[martijnhoekstra]

Description

make lint pins golangci-lint v2.9, which can't load a go1.27.3 module, so it stops before linting. The lint workflow moved to v2.15 with the Go v1.27.2 update in ee1476e; the Makefile stayed behind. With v2.15, six findings show up that CI doesn't report because of only-new-issues. This PR updates the Makefile and fixes or annotates those findings, one commit each, plus a follow-up:

1. The Makefile's golangci-lint goes to v2.15, as in the lint workflow.
2. dupl: the hvt and spt BuildExecCmd bodies were identical; both now call one solo5ExecCmd.
3. gosec G115 in getUnprivilegedMountFlags: the ST_* flags are compared as int64, the type of Statfs_t.Flags on amd64 and arm64, instead of converting the flags to uintptr.
4. gosec G702 and G703 in cmd/urunc/utils.go are annotated as false positives: runcExec hands non-unikernel containers to runc with urunc's own arguments, and prepareXDGRuntimeDir only creates $XDG_RUNTIME_DIR/urunc for a rootless user.
5. Follow-up, to take or leave: prepareXDGRuntimeDir creates urunc through an os.Root opened on $XDG_RUNTIME_DIR, so a symlink can't send MkdirAll or Chmod outside it, and the G703 annotations go. G702 has no sanitizers in gosec v2.29, so the runcExec annotation stays. One behaviour change: $XDG_RUNTIME_DIR itself must now exist, as the XDG specification requires; before, MkdirAll created it.

Related issues

• Fixes make lint fails locally #1201

How was this tested?

• golangci-lint v2.15 with make lint's command (golangci-lint run -v --timeout=5m) reports 0 issues, with and without the follow-up.
• All unit test targets pass (test_unikontainers as a non-root user).
• go build ./... passes for amd64; pkg/unikontainers also builds and vets for arm64.
• New unit tests for prepareXDGRuntimeDir in cmd/urunc (go test ./cmd/urunc; the make unittest targets don't cover that package): the directory gets mode 0700 with the sticky bit, a missing $XDG_RUNTIME_DIR is an error, and a urunc symlink pointing outside is refused without touching its target. On the code before the follow-up, the last two fail.
• Rootless by hand: XDG_RUNTIME_DIR=/tmp/xdg urunc ... as a non-root user creates /tmp/xdg/urunc as drwx-----T.
• The ctr e2e suite with urunc built by make static and Firecracker v1.7.0: all 14 specs the test machine can run pass, including the four hvt and spt Mirage specs. Skipped because the machine lacks devmapper, virtiofsd and Hyperlight: the two rumprun specs, Qemu-linux-read-file-virtiofs and Hyperlight-unikraft-hello.

LLM usage

Claude Opus 5.5 (claude-opus-5-5) helped write the changes and this description, and ran the tests above. I reviewed the changes and the results.

Checklist

• I have read the contribution guide.
• The linter passes locally (make lint).
• The e2e tests of at least one tool pass locally (make test_ctr, make test_nerdctl, make test_docker, make test_crictl).
• If LLMs were used: I have read the llm policy.

[netlify]

👷 Deploy request for urunc pending review.

Visit the deploys page to approve it

Name	Link
🔨 Latest commit	21f8d4e