libct: close the mount source fd ASAP!

[lifubang]

This commit factors out setupAndMountToRootfs without changing any
logic. Use "Hide whitespace changes" during review to focus on the
actual changes.

The refactor ensures the mount source file descriptor is closed via
defer in each loop iteration, reducing the total number of open FDs
in runc. This helps avoid hitting the file descriptor limit under
high concurrency or when handling many mounts.

[Copilot]

Pull request overview

Close mount source file descriptors as soon as they are no longer needed during rootfs setup, reducing peak FD usage in runc (especially under high mount counts / concurrency).

Changes:

• Refactors mount source-fd acquisition logic into a new initMountEntry helper.
• Moves lifetime management of the mount source FD into mountToRootfs to close it immediately after each mount is processed.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[rata]

Just curious, are you seeing a lot fds and is causing issues for you?

[lifubang]

Just curious, are you seeing a lot fds and is causing issues for you?

This can fail under a restrictive nofile (max open files) limit when using many idmapped mounts. The second commit demonstrates the issue; without the fix in the first commit, the test fails.

[kolyshkin]

lgtm

[kolyshkin]

Guess you'd want 1.5 backport @lifubang ?

[lifubang]

Guess you'd want 1.5 backport @lifubang ?

Yes, it looks like a small bug.

[rata]

Thanks! Let's tune the error handling and simplify a little bit the code

[kolyshkin]

For review purposes, it would be nice to split the second commit into two

1. Factor out setupAndMountToRootfs.
2. Implement the fix.

Otherwise it is harder to review what exactly are you changing since you also move the code around.

Still LGTM though

[cyphar]

Yeah I agree @kolyshkin, it took me a couple of read-throughs to see what was being changed.

[lifubang]

2. Implement the fix.

In fact, no second fix is needed. As @rata suggested, factoring out setupAndMountToRootfs is sufficient to ensure the mount source file descriptor is closed in each loop iteration.

You can use “Hide whitespace changes” to make the review easier.

[kolyshkin]

2. Implement the fix.

In fact, no second fix is needed. As @rata suggested, factoring out setupAndMountToRootfs is sufficient to ensure the mount source file descriptor is closed in each loop iteration.

You can use “Hide whitespace changes” to make the review easier.

Thank you for clarification! Still LGTM )