Add support for v2 containerd metrics in the shim, v2 metrics are only used when runsc is run with --system-cgroup=true.
Containerd requires v2 metrics when the host is run with CGroupsV2.
This issue was noticed when attempting to gather metrics on AL2023 which defaults to CGroupsV2.

Fixes: #11472
Signed-off-by: Champ-Goblem <cameron@northflank.com>

…s-support

PiperOrigin-RevId: 730560110

PiperOrigin-RevId: 732128622

PiperOrigin-RevId: 732194076

PiperOrigin-RevId: 732286578

PiperOrigin-RevId: 732302179

PiperOrigin-RevId: 732340885

Exec'd processes cannot be stitched back to the original caller
and are killed after restore. So ignore failures
to restore host FDs (generally stdio) that belong
to them.

Fixes #11439

PiperOrigin-RevId: 732972054

Adding ctr instructions for an easier verification.

PiperOrigin-RevId: 733017114

This support is only needed when the gofer mount in question is writable.
By default, the rootfs has an overlayfs applied, so the gofer lower layer is
not writabled. But if you are using --overlay2=none, then this change should
allow you to save sandbox with open FDs to deleted files in rootfs.

Updates #11425

PiperOrigin-RevId: 733021267

This feature is controlled by an MSR; MSRs are per-CPU.

The Intel SDM doesn't document CPUID faulting, at least as of the Dec 2024
revision; despite the deleted comment in ring0/kernel_amd64.go, there is no
Vol. 3 Table 2-43, and every table in Vol. 4 ("Model-Specific Registers") lists
bit 31 in MSR_PLATFORM_INFO as "reserved". The only documentation seems to be
that cited by Linux's e9ea1e7f53b85 ("x86/arch_prctl: Add
ARCH_[GET|SET]_CPUID"): "Intel Virtualization Technology FlexMigration
Application Note" 323850-004, 2012. This document positions CPUID faulting as
an alternative way to support cross-CPU migration for VMs that don't use VMX;
consequently it does not clarify if CPUID faulting is effective in guest ("VMX
non-root") mode, or if the CPUID VM exit takes precedence. If the former is the
case then CPUID faulting is probably faster than setting app CPUID with
KVM_SET_CPUID2, and vice versa. But regardless, this is much simpler.

PiperOrigin-RevId: 733113944

This helps debugging `runsc` issues involving RPC overload, and helps
connect multiple `runsc` invocations' logs to their corresponding handling
in the Sentry.

PiperOrigin-RevId: 733123936

The OCI spec has entrypoint as the first argument in specs.Process.Args.
During testing, we observed inconsistencies in entrypoint resolution: it
was resolved during checkpoint but not during restore (or vice versa),
leading to spec validation failures. This CL corrects this by comparing the
absolute paths of entrypoints in spec validation.

PiperOrigin-RevId: 733200146