@@ -4047,6 +4047,13 @@ definitions:

         enum: ["cgroupfs", "systemd", "none"]

         default: "cgroupfs"

         example: "cgroupfs"

+      CgroupVersion:

+        description: |

+          The version of the cgroup.

+        type: "string"

+        enum: ["1", "2"]

+        default: "1"

+        example: "1"

       NEventsListener:

         description: "Number of event listeners subscribed."

         type: "integer"

@@ -175,6 +175,7 @@ type Info struct {

 	SystemTime         string

 	LoggingDriver      string

 	CgroupDriver       string

+	CgroupVersion      string `json:",omitempty"`

 	NEventsListener    int

 	KernelVersion      string

 	OperatingSystem    string

@@ -44,6 +44,7 @@ import (

 	"github.com/docker/docker/pkg/pidfile"

 	"github.com/docker/docker/pkg/plugingetter"

 	"github.com/docker/docker/pkg/signal"

+	"github.com/docker/docker/pkg/sysinfo"

 	"github.com/docker/docker/pkg/system"

 	"github.com/docker/docker/plugin"

 	"github.com/docker/docker/rootless"

@@ -452,7 +453,11 @@ func warnOnDeprecatedConfigOptions(config *config.Config) {

 }

 func initRouter(opts routerOptions) {

-	decoder := runconfig.ContainerDecoder{}

+	decoder := runconfig.ContainerDecoder{

+		GetSysInfo: func() *sysinfo.SysInfo {

+			return opts.daemon.RawSysInfo(true)

+		},

+	}

 	routers := []router.Router{

 		// we need to add the checkpoint router before the container router or the DELETE gets masked

@@ -42,6 +42,7 @@ import (

 	"github.com/docker/docker/errdefs"

 	bkconfig "github.com/moby/buildkit/cmd/buildkitd/config"

 	"github.com/moby/buildkit/util/resolver"

+	rsystem "github.com/opencontainers/runc/libcontainer/system"

 	"github.com/sirupsen/logrus"

 	// register graph drivers

@@ -56,7 +57,6 @@ import (

 	"github.com/docker/docker/pkg/idtools"

 	"github.com/docker/docker/pkg/locker"

 	"github.com/docker/docker/pkg/plugingetter"

-	"github.com/docker/docker/pkg/sysinfo"

 	"github.com/docker/docker/pkg/system"

 	"github.com/docker/docker/pkg/truncindex"

 	"github.com/docker/docker/plugin"

@@ -1026,10 +1026,10 @@ func NewDaemon(ctx context.Context, config *config.Config, pluginStore *plugin.S

 		return nil, err

 	}

-	sysInfo := sysinfo.New(false)

+	sysInfo := d.RawSysInfo(false)

 	// Check if Devices cgroup is mounted, it is hard requirement for container security,

 	// on Linux.

-	if runtime.GOOS == "linux" && !sysInfo.CgroupDevicesEnabled {

+	if runtime.GOOS == "linux" && !sysInfo.CgroupDevicesEnabled && !rsystem.RunningInUserNS() {

 		return nil, errors.New("Devices cgroup isn't mounted")

 	}

@@ -644,7 +644,7 @@ func verifyPlatformContainerSettings(daemon *Daemon, hostConfig *containertypes.

 	if hostConfig == nil {

 		return nil, nil

 	}

-	sysInfo := sysinfo.New(true)

+	sysInfo := daemon.RawSysInfo(true)

 	w, err := verifyPlatformContainerResources(&hostConfig.Resources, sysInfo, update)

@@ -1745,7 +1745,7 @@ func (daemon *Daemon) initCgroupsPath(path string) error {

 	}

 	path = filepath.Join(mnt, root, path)

-	sysInfo := sysinfo.New(true)

+	sysInfo := daemon.RawSysInfo(true)

 	if err := maybeCreateCPURealTimeFile(sysInfo.CPURealtimePeriod, daemon.configStore.CPURealtimePeriod, "cpu.rt_period_us", path); err != nil {

 		return err

 	}

@@ -1779,3 +1779,16 @@ func (daemon *Daemon) setupSeccompProfile() error {

 func (daemon *Daemon) useShimV2() bool {

 	return cgroups.IsCgroup2UnifiedMode()

 }

+

+// RawSysInfo returns *sysinfo.SysInfo .

+func (daemon *Daemon) RawSysInfo(quiet bool) *sysinfo.SysInfo {

+	var opts []sysinfo.Opt

+	if daemon.getCgroupDriver() == cgroupSystemdDriver {

+		rootlesskitParentEUID := os.Getenv("ROOTLESSKIT_PARENT_EUID")

+		if rootlesskitParentEUID != "" {

+			groupPath := fmt.Sprintf("/user.slice/user-%s.slice", rootlesskitParentEUID)

+			opts = append(opts, sysinfo.WithCgroup2GroupPath(groupPath))

+		}

+	}

+	return sysinfo.New(quiet, opts...)

+}

@@ -1,9 +1,18 @@

 // +build !linux,!freebsd,!windows

 package daemon // import "github.com/docker/docker/daemon"

-import "github.com/docker/docker/daemon/config"

+

+import (

+	"github.com/docker/docker/daemon/config"

+	"github.com/docker/docker/pkg/sysinfo"

+)

 const platformSupported = false

 func setupResolvConf(config *config.Config) {

 }

+

+// RawSysInfo returns *sysinfo.SysInfo .

+func (daemon *Daemon) RawSysInfo(quiet bool) *sysinfo.SysInfo {

+	return sysinfo.New(quiet)

+}

@@ -657,3 +657,8 @@ func setupResolvConf(config *config.Config) {

 func (daemon *Daemon) useShimV2() bool {

 	return true

 }

+

+// RawSysInfo returns *sysinfo.SysInfo .

+func (daemon *Daemon) RawSysInfo(quiet bool) *sysinfo.SysInfo {

+	return sysinfo.New(quiet)

+}

@@ -28,7 +28,7 @@ import (

 func (daemon *Daemon) SystemInfo() *types.Info {

 	defer metrics.StartTimer(hostInfoFunctions.WithValues("system_info"))()

-	sysInfo := sysinfo.New(true)

+	sysInfo := daemon.RawSysInfo(true)

 	cRunning, cPaused, cStopped := stateCtr.get()

 	v := &types.Info{

@@ -47,7 +47,6 @@ func (daemon *Daemon) SystemInfo() *types.Info {

 		NGoroutines:        runtime.NumGoroutine(),

 		SystemTime:         time.Now().Format(time.RFC3339Nano),

 		LoggingDriver:      daemon.defaultLogConfig.Type,

-		CgroupDriver:       daemon.getCgroupDriver(),

 		NEventsListener:    daemon.EventsService.SubscribersCount(),

 		KernelVersion:      kernelVersion(),

 		OperatingSystem:    operatingSystem(),

@@ -19,6 +19,12 @@ import (

 // fillPlatformInfo fills the platform related info.

 func (daemon *Daemon) fillPlatformInfo(v *types.Info, sysInfo *sysinfo.SysInfo) {

+	v.CgroupDriver = daemon.getCgroupDriver()

+	v.CgroupVersion = "1"

+	if sysInfo.CgroupUnified {

+		v.CgroupVersion = "2"

+	}

+

 	v.MemoryLimit = sysInfo.MemoryLimit

 	v.SwapLimit = sysInfo.SwapLimit

 	v.KernelMemory = sysInfo.KernelMemory

@@ -81,32 +87,43 @@ func (daemon *Daemon) fillPlatformInfo(v *types.Info, sysInfo *sysinfo.SysInfo)

 		v.InitCommit.ID = "N/A"

 	}

-	if !v.MemoryLimit {

-		v.Warnings = append(v.Warnings, "WARNING: No memory limit support")

-	}

-	if !v.SwapLimit {

-		v.Warnings = append(v.Warnings, "WARNING: No swap limit support")

-	}

-	if !v.KernelMemory {

-		v.Warnings = append(v.Warnings, "WARNING: No kernel memory limit support")

-	}

-	if !v.KernelMemoryTCP {

-		v.Warnings = append(v.Warnings, "WARNING: No kernel memory TCP limit support")

-	}

-	if !v.OomKillDisable {

-		v.Warnings = append(v.Warnings, "WARNING: No oom kill disable support")

-	}

-	if !v.CPUCfsQuota {

-		v.Warnings = append(v.Warnings, "WARNING: No cpu cfs quota support")

-	}

-	if !v.CPUCfsPeriod {

-		v.Warnings = append(v.Warnings, "WARNING: No cpu cfs period support")

-	}

-	if !v.CPUShares {

-		v.Warnings = append(v.Warnings, "WARNING: No cpu shares support")

-	}

-	if !v.CPUSet {

-		v.Warnings = append(v.Warnings, "WARNING: No cpuset support")

+	if v.CgroupDriver == cgroupNoneDriver {

+		if v.CgroupVersion == "2" {

+			v.Warnings = append(v.Warnings, "WARNING: Running in rootless-mode without cgroup. To enable cgroup in rootless-mode, you need to set exec-opt \"native.cgroupdriver=systemd\".")

+		} else {

+			v.Warnings = append(v.Warnings, "WARNING: Running in rootless-mode without cgroup. To enable cgroup in rootless-mode, you need to boot the system in cgroup v2 mode and set exec-opt \"native.cgroupdriver=systemd\".")

+		}

+	} else {

+		if !v.MemoryLimit {

+			v.Warnings = append(v.Warnings, "WARNING: No memory limit support")

+		}

+		if !v.SwapLimit {

+			v.Warnings = append(v.Warnings, "WARNING: No swap limit support")

+		}

+		if !v.KernelMemory {

+			v.Warnings = append(v.Warnings, "WARNING: No kernel memory limit support")

+		}

+		if !v.KernelMemoryTCP {

+			v.Warnings = append(v.Warnings, "WARNING: No kernel memory TCP limit support")

+		}

+		if !v.OomKillDisable {

+			v.Warnings = append(v.Warnings, "WARNING: No oom kill disable support")

+		}

+		if !v.CPUCfsQuota {

+			v.Warnings = append(v.Warnings, "WARNING: No cpu cfs quota support")

+		}

+		if !v.CPUCfsPeriod {

+			v.Warnings = append(v.Warnings, "WARNING: No cpu cfs period support")

+		}

+		if !v.CPUShares {

+			v.Warnings = append(v.Warnings, "WARNING: No cpu shares support")

+		}

+		if !v.CPUSet {

+			v.Warnings = append(v.Warnings, "WARNING: No cpuset support")

+		}

+		if v.CgroupVersion == "2" {

+			v.Warnings = append(v.Warnings, "WARNING: Support for cgroup v2 is experimental")

+		}

 	}

 	if !v.IPv4Forwarding {

 		v.Warnings = append(v.Warnings, "WARNING: IPv4 forwarding is disabled")

@@ -17,6 +17,7 @@ keywords: "API, Docker, rcli, REST, documentation"

 [Docker Engine API v1.41](https://docs.docker.com/engine/api/v1.41/) documentation

+* `GET /info` now returns an `CgroupVersion` field, containing the cgroup version.

 * `POST /services/create` and `POST /services/{id}/update` now supports `BindOptions.NonRecursive`.

 * The `ClusterStore` and `ClusterAdvertise` fields in `GET /info` are deprecated

   and are now omitted if they contain an empty value. This change is not versioned,

new file mode 100644

@@ -0,0 +1,151 @@

+package sysinfo // import "github.com/docker/docker/pkg/sysinfo"

+

+import (

+	"io/ioutil"

+	"path"

+	"strings"

+

+	cgroupsV2 "github.com/containerd/cgroups/v2"

+	rsystem "github.com/opencontainers/runc/libcontainer/system"

+	"github.com/sirupsen/logrus"

+)

+

+type infoCollectorV2 func(info *SysInfo, controllers map[string]struct{}, dirPath string) (warnings []string)

+

+func newV2(quiet bool, opts *opts) *SysInfo {

+	var warnings []string

+	sysInfo := &SysInfo{

+		CgroupUnified: true,

+	}

+	g := opts.cg2GroupPath

+	if g == "" {

+		g = "/"

+	}

+	m, err := cgroupsV2.LoadManager("/sys/fs/cgroup", g)

+	if err != nil {

+		logrus.Warn(err)

+	} else {

+		controllersM := make(map[string]struct{})

+		controllers, err := m.Controllers()

+		if err != nil {

+			logrus.Warn(err)

+		}

+		for _, c := range controllers {

+			controllersM[c] = struct{}{}

+		}

+		opsV2 := []infoCollectorV2{

+			applyMemoryCgroupInfoV2,

+			applyCPUCgroupInfoV2,

+			applyIOCgroupInfoV2,

+			applyCPUSetCgroupInfoV2,

+			applyPIDSCgroupInfoV2,

+			applyDevicesCgroupInfoV2,

+		}

+		dirPath := path.Join("/sys/fs/cgroup", path.Clean(g))

+		for _, o := range opsV2 {

+			w := o(sysInfo, controllersM, dirPath)

+			warnings = append(warnings, w...)

+		}

+	}

+

+	ops := []infoCollector{

+		applyNetworkingInfo,

+		applyAppArmorInfo,

+		applySeccompInfo,

+		applyCgroupNsInfo,

+	}

+	for _, o := range ops {

+		w := o(sysInfo, nil)

+		warnings = append(warnings, w...)

+	}

+	if !quiet {

+		for _, w := range warnings {

+			logrus.Warn(w)

+		}

+	}

+	return sysInfo

+}

+

+func applyMemoryCgroupInfoV2(info *SysInfo, controllers map[string]struct{}, _ string) []string {

+	var warnings []string

+	if _, ok := controllers["memory"]; !ok {

+		warnings = append(warnings, "Unable to find memory controller")

+		return warnings

+	}

+

+	info.MemoryLimit = true

+	info.SwapLimit = true

+	info.MemoryReservation = true

+	info.OomKillDisable = false

+	info.MemorySwappiness = false

+	info.KernelMemory = false

+	info.KernelMemoryTCP = false

+	return warnings

+}

+

+func applyCPUCgroupInfoV2(info *SysInfo, controllers map[string]struct{}, _ string) []string {

+	var warnings []string

+	if _, ok := controllers["cpu"]; !ok {

+		warnings = append(warnings, "Unable to find cpu controller")

+		return warnings

+	}

+	info.CPUShares = true

+	info.CPUCfsPeriod = true

+	info.CPUCfsQuota = true

+	info.CPURealtimePeriod = false

+	info.CPURealtimeRuntime = false

+	return warnings

+}

+

+func applyIOCgroupInfoV2(info *SysInfo, controllers map[string]struct{}, _ string) []string {

+	var warnings []string

+	if _, ok := controllers["io"]; !ok {

+		warnings = append(warnings, "Unable to find io controller")

+		return warnings

+	}

+

+	info.BlkioWeight = true

+	info.BlkioWeightDevice = true

+	info.BlkioReadBpsDevice = true

+	info.BlkioWriteBpsDevice = true

+	info.BlkioReadIOpsDevice = true

+	info.BlkioWriteIOpsDevice = true

+	return warnings

+}

+

+func applyCPUSetCgroupInfoV2(info *SysInfo, controllers map[string]struct{}, dirPath string) []string {

+	var warnings []string

+	if _, ok := controllers["cpuset"]; !ok {

+		warnings = append(warnings, "Unable to find cpuset controller")

+		return warnings

+	}

+	info.Cpuset = true

+

+	cpus, err := ioutil.ReadFile(path.Join(dirPath, "cpuset.cpus.effective"))

+	if err != nil {

+		return warnings

+	}

+	info.Cpus = strings.TrimSpace(string(cpus))

+

+	mems, err := ioutil.ReadFile(path.Join(dirPath, "cpuset.mems.effective"))

+	if err != nil {

+		return warnings

+	}

+	info.Mems = strings.TrimSpace(string(mems))

+	return warnings

+}

+

+func applyPIDSCgroupInfoV2(info *SysInfo, controllers map[string]struct{}, _ string) []string {

+	var warnings []string

+	if _, ok := controllers["pids"]; !ok {

+		warnings = append(warnings, "Unable to find pids controller")

+		return warnings

+	}

+	info.PidsLimit = true

+	return warnings

+}

+

+func applyDevicesCgroupInfoV2(info *SysInfo, controllers map[string]struct{}, _ string) []string {

+	info.CgroupDevicesEnabled = !rsystem.RunningInUserNS()

+	return nil

+}

@@ -30,6 +30,9 @@ type SysInfo struct {

 	// Whether the cgroup has the mountpoint of "devices" or not

 	CgroupDevicesEnabled bool

+

+	// Whether the cgroup is in unified mode (v2).

+	CgroupUnified bool

 }

 type cgroupMemInfo struct {

@@ -28,10 +28,37 @@ func findCgroupMountpoints() (map[string]string, error) {

 type infoCollector func(info *SysInfo, cgMounts map[string]string) (warnings []string)

+type opts struct {

+	cg2GroupPath string

+}

+

+// Opt for New().

+type Opt func(*opts)

+

+// WithCgroup2GroupPath specifies the cgroup v2 group path to inspect availability

+// of the controllers.

+//

+// WithCgroup2GroupPath is expected to be used for rootless mode with systemd driver.

+//

+// e.g. g = "/user.slice/user-1000.slice/user@1000.service"

+func WithCgroup2GroupPath(g string) Opt {

+	return func(o *opts) {

+		o.cg2GroupPath = path.Clean(g)

+	}

+}

+

 // New returns a new SysInfo, using the filesystem to detect which features

 // the kernel supports. If `quiet` is `false` warnings are printed in logs

 // whenever an error occurs or misconfigurations are present.

-func New(quiet bool) *SysInfo {

+func New(quiet bool, options ...Opt) *SysInfo {

+	var opts opts

+	for _, o := range options {

+		o(&opts)

+	}

+	if cgroups.IsCgroup2UnifiedMode() {

+		return newV2(quiet, &opts)

+	}

+

 	var ops []infoCollector

 	var warnings []string

 	sysInfo := &SysInfo{}

@@ -60,9 +87,6 @@ func New(quiet bool) *SysInfo {

 		w := o(sysInfo, cgMounts)

 		warnings = append(warnings, w...)

 	}

-	if cgroups.IsCgroup2UnifiedMode() {

-		warnings = append(warnings, "Your system is running cgroup v2 (unsupported)")

-	}

 	if !quiet {

 		for _, w := range warnings {

 			logrus.Warn(w)

@@ -73,15 +97,6 @@ func New(quiet bool) *SysInfo {

 // applyMemoryCgroupInfo reads the memory information from the memory cgroup mount point.

 func applyMemoryCgroupInfo(info *SysInfo, cgMounts map[string]string) []string {

-	if cgroups.IsCgroup2UnifiedMode() {

-		// TODO: check cgroup2 info correctly

-		info.MemoryLimit = true

-		info.SwapLimit = true

-		info.MemoryReservation = true

-		info.OomKillDisable = true

-		info.MemorySwappiness = true

-		return nil

-	}

 	var warnings []string

 	mountPoint, ok := cgMounts["memory"]

 	if !ok {

@@ -120,15 +135,6 @@ func applyMemoryCgroupInfo(info *SysInfo, cgMounts map[string]string) []string {

 // applyCPUCgroupInfo reads the cpu information from the cpu cgroup mount point.

 func applyCPUCgroupInfo(info *SysInfo, cgMounts map[string]string) []string {

-	if cgroups.IsCgroup2UnifiedMode() {

-		// TODO: check cgroup2 info correctly

-		info.CPUShares = true

-		info.CPUCfsPeriod = true

-		info.CPUCfsQuota = true

-		info.CPURealtimePeriod = true

-		info.CPURealtimeRuntime = true

-		return nil

-	}

 	var warnings []string

 	mountPoint, ok := cgMounts["cpu"]

 	if !ok {

@@ -166,15 +172,6 @@ func applyCPUCgroupInfo(info *SysInfo, cgMounts map[string]string) []string {

 // applyBlkioCgroupInfo reads the blkio information from the blkio cgroup mount point.

 func applyBlkioCgroupInfo(info *SysInfo, cgMounts map[string]string) []string {

-	if cgroups.IsCgroup2UnifiedMode() {

-		// TODO: check cgroup2 info correctly

-		info.BlkioWeight = true

-		info.BlkioReadBpsDevice = true

-		info.BlkioWriteBpsDevice = true

-		info.BlkioReadIOpsDevice = true

-		info.BlkioWriteIOpsDevice = true

-		return nil

-	}

 	var warnings []string

 	mountPoint, ok := cgMounts["blkio"]

 	if !ok {

@@ -216,11 +213,6 @@ func applyBlkioCgroupInfo(info *SysInfo, cgMounts map[string]string) []string {

 // applyCPUSetCgroupInfo reads the cpuset information from the cpuset cgroup mount point.

 func applyCPUSetCgroupInfo(info *SysInfo, cgMounts map[string]string) []string {

-	if cgroups.IsCgroup2UnifiedMode() {

-		// TODO: check cgroup2 info correctly

-		info.Cpuset = true

-		return nil

-	}

 	var warnings []string

 	mountPoint, ok := cgMounts["cpuset"]

 	if !ok {

@@ -248,11 +240,6 @@ func applyCPUSetCgroupInfo(info *SysInfo, cgMounts map[string]string) []string {

 // applyPIDSCgroupInfo reads the pids information from the pids cgroup mount point.

 func applyPIDSCgroupInfo(info *SysInfo, _ map[string]string) []string {

-	if cgroups.IsCgroup2UnifiedMode() {

-		// TODO: check cgroup2 info correctly

-		info.PidsLimit = true

-		return nil

-	}

 	var warnings []string

 	_, err := cgroups.FindCgroupMountpoint("", "pids")

 	if err != nil {

@@ -265,11 +252,6 @@ func applyPIDSCgroupInfo(info *SysInfo, _ map[string]string) []string {

 // applyDevicesCgroupInfo reads the pids information from the devices cgroup mount point.

 func applyDevicesCgroupInfo(info *SysInfo, cgMounts map[string]string) []string {

-	if cgroups.IsCgroup2UnifiedMode() {

-		// TODO: check cgroup2 info correctly

-		info.CgroupDevicesEnabled = true

-		return nil

-	}

 	var warnings []string

 	_, ok := cgMounts["devices"]

 	info.CgroupDevicesEnabled = ok

@@ -2,8 +2,13 @@

 package sysinfo // import "github.com/docker/docker/pkg/sysinfo"

+type opts struct{}

+

+// Opt for New().

+type Opt func(*opts)

+

 // New returns an empty SysInfo for non linux for now.

-func New(quiet bool) *SysInfo {

+func New(quiet bool, options ...Opt) *SysInfo {

 	sysInfo := &SysInfo{}

 	return sysInfo

 }

@@ -1,7 +1,12 @@

 package sysinfo // import "github.com/docker/docker/pkg/sysinfo"

+type opts struct{}

+

+// Opt for New().

+type Opt func(*opts)

+

 // New returns an empty SysInfo for windows for now.

-func New(quiet bool) *SysInfo {

+func New(quiet bool, options ...Opt) *SysInfo {

 	sysInfo := &SysInfo{}

 	return sysInfo

 }

@@ -11,11 +11,20 @@ import (

 // ContainerDecoder implements httputils.ContainerDecoder

 // calling DecodeContainerConfig.

-type ContainerDecoder struct{}

+type ContainerDecoder struct {

+	GetSysInfo func() *sysinfo.SysInfo

+}

 // DecodeConfig makes ContainerDecoder to implement httputils.ContainerDecoder

 func (r ContainerDecoder) DecodeConfig(src io.Reader) (*container.Config, *container.HostConfig, *networktypes.NetworkingConfig, error) {

-	return decodeContainerConfig(src)

+	var si *sysinfo.SysInfo

+	if r.GetSysInfo != nil {

+		si = r.GetSysInfo()

+	} else {

+		si = sysinfo.New(true)

+	}

+

+	return decodeContainerConfig(src, si)

 }

 // DecodeHostConfig makes ContainerDecoder to implement httputils.ContainerDecoder

@@ -27,7 +36,7 @@ func (r ContainerDecoder) DecodeHostConfig(src io.Reader) (*container.HostConfig

 // struct and returns both a Config and a HostConfig struct

 // Be aware this function is not checking whether the resulted structs are nil,

 // it's your business to do so

-func decodeContainerConfig(src io.Reader) (*container.Config, *container.HostConfig, *networktypes.NetworkingConfig, error) {

+func decodeContainerConfig(src io.Reader, si *sysinfo.SysInfo) (*container.Config, *container.HostConfig, *networktypes.NetworkingConfig, error) {

 	var w ContainerConfigWrapper

 	decoder := json.NewDecoder(src)

@@ -63,7 +72,7 @@ func decodeContainerConfig(src io.Reader) (*container.Config, *container.HostCon

 	}

 	// Validate Resources

-	if err := validateResources(hc, sysinfo.New(true)); err != nil {

+	if err := validateResources(hc, si); err != nil {

 		return nil, nil, nil, err

 	}

@@ -12,6 +12,7 @@ import (

 	"github.com/docker/docker/api/types/container"

 	networktypes "github.com/docker/docker/api/types/network"

 	"github.com/docker/docker/api/types/strslice"

+	"github.com/docker/docker/pkg/sysinfo"

 )

 type f struct {

@@ -46,7 +47,7 @@ func TestDecodeContainerConfig(t *testing.T) {

 			t.Fatal(err)

 		}

-		c, h, _, err := decodeContainerConfig(bytes.NewReader(b))

+		c, h, _, err := decodeContainerConfig(bytes.NewReader(b), sysinfo.New(true))

 		if err != nil {

 			t.Fatal(fmt.Errorf("Error parsing %s: %v", f, err))

 		}

@@ -130,5 +131,5 @@ func callDecodeContainerConfigIsolation(isolation string) (*container.Config, *c

 	if b, err = json.Marshal(w); err != nil {

 		return nil, nil, nil, fmt.Errorf("Error on marshal %s", err.Error())

 	}

-	return decodeContainerConfig(bytes.NewReader(b))

+	return decodeContainerConfig(bytes.NewReader(b), sysinfo.New(true))

 }

@@ -130,6 +130,7 @@ github.com/containerd/go-runc                       7016d3ce2328dd2cb1192b2076eb

 github.com/containerd/typeurl                       b45ef1f1f737e10bd45b25b669df25f0da8b9ba0

 github.com/containerd/ttrpc                         0be804eadb152bc3b3c20c5edc314c4633833398

 github.com/gogo/googleapis                          01e0f9cca9b92166042241267ee2a5cdf5cff46c # v1.3.2

+github.com/cilium/ebpf                              60c3aa43f488292fe2ee50fb8b833b383ca8ebbb

 # cluster

 github.com/docker/swarmkit                          ebe39a32e3ed4c3a3783a02c11cccf388818694c

new file mode 100644

@@ -0,0 +1,23 @@

+MIT License

+

+Copyright (c) 2017 Nathan Sweet

+Copyright (c) 2018, 2019 Cloudflare

+Copyright (c) 2019 Authors of Cilium

+

+Permission is hereby granted, free of charge, to any person obtaining a copy

+of this software and associated documentation files (the "Software"), to deal

+in the Software without restriction, including without limitation the rights

+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell

+copies of the Software, and to permit persons to whom the Software is

+furnished to do so, subject to the following conditions:

+

+The above copyright notice and this permission notice shall be included in all

+copies or substantial portions of the Software.

+

+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR

+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,

+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE

+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER

+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,

+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE

+SOFTWARE.

new file mode 100644

@@ -0,0 +1,203 @@

+package ebpf

+

+import (

+	"bufio"

+	"bytes"

+	"fmt"

+	"io"

+	"os"

+	"syscall"

+

+	"github.com/cilium/ebpf/internal"

+	"github.com/pkg/errors"

+)

+

+// MapABI are the attributes of a Map which are available across all supported kernels.

+type MapABI struct {

+	Type       MapType

+	KeySize    uint32

+	ValueSize  uint32

+	MaxEntries uint32

+	Flags      uint32

+}

+

+func newMapABIFromSpec(spec *MapSpec) *MapABI {

+	return &MapABI{

+		spec.Type,

+		spec.KeySize,

+		spec.ValueSize,

+		spec.MaxEntries,

+		spec.Flags,

+	}

+}

+

+func newMapABIFromFd(fd *bpfFD) (string, *MapABI, error) {

+	info, err := bpfGetMapInfoByFD(fd)

+	if err != nil {

+		if errors.Cause(err) == syscall.EINVAL {

+			abi, err := newMapABIFromProc(fd)

+			return "", abi, err

+		}

+		return "", nil, err

+	}

+

+	return "", &MapABI{

+		MapType(info.mapType),

+		info.keySize,

+		info.valueSize,

+		info.maxEntries,

+		info.flags,

+	}, nil

+}

+

+func newMapABIFromProc(fd *bpfFD) (*MapABI, error) {

+	var abi MapABI

+	err := scanFdInfo(fd, map[string]interface{}{

+		"map_type":    &abi.Type,

+		"key_size":    &abi.KeySize,

+		"value_size":  &abi.ValueSize,

+		"max_entries": &abi.MaxEntries,

+		"map_flags":   &abi.Flags,

+	})

+	if err != nil {

+		return nil, err

+	}

+	return &abi, nil

+}

+

+// Equal returns true if two ABIs have the same values.

+func (abi *MapABI) Equal(other *MapABI) bool {

+	switch {

+	case abi.Type != other.Type:

+		return false

+	case abi.KeySize != other.KeySize:

+		return false

+	case abi.ValueSize != other.ValueSize:

+		return false

+	case abi.MaxEntries != other.MaxEntries:

+		return false

+	case abi.Flags != other.Flags:

+		return false

+	default:

+		return true

+	}

+}

+

+// ProgramABI are the attributes of a Program which are available across all supported kernels.

+type ProgramABI struct {

+	Type ProgramType

+}

+

+func newProgramABIFromSpec(spec *ProgramSpec) *ProgramABI {

+	return &ProgramABI{

+		spec.Type,

+	}

+}

+

+func newProgramABIFromFd(fd *bpfFD) (string, *ProgramABI, error) {

+	info, err := bpfGetProgInfoByFD(fd)

+	if err != nil {

+		if errors.Cause(err) == syscall.EINVAL {

+			return newProgramABIFromProc(fd)

+		}

+

+		return "", nil, err

+	}

+

+	var name string

+	if bpfName := convertCString(info.name[:]); bpfName != "" {

+		name = bpfName

+	} else {

+		name = convertCString(info.tag[:])

+	}

+

+	return name, &ProgramABI{

+		Type: ProgramType(info.progType),

+	}, nil

+}

+

+func newProgramABIFromProc(fd *bpfFD) (string, *ProgramABI, error) {

+	var (

+		abi  ProgramABI

+		name string

+	)

+

+	err := scanFdInfo(fd, map[string]interface{}{

+		"prog_type": &abi.Type,

+		"prog_tag":  &name,

+	})

+	if errors.Cause(err) == errMissingFields {

+		return "", nil, &internal.UnsupportedFeatureError{

+			Name:           "reading ABI from /proc/self/fdinfo",

+			MinimumVersion: internal.Version{4, 11, 0},

+		}

+	}

+	if err != nil {

+		return "", nil, err

+	}

+

+	return name, &abi, nil

+}

+

+func scanFdInfo(fd *bpfFD, fields map[string]interface{}) error {

+	raw, err := fd.value()

+	if err != nil {

+		return err

+	}

+

+	fh, err := os.Open(fmt.Sprintf("/proc/self/fdinfo/%d", raw))

+	if err != nil {

+		return err

+	}

+	defer fh.Close()

+

+	return errors.Wrap(scanFdInfoReader(fh, fields), fh.Name())

+}

+

+var errMissingFields = errors.New("missing fields")

+

+func scanFdInfoReader(r io.Reader, fields map[string]interface{}) error {

+	var (

+		scanner = bufio.NewScanner(r)

+		scanned int

+	)

+

+	for scanner.Scan() {

+		parts := bytes.SplitN(scanner.Bytes(), []byte("\t"), 2)

+		if len(parts) != 2 {

+			continue

+		}

+

+		name := bytes.TrimSuffix(parts[0], []byte(":"))

+		field, ok := fields[string(name)]