build: preserve default CFLAGS for libseccomp

[hakman]

When CFLAGS is unset, the per-architecture libseccomp build loop resets it to an empty value and set_cross_vars exports it. This prevents Autoconf from applying its default -g -O2 flags, leaving libseccomp unoptimized. Release builds link against these per-architecture copies, including for the native architecture.

Restore an unset CFLAGS before each architecture build instead of exporting an empty value. This lets configure choose its defaults when set_cross_vars does not add architecture-specific CFLAGS, while preserving explicitly empty and custom caller values.

In an amd64 comparison of matched runc v1.5.1 builds with libseccomp 2.6.0 on an Azure D16ds_v5, building libseccomp with -g -O2 instead of empty CFLAGS reduced mean runc run time with containerd's RuntimeDefault seccomp profile from 43.16 ms to 36.24 ms, approximately 16%, over 200 samples per variant.

[kolyshkin]

Oh my.

I think the right approach here should use something like

if [ -v CFLAGS ]; then
   local original_cflags="$CFLAGS"
fi
...
# Reset CFLAGS.
if [ -v original_cflags ]; then
    CFLAGS="$original_cflags"
else
    unset CFLAGS
fi

[hakman]

Thanks for the review @kolyshkin, updated.

[kolyshkin]

Thanks, this works!

Yet better idea is to not change CFLAGS in set_cross_vars, so we won't have to save/restore it

[kolyshkin]

Yet better idea is to not change CFLAGS in set_cross_vars, so we won't have to save/restore it

We also have the same issue in script/release_build.sh.

Opened #5464 as an alternative

[hakman]

Yet better idea is to not change CFLAGS in set_cross_vars, so we won't have to save/restore it

We also have the same issue in script/release_build.sh.

Opened #5464 as an alternative

Thanks, looks like a more complete alternative. I don't think there's any reason to keep this one open anymore.