cache
- * resource constraints.
- *
- *  The file `tasks` has a list of tasks that belongs to this group (e.g.,
- * <container_id>" group). Tasks can be added to a group by writing the task ID
- * to the "tasks" file  (which will automatically remove them from the previous
- * group to which they belonged). New tasks created by fork(2) and clone(2) are
- * added to the same group as their parent. If a pid is not in any sub group, it is
- * in root group.
- *
- * The file `schemata` has allocation bitmasks/values for L3 cache on each socket,
- * which contains L3 cache id and capacity bitmask (CBM).
- * 	Format: "L3:<cache_id0>=<cbm0>;<cache_id1>=<cbm1>;..."
- * For example, on a two-socket machine, L3's schema line could be `L3:0=ff;1=c0`
- * which means L3 cache id 0's CBM is 0xff, and L3 cache id 1's CBM is 0xc0.
- *
- * The valid L3 cache CBM is a *contiguous bits set* and number of bits that can
- * be set is less than the max bit. The max bits in the CBM is varied among
- * supported Intel Xeon platforms. In Intel RDT "resource control" filesystem
- * layout, the CBM in a group should be a subset of the CBM in root. Kernel will
- * check if it is valid when writing. e.g., 0xfffff in root indicates the max bits
- * of CBM is 20 bits, which mapping to entire L3 cache capacity. Some valid CBM
- * values to set in a group: 0xf, 0xf0, 0x3ff, 0x1f00 and etc.
- *
- * For more information about Intel RDT/CAT kernel interface:
- * https://www.kernel.org/doc/Documentation/x86/intel_rdt_ui.txt
- *
- * An example for runc:
- * Consider a two-socket machine with two L3 caches where the default CBM is
- * 0xfffff and the max CBM length is 20 bits. With this configuration, tasks
- * inside the container only have access to the "upper" 80% of L3 cache id 0 and
- * the "lower" 50% L3 cache id 1:
- *
- * "linux": {
- * 	"intelRdt": {
- * 		"l3CacheSchema": "L3:0=ffff0;1=3ff"
- * 	}
- * }
- */
-
-type Manager interface {
-	// Applies Intel RDT configuration to the process with the specified pid
-	Apply(pid int) error
-
-	// Returns statistics for Intel RDT
-	GetStats() (*Stats, error)
-
-	// Destroys the Intel RDT 'container_id' group
-	Destroy() error
-
-	// Returns Intel RDT path to save in a state file and to be able to
-	// restore the object later
-	GetPath() string
-
-	// Set Intel RDT "resource control" filesystem as configured.
-	Set(container *configs.Config) error
-}
-
-// This implements interface Manager
-type IntelRdtManager struct {
-	mu     sync.Mutex
-	Config *configs.Config
-	Id     string
-	Path   string
-}
-
-const (
-	IntelRdtTasks = "tasks"
-)
-
-var (
-	// The absolute root path of the Intel RDT "resource control" filesystem
-	intelRdtRoot     string
-	intelRdtRootLock sync.Mutex
-
-	// The flag to indicate if Intel RDT is supported
-	isEnabled bool
-)
-
-type intelRdtData struct {
-	root   string
-	config *configs.Config
-	pid    int
-}
-
-// Check if Intel RDT is enabled in init()
-func init() {
-	// 1. Check if hardware and kernel support Intel RDT/CAT feature
-	// "cat_l3" flag is set if supported
-	isFlagSet, err := parseCpuInfoFile("/proc/cpuinfo")
-	if !isFlagSet || err != nil {
-		isEnabled = false
-		return
-	}
-
-	// 2. Check if Intel RDT "resource control" filesystem is mounted
-	// The user guarantees to mount the filesystem
-	isEnabled = isIntelRdtMounted()
-}
-
-// Return the mount point path of Intel RDT "resource control" filesysem
-func findIntelRdtMountpointDir() (string, error) {
-	f, err := os.Open("/proc/self/mountinfo")
-	if err != nil {
-		return "", err
-	}
-	defer f.Close()
-
-	s := bufio.NewScanner(f)
-	for s.Scan() {
-		text := s.Text()
-		fields := strings.Split(text, " ")
-		// Safe as mountinfo encodes mountpoints with spaces as \040.
-		index := strings.Index(text, " - ")
-		postSeparatorFields := strings.Fields(text[index+3:])
-		numPostFields := len(postSeparatorFields)
-
-		// This is an error as we can't detect if the mount is for "Intel RDT"
-		if numPostFields == 0 {
-			return "", fmt.Errorf("Found no fields post '-' in %q", text)
-		}
-
-		if postSeparatorFields[0] == "resctrl" {
-			// Check that the mount is properly formated.
-			if numPostFields < 3 {
-				return "", fmt.Errorf("Error found less than 3 fields post '-' in %q", text)
-			}
-
-			return fields[4], nil
-		}
-	}
-	if err := s.Err(); err != nil {
-		return "", err
-	}
-
-	return "", NewNotFoundError("Intel RDT")
-}
-
-// Gets the root path of Intel RDT "resource control" filesystem
-func getIntelRdtRoot() (string, error) {
-	intelRdtRootLock.Lock()
-	defer intelRdtRootLock.Unlock()
-
-	if intelRdtRoot != "" {
-		return intelRdtRoot, nil
-	}
-
-	root, err := findIntelRdtMountpointDir()
-	if err != nil {
-		return "", err
-	}
-
-	if _, err := os.Stat(root); err != nil {
-		return "", err
-	}
-
-	intelRdtRoot = root
-	return intelRdtRoot, nil
-}
-
-func isIntelRdtMounted() bool {
-	_, err := getIntelRdtRoot()
-	if err != nil {
-		return false
-	}
-
-	return true
-}
-
-func parseCpuInfoFile(path string) (bool, error) {
-	f, err := os.Open(path)
-	if err != nil {
-		return false, err
-	}
-	defer f.Close()
-
-	s := bufio.NewScanner(f)
-	for s.Scan() {
-		if err := s.Err(); err != nil {
-			return false, err
-		}
-
-		text := s.Text()
-		flags := strings.Split(text, " ")
-
-		// "cat_l3" flag is set if Intel RDT/CAT is supported
-		for _, flag := range flags {
-			if flag == "cat_l3" {
-				return true, nil
-			}
-		}
-	}
-	return false, nil
-}
-
-func parseUint(s string, base, bitSize int) (uint64, error) {
-	value, err := strconv.ParseUint(s, base, bitSize)
-	if err != nil {
-		intValue, intErr := strconv.ParseInt(s, base, bitSize)
-		// 1. Handle negative values greater than MinInt64 (and)
-		// 2. Handle negative values lesser than MinInt64
-		if intErr == nil && intValue < 0 {
-			return 0, nil
-		} else if intErr != nil && intErr.(*strconv.NumError).Err == strconv.ErrRange && intValue < 0 {
-			return 0, nil
-		}
-
-		return value, err
-	}
-
-	return value, nil
-}
-
-// Gets a single uint64 value from the specified file.
-func getIntelRdtParamUint(path, file string) (uint64, error) {
-	fileName := filepath.Join(path, file)
-	contents, err := ioutil.ReadFile(fileName)
-	if err != nil {
-		return 0, err
-	}
-
-	res, err := parseUint(strings.TrimSpace(string(contents)), 10, 64)
-	if err != nil {
-		return res, fmt.Errorf("unable to parse %q as a uint from file %q", string(contents), fileName)
-	}
-	return res, nil
-}
-
-// Gets a string value from the specified file
-func getIntelRdtParamString(path, file string) (string, error) {
-	contents, err := ioutil.ReadFile(filepath.Join(path, file))
-	if err != nil {
-		return "", err
-	}
-
-	return strings.TrimSpace(string(contents)), nil
-}
-
-func readTasksFile(dir string) ([]int, error) {
-	f, err := os.Open(filepath.Join(dir, IntelRdtTasks))
-	if err != nil {
-		return nil, err
-	}
-	defer f.Close()
-
-	var (
-		s   = bufio.NewScanner(f)
-		out = []int{}
-	)
-
-	for s.Scan() {
-		if t := s.Text(); t != "" {
-			pid, err := strconv.Atoi(t)
-			if err != nil {
-				return nil, err
-			}
-			out = append(out, pid)
-		}
-	}
-	return out, nil
-}
-
-func writeFile(dir, file, data string) error {
-	if dir == "" {
-		return fmt.Errorf("no such directory for %s", file)
-	}
-	if err := ioutil.WriteFile(filepath.Join(dir, file), []byte(data+"\n"), 0700); err != nil {
-		return fmt.Errorf("failed to write %v to %v: %v", data, file, err)
-	}
-	return nil
-}
-
-func getIntelRdtData(c *configs.Config, pid int) (*intelRdtData, error) {
-	rootPath, err := getIntelRdtRoot()
-	if err != nil {
-		return nil, err
-	}
-	return &intelRdtData{
-		root:   rootPath,
-		config: c,
-		pid:    pid,
-	}, nil
-}
-
-// Get the read-only L3 cache information
-func getL3CacheInfo() (*L3CacheInfo, error) {
-	l3CacheInfo := &L3CacheInfo{}
-
-	rootPath, err := getIntelRdtRoot()
-	if err != nil {
-		return l3CacheInfo, err
-	}
-
-	path := filepath.Join(rootPath, "info", "L3")
-	cbmMask, err := getIntelRdtParamString(path, "cbm_mask")
-	if err != nil {
-		return l3CacheInfo, err
-	}
-	minCbmBits, err := getIntelRdtParamUint(path, "min_cbm_bits")
-	if err != nil {
-		return l3CacheInfo, err
-	}
-	numClosids, err := getIntelRdtParamUint(path, "num_closids")
-	if err != nil {
-		return l3CacheInfo, err
-	}
-
-	l3CacheInfo.CbmMask = cbmMask
-	l3CacheInfo.MinCbmBits = minCbmBits
-	l3CacheInfo.NumClosids = numClosids
-
-	return l3CacheInfo, nil
-}
-
-// WriteIntelRdtTasks writes the specified pid into the "tasks" file
-func WriteIntelRdtTasks(dir string, pid int) error {
-	if dir == "" {
-		return fmt.Errorf("no such directory for %s", IntelRdtTasks)
-	}
-
-	// Dont attach any pid if -1 is specified as a pid
-	if pid != -1 {
-		if err := ioutil.WriteFile(filepath.Join(dir, IntelRdtTasks), []byte(strconv.Itoa(pid)), 0700); err != nil {
-			return fmt.Errorf("failed to write %v to %v: %v", pid, IntelRdtTasks, err)
-		}
-	}
-	return nil
-}
-
-// Check if Intel RDT is enabled
-func IsEnabled() bool {
-	return isEnabled
-}
-
-// Get the 'container_id' path in Intel RDT "resource control" filesystem
-func GetIntelRdtPath(id string) (string, error) {
-	rootPath, err := getIntelRdtRoot()
-	if err != nil {
-		return "", err
-	}
-
-	path := filepath.Join(rootPath, id)
-	return path, nil
-}
-
-// Applies Intel RDT configuration to the process with the specified pid
-func (m *IntelRdtManager) Apply(pid int) (err error) {
-	// If intelRdt is not specified in config, we do nothing
-	if m.Config.IntelRdt == nil {
-		return nil
-	}
-	d, err := getIntelRdtData(m.Config, pid)
-	if err != nil && !IsNotFound(err) {
-		return err
-	}
-
-	m.mu.Lock()
-	defer m.mu.Unlock()
-	path, err := d.join(m.Id)
-	if err != nil {
-		return err
-	}
-
-	m.Path = path
-	return nil
-}
-
-// Destroys the Intel RDT 'container_id' group
-func (m *IntelRdtManager) Destroy() error {
-	m.mu.Lock()
-	defer m.mu.Unlock()
-	if err := os.RemoveAll(m.Path); err != nil {
-		return err
-	}
-	m.Path = ""
-	return nil
-}
-
-// Returns Intel RDT path to save in a state file and to be able to
-// restore the object later
-func (m *IntelRdtManager) GetPath() string {
-	if m.Path == "" {
-		m.Path, _ = GetIntelRdtPath(m.Id)
-	}
-	return m.Path
-}
-
-// Returns statistics for Intel RDT
-func (m *IntelRdtManager) GetStats() (*Stats, error) {
-	// If intelRdt is not specified in config
-	if m.Config.IntelRdt == nil {
-		return nil, nil
-	}
-
-	m.mu.Lock()
-	defer m.mu.Unlock()
-	stats := NewStats()
-
-	// The read-only L3 cache information
-	l3CacheInfo, err := getL3CacheInfo()
-	if err != nil {
-		return nil, err
-	}
-	stats.L3CacheInfo = l3CacheInfo
-
-	// The read-only L3 cache schema in root
-	rootPath, err := getIntelRdtRoot()
-	if err != nil {
-		return nil, err
-	}
-	tmpRootStrings, err := getIntelRdtParamString(rootPath, "schemata")
-	if err != nil {
-		return nil, err
-	}
-	// L3 cache schema is in the first line
-	schemaRootStrings := strings.Split(tmpRootStrings, "\n")
-	stats.L3CacheSchemaRoot = schemaRootStrings[0]
-
-	// The L3 cache schema in 'container_id' group
-	tmpStrings, err := getIntelRdtParamString(m.GetPath(), "schemata")
-	if err != nil {
-		return nil, err
-	}
-	// L3 cache schema is in the first line
-	schemaStrings := strings.Split(tmpStrings, "\n")
-	stats.L3CacheSchema = schemaStrings[0]
-
-	return stats, nil
-}
-
-// Set Intel RDT "resource control" filesystem as configured.
-func (m *IntelRdtManager) Set(container *configs.Config) error {
-	path := m.GetPath()
-
-	// About L3 cache schema file:
-	// The schema has allocation masks/values for L3 cache on each socket,
-	// which contains L3 cache id and capacity bitmask (CBM).
-	//     Format: "L3:<cache_id0>=<cbm0>;<cache_id1>=<cbm1>;..."
-	// For example, on a two-socket machine, L3's schema line could be:
-	//     L3:0=ff;1=c0
-	// Which means L3 cache id 0's CBM is 0xff, and L3 cache id 1's CBM is 0xc0.
-	//
-	// About L3 cache CBM validity:
-	// The valid L3 cache CBM is a *contiguous bits set* and number of
-	// bits that can be set is less than the max bit. The max bits in the
-	// CBM is varied among supported Intel Xeon platforms. In Intel RDT
-	// "resource control" filesystem layout, the CBM in a group should
-	// be a subset of the CBM in root. Kernel will check if it is valid
-	// when writing.
-	// e.g., 0xfffff in root indicates the max bits of CBM is 20 bits,
-	// which mapping to entire L3 cache capacity. Some valid CBM values
-	// to set in a group: 0xf, 0xf0, 0x3ff, 0x1f00 and etc.
-	if container.IntelRdt != nil {
-		l3CacheSchema := container.IntelRdt.L3CacheSchema
-		if l3CacheSchema != "" {
-			if err := writeFile(path, "schemata", l3CacheSchema); err != nil {
-				return err
-			}
-		}
-	}
-
-	return nil
-}
-
-func (raw *intelRdtData) join(id string) (string, error) {
-	path := filepath.Join(raw.root, id)
-	if err := os.MkdirAll(path, 0755); err != nil {
-		return "", err
-	}
-
-	if err := WriteIntelRdtTasks(path, raw.pid); err != nil {
-		return "", err
-	}
-	return path, nil
-}
-
-type NotFoundError struct {
-	ResourceControl string
-}
-
-func (e *NotFoundError) Error() string {
-	return fmt.Sprintf("mountpoint for %s not found", e.ResourceControl)
-}
-
-func NewNotFoundError(res string) error {
-	return &NotFoundError{
-		ResourceControl: res,
-	}
-}
-
-func IsNotFound(err error) bool {
-	if err == nil {
-		return false
-	}
-	_, ok := err.(*NotFoundError)
-	return ok
-}
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/intelrdt/stats.go b/vendor/github.com/opencontainers/runc/libcontainer/intelrdt/stats.go
deleted file mode 100644
index 095c0a380..000000000
--- a/vendor/github.com/opencontainers/runc/libcontainer/intelrdt/stats.go
+++ /dev/null
@@ -1,24 +0,0 @@
-// +build linux
-
-package intelrdt
-
-type L3CacheInfo struct {
-	CbmMask    string `json:"cbm_mask,omitempty"`
-	MinCbmBits uint64 `json:"min_cbm_bits,omitempty"`
-	NumClosids uint64 `json:"num_closids,omitempty"`
-}
-
-type Stats struct {
-	// The read-only L3 cache information
-	L3CacheInfo *L3CacheInfo `json:"l3_cache_info,omitempty"`
-
-	// The read-only L3 cache schema in root
-	L3CacheSchemaRoot string `json:"l3_cache_schema_root,omitempty"`
-
-	// The L3 cache schema in 'container_id' group
-	L3CacheSchema string `json:"l3_cache_schema,omitempty"`
-}
-
-func NewStats() *Stats {
-	return &Stats{}
-}
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/keys/keyctl.go b/vendor/github.com/opencontainers/runc/libcontainer/keys/keyctl.go
deleted file mode 100644
index ce8b4e6b0..000000000
--- a/vendor/github.com/opencontainers/runc/libcontainer/keys/keyctl.go
+++ /dev/null
@@ -1,50 +0,0 @@
-// +build linux
-
-package keys
-
-import (
-	"fmt"
-	"strconv"
-	"strings"
-
-	"golang.org/x/sys/unix"
-)
-
-type KeySerial uint32
-
-func JoinSessionKeyring(name string) (KeySerial, error) {
-	sessKeyId, err := unix.KeyctlJoinSessionKeyring(name)
-	if err != nil {
-		return 0, fmt.Errorf("could not create session key: %v", err)
-	}
-	return KeySerial(sessKeyId), nil
-}
-
-// ModKeyringPerm modifies permissions on a keyring by reading the current permissions,
-// anding the bits with the given mask (clearing permissions) and setting
-// additional permission bits
-func ModKeyringPerm(ringId KeySerial, mask, setbits uint32) error {
-	dest, err := unix.KeyctlString(unix.KEYCTL_DESCRIBE, int(ringId))
-	if err != nil {
-		return err
-	}
-
-	res := strings.Split(dest, ";")
-	if len(res) < 5 {
-		return fmt.Errorf("Destination buffer for key description is too small")
-	}
-
-	// parse permissions
-	perm64, err := strconv.ParseUint(res[3], 16, 32)
-	if err != nil {
-		return err
-	}
-
-	perm := (uint32(perm64) & mask) | setbits
-
-	if err := unix.KeyctlSetperm(int(ringId), perm); err != nil {
-		return err
-	}
-
-	return nil
-}
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/message_linux.go b/vendor/github.com/opencontainers/runc/libcontainer/message_linux.go
deleted file mode 100644
index ab453cde9..000000000
--- a/vendor/github.com/opencontainers/runc/libcontainer/message_linux.go
+++ /dev/null
@@ -1,89 +0,0 @@
-// +build linux
-
-package libcontainer
-
-import (
-	"github.com/vishvananda/netlink/nl"
-	"golang.org/x/sys/unix"
-)
-
-// list of known message types we want to send to bootstrap program
-// The number is randomly chosen to not conflict with known netlink types
-const (
-	InitMsg         uint16 = 62000
-	CloneFlagsAttr  uint16 = 27281
-	NsPathsAttr     uint16 = 27282
-	UidmapAttr      uint16 = 27283
-	GidmapAttr      uint16 = 27284
-	SetgroupAttr    uint16 = 27285
-	OomScoreAdjAttr uint16 = 27286
-	RootlessAttr    uint16 = 27287
-	UidmapPathAttr  uint16 = 27288
-	GidmapPathAttr  uint16 = 27289
-)
-
-type Int32msg struct {
-	Type  uint16
-	Value uint32
-}
-
-// Serialize serializes the message.
-// Int32msg has the following representation
-// | nlattr len | nlattr type |
-// | uint32 value             |
-func (msg *Int32msg) Serialize() []byte {
-	buf := make([]byte, msg.Len())
-	native := nl.NativeEndian()
-	native.PutUint16(buf[0:2], uint16(msg.Len()))
-	native.PutUint16(buf[2:4], msg.Type)
-	native.PutUint32(buf[4:8], msg.Value)
-	return buf
-}
-
-func (msg *Int32msg) Len() int {
-	return unix.NLA_HDRLEN + 4
-}
-
-// Bytemsg has the following representation
-// | nlattr len | nlattr type |
-// | value              | pad |
-type Bytemsg struct {
-	Type  uint16
-	Value []byte
-}
-
-func (msg *Bytemsg) Serialize() []byte {
-	l := msg.Len()
-	buf := make([]byte, (l+unix.NLA_ALIGNTO-1) & ^(unix.NLA_ALIGNTO-1))
-	native := nl.NativeEndian()
-	native.PutUint16(buf[0:2], uint16(l))
-	native.PutUint16(buf[2:4], msg.Type)
-	copy(buf[4:], msg.Value)
-	return buf
-}
-
-func (msg *Bytemsg) Len() int {
-	return unix.NLA_HDRLEN + len(msg.Value) + 1 // null-terminated
-}
-
-type Boolmsg struct {
-	Type  uint16
-	Value bool
-}
-
-func (msg *Boolmsg) Serialize() []byte {
-	buf := make([]byte, msg.Len())
-	native := nl.NativeEndian()
-	native.PutUint16(buf[0:2], uint16(msg.Len()))
-	native.PutUint16(buf[2:4], msg.Type)
-	if msg.Value {
-		buf[4] = 1
-	} else {
-		buf[4] = 0
-	}
-	return buf
-}
-
-func (msg *Boolmsg) Len() int {
-	return unix.NLA_HDRLEN + 1
-}
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/mount/mount.go b/vendor/github.com/opencontainers/runc/libcontainer/mount/mount.go
deleted file mode 100644
index e8965e081..000000000
--- a/vendor/github.com/opencontainers/runc/libcontainer/mount/mount.go
+++ /dev/null
@@ -1,23 +0,0 @@
-package mount
-
-// GetMounts retrieves a list of mounts for the current running process.
-func GetMounts() ([]*Info, error) {
-	return parseMountTable()
-}
-
-// Mounted looks at /proc/self/mountinfo to determine of the specified
-// mountpoint has been mounted
-func Mounted(mountpoint string) (bool, error) {
-	entries, err := parseMountTable()
-	if err != nil {
-		return false, err
-	}
-
-	// Search the table for the mountpoint
-	for _, e := range entries {
-		if e.Mountpoint == mountpoint {
-			return true, nil
-		}
-	}
-	return false, nil
-}
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/mount/mount_linux.go b/vendor/github.com/opencontainers/runc/libcontainer/mount/mount_linux.go
deleted file mode 100644
index 1e5191928..000000000
--- a/vendor/github.com/opencontainers/runc/libcontainer/mount/mount_linux.go
+++ /dev/null
@@ -1,82 +0,0 @@
-// +build linux
-
-package mount
-
-import (
-	"bufio"
-	"fmt"
-	"io"
-	"os"
-	"strings"
-)
-
-const (
-	/* 36 35 98:0 /mnt1 /mnt2 rw,noatime master:1 - ext3 /dev/root rw,errors=continue
-	   (1)(2)(3)   (4)   (5)      (6)      (7)   (8) (9)   (10)         (11)
-
-	   (1) mount ID:  unique identifier of the mount (may be reused after umount)
-	   (2) parent ID:  ID of parent (or of self for the top of the mount tree)
-	   (3) major:minor:  value of st_dev for files on filesystem
-	   (4) root:  root of the mount within the filesystem
-	   (5) mount point:  mount point relative to the process's root
-	   (6) mount options:  per mount options
-	   (7) optional fields:  zero or more fields of the form "tag[:value]"
-	   (8) separator:  marks the end of the optional fields
-	   (9) filesystem type:  name of filesystem of the form "type[.subtype]"
-	   (10) mount source:  filesystem specific information or "none"
-	   (11) super options:  per super block options*/
-	mountinfoFormat = "%d %d %d:%d %s %s %s %s"
-)
-
-// Parse /proc/self/mountinfo because comparing Dev and ino does not work from
-// bind mounts
-func parseMountTable() ([]*Info, error) {
-	f, err := os.Open("/proc/self/mountinfo")
-	if err != nil {
-		return nil, err
-	}
-	defer f.Close()
-
-	return parseInfoFile(f)
-}
-
-func parseInfoFile(r io.Reader) ([]*Info, error) {
-	var (
-		s   = bufio.NewScanner(r)
-		out = []*Info{}
-	)
-
-	for s.Scan() {
-		if err := s.Err(); err != nil {
-			return nil, err
-		}
-
-		var (
-			p              = &Info{}
-			text           = s.Text()
-			optionalFields string
-		)
-
-		if _, err := fmt.Sscanf(text, mountinfoFormat,
-			&p.ID, &p.Parent, &p.Major, &p.Minor,
-			&p.Root, &p.Mountpoint, &p.Opts, &optionalFields); err != nil {
-			return nil, fmt.Errorf("Scanning '%s' failed: %s", text, err)
-		}
-		// Safe as mountinfo encodes mountpoints with spaces as \040.
-		index := strings.Index(text, " - ")
-		postSeparatorFields := strings.Fields(text[index+3:])
-		if len(postSeparatorFields) < 3 {
-			return nil, fmt.Errorf("Error found less than 3 fields post '-' in %q", text)
-		}
-
-		if optionalFields != "-" {
-			p.Optional = optionalFields
-		}
-
-		p.Fstype = postSeparatorFields[0]
-		p.Source = postSeparatorFields[1]
-		p.VfsOpts = strings.Join(postSeparatorFields[2:], " ")
-		out = append(out, p)
-	}
-	return out, nil
-}
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/mount/mountinfo.go b/vendor/github.com/opencontainers/runc/libcontainer/mount/mountinfo.go
deleted file mode 100644
index e3fc3535e..000000000
--- a/vendor/github.com/opencontainers/runc/libcontainer/mount/mountinfo.go
+++ /dev/null
@@ -1,40 +0,0 @@
-package mount
-
-// Info reveals information about a particular mounted filesystem. This
-// struct is populated from the content in the /proc/<pid>/mountinfo file.
-type Info struct {
-	// ID is a unique identifier of the mount (may be reused after umount).
-	ID int
-
-	// Parent indicates the ID of the mount parent (or of self for the top of the
-	// mount tree).
-	Parent int
-
-	// Major indicates one half of the device ID which identifies the device class.
-	Major int
-
-	// Minor indicates one half of the device ID which identifies a specific
-	// instance of device.
-	Minor int
-
-	// Root of the mount within the filesystem.
-	Root string
-
-	// Mountpoint indicates the mount point relative to the process's root.
-	Mountpoint string
-
-	// Opts represents mount-specific options.
-	Opts string
-
-	// Optional represents optional fields.
-	Optional string
-
-	// Fstype indicates the type of filesystem, such as EXT3.
-	Fstype string
-
-	// Source indicates filesystem specific information or "none".
-	Source string
-
-	// VfsOpts represents per super block options.
-	VfsOpts string
-}
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/network_linux.go b/vendor/github.com/opencontainers/runc/libcontainer/network_linux.go
deleted file mode 100644
index 5075bee4d..000000000
--- a/vendor/github.com/opencontainers/runc/libcontainer/network_linux.go
+++ /dev/null
@@ -1,259 +0,0 @@
-// +build linux
-
-package libcontainer
-
-import (
-	"fmt"
-	"io/ioutil"
-	"net"
-	"path/filepath"
-	"strconv"
-	"strings"
-
-	"github.com/opencontainers/runc/libcontainer/configs"
-	"github.com/opencontainers/runc/libcontainer/utils"
-	"github.com/vishvananda/netlink"
-)
-
-var strategies = map[string]networkStrategy{
-	"veth":     &veth{},
-	"loopback": &loopback{},
-}
-
-// networkStrategy represents a specific network configuration for
-// a container's networking stack
-type networkStrategy interface {
-	create(*network, int) error
-	initialize(*network) error
-	detach(*configs.Network) error
-	attach(*configs.Network) error
-}
-
-// getStrategy returns the specific network strategy for the
-// provided type.
-func getStrategy(tpe string) (networkStrategy, error) {
-	s, exists := strategies[tpe]
-	if !exists {
-		return nil, fmt.Errorf("unknown strategy type %q", tpe)
-	}
-	return s, nil
-}
-
-// Returns the network statistics for the network interfaces represented by the NetworkRuntimeInfo.
-func getNetworkInterfaceStats(interfaceName string) (*NetworkInterface, error) {
-	out := &NetworkInterface{Name: interfaceName}
-	// This can happen if the network runtime information is missing - possible if the
-	// container was created by an old version of libcontainer.
-	if interfaceName == "" {
-		return out, nil
-	}
-	type netStatsPair struct {
-		// Where to write the output.
-		Out *uint64
-		// The network stats file to read.
-		File string
-	}
-	// Ingress for host veth is from the container. Hence tx_bytes stat on the host veth is actually number of bytes received by the container.
-	netStats := []netStatsPair{
-		{Out: &out.RxBytes, File: "tx_bytes"},
-		{Out: &out.RxPackets, File: "tx_packets"},
-		{Out: &out.RxErrors, File: "tx_errors"},
-		{Out: &out.RxDropped, File: "tx_dropped"},
-
-		{Out: &out.TxBytes, File: "rx_bytes"},
-		{Out: &out.TxPackets, File: "rx_packets"},
-		{Out: &out.TxErrors, File: "rx_errors"},
-		{Out: &out.TxDropped, File: "rx_dropped"},
-	}
-	for _, netStat := range netStats {
-		data, err := readSysfsNetworkStats(interfaceName, netStat.File)
-		if err != nil {
-			return nil, err
-		}
-		*(netStat.Out) = data
-	}
-	return out, nil
-}
-
-// Reads the specified statistics available under /sys/class/net/<EthInterface>/statistics
-func readSysfsNetworkStats(ethInterface, statsFile string) (uint64, error) {
-	data, err := ioutil.ReadFile(filepath.Join("/sys/class/net", ethInterface, "statistics", statsFile))
-	if err != nil {
-		return 0, err
-	}
-	return strconv.ParseUint(strings.TrimSpace(string(data)), 10, 64)
-}
-
-// loopback is a network strategy that provides a basic loopback device
-type loopback struct {
-}
-
-func (l *loopback) create(n *network, nspid int) error {
-	return nil
-}
-
-func (l *loopback) initialize(config *network) error {
-	return netlink.LinkSetUp(&netlink.Device{LinkAttrs: netlink.LinkAttrs{Name: "lo"}})
-}
-
-func (l *loopback) attach(n *configs.Network) (err error) {
-	return nil
-}
-
-func (l *loopback) detach(n *configs.Network) (err error) {
-	return nil
-}
-
-// veth is a network strategy that uses a bridge and creates
-// a veth pair, one that is attached to the bridge on the host and the other
-// is placed inside the container's namespace
-type veth struct {
-}
-
-func (v *veth) detach(n *configs.Network) (err error) {
-	return netlink.LinkSetMaster(&netlink.Device{LinkAttrs: netlink.LinkAttrs{Name: n.HostInterfaceName}}, nil)
-}
-
-// attach a container network interface to an external network
-func (v *veth) attach(n *configs.Network) (err error) {
-	brl, err := netlink.LinkByName(n.Bridge)
-	if err != nil {
-		return err
-	}
-	br, ok := brl.(*netlink.Bridge)
-	if !ok {
-		return fmt.Errorf("Wrong device type %T", brl)
-	}
-	host, err := netlink.LinkByName(n.HostInterfaceName)
-	if err != nil {
-		return err
-	}
-
-	if err := netlink.LinkSetMaster(host, br); err != nil {
-		return err
-	}
-	if err := netlink.LinkSetMTU(host, n.Mtu); err != nil {
-		return err
-	}
-	if n.HairpinMode {
-		if err := netlink.LinkSetHairpin(host, true); err != nil {
-			return err
-		}
-	}
-	if err := netlink.LinkSetUp(host); err != nil {
-		return err
-	}
-
-	return nil
-}
-
-func (v *veth) create(n *network, nspid int) (err error) {
-	tmpName, err := v.generateTempPeerName()
-	if err != nil {
-		return err
-	}
-	n.TempVethPeerName = tmpName
-	if n.Bridge == "" {
-		return fmt.Errorf("bridge is not specified")
-	}
-	veth := &netlink.Veth{
-		LinkAttrs: netlink.LinkAttrs{
-			Name:   n.HostInterfaceName,
-			TxQLen: n.TxQueueLen,
-		},
-		PeerName: n.TempVethPeerName,
-	}
-	if err := netlink.LinkAdd(veth); err != nil {
-		return err
-	}
-	defer func() {
-		if err != nil {
-			netlink.LinkDel(veth)
-		}
-	}()
-	if err := v.attach(&n.Network); err != nil {
-		return err
-	}
-	child, err := netlink.LinkByName(n.TempVethPeerName)
-	if err != nil {
-		return err
-	}
-	return netlink.LinkSetNsPid(child, nspid)
-}
-
-func (v *veth) generateTempPeerName() (string, error) {
-	return utils.GenerateRandomName("veth", 7)
-}
-
-func (v *veth) initialize(config *network) error {
-	peer := config.TempVethPeerName
-	if peer == "" {
-		return fmt.Errorf("peer is not specified")
-	}
-	child, err := netlink.LinkByName(peer)
-	if err != nil {
-		return err
-	}
-	if err := netlink.LinkSetDown(child); err != nil {
-		return err
-	}
-	if err := netlink.LinkSetName(child, config.Name); err != nil {
-		return err
-	}
-	// get the interface again after we changed the name as the index also changes.
-	if child, err = netlink.LinkByName(config.Name); err != nil {
-		return err
-	}
-	if config.MacAddress != "" {
-		mac, err := net.ParseMAC(config.MacAddress)
-		if err != nil {
-			return err
-		}
-		if err := netlink.LinkSetHardwareAddr(child, mac); err != nil {
-			return err
-		}
-	}
-	ip, err := netlink.ParseAddr(config.Address)
-	if err != nil {
-		return err
-	}
-	if err := netlink.AddrAdd(child, ip); err != nil {
-		return err
-	}
-	if config.IPv6Address != "" {
-		ip6, err := netlink.ParseAddr(config.IPv6Address)
-		if err != nil {
-			return err
-		}
-		if err := netlink.AddrAdd(child, ip6); err != nil {
-			return err
-		}
-	}
-	if err := netlink.LinkSetMTU(child, config.Mtu); err != nil {
-		return err
-	}
-	if err := netlink.LinkSetUp(child); err != nil {
-		return err
-	}
-	if config.Gateway != "" {
-		gw := net.ParseIP(config.Gateway)
-		if err := netlink.RouteAdd(&netlink.Route{
-			Scope:     netlink.SCOPE_UNIVERSE,
-			LinkIndex: child.Attrs().Index,
-			Gw:        gw,
-		}); err != nil {
-			return err
-		}
-	}
-	if config.IPv6Gateway != "" {
-		gw := net.ParseIP(config.IPv6Gateway)
-		if err := netlink.RouteAdd(&netlink.Route{
-			Scope:     netlink.SCOPE_UNIVERSE,
-			LinkIndex: child.Attrs().Index,
-			Gw:        gw,
-		}); err != nil {
-			return err
-		}
-	}
-	return nil
-}
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/notify_linux.go b/vendor/github.com/opencontainers/runc/libcontainer/notify_linux.go
deleted file mode 100644
index 47a06783d..000000000
--- a/vendor/github.com/opencontainers/runc/libcontainer/notify_linux.go
+++ /dev/null
@@ -1,90 +0,0 @@
-// +build linux
-
-package libcontainer
-
-import (
-	"fmt"
-	"io/ioutil"
-	"os"
-	"path/filepath"
-
-	"golang.org/x/sys/unix"
-)
-
-const oomCgroupName = "memory"
-
-type PressureLevel uint
-
-const (
-	LowPressure PressureLevel = iota
-	MediumPressure
-	CriticalPressure
-)
-
-func registerMemoryEvent(cgDir string, evName string, arg string) (<-chan struct{}, error) {
-	evFile, err := os.Open(filepath.Join(cgDir, evName))
-	if err != nil {
-		return nil, err
-	}
-	fd, err := unix.Eventfd(0, unix.EFD_CLOEXEC)
-	if err != nil {
-		evFile.Close()
-		return nil, err
-	}
-
-	eventfd := os.NewFile(uintptr(fd), "eventfd")
-
-	eventControlPath := filepath.Join(cgDir, "cgroup.event_control")
-	data := fmt.Sprintf("%d %d %s", eventfd.Fd(), evFile.Fd(), arg)
-	if err := ioutil.WriteFile(eventControlPath, []byte(data), 0700); err != nil {
-		eventfd.Close()
-		evFile.Close()
-		return nil, err
-	}
-	ch := make(chan struct{})
-	go func() {
-		defer func() {
-			eventfd.Close()
-			evFile.Close()
-			close(ch)
-		}()
-		buf := make([]byte, 8)
-		for {
-			if _, err := eventfd.Read(buf); err != nil {
-				return
-			}
-			// When a cgroup is destroyed, an event is sent to eventfd.
-			// So if the control path is gone, return instead of notifying.
-			if _, err := os.Lstat(eventControlPath); os.IsNotExist(err) {
-				return
-			}
-			ch <- struct{}{}
-		}
-	}()
-	return ch, nil
-}
-
-// notifyOnOOM returns channel on which you can expect event about OOM,
-// if process died without OOM this channel will be closed.
-func notifyOnOOM(paths map[string]string) (<-chan struct{}, error) {
-	dir := paths[oomCgroupName]
-	if dir == "" {
-		return nil, fmt.Errorf("path %q missing", oomCgroupName)
-	}
-
-	return registerMemoryEvent(dir, "memory.oom_control", "")
-}
-
-func notifyMemoryPressure(paths map[string]string, level PressureLevel) (<-chan struct{}, error) {
-	dir := paths[oomCgroupName]
-	if dir == "" {
-		return nil, fmt.Errorf("path %q missing", oomCgroupName)
-	}
-
-	if level > CriticalPressure {
-		return nil, fmt.Errorf("invalid pressure level %d", level)
-	}
-
-	levelStr := []string{"low", "medium", "critical"}[level]
-	return registerMemoryEvent(dir, "memory.pressure_level", levelStr)
-}
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/process.go b/vendor/github.com/opencontainers/runc/libcontainer/process.go
deleted file mode 100644
index 86bf7387f..000000000
--- a/vendor/github.com/opencontainers/runc/libcontainer/process.go
+++ /dev/null
@@ -1,110 +0,0 @@
-package libcontainer
-
-import (
-	"fmt"
-	"io"
-	"math"
-	"os"
-
-	"github.com/opencontainers/runc/libcontainer/configs"
-)
-
-type processOperations interface {
-	wait() (*os.ProcessState, error)
-	signal(sig os.Signal) error
-	pid() int
-}
-
-// Process specifies the configuration and IO for a process inside
-// a container.
-type Process struct {
-	// The command to be run followed by any arguments.
-	Args []string
-
-	// Env specifies the environment variables for the process.
-	Env []string
-
-	// User will set the uid and gid of the executing process running inside the container
-	// local to the container's user and group configuration.
-	User string
-
-	// AdditionalGroups specifies the gids that should be added to supplementary groups
-	// in addition to those that the user belongs to.
-	AdditionalGroups []string
-
-	// Cwd will change the processes current working directory inside the container's rootfs.
-	Cwd string
-
-	// Stdin is a pointer to a reader which provides the standard input stream.
-	Stdin io.Reader
-
-	// Stdout is a pointer to a writer which receives the standard output stream.
-	Stdout io.Writer
-
-	// Stderr is a pointer to a writer which receives the standard error stream.
-	Stderr io.Writer
-
-	// ExtraFiles specifies additional open files to be inherited by the container
-	ExtraFiles []*os.File
-
-	// Initial sizings for the console
-	ConsoleWidth  uint16
-	ConsoleHeight uint16
-
-	// Capabilities specify the capabilities to keep when executing the process inside the container
-	// All capabilities not specified will be dropped from the processes capability mask
-	Capabilities *configs.Capabilities
-
-	// AppArmorProfile specifies the profile to apply to the process and is
-	// changed at the time the process is execed
-	AppArmorProfile string
-
-	// Label specifies the label to apply to the process.  It is commonly used by selinux
-	Label string
-
-	// NoNewPrivileges controls whether processes can gain additional privileges.
-	NoNewPrivileges *bool
-
-	// Rlimits specifies the resource limits, such as max open files, to set in the container
-	// If Rlimits are not set, the container will inherit rlimits from the parent process
-	Rlimits []configs.Rlimit
-
-	// ConsoleSocket provides the masterfd console.
-	ConsoleSocket *os.File
-
-	ops processOperations
-}
-
-// Wait waits for the process to exit.
-// Wait releases any resources associated with the Process
-func (p Process) Wait() (*os.ProcessState, error) {
-	if p.ops == nil {
-		return nil, newGenericError(fmt.Errorf("invalid process"), NoProcessOps)
-	}
-	return p.ops.wait()
-}
-
-// Pid returns the process ID
-func (p Process) Pid() (int, error) {
-	// math.MinInt32 is returned here, because it's invalid value
-	// for the kill() system call.
-	if p.ops == nil {
-		return math.MinInt32, newGenericError(fmt.Errorf("invalid process"), NoProcessOps)
-	}
-	return p.ops.pid(), nil
-}
-
-// Signal sends a signal to the Process.
-func (p Process) Signal(sig os.Signal) error {
-	if p.ops == nil {
-		return newGenericError(fmt.Errorf("invalid process"), NoProcessOps)
-	}
-	return p.ops.signal(sig)
-}
-
-// IO holds the process's STDIO
-type IO struct {
-	Stdin  io.WriteCloser
-	Stdout io.ReadCloser
-	Stderr io.ReadCloser
-}
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/process_linux.go b/vendor/github.com/opencontainers/runc/libcontainer/process_linux.go
deleted file mode 100644
index 58980b059..000000000
--- a/vendor/github.com/opencontainers/runc/libcontainer/process_linux.go
+++ /dev/null
@@ -1,547 +0,0 @@
-// +build linux
-
-package libcontainer
-
-import (
-	"encoding/json"
-	"errors"
-	"fmt"
-	"io"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"strconv"
-	"syscall" // only for Signal
-
-	"github.com/opencontainers/runc/libcontainer/cgroups"
-	"github.com/opencontainers/runc/libcontainer/configs"
-	"github.com/opencontainers/runc/libcontainer/intelrdt"
-	"github.com/opencontainers/runc/libcontainer/system"
-	"github.com/opencontainers/runc/libcontainer/utils"
-
-	"golang.org/x/sys/unix"
-)
-
-type parentProcess interface {
-	// pid returns the pid for the running process.
-	pid() int
-
-	// start starts the process execution.
-	start() error
-
-	// send a SIGKILL to the process and wait for the exit.
-	terminate() error
-
-	// wait waits on the process returning the process state.
-	wait() (*os.ProcessState, error)
-
-	// startTime returns the process start time.
-	startTime() (uint64, error)
-
-	signal(os.Signal) error
-
-	externalDescriptors() []string
-
-	setExternalDescriptors(fds []string)
-}
-
-type setnsProcess struct {
-	cmd           *exec.Cmd
-	parentPipe    *os.File
-	childPipe     *os.File
-	cgroupPaths   map[string]string
-	intelRdtPath  string
-	config        *initConfig
-	fds           []string
-	process       *Process
-	bootstrapData io.Reader
-}
-
-func (p *setnsProcess) startTime() (uint64, error) {
-	stat, err := system.Stat(p.pid())
-	return stat.StartTime, err
-}
-
-func (p *setnsProcess) signal(sig os.Signal) error {
-	s, ok := sig.(syscall.Signal)
-	if !ok {
-		return errors.New("os: unsupported signal type")
-	}
-	return unix.Kill(p.pid(), s)
-}
-
-func (p *setnsProcess) start() (err error) {
-	defer p.parentPipe.Close()
-	err = p.cmd.Start()
-	p.childPipe.Close()
-	if err != nil {
-		return newSystemErrorWithCause(err, "starting setns process")
-	}
-	if p.bootstrapData != nil {
-		if _, err := io.Copy(p.parentPipe, p.bootstrapData); err != nil {
-			return newSystemErrorWithCause(err, "copying bootstrap data to pipe")
-		}
-	}
-	if err = p.execSetns(); err != nil {
-		return newSystemErrorWithCause(err, "executing setns process")
-	}
-	if len(p.cgroupPaths) > 0 {
-		if err := cgroups.EnterPid(p.cgroupPaths, p.pid()); err != nil {
-			return newSystemErrorWithCausef(err, "adding pid %d to cgroups", p.pid())
-		}
-	}
-	if p.intelRdtPath != "" {
-		// if Intel RDT "resource control" filesystem path exists
-		_, err := os.Stat(p.intelRdtPath)
-		if err == nil {
-			if err := intelrdt.WriteIntelRdtTasks(p.intelRdtPath, p.pid()); err != nil {
-				return newSystemErrorWithCausef(err, "adding pid %d to Intel RDT resource control filesystem", p.pid())
-			}
-		}
-	}
-	// set rlimits, this has to be done here because we lose permissions
-	// to raise the limits once we enter a user-namespace
-	if err := setupRlimits(p.config.Rlimits, p.pid()); err != nil {
-		return newSystemErrorWithCause(err, "setting rlimits for process")
-	}
-	if err := utils.WriteJSON(p.parentPipe, p.config); err != nil {
-		return newSystemErrorWithCause(err, "writing config to pipe")
-	}
-
-	ierr := parseSync(p.parentPipe, func(sync *syncT) error {
-		switch sync.Type {
-		case procReady:
-			// This shouldn't happen.
-			panic("unexpected procReady in setns")
-		case procHooks:
-			// This shouldn't happen.
-			panic("unexpected procHooks in setns")
-		default:
-			return newSystemError(fmt.Errorf("invalid JSON payload from child"))
-		}
-	})
-
-	if err := unix.Shutdown(int(p.parentPipe.Fd()), unix.SHUT_WR); err != nil {
-		return newSystemErrorWithCause(err, "calling shutdown on init pipe")
-	}
-	// Must be done after Shutdown so the child will exit and we can wait for it.
-	if ierr != nil {
-		p.wait()
-		return ierr
-	}
-	return nil
-}
-
-// execSetns runs the process that executes C code to perform the setns calls
-// because setns support requires the C process to fork off a child and perform the setns
-// before the go runtime boots, we wait on the process to die and receive the child's pid
-// over the provided pipe.
-func (p *setnsProcess) execSetns() error {
-	status, err := p.cmd.Process.Wait()
-	if err != nil {
-		p.cmd.Wait()
-		return newSystemErrorWithCause(err, "waiting on setns process to finish")
-	}
-	if !status.Success() {
-		p.cmd.Wait()
-		return newSystemError(&exec.ExitError{ProcessState: status})
-	}
-	var pid *pid
-	if err := json.NewDecoder(p.parentPipe).Decode(&pid); err != nil {
-		p.cmd.Wait()
-		return newSystemErrorWithCause(err, "reading pid from init pipe")
-	}
-
-	// Clean up the zombie parent process
-	firstChildProcess, err := os.FindProcess(pid.PidFirstChild)
-	if err != nil {
-		return err
-	}
-
-	// Ignore the error in case the child has already been reaped for any reason
-	_, _ = firstChildProcess.Wait()
-
-	process, err := os.FindProcess(pid.Pid)
-	if err != nil {
-		return err
-	}
-	p.cmd.Process = process
-	p.process.ops = p
-	return nil
-}
-
-// terminate sends a SIGKILL to the forked process for the setns routine then waits to
-// avoid the process becoming a zombie.
-func (p *setnsProcess) terminate() error {
-	if p.cmd.Process == nil {
-		return nil
-	}
-	err := p.cmd.Process.Kill()
-	if _, werr := p.wait(); err == nil {
-		err = werr
-	}
-	return err
-}
-
-func (p *setnsProcess) wait() (*os.ProcessState, error) {
-	err := p.cmd.Wait()
-
-	// Return actual ProcessState even on Wait error
-	return p.cmd.ProcessState, err
-}
-
-func (p *setnsProcess) pid() int {
-	return p.cmd.Process.Pid
-}
-
-func (p *setnsProcess) externalDescriptors() []string {
-	return p.fds
-}
-
-func (p *setnsProcess) setExternalDescriptors(newFds []string) {
-	p.fds = newFds
-}
-
-type initProcess struct {
-	cmd             *exec.Cmd
-	parentPipe      *os.File
-	childPipe       *os.File
-	config          *initConfig
-	manager         cgroups.Manager
-	intelRdtManager intelrdt.Manager
-	container       *linuxContainer
-	fds             []string
-	process         *Process
-	bootstrapData   io.Reader
-	sharePidns      bool
-}
-
-func (p *initProcess) pid() int {
-	return p.cmd.Process.Pid
-}
-
-func (p *initProcess) externalDescriptors() []string {
-	return p.fds
-}
-
-// execSetns runs the process that executes C code to perform the setns calls
-// because setns support requires the C process to fork off a child and perform the setns
-// before the go runtime boots, we wait on the process to die and receive the child's pid
-// over the provided pipe.
-// This is called by initProcess.start function
-func (p *initProcess) execSetns() error {
-	status, err := p.cmd.Process.Wait()
-	if err != nil {
-		p.cmd.Wait()
-		return err
-	}
-	if !status.Success() {
-		p.cmd.Wait()
-		return &exec.ExitError{ProcessState: status}
-	}
-	var pid *pid
-	if err := json.NewDecoder(p.parentPipe).Decode(&pid); err != nil {
-		p.cmd.Wait()
-		return err
-	}
-
-	// Clean up the zombie parent process
-	firstChildProcess, err := os.FindProcess(pid.PidFirstChild)
-	if err != nil {
-		return err
-	}
-
-	// Ignore the error in case the child has already been reaped for any reason
-	_, _ = firstChildProcess.Wait()
-
-	process, err := os.FindProcess(pid.Pid)
-	if err != nil {
-		return err
-	}
-	p.cmd.Process = process
-	p.process.ops = p
-	return nil
-}
-
-func (p *initProcess) start() error {
-	defer p.parentPipe.Close()
-	err := p.cmd.Start()
-	p.process.ops = p
-	p.childPipe.Close()
-	if err != nil {
-		p.process.ops = nil
-		return newSystemErrorWithCause(err, "starting init process command")
-	}
-	// Do this before syncing with child so that no children can escape the
-	// cgroup. We don't need to worry about not doing this and not being root
-	// because we'd be using the rootless cgroup manager in that case.
-	if err := p.manager.Apply(p.pid()); err != nil {
-		return newSystemErrorWithCause(err, "applying cgroup configuration for process")
-	}
-	if p.intelRdtManager != nil {
-		if err := p.intelRdtManager.Apply(p.pid()); err != nil {
-			return newSystemErrorWithCause(err, "applying Intel RDT configuration for process")
-		}
-	}
-	defer func() {
-		if err != nil {
-			// TODO: should not be the responsibility to call here
-			p.manager.Destroy()
-			if p.intelRdtManager != nil {
-				p.intelRdtManager.Destroy()
-			}
-		}
-	}()
-
-	if _, err := io.Copy(p.parentPipe, p.bootstrapData); err != nil {
-		return newSystemErrorWithCause(err, "copying bootstrap data to pipe")
-	}
-
-	if err := p.execSetns(); err != nil {
-		return newSystemErrorWithCause(err, "running exec setns process for init")
-	}
-
-	// Save the standard descriptor names before the container process
-	// can potentially move them (e.g., via dup2()).  If we don't do this now,
-	// we won't know at checkpoint time which file descriptor to look up.
-	fds, err := getPipeFds(p.pid())
-	if err != nil {
-		return newSystemErrorWithCausef(err, "getting pipe fds for pid %d", p.pid())
-	}
-	p.setExternalDescriptors(fds)
-	if err := p.createNetworkInterfaces(); err != nil {
-		return newSystemErrorWithCause(err, "creating network interfaces")
-	}
-	if err := p.sendConfig(); err != nil {
-		return newSystemErrorWithCause(err, "sending config to init process")
-	}
-	var (
-		sentRun    bool
-		sentResume bool
-	)
-
-	ierr := parseSync(p.parentPipe, func(sync *syncT) error {
-		switch sync.Type {
-		case procReady:
-			// set rlimits, this has to be done here because we lose permissions
-			// to raise the limits once we enter a user-namespace
-			if err := setupRlimits(p.config.Rlimits, p.pid()); err != nil {
-				return newSystemErrorWithCause(err, "setting rlimits for ready process")
-			}
-			// call prestart hooks
-			if !p.config.Config.Namespaces.Contains(configs.NEWNS) {
-				// Setup cgroup before prestart hook, so that the prestart hook could apply cgroup permissions.
-				if err := p.manager.Set(p.config.Config); err != nil {
-					return newSystemErrorWithCause(err, "setting cgroup config for ready process")
-				}
-				if p.intelRdtManager != nil {
-					if err := p.intelRdtManager.Set(p.config.Config); err != nil {
-						return newSystemErrorWithCause(err, "setting Intel RDT config for ready process")
-					}
-				}
-
-				if p.config.Config.Hooks != nil {
-					bundle, annotations := utils.Annotations(p.container.config.Labels)
-					s := configs.HookState{
-						Version:     p.container.config.Version,
-						ID:          p.container.id,
-						Pid:         p.pid(),
-						Bundle:      bundle,
-						Annotations: annotations,
-					}
-					for i, hook := range p.config.Config.Hooks.Prestart {
-						if err := hook.Run(s); err != nil {
-							return newSystemErrorWithCausef(err, "running prestart hook %d", i)
-						}
-					}
-				}
-			}
-			// Sync with child.
-			if err := writeSync(p.parentPipe, procRun); err != nil {
-				return newSystemErrorWithCause(err, "writing syncT 'run'")
-			}
-			sentRun = true
-		case procHooks:
-			// Setup cgroup before prestart hook, so that the prestart hook could apply cgroup permissions.
-			if err := p.manager.Set(p.config.Config); err != nil {
-				return newSystemErrorWithCause(err, "setting cgroup config for procHooks process")
-			}
-			if p.intelRdtManager != nil {
-				if err := p.intelRdtManager.Set(p.config.Config); err != nil {
-					return newSystemErrorWithCause(err, "setting Intel RDT config for procHooks process")
-				}
-			}
-			if p.config.Config.Hooks != nil {
-				bundle, annotations := utils.Annotations(p.container.config.Labels)
-				s := configs.HookState{
-					Version:     p.container.config.Version,
-					ID:          p.container.id,
-					Pid:         p.pid(),
-					Bundle:      bundle,
-					Annotations: annotations,
-				}
-				for i, hook := range p.config.Config.Hooks.Prestart {
-					if err := hook.Run(s); err != nil {
-						return newSystemErrorWithCausef(err, "running prestart hook %d", i)
-					}
-				}
-			}
-			// Sync with child.
-			if err := writeSync(p.parentPipe, procResume); err != nil {
-				return newSystemErrorWithCause(err, "writing syncT 'resume'")
-			}
-			sentResume = true
-		default:
-			return newSystemError(fmt.Errorf("invalid JSON payload from child"))
-		}
-
-		return nil
-	})
-
-	if !sentRun {
-		return newSystemErrorWithCause(ierr, "container init")
-	}
-	if p.config.Config.Namespaces.Contains(configs.NEWNS) && !sentResume {
-		return newSystemError(fmt.Errorf("could not synchronise after executing prestart hooks with container process"))
-	}
-	if err := unix.Shutdown(int(p.parentPipe.Fd()), unix.SHUT_WR); err != nil {
-		return newSystemErrorWithCause(err, "shutting down init pipe")
-	}
-
-	// Must be done after Shutdown so the child will exit and we can wait for it.
-	if ierr != nil {
-		p.wait()
-		return ierr
-	}
-	return nil
-}
-
-func (p *initProcess) wait() (*os.ProcessState, error) {
-	err := p.cmd.Wait()
-	if err != nil {
-		return p.cmd.ProcessState, err
-	}
-	// we should kill all processes in cgroup when init is died if we use host PID namespace
-	if p.sharePidns {
-		signalAllProcesses(p.manager, unix.SIGKILL)
-	}
-	return p.cmd.ProcessState, nil
-}
-
-func (p *initProcess) terminate() error {
-	if p.cmd.Process == nil {
-		return nil
-	}
-	err := p.cmd.Process.Kill()
-	if _, werr := p.wait(); err == nil {
-		err = werr
-	}
-	return err
-}
-
-func (p *initProcess) startTime() (uint64, error) {
-	stat, err := system.Stat(p.pid())
-	return stat.StartTime, err
-}
-
-func (p *initProcess) sendConfig() error {
-	// send the config to the container's init process, we don't use JSON Encode
-	// here because there might be a problem in JSON decoder in some cases, see:
-	// https://github.com/docker/docker/issues/14203#issuecomment-174177790
-	return utils.WriteJSON(p.parentPipe, p.config)
-}
-
-func (p *initProcess) createNetworkInterfaces() error {
-	for _, config := range p.config.Config.Networks {
-		strategy, err := getStrategy(config.Type)
-		if err != nil {
-			return err
-		}
-		n := &network{
-			Network: *config,
-		}
-		if err := strategy.create(n, p.pid()); err != nil {
-			return err
-		}
-		p.config.Networks = append(p.config.Networks, n)
-	}
-	return nil
-}
-
-func (p *initProcess) signal(sig os.Signal) error {
-	s, ok := sig.(syscall.Signal)
-	if !ok {
-		return errors.New("os: unsupported signal type")
-	}
-	return unix.Kill(p.pid(), s)
-}
-
-func (p *initProcess) setExternalDescriptors(newFds []string) {
-	p.fds = newFds
-}
-
-func getPipeFds(pid int) ([]string, error) {
-	fds := make([]string, 3)
-
-	dirPath := filepath.Join("/proc", strconv.Itoa(pid), "/fd")
-	for i := 0; i < 3; i++ {
-		// XXX: This breaks if the path is not a valid symlink (which can
-		//      happen in certain particularly unlucky mount namespace setups).
-		f := filepath.Join(dirPath, strconv.Itoa(i))
-		target, err := os.Readlink(f)
-		if err != nil {
-			// Ignore permission errors, for rootless containers and other
-			// non-dumpable processes. if we can't get the fd for a particular
-			// file, there's not much we can do.
-			if os.IsPermission(err) {
-				continue
-			}
-			return fds, err
-		}
-		fds[i] = target
-	}
-	return fds, nil
-}
-
-// InitializeIO creates pipes for use with the process's stdio and returns the
-// opposite side for each. Do not use this if you want to have a pseudoterminal
-// set up for you by libcontainer (TODO: fix that too).
-// TODO: This is mostly unnecessary, and should be handled by clients.
-func (p *Process) InitializeIO(rootuid, rootgid int) (i *IO, err error) {
-	var fds []uintptr
-	i = &IO{}
-	// cleanup in case of an error
-	defer func() {
-		if err != nil {
-			for _, fd := range fds {
-				unix.Close(int(fd))
-			}
-		}
-	}()
-	// STDIN
-	r, w, err := os.Pipe()
-	if err != nil {
-		return nil, err
-	}
-	fds = append(fds, r.Fd(), w.Fd())
-	p.Stdin, i.Stdin = r, w
-	// STDOUT
-	if r, w, err = os.Pipe(); err != nil {
-		return nil, err
-	}
-	fds = append(fds, r.Fd(), w.Fd())
-	p.Stdout, i.Stdout = w, r
-	// STDERR
-	if r, w, err = os.Pipe(); err != nil {
-		return nil, err
-	}
-	fds = append(fds, r.Fd(), w.Fd())
-	p.Stderr, i.Stderr = w, r
-	// change ownership of the pipes incase we are in a user namespace
-	for _, fd := range fds {
-		if err := unix.Fchown(int(fd), rootuid, rootgid); err != nil {
-			return nil, err
-		}
-	}
-	return i, nil
-}
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/restored_process.go b/vendor/github.com/opencontainers/runc/libcontainer/restored_process.go
deleted file mode 100644
index 408916ad9..000000000
--- a/vendor/github.com/opencontainers/runc/libcontainer/restored_process.go
+++ /dev/null
@@ -1,122 +0,0 @@
-// +build linux
-
-package libcontainer
-
-import (
-	"fmt"
-	"os"
-
-	"github.com/opencontainers/runc/libcontainer/system"
-)
-
-func newRestoredProcess(pid int, fds []string) (*restoredProcess, error) {
-	var (
-		err error
-	)
-	proc, err := os.FindProcess(pid)
-	if err != nil {
-		return nil, err
-	}
-	stat, err := system.Stat(pid)
-	if err != nil {
-		return nil, err
-	}
-	return &restoredProcess{
-		proc:             proc,
-		processStartTime: stat.StartTime,
-		fds:              fds,
-	}, nil
-}
-
-type restoredProcess struct {
-	proc             *os.Process
-	processStartTime uint64
-	fds              []string
-}
-
-func (p *restoredProcess) start() error {
-	return newGenericError(fmt.Errorf("restored process cannot be started"), SystemError)
-}
-
-func (p *restoredProcess) pid() int {
-	return p.proc.Pid
-}
-
-func (p *restoredProcess) terminate() error {
-	err := p.proc.Kill()
-	if _, werr := p.wait(); err == nil {
-		err = werr
-	}
-	return err
-}
-
-func (p *restoredProcess) wait() (*os.ProcessState, error) {
-	// TODO: how do we wait on the actual process?
-	// maybe use --exec-cmd in criu
-	st, err := p.proc.Wait()
-	if err != nil {
-		return nil, err
-	}
-	return st, nil
-}
-
-func (p *restoredProcess) startTime() (uint64, error) {
-	return p.processStartTime, nil
-}
-
-func (p *restoredProcess) signal(s os.Signal) error {
-	return p.proc.Signal(s)
-}
-
-func (p *restoredProcess) externalDescriptors() []string {
-	return p.fds
-}
-
-func (p *restoredProcess) setExternalDescriptors(newFds []string) {
-	p.fds = newFds
-}
-
-// nonChildProcess represents a process where the calling process is not
-// the parent process.  This process is created when a factory loads a container from
-// a persisted state.
-type nonChildProcess struct {
-	processPid       int
-	processStartTime uint64
-	fds              []string
-}
-
-func (p *nonChildProcess) start() error {
-	return newGenericError(fmt.Errorf("restored process cannot be started"), SystemError)
-}
-
-func (p *nonChildProcess) pid() int {
-	return p.processPid
-}
-
-func (p *nonChildProcess) terminate() error {
-	return newGenericError(fmt.Errorf("restored process cannot be terminated"), SystemError)
-}
-
-func (p *nonChildProcess) wait() (*os.ProcessState, error) {
-	return nil, newGenericError(fmt.Errorf("restored process cannot be waited on"), SystemError)
-}
-
-func (p *nonChildProcess) startTime() (uint64, error) {
-	return p.processStartTime, nil
-}
-
-func (p *nonChildProcess) signal(s os.Signal) error {
-	proc, err := os.FindProcess(p.processPid)
-	if err != nil {
-		return err
-	}
-	return proc.Signal(s)
-}
-
-func (p *nonChildProcess) externalDescriptors() []string {
-	return p.fds
-}
-
-func (p *nonChildProcess) setExternalDescriptors(newFds []string) {
-	p.fds = newFds
-}
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/rootfs_linux.go b/vendor/github.com/opencontainers/runc/libcontainer/rootfs_linux.go
deleted file mode 100644
index 73ee2bd69..000000000
--- a/vendor/github.com/opencontainers/runc/libcontainer/rootfs_linux.go
+++ /dev/null
@@ -1,838 +0,0 @@
-// +build linux
-
-package libcontainer
-
-import (
-	"fmt"
-	"io"
-	"io/ioutil"
-	"os"
-	"os/exec"
-	"path"
-	"path/filepath"
-	"strings"
-	"time"
-
-	"github.com/cyphar/filepath-securejoin"
-	"github.com/mrunalp/fileutils"
-	"github.com/opencontainers/runc/libcontainer/cgroups"
-	"github.com/opencontainers/runc/libcontainer/configs"
-	"github.com/opencontainers/runc/libcontainer/mount"
-	"github.com/opencontainers/runc/libcontainer/system"
-	libcontainerUtils "github.com/opencontainers/runc/libcontainer/utils"
-	"github.com/opencontainers/selinux/go-selinux/label"
-
-	"golang.org/x/sys/unix"
-)
-
-const defaultMountFlags = unix.MS_NOEXEC | unix.MS_NOSUID | unix.MS_NODEV
-
-// needsSetupDev returns true if /dev needs to be set up.
-func needsSetupDev(config *configs.Config) bool {
-	for _, m := range config.Mounts {
-		if m.Device == "bind" && libcontainerUtils.CleanPath(m.Destination) == "/dev" {
-			return false
-		}
-	}
-	return true
-}
-
-// prepareRootfs sets up the devices, mount points, and filesystems for use
-// inside a new mount namespace. It doesn't set anything as ro. You must call
-// finalizeRootfs after this function to finish setting up the rootfs.
-func prepareRootfs(pipe io.ReadWriter, iConfig *initConfig) (err error) {
-	config := iConfig.Config
-	if err := prepareRoot(config); err != nil {
-		return newSystemErrorWithCause(err, "preparing rootfs")
-	}
-
-	setupDev := needsSetupDev(config)
-	for _, m := range config.Mounts {
-		for _, precmd := range m.PremountCmds {
-			if err := mountCmd(precmd); err != nil {
-				return newSystemErrorWithCause(err, "running premount command")
-			}
-		}
-
-		if err := mountToRootfs(m, config.Rootfs, config.MountLabel); err != nil {
-			return newSystemErrorWithCausef(err, "mounting %q to rootfs %q at %q", m.Source, config.Rootfs, m.Destination)
-		}
-
-		for _, postcmd := range m.PostmountCmds {
-			if err := mountCmd(postcmd); err != nil {
-				return newSystemErrorWithCause(err, "running postmount command")
-			}
-		}
-	}
-
-	if setupDev {
-		if err := createDevices(config); err != nil {
-			return newSystemErrorWithCause(err, "creating device nodes")
-		}
-		if err := setupPtmx(config); err != nil {
-			return newSystemErrorWithCause(err, "setting up ptmx")
-		}
-		if err := setupDevSymlinks(config.Rootfs); err != nil {
-			return newSystemErrorWithCause(err, "setting up /dev symlinks")
-		}
-	}
-
-	// Signal the parent to run the pre-start hooks.
-	// The hooks are run after the mounts are setup, but before we switch to the new
-	// root, so that the old root is still available in the hooks for any mount
-	// manipulations.
-	// Note that iConfig.Cwd is not guaranteed to exist here.
-	if err := syncParentHooks(pipe); err != nil {
-		return err
-	}
-
-	// The reason these operations are done here rather than in finalizeRootfs
-	// is because the console-handling code gets quite sticky if we have to set
-	// up the console before doing the pivot_root(2). This is because the
-	// Console API has to also work with the ExecIn case, which means that the
-	// API must be able to deal with being inside as well as outside the
-	// container. It's just cleaner to do this here (at the expense of the
-	// operation not being perfectly split).
-
-	if err := unix.Chdir(config.Rootfs); err != nil {
-		return newSystemErrorWithCausef(err, "changing dir to %q", config.Rootfs)
-	}
-
-	if config.NoPivotRoot {
-		err = msMoveRoot(config.Rootfs)
-	} else if config.Namespaces.Contains(configs.NEWNS) {
-		err = pivotRoot(config.Rootfs)
-	} else {
-		err = chroot(config.Rootfs)
-	}
-	if err != nil {
-		return newSystemErrorWithCause(err, "jailing process inside rootfs")
-	}
-
-	if setupDev {
-		if err := reOpenDevNull(); err != nil {
-			return newSystemErrorWithCause(err, "reopening /dev/null inside container")
-		}
-	}
-
-	if cwd := iConfig.Cwd; cwd != "" {
-		// Note that spec.Process.Cwd can contain unclean value like  "../../../../foo/bar...".
-		// However, we are safe to call MkDirAll directly because we are in the jail here.
-		if err := os.MkdirAll(cwd, 0755); err != nil {
-			return err
-		}
-	}
-
-	return nil
-}
-
-// finalizeRootfs sets anything to ro if necessary. You must call
-// prepareRootfs first.
-func finalizeRootfs(config *configs.Config) (err error) {
-	// remount dev as ro if specified
-	for _, m := range config.Mounts {
-		if libcontainerUtils.CleanPath(m.Destination) == "/dev" {
-			if m.Flags&unix.MS_RDONLY == unix.MS_RDONLY {
-				if err := remountReadonly(m); err != nil {
-					return newSystemErrorWithCausef(err, "remounting %q as readonly", m.Destination)
-				}
-			}
-			break
-		}
-	}
-
-	// set rootfs ( / ) as readonly
-	if config.Readonlyfs {
-		if err := setReadonly(); err != nil {
-			return newSystemErrorWithCause(err, "setting rootfs as readonly")
-		}
-	}
-
-	unix.Umask(0022)
-	return nil
-}
-
-func mountCmd(cmd configs.Command) error {
-	command := exec.Command(cmd.Path, cmd.Args[:]...)
-	command.Env = cmd.Env
-	command.Dir = cmd.Dir
-	if out, err := command.CombinedOutput(); err != nil {
-		return fmt.Errorf("%#v failed: %s: %v", cmd, string(out), err)
-	}
-	return nil
-}
-
-func mountToRootfs(m *configs.Mount, rootfs, mountLabel string) error {
-	var (
-		dest = m.Destination
-	)
-	if !strings.HasPrefix(dest, rootfs) {
-		dest = filepath.Join(rootfs, dest)
-	}
-
-	switch m.Device {
-	case "proc", "sysfs":
-		if err := os.MkdirAll(dest, 0755); err != nil {
-			return err
-		}
-		// Selinux kernels do not support labeling of /proc or /sys
-		return mountPropagate(m, rootfs, "")
-	case "mqueue":
-		if err := os.MkdirAll(dest, 0755); err != nil {
-			return err
-		}
-		if err := mountPropagate(m, rootfs, mountLabel); err != nil {
-			// older kernels do not support labeling of /dev/mqueue
-			if err := mountPropagate(m, rootfs, ""); err != nil {
-				return err
-			}
-			return label.SetFileLabel(dest, mountLabel)
-		}
-		return nil
-	case "tmpfs":
-		copyUp := m.Extensions&configs.EXT_COPYUP == configs.EXT_COPYUP
-		tmpDir := ""
-		stat, err := os.Stat(dest)
-		if err != nil {
-			if err := os.MkdirAll(dest, 0755); err != nil {
-				return err
-			}
-		}
-		if copyUp {
-			tmpDir, err = ioutil.TempDir("/tmp", "runctmpdir")
-			if err != nil {
-				return newSystemErrorWithCause(err, "tmpcopyup: failed to create tmpdir")
-			}
-			defer os.RemoveAll(tmpDir)
-			m.Destination = tmpDir
-		}
-		if err := mountPropagate(m, rootfs, mountLabel); err != nil {
-			return err
-		}
-		if copyUp {
-			if err := fileutils.CopyDirectory(dest, tmpDir); err != nil {
-				errMsg := fmt.Errorf("tmpcopyup: failed to copy %s to %s: %v", dest, tmpDir, err)
-				if err1 := unix.Unmount(tmpDir, unix.MNT_DETACH); err1 != nil {
-					return newSystemErrorWithCausef(err1, "tmpcopyup: %v: failed to unmount", errMsg)
-				}
-				return errMsg
-			}
-			if err := unix.Mount(tmpDir, dest, "", unix.MS_MOVE, ""); err != nil {
-				errMsg := fmt.Errorf("tmpcopyup: failed to move mount %s to %s: %v", tmpDir, dest, err)
-				if err1 := unix.Unmount(tmpDir, unix.MNT_DETACH); err1 != nil {
-					return newSystemErrorWithCausef(err1, "tmpcopyup: %v: failed to unmount", errMsg)
-				}
-				return errMsg
-			}
-		}
-		if stat != nil {
-			if err = os.Chmod(dest, stat.Mode()); err != nil {
-				return err
-			}
-		}
-		return nil
-	case "bind":
-		stat, err := os.Stat(m.Source)
-		if err != nil {
-			// error out if the source of a bind mount does not exist as we will be
-			// unable to bind anything to it.
-			return err
-		}
-		// ensure that the destination of the bind mount is resolved of symlinks at mount time because
-		// any previous mounts can invalidate the next mount's destination.
-		// this can happen when a user specifies mounts within other mounts to cause breakouts or other
-		// evil stuff to try to escape the container's rootfs.
-		if dest, err = securejoin.SecureJoin(rootfs, m.Destination); err != nil {
-			return err
-		}
-		if err := checkMountDestination(rootfs, dest); err != nil {
-			return err
-		}
-		// update the mount with the correct dest after symlinks are resolved.
-		m.Destination = dest
-		if err := createIfNotExists(dest, stat.IsDir()); err != nil {
-			return err
-		}
-		if err := mountPropagate(m, rootfs, mountLabel); err != nil {
-			return err
-		}
-		// bind mount won't change mount options, we need remount to make mount options effective.
-		// first check that we have non-default options required before attempting a remount
-		if m.Flags&^(unix.MS_REC|unix.MS_REMOUNT|unix.MS_BIND) != 0 {
-			// only remount if unique mount options are set
-			if err := remount(m, rootfs); err != nil {
-				return err
-			}
-		}
-
-		if m.Relabel != "" {
-			if err := label.Validate(m.Relabel); err != nil {
-				return err
-			}
-			shared := label.IsShared(m.Relabel)
-			if err := label.Relabel(m.Source, mountLabel, shared); err != nil {
-				return err
-			}
-		}
-	case "cgroup":
-		binds, err := getCgroupMounts(m)
-		if err != nil {
-			return err
-		}
-		var merged []string
-		for _, b := range binds {
-			ss := filepath.Base(b.Destination)
-			if strings.Contains(ss, ",") {
-				merged = append(merged, ss)
-			}
-		}
-		tmpfs := &configs.Mount{
-			Source:           "tmpfs",
-			Device:           "tmpfs",
-			Destination:      m.Destination,
-			Flags:            defaultMountFlags,
-			Data:             "mode=755",
-			PropagationFlags: m.PropagationFlags,
-		}
-		if err := mountToRootfs(tmpfs, rootfs, mountLabel); err != nil {
-			return err
-		}
-		for _, b := range binds {
-			if err := mountToRootfs(b, rootfs, mountLabel); err != nil {
-				return err
-			}
-		}
-		for _, mc := range merged {
-			for _, ss := range strings.Split(mc, ",") {
-				// symlink(2) is very dumb, it will just shove the path into
-				// the link and doesn't do any checks or relative path
-				// conversion. Also, don't error out if the cgroup already exists.
-				if err := os.Symlink(mc, filepath.Join(rootfs, m.Destination, ss)); err != nil && !os.IsExist(err) {
-					return err
-				}
-			}
-		}
-		if m.Flags&unix.MS_RDONLY != 0 {
-			// remount cgroup root as readonly
-			mcgrouproot := &configs.Mount{
-				Source:      m.Destination,
-				Device:      "bind",
-				Destination: m.Destination,
-				Flags:       defaultMountFlags | unix.MS_RDONLY | unix.MS_BIND,
-			}
-			if err := remount(mcgrouproot, rootfs); err != nil {
-				return err
-			}
-		}
-	default:
-		// ensure that the destination of the mount is resolved of symlinks at mount time because
-		// any previous mounts can invalidate the next mount's destination.
-		// this can happen when a user specifies mounts within other mounts to cause breakouts or other
-		// evil stuff to try to escape the container's rootfs.
-		var err error
-		if dest, err = securejoin.SecureJoin(rootfs, m.Destination); err != nil {
-			return err
-		}
-		if err := checkMountDestination(rootfs, dest); err != nil {
-			return err
-		}
-		// update the mount with the correct dest after symlinks are resolved.
-		m.Destination = dest
-		if err := os.MkdirAll(dest, 0755); err != nil {
-			return err
-		}
-		return mountPropagate(m, rootfs, mountLabel)
-	}
-	return nil
-}
-
-func getCgroupMounts(m *configs.Mount) ([]*configs.Mount, error) {
-	mounts, err := cgroups.GetCgroupMounts(false)
-	if err != nil {
-		return nil, err
-	}
-
-	cgroupPaths, err := cgroups.ParseCgroupFile("/proc/self/cgroup")
-	if err != nil {
-		return nil, err
-	}
-
-	var binds []*configs.Mount
-
-	for _, mm := range mounts {
-		dir, err := mm.GetOwnCgroup(cgroupPaths)
-		if err != nil {
-			return nil, err
-		}
-		relDir, err := filepath.Rel(mm.Root, dir)
-		if err != nil {
-			return nil, err
-		}
-		binds = append(binds, &configs.Mount{
-			Device:           "bind",
-			Source:           filepath.Join(mm.Mountpoint, relDir),
-			Destination:      filepath.Join(m.Destination, filepath.Base(mm.Mountpoint)),
-			Flags:            unix.MS_BIND | unix.MS_REC | m.Flags,
-			PropagationFlags: m.PropagationFlags,
-		})
-	}
-
-	return binds, nil
-}
-
-// checkMountDestination checks to ensure that the mount destination is not over the top of /proc.
-// dest is required to be an abs path and have any symlinks resolved before calling this function.
-func checkMountDestination(rootfs, dest string) error {
-	invalidDestinations := []string{
-		"/proc",
-	}
-	// White list, it should be sub directories of invalid destinations
-	validDestinations := []string{
-		// These entries can be bind mounted by files emulated by fuse,
-		// so commands like top, free displays stats in container.
-		"/proc/cpuinfo",
-		"/proc/diskstats",
-		"/proc/meminfo",
-		"/proc/stat",
-		"/proc/swaps",
-		"/proc/uptime",
-		"/proc/net/dev",
-	}
-	for _, valid := range validDestinations {
-		path, err := filepath.Rel(filepath.Join(rootfs, valid), dest)
-		if err != nil {
-			return err
-		}
-		if path == "." {
-			return nil
-		}
-	}
-	for _, invalid := range invalidDestinations {
-		path, err := filepath.Rel(filepath.Join(rootfs, invalid), dest)
-		if err != nil {
-			return err
-		}
-		if path == "." || !strings.HasPrefix(path, "..") {
-			return fmt.Errorf("%q cannot be mounted because it is located inside %q", dest, invalid)
-		}
-	}
-	return nil
-}
-
-func setupDevSymlinks(rootfs string) error {
-	var links = [][2]string{
-		{"/proc/self/fd", "/dev/fd"},
-		{"/proc/self/fd/0", "/dev/stdin"},
-		{"/proc/self/fd/1", "/dev/stdout"},
-		{"/proc/self/fd/2", "/dev/stderr"},
-	}
-	// kcore support can be toggled with CONFIG_PROC_KCORE; only create a symlink
-	// in /dev if it exists in /proc.
-	if _, err := os.Stat("/proc/kcore"); err == nil {
-		links = append(links, [2]string{"/proc/kcore", "/dev/core"})
-	}
-	for _, link := range links {
-		var (
-			src = link[0]
-			dst = filepath.Join(rootfs, link[1])
-		)
-		if err := os.Symlink(src, dst); err != nil && !os.IsExist(err) {
-			return fmt.Errorf("symlink %s %s %s", src, dst, err)
-		}
-	}
-	return nil
-}
-
-// If stdin, stdout, and/or stderr are pointing to `/dev/null` in the parent's rootfs
-// this method will make them point to `/dev/null` in this container's rootfs.  This
-// needs to be called after we chroot/pivot into the container's rootfs so that any
-// symlinks are resolved locally.
-func reOpenDevNull() error {
-	var stat, devNullStat unix.Stat_t
-	file, err := os.OpenFile("/dev/null", os.O_RDWR, 0)
-	if err != nil {
-		return fmt.Errorf("Failed to open /dev/null - %s", err)
-	}
-	defer file.Close()
-	if err := unix.Fstat(int(file.Fd()), &devNullStat); err != nil {
-		return err
-	}
-	for fd := 0; fd < 3; fd++ {
-		if err := unix.Fstat(fd, &stat); err != nil {
-			return err
-		}
-		if stat.Rdev == devNullStat.Rdev {
-			// Close and re-open the fd.
-			if err := unix.Dup3(int(file.Fd()), fd, 0); err != nil {
-				return err
-			}
-		}
-	}
-	return nil
-}
-
-// Create the device nodes in the container.
-func createDevices(config *configs.Config) error {
-	useBindMount := system.RunningInUserNS() || config.Namespaces.Contains(configs.NEWUSER)
-	oldMask := unix.Umask(0000)
-	for _, node := range config.Devices {
-		// containers running in a user namespace are not allowed to mknod
-		// devices so we can just bind mount it from the host.
-		if err := createDeviceNode(config.Rootfs, node, useBindMount); err != nil {
-			unix.Umask(oldMask)
-			return err
-		}
-	}
-	unix.Umask(oldMask)
-	return nil
-}
-
-func bindMountDeviceNode(dest string, node *configs.Device) error {
-	f, err := os.Create(dest)
-	if err != nil && !os.IsExist(err) {
-		return err
-	}
-	if f != nil {
-		f.Close()
-	}
-	return unix.Mount(node.Path, dest, "bind", unix.MS_BIND, "")
-}
-
-// Creates the device node in the rootfs of the container.
-func createDeviceNode(rootfs string, node *configs.Device, bind bool) error {
-	dest := filepath.Join(rootfs, node.Path)
-	if err := os.MkdirAll(filepath.Dir(dest), 0755); err != nil {
-		return err
-	}
-
-	if bind {
-		return bindMountDeviceNode(dest, node)
-	}
-	if err := mknodDevice(dest, node); err != nil {
-		if os.IsExist(err) {
-			return nil
-		} else if os.IsPermission(err) {
-			return bindMountDeviceNode(dest, node)
-		}
-		return err
-	}
-	return nil
-}
-
-func mknodDevice(dest string, node *configs.Device) error {
-	fileMode := node.FileMode
-	switch node.Type {
-	case 'c', 'u':
-		fileMode |= unix.S_IFCHR
-	case 'b':
-		fileMode |= unix.S_IFBLK
-	case 'p':
-		fileMode |= unix.S_IFIFO
-	default:
-		return fmt.Errorf("%c is not a valid device type for device %s", node.Type, node.Path)
-	}
-	if err := unix.Mknod(dest, uint32(fileMode), node.Mkdev()); err != nil {
-		return err
-	}
-	return unix.Chown(dest, int(node.Uid), int(node.Gid))
-}
-
-func getMountInfo(mountinfo []*mount.Info, dir string) *mount.Info {
-	for _, m := range mountinfo {
-		if m.Mountpoint == dir {
-			return m
-		}
-	}
-	return nil
-}
-
-// Get the parent mount point of directory passed in as argument. Also return
-// optional fields.
-func getParentMount(rootfs string) (string, string, error) {
-	var path string
-
-	mountinfos, err := mount.GetMounts()
-	if err != nil {
-		return "", "", err
-	}
-
-	mountinfo := getMountInfo(mountinfos, rootfs)
-	if mountinfo != nil {
-		return rootfs, mountinfo.Optional, nil
-	}
-
-	path = rootfs
-	for {
-		path = filepath.Dir(path)
-
-		mountinfo = getMountInfo(mountinfos, path)
-		if mountinfo != nil {
-			return path, mountinfo.Optional, nil
-		}
-
-		if path == "/" {
-			break
-		}
-	}
-
-	// If we are here, we did not find parent mount. Something is wrong.
-	return "", "", fmt.Errorf("Could not find parent mount of %s", rootfs)
-}
-
-// Make parent mount private if it was shared
-func rootfsParentMountPrivate(rootfs string) error {
-	sharedMount := false
-
-	parentMount, optionalOpts, err := getParentMount(rootfs)
-	if err != nil {
-		return err
-	}
-
-	optsSplit := strings.Split(optionalOpts, " ")
-	for _, opt := range optsSplit {
-		if strings.HasPrefix(opt, "shared:") {
-			sharedMount = true
-			break
-		}
-	}
-
-	// Make parent mount PRIVATE if it was shared. It is needed for two
-	// reasons. First of all pivot_root() will fail if parent mount is
-	// shared. Secondly when we bind mount rootfs it will propagate to
-	// parent namespace and we don't want that to happen.
-	if sharedMount {
-		return unix.Mount("", parentMount, "", unix.MS_PRIVATE, "")
-	}
-
-	return nil
-}
-
-func prepareRoot(config *configs.Config) error {
-	flag := unix.MS_SLAVE | unix.MS_REC
-	if config.RootPropagation != 0 {
-		flag = config.RootPropagation
-	}
-	if err := unix.Mount("", "/", "", uintptr(flag), ""); err != nil {
-		return err
-	}
-
-	// Make parent mount private to make sure following bind mount does
-	// not propagate in other namespaces. Also it will help with kernel
-	// check pass in pivot_root. (IS_SHARED(new_mnt->mnt_parent))
-	if err := rootfsParentMountPrivate(config.Rootfs); err != nil {
-		return err
-	}
-
-	return unix.Mount(config.Rootfs, config.Rootfs, "bind", unix.MS_BIND|unix.MS_REC, "")
-}
-
-func setReadonly() error {
-	return unix.Mount("/", "/", "bind", unix.MS_BIND|unix.MS_REMOUNT|unix.MS_RDONLY|unix.MS_REC, "")
-}
-
-func setupPtmx(config *configs.Config) error {
-	ptmx := filepath.Join(config.Rootfs, "dev/ptmx")
-	if err := os.Remove(ptmx); err != nil && !os.IsNotExist(err) {
-		return err
-	}
-	if err := os.Symlink("pts/ptmx", ptmx); err != nil {
-		return fmt.Errorf("symlink dev ptmx %s", err)
-	}
-	return nil
-}
-
-// pivotRoot will call pivot_root such that rootfs becomes the new root
-// filesystem, and everything else is cleaned up.
-func pivotRoot(rootfs string) error {
-	// While the documentation may claim otherwise, pivot_root(".", ".") is
-	// actually valid. What this results in is / being the new root but
-	// /proc/self/cwd being the old root. Since we can play around with the cwd
-	// with pivot_root this allows us to pivot without creating directories in
-	// the rootfs. Shout-outs to the LXC developers for giving us this idea.
-
-	oldroot, err := unix.Open("/", unix.O_DIRECTORY|unix.O_RDONLY, 0)
-	if err != nil {
-		return err
-	}
-	defer unix.Close(oldroot)
-
-	newroot, err := unix.Open(rootfs, unix.O_DIRECTORY|unix.O_RDONLY, 0)
-	if err != nil {
-		return err
-	}
-	defer unix.Close(newroot)
-
-	// Change to the new root so that the pivot_root actually acts on it.
-	if err := unix.Fchdir(newroot); err != nil {
-		return err
-	}
-
-	if err := unix.PivotRoot(".", "."); err != nil {
-		return fmt.Errorf("pivot_root %s", err)
-	}
-
-	// Currently our "." is oldroot (according to the current kernel code).
-	// However, purely for safety, we will fchdir(oldroot) since there isn't
-	// really any guarantee from the kernel what /proc/self/cwd will be after a
-	// pivot_root(2).
-
-	if err := unix.Fchdir(oldroot); err != nil {
-		return err
-	}
-
-	// Make oldroot rslave to make sure our unmounts don't propagate to the
-	// host (and thus bork the machine). We don't use rprivate because this is
-	// known to cause issues due to races where we still have a reference to a
-	// mount while a process in the host namespace are trying to operate on
-	// something they think has no mounts (devicemapper in particular).
-	if err := unix.Mount("", ".", "", unix.MS_SLAVE|unix.MS_REC, ""); err != nil {
-		return err
-	}
-	// Preform the unmount. MNT_DETACH allows us to unmount /proc/self/cwd.
-	if err := unix.Unmount(".", unix.MNT_DETACH); err != nil {
-		return err
-	}
-
-	// Switch back to our shiny new root.
-	if err := unix.Chdir("/"); err != nil {
-		return fmt.Errorf("chdir / %s", err)
-	}
-	return nil
-}
-
-func msMoveRoot(rootfs string) error {
-	if err := unix.Mount(rootfs, "/", "", unix.MS_MOVE, ""); err != nil {
-		return err
-	}
-	return chroot(rootfs)
-}
-
-func chroot(rootfs string) error {
-	if err := unix.Chroot("."); err != nil {
-		return err
-	}
-	return unix.Chdir("/")
-}
-
-// createIfNotExists creates a file or a directory only if it does not already exist.
-func createIfNotExists(path string, isDir bool) error {
-	if _, err := os.Stat(path); err != nil {
-		if os.IsNotExist(err) {
-			if isDir {
-				return os.MkdirAll(path, 0755)
-			}
-			if err := os.MkdirAll(filepath.Dir(path), 0755); err != nil {
-				return err
-			}
-			f, err := os.OpenFile(path, os.O_CREATE, 0755)
-			if err != nil {
-				return err
-			}
-			f.Close()
-		}
-	}
-	return nil
-}
-
-// readonlyPath will make a path read only.
-func readonlyPath(path string) error {
-	if err := unix.Mount(path, path, "", unix.MS_BIND|unix.MS_REC, ""); err != nil {
-		if os.IsNotExist(err) {
-			return nil
-		}
-		return err
-	}
-	return unix.Mount(path, path, "", unix.MS_BIND|unix.MS_REMOUNT|unix.MS_RDONLY|unix.MS_REC, "")
-}
-
-// remountReadonly will remount an existing mount point and ensure that it is read-only.
-func remountReadonly(m *configs.Mount) error {
-	var (
-		dest  = m.Destination
-		flags = m.Flags
-	)
-	for i := 0; i < 5; i++ {
-		// There is a special case in the kernel for
-		// MS_REMOUNT | MS_BIND, which allows us to change only the
-		// flags even as an unprivileged user (i.e. user namespace)
-		// assuming we don't drop any security related flags (nodev,
-		// nosuid, etc.). So, let's use that case so that we can do
-		// this re-mount without failing in a userns.
-		flags |= unix.MS_REMOUNT | unix.MS_BIND | unix.MS_RDONLY
-		if err := unix.Mount("", dest, "", uintptr(flags), ""); err != nil {
-			switch err {
-			case unix.EBUSY:
-				time.Sleep(100 * time.Millisecond)
-				continue
-			default:
-				return err
-			}
-		}
-		return nil
-	}
-	return fmt.Errorf("unable to mount %s as readonly max retries reached", dest)
-}
-
-// maskPath masks the top of the specified path inside a container to avoid
-// security issues from processes reading information from non-namespace aware
-// mounts ( proc/kcore ).
-// For files, maskPath bind mounts /dev/null over the top of the specified path.
-// For directories, maskPath mounts read-only tmpfs over the top of the specified path.
-func maskPath(path string) error {
-	if err := unix.Mount("/dev/null", path, "", unix.MS_BIND, ""); err != nil && !os.IsNotExist(err) {
-		if err == unix.ENOTDIR {
-			return unix.Mount("tmpfs", path, "tmpfs", unix.MS_RDONLY, "")
-		}
-		return err
-	}
-	return nil
-}
-
-// writeSystemProperty writes the value to a path under /proc/sys as determined from the key.
-// For e.g. net.ipv4.ip_forward translated to /proc/sys/net/ipv4/ip_forward.
-func writeSystemProperty(key, value string) error {
-	keyPath := strings.Replace(key, ".", "/", -1)
-	return ioutil.WriteFile(path.Join("/proc/sys", keyPath), []byte(value), 0644)
-}
-
-func remount(m *configs.Mount, rootfs string) error {
-	var (
-		dest = m.Destination
-	)
-	if !strings.HasPrefix(dest, rootfs) {
-		dest = filepath.Join(rootfs, dest)
-	}
-	if err := unix.Mount(m.Source, dest, m.Device, uintptr(m.Flags|unix.MS_REMOUNT), ""); err != nil {
-		return err
-	}
-	return nil
-}
-
-// Do the mount operation followed by additional mounts required to take care
-// of propagation flags.
-func mountPropagate(m *configs.Mount, rootfs string, mountLabel string) error {
-	var (
-		dest  = m.Destination
-		data  = label.FormatMountLabel(m.Data, mountLabel)
-		flags = m.Flags
-	)
-	if libcontainerUtils.CleanPath(dest) == "/dev" {
-		flags &= ^unix.MS_RDONLY
-	}
-
-	copyUp := m.Extensions&configs.EXT_COPYUP == configs.EXT_COPYUP
-	if !(copyUp || strings.HasPrefix(dest, rootfs)) {
-		dest = filepath.Join(rootfs, dest)
-	}
-
-	if err := unix.Mount(m.Source, dest, m.Device, uintptr(flags), data); err != nil {
-		return err
-	}
-
-	for _, pflag := range m.PropagationFlags {
-		if err := unix.Mount("", dest, "", uintptr(pflag), ""); err != nil {
-			return err
-		}
-	}
-	return nil
-}
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/seccomp/config.go b/vendor/github.com/opencontainers/runc/libcontainer/seccomp/config.go
deleted file mode 100644
index ded5a6bbc..000000000
--- a/vendor/github.com/opencontainers/runc/libcontainer/seccomp/config.go
+++ /dev/null
@@ -1,76 +0,0 @@
-package seccomp
-
-import (
-	"fmt"
-
-	"github.com/opencontainers/runc/libcontainer/configs"
-)
-
-var operators = map[string]configs.Operator{
-	"SCMP_CMP_NE":        configs.NotEqualTo,
-	"SCMP_CMP_LT":        configs.LessThan,
-	"SCMP_CMP_LE":        configs.LessThanOrEqualTo,
-	"SCMP_CMP_EQ":        configs.EqualTo,
-	"SCMP_CMP_GE":        configs.GreaterThanOrEqualTo,
-	"SCMP_CMP_GT":        configs.GreaterThan,
-	"SCMP_CMP_MASKED_EQ": configs.MaskEqualTo,
-}
-
-var actions = map[string]configs.Action{
-	"SCMP_ACT_KILL":  configs.Kill,
-	"SCMP_ACT_ERRNO": configs.Errno,
-	"SCMP_ACT_TRAP":  configs.Trap,
-	"SCMP_ACT_ALLOW": configs.Allow,
-	"SCMP_ACT_TRACE": configs.Trace,
-}
-
-var archs = map[string]string{
-	"SCMP_ARCH_X86":         "x86",
-	"SCMP_ARCH_X86_64":      "amd64",
-	"SCMP_ARCH_X32":         "x32",
-	"SCMP_ARCH_ARM":         "arm",
-	"SCMP_ARCH_AARCH64":     "arm64",
-	"SCMP_ARCH_MIPS":        "mips",
-	"SCMP_ARCH_MIPS64":      "mips64",
-	"SCMP_ARCH_MIPS64N32":   "mips64n32",
-	"SCMP_ARCH_MIPSEL":      "mipsel",
-	"SCMP_ARCH_MIPSEL64":    "mipsel64",
-	"SCMP_ARCH_MIPSEL64N32": "mipsel64n32",
-	"SCMP_ARCH_PPC":         "ppc",
-	"SCMP_ARCH_PPC64":       "ppc64",
-	"SCMP_ARCH_PPC64LE":     "ppc64le",
-	"SCMP_ARCH_S390":        "s390",
-	"SCMP_ARCH_S390X":       "s390x",
-}
-
-// ConvertStringToOperator converts a string into a Seccomp comparison operator.
-// Comparison operators use the names they are assigned by Libseccomp's header.
-// Attempting to convert a string that is not a valid operator results in an
-// error.
-func ConvertStringToOperator(in string) (configs.Operator, error) {
-	if op, ok := operators[in]; ok == true {
-		return op, nil
-	}
-	return 0, fmt.Errorf("string %s is not a valid operator for seccomp", in)
-}
-
-// ConvertStringToAction converts a string into a Seccomp rule match action.
-// Actions use the names they are assigned in Libseccomp's header, though some
-// (notable, SCMP_ACT_TRACE) are not available in this implementation and will
-// return errors.
-// Attempting to convert a string that is not a valid action results in an
-// error.
-func ConvertStringToAction(in string) (configs.Action, error) {
-	if act, ok := actions[in]; ok == true {
-		return act, nil
-	}
-	return 0, fmt.Errorf("string %s is not a valid action for seccomp", in)
-}
-
-// ConvertStringToArch converts a string into a Seccomp comparison arch.
-func ConvertStringToArch(in string) (string, error) {
-	if arch, ok := archs[in]; ok == true {
-		return arch, nil
-	}
-	return "", fmt.Errorf("string %s is not a valid arch for seccomp", in)
-}
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/seccomp/seccomp_linux.go b/vendor/github.com/opencontainers/runc/libcontainer/seccomp/seccomp_linux.go
deleted file mode 100644
index d99f3fe64..000000000
--- a/vendor/github.com/opencontainers/runc/libcontainer/seccomp/seccomp_linux.go
+++ /dev/null
@@ -1,258 +0,0 @@
-// +build linux,cgo,seccomp
-
-package seccomp
-
-import (
-	"bufio"
-	"fmt"
-	"os"
-	"strings"
-
-	"github.com/opencontainers/runc/libcontainer/configs"
-	libseccomp "github.com/seccomp/libseccomp-golang"
-
-	"golang.org/x/sys/unix"
-)
-
-var (
-	actAllow = libseccomp.ActAllow
-	actTrap  = libseccomp.ActTrap
-	actKill  = libseccomp.ActKill
-	actTrace = libseccomp.ActTrace.SetReturnCode(int16(unix.EPERM))
-	actErrno = libseccomp.ActErrno.SetReturnCode(int16(unix.EPERM))
-)
-
-const (
-	// Linux system calls can have at most 6 arguments
-	syscallMaxArguments int = 6
-)
-
-// Filters given syscalls in a container, preventing them from being used
-// Started in the container init process, and carried over to all child processes
-// Setns calls, however, require a separate invocation, as they are not children
-// of the init until they join the namespace
-func InitSeccomp(config *configs.Seccomp) error {
-	if config == nil {
-		return fmt.Errorf("cannot initialize Seccomp - nil config passed")
-	}
-
-	defaultAction, err := getAction(config.DefaultAction)
-	if err != nil {
-		return fmt.Errorf("error initializing seccomp - invalid default action")
-	}
-
-	filter, err := libseccomp.NewFilter(defaultAction)
-	if err != nil {
-		return fmt.Errorf("error creating filter: %s", err)
-	}
-
-	// Add extra architectures
-	for _, arch := range config.Architectures {
-		scmpArch, err := libseccomp.GetArchFromString(arch)
-		if err != nil {
-			return fmt.Errorf("error validating Seccomp architecture: %s", err)
-		}
-
-		if err := filter.AddArch(scmpArch); err != nil {
-			return fmt.Errorf("error adding architecture to seccomp filter: %s", err)
-		}
-	}
-
-	// Unset no new privs bit
-	if err := filter.SetNoNewPrivsBit(false); err != nil {
-		return fmt.Errorf("error setting no new privileges: %s", err)
-	}
-
-	// Add a rule for each syscall
-	for _, call := range config.Syscalls {
-		if call == nil {
-			return fmt.Errorf("encountered nil syscall while initializing Seccomp")
-		}
-
-		if err = matchCall(filter, call); err != nil {
-			return err
-		}
-	}
-
-	if err = filter.Load(); err != nil {
-		return fmt.Errorf("error loading seccomp filter into kernel: %s", err)
-	}
-
-	return nil
-}
-
-// IsEnabled returns if the kernel has been configured to support seccomp.
-func IsEnabled() bool {
-	// Try to read from /proc/self/status for kernels > 3.8
-	s, err := parseStatusFile("/proc/self/status")
-	if err != nil {
-		// Check if Seccomp is supported, via CONFIG_SECCOMP.
-		if err := unix.Prctl(unix.PR_GET_SECCOMP, 0, 0, 0, 0); err != unix.EINVAL {
-			// Make sure the kernel has CONFIG_SECCOMP_FILTER.
-			if err := unix.Prctl(unix.PR_SET_SECCOMP, unix.SECCOMP_MODE_FILTER, 0, 0, 0); err != unix.EINVAL {
-				return true
-			}
-		}
-		return false
-	}
-	_, ok := s["Seccomp"]
-	return ok
-}
-
-// Convert Libcontainer Action to Libseccomp ScmpAction
-func getAction(act configs.Action) (libseccomp.ScmpAction, error) {
-	switch act {
-	case configs.Kill:
-		return actKill, nil
-	case configs.Errno:
-		return actErrno, nil
-	case configs.Trap:
-		return actTrap, nil
-	case configs.Allow:
-		return actAllow, nil
-	case configs.Trace:
-		return actTrace, nil
-	default:
-		return libseccomp.ActInvalid, fmt.Errorf("invalid action, cannot use in rule")
-	}
-}
-
-// Convert Libcontainer Operator to Libseccomp ScmpCompareOp
-func getOperator(op configs.Operator) (libseccomp.ScmpCompareOp, error) {
-	switch op {
-	case configs.EqualTo:
-		return libseccomp.CompareEqual, nil
-	case configs.NotEqualTo:
-		return libseccomp.CompareNotEqual, nil
-	case configs.GreaterThan:
-		return libseccomp.CompareGreater, nil
-	case configs.GreaterThanOrEqualTo:
-		return libseccomp.CompareGreaterEqual, nil
-	case configs.LessThan:
-		return libseccomp.CompareLess, nil
-	case configs.LessThanOrEqualTo:
-		return libseccomp.CompareLessOrEqual, nil
-	case configs.MaskEqualTo:
-		return libseccomp.CompareMaskedEqual, nil
-	default:
-		return libseccomp.CompareInvalid, fmt.Errorf("invalid operator, cannot use in rule")
-	}
-}
-
-// Convert Libcontainer Arg to Libseccomp ScmpCondition
-func getCondition(arg *configs.Arg) (libseccomp.ScmpCondition, error) {
-	cond := libseccomp.ScmpCondition{}
-
-	if arg == nil {
-		return cond, fmt.Errorf("cannot convert nil to syscall condition")
-	}
-
-	op, err := getOperator(arg.Op)
-	if err != nil {
-		return cond, err
-	}
-
-	return libseccomp.MakeCondition(arg.Index, op, arg.Value, arg.ValueTwo)
-}
-
-// Add a rule to match a single syscall
-func matchCall(filter *libseccomp.ScmpFilter, call *configs.Syscall) error {
-	if call == nil || filter == nil {
-		return fmt.Errorf("cannot use nil as syscall to block")
-	}
-
-	if len(call.Name) == 0 {
-		return fmt.Errorf("empty string is not a valid syscall")
-	}
-
-	// If we can't resolve the syscall, assume it's not supported on this kernel
-	// Ignore it, don't error out
-	callNum, err := libseccomp.GetSyscallFromName(call.Name)
-	if err != nil {
-		return nil
-	}
-
-	// Convert the call's action to the libseccomp equivalent
-	callAct, err := getAction(call.Action)
-	if err != nil {
-		return fmt.Errorf("action in seccomp profile is invalid: %s", err)
-	}
-
-	// Unconditional match - just add the rule
-	if len(call.Args) == 0 {
-		if err = filter.AddRule(callNum, callAct); err != nil {
-			return fmt.Errorf("error adding seccomp filter rule for syscall %s: %s", call.Name, err)
-		}
-	} else {
-		// If two or more arguments have the same condition,
-		// Revert to old behavior, adding each condition as a separate rule
-		argCounts := make([]uint, syscallMaxArguments)
-		conditions := []libseccomp.ScmpCondition{}
-
-		for _, cond := range call.Args {
-			newCond, err := getCondition(cond)
-			if err != nil {
-				return fmt.Errorf("error creating seccomp syscall condition for syscall %s: %s", call.Name, err)
-			}
-
-			argCounts[cond.Index] += 1
-
-			conditions = append(conditions, newCond)
-		}
-
-		hasMultipleArgs := false
-		for _, count := range argCounts {
-			if count > 1 {
-				hasMultipleArgs = true
-				break
-			}
-		}
-
-		if hasMultipleArgs {
-			// Revert to old behavior
-			// Add each condition attached to a separate rule
-			for _, cond := range conditions {
-				condArr := []libseccomp.ScmpCondition{cond}
-
-				if err = filter.AddRuleConditional(callNum, callAct, condArr); err != nil {
-					return fmt.Errorf("error adding seccomp rule for syscall %s: %s", call.Name, err)
-				}
-			}
-		} else {
-			// No conditions share same argument
-			// Use new, proper behavior
-			if err = filter.AddRuleConditional(callNum, callAct, conditions); err != nil {
-				return fmt.Errorf("error adding seccomp rule for syscall %s: %s", call.Name, err)
-			}
-		}
-	}
-
-	return nil
-}
-
-func parseStatusFile(path string) (map[string]string, error) {
-	f, err := os.Open(path)
-	if err != nil {
-		return nil, err
-	}
-	defer f.Close()
-
-	s := bufio.NewScanner(f)
-	status := make(map[string]string)
-
-	for s.Scan() {
-		text := s.Text()
-		parts := strings.Split(text, ":")
-
-		if len(parts) <= 1 {
-			continue
-		}
-
-		status[parts[0]] = parts[1]
-	}
-	if err := s.Err(); err != nil {
-		return nil, err
-	}
-
-	return status, nil
-}
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/seccomp/seccomp_unsupported.go b/vendor/github.com/opencontainers/runc/libcontainer/seccomp/seccomp_unsupported.go
deleted file mode 100644
index 44df1ad4c..000000000
--- a/vendor/github.com/opencontainers/runc/libcontainer/seccomp/seccomp_unsupported.go
+++ /dev/null
@@ -1,24 +0,0 @@
-// +build !linux !cgo !seccomp
-
-package seccomp
-
-import (
-	"errors"
-
-	"github.com/opencontainers/runc/libcontainer/configs"
-)
-
-var ErrSeccompNotEnabled = errors.New("seccomp: config provided but seccomp not supported")
-
-// InitSeccomp does nothing because seccomp is not supported.
-func InitSeccomp(config *configs.Seccomp) error {
-	if config != nil {
-		return ErrSeccompNotEnabled
-	}
-	return nil
-}
-
-// IsEnabled returns false, because it is not supported.
-func IsEnabled() bool {
-	return false
-}
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/setns_init_linux.go b/vendor/github.com/opencontainers/runc/libcontainer/setns_init_linux.go
deleted file mode 100644
index 096c601e7..000000000
--- a/vendor/github.com/opencontainers/runc/libcontainer/setns_init_linux.go
+++ /dev/null
@@ -1,76 +0,0 @@
-// +build linux
-
-package libcontainer
-
-import (
-	"fmt"
-	"os"
-
-	"github.com/opencontainers/runc/libcontainer/apparmor"
-	"github.com/opencontainers/runc/libcontainer/keys"
-	"github.com/opencontainers/runc/libcontainer/seccomp"
-	"github.com/opencontainers/runc/libcontainer/system"
-	"github.com/opencontainers/selinux/go-selinux/label"
-
-	"golang.org/x/sys/unix"
-)
-
-// linuxSetnsInit performs the container's initialization for running a new process
-// inside an existing container.
-type linuxSetnsInit struct {
-	pipe          *os.File
-	consoleSocket *os.File
-	config        *initConfig
-}
-
-func (l *linuxSetnsInit) getSessionRingName() string {
-	return fmt.Sprintf("_ses.%s", l.config.ContainerId)
-}
-
-func (l *linuxSetnsInit) Init() error {
-	if !l.config.Config.NoNewKeyring {
-		// do not inherit the parent's session keyring
-		if _, err := keys.JoinSessionKeyring(l.getSessionRingName()); err != nil {
-			return err
-		}
-	}
-	if l.config.CreateConsole {
-		if err := setupConsole(l.consoleSocket, l.config, false); err != nil {
-			return err
-		}
-		if err := system.Setctty(); err != nil {
-			return err
-		}
-	}
-	if l.config.NoNewPrivileges {
-		if err := unix.Prctl(unix.PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); err != nil {
-			return err
-		}
-	}
-	// Without NoNewPrivileges seccomp is a privileged operation, so we need to
-	// do this before dropping capabilities; otherwise do it as late as possible
-	// just before execve so as few syscalls take place after it as possible.
-	if l.config.Config.Seccomp != nil && !l.config.NoNewPrivileges {
-		if err := seccomp.InitSeccomp(l.config.Config.Seccomp); err != nil {
-			return err
-		}
-	}
-	if err := finalizeNamespace(l.config); err != nil {
-		return err
-	}
-	if err := apparmor.ApplyProfile(l.config.AppArmorProfile); err != nil {
-		return err
-	}
-	if err := label.SetProcessLabel(l.config.ProcessLabel); err != nil {
-		return err
-	}
-	// Set seccomp as close to execve as possible, so as few syscalls take
-	// place afterward (reducing the amount of syscalls that users need to
-	// enable in their seccomp profiles).
-	if l.config.Config.Seccomp != nil && l.config.NoNewPrivileges {
-		if err := seccomp.InitSeccomp(l.config.Config.Seccomp); err != nil {
-			return newSystemErrorWithCause(err, "init seccomp")
-		}
-	}
-	return system.Execv(l.config.Args[0], l.config.Args[0:], os.Environ())
-}
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/stacktrace/capture.go b/vendor/github.com/opencontainers/runc/libcontainer/stacktrace/capture.go
deleted file mode 100644
index 0bbe14950..000000000
--- a/vendor/github.com/opencontainers/runc/libcontainer/stacktrace/capture.go
+++ /dev/null
@@ -1,27 +0,0 @@
-package stacktrace
-
-import "runtime"
-
-// Capture captures a stacktrace for the current calling go program
-//
-// skip is the number of frames to skip
-func Capture(userSkip int) Stacktrace {
-	var (
-		skip   = userSkip + 1 // add one for our own function
-		frames []Frame
-		prevPc uintptr
-	)
-	for i := skip; ; i++ {
-		pc, file, line, ok := runtime.Caller(i)
-		//detect if caller is repeated to avoid loop, gccgo
-		//currently runs  into a loop without this check
-		if !ok || pc == prevPc {
-			break
-		}
-		frames = append(frames, NewFrame(pc, file, line))
-		prevPc = pc
-	}
-	return Stacktrace{
-		Frames: frames,
-	}
-}
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/stacktrace/frame.go b/vendor/github.com/opencontainers/runc/libcontainer/stacktrace/frame.go
deleted file mode 100644
index 0d590d9a5..000000000
--- a/vendor/github.com/opencontainers/runc/libcontainer/stacktrace/frame.go
+++ /dev/null
@@ -1,38 +0,0 @@
-package stacktrace
-
-import (
-	"path/filepath"
-	"runtime"
-	"strings"
-)
-
-// NewFrame returns a new stack frame for the provided information
-func NewFrame(pc uintptr, file string, line int) Frame {
-	fn := runtime.FuncForPC(pc)
-	if fn == nil {
-		return Frame{}
-	}
-	pack, name := parseFunctionName(fn.Name())
-	return Frame{
-		Line:     line,
-		File:     filepath.Base(file),
-		Package:  pack,
-		Function: name,
-	}
-}
-
-func parseFunctionName(name string) (string, string) {
-	i := strings.LastIndex(name, ".")
-	if i == -1 {
-		return "", name
-	}
-	return name[:i], name[i+1:]
-}
-
-// Frame contains all the information for a stack frame within a go program
-type Frame struct {
-	File     string
-	Function string
-	Package  string
-	Line     int
-}
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/stacktrace/stacktrace.go b/vendor/github.com/opencontainers/runc/libcontainer/stacktrace/stacktrace.go
deleted file mode 100644
index 5e8b58d2d..000000000
--- a/vendor/github.com/opencontainers/runc/libcontainer/stacktrace/stacktrace.go
+++ /dev/null
@@ -1,5 +0,0 @@
-package stacktrace
-
-type Stacktrace struct {
-	Frames []Frame
-}
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/standard_init_linux.go b/vendor/github.com/opencontainers/runc/libcontainer/standard_init_linux.go
deleted file mode 100644
index 02ea753ed..000000000
--- a/vendor/github.com/opencontainers/runc/libcontainer/standard_init_linux.go
+++ /dev/null
@@ -1,193 +0,0 @@
-// +build linux
-
-package libcontainer
-
-import (
-	"fmt"
-	"os"
-	"os/exec"
-	"syscall" //only for Exec
-
-	"github.com/opencontainers/runc/libcontainer/apparmor"
-	"github.com/opencontainers/runc/libcontainer/configs"
-	"github.com/opencontainers/runc/libcontainer/keys"
-	"github.com/opencontainers/runc/libcontainer/seccomp"
-	"github.com/opencontainers/runc/libcontainer/system"
-	"github.com/opencontainers/selinux/go-selinux/label"
-
-	"golang.org/x/sys/unix"
-)
-
-type linuxStandardInit struct {
-	pipe          *os.File
-	consoleSocket *os.File
-	parentPid     int
-	fifoFd        int
-	config        *initConfig
-}
-
-func (l *linuxStandardInit) getSessionRingParams() (string, uint32, uint32) {
-	var newperms uint32
-
-	if l.config.Config.Namespaces.Contains(configs.NEWUSER) {
-		// With user ns we need 'other' search permissions.
-		newperms = 0x8
-	} else {
-		// Without user ns we need 'UID' search permissions.
-		newperms = 0x80000
-	}
-
-	// Create a unique per session container name that we can join in setns;
-	// However, other containers can also join it.
-	return fmt.Sprintf("_ses.%s", l.config.ContainerId), 0xffffffff, newperms
-}
-
-func (l *linuxStandardInit) Init() error {
-	if !l.config.Config.NoNewKeyring {
-		ringname, keepperms, newperms := l.getSessionRingParams()
-
-		// Do not inherit the parent's session keyring.
-		sessKeyId, err := keys.JoinSessionKeyring(ringname)
-		if err != nil {
-			return err
-		}
-		// Make session keyring searcheable.
-		if err := keys.ModKeyringPerm(sessKeyId, keepperms, newperms); err != nil {
-			return err
-		}
-	}
-
-	if err := setupNetwork(l.config); err != nil {
-		return err
-	}
-	if err := setupRoute(l.config.Config); err != nil {
-		return err
-	}
-
-	label.Init()
-	if err := prepareRootfs(l.pipe, l.config); err != nil {
-		return err
-	}
-	// Set up the console. This has to be done *before* we finalize the rootfs,
-	// but *after* we've given the user the chance to set up all of the mounts
-	// they wanted.
-	if l.config.CreateConsole {
-		if err := setupConsole(l.consoleSocket, l.config, true); err != nil {
-			return err
-		}
-		if err := system.Setctty(); err != nil {
-			return err
-		}
-	}
-
-	// Finish the rootfs setup.
-	if l.config.Config.Namespaces.Contains(configs.NEWNS) {
-		if err := finalizeRootfs(l.config.Config); err != nil {
-			return err
-		}
-	}
-
-	if hostname := l.config.Config.Hostname; hostname != "" {
-		if err := unix.Sethostname([]byte(hostname)); err != nil {
-			return err
-		}
-	}
-	if err := apparmor.ApplyProfile(l.config.AppArmorProfile); err != nil {
-		return err
-	}
-	if err := label.SetProcessLabel(l.config.ProcessLabel); err != nil {
-		return err
-	}
-
-	for key, value := range l.config.Config.Sysctl {
-		if err := writeSystemProperty(key, value); err != nil {
-			return err
-		}
-	}
-	for _, path := range l.config.Config.ReadonlyPaths {
-		if err := readonlyPath(path); err != nil {
-			return err
-		}
-	}
-	for _, path := range l.config.Config.MaskPaths {
-		if err := maskPath(path); err != nil {
-			return err
-		}
-	}
-	pdeath, err := system.GetParentDeathSignal()
-	if err != nil {
-		return err
-	}
-	if l.config.NoNewPrivileges {
-		if err := unix.Prctl(unix.PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); err != nil {
-			return err
-		}
-	}
-	// Tell our parent that we're ready to Execv. This must be done before the
-	// Seccomp rules have been applied, because we need to be able to read and
-	// write to a socket.
-	if err := syncParentReady(l.pipe); err != nil {
-		return err
-	}
-	// Without NoNewPrivileges seccomp is a privileged operation, so we need to
-	// do this before dropping capabilities; otherwise do it as late as possible
-	// just before execve so as few syscalls take place after it as possible.
-	if l.config.Config.Seccomp != nil && !l.config.NoNewPrivileges {
-		if err := seccomp.InitSeccomp(l.config.Config.Seccomp); err != nil {
-			return err
-		}
-	}
-	if err := finalizeNamespace(l.config); err != nil {
-		return err
-	}
-	// finalizeNamespace can change user/group which clears the parent death
-	// signal, so we restore it here.
-	if err := pdeath.Restore(); err != nil {
-		return err
-	}
-	// Compare the parent from the initial start of the init process and make
-	// sure that it did not change.  if the parent changes that means it died
-	// and we were reparented to something else so we should just kill ourself
-	// and not cause problems for someone else.
-	if unix.Getppid() != l.parentPid {
-		return unix.Kill(unix.Getpid(), unix.SIGKILL)
-	}
-	// Check for the arg before waiting to make sure it exists and it is
-	// returned as a create time error.
-	name, err := exec.LookPath(l.config.Args[0])
-	if err != nil {
-		return err
-	}
-	// Close the pipe to signal that we have completed our init.
-	l.pipe.Close()
-	// Wait for the FIFO to be opened on the other side before exec-ing the
-	// user process. We open it through /proc/self/fd/$fd, because the fd that
-	// was given to us was an O_PATH fd to the fifo itself. Linux allows us to
-	// re-open an O_PATH fd through /proc.
-	fd, err := unix.Open(fmt.Sprintf("/proc/self/fd/%d", l.fifoFd), unix.O_WRONLY|unix.O_CLOEXEC, 0)
-	if err != nil {
-		return newSystemErrorWithCause(err, "open exec fifo")
-	}
-	if _, err := unix.Write(fd, []byte("0")); err != nil {
-		return newSystemErrorWithCause(err, "write 0 exec fifo")
-	}
-	// Close the O_PATH fifofd fd before exec because the kernel resets
-	// dumpable in the wrong order. This has been fixed in newer kernels, but
-	// we keep this to ensure CVE-2016-9962 doesn't re-emerge on older kernels.
-	// N.B. the core issue itself (passing dirfds to the host filesystem) has
-	// since been resolved.
-	// https://github.com/torvalds/linux/blob/v4.9/fs/exec.c#L1290-L1318
-	unix.Close(l.fifoFd)
-	// Set seccomp as close to execve as possible, so as few syscalls take
-	// place afterward (reducing the amount of syscalls that users need to
-	// enable in their seccomp profiles).
-	if l.config.Config.Seccomp != nil && l.config.NoNewPrivileges {
-		if err := seccomp.InitSeccomp(l.config.Config.Seccomp); err != nil {
-			return newSystemErrorWithCause(err, "init seccomp")
-		}
-	}
-	if err := syscall.Exec(name, l.config.Args[0:], os.Environ()); err != nil {
-		return newSystemErrorWithCause(err, "exec user process")
-	}
-	return nil
-}
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/state_linux.go b/vendor/github.com/opencontainers/runc/libcontainer/state_linux.go
deleted file mode 100644
index b45ce23e4..000000000
--- a/vendor/github.com/opencontainers/runc/libcontainer/state_linux.go
+++ /dev/null
@@ -1,255 +0,0 @@
-// +build linux
-
-package libcontainer
-
-import (
-	"fmt"
-	"os"
-	"path/filepath"
-
-	"github.com/opencontainers/runc/libcontainer/configs"
-	"github.com/opencontainers/runc/libcontainer/utils"
-
-	"github.com/sirupsen/logrus"
-	"golang.org/x/sys/unix"
-)
-
-func newStateTransitionError(from, to containerState) error {
-	return &stateTransitionError{
-		From: from.status().String(),
-		To:   to.status().String(),
-	}
-}
-
-// stateTransitionError is returned when an invalid state transition happens from one
-// state to another.
-type stateTransitionError struct {
-	From string
-	To   string
-}
-
-func (s *stateTransitionError) Error() string {
-	return fmt.Sprintf("invalid state transition from %s to %s", s.From, s.To)
-}
-
-type containerState interface {
-	transition(containerState) error
-	destroy() error
-	status() Status
-}
-
-func destroy(c *linuxContainer) error {
-	if !c.config.Namespaces.Contains(configs.NEWPID) {
-		if err := signalAllProcesses(c.cgroupManager, unix.SIGKILL); err != nil {
-			logrus.Warn(err)
-		}
-	}
-	err := c.cgroupManager.Destroy()
-	if c.intelRdtManager != nil {
-		if ierr := c.intelRdtManager.Destroy(); err == nil {
-			err = ierr
-		}
-	}
-	if rerr := os.RemoveAll(c.root); err == nil {
-		err = rerr
-	}
-	c.initProcess = nil
-	if herr := runPoststopHooks(c); err == nil {
-		err = herr
-	}
-	c.state = &stoppedState{c: c}
-	return err
-}
-
-func runPoststopHooks(c *linuxContainer) error {
-	if c.config.Hooks != nil {
-		bundle, annotations := utils.Annotations(c.config.Labels)
-		s := configs.HookState{
-			Version:     c.config.Version,
-			ID:          c.id,
-			Bundle:      bundle,
-			Annotations: annotations,
-		}
-		for _, hook := range c.config.Hooks.Poststop {
-			if err := hook.Run(s); err != nil {
-				return err
-			}
-		}
-	}
-	return nil
-}
-
-// stoppedState represents a container is a stopped/destroyed state.
-type stoppedState struct {
-	c *linuxContainer
-}
-
-func (b *stoppedState) status() Status {
-	return Stopped
-}
-
-func (b *stoppedState) transition(s containerState) error {
-	switch s.(type) {
-	case *runningState, *restoredState:
-		b.c.state = s
-		return nil
-	case *stoppedState:
-		return nil
-	}
-	return newStateTransitionError(b, s)
-}
-
-func (b *stoppedState) destroy() error {
-	return destroy(b.c)
-}
-
-// runningState represents a container that is currently running.
-type runningState struct {
-	c *linuxContainer
-}
-
-func (r *runningState) status() Status {
-	return Running
-}
-
-func (r *runningState) transition(s containerState) error {
-	switch s.(type) {
-	case *stoppedState:
-		t, err := r.c.runType()
-		if err != nil {
-			return err
-		}
-		if t == Running {
-			return newGenericError(fmt.Errorf("container still running"), ContainerNotStopped)
-		}
-		r.c.state = s
-		return nil
-	case *pausedState:
-		r.c.state = s
-		return nil
-	case *runningState:
-		return nil
-	}
-	return newStateTransitionError(r, s)
-}
-
-func (r *runningState) destroy() error {
-	t, err := r.c.runType()
-	if err != nil {
-		return err
-	}
-	if t == Running {
-		return newGenericError(fmt.Errorf("container is not destroyed"), ContainerNotStopped)
-	}
-	return destroy(r.c)
-}
-
-type createdState struct {
-	c *linuxContainer
-}
-
-func (i *createdState) status() Status {
-	return Created
-}
-
-func (i *createdState) transition(s containerState) error {
-	switch s.(type) {
-	case *runningState, *pausedState, *stoppedState:
-		i.c.state = s
-		return nil
-	case *createdState:
-		return nil
-	}
-	return newStateTransitionError(i, s)
-}
-
-func (i *createdState) destroy() error {
-	i.c.initProcess.signal(unix.SIGKILL)
-	return destroy(i.c)
-}
-
-// pausedState represents a container that is currently pause.  It cannot be destroyed in a
-// paused state and must transition back to running first.
-type pausedState struct {
-	c *linuxContainer
-}
-
-func (p *pausedState) status() Status {
-	return Paused
-}
-
-func (p *pausedState) transition(s containerState) error {
-	switch s.(type) {
-	case *runningState, *stoppedState:
-		p.c.state = s
-		return nil
-	case *pausedState:
-		return nil
-	}
-	return newStateTransitionError(p, s)
-}
-
-func (p *pausedState) destroy() error {
-	t, err := p.c.runType()
-	if err != nil {
-		return err
-	}
-	if t != Running && t != Created {
-		if err := p.c.cgroupManager.Freeze(configs.Thawed); err != nil {
-			return err
-		}
-		return destroy(p.c)
-	}
-	return newGenericError(fmt.Errorf("container is paused"), ContainerPaused)
-}
-
-// restoredState is the same as the running state but also has associated checkpoint
-// information that maybe need destroyed when the container is stopped and destroy is called.
-type restoredState struct {
-	imageDir string
-	c        *linuxContainer
-}
-
-func (r *restoredState) status() Status {
-	return Running
-}
-
-func (r *restoredState) transition(s containerState) error {
-	switch s.(type) {
-	case *stoppedState, *runningState:
-		return nil
-	}
-	return newStateTransitionError(r, s)
-}
-
-func (r *restoredState) destroy() error {
-	if _, err := os.Stat(filepath.Join(r.c.root, "checkpoint")); err != nil {
-		if !os.IsNotExist(err) {
-			return err
-		}
-	}
-	return destroy(r.c)
-}
-
-// loadedState is used whenever a container is restored, loaded, or setting additional
-// processes inside and it should not be destroyed when it is exiting.
-type loadedState struct {
-	c *linuxContainer
-	s Status
-}
-
-func (n *loadedState) status() Status {
-	return n.s
-}
-
-func (n *loadedState) transition(s containerState) error {
-	n.c.state = s
-	return nil
-}
-
-func (n *loadedState) destroy() error {
-	if err := n.c.refreshState(); err != nil {
-		return err
-	}
-	return n.c.state.destroy()
-}
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/stats.go b/vendor/github.com/opencontainers/runc/libcontainer/stats.go
deleted file mode 100644
index 303e4b94c..000000000
--- a/vendor/github.com/opencontainers/runc/libcontainer/stats.go
+++ /dev/null
@@ -1,15 +0,0 @@
-package libcontainer
-
-type NetworkInterface struct {
-	// Name is the name of the network interface.
-	Name string
-
-	RxBytes   uint64
-	RxPackets uint64
-	RxErrors  uint64
-	RxDropped uint64
-	TxBytes   uint64
-	TxPackets uint64
-	TxErrors  uint64
-	TxDropped uint64
-}
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/stats_linux.go b/vendor/github.com/opencontainers/runc/libcontainer/stats_linux.go
deleted file mode 100644
index 29fd641e9..000000000
--- a/vendor/github.com/opencontainers/runc/libcontainer/stats_linux.go
+++ /dev/null
@@ -1,10 +0,0 @@
-package libcontainer
-
-import "github.com/opencontainers/runc/libcontainer/cgroups"
-import "github.com/opencontainers/runc/libcontainer/intelrdt"
-
-type Stats struct {
-	Interfaces    []*NetworkInterface
-	CgroupStats   *cgroups.Stats
-	IntelRdtStats *intelrdt.Stats
-}
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/sync.go b/vendor/github.com/opencontainers/runc/libcontainer/sync.go
deleted file mode 100644
index cf7b45bc3..000000000
--- a/vendor/github.com/opencontainers/runc/libcontainer/sync.go
+++ /dev/null
@@ -1,107 +0,0 @@
-package libcontainer
-
-import (
-	"encoding/json"
-	"fmt"
-	"io"
-
-	"github.com/opencontainers/runc/libcontainer/utils"
-)
-
-type syncType string
-
-// Constants that are used for synchronisation between the parent and child
-// during container setup. They come in pairs (with procError being a generic
-// response which is followed by a &genericError).
-//
-// [  child  ] <-> [   parent   ]
-//
-// procHooks   --> [run hooks]
-//             <-- procResume
-//
-// procConsole -->
-//             <-- procConsoleReq
-//  [send(fd)] --> [recv(fd)]
-//             <-- procConsoleAck
-//
-// procReady   --> [final setup]
-//             <-- procRun
-const (
-	procError  syncType = "procError"
-	procReady  syncType = "procReady"
-	procRun    syncType = "procRun"
-	procHooks  syncType = "procHooks"
-	procResume syncType = "procResume"
-)
-
-type syncT struct {
-	Type syncType `json:"type"`
-}
-
-// writeSync is used to write to a synchronisation pipe. An error is returned
-// if there was a problem writing the payload.
-func writeSync(pipe io.Writer, sync syncType) error {
-	if err := utils.WriteJSON(pipe, syncT{sync}); err != nil {
-		return err
-	}
-	return nil
-}
-
-// readSync is used to read from a synchronisation pipe. An error is returned
-// if we got a genericError, the pipe was closed, or we got an unexpected flag.
-func readSync(pipe io.Reader, expected syncType) error {
-	var procSync syncT
-	if err := json.NewDecoder(pipe).Decode(&procSync); err != nil {
-		if err == io.EOF {
-			return fmt.Errorf("parent closed synchronisation channel")
-		}
-
-		if procSync.Type == procError {
-			var ierr genericError
-
-			if err := json.NewDecoder(pipe).Decode(&ierr); err != nil {
-				return fmt.Errorf("failed reading error from parent: %v", err)
-			}
-
-			return &ierr
-		}
-
-		if procSync.Type != expected {
-			return fmt.Errorf("invalid synchronisation flag from parent")
-		}
-	}
-	return nil
-}
-
-// parseSync runs the given callback function on each syncT received from the
-// child. It will return once io.EOF is returned from the given pipe.
-func parseSync(pipe io.Reader, fn func(*syncT) error) error {
-	dec := json.NewDecoder(pipe)
-	for {
-		var sync syncT
-		if err := dec.Decode(&sync); err != nil {
-			if err == io.EOF {
-				break
-			}
-			return err
-		}
-
-		// We handle this case outside fn for cleanliness reasons.
-		var ierr *genericError
-		if sync.Type == procError {
-			if err := dec.Decode(&ierr); err != nil && err != io.EOF {
-				return newSystemErrorWithCause(err, "decoding proc error from init")
-			}
-			if ierr != nil {
-				return ierr
-			}
-			// Programmer error.
-			panic("No error following JSON procError payload.")
-		}
-
-		if err := fn(&sync); err != nil {
-			return err
-		}
-	}
-	return nil
-}
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/utils/cmsg.go b/vendor/github.com/opencontainers/runc/libcontainer/utils/cmsg.go
deleted file mode 100644
index c8a9364d5..000000000
--- a/vendor/github.com/opencontainers/runc/libcontainer/utils/cmsg.go
+++ /dev/null
@@ -1,93 +0,0 @@
-// +build linux
-
-package utils
-
-/*
- * Copyright 2016, 2017 SUSE LLC
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-import (
-	"fmt"
-	"os"
-
-	"golang.org/x/sys/unix"
-)
-
-// MaxSendfdLen is the maximum length of the name of a file descriptor being
-// sent using SendFd. The name of the file handle returned by RecvFd will never
-// be larger than this value.
-const MaxNameLen = 4096
-
-// oobSpace is the size of the oob slice required to store a single FD. Note
-// that unix.UnixRights appears to make the assumption that fd is always int32,
-// so sizeof(fd) = 4.
-var oobSpace = unix.CmsgSpace(4)
-
-// RecvFd waits for a file descriptor to be sent over the given AF_UNIX
-// socket. The file name of the remote file descriptor will be recreated
-// locally (it is sent as non-auxiliary data in the same payload).
-func RecvFd(socket *os.File) (*os.File, error) {
-	// For some reason, unix.Recvmsg uses the length rather than the capacity
-	// when passing the msg_controllen and other attributes to recvmsg.  So we
-	// have to actually set the length.
-	name := make([]byte, MaxNameLen)
-	oob := make([]byte, oobSpace)
-
-	sockfd := socket.Fd()
-	n, oobn, _, _, err := unix.Recvmsg(int(sockfd), name, oob, 0)
-	if err != nil {
-		return nil, err
-	}
-
-	if n >= MaxNameLen || oobn != oobSpace {
-		return nil, fmt.Errorf("recvfd: incorrect number of bytes read (n=%d oobn=%d)", n, oobn)
-	}
-
-	// Truncate.
-	name = name[:n]
-	oob = oob[:oobn]
-
-	scms, err := unix.ParseSocketControlMessage(oob)
-	if err != nil {
-		return nil, err
-	}
-	if len(scms) != 1 {
-		return nil, fmt.Errorf("recvfd: number of SCMs is not 1: %d", len(scms))
-	}
-	scm := scms[0]
-
-	fds, err := unix.ParseUnixRights(&scm)
-	if err != nil {
-		return nil, err
-	}
-	if len(fds) != 1 {
-		return nil, fmt.Errorf("recvfd: number of fds is not 1: %d", len(fds))
-	}
-	fd := uintptr(fds[0])
-
-	return os.NewFile(fd, string(name)), nil
-}
-
-// SendFd sends a file descriptor over the given AF_UNIX socket. In
-// addition, the file.Name() of the given file will also be sent as
-// non-auxiliary data in the same payload (allowing to send contextual
-// information for a file descriptor).
-func SendFd(socket *os.File, name string, fd uintptr) error {
-	if len(name) >= MaxNameLen {
-		return fmt.Errorf("sendfd: filename too long: %s", name)
-	}
-	oob := unix.UnixRights(int(fd))
-	return unix.Sendmsg(int(socket.Fd()), []byte(name), oob, nil, 0)
-}
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/utils/utils.go b/vendor/github.com/opencontainers/runc/libcontainer/utils/utils.go
deleted file mode 100644
index baa54c9ba..000000000
--- a/vendor/github.com/opencontainers/runc/libcontainer/utils/utils.go
+++ /dev/null
@@ -1,127 +0,0 @@
-package utils
-
-import (
-	"crypto/rand"
-	"encoding/hex"
-	"encoding/json"
-	"io"
-	"os"
-	"path/filepath"
-	"strings"
-	"unsafe"
-
-	"golang.org/x/sys/unix"
-)
-
-const (
-	exitSignalOffset = 128
-)
-
-// GenerateRandomName returns a new name joined with a prefix.  This size
-// specified is used to truncate the randomly generated value
-func GenerateRandomName(prefix string, size int) (string, error) {
-	id := make([]byte, 32)
-	if _, err := io.ReadFull(rand.Reader, id); err != nil {
-		return "", err
-	}
-	if size > 64 {
-		size = 64
-	}
-	return prefix + hex.EncodeToString(id)[:size], nil
-}
-
-// ResolveRootfs ensures that the current working directory is
-// not a symlink and returns the absolute path to the rootfs
-func ResolveRootfs(uncleanRootfs string) (string, error) {
-	rootfs, err := filepath.Abs(uncleanRootfs)
-	if err != nil {
-		return "", err
-	}
-	return filepath.EvalSymlinks(rootfs)
-}
-
-// ExitStatus returns the correct exit status for a process based on if it
-// was signaled or exited cleanly
-func ExitStatus(status unix.WaitStatus) int {
-	if status.Signaled() {
-		return exitSignalOffset + int(status.Signal())
-	}
-	return status.ExitStatus()
-}
-
-// WriteJSON writes the provided struct v to w using standard json marshaling
-func WriteJSON(w io.Writer, v interface{}) error {
-	data, err := json.Marshal(v)
-	if err != nil {
-		return err
-	}
-	_, err = w.Write(data)
-	return err
-}
-
-// CleanPath makes a path safe for use with filepath.Join. This is done by not
-// only cleaning the path, but also (if the path is relative) adding a leading
-// '/' and cleaning it (then removing the leading '/'). This ensures that a
-// path resulting from prepending another path will always resolve to lexically
-// be a subdirectory of the prefixed path. This is all done lexically, so paths
-// that include symlinks won't be safe as a result of using CleanPath.
-func CleanPath(path string) string {
-	// Deal with empty strings nicely.
-	if path == "" {
-		return ""
-	}
-
-	// Ensure that all paths are cleaned (especially problematic ones like
-	// "/../../../../../" which can cause lots of issues).
-	path = filepath.Clean(path)
-
-	// If the path isn't absolute, we need to do more processing to fix paths
-	// such as "../../../../<etc>/some/path". We also shouldn't convert absolute
-	// paths to relative ones.
-	if !filepath.IsAbs(path) {
-		path = filepath.Clean(string(os.PathSeparator) + path)
-		// This can't fail, as (by definition) all paths are relative to root.
-		path, _ = filepath.Rel(string(os.PathSeparator), path)
-	}
-
-	// Clean the path again for good measure.
-	return filepath.Clean(path)
-}
-
-// SearchLabels searches a list of key-value pairs for the provided key and
-// returns the corresponding value. The pairs must be separated with '='.
-func SearchLabels(labels []string, query string) string {
-	for _, l := range labels {
-		parts := strings.SplitN(l, "=", 2)
-		if len(parts) < 2 {
-			continue
-		}
-		if parts[0] == query {
-			return parts[1]
-		}
-	}
-	return ""
-}
-
-// Annotations returns the bundle path and user defined annotations from the
-// libcontainer state.  We need to remove the bundle because that is a label
-// added by libcontainer.
-func Annotations(labels []string) (bundle string, userAnnotations map[string]string) {
-	userAnnotations = make(map[string]string)
-	for _, l := range labels {
-		parts := strings.SplitN(l, "=", 2)
-		if len(parts) < 2 {
-			continue
-		}
-		if parts[0] == "bundle" {
-			bundle = parts[1]
-		} else {
-			userAnnotations[parts[0]] = parts[1]
-		}
-	}
-	return
-}
-
-func GetIntSize() int {
-	return int(unsafe.Sizeof(1))
-}
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/utils/utils_unix.go b/vendor/github.com/opencontainers/runc/libcontainer/utils/utils_unix.go
deleted file mode 100644
index c96088988..000000000
--- a/vendor/github.com/opencontainers/runc/libcontainer/utils/utils_unix.go
+++ /dev/null
@@ -1,44 +0,0 @@
-// +build !windows
-
-package utils
-
-import (
-	"io/ioutil"
-	"os"
-	"strconv"
-
-	"golang.org/x/sys/unix"
-)
-
-func CloseExecFrom(minFd int) error {
-	fdList, err := ioutil.ReadDir("/proc/self/fd")
-	if err != nil {
-		return err
-	}
-	for _, fi := range fdList {
-		fd, err := strconv.Atoi(fi.Name())
-		if err != nil {
-			// ignore non-numeric file names
-			continue
-		}
-
-		if fd < minFd {
-			// ignore descriptors lower than our specified minimum
-			continue
-		}
-
-		// intentionally ignore errors from unix.CloseOnExec
-		unix.CloseOnExec(fd)
-		// the cases where this might fail are basically file descriptors that have already been closed (including and especially the one that was created when ioutil.ReadDir did the "opendir" syscall)
-	}
-	return nil
-}
-
-// NewSockPair returns a new unix socket pair
-func NewSockPair(name string) (parent *os.File, child *os.File, err error) {
-	fds, err := unix.Socketpair(unix.AF_LOCAL, unix.SOCK_STREAM|unix.SOCK_CLOEXEC, 0)
-	if err != nil {
-		return nil, nil, err
-	}
-	return os.NewFile(uintptr(fds[1]), name+"-p"), os.NewFile(uintptr(fds[0]), name+"-c"), nil
-}