deps: bump to go-criu v8.3.0, drop google protobuf

[kolyshkin]

go-criu v8.3.0 partially switches to protobuf-go-lite 1, which helps
to remove google.golang.org/protobuf dependency from here,
reducing the runc binary size from ~16M to ~14M.

The only missing piece is proto.String, proto.Bool, proto.Int32 etc.
helpers that return a pointer to a given variable. Those are replaced
by a generic mkPtr, which in turn is to be replaced by the new builtin
once Go < 1.26 is no longer supported.

[kolyshkin]

Here's the size comparison via gsa. Here

• runc.go-criu-v8.2.0 is built from deps: bump go-criu to v8.2.0 #5313
• runc is built from this PR.

TL;DR: new binary is ~12% (~2MB) smaller (16 -> 14 MB).

┌─────────────────────────────────────────────────────────────────────────────────────────┐
│ Diff between runc.go-criu-v8.2.0 and runc                                               │
├──────────┬──────────────────────────────────────────────┬──────────┬──────────┬─────────┤
│ PERCENT  │ NAME                                         │ OLD SIZE │ NEW SIZE │ DIFF    │
├──────────┼──────────────────────────────────────────────┼──────────┼──────────┼─────────┤
│ +382.76% │ github.com/checkpoint-restore/go-criu/v8     │ 110 kB   │ 533 kB   │ +422 kB │
│ +100%    │ github.com/aperturerobotics/protobuf-go-lite │          │ 3.8 kB   │ +3.8 kB │
  .... (skipped diffs < 1KB) ....
│ -7.82%   │ <unnamed:generated>                          │ 161 kB   │ 148 kB   │ -13 kB  │
│ -4.26%   │ runtime                                      │ 1.4 MB   │ 1.3 MB   │ -58 kB  │
│ -100%    │ google.golang.org/protobuf                   │ 1.5 MB   │          │ -1.5 MB │
├──────────┼──────────────────────────────────────────────┼──────────┼──────────┼─────────┤
│ +104.01% │ .gopclntab                                   │ 49 kB    │ 99 kB    │ +50 kB  │
│ -1.98%   │ .noptrdata                                   │ 30 kB    │ 30 kB    │ -600 B  │
│ -2.37%   │ .rodata                                      │ 90 kB    │ 88 kB    │ -2.1 kB │
│ -12.67%  │ .data                                        │ 81 kB    │ 71 kB    │ -10 kB  │
│ -19.39%  │ .data.rel.ro                                 │ 266 kB   │ 214 kB   │ -52 kB  │
├──────────┼──────────────────────────────────────────────┼──────────┼──────────┼─────────┤
│ -11.72%  │ runc.go-criu-v8.2.0                          │ 16 MB    │ 14 MB    │ -1.9 MB │
│          │ runc                                         │          │          │         │
└──────────┴──────────────────────────────────────────────┴──────────┴──────────┴─────────┘

[kolyshkin]

[kir@kir-tp1 runc]$ ls -l runc runc.after 
-rwxr-xr-x. 1 kir kir 16189280 Jun 15 10:14 runc
-rwxr-xr-x. 1 kir kir 14295872 Jun 15 10:14 runc.after

[kir@kir-tp1 runc]$ ls -lh runc runc.after 
-rwxr-xr-x. 1 kir kir 16M Jun 15 10:14 runc
-rwxr-xr-x. 1 kir kir 14M Jun 15 10:14 runc.after

[kir@kir-tp1 runc]$ size runc runc.after  | column -t
text      data     bss       dec       hex      filename
10102612  1453705  33786120  45342437  2b3dee5  runc
8989599   1243465  33783560  44016624  29fa3f0  runc.after

[kolyshkin]

Reducing the binary size helps rootless execution times, since we spend about 1/3 of runc exec copying our binary via sendfile (last time I checked).

[kir@kir-tp1 runc-rootless]$ hyperfine './runc exec 1234 /bin/true' './runc.after exec 1234 /bin/true' './runc exec 1234 /bin/true'
Benchmark 1: ./runc exec 1234 /bin/true
  Time (mean ± σ):      13.2 ms ±   1.4 ms    [User: 4.5 ms, System: 11.0 ms]
  Range (min … max):    10.6 ms …  20.8 ms    228 runs
 
Benchmark 2: ./runc.after exec 1234 /bin/true
  Time (mean ± σ):      12.3 ms ±   1.3 ms    [User: 4.2 ms, System: 10.4 ms]
  Range (min … max):     9.6 ms …  20.6 ms    248 runs
 
Benchmark 3: ./runc exec 1234 /bin/true
  Time (mean ± σ):      13.4 ms ±   1.3 ms    [User: 4.4 ms, System: 11.4 ms]
  Range (min … max):    10.6 ms …  18.6 ms    236 runs
 
Summary
  ./runc.after exec 1234 /bin/true ran
    1.07 ± 0.16 times faster than ./runc exec 1234 /bin/true
    1.09 ± 0.15 times faster than ./runc exec 1234 /bin/true

[rata]

@kolyshkin awesome! LGTM, thanks!!

[rata]

CRIU repos seem broken :(

[kolyshkin]

CRIU repos seem broken :(

Yeah this part (installing criu from OBS or launchpad) was always more brittle.

[kolyshkin]

I think the chance of c/r breakage is very low and we can backport this to 1.5.0; wdyt @cyphar ?

[kolyshkin]

@opencontainers/runc-maintainers PTAL

[thaJeztah]

Nice! TIL about https://github.com/aperturerobotics/protobuf-go-lite - looks interesting

[kolyshkin]

Nice! TIL about https://github.com/aperturerobotics/protobuf-go-lite - looks interesting

The use case is small(ish) -- embedded stuff (where memory and disk space are tight) and tools like runc, where we should really try to keep the binary size down because we copy it for every run/start/exec (currently only for rootless).