libct/devices: move config to libct/cg/devices/config

[kolyshkin]

This is the next step to facilitate separation of libct/cgroups as per https://github.com/opencontainers/tob/blob/main/proposals/cgroups.md

Currently, libcontainer/devices contains two things:

1. Device-related configuration data structures and accompanying
   methods. Those are used by runc itself, mostly by libct/cgroups.

2. A few functions (HostDevices, DeviceFromPath, GetDevices).
   Those are not used by runc directly, but have some external users
   (cri-o, microsoft/hcsshim), and they also have a few forks
   (containerd/pkg/oci, podman/pkg/util).

This commit moves (1) to a new separate package, config (under
libcontainer/cgroups/devices), adding a backward-compatible aliases
(marked as deprecated so we will be able to remove those later).

(As for (2), I think something like moby/sys#181 should be done)

[kolyshkin]

So,

1. this CAN NOT be moved to libcontainer/cgroups (like we did with the rest of cgroups-related configs in libct/configs: move cgroup configs to libct/cgroups #4472) because some IDs (Type, Rule, Permissions) are too generic, and renaming them (to DeviceType, DeviceRule, DevicePermissions) will break backward compatibility (mostly due to Rulebeing embedded intoDevice`);
2. this CAN NOT be moved to libcontainer/cgroups/devices as it is a special package (importing it enables cgroup managers to manage devices (see https://github.com/opencontainers/runc/blob/main/libcontainer/cgroups/devices/devices.go) and makes binaries larger due to more dependencies like cilium/ebpf);
3. this CAN be moved to any other new package under libct/cgroups, e.g. libcontainer/cgroups/devconfig or something like this) -- please let me know it it's better than devices/config;
4. this COULD HAVE BEEN moved to libcontainer/cgroups/configs but in libct/configs: move cgroup configs to libct/cgroups #4472 we've decided to go without this package (although I should have thought about devices at that time, and I missed it).

So, it's either the way it is now in this PR, or we can break the backward compatibility and go with 1, or we go with 3.

WDYT @thaJeztah ?

[kolyshkin]

I want libcontainer/cgroups to be moved to https://github.com/opencontainers/cgroups before we hit v1.3.0, and this is a necessary step. PTAL @opencontainers/runc-maintainers 🙏

[lifubang]

Just only a question, in fact, it seems that all things in this file are not used by runc after we moved this function to another place, maybe we can mark the whole package deprecated? But maybe they are used by some other projects, so we need to keep these unneeded codes here?

[lifubang]

Because of the above reason, I suggest to move all this file to ‘github.com/opencontainers/runc/libcontainer/cgroups/devices/config’, the other reason is that if someone wants to use these functions besides with ‘github.com/opencontainers/runc/libcontainer/cgroups/devices/config’, he needs to import these two packages, it will make us confused. WDYT?

[kolyshkin]

it seems that all things in this file are not used by runc after we moved this function to another place, maybe we can mark the whole package deprecated?

We could, but usually while doing so, you have to suggest a replacement. Alas, I can't suggest any replacement at this time. As noted in this PR description, there are forks of this code (in containerd/pkg/oci and podman/pkg/util) but they are not a direct replacement.

But maybe they are used by some other projects, so we need to keep these unneeded codes here?

Exactly. As noted in description:

2. A few functions (HostDevices, DeviceFromPath, GetDevices).
   Those are not used by runc directly, but have some external users
   (cri-o, microsoft/hcsshim)

So,

• we can't remove this;
• we can't mark them deprecated (as we can't offer an alternative);

The long-term plan for this is also in the description:

(As for (2), I think something like moby/sys#181 should be done)

Now,

Because of the above reason, I suggest to move all this file to ‘github.com/opencontainers/runc/libcontainer/cgroups/devices/config’

So, these two things (1 and 2 in the description) are really not related. 1 is used by runc (in particular, by libcontainer/cgroups) and this is why this PR moves it there. 2 has some external users, and the long term plan is to move it to moby (see moby/sys#181).

The big picture here is, we want to move libcontainer/cgroups to a separate repository (see https://github.com/opencontainers/tob/blob/main/proposals/cgroups.md), and for that we need to make it as self-contained as possible. For this, (1) from the description goes to libcontainer/cgroups, and (2) stays where it is.

Let me know if I can clarify this further.

[lifubang]

Yes, I got it now, thanks your explanation, it seems that the current solution is the best decision at this time.

Needs more change