pkg/sys

Cross-platform syscalls and filesystem primitives. The shim between containerd's portable Go code and the platform-specific things that have to be done in each OS.

Purpose

• Centralize platform-dependent file/permission/cgroup/socket logic.
• Make _linux.go / _windows.go splits the exception, not the rule, in higher-level code.

Notable helpers

Helper	File	Purpose
MkdirAllWithACL	pkg/sys/filesys_*.go	Create a directory tree with appropriate ACL/mode for the platform
OpenLockedFile	pkg/sys/oom_unix.go	OOM-related per-pid file handling
SetOOMScore	pkg/sys/oom_*.go	Set the daemon's OOM score (Linux)
SetSubreaper	pkg/sys/proc_*.go	Make the daemon a subreaper of orphaned processes (Linux)
RunningInUserNS	pkg/sys/userns_*.go	Detect user-namespace nesting
RunningPrivileged	pkg/sys/privileges_*.go	Detect whether the daemon has the necessary capabilities
EnsureRemoveAll	pkg/sys/filesys_*.go	Robust recursive remove that retries on EBUSY
Listen*	pkg/sys/listen_*.go	Cross-platform listen helpers (Unix sockets, Windows named pipes)

Subdirectories

• pkg/sys/reaper/ — child reaper for the shim and the daemon (Linux). Catches SIGCHLD and harvests zombies.
• pkg/sys/socket/ — socket-pair helpers used by the shim's stdio plumbing.

Why centralize

• The reaper and OOM helpers in particular are subtle (they must be set up before any goroutine forks). Keeping them in one package prevents subtle bugs from sneaking in elsewhere.
• The Windows ACL handling is non-obvious (CIFS-style ACL strings); having it in one place avoids reinvention.

Entry points for modification

• New syscall wrapper: add _linux.go/_windows.go/_other.go triplet so the symbol exists everywhere even if it returns errors.ErrUnsupported on some platforms.
• New cross-platform listener type: extend pkg/sys/listen_*.go and pkg/dialer/.