@@ -27,6 +27,7 @@ import (

 	"github.com/containerd/containerd/defaults"

 	"github.com/containerd/containerd/pkg/dialer"

 	"github.com/containerd/containerd/remotes/docker"

+	"github.com/containerd/containerd/sys"

 	"github.com/docker/docker/api/types"

 	containertypes "github.com/docker/docker/api/types/container"

 	"github.com/docker/docker/api/types/swarm"

@@ -42,7 +43,6 @@ import (

 	"github.com/docker/docker/errdefs"

 	bkconfig "github.com/moby/buildkit/cmd/buildkitd/config"

 	"github.com/moby/buildkit/util/resolver"

-	rsystem "github.com/opencontainers/runc/libcontainer/system"

 	"github.com/sirupsen/logrus"

 	// register graph drivers

@@ -1040,7 +1040,7 @@ func NewDaemon(ctx context.Context, config *config.Config, pluginStore *plugin.S

 	sysInfo := d.RawSysInfo(false)

 	// Check if Devices cgroup is mounted, it is hard requirement for container security,

 	// on Linux.

-	if runtime.GOOS == "linux" && !sysInfo.CgroupDevicesEnabled && !rsystem.RunningInUserNS() {

+	if runtime.GOOS == "linux" && !sysInfo.CgroupDevicesEnabled && !sys.RunningInUserNS() {

 		return nil, errors.New("Devices cgroup isn't mounted")

 	}

@@ -18,6 +18,7 @@ import (

 	statsV1 "github.com/containerd/cgroups/stats/v1"

 	statsV2 "github.com/containerd/cgroups/v2/stats"

+	"github.com/containerd/containerd/sys"

 	"github.com/docker/docker/api/types"

 	"github.com/docker/docker/api/types/blkiodev"

 	pblkiodev "github.com/docker/docker/api/types/blkiodev"

@@ -44,7 +45,6 @@ import (

 	lntypes "github.com/docker/libnetwork/types"

 	"github.com/moby/sys/mount"

 	"github.com/opencontainers/runc/libcontainer/cgroups"

-	rsystem "github.com/opencontainers/runc/libcontainer/system"

 	specs "github.com/opencontainers/runtime-spec/specs-go"

 	"github.com/opencontainers/selinux/go-selinux/label"

 	"github.com/pkg/errors"

@@ -1668,7 +1668,7 @@ func setMayDetachMounts() error {

 		// Setting may_detach_mounts does not work in an

 		// unprivileged container. Ignore the error, but log

 		// it if we appear not to be in that situation.

-		if !rsystem.RunningInUserNS() {

+		if !sys.RunningInUserNS() {

 			logrus.Debugf("Permission denied writing %q to /proc/sys/fs/may_detach_mounts", "1")

 		}

 		return nil

@@ -1688,7 +1688,7 @@ func setupOOMScoreAdj(score int) error {

 		// Setting oom_score_adj does not work in an

 		// unprivileged container. Ignore the error, but log

 		// it if we appear not to be in that situation.

-		if !rsystem.RunningInUserNS() {

+		if !sys.RunningInUserNS() {

 			logrus.Debugf("Permission denied writing %q to /proc/self/oom_score_adj", stringScore)

 		}

 		return nil

@@ -35,6 +35,7 @@ import (

 	"strings"

 	"sync"

+	"github.com/containerd/containerd/sys"

 	"github.com/docker/docker/daemon/graphdriver"

 	"github.com/docker/docker/pkg/archive"

 	"github.com/docker/docker/pkg/chrootarchive"

@@ -44,7 +45,6 @@ import (

 	"github.com/docker/docker/pkg/locker"

 	"github.com/docker/docker/pkg/system"

 	"github.com/moby/sys/mount"

-	rsystem "github.com/opencontainers/runc/libcontainer/system"

 	"github.com/opencontainers/selinux/go-selinux/label"

 	"github.com/pkg/errors"

 	"github.com/sirupsen/logrus"

@@ -177,7 +177,7 @@ func supportsAufs() error {

 	// proc/filesystems for when aufs is supported

 	exec.Command("modprobe", "aufs").Run()

-	if rsystem.RunningInUserNS() {

+	if sys.RunningInUserNS() {

 		return ErrAufsNested

 	}

@@ -11,9 +11,9 @@ import (

 	"syscall"

 	"time"

+	"github.com/containerd/containerd/sys"

 	"github.com/docker/docker/pkg/pools"

 	"github.com/docker/docker/pkg/system"

-	rsystem "github.com/opencontainers/runc/libcontainer/system"

 	"golang.org/x/sys/unix"

 )

@@ -184,7 +184,7 @@ func DirCopy(srcDir, dstDir string, copyMode Mode, copyXattrs bool) error {

 			}

 		case mode&os.ModeDevice != 0:

-			if rsystem.RunningInUserNS() {

+			if sys.RunningInUserNS() {

 				// cannot create a device if running in user namespace

 				return nil

 			}

@@ -14,6 +14,7 @@ import (

 	"path/filepath"

 	"strings"

+	"github.com/containerd/containerd/sys"

 	"github.com/docker/docker/daemon/graphdriver"

 	"github.com/docker/docker/daemon/graphdriver/overlayutils"

 	"github.com/docker/docker/pkg/archive"

@@ -25,7 +26,6 @@ import (

 	"github.com/docker/docker/pkg/parsers/kernel"

 	"github.com/docker/docker/pkg/system"

 	"github.com/moby/sys/mount"

-	rsystem "github.com/opencontainers/runc/libcontainer/system"

 	"github.com/opencontainers/selinux/go-selinux/label"

 	"github.com/pkg/errors"

 	"github.com/sirupsen/logrus"

@@ -475,7 +475,7 @@ func (d *Driver) ApplyDiff(id string, parent string, diff io.Reader) (size int64

 		GIDMaps: d.gidMaps,

 		// Use AUFS whiteout format: https://github.com/containers/storage/blob/39a8d5ed9843844eafb5d2ba6e6a7510e0126f40/drivers/overlay/overlay.go#L1084-L1089

 		WhiteoutFormat: archive.AUFSWhiteoutFormat,

-		InUserNS:       rsystem.RunningInUserNS(),

+		InUserNS:       sys.RunningInUserNS(),

 	}); err != nil {

 		return 0, err

 	}

@@ -15,6 +15,7 @@ import (

 	"strings"

 	"sync"

+	"github.com/containerd/containerd/sys"

 	"github.com/docker/docker/daemon/graphdriver"

 	"github.com/docker/docker/daemon/graphdriver/overlayutils"

 	"github.com/docker/docker/daemon/graphdriver/quota"

@@ -29,7 +30,6 @@ import (

 	"github.com/docker/docker/pkg/system"

 	units "github.com/docker/go-units"

 	"github.com/moby/sys/mount"

-	rsystem "github.com/opencontainers/runc/libcontainer/system"

 	"github.com/opencontainers/selinux/go-selinux/label"

 	"github.com/sirupsen/logrus"

 	"golang.org/x/sys/unix"

@@ -683,7 +683,7 @@ func (d *Driver) ApplyDiff(id string, parent string, diff io.Reader) (size int64

 		UIDMaps:        d.uidMaps,

 		GIDMaps:        d.gidMaps,

 		WhiteoutFormat: archive.OverlayWhiteoutFormat,

-		InUserNS:       rsystem.RunningInUserNS(),

+		InUserNS:       sys.RunningInUserNS(),

 	}); err != nil {

 		return 0, err

 	}

@@ -57,7 +57,7 @@ import (

 	"path/filepath"

 	"unsafe"

-	rsystem "github.com/opencontainers/runc/libcontainer/system"

+	"github.com/containerd/containerd/sys"

 	"github.com/pkg/errors"

 	"github.com/sirupsen/logrus"

 	"golang.org/x/sys/unix"

@@ -90,7 +90,7 @@ func NewControl(basePath string) (*Control, error) {

 	// If we are running in a user namespace quota won't be supported for

 	// now since makeBackingFsDev() will try to mknod().

 	//

-	if rsystem.RunningInUserNS() {

+	if sys.RunningInUserNS() {

 		return nil, ErrQuotaNotSupported

 	}

@@ -14,6 +14,7 @@ import (

 	"github.com/containerd/containerd/containers"

 	coci "github.com/containerd/containerd/oci"

+	"github.com/containerd/containerd/sys"

 	containertypes "github.com/docker/docker/api/types/container"

 	"github.com/docker/docker/container"

 	daemonconfig "github.com/docker/docker/daemon/config"

@@ -28,7 +29,6 @@ import (

 	"github.com/opencontainers/runc/libcontainer/apparmor"

 	"github.com/opencontainers/runc/libcontainer/cgroups"

 	"github.com/opencontainers/runc/libcontainer/devices"

-	rsystem "github.com/opencontainers/runc/libcontainer/system"

 	"github.com/opencontainers/runc/libcontainer/user"

 	specs "github.com/opencontainers/runtime-spec/specs-go"

 	"github.com/pkg/errors"

@@ -857,7 +857,7 @@ func WithDevices(daemon *Daemon, c *container.Container) coci.SpecOpts {

 		var devs []specs.LinuxDevice

 		devPermissions := s.Linux.Resources.Devices

-		if c.HostConfig.Privileged && !rsystem.RunningInUserNS() {

+		if c.HostConfig.Privileged && !sys.RunningInUserNS() {

 			hostDevices, err := devices.HostDevices()

 			if err != nil {

 				return err