From b45cf1ccb65e2195f7e614ee5d02a6e8e9924f1a Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sun, 21 Jun 2026 03:52:53 +0000
Subject: [PATCH] Bump github.com/opencontainers/runc from 1.4.2 to 1.5.0

Bumps [github.com/opencontainers/runc](https://github.com/opencontainers/runc) from 1.4.2 to 1.5.0.
- [Release notes](https://github.com/opencontainers/runc/releases)
- [Changelog](https://github.com/opencontainers/runc/blob/main/CHANGELOG.md)
- [Commits](https://github.com/opencontainers/runc/compare/v1.4.2...v1.5.0)

---
updated-dependencies:
- dependency-name: github.com/opencontainers/runc
  dependency-version: 1.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 go.mod                                        |    12 +-
 go.sum                                        |    24 +-
 vendor/cyphar.com/go-pathrs/handle_linux.go   |     8 +-
 .../internal/libpathrs/libpathrs_linux.go     |    76 +-
 .../go-pathrs/procfs/procfs_linux.go          |    10 +-
 vendor/cyphar.com/go-pathrs/root_linux.go     |    54 +-
 vendor/cyphar.com/go-pathrs/version_linux.go  |    27 +
 .../protobuf-go-lite/.gitattributes           |     1 +
 .../protobuf-go-lite/.gitignore               |     8 +
 .../protobuf-go-lite/.golangci.yml            |    69 +
 .../aperturerobotics/protobuf-go-lite/.ignore |     5 +
 .../aperturerobotics/protobuf-go-lite/LICENSE |    31 +
 .../protobuf-go-lite/Makefile                 |   112 +
 .../aperturerobotics/protobuf-go-lite/PATENTS |    22 +
 .../protobuf-go-lite/README.md                |   157 +
 .../protobuf-go-lite/protobuf-go-lite.go      |   594 +
 .../go-criu/v7/.golangci.yml                  |    22 -
 .../checkpoint-restore/go-criu/v7/README.md   |   112 -
 .../go-criu/v7/rpc/rpc.pb.go                  |  2390 ---
 .../go-criu/{v7 => v8}/.gitignore             |     0
 .../go-criu/v8/.golangci.yml                  |    46 +
 .../go-criu/v8/CONTRIBUTING.md                |    53 +
 .../go-criu/{v7 => v8}/LICENSE                |     0
 .../go-criu/{v7 => v8}/MAINTAINERS            |     0
 .../go-criu/{v7 => v8}/Makefile               |     4 +-
 .../checkpoint-restore/go-criu/v8/README.md   |    85 +
 .../go-criu/{v7 => v8}/codecov.yml            |     0
 .../go-criu/{v7 => v8}/features.go            |     2 +-
 .../go-criu/v8/internal/proto/proto.go        |    13 +
 .../go-criu/{v7 => v8}/main.go                |    89 +-
 .../go-criu/{v7 => v8}/notify.go              |     0
 .../go-criu/v8/rpc/rpc.pb.go                  | 13032 ++++++++++++++++
 .../go-criu/{v7 => v8}/rpc/rpc.proto          |     0
 .../cyphar/filepath-securejoin/CHANGELOG.md   |    11 +
 .../cyphar/filepath-securejoin/VERSION        |     2 +-
 .../pathrs-lite/open_libpathrs.go             |     2 +-
 vendor/github.com/godbus/dbus/v5/.cirrus.yml  |    11 +
 .../github.com/godbus/dbus/v5/.golangci.yml   |    13 +
 vendor/github.com/godbus/dbus/v5/README.md    |     5 +-
 vendor/github.com/godbus/dbus/v5/SECURITY.md  |    13 +
 vendor/github.com/godbus/dbus/v5/auth.go      |    48 +-
 .../godbus/dbus/v5/auth_default_other.go      |     7 +
 .../godbus/dbus/v5/auth_default_windows.go    |     5 +
 .../v5/{auth_sha1.go => auth_sha1_windows.go} |     7 +
 vendor/github.com/godbus/dbus/v5/call.go      |     9 +-
 vendor/github.com/godbus/dbus/v5/conn.go      |    91 +-
 .../github.com/godbus/dbus/v5/conn_darwin.go  |     1 -
 .../github.com/godbus/dbus/v5/conn_other.go   |    23 +-
 vendor/github.com/godbus/dbus/v5/conn_unix.go |    25 +-
 .../github.com/godbus/dbus/v5/conn_windows.go |     2 -
 vendor/github.com/godbus/dbus/v5/dbus.go      |    29 +-
 vendor/github.com/godbus/dbus/v5/decoder.go   |   202 +-
 .../godbus/dbus/v5/default_handler.go         |    32 +-
 vendor/github.com/godbus/dbus/v5/doc.go       |    43 +-
 vendor/github.com/godbus/dbus/v5/encoder.go   |     4 +-
 vendor/github.com/godbus/dbus/v5/export.go    |    93 +-
 vendor/github.com/godbus/dbus/v5/homedir.go   |    25 -
 vendor/github.com/godbus/dbus/v5/match.go     |     8 +-
 vendor/github.com/godbus/dbus/v5/message.go   |    21 +-
 vendor/github.com/godbus/dbus/v5/object.go    |    39 +-
 .../godbus/dbus/v5/sequential_handler.go      |     2 +-
 .../godbus/dbus/v5/server_interfaces.go       |    12 +-
 vendor/github.com/godbus/dbus/v5/sig.go       |    17 +-
 .../godbus/dbus/v5/transport_nonce_tcp.go     |     8 +-
 .../godbus/dbus/v5/transport_unix.go          |   147 +-
 .../dbus/v5/transport_unixcred_freebsd.go     |    38 +-
 .../dbus/v5/transport_unixcred_linux.go       |     2 +-
 vendor/github.com/godbus/dbus/v5/variant.go   |    31 +-
 .../godbus/dbus/v5/variant_lexer.go           |     2 +-
 .../godbus/dbus/v5/variant_parser.go          |    46 +-
 vendor/github.com/moby/sys/devices/LICENSE    |   202 +
 .../sys}/devices/device_unix.go               |    45 +-
 vendor/github.com/moby/sys/devices/doc.go     |     4 +
 .../utils => internal/cmsg}/cmsg.go           |     7 +-
 .../runc/internal/pathrs/mkdirall.go          |    18 +-
 .../internal/pathrs/mkdirall_pathrslite.go    |    15 +-
 .../runc/internal/pathrs/root_pathrslite.go   |    55 +-
 .../runc/internal/sys/sysctl_linux.go         |     6 +-
 .../runc/libcontainer/README.md               |   219 +-
 .../opencontainers/runc/libcontainer/SPEC.md  |    20 +-
 .../runc/libcontainer/apparmor/apparmor.go    |     3 +
 .../libcontainer/capabilities/capabilities.go |     1 +
 .../libcontainer/configs/cgroup_deprecated.go |    29 -
 .../runc/libcontainer/configs/config.go       |    11 -
 .../runc/libcontainer/configs/config_linux.go |    26 +-
 .../runc/libcontainer/configs/memorypolicy.go |    19 -
 .../runc/libcontainer/configs/mount_linux.go  |     6 +-
 .../runc/libcontainer/criu_linux.go           |   176 +-
 .../libcontainer/devices/device_deprecated.go |    20 -
 .../devices/device_deprecated_unix.go         |    55 +
 .../runc/libcontainer/exeseal/doc.go          |     3 +
 .../runc/libcontainer/init_linux.go           |     5 +-
 .../runc/libcontainer/intelrdt/intelrdt.go    |    19 +-
 .../runc/libcontainer/internal/userns/doc.go  |     2 +
 .../internal/userns/usernsfd_linux.go         |     3 +-
 .../runc/libcontainer/keys/keyctl.go          |     1 +
 .../runc/libcontainer/logs/logs.go            |     2 +
 .../runc/libcontainer/process.go              |     6 +-
 .../runc/libcontainer/process_linux.go        |    10 +-
 .../runc/libcontainer/rootfs_linux.go         |   204 +-
 .../runc/libcontainer/seccomp/config.go       |     1 +
 .../runc/libcontainer/seccomp/doc.go          |     3 +
 .../runc/libcontainer/seccomp/patchbpf/doc.go |     3 +
 .../seccomp/patchbpf/enosys_linux.go          |    12 +
 .../libcontainer/seccomp/seccomp_linux.go     |     5 +
 .../runc/libcontainer/standard_init_linux.go  |     3 +-
 .../opencontainers/runc/libcontainer/sync.go  |     8 +-
 .../runc/libcontainer/system/doc.go           |     2 +
 .../libcontainer/utils/cmsg_deprecated.go     |    35 +
 .../runc/libcontainer/utils/utils.go          |    23 +-
 .../runc/libcontainer/utils/utils_unix.go     |    40 -
 .../opencontainers/runc/types/events.go       |     2 +
 vendor/modules.txt                            |    28 +-
 113 files changed, 15885 insertions(+), 3606 deletions(-)
 create mode 100644 vendor/cyphar.com/go-pathrs/version_linux.go
 create mode 100644 vendor/github.com/aperturerobotics/protobuf-go-lite/.gitattributes
 create mode 100644 vendor/github.com/aperturerobotics/protobuf-go-lite/.gitignore
 create mode 100644 vendor/github.com/aperturerobotics/protobuf-go-lite/.golangci.yml
 create mode 100644 vendor/github.com/aperturerobotics/protobuf-go-lite/.ignore
 create mode 100644 vendor/github.com/aperturerobotics/protobuf-go-lite/LICENSE
 create mode 100644 vendor/github.com/aperturerobotics/protobuf-go-lite/Makefile
 create mode 100644 vendor/github.com/aperturerobotics/protobuf-go-lite/PATENTS
 create mode 100644 vendor/github.com/aperturerobotics/protobuf-go-lite/README.md
 create mode 100644 vendor/github.com/aperturerobotics/protobuf-go-lite/protobuf-go-lite.go
 delete mode 100644 vendor/github.com/checkpoint-restore/go-criu/v7/.golangci.yml
 delete mode 100644 vendor/github.com/checkpoint-restore/go-criu/v7/README.md
 delete mode 100644 vendor/github.com/checkpoint-restore/go-criu/v7/rpc/rpc.pb.go
 rename vendor/github.com/checkpoint-restore/go-criu/{v7 => v8}/.gitignore (100%)
 create mode 100644 vendor/github.com/checkpoint-restore/go-criu/v8/.golangci.yml
 create mode 100644 vendor/github.com/checkpoint-restore/go-criu/v8/CONTRIBUTING.md
 rename vendor/github.com/checkpoint-restore/go-criu/{v7 => v8}/LICENSE (100%)
 rename vendor/github.com/checkpoint-restore/go-criu/{v7 => v8}/MAINTAINERS (100%)
 rename vendor/github.com/checkpoint-restore/go-criu/{v7 => v8}/Makefile (87%)
 create mode 100644 vendor/github.com/checkpoint-restore/go-criu/v8/README.md
 rename vendor/github.com/checkpoint-restore/go-criu/{v7 => v8}/codecov.yml (100%)
 rename vendor/github.com/checkpoint-restore/go-criu/{v7 => v8}/features.go (96%)
 create mode 100644 vendor/github.com/checkpoint-restore/go-criu/v8/internal/proto/proto.go
 rename vendor/github.com/checkpoint-restore/go-criu/{v7 => v8}/main.go (72%)
 rename vendor/github.com/checkpoint-restore/go-criu/{v7 => v8}/notify.go (100%)
 create mode 100644 vendor/github.com/checkpoint-restore/go-criu/v8/rpc/rpc.pb.go
 rename vendor/github.com/checkpoint-restore/go-criu/{v7 => v8}/rpc/rpc.proto (100%)
 create mode 100644 vendor/github.com/godbus/dbus/v5/.cirrus.yml
 create mode 100644 vendor/github.com/godbus/dbus/v5/.golangci.yml
 create mode 100644 vendor/github.com/godbus/dbus/v5/SECURITY.md
 create mode 100644 vendor/github.com/godbus/dbus/v5/auth_default_other.go
 create mode 100644 vendor/github.com/godbus/dbus/v5/auth_default_windows.go
 rename vendor/github.com/godbus/dbus/v5/{auth_sha1.go => auth_sha1_windows.go} (95%)
 delete mode 100644 vendor/github.com/godbus/dbus/v5/homedir.go
 create mode 100644 vendor/github.com/moby/sys/devices/LICENSE
 rename vendor/github.com/{opencontainers/runc/libcontainer => moby/sys}/devices/device_unix.go (62%)
 create mode 100644 vendor/github.com/moby/sys/devices/doc.go
 rename vendor/github.com/opencontainers/runc/{libcontainer/utils => internal/cmsg}/cmsg.go (97%)
 delete mode 100644 vendor/github.com/opencontainers/runc/libcontainer/configs/cgroup_deprecated.go
 delete mode 100644 vendor/github.com/opencontainers/runc/libcontainer/devices/device_deprecated.go
 create mode 100644 vendor/github.com/opencontainers/runc/libcontainer/devices/device_deprecated_unix.go
 create mode 100644 vendor/github.com/opencontainers/runc/libcontainer/exeseal/doc.go
 create mode 100644 vendor/github.com/opencontainers/runc/libcontainer/internal/userns/doc.go
 create mode 100644 vendor/github.com/opencontainers/runc/libcontainer/seccomp/doc.go
 create mode 100644 vendor/github.com/opencontainers/runc/libcontainer/seccomp/patchbpf/doc.go
 create mode 100644 vendor/github.com/opencontainers/runc/libcontainer/system/doc.go
 create mode 100644 vendor/github.com/opencontainers/runc/libcontainer/utils/cmsg_deprecated.go

diff --git a/go.mod b/go.mod
index e0c32ca092..f4a8735e92 100644
--- a/go.mod
+++ b/go.mod
@@ -45,7 +45,7 @@ require (
 	github.com/moby/sys/user v0.4.0
 	github.com/open-policy-agent/opa v0.70.0
 	github.com/opencontainers/cgroups v0.0.6
-	github.com/opencontainers/runc v1.4.2
+	github.com/opencontainers/runc v1.5.0
 	github.com/opencontainers/runtime-spec v1.3.0
 	github.com/pelletier/go-toml v1.9.5
 	github.com/pkg/errors v0.9.1
@@ -66,19 +66,20 @@ require (
 )
 
 require (
-	cyphar.com/go-pathrs v0.2.4 // indirect
+	cyphar.com/go-pathrs v0.2.5 // indirect
 	github.com/OneOfOne/xxhash v1.2.8 // indirect
 	github.com/agnivade/levenshtein v1.2.0 // indirect
+	github.com/aperturerobotics/protobuf-go-lite v0.14.0 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
-	github.com/checkpoint-restore/go-criu/v7 v7.2.0 // indirect
+	github.com/checkpoint-restore/go-criu/v8 v8.3.0 // indirect
 	github.com/cilium/ebpf v0.17.3 // indirect
 	github.com/containerd/continuity v0.5.0 // indirect
 	github.com/containerd/fifo v1.1.0 // indirect
 	github.com/containerd/protobuild v0.3.0 // indirect
 	github.com/coreos/go-systemd/v22 v22.7.0 // indirect
 	github.com/cpuguy83/go-md2man/v2 v2.0.7 // indirect
-	github.com/cyphar/filepath-securejoin v0.6.1 // indirect
+	github.com/cyphar/filepath-securejoin v0.7.0 // indirect
 	github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.0 // indirect
 	github.com/docker/cli v29.4.3+incompatible // indirect
 	github.com/docker/docker-credential-helpers v0.9.3 // indirect
@@ -89,7 +90,7 @@ require (
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/gobwas/glob v0.2.3 // indirect
 	github.com/goccy/go-json v0.10.3 // indirect
-	github.com/godbus/dbus/v5 v5.1.0 // indirect
+	github.com/godbus/dbus/v5 v5.2.2 // indirect
 	github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
 	github.com/golang/protobuf v1.5.4 // indirect
 	github.com/google/uuid v1.6.0 // indirect
@@ -104,6 +105,7 @@ require (
 	github.com/mdlayher/socket v0.5.1 // indirect
 	github.com/mdlayher/vsock v1.2.1 // indirect
 	github.com/moby/sys/capability v0.4.0 // indirect
+	github.com/moby/sys/devices v0.1.0 // indirect
 	github.com/moby/sys/mountinfo v0.7.2 // indirect
 	github.com/moby/sys/userns v0.1.0 // indirect
 	github.com/mrunalp/fileutils v0.5.1 // indirect
diff --git a/go.sum b/go.sum
index 83d8303596..dea5bc8482 100644
--- a/go.sum
+++ b/go.sum
@@ -335,8 +335,8 @@ cloud.google.com/go/vpcaccess v1.8.6/go.mod h1:61yymNplV1hAbo8+kBOFO7Vs+4ZHYI244
 cloud.google.com/go/webrisk v1.11.1/go.mod h1:+9SaepGg2lcp1p0pXuHyz3R2Yi2fHKKb4c1Q9y0qbtA=
 cloud.google.com/go/websecurityscanner v1.7.6/go.mod h1:ucaaTO5JESFn5f2pjdX01wGbQ8D6h79KHrmO2uGZeiY=
 cloud.google.com/go/workflows v1.14.2/go.mod h1:5nqKjMD+MsJs41sJhdVrETgvD5cOK3hUcAs8ygqYvXQ=
-cyphar.com/go-pathrs v0.2.4 h1:iD/mge36swa1UFKdINkr1Frkpp6wZsy3YYEildj9cLY=
-cyphar.com/go-pathrs v0.2.4/go.mod h1:y8f1EMG7r+hCuFf/rXsKqMJrJAUoADZGNh5/vZPKcGc=
+cyphar.com/go-pathrs v0.2.5 h1:SnX9FBvnoyn3lUs1dkMgZ52bAETpirNu3FTRh5HlRik=
+cyphar.com/go-pathrs v0.2.5/go.mod h1:y8f1EMG7r+hCuFf/rXsKqMJrJAUoADZGNh5/vZPKcGc=
 dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU=
 gioui.org v0.0.0-20210308172011-57750fc8a0a6/go.mod h1:RSH6KIUZ0p2xy5zHDxgAM4zumjgTw83q2ge/PI+yyw8=
 git.sr.ht/~sbinet/gg v0.3.1/go.mod h1:KGYtlADtqsqANL9ueOFkWymvzUvLMQllU5Ixo+8v3pc=
@@ -386,6 +386,8 @@ github.com/andybalholm/brotli v1.0.5/go.mod h1:fO7iG3H7G2nSZ7m0zPUDn85XEX2GTukHG
 github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kdvxnR2qWY=
 github.com/apache/arrow/go/v15 v15.0.2/go.mod h1:DGXsR3ajT524njufqf95822i+KTh+yea1jass9YXgjA=
 github.com/apache/thrift v0.17.0/go.mod h1:OLxhMRJxomX+1I/KUw03qoV3mMz16BwaKI+d4fPBx7Q=
+github.com/aperturerobotics/protobuf-go-lite v0.14.0 h1:6YhovtoUZtXgXLHZ2VV2GCYUzFfi8UN6172Vl2flNlE=
+github.com/aperturerobotics/protobuf-go-lite v0.14.0/go.mod h1:lGH3s5ArCTXKI4wJdlNpaybUtwSjfAG0vdWjxOfMcF8=
 github.com/arbovm/levenshtein v0.0.0-20160628152529-48b4e1c0c4d0 h1:jfIu9sQUG6Ig+0+Ap1h4unLjW6YQJpKZVmUzxsD4E/Q=
 github.com/arbovm/levenshtein v0.0.0-20160628152529-48b4e1c0c4d0/go.mod h1:t2tdKJDJF9BV14lnkjHmOQgcvEKgtqs5a1N3LNdJhGE=
 github.com/bazelbuild/rules_go v0.49.0/go.mod h1:Dhcz716Kqg1RHNWos+N6MlXNkjNP2EwZQ0LukRKJfMs=
@@ -408,8 +410,8 @@ github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XL
 github.com/cespare/xxhash/v2 v2.2.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/checkpoint-restore/go-criu/v7 v7.2.0 h1:qGiWA4App1gGlEfIJ68WR9jbezV9J7yZdjzglezcqKo=
-github.com/checkpoint-restore/go-criu/v7 v7.2.0/go.mod h1:u0LCWLg0w4yqqu14aXhiB4YD3a1qd8EcCEg7vda5dwo=
+github.com/checkpoint-restore/go-criu/v8 v8.3.0 h1:UC3Ioay1OMN2Wg33U53enRoG2701vJ9Y2Ex4APmC52w=
+github.com/checkpoint-restore/go-criu/v8 v8.3.0/go.mod h1:33d6FwGJGwnzKVvaO0SxlN0tPSuArKU9X/inD/L7/qA=
 github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
 github.com/chzyer/logex v1.2.0/go.mod h1:9+9sk7u7pGNWYMkh0hdiL++6OeibzJccyQU4p4MedaY=
 github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
@@ -478,8 +480,8 @@ github.com/coreos/go-systemd/v22 v22.7.0/go.mod h1:xNUYtjHu2EDXbsxz1i41wouACIwT7
 github.com/cpuguy83/go-md2man/v2 v2.0.7 h1:zbFlGlXEAKlwXpmvle3d8Oe3YnkKIK4xSRTd3sHPnBo=
 github.com/cpuguy83/go-md2man/v2 v2.0.7/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
-github.com/cyphar/filepath-securejoin v0.6.1 h1:5CeZ1jPXEiYt3+Z6zqprSAgSWiggmpVyciv8syjIpVE=
-github.com/cyphar/filepath-securejoin v0.6.1/go.mod h1:A8hd4EnAeyujCJRrICiOWqjS1AX0a9kM5XL+NwKoYSc=
+github.com/cyphar/filepath-securejoin v0.7.0 h1:s0Y3ITPy6sQn5xt54DuYvTF8hu134ooYLUb58DX/HjE=
+github.com/cyphar/filepath-securejoin v0.7.0/go.mod h1:ymLGms/u3BYaviIiuKFnUx8EkQEZeK6cInNoAPJA3o4=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
@@ -583,8 +585,8 @@ github.com/goccy/go-json v0.10.3 h1:KZ5WoDbxAIgm2HNbYckL0se1fHD6rz5j4ywS6ebzDqA=
 github.com/goccy/go-json v0.10.3/go.mod h1:oq7eo15ShAhp70Anwd5lgX2pLfOS3QCiwU/PULtXL6M=
 github.com/goccy/go-yaml v1.9.8/go.mod h1:JubOolP3gh0HpiBc4BLRD4YmjEjHAmIIB2aaXKkTfoE=
 github.com/goccy/go-yaml v1.11.0/go.mod h1:H+mJrWtjPTJAHvRbV09MCK9xYwODM+wRTVFFTWckfng=
-github.com/godbus/dbus/v5 v5.1.0 h1:4KLkAxT3aOY8Li4FRJe/KvhoNFFxo0m6fNuFUO8QJUk=
-github.com/godbus/dbus/v5 v5.1.0/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
+github.com/godbus/dbus/v5 v5.2.2 h1:TUR3TgtSVDmjiXOgAAyaZbYmIeP3DPkld3jgKGV8mXQ=
+github.com/godbus/dbus/v5 v5.2.2/go.mod h1:3AAv2+hPq5rdnr5txxxRwiGjPXamgoIHgz9FPBfOp3c=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
 github.com/golang/freetype v0.0.0-20170609003504-e2365dfdc4a0/go.mod h1:E/TSTwGwJL78qG/PmXZO1EjYhfJinVAhrmmHX6Z8B9k=
@@ -835,6 +837,8 @@ github.com/minio/c2goasm v0.0.0-20190812172519-36a3d3bbc4f3/go.mod h1:RagcQ7I8Ie
 github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
 github.com/moby/sys/capability v0.4.0 h1:4D4mI6KlNtWMCM1Z/K0i7RV1FkX+DBDHKVJpCndZoHk=
 github.com/moby/sys/capability v0.4.0/go.mod h1:4g9IK291rVkms3LKCDOoYlnV8xKwoDTpIrNEE35Wq0I=
+github.com/moby/sys/devices v0.1.0 h1:uaMrDm1U3h0AwUDNWeT5lBV40v0eayt+VuukRbYn5K4=
+github.com/moby/sys/devices v0.1.0/go.mod h1:nIV6AO7t0DY2ObAm1GfL4AX9mBRqzxzHwGfvNCR9lfI=
 github.com/moby/sys/mountinfo v0.7.2 h1:1shs6aH5s4o5H2zQLn796ADW1wMrIwHsyJ2v9KouLrg=
 github.com/moby/sys/mountinfo v0.7.2/go.mod h1:1YOa8w8Ih7uW0wALDUgT1dTTSBrZ+HiBLGws92L2RU4=
 github.com/moby/sys/user v0.4.0 h1:jhcMKit7SA80hivmFJcbB1vqmw//wU61Zdui2eQXuMs=
@@ -856,8 +860,8 @@ github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
 github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040=
 github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M=
-github.com/opencontainers/runc v1.4.2 h1:/AEjjXuVH9lTRl9ZyUFQj7oWBM7Xv00qFV6Vx9q5N3o=
-github.com/opencontainers/runc v1.4.2/go.mod h1:ufk5PTTsy5pnGBAvTh50e+eqGk01pYH2YcVxh557Qlk=
+github.com/opencontainers/runc v1.5.0 h1:6HPQ7DW9/wNaENamFHvOpTkGIYXMIb32Ne+wLiuzsZQ=
+github.com/opencontainers/runc v1.5.0/go.mod h1:95e1csYzphSxDuOF+BhCxklMFV0eehUWZwYId+70EZE=
 github.com/opencontainers/runtime-spec v1.3.0 h1:YZupQUdctfhpZy3TM39nN9Ika5CBWT5diQ8ibYCRkxg=
 github.com/opencontainers/runtime-spec v1.3.0/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
 github.com/opencontainers/selinux v1.15.0 h1:4Gs40e/R2FvM8PC1HPaPncLLaDor8Y2WDfk5gjU9o5M=
diff --git a/vendor/cyphar.com/go-pathrs/handle_linux.go b/vendor/cyphar.com/go-pathrs/handle_linux.go
index 6ed0b7af7a..78225e006a 100644
--- a/vendor/cyphar.com/go-pathrs/handle_linux.go
+++ b/vendor/cyphar.com/go-pathrs/handle_linux.go
@@ -17,6 +17,8 @@ import (
 	"fmt"
 	"os"
 
+	"golang.org/x/sys/unix"
+
 	"cyphar.com/go-pathrs/internal/fdutils"
 	"cyphar.com/go-pathrs/internal/libpathrs"
 )
@@ -56,11 +58,11 @@ func HandleFromFile(file *os.File) (*Handle, error) {
 // and can be opened multiple times.
 //
 // The handle returned is only usable for reading, and this is method is
-// shorthand for [Handle.OpenFile] with os.O_RDONLY.
+// shorthand for [Handle.OpenFile] with [unix.O_RDONLY].
 //
 // TODO: Rename these to "Reopen" or something.
 func (h *Handle) Open() (*os.File, error) {
-	return h.OpenFile(os.O_RDONLY)
+	return h.OpenFile(unix.O_RDONLY)
 }
 
 // OpenFile creates an "upgraded" file handle to the file referenced by the
@@ -71,7 +73,7 @@ func (h *Handle) Open() (*os.File, error) {
 // handle.
 //
 // TODO: Rename these to "Reopen" or something.
-func (h *Handle) OpenFile(flags int) (*os.File, error) {
+func (h *Handle) OpenFile(flags uint64) (*os.File, error) {
 	return fdutils.WithFileFd(h.inner, func(fd uintptr) (*os.File, error) {
 		newFd, err := libpathrs.Reopen(fd, flags)
 		if err != nil {
diff --git a/vendor/cyphar.com/go-pathrs/internal/libpathrs/libpathrs_linux.go b/vendor/cyphar.com/go-pathrs/internal/libpathrs/libpathrs_linux.go
index d54497a5b7..d610a3be43 100644
--- a/vendor/cyphar.com/go-pathrs/internal/libpathrs/libpathrs_linux.go
+++ b/vendor/cyphar.com/go-pathrs/internal/libpathrs/libpathrs_linux.go
@@ -60,8 +60,8 @@ func OpenRoot(path string) (uintptr, error) {
 }
 
 // Reopen wraps pathrs_reopen.
-func Reopen(fd uintptr, flags int) (uintptr, error) {
-	newFd := C.pathrs_reopen(C.int(fd), C.int(flags))
+func Reopen(fd uintptr, flags uint64) (uintptr, error) {
+	newFd := C.pathrs_reopen(C.int(fd), C.uint64_t(flags))
 	return uintptr(newFd), fetchError(newFd)
 }
 
@@ -84,11 +84,11 @@ func InRootResolveNoFollow(rootFd uintptr, path string) (uintptr, error) {
 }
 
 // InRootOpen wraps pathrs_inroot_open.
-func InRootOpen(rootFd uintptr, path string, flags int) (uintptr, error) {
+func InRootOpen(rootFd uintptr, path string, flags uint64) (uintptr, error) {
 	cPath := C.CString(path)
 	defer C.free(unsafe.Pointer(cPath))
 
-	fd := C.pathrs_inroot_open(C.int(rootFd), cPath, C.int(flags))
+	fd := C.pathrs_inroot_open(C.int(rootFd), cPath, C.uint64_t(flags))
 	return uintptr(fd), fetchError(fd)
 }
 
@@ -145,23 +145,23 @@ func InRootRemoveAll(rootFd uintptr, path string) error {
 }
 
 // InRootCreat wraps pathrs_inroot_creat.
-func InRootCreat(rootFd uintptr, path string, flags int, mode uint32) (uintptr, error) {
+func InRootCreat(rootFd uintptr, path string, flags uint64, mode uint32) (uintptr, error) {
 	cPath := C.CString(path)
 	defer C.free(unsafe.Pointer(cPath))
 
-	fd := C.pathrs_inroot_creat(C.int(rootFd), cPath, C.int(flags), C.uint(mode))
+	fd := C.pathrs_inroot_creat(C.int(rootFd), cPath, C.uint64_t(flags), C.uint(mode))
 	return uintptr(fd), fetchError(fd)
 }
 
 // InRootRename wraps pathrs_inroot_rename.
-func InRootRename(rootFd uintptr, src, dst string, flags uint) error {
-	cSrc := C.CString(src)
-	defer C.free(unsafe.Pointer(cSrc))
+func InRootRename(oldRootFd uintptr, oldPath string, newRootFd uintptr, newPath string, flags uint64) error {
+	cOldPath := C.CString(oldPath)
+	defer C.free(unsafe.Pointer(cOldPath))
 
-	cDst := C.CString(dst)
-	defer C.free(unsafe.Pointer(cDst))
+	cNewPath := C.CString(newPath)
+	defer C.free(unsafe.Pointer(cNewPath))
 
-	err := C.pathrs_inroot_rename(C.int(rootFd), cSrc, cDst, C.uint(flags))
+	err := C.pathrs_inroot_rename(C.int(oldRootFd), cOldPath, C.int(newRootFd), cNewPath, C.uint64_t(flags))
 	return fetchError(err)
 }
 
@@ -193,26 +193,26 @@ func InRootMknod(rootFd uintptr, path string, mode uint32, dev uint64) error {
 }
 
 // InRootSymlink wraps pathrs_inroot_symlink.
-func InRootSymlink(rootFd uintptr, path, target string) error {
-	cPath := C.CString(path)
-	defer C.free(unsafe.Pointer(cPath))
+func InRootSymlink(target string, rootFd uintptr, linkpath string) error {
+	cLinkpath := C.CString(linkpath)
+	defer C.free(unsafe.Pointer(cLinkpath))
 
 	cTarget := C.CString(target)
 	defer C.free(unsafe.Pointer(cTarget))
 
-	err := C.pathrs_inroot_symlink(C.int(rootFd), cPath, cTarget)
+	err := C.pathrs_inroot_symlink(cTarget, C.int(rootFd), cLinkpath)
 	return fetchError(err)
 }
 
 // InRootHardlink wraps pathrs_inroot_hardlink.
-func InRootHardlink(rootFd uintptr, path, target string) error {
-	cPath := C.CString(path)
-	defer C.free(unsafe.Pointer(cPath))
+func InRootHardlink(oldRootFd uintptr, oldPath string, newRootFd uintptr, newPath string, flags uint64) error {
+	cNewPath := C.CString(newPath)
+	defer C.free(unsafe.Pointer(cNewPath))
 
-	cTarget := C.CString(target)
-	defer C.free(unsafe.Pointer(cTarget))
+	cOldPath := C.CString(oldPath)
+	defer C.free(unsafe.Pointer(cOldPath))
 
-	err := C.pathrs_inroot_hardlink(C.int(rootFd), cPath, cTarget)
+	err := C.pathrs_inroot_hardlink(C.int(oldRootFd), cOldPath, C.int(newRootFd), cNewPath, C.uint64_t(flags))
 	return fetchError(err)
 }
 
@@ -277,13 +277,13 @@ func init() {
 func ProcPid(pid uint32) ProcBase { return ProcBaseTypePid | ProcBase(pid) }
 
 // ProcOpenat wraps pathrs_proc_openat.
-func ProcOpenat(procRootFd int, base ProcBase, path string, flags int) (uintptr, error) {
+func ProcOpenat(procRootFd int, base ProcBase, path string, flags uint64) (uintptr, error) {
 	cBase := C.pathrs_proc_base_t(base)
 
 	cPath := C.CString(path)
 	defer C.free(unsafe.Pointer(cPath))
 
-	fd := C.pathrs_proc_openat(C.int(procRootFd), cBase, cPath, C.int(flags))
+	fd := C.pathrs_proc_openat(C.int(procRootFd), cBase, cPath, C.uint64_t(flags))
 	return uintptr(fd), fetchError(fd)
 }
 
@@ -335,3 +335,31 @@ func ProcfsOpen(how *ProcfsOpenHow) (uintptr, error) {
 	fd := C.pathrs_procfs_open((*C.pathrs_procfs_open_how)(how), C.size_t(unsafe.Sizeof(*how)))
 	return uintptr(fd), fetchError(fd)
 }
+
+// VersionInfo is a Go-friendly form of pathrs_version_info_t (struct).
+type VersionInfo struct {
+	VersionString string
+}
+
+// versionInfo is pathrs_version_info_t (struct).
+type versionInfo C.pathrs_version_info_t
+
+// Version is pathrs_version_info_t (sizeof(version) is passed automatically).
+func Version() (*VersionInfo, error) {
+	var rawVersion versionInfo
+	size := C.pathrs_version((*C.pathrs_version_info_t)(&rawVersion), C.size_t(unsafe.Sizeof(rawVersion)))
+	switch {
+	case size < 0:
+		return nil, fetchError(size)
+	case size > 0:
+		// TODO(log): Logging?
+		fallthrough
+	default:
+		// TODO(log): Add a log statement if sizeof(rawVersion) is bigger than
+		// the number of fields we store in VersionInfo. Otherwise a rebuild
+		// will mask that Go callers cannot see any new fields.
+		return &VersionInfo{
+			VersionString: C.GoString(rawVersion.version_string),
+		}, nil
+	}
+}
diff --git a/vendor/cyphar.com/go-pathrs/procfs/procfs_linux.go b/vendor/cyphar.com/go-pathrs/procfs/procfs_linux.go
index 915e9ccdb5..6a3142646f 100644
--- a/vendor/cyphar.com/go-pathrs/procfs/procfs_linux.go
+++ b/vendor/cyphar.com/go-pathrs/procfs/procfs_linux.go
@@ -127,7 +127,7 @@ func (proc *Handle) fd() int {
 }
 
 // TODO: Should we expose open?
-func (proc *Handle) open(base ProcBase, path string, flags int) (_ *os.File, Closer ThreadCloser, Err error) {
+func (proc *Handle) open(base ProcBase, path string, flags uint64) (_ *os.File, Closer ThreadCloser, Err error) {
 	var closer ThreadCloser
 	if base == ProcThreadSelf {
 		runtime.LockOSThread()
@@ -154,7 +154,7 @@ func (proc *Handle) open(base ProcBase, path string, flags int) (_ *os.File, Clo
 // (such as /proc/cpuinfo) or information about other processes (such as
 // /proc/1). Accessing your own process information should be done using
 // [Handle.OpenSelf] or [Handle.OpenThreadSelf].
-func (proc *Handle) OpenRoot(path string, flags int) (*os.File, error) {
+func (proc *Handle) OpenRoot(path string, flags uint64) (*os.File, error) {
 	file, closer, err := proc.open(ProcRoot, path, flags)
 	if closer != nil {
 		// should not happen
@@ -180,7 +180,7 @@ func (proc *Handle) OpenRoot(path string, flags int) (*os.File, error) {
 // Unlike [Handle.OpenThreadSelf], this method does not involve locking
 // the goroutine to the current OS thread and so is simpler to use and
 // theoretically has slightly less overhead.
-func (proc *Handle) OpenSelf(path string, flags int) (*os.File, error) {
+func (proc *Handle) OpenSelf(path string, flags uint64) (*os.File, error) {
 	file, closer, err := proc.open(ProcSelf, path, flags)
 	if closer != nil {
 		// should not happen
@@ -198,7 +198,7 @@ func (proc *Handle) OpenSelf(path string, flags int) (*os.File, error) {
 // Be aware that due to PID recycling, using this is generally not safe except
 // in certain circumstances. See the documentation of [ProcPid] for more
 // details.
-func (proc *Handle) OpenPid(pid int, path string, flags int) (*os.File, error) {
+func (proc *Handle) OpenPid(pid int, path string, flags uint64) (*os.File, error) {
 	file, closer, err := proc.open(ProcPid(pid), path, flags)
 	if closer != nil {
 		// should not happen
@@ -225,7 +225,7 @@ func (proc *Handle) OpenPid(pid int, path string, flags int) (*os.File, error) {
 // callback MUST be called AFTER you have finished using the returned
 // [os.File]. This callback is completely separate to [os.File.Close], so it
 // must be called regardless of how you close the handle.
-func (proc *Handle) OpenThreadSelf(path string, flags int) (*os.File, ThreadCloser, error) {
+func (proc *Handle) OpenThreadSelf(path string, flags uint64) (*os.File, ThreadCloser, error) {
 	return proc.open(ProcThreadSelf, path, flags)
 }
 
diff --git a/vendor/cyphar.com/go-pathrs/root_linux.go b/vendor/cyphar.com/go-pathrs/root_linux.go
index 5bc2e90717..4741a24a46 100644
--- a/vendor/cyphar.com/go-pathrs/root_linux.go
+++ b/vendor/cyphar.com/go-pathrs/root_linux.go
@@ -19,6 +19,8 @@ import (
 	"os"
 	"syscall"
 
+	"golang.org/x/sys/unix"
+
 	"cyphar.com/go-pathrs/internal/fdutils"
 	"cyphar.com/go-pathrs/internal/libpathrs"
 )
@@ -27,7 +29,7 @@ import (
 // purpose of this "root handle" is to perform operations within the directory
 // tree, or to get a [Handle] to inodes within the directory tree.
 //
-// At time of writing, it is considered a *VERY BAD IDEA* to open a [Root]
+// At time of writing, it is considered a *VERY BAD IDEA* to open a Root
 // inside a possibly-attacker-controlled directory tree. While we do have
 // protections that should defend against it, it's far more dangerous than just
 // opening a directory tree which is not inside a potentially-untrusted
@@ -68,7 +70,7 @@ func RootFromFile(file *os.File) (*Root, error) {
 //
 // All symlinks (including trailing symlinks) are followed, but they are
 // resolved within the rootfs. If you wish to open a handle to the symlink
-// itself, use [ResolveNoFollow].
+// itself, use [Root.ResolveNoFollow].
 func (r *Root) Resolve(path string) (*Handle, error) {
 	return fdutils.WithFileFd(r.inner, func(rootFd uintptr) (*Handle, error) {
 		handleFd, err := libpathrs.InRootResolve(rootFd, path)
@@ -83,10 +85,10 @@ func (r *Root) Resolve(path string) (*Handle, error) {
 	})
 }
 
-// ResolveNoFollow is effectively an O_NOFOLLOW version of [Resolve]. Their
-// behaviour is identical, except that *trailing* symlinks will not be
-// followed. If the final component is a trailing symlink, an O_PATH|O_NOFOLLOW
-// handle to the symlink itself is returned.
+// ResolveNoFollow is effectively an [unix.O_NOFOLLOW] version of
+// [Root.Resolve]. Their behaviour is identical, except that *trailing*
+// symlinks will not be followed. If the final component is a trailing symlink,
+// an [unix.O_PATH]|[unix.O_NOFOLLOW] handle to the symlink itself is returned.
 func (r *Root) ResolveNoFollow(path string) (*Handle, error) {
 	return fdutils.WithFileFd(r.inner, func(rootFd uintptr) (*Handle, error) {
 		handleFd, err := libpathrs.InRootResolveNoFollow(rootFd, path)
@@ -101,29 +103,29 @@ func (r *Root) ResolveNoFollow(path string) (*Handle, error) {
 	})
 }
 
-// Open is effectively shorthand for [Resolve] followed by [Handle.Open], but
-// can be slightly more efficient (it reduces CGo overhead and the number of
-// syscalls used when using the openat2-based resolver) and is arguably more
+// Open is effectively shorthand for [Root.Resolve] followed by [Handle.Open],
+// but can be slightly more efficient (it reduces CGo overhead and the number
+// of syscalls used when using the openat2-based resolver) and is arguably more
 // ergonomic to use.
 //
 // This is effectively equivalent to [os.Open].
 func (r *Root) Open(path string) (*os.File, error) {
-	return r.OpenFile(path, os.O_RDONLY)
+	return r.OpenFile(path, unix.O_RDONLY)
 }
 
-// OpenFile is effectively shorthand for [Resolve] followed by
+// OpenFile is effectively shorthand for [Root.Resolve] followed by
 // [Handle.OpenFile], but can be slightly more efficient (it reduces CGo
 // overhead and the number of syscalls used when using the openat2-based
 // resolver) and is arguably more ergonomic to use.
 //
-// However, if flags contains os.O_NOFOLLOW and the path is a symlink, then
+// However, if flags contains [unix.O_NOFOLLOW] and the path is a symlink, then
 // OpenFile's behaviour will match that of openat2. In most cases an error will
-// be returned, but if os.O_PATH is provided along with os.O_NOFOLLOW then a
-// file equivalent to [ResolveNoFollow] will be returned instead.
+// be returned, but if [unix.O_PATH] is provided along with [unix.O_NOFOLLOW]
+// then a file equivalent to [Root.ResolveNoFollow] will be returned instead.
 //
-// This is effectively equivalent to [os.OpenFile], except that os.O_CREAT is
-// not supported.
-func (r *Root) OpenFile(path string, flags int) (*os.File, error) {
+// This is effectively equivalent to [os.OpenFile], except that [unix.O_CREAT]
+// is not supported.
+func (r *Root) OpenFile(path string, flags uint64) (*os.File, error) {
 	return fdutils.WithFileFd(r.inner, func(rootFd uintptr) (*os.File, error) {
 		fd, err := libpathrs.InRootOpen(rootFd, path, flags)
 		if err != nil {
@@ -139,7 +141,7 @@ func (r *Root) OpenFile(path string, flags int) (*os.File, error) {
 //
 // Unlike [os.Create], if the file already exists an error is created rather
 // than the file being opened and truncated.
-func (r *Root) Create(path string, flags int, mode os.FileMode) (*os.File, error) {
+func (r *Root) Create(path string, flags uint64, mode os.FileMode) (*os.File, error) {
 	unixMode, err := toUnixMode(mode, false)
 	if err != nil {
 		return nil, err
@@ -155,9 +157,9 @@ func (r *Root) Create(path string, flags int, mode os.FileMode) (*os.File, error
 
 // Rename two paths within a [Root]'s directory tree. The flags argument is
 // identical to the RENAME_* flags to the renameat2(2) system call.
-func (r *Root) Rename(src, dst string, flags uint) error {
+func (r *Root) Rename(src, dst string, flags uint64) error {
 	_, err := fdutils.WithFileFd(r.inner, func(rootFd uintptr) (struct{}, error) {
-		err := libpathrs.InRootRename(rootFd, src, dst, flags)
+		err := libpathrs.InRootRename(rootFd, src, rootFd, dst, flags)
 		return struct{}{}, err
 	})
 	return err
@@ -277,26 +279,26 @@ func (r *Root) Mknod(path string, mode os.FileMode, dev uint64) error {
 }
 
 // Symlink creates a symlink within a [Root]'s directory tree. The symlink is
-// created at path and is a link to target.
+// created at newname and is a link to oldname.
 //
 // This is effectively equivalent to [os.Symlink].
-func (r *Root) Symlink(path, target string) error {
+func (r *Root) Symlink(oldname, newname string) error {
 	_, err := fdutils.WithFileFd(r.inner, func(rootFd uintptr) (struct{}, error) {
-		err := libpathrs.InRootSymlink(rootFd, path, target)
+		err := libpathrs.InRootSymlink(oldname, rootFd, newname)
 		return struct{}{}, err
 	})
 	return err
 }
 
 // Hardlink creates a hardlink within a [Root]'s directory tree. The hardlink
-// is created at path and is a link to target. Both paths are within the
+// is created at newname and is a link to oldname. Both paths are within the
 // [Root]'s directory tree (you cannot hardlink to a different [Root] or the
 // host).
 //
 // This is effectively equivalent to [os.Link].
-func (r *Root) Hardlink(path, target string) error {
+func (r *Root) Hardlink(oldname, newname string) error {
 	_, err := fdutils.WithFileFd(r.inner, func(rootFd uintptr) (struct{}, error) {
-		err := libpathrs.InRootHardlink(rootFd, path, target)
+		err := libpathrs.InRootHardlink(rootFd, oldname, rootFd, newname, 0)
 		return struct{}{}, err
 	})
 	return err
diff --git a/vendor/cyphar.com/go-pathrs/version_linux.go b/vendor/cyphar.com/go-pathrs/version_linux.go
new file mode 100644
index 0000000000..9ed2d74eca
--- /dev/null
+++ b/vendor/cyphar.com/go-pathrs/version_linux.go
@@ -0,0 +1,27 @@
+//go:build linux
+
+// SPDX-License-Identifier: MPL-2.0
+/*
+ * libpathrs: safe path resolution on Linux
+ * Copyright (C) 2026 Aleksa Sarai <cyphar@cyphar.com>
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at https://mozilla.org/MPL/2.0/.
+ */
+
+package pathrs
+
+import (
+	"cyphar.com/go-pathrs/internal/libpathrs"
+)
+
+// LibraryVersionInfo contains information about the version and features
+// supported by the underlying libpathrs.so library at runtime.
+type LibraryVersionInfo = libpathrs.VersionInfo
+
+// LibraryVersion returns information about the version and features supported
+// by the underlying libpathrs.so library at runtime.
+func LibraryVersion() (*LibraryVersionInfo, error) {
+	return libpathrs.Version()
+}
diff --git a/vendor/github.com/aperturerobotics/protobuf-go-lite/.gitattributes b/vendor/github.com/aperturerobotics/protobuf-go-lite/.gitattributes
new file mode 100644
index 0000000000..1f21496300
--- /dev/null
+++ b/vendor/github.com/aperturerobotics/protobuf-go-lite/.gitattributes
@@ -0,0 +1 @@
+*.pb.* linguist-generated
diff --git a/vendor/github.com/aperturerobotics/protobuf-go-lite/.gitignore b/vendor/github.com/aperturerobotics/protobuf-go-lite/.gitignore
new file mode 100644
index 0000000000..1a6d2284a0
--- /dev/null
+++ b/vendor/github.com/aperturerobotics/protobuf-go-lite/.gitignore
@@ -0,0 +1,8 @@
+/.cache/
+/.gocache/
+/bin/
+/vendor/
+.#*
+.aider*
+debug.test*
+/node_modules
diff --git a/vendor/github.com/aperturerobotics/protobuf-go-lite/.golangci.yml b/vendor/github.com/aperturerobotics/protobuf-go-lite/.golangci.yml
new file mode 100644
index 0000000000..81b6f4b7df
--- /dev/null
+++ b/vendor/github.com/aperturerobotics/protobuf-go-lite/.golangci.yml
@@ -0,0 +1,69 @@
+linters:
+  enable:
+    - depguard
+    - goimports
+    - gosec
+    - gosimple
+    - govet
+    - importas
+    - ineffassign
+    - misspell
+    - revive
+    - staticcheck
+    - typecheck
+    - unconvert
+    - unused
+
+  disable:
+    - errcheck
+
+  run:
+    concurrency: 4
+    modules-download-mode: vendor
+
+    skip-dirs:
+      - hack
+
+linters-settings:
+  staticcheck:
+    checks:
+      - all
+      - '-SA1012' # Allow passing nil contexts.
+      - '-SA1019' # Allow calling deprecated symbols.
+
+  importas:
+    # Do not allow unaliased imports of aliased packages.
+    no-unaliased: true
+
+  maligned:
+    suggest-new: true
+
+  depguard:
+    rules:
+      main:
+        deny:
+          - pkg: io/ioutil
+            desc: The io/ioutil package has been deprecated, see https://go.dev/doc/go1.16#ioutil
+          #- pkg: "github.com/stretchr/testify/assert"
+          #  desc: Use "gotest.tools/v3/assert" instead
+          #- pkg: "github.com/stretchr/testify/require"
+          #  desc: Use "gotest.tools/v3/assert" instead
+          - pkg: "github.com/stretchr/testify/suite"
+            desc: Do not use
+
+  revive:
+    rules:
+      - name: package-comments
+        disabled: true
+
+issues:
+  # Maximum issues count per one linter. Set to 0 to disable. Default is 50.
+  max-issues-per-linter: 0
+
+  # Maximum count of issues with the same text. Set to 0 to disable. Default is 3.
+  max-same-issues: 0
+
+  exclude:
+    - G601
+    - G306
+    - G204
diff --git a/vendor/github.com/aperturerobotics/protobuf-go-lite/.ignore b/vendor/github.com/aperturerobotics/protobuf-go-lite/.ignore
new file mode 100644
index 0000000000..3be6623eab
--- /dev/null
+++ b/vendor/github.com/aperturerobotics/protobuf-go-lite/.ignore
@@ -0,0 +1,5 @@
+*.pb.go
+*.pb.ts
+go.sum
+testdata
+thirdparty
\ No newline at end of file
diff --git a/vendor/github.com/aperturerobotics/protobuf-go-lite/LICENSE b/vendor/github.com/aperturerobotics/protobuf-go-lite/LICENSE
new file mode 100644
index 0000000000..a5f7f63da3
--- /dev/null
+++ b/vendor/github.com/aperturerobotics/protobuf-go-lite/LICENSE
@@ -0,0 +1,31 @@
+Copyright (c) 2024-2025 Aperture Robotics, LLC. All rights reserved.
+Copyright (c) 2024-2025 Christian Stewart <christian@aperture.us>. All rights reserved.
+Copyright (c) 2021, PlanetScale Inc. All rights reserved.
+Copyright (c) 2013, The GoGo Authors. All rights reserved.
+Copyright (c) 2018 The Go Authors. All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are
+met:
+
+   * Redistributions of source code must retain the above copyright
+notice, this list of conditions and the following disclaimer.
+   * Redistributions in binary form must reproduce the above
+copyright notice, this list of conditions and the following disclaimer
+in the documentation and/or other materials provided with the
+distribution.
+   * Neither the name of Google Inc. nor the names of its
+contributors may be used to endorse or promote products derived from
+this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
\ No newline at end of file
diff --git a/vendor/github.com/aperturerobotics/protobuf-go-lite/Makefile b/vendor/github.com/aperturerobotics/protobuf-go-lite/Makefile
new file mode 100644
index 0000000000..4a32248da6
--- /dev/null
+++ b/vendor/github.com/aperturerobotics/protobuf-go-lite/Makefile
@@ -0,0 +1,112 @@
+SHELL:=bash
+PROTOWRAP=hack/bin/protowrap
+GOIMPORTS=hack/bin/goimports
+GOFUMPT=hack/bin/gofumpt
+GOLANGCI_LINT=hack/bin/golangci-lint
+PROTOC_GEN_GO=hack/bin/protoc-gen-go-lite
+GOLIST=go list -f "{{ .Dir }}" -m
+
+export GO111MODULE=on
+undefine GOOS
+undefine GOARCH
+
+all:
+
+vendor:
+	go mod vendor
+
+$(GOIMPORTS):
+	cd ./hack; \
+	go build -v \
+		-o ./bin/goimports \
+		golang.org/x/tools/cmd/goimports
+
+$(GOFUMPT):
+	cd ./hack; \
+	go build -v \
+		-o ./bin/gofumpt \
+		mvdan.cc/gofumpt
+
+$(PROTOWRAP):
+	cd ./hack; \
+	go build -v \
+		-o ./bin/protowrap \
+		github.com/aperturerobotics/goprotowrap/cmd/protowrap
+
+$(GOLANGCI_LINT):
+	cd ./hack; \
+	go build -v \
+		-o ./bin/golangci-lint \
+		github.com/golangci/golangci-lint/cmd/golangci-lint
+
+$(PROTOC_GEN_GO):
+	cd ./hack; \
+	go build -v \
+		-o ./bin/protoc-gen-go-lite \
+		github.com/aperturerobotics/protobuf-go-lite/cmd/protoc-gen-go-lite
+
+.PHONY: protoc-gen-go-lite-tool
+protoc-gen-go-lite-tool:
+	cd ./hack; \
+	go build -v \
+		-o ./bin/protoc-gen-go-lite \
+		github.com/aperturerobotics/protobuf-go-lite/cmd/protoc-gen-go-lite
+
+.PHONY: build
+build: vendor
+	go build -v
+
+.PHONY: lint
+lint: $(GOLANGCI_LINT)
+	$(GOLANGCI_LINT) run --timeout=10m
+
+.PHONY: fix
+fix: $(GOLANGCI_LINT)
+	$(GOLANGCI_LINT) run --fix --timeout=10m
+
+.PHONY: format
+format: $(GOFUMPT) $(GOIMPORTS)
+	$(GOIMPORTS) -w ./
+	$(GOFUMPT) -w ./
+
+.PHONY: test
+test:
+	go test -v ./...
+
+.PHONY: gengo
+gengo: $(GOIMPORTS) $(PROTOWRAP) protoc-gen-go-lite-tool
+	shopt -s globstar; \
+	set -eo pipefail; \
+	export PROJECT=$$(go list -m); \
+	export PATH=$$(pwd)/hack/bin:$${PATH}; \
+	mkdir -p $$(pwd)/vendor/$$(dirname $${PROJECT}); \
+	rm $$(pwd)/vendor/$${PROJECT} || true; \
+	ln -s $$(pwd) $$(pwd)/vendor/$${PROJECT} ; \
+	protogen() { \
+		$(PROTOWRAP) \
+			-I $$(pwd)/vendor \
+			-I $$(pwd) \
+			--go-lite_out=$$(pwd)/vendor \
+			--proto_path $$(pwd)/vendor \
+			--print_structure \
+			--only_specified_files \
+			$$2 \
+			$$(\
+				git \
+					ls-files "$$1" |\
+					xargs printf -- \
+					"$$(pwd)/vendor/$${PROJECT}/%s "); \
+	}; \
+	for d in ./types/known/*; do \
+		protogen "$${d}/*.proto" "--go-lite_opt=features=marshal+marshal_strict+unmarshal+unmarshal_unsafe+size+equal+clone+text"; \
+	done; \
+	protogen "./types/descriptorpb/*.proto" ""; \
+	protogen "./types/pluginpb/*.proto" ""; \
+	protogen "./testproto/*.proto" ""; \
+	rm $$(pwd)/vendor/$${PROJECT} || true
+	$(GOIMPORTS) -w ./
+
+.PHONY: check-gengo
+check-gengo: gengo
+	git diff --exit-code HEAD
+	test -z "$$(git ls-files --others --exclude-standard)" || (git ls-files --others --exclude-standard; exit 1)
diff --git a/vendor/github.com/aperturerobotics/protobuf-go-lite/PATENTS b/vendor/github.com/aperturerobotics/protobuf-go-lite/PATENTS
new file mode 100644
index 0000000000..733099041f
--- /dev/null
+++ b/vendor/github.com/aperturerobotics/protobuf-go-lite/PATENTS
@@ -0,0 +1,22 @@
+Additional IP Rights Grant (Patents)
+
+"This implementation" means the copyrightable works distributed by
+Google as part of the Go project.
+
+Google hereby grants to You a perpetual, worldwide, non-exclusive,
+no-charge, royalty-free, irrevocable (except as stated in this section)
+patent license to make, have made, use, offer to sell, sell, import,
+transfer and otherwise run, modify and propagate the contents of this
+implementation of Go, where such license applies only to those patent
+claims, both currently owned or controlled by Google and acquired in
+the future, licensable by Google that are necessarily infringed by this
+implementation of Go.  This grant does not include claims that would be
+infringed only as a consequence of further modification of this
+implementation.  If you or your agent or exclusive licensee institute or
+order or agree to the institution of patent litigation against any
+entity (including a cross-claim or counterclaim in a lawsuit) alleging
+that this implementation of Go or any code incorporated within this
+implementation of Go constitutes direct or contributory patent
+infringement, or inducement of patent infringement, then any patent
+rights granted to you under this License for this implementation of Go
+shall terminate as of the date such litigation is filed.
diff --git a/vendor/github.com/aperturerobotics/protobuf-go-lite/README.md b/vendor/github.com/aperturerobotics/protobuf-go-lite/README.md
new file mode 100644
index 0000000000..a56e9000cf
--- /dev/null
+++ b/vendor/github.com/aperturerobotics/protobuf-go-lite/README.md
@@ -0,0 +1,157 @@
+# protobuf-go-lite
+
+[![GoDoc Widget]][GoDoc] [![Go Report Card Widget]][Go Report Card] [![DeepWiki Widget]][DeepWiki]
+
+[GoDoc]: https://godoc.org/github.com/aperturerobotics/protobuf-go-lite
+[GoDoc Widget]: https://godoc.org/github.com/aperturerobotics/protobuf-go-lite?status.svg
+[Go Report Card Widget]: https://goreportcard.com/badge/github.com/aperturerobotics/protobuf-go-lite
+[Go Report Card]: https://goreportcard.com/report/github.com/aperturerobotics/protobuf-go-lite
+[DeepWiki Widget]: https://img.shields.io/badge/DeepWiki-aperturerobotics%2Fprotobuf--go--lite-blue.svg?logo=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAACwAAAAyCAYAAAAnWDnqAAAAAXNSR0IArs4c6QAAA05JREFUaEPtmUtyEzEQhtWTQyQLHNak2AB7ZnyXZMEjXMGeK/AIi+QuHrMnbChYY7MIh8g01fJoopFb0uhhEqqcbWTp06/uv1saEDv4O3n3dV60RfP947Mm9/SQc0ICFQgzfc4CYZoTPAswgSJCCUJUnAAoRHOAUOcATwbmVLWdGoH//PB8mnKqScAhsD0kYP3j/Yt5LPQe2KvcXmGvRHcDnpxfL2zOYJ1mFwrryWTz0advv1Ut4CJgf5uhDuDj5eUcAUoahrdY/56ebRWeraTjMt/00Sh3UDtjgHtQNHwcRGOC98BJEAEymycmYcWwOprTgcB6VZ5JK5TAJ+fXGLBm3FDAmn6oPPjR4rKCAoJCal2eAiQp2x0vxTPB3ALO2CRkwmDy5WohzBDwSEFKRwPbknEggCPB/imwrycgxX2NzoMCHhPkDwqYMr9tRcP5qNrMZHkVnOjRMWwLCcr8ohBVb1OMjxLwGCvjTikrsBOiA6fNyCrm8V1rP93iVPpwaE+gO0SsWmPiXB+jikdf6SizrT5qKasx5j8ABbHpFTx+vFXp9EnYQmLx02h1QTTrl6eDqxLnGjporxl3NL3agEvXdT0WmEost648sQOYAeJS9Q7bfUVoMGnjo4AZdUMQku50McDcMWcBPvr0SzbTAFDfvJqwLzgxwATnCgnp4wDl6Aa+Ax283gghmj+vj7feE2KBBRMW3FzOpLOADl0Isb5587h/U4gGvkt5v60Z1VLG8BhYjbzRwyQZemwAd6cCR5/XFWLYZRIMpX39AR0tjaGGiGzLVyhse5C9RKC6ai42ppWPKiBagOvaYk8lO7DajerabOZP46Lby5wKjw1HCRx7p9sVMOWGzb/vA1hwiWc6jm3MvQDTogQkiqIhJV0nBQBTU+3okKCFDy9WwferkHjtxib7t3xIUQtHxnIwtx4mpg26/HfwVNVDb4oI9RHmx5WGelRVlrtiw43zboCLaxv46AZeB3IlTkwouebTr1y2NjSpHz68WNFjHvupy3q8TFn3Hos2IAk4Ju5dCo8B3wP7VPr/FGaKiG+T+v+TQqIrOqMTL1VdWV1DdmcbO8KXBz6esmYWYKPwDL5b5FA1a0hwapHiom0r/cKaoqr+27/XcrS5UwSMbQAAAABJRU5ErkJggg==
+[DeepWiki]: https://deepwiki.com/aperturerobotics/protobuf-go-lite
+
+**protobuf-go-lite** is a stripped-down version of the [protobuf-go] code
+generator modified to work without reflection and merged with [vtprotobuf] to
+provide modular features with static code generation for marshal/unmarshal,
+size, clone, and equal. It bundles a fork of [protoc-gen-go-json] for JSON.
+
+[protobuf-go]: https://github.com/protocolbuffers/protobuf-go
+[vtprotobuf]: https://github.com/planetscale/vtprotobuf
+[protoc-gen-go-json]: https://github.com/TheThingsIndustries/protoc-gen-go-json
+
+Static code generation without reflection is more efficient at runtime and
+results in smaller code binaries. It also provides better support for [tinygo]
+which has limited reflection support.
+
+[tinygo]: https://github.com/tinygo-org/tinygo
+
+protobuf-go-lite supports Edition 2024 schemas that resolve to the open Go API
+and static, reflect-free generated output. The default `features=all` path
+supports explicit and implicit presence, legacy required fields, packed
+encoding, delimited message encoding, oneofs, maps, clone/equal, text,
+unmarshal, unsafe unmarshal, and JSON when the resolved JSON format is
+`ALLOW`.
+
+protobuf-go-lite rejects Edition schemas that require closed enum semantics,
+`LEGACY_BEST_EFFORT` JSON, or explicit hybrid/opaque Go APIs. It does not
+support fieldmasks and extensions.
+
+### Ecosystem
+
+Lightweight Protobuf 3 RPCs are implemented in [StaRPC] for Go and TypeScript.
+
+[StaRPC]: https://github.com/aperturerobotics/starpc
+
+[protoc-gen-doc] is recommended for generating documentation.
+
+[protoc-gen-doc]: https://github.com/pseudomuto/protoc-gen-doc
+
+[protobuf-es-lite] is recommended for lightweight TypeScript protobufs.
+
+[protobuf-es-lite]: https://github.com/aperturerobotics/protobuf-es-lite
+
+## Protobuf
+
+[protocol buffers](https://protobuf.dev) are a cross-platform cross-language
+message serialization format. Protobuf is a language for specifying the schema
+for structured data. This schema is compiled into language specific bindings.
+This project provides both a tool to generate Go code for the protocol buffer
+language, and also the runtime implementation to handle serialization of
+messages in Go.
+
+See the [protocol buffer developer guide](https://protobuf.dev/overview) for
+more information about protocol buffers themselves.
+
+## Example
+
+See the [protobuf-project](https://github.com/aperturerobotics/protobuf-project)
+template for an example of how to use this package and vtprotobuf together with
+protowrap to generate protobufs for your project.
+
+This package is available at **github.com/aperturerobotics/protobuf-go-lite**.
+
+## Package index
+
+Summary of the packages provided by this module:
+
+*   [`compiler/protogen`](https://pkg.go.dev/github.com/aperturerobotics/protobuf-go-lite/compiler/protogen):
+    Package `protogen` provides support for writing protoc plugins.
+*   [`cmd/protoc-gen-go-lite`](https://pkg.go.dev/github.com/aperturerobotics/protobuf-go-lite/cmd/protoc-gen-go-lite):
+    The `protoc-gen-go-lite` binary is a protoc plugin to generate a Go protocol
+    buffer package.
+
+## Usage
+
+1. Install `protoc-gen-go-lite`:
+
+    ```
+    go install github.com/aperturerobotics/protobuf-go-lite/cmd/protoc-gen-go-lite@latest
+    ```
+
+2. Update your `protoc` generator to use the new plug-in.
+
+    ```
+    for name in $(PROTO_SRC_NAMES); do \
+        protoc \
+          --plugin protoc-gen-go-lite="${GOBIN}/protoc-gen-go-lite" \
+          --go-lite_out=.  \
+          --go-lite_opt=features=marshal+unmarshal+size+equal+clone \
+        proto/$${name}.proto; \
+    done
+    ```
+
+`protobuf-go-lite` replaces `protoc-gen-go` and `protoc-gen-go-vtprotobuf` and should not be used with those generators.
+
+Check out the [template](https://github.com/aperturerobotics/template) for a quick start!
+
+## Available features
+
+The following additional features from vtprotobuf can be enabled:
+
+- `size`: generates a `func (p *YourProto) SizeVT() int` helper that behaves identically to calling `proto.Size(p)` on the message, except the size calculation is fully unrolled and does not use reflection. This helper function can be used directly, and it'll also be used by the `marshal` codegen to ensure the destination buffer is properly sized before ProtoBuf objects are marshalled to it.
+
+- `equal`: generates the following helper methods
+
+    - `func (this *YourProto) EqualVT(that *YourProto) bool`: this function behaves almost identically to calling `proto.Equal(this, that)` on messages, except the equality calculation is fully unrolled and does not use reflection. This helper function can be used directly.
+
+    - `func (this *YourProto) EqualMessageVT(thatMsg any) bool`: this function behaves like the above `this.EqualVT(that)`, but allows comparing against arbitrary proto messages. If `thatMsg` is not of type `*YourProto`, false is returned. The uniform signature provided by this method allows accessing this method via type assertions even if the message type is not known at compile time. This allows implementing a generic `func EqualVT(proto.Message, proto.Message) bool` without reflection.
+
+- `marshal`: generates the following helper methods
+
+    - `func (p *YourProto) MarshalVT() ([]byte, error)`: this function behaves identically to calling `proto.Marshal(p)`, except the actual marshalling has been fully unrolled and does not use reflection or allocate memory. This function simply allocates a properly sized buffer by calling `SizeVT` on the message and then uses `MarshalToSizedBufferVT` to marshal to it.
+
+    - `func (p *YourProto) MarshalToVT(data []byte) (int, error)`: this function can be used to marshal a message to an existing buffer. The buffer must be large enough to hold the marshalled message, otherwise this function will panic. It returns the number of bytes marshalled. This function is useful e.g. when using memory pooling to re-use serialization buffers.
+
+    - `func (p *YourProto) MarshalToSizedBufferVT(data []byte) (int, error)`: this function behaves like `MarshalTo` but expects that the input buffer has the exact size required to hold the message, otherwise it will panic.
+
+- `marshal_strict`: generates the following helper methods
+
+    - `func (p *YourProto) MarshalVTStrict() ([]byte, error)`: this function behaves like `MarshalVT`, except fields are marshalled in a strict order by field's numbers they were declared in .proto file.
+
+    - `func (p *YourProto) MarshalToVTStrict(data []byte) (int, error)`: this function behaves like `MarshalToVT`, except fields are marshalled in a strict order by field's numbers they were declared in .proto file.
+
+    - `func (p *YourProto) MarshalToSizedBufferVTStrict(data []byte) (int, error)`: this function behaves like `MarshalToSizedBufferVT`, except fields are marshalled in a strict order by field's numbers they were declared in .proto file.
+
+
+- `unmarshal`: generates a `func (p *YourProto) UnmarshalVT(data []byte)` that behaves similarly to calling `proto.Unmarshal(data, p)` on the message, except the unmarshalling is performed by unrolled codegen without using reflection and allocating as little memory as possible. If the receiver `p` is **not** fully zeroed-out, the unmarshal call will actually behave like `proto.Merge(data, p)`. This is because the `proto.Unmarshal` in the ProtoBuf API is implemented by resetting the destination message and then calling `proto.Merge` on it. To ensure proper `Unmarshal` semantics, ensure you've called `proto.Reset` on your message before calling `UnmarshalVT`, or that your message has been newly allocated.
+
+- `unmarshal_unsafe` generates a `func (p *YourProto) UnmarshalVTUnsafe(data []byte)` that behaves like `UnmarshalVT`, except it unsafely casts slices of data to `bytes` and `string` fields instead of copying them to newly allocated arrays, so that it performs less allocations. **Data received from the wire has to be left untouched for the lifetime of the message.** Otherwise, the message's `bytes` and `string` fields can be corrupted.
+
+- `clone`: generates the following helper methods
+
+    - `func (p *YourProto) CloneVT() *YourProto`: this function behaves similarly to calling `proto.Clone(p)` on the message, except the cloning is performed by unrolled codegen without using reflection. If the receiver `p` is `nil` a typed `nil` is returned.
+
+    - `func (p *YourProto) CloneMessageVT() any`: this function behaves like the above `p.CloneVT()`, but provides a uniform signature in order to be accessible via type assertions even if the type is not known at compile time. This allows implementing a generic `func CloneMessageVT() any` without reflection. If the receiver `p` is `nil`, a typed `nil` pointer of the message type will be returned inside a `any` interface.
+
+- `json`: generates the following helper methods
+
+    - `func (p *YourProto) UnmarshalJSON(data []byte) error` behaves similarly to calling `protojson.Unmarshal(data, p)` on the message, except the unmarshalling is performed by unrolled codegen without using reflection and allocating as little memory as possible (with json-iterator/go). If the receiver `p` is **not** fully zeroed-out, the unmarshal call will actually behave like `proto.Merge(data, p)`. To ensure proper `Unmarshal` semantics, ensure you've called `proto.Reset` on your message before calling `UnmarshalJSON`, or that your message has been newly allocated.
+
+    - `func (p *YourProto) UnmarshalJSONValue(val *fastjson.Value) error` unmarshals a `*fastjson.Value`.
+
+    - `func (p *YourProto) MarshalJSON() ([]byte, error)` behaves similarly to calling `protojson.Marshal(p)` on the message, except the marshalling is performed by unrolled codegen without using reflection and allocating as little memory as possible (with json-iterator/go).
+
+    - Adding a `//protobuf-go-lite:disable-json` comment before a message or enum will disable the json marshaler / unmarshaler.
+
+## License
+
+BSD-3
diff --git a/vendor/github.com/aperturerobotics/protobuf-go-lite/protobuf-go-lite.go b/vendor/github.com/aperturerobotics/protobuf-go-lite/protobuf-go-lite.go
new file mode 100644
index 0000000000..98e2eb6423
--- /dev/null
+++ b/vendor/github.com/aperturerobotics/protobuf-go-lite/protobuf-go-lite.go
@@ -0,0 +1,594 @@
+package protobuf_go_lite
+
+import (
+	"errors"
+	"fmt"
+	"io"
+	"math"
+	"math/bits"
+	"slices"
+	"unsafe"
+)
+
+var (
+	// ErrInvalidLength is returned when decoding a negative length.
+	ErrInvalidLength = errors.New("proto: negative length found during unmarshaling")
+	// ErrIntOverflow is returned when decoding a varint representation of an integer that overflows 64 bits.
+	ErrIntOverflow = errors.New("proto: integer overflow")
+	// ErrUnexpectedEndOfGroup is returned when decoding a group end without a corresponding group start.
+	ErrUnexpectedEndOfGroup = errors.New("proto: unexpected end of group")
+)
+
+// Message is the base vtprotobuf message marshal/unmarshal interface.
+type Message interface {
+	// SizeVT returns the size of the message when marshaled.
+	SizeVT() int
+	// MarshalToSizedBufferVT marshals to a buffer that already is SizeVT bytes long.
+	MarshalToSizedBufferVT(dAtA []byte) (int, error)
+	// MarshalVT marshals the message with vtprotobuf.
+	MarshalVT() ([]byte, error)
+	// UnmarshalVT unmarshals the message object with vtprotobuf.
+	UnmarshalVT(data []byte) error
+	// Reset resets the message.
+	Reset()
+}
+
+// JSONMessage is a message with MarshalJSON and UnmarshalJSON.
+type JSONMessage interface {
+	// MarshalJSON marshals the message to JSON.
+	MarshalJSON() ([]byte, error)
+	// UnmarshalJSON unmarshals the message from JSON.
+	UnmarshalJSON(data []byte) error
+}
+
+// CloneMessage is a message with a CloneMessage function.
+type CloneMessage interface {
+	// Message extends the base message type.
+	Message
+	// CloneMessageVT clones the object.
+	CloneMessageVT() CloneMessage
+}
+
+// CloneVT is a message with a CloneVT function (VTProtobuf).
+type CloneVT[T comparable] interface {
+	comparable
+	// CloneMessage is the non-generic clone interface.
+	CloneMessage
+	// CloneVT clones the object.
+	CloneVT() T
+}
+
+// CloneVTSlice clones a slice of CloneVT messages.
+func CloneVTSlice[S ~[]E, E CloneVT[E]](s S) S {
+	out := make([]E, len(s))
+	var empty E
+	for i := range s {
+		if s[i] != empty {
+			out[i] = s[i].CloneVT()
+		}
+	}
+	return out
+}
+
+// EqualVT is a message with a EqualVT function (VTProtobuf).
+type EqualVT[T comparable] interface {
+	comparable
+	// EqualVT compares against the other message for equality.
+	EqualVT(other T) bool
+}
+
+// CompareComparable returns a compare function to compare two comparable types.
+func CompareComparable[T comparable]() func(t1, t2 T) bool {
+	return func(t1, t2 T) bool {
+		return t1 == t2
+	}
+}
+
+// CompareEqualVT returns a compare function to compare two VTProtobuf messages.
+func CompareEqualVT[T EqualVT[T]]() func(t1, t2 T) bool {
+	return func(t1, t2 T) bool {
+		return IsEqualVT(t1, t2)
+	}
+}
+
+// IsEqualVT checks if two EqualVT objects are equal.
+func IsEqualVT[T EqualVT[T]](t1, t2 T) bool {
+	var empty T
+	t1Empty, t2Empty := t1 == empty, t2 == empty
+	if t1Empty != t2Empty {
+		return false
+	}
+	if t1Empty {
+		return true
+	}
+	return t1.EqualVT(t2)
+}
+
+// IsEqualVTSlice checks if two slices of EqualVT messages are equal.
+func IsEqualVTSlice[S ~[]E, E EqualVT[E]](s1, s2 S) bool {
+	return slices.EqualFunc(s1, s2, CompareEqualVT[E]())
+}
+
+// EncodeVarint encodes a uint64 into a varint-encoded byte slice and returns the offset of the encoded value.
+// The provided offset is the offset after the last byte of the encoded value.
+func EncodeVarint(dAtA []byte, offset int, v uint64) int {
+	offset -= SizeOfVarint(v)
+	base := offset
+	for v >= 1<<7 {
+		dAtA[offset] = uint8(v&0x7f | 0x80) //nolint:gosec
+		v >>= 7
+		offset++
+	}
+	dAtA[offset] = uint8(v)
+	return base
+}
+
+// AppendVarint appends v to b as a varint-encoded uint64.
+func AppendVarint(b []byte, v uint64) []byte {
+	switch {
+	case v < 1<<7:
+		b = append(b, byte(v))
+	case v < 1<<14:
+		b = append(b,
+			byte((v>>0)&0x7f|0x80),
+			byte(v>>7))
+	case v < 1<<21:
+		b = append(b,
+			byte((v>>0)&0x7f|0x80),
+			byte((v>>7)&0x7f|0x80),
+			byte(v>>14))
+	case v < 1<<28:
+		b = append(b,
+			byte((v>>0)&0x7f|0x80),
+			byte((v>>7)&0x7f|0x80),
+			byte((v>>14)&0x7f|0x80),
+			byte(v>>21))
+	case v < 1<<35:
+		b = append(b,
+			byte((v>>0)&0x7f|0x80),
+			byte((v>>7)&0x7f|0x80),
+			byte((v>>14)&0x7f|0x80),
+			byte((v>>21)&0x7f|0x80),
+			byte(v>>28))
+	case v < 1<<42:
+		b = append(b,
+			byte((v>>0)&0x7f|0x80),
+			byte((v>>7)&0x7f|0x80),
+			byte((v>>14)&0x7f|0x80),
+			byte((v>>21)&0x7f|0x80),
+			byte((v>>28)&0x7f|0x80),
+			byte(v>>35))
+	case v < 1<<49:
+		b = append(b,
+			byte((v>>0)&0x7f|0x80),
+			byte((v>>7)&0x7f|0x80),
+			byte((v>>14)&0x7f|0x80),
+			byte((v>>21)&0x7f|0x80),
+			byte((v>>28)&0x7f|0x80),
+			byte((v>>35)&0x7f|0x80),
+			byte(v>>42))
+	case v < 1<<56:
+		b = append(b,
+			byte((v>>0)&0x7f|0x80),
+			byte((v>>7)&0x7f|0x80),
+			byte((v>>14)&0x7f|0x80),
+			byte((v>>21)&0x7f|0x80),
+			byte((v>>28)&0x7f|0x80),
+			byte((v>>35)&0x7f|0x80),
+			byte((v>>42)&0x7f|0x80),
+			byte(v>>49))
+	case v < 1<<63:
+		b = append(b,
+			byte((v>>0)&0x7f|0x80),
+			byte((v>>7)&0x7f|0x80),
+			byte((v>>14)&0x7f|0x80),
+			byte((v>>21)&0x7f|0x80),
+			byte((v>>28)&0x7f|0x80),
+			byte((v>>35)&0x7f|0x80),
+			byte((v>>42)&0x7f|0x80),
+			byte((v>>49)&0x7f|0x80),
+			byte(v>>56))
+	default:
+		b = append(b,
+			byte((v>>0)&0x7f|0x80),
+			byte((v>>7)&0x7f|0x80),
+			byte((v>>14)&0x7f|0x80),
+			byte((v>>21)&0x7f|0x80),
+			byte((v>>28)&0x7f|0x80),
+			byte((v>>35)&0x7f|0x80),
+			byte((v>>42)&0x7f|0x80),
+			byte((v>>49)&0x7f|0x80),
+			byte((v>>56)&0x7f|0x80),
+			1)
+	}
+	return b
+}
+
+// ConsumeVarint parses b as a varint-encoded uint64, reporting its length.
+// This returns -1 upon any error, -1 for parse error and -2 for overflow.
+func ConsumeVarint(b []byte) (v uint64, n int) {
+	var y uint64
+	if len(b) <= 0 {
+		return 0, -1
+	}
+	v = uint64(b[0])
+	if v < 0x80 {
+		return v, 1
+	}
+	v -= 0x80
+
+	if len(b) <= 1 {
+		return 0, -1
+	}
+	y = uint64(b[1])
+	v += y << 7
+	if y < 0x80 {
+		return v, 2
+	}
+	v -= 0x80 << 7
+
+	if len(b) <= 2 {
+		return 0, -1
+	}
+	y = uint64(b[2])
+	v += y << 14
+	if y < 0x80 {
+		return v, 3
+	}
+	v -= 0x80 << 14
+
+	if len(b) <= 3 {
+		return 0, -1
+	}
+	y = uint64(b[3])
+	v += y << 21
+	if y < 0x80 {
+		return v, 4
+	}
+	v -= 0x80 << 21
+
+	if len(b) <= 4 {
+		return 0, -1
+	}
+	y = uint64(b[4])
+	v += y << 28
+	if y < 0x80 {
+		return v, 5
+	}
+	v -= 0x80 << 28
+
+	if len(b) <= 5 {
+		return 0, -1
+	}
+	y = uint64(b[5])
+	v += y << 35
+	if y < 0x80 {
+		return v, 6
+	}
+	v -= 0x80 << 35
+
+	if len(b) <= 6 {
+		return 0, -1
+	}
+	y = uint64(b[6])
+	v += y << 42
+	if y < 0x80 {
+		return v, 7
+	}
+	v -= 0x80 << 42
+
+	if len(b) <= 7 {
+		return 0, -1
+	}
+	y = uint64(b[7])
+	v += y << 49
+	if y < 0x80 {
+		return v, 8
+	}
+	v -= 0x80 << 49
+
+	if len(b) <= 8 {
+		return 0, -1
+	}
+	y = uint64(b[8])
+	v += y << 56
+	if y < 0x80 {
+		return v, 9
+	}
+	v -= 0x80 << 56
+
+	if len(b) <= 9 {
+		return 0, -1
+	}
+	y = uint64(b[9])
+	v += y << 63
+	if y < 2 {
+		return v, 10
+	}
+	return 0, -2
+}
+
+// SizeOfVarint returns the size of the varint-encoded value.
+func SizeOfVarint(x uint64) (n int) {
+	return (bits.Len64(x|1) + 6) / 7
+}
+
+// DecodeVarint decodes a varint at the given index, returning value, new index, and error.
+// Assumes idx is within bounds (0 <= idx <= len(b)); generated code maintains this invariant.
+func DecodeVarint(b []byte, idx int) (uint64, int, error) {
+	v, n := ConsumeVarint(b[idx:])
+	if n < 0 {
+		if n == -1 {
+			return 0, 0, io.ErrUnexpectedEOF
+		}
+		return 0, 0, ErrIntOverflow
+	}
+	return v, idx + n, nil
+}
+
+// DecodeVarintInt32 decodes a varint as int32.
+// Assumes idx is within bounds (0 <= idx <= len(b)); generated code maintains this invariant.
+func DecodeVarintInt32(b []byte, idx int) (int32, int, error) {
+	v, n := ConsumeVarint(b[idx:])
+	if n < 0 {
+		if n == -1 {
+			return 0, 0, io.ErrUnexpectedEOF
+		}
+		return 0, 0, ErrIntOverflow
+	}
+	return int32(v), idx + n, nil //nolint:gosec
+}
+
+// DecodeVarintInt64 decodes a varint as int64.
+// Assumes idx is within bounds (0 <= idx <= len(b)); generated code maintains this invariant.
+func DecodeVarintInt64(b []byte, idx int) (int64, int, error) {
+	v, n := ConsumeVarint(b[idx:])
+	if n < 0 {
+		if n == -1 {
+			return 0, 0, io.ErrUnexpectedEOF
+		}
+		return 0, 0, ErrIntOverflow
+	}
+	return int64(v), idx + n, nil //nolint:gosec
+}
+
+// DecodeVarintUint32 decodes a varint as uint32.
+// Assumes idx is within bounds (0 <= idx <= len(b)); generated code maintains this invariant.
+func DecodeVarintUint32(b []byte, idx int) (uint32, int, error) {
+	v, n := ConsumeVarint(b[idx:])
+	if n < 0 {
+		if n == -1 {
+			return 0, 0, io.ErrUnexpectedEOF
+		}
+		return 0, 0, ErrIntOverflow
+	}
+	return uint32(v), idx + n, nil //nolint:gosec
+}
+
+// DecodeVarintBool decodes a varint as bool.
+// Assumes idx is within bounds (0 <= idx <= len(b)); generated code maintains this invariant.
+func DecodeVarintBool(b []byte, idx int) (bool, int, error) {
+	v, n := ConsumeVarint(b[idx:])
+	if n < 0 {
+		if n == -1 {
+			return false, 0, io.ErrUnexpectedEOF
+		}
+		return false, 0, ErrIntOverflow
+	}
+	return v != 0, idx + n, nil
+}
+
+// DecodeSint32 decodes a zigzag-encoded sint32.
+// Assumes idx is within bounds (0 <= idx <= len(b)); generated code maintains this invariant.
+func DecodeSint32(b []byte, idx int) (int32, int, error) {
+	v, n := ConsumeVarint(b[idx:])
+	if n < 0 {
+		if n == -1 {
+			return 0, 0, io.ErrUnexpectedEOF
+		}
+		return 0, 0, ErrIntOverflow
+	}
+	return int32((uint32(v) >> 1) ^ uint32((int32(v&1)<<31)>>31)), idx + n, nil //nolint:gosec
+}
+
+// DecodeSint64 decodes a zigzag-encoded sint64.
+// Assumes idx is within bounds (0 <= idx <= len(b)); generated code maintains this invariant.
+func DecodeSint64(b []byte, idx int) (int64, int, error) {
+	v, n := ConsumeVarint(b[idx:])
+	if n < 0 {
+		if n == -1 {
+			return 0, 0, io.ErrUnexpectedEOF
+		}
+		return 0, 0, ErrIntOverflow
+	}
+	return int64((v >> 1) ^ uint64((int64(v&1)<<63)>>63)), idx + n, nil //nolint:gosec
+}
+
+// DecodeFixed32 decodes a fixed 32-bit value.
+// Assumes idx is within bounds (0 <= idx <= len(b)); generated code maintains this invariant.
+func DecodeFixed32(b []byte, idx int) (uint32, int, error) {
+	if idx+4 > len(b) {
+		return 0, 0, io.ErrUnexpectedEOF
+	}
+	v := uint32(b[idx]) | uint32(b[idx+1])<<8 | uint32(b[idx+2])<<16 | uint32(b[idx+3])<<24
+	return v, idx + 4, nil
+}
+
+// DecodeFixed64 decodes a fixed 64-bit value.
+// Assumes idx is within bounds (0 <= idx <= len(b)); generated code maintains this invariant.
+func DecodeFixed64(b []byte, idx int) (uint64, int, error) {
+	if idx+8 > len(b) {
+		return 0, 0, io.ErrUnexpectedEOF
+	}
+	v := uint64(b[idx]) | uint64(b[idx+1])<<8 | uint64(b[idx+2])<<16 | uint64(b[idx+3])<<24 |
+		uint64(b[idx+4])<<32 | uint64(b[idx+5])<<40 | uint64(b[idx+6])<<48 | uint64(b[idx+7])<<56
+	return v, idx + 8, nil
+}
+
+// DecodeFloat32 decodes a 32-bit float.
+// Assumes idx is within bounds (0 <= idx <= len(b)); generated code maintains this invariant.
+func DecodeFloat32(b []byte, idx int) (float32, int, error) {
+	v, idx, err := DecodeFixed32(b, idx)
+	if err != nil {
+		return 0, 0, err
+	}
+	return math.Float32frombits(v), idx, nil
+}
+
+// DecodeFloat64 decodes a 64-bit float.
+// Assumes idx is within bounds (0 <= idx <= len(b)); generated code maintains this invariant.
+func DecodeFloat64(b []byte, idx int) (float64, int, error) {
+	v, idx, err := DecodeFixed64(b, idx)
+	if err != nil {
+		return 0, 0, err
+	}
+	return math.Float64frombits(v), idx, nil
+}
+
+// DecodeBytes decodes a length-prefixed byte slice. If copy is false, returns a sub-slice.
+// Assumes idx is within bounds (0 <= idx <= len(b)); generated code maintains this invariant.
+func DecodeBytes(b []byte, idx int, cp bool) ([]byte, int, error) {
+	length, idx, err := DecodeVarint(b, idx)
+	if err != nil {
+		return nil, 0, err
+	}
+	l := int(length) //nolint:gosec
+	if l < 0 {
+		return nil, 0, ErrInvalidLength
+	}
+	end := idx + l
+	if end < idx || end > len(b) {
+		return nil, 0, io.ErrUnexpectedEOF
+	}
+	if cp {
+		out := make([]byte, l)
+		copy(out, b[idx:end])
+		return out, end, nil
+	}
+	return b[idx:end], end, nil
+}
+
+// DecodeString decodes a length-prefixed string (with copy).
+// Assumes idx is within bounds (0 <= idx <= len(b)); generated code maintains this invariant.
+func DecodeString(b []byte, idx int) (string, int, error) {
+	length, idx, err := DecodeVarint(b, idx)
+	if err != nil {
+		return "", 0, err
+	}
+	l := int(length) //nolint:gosec
+	if l < 0 {
+		return "", 0, ErrInvalidLength
+	}
+	end := idx + l
+	if end < idx || end > len(b) {
+		return "", 0, io.ErrUnexpectedEOF
+	}
+	return string(b[idx:end]), end, nil
+}
+
+// DecodeStringUnsafe decodes a length-prefixed string without copying.
+// The returned string shares memory with the input slice.
+// Assumes idx is within bounds (0 <= idx <= len(b)); generated code maintains this invariant.
+func DecodeStringUnsafe(b []byte, idx int) (string, int, error) {
+	length, idx, err := DecodeVarint(b, idx)
+	if err != nil {
+		return "", 0, err
+	}
+	l := int(length) //nolint:gosec
+	if l < 0 {
+		return "", 0, ErrInvalidLength
+	}
+	end := idx + l
+	if end < idx || end > len(b) {
+		return "", 0, io.ErrUnexpectedEOF
+	}
+	if l == 0 {
+		return "", end, nil
+	}
+	return unsafe.String(&b[idx], l), end, nil
+}
+
+// SizeOfZigzag returns the size of the zigzag-encoded value.
+func SizeOfZigzag(x uint64) (n int) {
+	return SizeOfVarint(uint64((x << 1) ^ uint64((int64(x) >> 63)))) //nolint
+}
+
+// Skip the first record of the byte slice and return the offset of the next record.
+func Skip(dAtA []byte) (n int, err error) {
+	l := len(dAtA)
+	iNdEx := 0
+	depth := 0
+	for iNdEx < l {
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return 0, ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return 0, io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= (uint64(b) & 0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		wireType := int(wire & 0x7) //nolint:gosec
+		switch wireType {
+		case 0:
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return 0, ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return 0, io.ErrUnexpectedEOF
+				}
+				iNdEx++
+				if dAtA[iNdEx-1] < 0x80 {
+					break
+				}
+			}
+		case 1:
+			iNdEx += 8
+		case 2:
+			var length int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return 0, ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return 0, io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				length |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if length < 0 {
+				return 0, ErrInvalidLength
+			}
+			iNdEx += length
+		case 3:
+			depth++
+		case 4:
+			if depth == 0 {
+				return 0, ErrUnexpectedEndOfGroup
+			}
+			depth--
+		case 5:
+			iNdEx += 4
+		default:
+			return 0, fmt.Errorf("proto: illegal wireType %d", wireType)
+		}
+		if iNdEx < 0 {
+			return 0, ErrInvalidLength
+		}
+		if depth == 0 {
+			return iNdEx, nil
+		}
+	}
+	return 0, io.ErrUnexpectedEOF
+}
diff --git a/vendor/github.com/checkpoint-restore/go-criu/v7/.golangci.yml b/vendor/github.com/checkpoint-restore/go-criu/v7/.golangci.yml
deleted file mode 100644
index a0d20be214..0000000000
--- a/vendor/github.com/checkpoint-restore/go-criu/v7/.golangci.yml
+++ /dev/null
@@ -1,22 +0,0 @@
-linters:
-  presets:
-    - bugs
-    - performance
-    - unused
-    - format
-  disable:
-    - musttag
-  enable:
-    - whitespace
-    - misspell
-    - dupl
-    - gosimple
-    - stylecheck
-
-linters-settings:
-  exhaustive:
-    default-signifies-exhaustive: true
-  gosec:
-    excludes:
-      # https://github.com/securego/gosec/issues/1185
-      - G115
diff --git a/vendor/github.com/checkpoint-restore/go-criu/v7/README.md b/vendor/github.com/checkpoint-restore/go-criu/v7/README.md
deleted file mode 100644
index 14a08eb7c0..0000000000
--- a/vendor/github.com/checkpoint-restore/go-criu/v7/README.md
+++ /dev/null
@@ -1,112 +0,0 @@
-<!-- markdownlint-configure-file { "no-hard-tabs": { "code_blocks": false } } -->
-# go-criu -- Go bindings for CRIU
-
-[![test](https://github.com/checkpoint-restore/go-criu/workflows/ci/badge.svg?branch=master)](https://github.com/checkpoint-restore/go-criu/actions?query=workflow%3Aci)
-[![verify](https://github.com/checkpoint-restore/go-criu/workflows/verify/badge.svg?branch=master)](https://github.com/checkpoint-restore/go-criu/actions?query=workflow%3Averify)
-[![Go Reference](https://pkg.go.dev/badge/github.com/checkpoint-restore/go-criu.svg)](https://pkg.go.dev/github.com/checkpoint-restore/go-criu)
-
-This repository provides Go bindings for [CRIU](https://criu.org/).
-The code is based on the Go-based PHaul implementation from the CRIU repository.
-For easier inclusion into other Go projects, the CRIU Go bindings have been
-moved to this repository.
-
-## CRIU
-
-The Go bindings provide an easy way to use the CRIU RPC calls from Go without
-the need to set up all the infrastructure to make the actual RPC connection to CRIU.
-
-The following example would print the version of CRIU:
-
-```go
-import (
-	"log"
-
-	"github.com/checkpoint-restore/go-criu/v7"
-)
-
-func main() {
-	c := criu.MakeCriu()
-	version, err := c.GetCriuVersion()
-	if err != nil {
-		log.Fatalln(err)
-	}
-	log.Println(version)
-}
-```
-
-or to just check if at least a certain CRIU version is installed:
-
-```go
-	c := criu.MakeCriu()
-	result, err := c.IsCriuAtLeast(31100)
-```
-
-## CRIT
-
-The `crit` package provides bindings to decode, encode, and manipulate
-CRIU image files natively within Go. It also provides a CLI tool similar
-to the original CRIT Python tool. To get started with this, see the docs
-at [CRIT (Go library)](https://criu.org/CRIT_%28Go_library%29).
-
-## Releases
-
-The first go-criu release was 3.11 based on CRIU 3.11. The initial plan
-was to follow CRIU so that go-criu would carry the same version number as
-CRIU.
-
-As go-criu is imported in other projects and as Go modules are expected
-to follow Semantic Versioning go-criu will also follow Semantic Versioning
-starting with the 4.0.0 release.
-
-The following table shows the relation between go-criu and criu versions:
-
-| Major version  | Latest release | CRIU version |
-| -------------- | -------------- | ------------ |
-| v7             | 7.2.0          | 3.19         |
-| v7             | 7.0.0          | 3.18         |
-| v6             | 6.3.0          | 3.17         |
-| v5             | 5.3.0          | 3.16         |
-| v5             | 5.0.0          | 3.15         |
-| v4             | 4.1.0          | 3.14         |
-
-## How to contribute
-
-While bug fixes can first be identified via an "issue", that is not required.
-It's ok to just open up a PR with the fix, but make sure you include the same
-information you would have included in an issue - like how to reproduce it.
-
-PRs for new features should include some background on what use cases the
-new code is trying to address. When possible and when it makes sense, try to
-break-up larger PRs into smaller ones - it's easier to review smaller
-code changes. But only if those smaller ones make sense as stand-alone PRs.
-
-Regardless of the type of PR, all PRs should include:
-
-* well documented code changes
-* additional testcases. Ideally, they should fail w/o your code change applied
-* documentation changes
-
-Squash your commits into logical pieces of work that might want to be reviewed
-separate from the rest of the PRs. Ideally, each commit should implement a
-single idea, and the PR branch should pass the tests at every commit. GitHub
-makes it easy to review the cumulative effect of many commits; so, when in
-doubt, use smaller commits.
-
-PRs that fix issues should include a reference like `Closes #XXXX` in the
-commit message so that github will automatically close the referenced issue
-when the PR is merged.
-
-Contributors must assert that they are in compliance with the [Developer
-Certificate of Origin 1.1](http://developercertificate.org/). This is achieved
-by adding a "Signed-off-by" line containing the contributor's name and e-mail
-to every commit message. Your signature certifies that you wrote the patch or
-otherwise have the right to pass it on as an open-source patch.
-
-## License and copyright
-
-Unless mentioned otherwise in a specific file's header, all code in
-this project is released under the Apache 2.0 license.
-
-The author of a change remains the copyright holder of their code
-(no copyright assignment). The list of authors and contributors can be
-retrieved from the git commit history and in some cases, the file headers.
diff --git a/vendor/github.com/checkpoint-restore/go-criu/v7/rpc/rpc.pb.go b/vendor/github.com/checkpoint-restore/go-criu/v7/rpc/rpc.pb.go
deleted file mode 100644
index 730496b04f..0000000000
--- a/vendor/github.com/checkpoint-restore/go-criu/v7/rpc/rpc.pb.go
+++ /dev/null
@@ -1,2390 +0,0 @@
-// SPDX-License-Identifier: MIT
-
-// Code generated by protoc-gen-go. DO NOT EDIT.
-// versions:
-// 	protoc-gen-go v1.30.0
-// 	protoc        v4.23.4
-// source: rpc/rpc.proto
-
-package rpc
-
-import (
-	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
-	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
-	reflect "reflect"
-	sync "sync"
-)
-
-const (
-	// Verify that this generated code is sufficiently up-to-date.
-	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
-	// Verify that runtime/protoimpl is sufficiently up-to-date.
-	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
-)
-
-type CriuCgMode int32
-
-const (
-	CriuCgMode_IGNORE  CriuCgMode = 0
-	CriuCgMode_CG_NONE CriuCgMode = 1
-	CriuCgMode_PROPS   CriuCgMode = 2
-	CriuCgMode_SOFT    CriuCgMode = 3
-	CriuCgMode_FULL    CriuCgMode = 4
-	CriuCgMode_STRICT  CriuCgMode = 5
-	CriuCgMode_DEFAULT CriuCgMode = 6
-)
-
-// Enum value maps for CriuCgMode.
-var (
-	CriuCgMode_name = map[int32]string{
-		0: "IGNORE",
-		1: "CG_NONE",
-		2: "PROPS",
-		3: "SOFT",
-		4: "FULL",
-		5: "STRICT",
-		6: "DEFAULT",
-	}
-	CriuCgMode_value = map[string]int32{
-		"IGNORE":  0,
-		"CG_NONE": 1,
-		"PROPS":   2,
-		"SOFT":    3,
-		"FULL":    4,
-		"STRICT":  5,
-		"DEFAULT": 6,
-	}
-)
-
-func (x CriuCgMode) Enum() *CriuCgMode {
-	p := new(CriuCgMode)
-	*p = x
-	return p
-}
-
-func (x CriuCgMode) String() string {
-	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
-}
-
-func (CriuCgMode) Descriptor() protoreflect.EnumDescriptor {
-	return file_rpc_rpc_proto_enumTypes[0].Descriptor()
-}
-
-func (CriuCgMode) Type() protoreflect.EnumType {
-	return &file_rpc_rpc_proto_enumTypes[0]
-}
-
-func (x CriuCgMode) Number() protoreflect.EnumNumber {
-	return protoreflect.EnumNumber(x)
-}
-
-// Deprecated: Do not use.
-func (x *CriuCgMode) UnmarshalJSON(b []byte) error {
-	num, err := protoimpl.X.UnmarshalJSONEnum(x.Descriptor(), b)
-	if err != nil {
-		return err
-	}
-	*x = CriuCgMode(num)
-	return nil
-}
-
-// Deprecated: Use CriuCgMode.Descriptor instead.
-func (CriuCgMode) EnumDescriptor() ([]byte, []int) {
-	return file_rpc_rpc_proto_rawDescGZIP(), []int{0}
-}
-
-type CriuNetworkLockMethod int32
-
-const (
-	CriuNetworkLockMethod_IPTABLES CriuNetworkLockMethod = 1
-	CriuNetworkLockMethod_NFTABLES CriuNetworkLockMethod = 2
-	CriuNetworkLockMethod_SKIP     CriuNetworkLockMethod = 3
-)
-
-// Enum value maps for CriuNetworkLockMethod.
-var (
-	CriuNetworkLockMethod_name = map[int32]string{
-		1: "IPTABLES",
-		2: "NFTABLES",
-		3: "SKIP",
-	}
-	CriuNetworkLockMethod_value = map[string]int32{
-		"IPTABLES": 1,
-		"NFTABLES": 2,
-		"SKIP":     3,
-	}
-)
-
-func (x CriuNetworkLockMethod) Enum() *CriuNetworkLockMethod {
-	p := new(CriuNetworkLockMethod)
-	*p = x
-	return p
-}
-
-func (x CriuNetworkLockMethod) String() string {
-	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
-}
-
-func (CriuNetworkLockMethod) Descriptor() protoreflect.EnumDescriptor {
-	return file_rpc_rpc_proto_enumTypes[1].Descriptor()
-}
-
-func (CriuNetworkLockMethod) Type() protoreflect.EnumType {
-	return &file_rpc_rpc_proto_enumTypes[1]
-}
-
-func (x CriuNetworkLockMethod) Number() protoreflect.EnumNumber {
-	return protoreflect.EnumNumber(x)
-}
-
-// Deprecated: Do not use.
-func (x *CriuNetworkLockMethod) UnmarshalJSON(b []byte) error {
-	num, err := protoimpl.X.UnmarshalJSONEnum(x.Descriptor(), b)
-	if err != nil {
-		return err
-	}
-	*x = CriuNetworkLockMethod(num)
-	return nil
-}
-
-// Deprecated: Use CriuNetworkLockMethod.Descriptor instead.
-func (CriuNetworkLockMethod) EnumDescriptor() ([]byte, []int) {
-	return file_rpc_rpc_proto_rawDescGZIP(), []int{1}
-}
-
-type CriuPreDumpMode int32
-
-const (
-	CriuPreDumpMode_SPLICE  CriuPreDumpMode = 1
-	CriuPreDumpMode_VM_READ CriuPreDumpMode = 2
-)
-
-// Enum value maps for CriuPreDumpMode.
-var (
-	CriuPreDumpMode_name = map[int32]string{
-		1: "SPLICE",
-		2: "VM_READ",
-	}
-	CriuPreDumpMode_value = map[string]int32{
-		"SPLICE":  1,
-		"VM_READ": 2,
-	}
-)
-
-func (x CriuPreDumpMode) Enum() *CriuPreDumpMode {
-	p := new(CriuPreDumpMode)
-	*p = x
-	return p
-}
-
-func (x CriuPreDumpMode) String() string {
-	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
-}
-
-func (CriuPreDumpMode) Descriptor() protoreflect.EnumDescriptor {
-	return file_rpc_rpc_proto_enumTypes[2].Descriptor()
-}
-
-func (CriuPreDumpMode) Type() protoreflect.EnumType {
-	return &file_rpc_rpc_proto_enumTypes[2]
-}
-
-func (x CriuPreDumpMode) Number() protoreflect.EnumNumber {
-	return protoreflect.EnumNumber(x)
-}
-
-// Deprecated: Do not use.
-func (x *CriuPreDumpMode) UnmarshalJSON(b []byte) error {
-	num, err := protoimpl.X.UnmarshalJSONEnum(x.Descriptor(), b)
-	if err != nil {
-		return err
-	}
-	*x = CriuPreDumpMode(num)
-	return nil
-}
-
-// Deprecated: Use CriuPreDumpMode.Descriptor instead.
-func (CriuPreDumpMode) EnumDescriptor() ([]byte, []int) {
-	return file_rpc_rpc_proto_rawDescGZIP(), []int{2}
-}
-
-type CriuReqType int32
-
-const (
-	CriuReqType_EMPTY            CriuReqType = 0
-	CriuReqType_DUMP             CriuReqType = 1
-	CriuReqType_RESTORE          CriuReqType = 2
-	CriuReqType_CHECK            CriuReqType = 3
-	CriuReqType_PRE_DUMP         CriuReqType = 4
-	CriuReqType_PAGE_SERVER      CriuReqType = 5
-	CriuReqType_NOTIFY           CriuReqType = 6
-	CriuReqType_CPUINFO_DUMP     CriuReqType = 7
-	CriuReqType_CPUINFO_CHECK    CriuReqType = 8
-	CriuReqType_FEATURE_CHECK    CriuReqType = 9
-	CriuReqType_VERSION          CriuReqType = 10
-	CriuReqType_WAIT_PID         CriuReqType = 11
-	CriuReqType_PAGE_SERVER_CHLD CriuReqType = 12
-	CriuReqType_SINGLE_PRE_DUMP  CriuReqType = 13
-)
-
-// Enum value maps for CriuReqType.
-var (
-	CriuReqType_name = map[int32]string{
-		0:  "EMPTY",
-		1:  "DUMP",
-		2:  "RESTORE",
-		3:  "CHECK",
-		4:  "PRE_DUMP",
-		5:  "PAGE_SERVER",
-		6:  "NOTIFY",
-		7:  "CPUINFO_DUMP",
-		8:  "CPUINFO_CHECK",
-		9:  "FEATURE_CHECK",
-		10: "VERSION",
-		11: "WAIT_PID",
-		12: "PAGE_SERVER_CHLD",
-		13: "SINGLE_PRE_DUMP",
-	}
-	CriuReqType_value = map[string]int32{
-		"EMPTY":            0,
-		"DUMP":             1,
-		"RESTORE":          2,
-		"CHECK":            3,
-		"PRE_DUMP":         4,
-		"PAGE_SERVER":      5,
-		"NOTIFY":           6,
-		"CPUINFO_DUMP":     7,
-		"CPUINFO_CHECK":    8,
-		"FEATURE_CHECK":    9,
-		"VERSION":          10,
-		"WAIT_PID":         11,
-		"PAGE_SERVER_CHLD": 12,
-		"SINGLE_PRE_DUMP":  13,
-	}
-)
-
-func (x CriuReqType) Enum() *CriuReqType {
-	p := new(CriuReqType)
-	*p = x
-	return p
-}
-
-func (x CriuReqType) String() string {
-	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
-}
-
-func (CriuReqType) Descriptor() protoreflect.EnumDescriptor {
-	return file_rpc_rpc_proto_enumTypes[3].Descriptor()
-}
-
-func (CriuReqType) Type() protoreflect.EnumType {
-	return &file_rpc_rpc_proto_enumTypes[3]
-}
-
-func (x CriuReqType) Number() protoreflect.EnumNumber {
-	return protoreflect.EnumNumber(x)
-}
-
-// Deprecated: Do not use.
-func (x *CriuReqType) UnmarshalJSON(b []byte) error {
-	num, err := protoimpl.X.UnmarshalJSONEnum(x.Descriptor(), b)
-	if err != nil {
-		return err
-	}
-	*x = CriuReqType(num)
-	return nil
-}
-
-// Deprecated: Use CriuReqType.Descriptor instead.
-func (CriuReqType) EnumDescriptor() ([]byte, []int) {
-	return file_rpc_rpc_proto_rawDescGZIP(), []int{3}
-}
-
-type CriuPageServerInfo struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	Address *string `protobuf:"bytes,1,opt,name=address" json:"address,omitempty"`
-	Port    *int32  `protobuf:"varint,2,opt,name=port" json:"port,omitempty"`
-	Pid     *int32  `protobuf:"varint,3,opt,name=pid" json:"pid,omitempty"`
-	Fd      *int32  `protobuf:"varint,4,opt,name=fd" json:"fd,omitempty"`
-}
-
-func (x *CriuPageServerInfo) Reset() {
-	*x = CriuPageServerInfo{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_rpc_rpc_proto_msgTypes[0]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *CriuPageServerInfo) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*CriuPageServerInfo) ProtoMessage() {}
-
-func (x *CriuPageServerInfo) ProtoReflect() protoreflect.Message {
-	mi := &file_rpc_rpc_proto_msgTypes[0]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use CriuPageServerInfo.ProtoReflect.Descriptor instead.
-func (*CriuPageServerInfo) Descriptor() ([]byte, []int) {
-	return file_rpc_rpc_proto_rawDescGZIP(), []int{0}
-}
-
-func (x *CriuPageServerInfo) GetAddress() string {
-	if x != nil && x.Address != nil {
-		return *x.Address
-	}
-	return ""
-}
-
-func (x *CriuPageServerInfo) GetPort() int32 {
-	if x != nil && x.Port != nil {
-		return *x.Port
-	}
-	return 0
-}
-
-func (x *CriuPageServerInfo) GetPid() int32 {
-	if x != nil && x.Pid != nil {
-		return *x.Pid
-	}
-	return 0
-}
-
-func (x *CriuPageServerInfo) GetFd() int32 {
-	if x != nil && x.Fd != nil {
-		return *x.Fd
-	}
-	return 0
-}
-
-type CriuVethPair struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	IfIn  *string `protobuf:"bytes,1,req,name=if_in,json=ifIn" json:"if_in,omitempty"`
-	IfOut *string `protobuf:"bytes,2,req,name=if_out,json=ifOut" json:"if_out,omitempty"`
-}
-
-func (x *CriuVethPair) Reset() {
-	*x = CriuVethPair{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_rpc_rpc_proto_msgTypes[1]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *CriuVethPair) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*CriuVethPair) ProtoMessage() {}
-
-func (x *CriuVethPair) ProtoReflect() protoreflect.Message {
-	mi := &file_rpc_rpc_proto_msgTypes[1]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use CriuVethPair.ProtoReflect.Descriptor instead.
-func (*CriuVethPair) Descriptor() ([]byte, []int) {
-	return file_rpc_rpc_proto_rawDescGZIP(), []int{1}
-}
-
-func (x *CriuVethPair) GetIfIn() string {
-	if x != nil && x.IfIn != nil {
-		return *x.IfIn
-	}
-	return ""
-}
-
-func (x *CriuVethPair) GetIfOut() string {
-	if x != nil && x.IfOut != nil {
-		return *x.IfOut
-	}
-	return ""
-}
-
-type ExtMountMap struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	Key *string `protobuf:"bytes,1,req,name=key" json:"key,omitempty"`
-	Val *string `protobuf:"bytes,2,req,name=val" json:"val,omitempty"`
-}
-
-func (x *ExtMountMap) Reset() {
-	*x = ExtMountMap{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_rpc_rpc_proto_msgTypes[2]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *ExtMountMap) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*ExtMountMap) ProtoMessage() {}
-
-func (x *ExtMountMap) ProtoReflect() protoreflect.Message {
-	mi := &file_rpc_rpc_proto_msgTypes[2]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use ExtMountMap.ProtoReflect.Descriptor instead.
-func (*ExtMountMap) Descriptor() ([]byte, []int) {
-	return file_rpc_rpc_proto_rawDescGZIP(), []int{2}
-}
-
-func (x *ExtMountMap) GetKey() string {
-	if x != nil && x.Key != nil {
-		return *x.Key
-	}
-	return ""
-}
-
-func (x *ExtMountMap) GetVal() string {
-	if x != nil && x.Val != nil {
-		return *x.Val
-	}
-	return ""
-}
-
-type JoinNamespace struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	Ns       *string `protobuf:"bytes,1,req,name=ns" json:"ns,omitempty"`
-	NsFile   *string `protobuf:"bytes,2,req,name=ns_file,json=nsFile" json:"ns_file,omitempty"`
-	ExtraOpt *string `protobuf:"bytes,3,opt,name=extra_opt,json=extraOpt" json:"extra_opt,omitempty"`
-}
-
-func (x *JoinNamespace) Reset() {
-	*x = JoinNamespace{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_rpc_rpc_proto_msgTypes[3]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *JoinNamespace) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*JoinNamespace) ProtoMessage() {}
-
-func (x *JoinNamespace) ProtoReflect() protoreflect.Message {
-	mi := &file_rpc_rpc_proto_msgTypes[3]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use JoinNamespace.ProtoReflect.Descriptor instead.
-func (*JoinNamespace) Descriptor() ([]byte, []int) {
-	return file_rpc_rpc_proto_rawDescGZIP(), []int{3}
-}
-
-func (x *JoinNamespace) GetNs() string {
-	if x != nil && x.Ns != nil {
-		return *x.Ns
-	}
-	return ""
-}
-
-func (x *JoinNamespace) GetNsFile() string {
-	if x != nil && x.NsFile != nil {
-		return *x.NsFile
-	}
-	return ""
-}
-
-func (x *JoinNamespace) GetExtraOpt() string {
-	if x != nil && x.ExtraOpt != nil {
-		return *x.ExtraOpt
-	}
-	return ""
-}
-
-type InheritFd struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	Key *string `protobuf:"bytes,1,req,name=key" json:"key,omitempty"`
-	Fd  *int32  `protobuf:"varint,2,req,name=fd" json:"fd,omitempty"`
-}
-
-func (x *InheritFd) Reset() {
-	*x = InheritFd{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_rpc_rpc_proto_msgTypes[4]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *InheritFd) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*InheritFd) ProtoMessage() {}
-
-func (x *InheritFd) ProtoReflect() protoreflect.Message {
-	mi := &file_rpc_rpc_proto_msgTypes[4]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use InheritFd.ProtoReflect.Descriptor instead.
-func (*InheritFd) Descriptor() ([]byte, []int) {
-	return file_rpc_rpc_proto_rawDescGZIP(), []int{4}
-}
-
-func (x *InheritFd) GetKey() string {
-	if x != nil && x.Key != nil {
-		return *x.Key
-	}
-	return ""
-}
-
-func (x *InheritFd) GetFd() int32 {
-	if x != nil && x.Fd != nil {
-		return *x.Fd
-	}
-	return 0
-}
-
-type CgroupRoot struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	Ctrl *string `protobuf:"bytes,1,opt,name=ctrl" json:"ctrl,omitempty"`
-	Path *string `protobuf:"bytes,2,req,name=path" json:"path,omitempty"`
-}
-
-func (x *CgroupRoot) Reset() {
-	*x = CgroupRoot{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_rpc_rpc_proto_msgTypes[5]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *CgroupRoot) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*CgroupRoot) ProtoMessage() {}
-
-func (x *CgroupRoot) ProtoReflect() protoreflect.Message {
-	mi := &file_rpc_rpc_proto_msgTypes[5]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use CgroupRoot.ProtoReflect.Descriptor instead.
-func (*CgroupRoot) Descriptor() ([]byte, []int) {
-	return file_rpc_rpc_proto_rawDescGZIP(), []int{5}
-}
-
-func (x *CgroupRoot) GetCtrl() string {
-	if x != nil && x.Ctrl != nil {
-		return *x.Ctrl
-	}
-	return ""
-}
-
-func (x *CgroupRoot) GetPath() string {
-	if x != nil && x.Path != nil {
-		return *x.Path
-	}
-	return ""
-}
-
-type UnixSk struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	Inode *uint32 `protobuf:"varint,1,req,name=inode" json:"inode,omitempty"`
-}
-
-func (x *UnixSk) Reset() {
-	*x = UnixSk{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_rpc_rpc_proto_msgTypes[6]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *UnixSk) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*UnixSk) ProtoMessage() {}
-
-func (x *UnixSk) ProtoReflect() protoreflect.Message {
-	mi := &file_rpc_rpc_proto_msgTypes[6]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use UnixSk.ProtoReflect.Descriptor instead.
-func (*UnixSk) Descriptor() ([]byte, []int) {
-	return file_rpc_rpc_proto_rawDescGZIP(), []int{6}
-}
-
-func (x *UnixSk) GetInode() uint32 {
-	if x != nil && x.Inode != nil {
-		return *x.Inode
-	}
-	return 0
-}
-
-type CriuOpts struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	ImagesDirFd          *int32                 `protobuf:"varint,1,req,name=images_dir_fd,json=imagesDirFd,def=-1" json:"images_dir_fd,omitempty"`
-	ImagesDir            *string                `protobuf:"bytes,68,opt,name=images_dir,json=imagesDir" json:"images_dir,omitempty"` // used only if images_dir_fd == -1
-	Pid                  *int32                 `protobuf:"varint,2,opt,name=pid" json:"pid,omitempty"`                              // if not set on dump, will dump requesting process
-	LeaveRunning         *bool                  `protobuf:"varint,3,opt,name=leave_running,json=leaveRunning" json:"leave_running,omitempty"`
-	ExtUnixSk            *bool                  `protobuf:"varint,4,opt,name=ext_unix_sk,json=extUnixSk" json:"ext_unix_sk,omitempty"`
-	TcpEstablished       *bool                  `protobuf:"varint,5,opt,name=tcp_established,json=tcpEstablished" json:"tcp_established,omitempty"`
-	EvasiveDevices       *bool                  `protobuf:"varint,6,opt,name=evasive_devices,json=evasiveDevices" json:"evasive_devices,omitempty"`
-	ShellJob             *bool                  `protobuf:"varint,7,opt,name=shell_job,json=shellJob" json:"shell_job,omitempty"`
-	FileLocks            *bool                  `protobuf:"varint,8,opt,name=file_locks,json=fileLocks" json:"file_locks,omitempty"`
-	LogLevel             *int32                 `protobuf:"varint,9,opt,name=log_level,json=logLevel,def=2" json:"log_level,omitempty"`
-	LogFile              *string                `protobuf:"bytes,10,opt,name=log_file,json=logFile" json:"log_file,omitempty"` // No subdirs are allowed. Consider using work-dir
-	Ps                   *CriuPageServerInfo    `protobuf:"bytes,11,opt,name=ps" json:"ps,omitempty"`
-	NotifyScripts        *bool                  `protobuf:"varint,12,opt,name=notify_scripts,json=notifyScripts" json:"notify_scripts,omitempty"`
-	Root                 *string                `protobuf:"bytes,13,opt,name=root" json:"root,omitempty"`
-	ParentImg            *string                `protobuf:"bytes,14,opt,name=parent_img,json=parentImg" json:"parent_img,omitempty"`
-	TrackMem             *bool                  `protobuf:"varint,15,opt,name=track_mem,json=trackMem" json:"track_mem,omitempty"`
-	AutoDedup            *bool                  `protobuf:"varint,16,opt,name=auto_dedup,json=autoDedup" json:"auto_dedup,omitempty"`
-	WorkDirFd            *int32                 `protobuf:"varint,17,opt,name=work_dir_fd,json=workDirFd" json:"work_dir_fd,omitempty"`
-	LinkRemap            *bool                  `protobuf:"varint,18,opt,name=link_remap,json=linkRemap" json:"link_remap,omitempty"`
-	Veths                []*CriuVethPair        `protobuf:"bytes,19,rep,name=veths" json:"veths,omitempty"` // DEPRECATED, use external instead
-	CpuCap               *uint32                `protobuf:"varint,20,opt,name=cpu_cap,json=cpuCap,def=4294967295" json:"cpu_cap,omitempty"`
-	ForceIrmap           *bool                  `protobuf:"varint,21,opt,name=force_irmap,json=forceIrmap" json:"force_irmap,omitempty"`
-	ExecCmd              []string               `protobuf:"bytes,22,rep,name=exec_cmd,json=execCmd" json:"exec_cmd,omitempty"`
-	ExtMnt               []*ExtMountMap         `protobuf:"bytes,23,rep,name=ext_mnt,json=extMnt" json:"ext_mnt,omitempty"`                       // DEPRECATED, use external instead
-	ManageCgroups        *bool                  `protobuf:"varint,24,opt,name=manage_cgroups,json=manageCgroups" json:"manage_cgroups,omitempty"` // backward compatibility
-	CgRoot               []*CgroupRoot          `protobuf:"bytes,25,rep,name=cg_root,json=cgRoot" json:"cg_root,omitempty"`
-	RstSibling           *bool                  `protobuf:"varint,26,opt,name=rst_sibling,json=rstSibling" json:"rst_sibling,omitempty"` // swrk only
-	InheritFd            []*InheritFd           `protobuf:"bytes,27,rep,name=inherit_fd,json=inheritFd" json:"inherit_fd,omitempty"`     // swrk only
-	AutoExtMnt           *bool                  `protobuf:"varint,28,opt,name=auto_ext_mnt,json=autoExtMnt" json:"auto_ext_mnt,omitempty"`
-	ExtSharing           *bool                  `protobuf:"varint,29,opt,name=ext_sharing,json=extSharing" json:"ext_sharing,omitempty"`
-	ExtMasters           *bool                  `protobuf:"varint,30,opt,name=ext_masters,json=extMasters" json:"ext_masters,omitempty"`
-	SkipMnt              []string               `protobuf:"bytes,31,rep,name=skip_mnt,json=skipMnt" json:"skip_mnt,omitempty"`
-	EnableFs             []string               `protobuf:"bytes,32,rep,name=enable_fs,json=enableFs" json:"enable_fs,omitempty"`
-	UnixSkIno            []*UnixSk              `protobuf:"bytes,33,rep,name=unix_sk_ino,json=unixSkIno" json:"unix_sk_ino,omitempty"` // DEPRECATED, use external instead
-	ManageCgroupsMode    *CriuCgMode            `protobuf:"varint,34,opt,name=manage_cgroups_mode,json=manageCgroupsMode,enum=CriuCgMode" json:"manage_cgroups_mode,omitempty"`
-	GhostLimit           *uint32                `protobuf:"varint,35,opt,name=ghost_limit,json=ghostLimit,def=1048576" json:"ghost_limit,omitempty"`
-	IrmapScanPaths       []string               `protobuf:"bytes,36,rep,name=irmap_scan_paths,json=irmapScanPaths" json:"irmap_scan_paths,omitempty"`
-	External             []string               `protobuf:"bytes,37,rep,name=external" json:"external,omitempty"`
-	EmptyNs              *uint32                `protobuf:"varint,38,opt,name=empty_ns,json=emptyNs" json:"empty_ns,omitempty"`
-	JoinNs               []*JoinNamespace       `protobuf:"bytes,39,rep,name=join_ns,json=joinNs" json:"join_ns,omitempty"`
-	CgroupProps          *string                `protobuf:"bytes,41,opt,name=cgroup_props,json=cgroupProps" json:"cgroup_props,omitempty"`
-	CgroupPropsFile      *string                `protobuf:"bytes,42,opt,name=cgroup_props_file,json=cgroupPropsFile" json:"cgroup_props_file,omitempty"`
-	CgroupDumpController []string               `protobuf:"bytes,43,rep,name=cgroup_dump_controller,json=cgroupDumpController" json:"cgroup_dump_controller,omitempty"`
-	FreezeCgroup         *string                `protobuf:"bytes,44,opt,name=freeze_cgroup,json=freezeCgroup" json:"freeze_cgroup,omitempty"`
-	Timeout              *uint32                `protobuf:"varint,45,opt,name=timeout" json:"timeout,omitempty"`
-	TcpSkipInFlight      *bool                  `protobuf:"varint,46,opt,name=tcp_skip_in_flight,json=tcpSkipInFlight" json:"tcp_skip_in_flight,omitempty"`
-	WeakSysctls          *bool                  `protobuf:"varint,47,opt,name=weak_sysctls,json=weakSysctls" json:"weak_sysctls,omitempty"`
-	LazyPages            *bool                  `protobuf:"varint,48,opt,name=lazy_pages,json=lazyPages" json:"lazy_pages,omitempty"`
-	StatusFd             *int32                 `protobuf:"varint,49,opt,name=status_fd,json=statusFd" json:"status_fd,omitempty"`
-	OrphanPtsMaster      *bool                  `protobuf:"varint,50,opt,name=orphan_pts_master,json=orphanPtsMaster" json:"orphan_pts_master,omitempty"`
-	ConfigFile           *string                `protobuf:"bytes,51,opt,name=config_file,json=configFile" json:"config_file,omitempty"`
-	TcpClose             *bool                  `protobuf:"varint,52,opt,name=tcp_close,json=tcpClose" json:"tcp_close,omitempty"`
-	LsmProfile           *string                `protobuf:"bytes,53,opt,name=lsm_profile,json=lsmProfile" json:"lsm_profile,omitempty"`
-	TlsCacert            *string                `protobuf:"bytes,54,opt,name=tls_cacert,json=tlsCacert" json:"tls_cacert,omitempty"`
-	TlsCacrl             *string                `protobuf:"bytes,55,opt,name=tls_cacrl,json=tlsCacrl" json:"tls_cacrl,omitempty"`
-	TlsCert              *string                `protobuf:"bytes,56,opt,name=tls_cert,json=tlsCert" json:"tls_cert,omitempty"`
-	TlsKey               *string                `protobuf:"bytes,57,opt,name=tls_key,json=tlsKey" json:"tls_key,omitempty"`
-	Tls                  *bool                  `protobuf:"varint,58,opt,name=tls" json:"tls,omitempty"`
-	TlsNoCnVerify        *bool                  `protobuf:"varint,59,opt,name=tls_no_cn_verify,json=tlsNoCnVerify" json:"tls_no_cn_verify,omitempty"`
-	CgroupYard           *string                `protobuf:"bytes,60,opt,name=cgroup_yard,json=cgroupYard" json:"cgroup_yard,omitempty"`
-	PreDumpMode          *CriuPreDumpMode       `protobuf:"varint,61,opt,name=pre_dump_mode,json=preDumpMode,enum=CriuPreDumpMode,def=1" json:"pre_dump_mode,omitempty"`
-	PidfdStoreSk         *int32                 `protobuf:"varint,62,opt,name=pidfd_store_sk,json=pidfdStoreSk" json:"pidfd_store_sk,omitempty"`
-	LsmMountContext      *string                `protobuf:"bytes,63,opt,name=lsm_mount_context,json=lsmMountContext" json:"lsm_mount_context,omitempty"`
-	NetworkLock          *CriuNetworkLockMethod `protobuf:"varint,64,opt,name=network_lock,json=networkLock,enum=CriuNetworkLockMethod,def=1" json:"network_lock,omitempty"`
-	MntnsCompatMode      *bool                  `protobuf:"varint,65,opt,name=mntns_compat_mode,json=mntnsCompatMode" json:"mntns_compat_mode,omitempty"`
-	SkipFileRwxCheck     *bool                  `protobuf:"varint,66,opt,name=skip_file_rwx_check,json=skipFileRwxCheck" json:"skip_file_rwx_check,omitempty"`
-	Unprivileged         *bool                  `protobuf:"varint,67,opt,name=unprivileged" json:"unprivileged,omitempty"`
-	LeaveStopped         *bool                  `protobuf:"varint,69,opt,name=leave_stopped,json=leaveStopped" json:"leave_stopped,omitempty"`
-	DisplayStats         *bool                  `protobuf:"varint,70,opt,name=display_stats,json=displayStats" json:"display_stats,omitempty"`
-	LogToStderr          *bool                  `protobuf:"varint,71,opt,name=log_to_stderr,json=logToStderr" json:"log_to_stderr,omitempty"` //	optional bool			check_mounts		= 128;
-}
-
-// Default values for CriuOpts fields.
-const (
-	Default_CriuOpts_ImagesDirFd = int32(-1)
-	Default_CriuOpts_LogLevel    = int32(2)
-	Default_CriuOpts_CpuCap      = uint32(4294967295)
-	Default_CriuOpts_GhostLimit  = uint32(1048576)
-	Default_CriuOpts_PreDumpMode = CriuPreDumpMode_SPLICE
-	Default_CriuOpts_NetworkLock = CriuNetworkLockMethod_IPTABLES
-)
-
-func (x *CriuOpts) Reset() {
-	*x = CriuOpts{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_rpc_rpc_proto_msgTypes[7]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *CriuOpts) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*CriuOpts) ProtoMessage() {}
-
-func (x *CriuOpts) ProtoReflect() protoreflect.Message {
-	mi := &file_rpc_rpc_proto_msgTypes[7]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use CriuOpts.ProtoReflect.Descriptor instead.
-func (*CriuOpts) Descriptor() ([]byte, []int) {
-	return file_rpc_rpc_proto_rawDescGZIP(), []int{7}
-}
-
-func (x *CriuOpts) GetImagesDirFd() int32 {
-	if x != nil && x.ImagesDirFd != nil {
-		return *x.ImagesDirFd
-	}
-	return Default_CriuOpts_ImagesDirFd
-}
-
-func (x *CriuOpts) GetImagesDir() string {
-	if x != nil && x.ImagesDir != nil {
-		return *x.ImagesDir
-	}
-	return ""
-}
-
-func (x *CriuOpts) GetPid() int32 {
-	if x != nil && x.Pid != nil {
-		return *x.Pid
-	}
-	return 0
-}
-
-func (x *CriuOpts) GetLeaveRunning() bool {
-	if x != nil && x.LeaveRunning != nil {
-		return *x.LeaveRunning
-	}
-	return false
-}
-
-func (x *CriuOpts) GetExtUnixSk() bool {
-	if x != nil && x.ExtUnixSk != nil {
-		return *x.ExtUnixSk
-	}
-	return false
-}
-
-func (x *CriuOpts) GetTcpEstablished() bool {
-	if x != nil && x.TcpEstablished != nil {
-		return *x.TcpEstablished
-	}
-	return false
-}
-
-func (x *CriuOpts) GetEvasiveDevices() bool {
-	if x != nil && x.EvasiveDevices != nil {
-		return *x.EvasiveDevices
-	}
-	return false
-}
-
-func (x *CriuOpts) GetShellJob() bool {
-	if x != nil && x.ShellJob != nil {
-		return *x.ShellJob
-	}
-	return false
-}
-
-func (x *CriuOpts) GetFileLocks() bool {
-	if x != nil && x.FileLocks != nil {
-		return *x.FileLocks
-	}
-	return false
-}
-
-func (x *CriuOpts) GetLogLevel() int32 {
-	if x != nil && x.LogLevel != nil {
-		return *x.LogLevel
-	}
-	return Default_CriuOpts_LogLevel
-}
-
-func (x *CriuOpts) GetLogFile() string {
-	if x != nil && x.LogFile != nil {
-		return *x.LogFile
-	}
-	return ""
-}
-
-func (x *CriuOpts) GetPs() *CriuPageServerInfo {
-	if x != nil {
-		return x.Ps
-	}
-	return nil
-}
-
-func (x *CriuOpts) GetNotifyScripts() bool {
-	if x != nil && x.NotifyScripts != nil {
-		return *x.NotifyScripts
-	}
-	return false
-}
-
-func (x *CriuOpts) GetRoot() string {
-	if x != nil && x.Root != nil {
-		return *x.Root
-	}
-	return ""
-}
-
-func (x *CriuOpts) GetParentImg() string {
-	if x != nil && x.ParentImg != nil {
-		return *x.ParentImg
-	}
-	return ""
-}
-
-func (x *CriuOpts) GetTrackMem() bool {
-	if x != nil && x.TrackMem != nil {
-		return *x.TrackMem
-	}
-	return false
-}
-
-func (x *CriuOpts) GetAutoDedup() bool {
-	if x != nil && x.AutoDedup != nil {
-		return *x.AutoDedup
-	}
-	return false
-}
-
-func (x *CriuOpts) GetWorkDirFd() int32 {
-	if x != nil && x.WorkDirFd != nil {
-		return *x.WorkDirFd
-	}
-	return 0
-}
-
-func (x *CriuOpts) GetLinkRemap() bool {
-	if x != nil && x.LinkRemap != nil {
-		return *x.LinkRemap
-	}
-	return false
-}
-
-func (x *CriuOpts) GetVeths() []*CriuVethPair {
-	if x != nil {
-		return x.Veths
-	}
-	return nil
-}
-
-func (x *CriuOpts) GetCpuCap() uint32 {
-	if x != nil && x.CpuCap != nil {
-		return *x.CpuCap
-	}
-	return Default_CriuOpts_CpuCap
-}
-
-func (x *CriuOpts) GetForceIrmap() bool {
-	if x != nil && x.ForceIrmap != nil {
-		return *x.ForceIrmap
-	}
-	return false
-}
-
-func (x *CriuOpts) GetExecCmd() []string {
-	if x != nil {
-		return x.ExecCmd
-	}
-	return nil
-}
-
-func (x *CriuOpts) GetExtMnt() []*ExtMountMap {
-	if x != nil {
-		return x.ExtMnt
-	}
-	return nil
-}
-
-func (x *CriuOpts) GetManageCgroups() bool {
-	if x != nil && x.ManageCgroups != nil {
-		return *x.ManageCgroups
-	}
-	return false
-}
-
-func (x *CriuOpts) GetCgRoot() []*CgroupRoot {
-	if x != nil {
-		return x.CgRoot
-	}
-	return nil
-}
-
-func (x *CriuOpts) GetRstSibling() bool {
-	if x != nil && x.RstSibling != nil {
-		return *x.RstSibling
-	}
-	return false
-}
-
-func (x *CriuOpts) GetInheritFd() []*InheritFd {
-	if x != nil {
-		return x.InheritFd
-	}
-	return nil
-}
-
-func (x *CriuOpts) GetAutoExtMnt() bool {
-	if x != nil && x.AutoExtMnt != nil {
-		return *x.AutoExtMnt
-	}
-	return false
-}
-
-func (x *CriuOpts) GetExtSharing() bool {
-	if x != nil && x.ExtSharing != nil {
-		return *x.ExtSharing
-	}
-	return false
-}
-
-func (x *CriuOpts) GetExtMasters() bool {
-	if x != nil && x.ExtMasters != nil {
-		return *x.ExtMasters
-	}
-	return false
-}
-
-func (x *CriuOpts) GetSkipMnt() []string {
-	if x != nil {
-		return x.SkipMnt
-	}
-	return nil
-}
-
-func (x *CriuOpts) GetEnableFs() []string {
-	if x != nil {
-		return x.EnableFs
-	}
-	return nil
-}
-
-func (x *CriuOpts) GetUnixSkIno() []*UnixSk {
-	if x != nil {
-		return x.UnixSkIno
-	}
-	return nil
-}
-
-func (x *CriuOpts) GetManageCgroupsMode() CriuCgMode {
-	if x != nil && x.ManageCgroupsMode != nil {
-		return *x.ManageCgroupsMode
-	}
-	return CriuCgMode_IGNORE
-}
-
-func (x *CriuOpts) GetGhostLimit() uint32 {
-	if x != nil && x.GhostLimit != nil {
-		return *x.GhostLimit
-	}
-	return Default_CriuOpts_GhostLimit
-}
-
-func (x *CriuOpts) GetIrmapScanPaths() []string {
-	if x != nil {
-		return x.IrmapScanPaths
-	}
-	return nil
-}
-
-func (x *CriuOpts) GetExternal() []string {
-	if x != nil {
-		return x.External
-	}
-	return nil
-}
-
-func (x *CriuOpts) GetEmptyNs() uint32 {
-	if x != nil && x.EmptyNs != nil {
-		return *x.EmptyNs
-	}
-	return 0
-}
-
-func (x *CriuOpts) GetJoinNs() []*JoinNamespace {
-	if x != nil {
-		return x.JoinNs
-	}
-	return nil
-}
-
-func (x *CriuOpts) GetCgroupProps() string {
-	if x != nil && x.CgroupProps != nil {
-		return *x.CgroupProps
-	}
-	return ""
-}
-
-func (x *CriuOpts) GetCgroupPropsFile() string {
-	if x != nil && x.CgroupPropsFile != nil {
-		return *x.CgroupPropsFile
-	}
-	return ""
-}
-
-func (x *CriuOpts) GetCgroupDumpController() []string {
-	if x != nil {
-		return x.CgroupDumpController
-	}
-	return nil
-}
-
-func (x *CriuOpts) GetFreezeCgroup() string {
-	if x != nil && x.FreezeCgroup != nil {
-		return *x.FreezeCgroup
-	}
-	return ""
-}
-
-func (x *CriuOpts) GetTimeout() uint32 {
-	if x != nil && x.Timeout != nil {
-		return *x.Timeout
-	}
-	return 0
-}
-
-func (x *CriuOpts) GetTcpSkipInFlight() bool {
-	if x != nil && x.TcpSkipInFlight != nil {
-		return *x.TcpSkipInFlight
-	}
-	return false
-}
-
-func (x *CriuOpts) GetWeakSysctls() bool {
-	if x != nil && x.WeakSysctls != nil {
-		return *x.WeakSysctls
-	}
-	return false
-}
-
-func (x *CriuOpts) GetLazyPages() bool {
-	if x != nil && x.LazyPages != nil {
-		return *x.LazyPages
-	}
-	return false
-}
-
-func (x *CriuOpts) GetStatusFd() int32 {
-	if x != nil && x.StatusFd != nil {
-		return *x.StatusFd
-	}
-	return 0
-}
-
-func (x *CriuOpts) GetOrphanPtsMaster() bool {
-	if x != nil && x.OrphanPtsMaster != nil {
-		return *x.OrphanPtsMaster
-	}
-	return false
-}
-
-func (x *CriuOpts) GetConfigFile() string {
-	if x != nil && x.ConfigFile != nil {
-		return *x.ConfigFile
-	}
-	return ""
-}
-
-func (x *CriuOpts) GetTcpClose() bool {
-	if x != nil && x.TcpClose != nil {
-		return *x.TcpClose
-	}
-	return false
-}
-
-func (x *CriuOpts) GetLsmProfile() string {
-	if x != nil && x.LsmProfile != nil {
-		return *x.LsmProfile
-	}
-	return ""
-}
-
-func (x *CriuOpts) GetTlsCacert() string {
-	if x != nil && x.TlsCacert != nil {
-		return *x.TlsCacert
-	}
-	return ""
-}
-
-func (x *CriuOpts) GetTlsCacrl() string {
-	if x != nil && x.TlsCacrl != nil {
-		return *x.TlsCacrl
-	}
-	return ""
-}
-
-func (x *CriuOpts) GetTlsCert() string {
-	if x != nil && x.TlsCert != nil {
-		return *x.TlsCert
-	}
-	return ""
-}
-
-func (x *CriuOpts) GetTlsKey() string {
-	if x != nil && x.TlsKey != nil {
-		return *x.TlsKey
-	}
-	return ""
-}
-
-func (x *CriuOpts) GetTls() bool {
-	if x != nil && x.Tls != nil {
-		return *x.Tls
-	}
-	return false
-}
-
-func (x *CriuOpts) GetTlsNoCnVerify() bool {
-	if x != nil && x.TlsNoCnVerify != nil {
-		return *x.TlsNoCnVerify
-	}
-	return false
-}
-
-func (x *CriuOpts) GetCgroupYard() string {
-	if x != nil && x.CgroupYard != nil {
-		return *x.CgroupYard
-	}
-	return ""
-}
-
-func (x *CriuOpts) GetPreDumpMode() CriuPreDumpMode {
-	if x != nil && x.PreDumpMode != nil {
-		return *x.PreDumpMode
-	}
-	return Default_CriuOpts_PreDumpMode
-}
-
-func (x *CriuOpts) GetPidfdStoreSk() int32 {
-	if x != nil && x.PidfdStoreSk != nil {
-		return *x.PidfdStoreSk
-	}
-	return 0
-}
-
-func (x *CriuOpts) GetLsmMountContext() string {
-	if x != nil && x.LsmMountContext != nil {
-		return *x.LsmMountContext
-	}
-	return ""
-}
-
-func (x *CriuOpts) GetNetworkLock() CriuNetworkLockMethod {
-	if x != nil && x.NetworkLock != nil {
-		return *x.NetworkLock
-	}
-	return Default_CriuOpts_NetworkLock
-}
-
-func (x *CriuOpts) GetMntnsCompatMode() bool {
-	if x != nil && x.MntnsCompatMode != nil {
-		return *x.MntnsCompatMode
-	}
-	return false
-}
-
-func (x *CriuOpts) GetSkipFileRwxCheck() bool {
-	if x != nil && x.SkipFileRwxCheck != nil {
-		return *x.SkipFileRwxCheck
-	}
-	return false
-}
-
-func (x *CriuOpts) GetUnprivileged() bool {
-	if x != nil && x.Unprivileged != nil {
-		return *x.Unprivileged
-	}
-	return false
-}
-
-func (x *CriuOpts) GetLeaveStopped() bool {
-	if x != nil && x.LeaveStopped != nil {
-		return *x.LeaveStopped
-	}
-	return false
-}
-
-func (x *CriuOpts) GetDisplayStats() bool {
-	if x != nil && x.DisplayStats != nil {
-		return *x.DisplayStats
-	}
-	return false
-}
-
-func (x *CriuOpts) GetLogToStderr() bool {
-	if x != nil && x.LogToStderr != nil {
-		return *x.LogToStderr
-	}
-	return false
-}
-
-type CriuDumpResp struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	Restored *bool `protobuf:"varint,1,opt,name=restored" json:"restored,omitempty"`
-}
-
-func (x *CriuDumpResp) Reset() {
-	*x = CriuDumpResp{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_rpc_rpc_proto_msgTypes[8]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *CriuDumpResp) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*CriuDumpResp) ProtoMessage() {}
-
-func (x *CriuDumpResp) ProtoReflect() protoreflect.Message {
-	mi := &file_rpc_rpc_proto_msgTypes[8]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use CriuDumpResp.ProtoReflect.Descriptor instead.
-func (*CriuDumpResp) Descriptor() ([]byte, []int) {
-	return file_rpc_rpc_proto_rawDescGZIP(), []int{8}
-}
-
-func (x *CriuDumpResp) GetRestored() bool {
-	if x != nil && x.Restored != nil {
-		return *x.Restored
-	}
-	return false
-}
-
-type CriuRestoreResp struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	Pid *int32 `protobuf:"varint,1,req,name=pid" json:"pid,omitempty"`
-}
-
-func (x *CriuRestoreResp) Reset() {
-	*x = CriuRestoreResp{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_rpc_rpc_proto_msgTypes[9]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *CriuRestoreResp) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*CriuRestoreResp) ProtoMessage() {}
-
-func (x *CriuRestoreResp) ProtoReflect() protoreflect.Message {
-	mi := &file_rpc_rpc_proto_msgTypes[9]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use CriuRestoreResp.ProtoReflect.Descriptor instead.
-func (*CriuRestoreResp) Descriptor() ([]byte, []int) {
-	return file_rpc_rpc_proto_rawDescGZIP(), []int{9}
-}
-
-func (x *CriuRestoreResp) GetPid() int32 {
-	if x != nil && x.Pid != nil {
-		return *x.Pid
-	}
-	return 0
-}
-
-type CriuNotify struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	Script *string `protobuf:"bytes,1,opt,name=script" json:"script,omitempty"`
-	Pid    *int32  `protobuf:"varint,2,opt,name=pid" json:"pid,omitempty"`
-}
-
-func (x *CriuNotify) Reset() {
-	*x = CriuNotify{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_rpc_rpc_proto_msgTypes[10]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *CriuNotify) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*CriuNotify) ProtoMessage() {}
-
-func (x *CriuNotify) ProtoReflect() protoreflect.Message {
-	mi := &file_rpc_rpc_proto_msgTypes[10]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use CriuNotify.ProtoReflect.Descriptor instead.
-func (*CriuNotify) Descriptor() ([]byte, []int) {
-	return file_rpc_rpc_proto_rawDescGZIP(), []int{10}
-}
-
-func (x *CriuNotify) GetScript() string {
-	if x != nil && x.Script != nil {
-		return *x.Script
-	}
-	return ""
-}
-
-func (x *CriuNotify) GetPid() int32 {
-	if x != nil && x.Pid != nil {
-		return *x.Pid
-	}
-	return 0
-}
-
-// List of features which can queried via
-// CRIU_REQ_TYPE__FEATURE_CHECK
-type CriuFeatures struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	MemTrack   *bool `protobuf:"varint,1,opt,name=mem_track,json=memTrack" json:"mem_track,omitempty"`
-	LazyPages  *bool `protobuf:"varint,2,opt,name=lazy_pages,json=lazyPages" json:"lazy_pages,omitempty"`
-	PidfdStore *bool `protobuf:"varint,3,opt,name=pidfd_store,json=pidfdStore" json:"pidfd_store,omitempty"`
-}
-
-func (x *CriuFeatures) Reset() {
-	*x = CriuFeatures{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_rpc_rpc_proto_msgTypes[11]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *CriuFeatures) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*CriuFeatures) ProtoMessage() {}
-
-func (x *CriuFeatures) ProtoReflect() protoreflect.Message {
-	mi := &file_rpc_rpc_proto_msgTypes[11]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use CriuFeatures.ProtoReflect.Descriptor instead.
-func (*CriuFeatures) Descriptor() ([]byte, []int) {
-	return file_rpc_rpc_proto_rawDescGZIP(), []int{11}
-}
-
-func (x *CriuFeatures) GetMemTrack() bool {
-	if x != nil && x.MemTrack != nil {
-		return *x.MemTrack
-	}
-	return false
-}
-
-func (x *CriuFeatures) GetLazyPages() bool {
-	if x != nil && x.LazyPages != nil {
-		return *x.LazyPages
-	}
-	return false
-}
-
-func (x *CriuFeatures) GetPidfdStore() bool {
-	if x != nil && x.PidfdStore != nil {
-		return *x.PidfdStore
-	}
-	return false
-}
-
-type CriuReq struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	Type          *CriuReqType `protobuf:"varint,1,req,name=type,enum=CriuReqType" json:"type,omitempty"`
-	Opts          *CriuOpts    `protobuf:"bytes,2,opt,name=opts" json:"opts,omitempty"`
-	NotifySuccess *bool        `protobuf:"varint,3,opt,name=notify_success,json=notifySuccess" json:"notify_success,omitempty"`
-	// When set service won't close the connection but
-	// will wait for more req-s to appear. Works not
-	// for all request types.
-	KeepOpen *bool `protobuf:"varint,4,opt,name=keep_open,json=keepOpen" json:"keep_open,omitempty"`
-	// 'features' can be used to query which features
-	// are supported by the installed criu/kernel
-	// via RPC.
-	Features *CriuFeatures `protobuf:"bytes,5,opt,name=features" json:"features,omitempty"`
-	// 'pid' is used for WAIT_PID
-	Pid *uint32 `protobuf:"varint,6,opt,name=pid" json:"pid,omitempty"`
-}
-
-func (x *CriuReq) Reset() {
-	*x = CriuReq{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_rpc_rpc_proto_msgTypes[12]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *CriuReq) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*CriuReq) ProtoMessage() {}
-
-func (x *CriuReq) ProtoReflect() protoreflect.Message {
-	mi := &file_rpc_rpc_proto_msgTypes[12]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use CriuReq.ProtoReflect.Descriptor instead.
-func (*CriuReq) Descriptor() ([]byte, []int) {
-	return file_rpc_rpc_proto_rawDescGZIP(), []int{12}
-}
-
-func (x *CriuReq) GetType() CriuReqType {
-	if x != nil && x.Type != nil {
-		return *x.Type
-	}
-	return CriuReqType_EMPTY
-}
-
-func (x *CriuReq) GetOpts() *CriuOpts {
-	if x != nil {
-		return x.Opts
-	}
-	return nil
-}
-
-func (x *CriuReq) GetNotifySuccess() bool {
-	if x != nil && x.NotifySuccess != nil {
-		return *x.NotifySuccess
-	}
-	return false
-}
-
-func (x *CriuReq) GetKeepOpen() bool {
-	if x != nil && x.KeepOpen != nil {
-		return *x.KeepOpen
-	}
-	return false
-}
-
-func (x *CriuReq) GetFeatures() *CriuFeatures {
-	if x != nil {
-		return x.Features
-	}
-	return nil
-}
-
-func (x *CriuReq) GetPid() uint32 {
-	if x != nil && x.Pid != nil {
-		return *x.Pid
-	}
-	return 0
-}
-
-type CriuResp struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	Type     *CriuReqType        `protobuf:"varint,1,req,name=type,enum=CriuReqType" json:"type,omitempty"`
-	Success  *bool               `protobuf:"varint,2,req,name=success" json:"success,omitempty"`
-	Dump     *CriuDumpResp       `protobuf:"bytes,3,opt,name=dump" json:"dump,omitempty"`
-	Restore  *CriuRestoreResp    `protobuf:"bytes,4,opt,name=restore" json:"restore,omitempty"`
-	Notify   *CriuNotify         `protobuf:"bytes,5,opt,name=notify" json:"notify,omitempty"`
-	Ps       *CriuPageServerInfo `protobuf:"bytes,6,opt,name=ps" json:"ps,omitempty"`
-	CrErrno  *int32              `protobuf:"varint,7,opt,name=cr_errno,json=crErrno" json:"cr_errno,omitempty"`
-	Features *CriuFeatures       `protobuf:"bytes,8,opt,name=features" json:"features,omitempty"`
-	CrErrmsg *string             `protobuf:"bytes,9,opt,name=cr_errmsg,json=crErrmsg" json:"cr_errmsg,omitempty"`
-	Version  *CriuVersion        `protobuf:"bytes,10,opt,name=version" json:"version,omitempty"`
-	Status   *int32              `protobuf:"varint,11,opt,name=status" json:"status,omitempty"`
-}
-
-func (x *CriuResp) Reset() {
-	*x = CriuResp{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_rpc_rpc_proto_msgTypes[13]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *CriuResp) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*CriuResp) ProtoMessage() {}
-
-func (x *CriuResp) ProtoReflect() protoreflect.Message {
-	mi := &file_rpc_rpc_proto_msgTypes[13]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use CriuResp.ProtoReflect.Descriptor instead.
-func (*CriuResp) Descriptor() ([]byte, []int) {
-	return file_rpc_rpc_proto_rawDescGZIP(), []int{13}
-}
-
-func (x *CriuResp) GetType() CriuReqType {
-	if x != nil && x.Type != nil {
-		return *x.Type
-	}
-	return CriuReqType_EMPTY
-}
-
-func (x *CriuResp) GetSuccess() bool {
-	if x != nil && x.Success != nil {
-		return *x.Success
-	}
-	return false
-}
-
-func (x *CriuResp) GetDump() *CriuDumpResp {
-	if x != nil {
-		return x.Dump
-	}
-	return nil
-}
-
-func (x *CriuResp) GetRestore() *CriuRestoreResp {
-	if x != nil {
-		return x.Restore
-	}
-	return nil
-}
-
-func (x *CriuResp) GetNotify() *CriuNotify {
-	if x != nil {
-		return x.Notify
-	}
-	return nil
-}
-
-func (x *CriuResp) GetPs() *CriuPageServerInfo {
-	if x != nil {
-		return x.Ps
-	}
-	return nil
-}
-
-func (x *CriuResp) GetCrErrno() int32 {
-	if x != nil && x.CrErrno != nil {
-		return *x.CrErrno
-	}
-	return 0
-}
-
-func (x *CriuResp) GetFeatures() *CriuFeatures {
-	if x != nil {
-		return x.Features
-	}
-	return nil
-}
-
-func (x *CriuResp) GetCrErrmsg() string {
-	if x != nil && x.CrErrmsg != nil {
-		return *x.CrErrmsg
-	}
-	return ""
-}
-
-func (x *CriuResp) GetVersion() *CriuVersion {
-	if x != nil {
-		return x.Version
-	}
-	return nil
-}
-
-func (x *CriuResp) GetStatus() int32 {
-	if x != nil && x.Status != nil {
-		return *x.Status
-	}
-	return 0
-}
-
-// Answer for criu_req_type.VERSION requests
-type CriuVersion struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	MajorNumber *int32  `protobuf:"varint,1,req,name=major_number,json=majorNumber" json:"major_number,omitempty"`
-	MinorNumber *int32  `protobuf:"varint,2,req,name=minor_number,json=minorNumber" json:"minor_number,omitempty"`
-	Gitid       *string `protobuf:"bytes,3,opt,name=gitid" json:"gitid,omitempty"`
-	Sublevel    *int32  `protobuf:"varint,4,opt,name=sublevel" json:"sublevel,omitempty"`
-	Extra       *int32  `protobuf:"varint,5,opt,name=extra" json:"extra,omitempty"`
-	Name        *string `protobuf:"bytes,6,opt,name=name" json:"name,omitempty"`
-}
-
-func (x *CriuVersion) Reset() {
-	*x = CriuVersion{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_rpc_rpc_proto_msgTypes[14]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *CriuVersion) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*CriuVersion) ProtoMessage() {}
-
-func (x *CriuVersion) ProtoReflect() protoreflect.Message {
-	mi := &file_rpc_rpc_proto_msgTypes[14]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use CriuVersion.ProtoReflect.Descriptor instead.
-func (*CriuVersion) Descriptor() ([]byte, []int) {
-	return file_rpc_rpc_proto_rawDescGZIP(), []int{14}
-}
-
-func (x *CriuVersion) GetMajorNumber() int32 {
-	if x != nil && x.MajorNumber != nil {
-		return *x.MajorNumber
-	}
-	return 0
-}
-
-func (x *CriuVersion) GetMinorNumber() int32 {
-	if x != nil && x.MinorNumber != nil {
-		return *x.MinorNumber
-	}
-	return 0
-}
-
-func (x *CriuVersion) GetGitid() string {
-	if x != nil && x.Gitid != nil {
-		return *x.Gitid
-	}
-	return ""
-}
-
-func (x *CriuVersion) GetSublevel() int32 {
-	if x != nil && x.Sublevel != nil {
-		return *x.Sublevel
-	}
-	return 0
-}
-
-func (x *CriuVersion) GetExtra() int32 {
-	if x != nil && x.Extra != nil {
-		return *x.Extra
-	}
-	return 0
-}
-
-func (x *CriuVersion) GetName() string {
-	if x != nil && x.Name != nil {
-		return *x.Name
-	}
-	return ""
-}
-
-var File_rpc_rpc_proto protoreflect.FileDescriptor
-
-var file_rpc_rpc_proto_rawDesc = []byte{
-	0x0a, 0x0d, 0x72, 0x70, 0x63, 0x2f, 0x72, 0x70, 0x63, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22,
-	0x67, 0x0a, 0x15, 0x63, 0x72, 0x69, 0x75, 0x5f, 0x70, 0x61, 0x67, 0x65, 0x5f, 0x73, 0x65, 0x72,
-	0x76, 0x65, 0x72, 0x5f, 0x69, 0x6e, 0x66, 0x6f, 0x12, 0x18, 0x0a, 0x07, 0x61, 0x64, 0x64, 0x72,
-	0x65, 0x73, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x61, 0x64, 0x64, 0x72, 0x65,
-	0x73, 0x73, 0x12, 0x12, 0x0a, 0x04, 0x70, 0x6f, 0x72, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x05,
-	0x52, 0x04, 0x70, 0x6f, 0x72, 0x74, 0x12, 0x10, 0x0a, 0x03, 0x70, 0x69, 0x64, 0x18, 0x03, 0x20,
-	0x01, 0x28, 0x05, 0x52, 0x03, 0x70, 0x69, 0x64, 0x12, 0x0e, 0x0a, 0x02, 0x66, 0x64, 0x18, 0x04,
-	0x20, 0x01, 0x28, 0x05, 0x52, 0x02, 0x66, 0x64, 0x22, 0x3c, 0x0a, 0x0e, 0x63, 0x72, 0x69, 0x75,
-	0x5f, 0x76, 0x65, 0x74, 0x68, 0x5f, 0x70, 0x61, 0x69, 0x72, 0x12, 0x13, 0x0a, 0x05, 0x69, 0x66,
-	0x5f, 0x69, 0x6e, 0x18, 0x01, 0x20, 0x02, 0x28, 0x09, 0x52, 0x04, 0x69, 0x66, 0x49, 0x6e, 0x12,
-	0x15, 0x0a, 0x06, 0x69, 0x66, 0x5f, 0x6f, 0x75, 0x74, 0x18, 0x02, 0x20, 0x02, 0x28, 0x09, 0x52,
-	0x05, 0x69, 0x66, 0x4f, 0x75, 0x74, 0x22, 0x33, 0x0a, 0x0d, 0x65, 0x78, 0x74, 0x5f, 0x6d, 0x6f,
-	0x75, 0x6e, 0x74, 0x5f, 0x6d, 0x61, 0x70, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01,
-	0x20, 0x02, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x76, 0x61, 0x6c,
-	0x18, 0x02, 0x20, 0x02, 0x28, 0x09, 0x52, 0x03, 0x76, 0x61, 0x6c, 0x22, 0x56, 0x0a, 0x0e, 0x6a,
-	0x6f, 0x69, 0x6e, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x12, 0x0e, 0x0a,
-	0x02, 0x6e, 0x73, 0x18, 0x01, 0x20, 0x02, 0x28, 0x09, 0x52, 0x02, 0x6e, 0x73, 0x12, 0x17, 0x0a,
-	0x07, 0x6e, 0x73, 0x5f, 0x66, 0x69, 0x6c, 0x65, 0x18, 0x02, 0x20, 0x02, 0x28, 0x09, 0x52, 0x06,
-	0x6e, 0x73, 0x46, 0x69, 0x6c, 0x65, 0x12, 0x1b, 0x0a, 0x09, 0x65, 0x78, 0x74, 0x72, 0x61, 0x5f,
-	0x6f, 0x70, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x65, 0x78, 0x74, 0x72, 0x61,
-	0x4f, 0x70, 0x74, 0x22, 0x2e, 0x0a, 0x0a, 0x69, 0x6e, 0x68, 0x65, 0x72, 0x69, 0x74, 0x5f, 0x66,
-	0x64, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x02, 0x28, 0x09, 0x52, 0x03,
-	0x6b, 0x65, 0x79, 0x12, 0x0e, 0x0a, 0x02, 0x66, 0x64, 0x18, 0x02, 0x20, 0x02, 0x28, 0x05, 0x52,
-	0x02, 0x66, 0x64, 0x22, 0x35, 0x0a, 0x0b, 0x63, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f, 0x72, 0x6f,
-	0x6f, 0x74, 0x12, 0x12, 0x0a, 0x04, 0x63, 0x74, 0x72, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x04, 0x63, 0x74, 0x72, 0x6c, 0x12, 0x12, 0x0a, 0x04, 0x70, 0x61, 0x74, 0x68, 0x18, 0x02,
-	0x20, 0x02, 0x28, 0x09, 0x52, 0x04, 0x70, 0x61, 0x74, 0x68, 0x22, 0x1f, 0x0a, 0x07, 0x75, 0x6e,
-	0x69, 0x78, 0x5f, 0x73, 0x6b, 0x12, 0x14, 0x0a, 0x05, 0x69, 0x6e, 0x6f, 0x64, 0x65, 0x18, 0x01,
-	0x20, 0x02, 0x28, 0x0d, 0x52, 0x05, 0x69, 0x6e, 0x6f, 0x64, 0x65, 0x22, 0xe4, 0x13, 0x0a, 0x09,
-	0x63, 0x72, 0x69, 0x75, 0x5f, 0x6f, 0x70, 0x74, 0x73, 0x12, 0x26, 0x0a, 0x0d, 0x69, 0x6d, 0x61,
-	0x67, 0x65, 0x73, 0x5f, 0x64, 0x69, 0x72, 0x5f, 0x66, 0x64, 0x18, 0x01, 0x20, 0x02, 0x28, 0x05,
-	0x3a, 0x02, 0x2d, 0x31, 0x52, 0x0b, 0x69, 0x6d, 0x61, 0x67, 0x65, 0x73, 0x44, 0x69, 0x72, 0x46,
-	0x64, 0x12, 0x1d, 0x0a, 0x0a, 0x69, 0x6d, 0x61, 0x67, 0x65, 0x73, 0x5f, 0x64, 0x69, 0x72, 0x18,
-	0x44, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x69, 0x6d, 0x61, 0x67, 0x65, 0x73, 0x44, 0x69, 0x72,
-	0x12, 0x10, 0x0a, 0x03, 0x70, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x05, 0x52, 0x03, 0x70,
-	0x69, 0x64, 0x12, 0x23, 0x0a, 0x0d, 0x6c, 0x65, 0x61, 0x76, 0x65, 0x5f, 0x72, 0x75, 0x6e, 0x6e,
-	0x69, 0x6e, 0x67, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0c, 0x6c, 0x65, 0x61, 0x76, 0x65,
-	0x52, 0x75, 0x6e, 0x6e, 0x69, 0x6e, 0x67, 0x12, 0x1e, 0x0a, 0x0b, 0x65, 0x78, 0x74, 0x5f, 0x75,
-	0x6e, 0x69, 0x78, 0x5f, 0x73, 0x6b, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x52, 0x09, 0x65, 0x78,
-	0x74, 0x55, 0x6e, 0x69, 0x78, 0x53, 0x6b, 0x12, 0x27, 0x0a, 0x0f, 0x74, 0x63, 0x70, 0x5f, 0x65,
-	0x73, 0x74, 0x61, 0x62, 0x6c, 0x69, 0x73, 0x68, 0x65, 0x64, 0x18, 0x05, 0x20, 0x01, 0x28, 0x08,
-	0x52, 0x0e, 0x74, 0x63, 0x70, 0x45, 0x73, 0x74, 0x61, 0x62, 0x6c, 0x69, 0x73, 0x68, 0x65, 0x64,
-	0x12, 0x27, 0x0a, 0x0f, 0x65, 0x76, 0x61, 0x73, 0x69, 0x76, 0x65, 0x5f, 0x64, 0x65, 0x76, 0x69,
-	0x63, 0x65, 0x73, 0x18, 0x06, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0e, 0x65, 0x76, 0x61, 0x73, 0x69,
-	0x76, 0x65, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x73, 0x12, 0x1b, 0x0a, 0x09, 0x73, 0x68, 0x65,
-	0x6c, 0x6c, 0x5f, 0x6a, 0x6f, 0x62, 0x18, 0x07, 0x20, 0x01, 0x28, 0x08, 0x52, 0x08, 0x73, 0x68,
-	0x65, 0x6c, 0x6c, 0x4a, 0x6f, 0x62, 0x12, 0x1d, 0x0a, 0x0a, 0x66, 0x69, 0x6c, 0x65, 0x5f, 0x6c,
-	0x6f, 0x63, 0x6b, 0x73, 0x18, 0x08, 0x20, 0x01, 0x28, 0x08, 0x52, 0x09, 0x66, 0x69, 0x6c, 0x65,
-	0x4c, 0x6f, 0x63, 0x6b, 0x73, 0x12, 0x1e, 0x0a, 0x09, 0x6c, 0x6f, 0x67, 0x5f, 0x6c, 0x65, 0x76,
-	0x65, 0x6c, 0x18, 0x09, 0x20, 0x01, 0x28, 0x05, 0x3a, 0x01, 0x32, 0x52, 0x08, 0x6c, 0x6f, 0x67,
-	0x4c, 0x65, 0x76, 0x65, 0x6c, 0x12, 0x19, 0x0a, 0x08, 0x6c, 0x6f, 0x67, 0x5f, 0x66, 0x69, 0x6c,
-	0x65, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x6c, 0x6f, 0x67, 0x46, 0x69, 0x6c, 0x65,
-	0x12, 0x26, 0x0a, 0x02, 0x70, 0x73, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x63,
-	0x72, 0x69, 0x75, 0x5f, 0x70, 0x61, 0x67, 0x65, 0x5f, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x5f,
-	0x69, 0x6e, 0x66, 0x6f, 0x52, 0x02, 0x70, 0x73, 0x12, 0x25, 0x0a, 0x0e, 0x6e, 0x6f, 0x74, 0x69,
-	0x66, 0x79, 0x5f, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x73, 0x18, 0x0c, 0x20, 0x01, 0x28, 0x08,
-	0x52, 0x0d, 0x6e, 0x6f, 0x74, 0x69, 0x66, 0x79, 0x53, 0x63, 0x72, 0x69, 0x70, 0x74, 0x73, 0x12,
-	0x12, 0x0a, 0x04, 0x72, 0x6f, 0x6f, 0x74, 0x18, 0x0d, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x72,
-	0x6f, 0x6f, 0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x70, 0x61, 0x72, 0x65, 0x6e, 0x74, 0x5f, 0x69, 0x6d,
-	0x67, 0x18, 0x0e, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x70, 0x61, 0x72, 0x65, 0x6e, 0x74, 0x49,
-	0x6d, 0x67, 0x12, 0x1b, 0x0a, 0x09, 0x74, 0x72, 0x61, 0x63, 0x6b, 0x5f, 0x6d, 0x65, 0x6d, 0x18,
-	0x0f, 0x20, 0x01, 0x28, 0x08, 0x52, 0x08, 0x74, 0x72, 0x61, 0x63, 0x6b, 0x4d, 0x65, 0x6d, 0x12,
-	0x1d, 0x0a, 0x0a, 0x61, 0x75, 0x74, 0x6f, 0x5f, 0x64, 0x65, 0x64, 0x75, 0x70, 0x18, 0x10, 0x20,
-	0x01, 0x28, 0x08, 0x52, 0x09, 0x61, 0x75, 0x74, 0x6f, 0x44, 0x65, 0x64, 0x75, 0x70, 0x12, 0x1e,
-	0x0a, 0x0b, 0x77, 0x6f, 0x72, 0x6b, 0x5f, 0x64, 0x69, 0x72, 0x5f, 0x66, 0x64, 0x18, 0x11, 0x20,
-	0x01, 0x28, 0x05, 0x52, 0x09, 0x77, 0x6f, 0x72, 0x6b, 0x44, 0x69, 0x72, 0x46, 0x64, 0x12, 0x1d,
-	0x0a, 0x0a, 0x6c, 0x69, 0x6e, 0x6b, 0x5f, 0x72, 0x65, 0x6d, 0x61, 0x70, 0x18, 0x12, 0x20, 0x01,
-	0x28, 0x08, 0x52, 0x09, 0x6c, 0x69, 0x6e, 0x6b, 0x52, 0x65, 0x6d, 0x61, 0x70, 0x12, 0x25, 0x0a,
-	0x05, 0x76, 0x65, 0x74, 0x68, 0x73, 0x18, 0x13, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x0f, 0x2e, 0x63,
-	0x72, 0x69, 0x75, 0x5f, 0x76, 0x65, 0x74, 0x68, 0x5f, 0x70, 0x61, 0x69, 0x72, 0x52, 0x05, 0x76,
-	0x65, 0x74, 0x68, 0x73, 0x12, 0x23, 0x0a, 0x07, 0x63, 0x70, 0x75, 0x5f, 0x63, 0x61, 0x70, 0x18,
-	0x14, 0x20, 0x01, 0x28, 0x0d, 0x3a, 0x0a, 0x34, 0x32, 0x39, 0x34, 0x39, 0x36, 0x37, 0x32, 0x39,
-	0x35, 0x52, 0x06, 0x63, 0x70, 0x75, 0x43, 0x61, 0x70, 0x12, 0x1f, 0x0a, 0x0b, 0x66, 0x6f, 0x72,
-	0x63, 0x65, 0x5f, 0x69, 0x72, 0x6d, 0x61, 0x70, 0x18, 0x15, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0a,
-	0x66, 0x6f, 0x72, 0x63, 0x65, 0x49, 0x72, 0x6d, 0x61, 0x70, 0x12, 0x19, 0x0a, 0x08, 0x65, 0x78,
-	0x65, 0x63, 0x5f, 0x63, 0x6d, 0x64, 0x18, 0x16, 0x20, 0x03, 0x28, 0x09, 0x52, 0x07, 0x65, 0x78,
-	0x65, 0x63, 0x43, 0x6d, 0x64, 0x12, 0x27, 0x0a, 0x07, 0x65, 0x78, 0x74, 0x5f, 0x6d, 0x6e, 0x74,
-	0x18, 0x17, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x65, 0x78, 0x74, 0x5f, 0x6d, 0x6f, 0x75,
-	0x6e, 0x74, 0x5f, 0x6d, 0x61, 0x70, 0x52, 0x06, 0x65, 0x78, 0x74, 0x4d, 0x6e, 0x74, 0x12, 0x25,
-	0x0a, 0x0e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x5f, 0x63, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x73,
-	0x18, 0x18, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0d, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x43, 0x67,
-	0x72, 0x6f, 0x75, 0x70, 0x73, 0x12, 0x25, 0x0a, 0x07, 0x63, 0x67, 0x5f, 0x72, 0x6f, 0x6f, 0x74,
-	0x18, 0x19, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x0c, 0x2e, 0x63, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f,
-	0x72, 0x6f, 0x6f, 0x74, 0x52, 0x06, 0x63, 0x67, 0x52, 0x6f, 0x6f, 0x74, 0x12, 0x1f, 0x0a, 0x0b,
-	0x72, 0x73, 0x74, 0x5f, 0x73, 0x69, 0x62, 0x6c, 0x69, 0x6e, 0x67, 0x18, 0x1a, 0x20, 0x01, 0x28,
-	0x08, 0x52, 0x0a, 0x72, 0x73, 0x74, 0x53, 0x69, 0x62, 0x6c, 0x69, 0x6e, 0x67, 0x12, 0x2a, 0x0a,
-	0x0a, 0x69, 0x6e, 0x68, 0x65, 0x72, 0x69, 0x74, 0x5f, 0x66, 0x64, 0x18, 0x1b, 0x20, 0x03, 0x28,
-	0x0b, 0x32, 0x0b, 0x2e, 0x69, 0x6e, 0x68, 0x65, 0x72, 0x69, 0x74, 0x5f, 0x66, 0x64, 0x52, 0x09,
-	0x69, 0x6e, 0x68, 0x65, 0x72, 0x69, 0x74, 0x46, 0x64, 0x12, 0x20, 0x0a, 0x0c, 0x61, 0x75, 0x74,
-	0x6f, 0x5f, 0x65, 0x78, 0x74, 0x5f, 0x6d, 0x6e, 0x74, 0x18, 0x1c, 0x20, 0x01, 0x28, 0x08, 0x52,
-	0x0a, 0x61, 0x75, 0x74, 0x6f, 0x45, 0x78, 0x74, 0x4d, 0x6e, 0x74, 0x12, 0x1f, 0x0a, 0x0b, 0x65,
-	0x78, 0x74, 0x5f, 0x73, 0x68, 0x61, 0x72, 0x69, 0x6e, 0x67, 0x18, 0x1d, 0x20, 0x01, 0x28, 0x08,
-	0x52, 0x0a, 0x65, 0x78, 0x74, 0x53, 0x68, 0x61, 0x72, 0x69, 0x6e, 0x67, 0x12, 0x1f, 0x0a, 0x0b,
-	0x65, 0x78, 0x74, 0x5f, 0x6d, 0x61, 0x73, 0x74, 0x65, 0x72, 0x73, 0x18, 0x1e, 0x20, 0x01, 0x28,
-	0x08, 0x52, 0x0a, 0x65, 0x78, 0x74, 0x4d, 0x61, 0x73, 0x74, 0x65, 0x72, 0x73, 0x12, 0x19, 0x0a,
-	0x08, 0x73, 0x6b, 0x69, 0x70, 0x5f, 0x6d, 0x6e, 0x74, 0x18, 0x1f, 0x20, 0x03, 0x28, 0x09, 0x52,
-	0x07, 0x73, 0x6b, 0x69, 0x70, 0x4d, 0x6e, 0x74, 0x12, 0x1b, 0x0a, 0x09, 0x65, 0x6e, 0x61, 0x62,
-	0x6c, 0x65, 0x5f, 0x66, 0x73, 0x18, 0x20, 0x20, 0x03, 0x28, 0x09, 0x52, 0x08, 0x65, 0x6e, 0x61,
-	0x62, 0x6c, 0x65, 0x46, 0x73, 0x12, 0x28, 0x0a, 0x0b, 0x75, 0x6e, 0x69, 0x78, 0x5f, 0x73, 0x6b,
-	0x5f, 0x69, 0x6e, 0x6f, 0x18, 0x21, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x08, 0x2e, 0x75, 0x6e, 0x69,
-	0x78, 0x5f, 0x73, 0x6b, 0x52, 0x09, 0x75, 0x6e, 0x69, 0x78, 0x53, 0x6b, 0x49, 0x6e, 0x6f, 0x12,
-	0x3d, 0x0a, 0x13, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x5f, 0x63, 0x67, 0x72, 0x6f, 0x75, 0x70,
-	0x73, 0x5f, 0x6d, 0x6f, 0x64, 0x65, 0x18, 0x22, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x0d, 0x2e, 0x63,
-	0x72, 0x69, 0x75, 0x5f, 0x63, 0x67, 0x5f, 0x6d, 0x6f, 0x64, 0x65, 0x52, 0x11, 0x6d, 0x61, 0x6e,
-	0x61, 0x67, 0x65, 0x43, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x4d, 0x6f, 0x64, 0x65, 0x12, 0x28,
-	0x0a, 0x0b, 0x67, 0x68, 0x6f, 0x73, 0x74, 0x5f, 0x6c, 0x69, 0x6d, 0x69, 0x74, 0x18, 0x23, 0x20,
-	0x01, 0x28, 0x0d, 0x3a, 0x07, 0x31, 0x30, 0x34, 0x38, 0x35, 0x37, 0x36, 0x52, 0x0a, 0x67, 0x68,
-	0x6f, 0x73, 0x74, 0x4c, 0x69, 0x6d, 0x69, 0x74, 0x12, 0x28, 0x0a, 0x10, 0x69, 0x72, 0x6d, 0x61,
-	0x70, 0x5f, 0x73, 0x63, 0x61, 0x6e, 0x5f, 0x70, 0x61, 0x74, 0x68, 0x73, 0x18, 0x24, 0x20, 0x03,
-	0x28, 0x09, 0x52, 0x0e, 0x69, 0x72, 0x6d, 0x61, 0x70, 0x53, 0x63, 0x61, 0x6e, 0x50, 0x61, 0x74,
-	0x68, 0x73, 0x12, 0x1a, 0x0a, 0x08, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x18, 0x25,
-	0x20, 0x03, 0x28, 0x09, 0x52, 0x08, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x12, 0x19,
-	0x0a, 0x08, 0x65, 0x6d, 0x70, 0x74, 0x79, 0x5f, 0x6e, 0x73, 0x18, 0x26, 0x20, 0x01, 0x28, 0x0d,
-	0x52, 0x07, 0x65, 0x6d, 0x70, 0x74, 0x79, 0x4e, 0x73, 0x12, 0x28, 0x0a, 0x07, 0x6a, 0x6f, 0x69,
-	0x6e, 0x5f, 0x6e, 0x73, 0x18, 0x27, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x0f, 0x2e, 0x6a, 0x6f, 0x69,
-	0x6e, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x52, 0x06, 0x6a, 0x6f, 0x69,
-	0x6e, 0x4e, 0x73, 0x12, 0x21, 0x0a, 0x0c, 0x63, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f, 0x70, 0x72,
-	0x6f, 0x70, 0x73, 0x18, 0x29, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x63, 0x67, 0x72, 0x6f, 0x75,
-	0x70, 0x50, 0x72, 0x6f, 0x70, 0x73, 0x12, 0x2a, 0x0a, 0x11, 0x63, 0x67, 0x72, 0x6f, 0x75, 0x70,
-	0x5f, 0x70, 0x72, 0x6f, 0x70, 0x73, 0x5f, 0x66, 0x69, 0x6c, 0x65, 0x18, 0x2a, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x0f, 0x63, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x50, 0x72, 0x6f, 0x70, 0x73, 0x46, 0x69,
-	0x6c, 0x65, 0x12, 0x34, 0x0a, 0x16, 0x63, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f, 0x64, 0x75, 0x6d,
-	0x70, 0x5f, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x18, 0x2b, 0x20, 0x03,
-	0x28, 0x09, 0x52, 0x14, 0x63, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x44, 0x75, 0x6d, 0x70, 0x43, 0x6f,
-	0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x12, 0x23, 0x0a, 0x0d, 0x66, 0x72, 0x65, 0x65,
-	0x7a, 0x65, 0x5f, 0x63, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x18, 0x2c, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x0c, 0x66, 0x72, 0x65, 0x65, 0x7a, 0x65, 0x43, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x12, 0x18, 0x0a,
-	0x07, 0x74, 0x69, 0x6d, 0x65, 0x6f, 0x75, 0x74, 0x18, 0x2d, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x07,
-	0x74, 0x69, 0x6d, 0x65, 0x6f, 0x75, 0x74, 0x12, 0x2b, 0x0a, 0x12, 0x74, 0x63, 0x70, 0x5f, 0x73,
-	0x6b, 0x69, 0x70, 0x5f, 0x69, 0x6e, 0x5f, 0x66, 0x6c, 0x69, 0x67, 0x68, 0x74, 0x18, 0x2e, 0x20,
-	0x01, 0x28, 0x08, 0x52, 0x0f, 0x74, 0x63, 0x70, 0x53, 0x6b, 0x69, 0x70, 0x49, 0x6e, 0x46, 0x6c,
-	0x69, 0x67, 0x68, 0x74, 0x12, 0x21, 0x0a, 0x0c, 0x77, 0x65, 0x61, 0x6b, 0x5f, 0x73, 0x79, 0x73,
-	0x63, 0x74, 0x6c, 0x73, 0x18, 0x2f, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0b, 0x77, 0x65, 0x61, 0x6b,
-	0x53, 0x79, 0x73, 0x63, 0x74, 0x6c, 0x73, 0x12, 0x1d, 0x0a, 0x0a, 0x6c, 0x61, 0x7a, 0x79, 0x5f,
-	0x70, 0x61, 0x67, 0x65, 0x73, 0x18, 0x30, 0x20, 0x01, 0x28, 0x08, 0x52, 0x09, 0x6c, 0x61, 0x7a,
-	0x79, 0x50, 0x61, 0x67, 0x65, 0x73, 0x12, 0x1b, 0x0a, 0x09, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73,
-	0x5f, 0x66, 0x64, 0x18, 0x31, 0x20, 0x01, 0x28, 0x05, 0x52, 0x08, 0x73, 0x74, 0x61, 0x74, 0x75,
-	0x73, 0x46, 0x64, 0x12, 0x2a, 0x0a, 0x11, 0x6f, 0x72, 0x70, 0x68, 0x61, 0x6e, 0x5f, 0x70, 0x74,
-	0x73, 0x5f, 0x6d, 0x61, 0x73, 0x74, 0x65, 0x72, 0x18, 0x32, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0f,
-	0x6f, 0x72, 0x70, 0x68, 0x61, 0x6e, 0x50, 0x74, 0x73, 0x4d, 0x61, 0x73, 0x74, 0x65, 0x72, 0x12,
-	0x1f, 0x0a, 0x0b, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x5f, 0x66, 0x69, 0x6c, 0x65, 0x18, 0x33,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x46, 0x69, 0x6c, 0x65,
-	0x12, 0x1b, 0x0a, 0x09, 0x74, 0x63, 0x70, 0x5f, 0x63, 0x6c, 0x6f, 0x73, 0x65, 0x18, 0x34, 0x20,
-	0x01, 0x28, 0x08, 0x52, 0x08, 0x74, 0x63, 0x70, 0x43, 0x6c, 0x6f, 0x73, 0x65, 0x12, 0x1f, 0x0a,
-	0x0b, 0x6c, 0x73, 0x6d, 0x5f, 0x70, 0x72, 0x6f, 0x66, 0x69, 0x6c, 0x65, 0x18, 0x35, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x0a, 0x6c, 0x73, 0x6d, 0x50, 0x72, 0x6f, 0x66, 0x69, 0x6c, 0x65, 0x12, 0x1d,
-	0x0a, 0x0a, 0x74, 0x6c, 0x73, 0x5f, 0x63, 0x61, 0x63, 0x65, 0x72, 0x74, 0x18, 0x36, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x09, 0x74, 0x6c, 0x73, 0x43, 0x61, 0x63, 0x65, 0x72, 0x74, 0x12, 0x1b, 0x0a,
-	0x09, 0x74, 0x6c, 0x73, 0x5f, 0x63, 0x61, 0x63, 0x72, 0x6c, 0x18, 0x37, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x08, 0x74, 0x6c, 0x73, 0x43, 0x61, 0x63, 0x72, 0x6c, 0x12, 0x19, 0x0a, 0x08, 0x74, 0x6c,
-	0x73, 0x5f, 0x63, 0x65, 0x72, 0x74, 0x18, 0x38, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x74, 0x6c,
-	0x73, 0x43, 0x65, 0x72, 0x74, 0x12, 0x17, 0x0a, 0x07, 0x74, 0x6c, 0x73, 0x5f, 0x6b, 0x65, 0x79,
-	0x18, 0x39, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x74, 0x6c, 0x73, 0x4b, 0x65, 0x79, 0x12, 0x10,
-	0x0a, 0x03, 0x74, 0x6c, 0x73, 0x18, 0x3a, 0x20, 0x01, 0x28, 0x08, 0x52, 0x03, 0x74, 0x6c, 0x73,
-	0x12, 0x27, 0x0a, 0x10, 0x74, 0x6c, 0x73, 0x5f, 0x6e, 0x6f, 0x5f, 0x63, 0x6e, 0x5f, 0x76, 0x65,
-	0x72, 0x69, 0x66, 0x79, 0x18, 0x3b, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0d, 0x74, 0x6c, 0x73, 0x4e,
-	0x6f, 0x43, 0x6e, 0x56, 0x65, 0x72, 0x69, 0x66, 0x79, 0x12, 0x1f, 0x0a, 0x0b, 0x63, 0x67, 0x72,
-	0x6f, 0x75, 0x70, 0x5f, 0x79, 0x61, 0x72, 0x64, 0x18, 0x3c, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a,
-	0x63, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x59, 0x61, 0x72, 0x64, 0x12, 0x3f, 0x0a, 0x0d, 0x70, 0x72,
-	0x65, 0x5f, 0x64, 0x75, 0x6d, 0x70, 0x5f, 0x6d, 0x6f, 0x64, 0x65, 0x18, 0x3d, 0x20, 0x01, 0x28,
-	0x0e, 0x32, 0x13, 0x2e, 0x63, 0x72, 0x69, 0x75, 0x5f, 0x70, 0x72, 0x65, 0x5f, 0x64, 0x75, 0x6d,
-	0x70, 0x5f, 0x6d, 0x6f, 0x64, 0x65, 0x3a, 0x06, 0x53, 0x50, 0x4c, 0x49, 0x43, 0x45, 0x52, 0x0b,
-	0x70, 0x72, 0x65, 0x44, 0x75, 0x6d, 0x70, 0x4d, 0x6f, 0x64, 0x65, 0x12, 0x24, 0x0a, 0x0e, 0x70,
-	0x69, 0x64, 0x66, 0x64, 0x5f, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x5f, 0x73, 0x6b, 0x18, 0x3e, 0x20,
-	0x01, 0x28, 0x05, 0x52, 0x0c, 0x70, 0x69, 0x64, 0x66, 0x64, 0x53, 0x74, 0x6f, 0x72, 0x65, 0x53,
-	0x6b, 0x12, 0x2a, 0x0a, 0x11, 0x6c, 0x73, 0x6d, 0x5f, 0x6d, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x63,
-	0x6f, 0x6e, 0x74, 0x65, 0x78, 0x74, 0x18, 0x3f, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0f, 0x6c, 0x73,
-	0x6d, 0x4d, 0x6f, 0x75, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x74, 0x65, 0x78, 0x74, 0x12, 0x46, 0x0a,
-	0x0c, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x5f, 0x6c, 0x6f, 0x63, 0x6b, 0x18, 0x40, 0x20,
-	0x01, 0x28, 0x0e, 0x32, 0x19, 0x2e, 0x63, 0x72, 0x69, 0x75, 0x5f, 0x6e, 0x65, 0x74, 0x77, 0x6f,
-	0x72, 0x6b, 0x5f, 0x6c, 0x6f, 0x63, 0x6b, 0x5f, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x3a, 0x08,
-	0x49, 0x50, 0x54, 0x41, 0x42, 0x4c, 0x45, 0x53, 0x52, 0x0b, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72,
-	0x6b, 0x4c, 0x6f, 0x63, 0x6b, 0x12, 0x2a, 0x0a, 0x11, 0x6d, 0x6e, 0x74, 0x6e, 0x73, 0x5f, 0x63,
-	0x6f, 0x6d, 0x70, 0x61, 0x74, 0x5f, 0x6d, 0x6f, 0x64, 0x65, 0x18, 0x41, 0x20, 0x01, 0x28, 0x08,
-	0x52, 0x0f, 0x6d, 0x6e, 0x74, 0x6e, 0x73, 0x43, 0x6f, 0x6d, 0x70, 0x61, 0x74, 0x4d, 0x6f, 0x64,
-	0x65, 0x12, 0x2d, 0x0a, 0x13, 0x73, 0x6b, 0x69, 0x70, 0x5f, 0x66, 0x69, 0x6c, 0x65, 0x5f, 0x72,
-	0x77, 0x78, 0x5f, 0x63, 0x68, 0x65, 0x63, 0x6b, 0x18, 0x42, 0x20, 0x01, 0x28, 0x08, 0x52, 0x10,
-	0x73, 0x6b, 0x69, 0x70, 0x46, 0x69, 0x6c, 0x65, 0x52, 0x77, 0x78, 0x43, 0x68, 0x65, 0x63, 0x6b,
-	0x12, 0x22, 0x0a, 0x0c, 0x75, 0x6e, 0x70, 0x72, 0x69, 0x76, 0x69, 0x6c, 0x65, 0x67, 0x65, 0x64,
-	0x18, 0x43, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0c, 0x75, 0x6e, 0x70, 0x72, 0x69, 0x76, 0x69, 0x6c,
-	0x65, 0x67, 0x65, 0x64, 0x12, 0x23, 0x0a, 0x0d, 0x6c, 0x65, 0x61, 0x76, 0x65, 0x5f, 0x73, 0x74,
-	0x6f, 0x70, 0x70, 0x65, 0x64, 0x18, 0x45, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0c, 0x6c, 0x65, 0x61,
-	0x76, 0x65, 0x53, 0x74, 0x6f, 0x70, 0x70, 0x65, 0x64, 0x12, 0x23, 0x0a, 0x0d, 0x64, 0x69, 0x73,
-	0x70, 0x6c, 0x61, 0x79, 0x5f, 0x73, 0x74, 0x61, 0x74, 0x73, 0x18, 0x46, 0x20, 0x01, 0x28, 0x08,
-	0x52, 0x0c, 0x64, 0x69, 0x73, 0x70, 0x6c, 0x61, 0x79, 0x53, 0x74, 0x61, 0x74, 0x73, 0x12, 0x22,
-	0x0a, 0x0d, 0x6c, 0x6f, 0x67, 0x5f, 0x74, 0x6f, 0x5f, 0x73, 0x74, 0x64, 0x65, 0x72, 0x72, 0x18,
-	0x47, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0b, 0x6c, 0x6f, 0x67, 0x54, 0x6f, 0x53, 0x74, 0x64, 0x65,
-	0x72, 0x72, 0x22, 0x2c, 0x0a, 0x0e, 0x63, 0x72, 0x69, 0x75, 0x5f, 0x64, 0x75, 0x6d, 0x70, 0x5f,
-	0x72, 0x65, 0x73, 0x70, 0x12, 0x1a, 0x0a, 0x08, 0x72, 0x65, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x64,
-	0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x08, 0x72, 0x65, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x64,
-	0x22, 0x25, 0x0a, 0x11, 0x63, 0x72, 0x69, 0x75, 0x5f, 0x72, 0x65, 0x73, 0x74, 0x6f, 0x72, 0x65,
-	0x5f, 0x72, 0x65, 0x73, 0x70, 0x12, 0x10, 0x0a, 0x03, 0x70, 0x69, 0x64, 0x18, 0x01, 0x20, 0x02,
-	0x28, 0x05, 0x52, 0x03, 0x70, 0x69, 0x64, 0x22, 0x37, 0x0a, 0x0b, 0x63, 0x72, 0x69, 0x75, 0x5f,
-	0x6e, 0x6f, 0x74, 0x69, 0x66, 0x79, 0x12, 0x16, 0x0a, 0x06, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74,
-	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x12, 0x10,
-	0x0a, 0x03, 0x70, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x05, 0x52, 0x03, 0x70, 0x69, 0x64,
-	0x22, 0x6c, 0x0a, 0x0d, 0x63, 0x72, 0x69, 0x75, 0x5f, 0x66, 0x65, 0x61, 0x74, 0x75, 0x72, 0x65,
-	0x73, 0x12, 0x1b, 0x0a, 0x09, 0x6d, 0x65, 0x6d, 0x5f, 0x74, 0x72, 0x61, 0x63, 0x6b, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x08, 0x52, 0x08, 0x6d, 0x65, 0x6d, 0x54, 0x72, 0x61, 0x63, 0x6b, 0x12, 0x1d,
-	0x0a, 0x0a, 0x6c, 0x61, 0x7a, 0x79, 0x5f, 0x70, 0x61, 0x67, 0x65, 0x73, 0x18, 0x02, 0x20, 0x01,
-	0x28, 0x08, 0x52, 0x09, 0x6c, 0x61, 0x7a, 0x79, 0x50, 0x61, 0x67, 0x65, 0x73, 0x12, 0x1f, 0x0a,
-	0x0b, 0x70, 0x69, 0x64, 0x66, 0x64, 0x5f, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x18, 0x03, 0x20, 0x01,
-	0x28, 0x08, 0x52, 0x0a, 0x70, 0x69, 0x64, 0x66, 0x64, 0x53, 0x74, 0x6f, 0x72, 0x65, 0x22, 0xd0,
-	0x01, 0x0a, 0x08, 0x63, 0x72, 0x69, 0x75, 0x5f, 0x72, 0x65, 0x71, 0x12, 0x22, 0x0a, 0x04, 0x74,
-	0x79, 0x70, 0x65, 0x18, 0x01, 0x20, 0x02, 0x28, 0x0e, 0x32, 0x0e, 0x2e, 0x63, 0x72, 0x69, 0x75,
-	0x5f, 0x72, 0x65, 0x71, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12,
-	0x1e, 0x0a, 0x04, 0x6f, 0x70, 0x74, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0a, 0x2e,
-	0x63, 0x72, 0x69, 0x75, 0x5f, 0x6f, 0x70, 0x74, 0x73, 0x52, 0x04, 0x6f, 0x70, 0x74, 0x73, 0x12,
-	0x25, 0x0a, 0x0e, 0x6e, 0x6f, 0x74, 0x69, 0x66, 0x79, 0x5f, 0x73, 0x75, 0x63, 0x63, 0x65, 0x73,
-	0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0d, 0x6e, 0x6f, 0x74, 0x69, 0x66, 0x79, 0x53,
-	0x75, 0x63, 0x63, 0x65, 0x73, 0x73, 0x12, 0x1b, 0x0a, 0x09, 0x6b, 0x65, 0x65, 0x70, 0x5f, 0x6f,
-	0x70, 0x65, 0x6e, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x52, 0x08, 0x6b, 0x65, 0x65, 0x70, 0x4f,
-	0x70, 0x65, 0x6e, 0x12, 0x2a, 0x0a, 0x08, 0x66, 0x65, 0x61, 0x74, 0x75, 0x72, 0x65, 0x73, 0x18,
-	0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x63, 0x72, 0x69, 0x75, 0x5f, 0x66, 0x65, 0x61,
-	0x74, 0x75, 0x72, 0x65, 0x73, 0x52, 0x08, 0x66, 0x65, 0x61, 0x74, 0x75, 0x72, 0x65, 0x73, 0x12,
-	0x10, 0x0a, 0x03, 0x70, 0x69, 0x64, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x03, 0x70, 0x69,
-	0x64, 0x22, 0x8f, 0x03, 0x0a, 0x09, 0x63, 0x72, 0x69, 0x75, 0x5f, 0x72, 0x65, 0x73, 0x70, 0x12,
-	0x22, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x01, 0x20, 0x02, 0x28, 0x0e, 0x32, 0x0e, 0x2e,
-	0x63, 0x72, 0x69, 0x75, 0x5f, 0x72, 0x65, 0x71, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x52, 0x04, 0x74,
-	0x79, 0x70, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x73, 0x75, 0x63, 0x63, 0x65, 0x73, 0x73, 0x18, 0x02,
-	0x20, 0x02, 0x28, 0x08, 0x52, 0x07, 0x73, 0x75, 0x63, 0x63, 0x65, 0x73, 0x73, 0x12, 0x23, 0x0a,
-	0x04, 0x64, 0x75, 0x6d, 0x70, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0f, 0x2e, 0x63, 0x72,
-	0x69, 0x75, 0x5f, 0x64, 0x75, 0x6d, 0x70, 0x5f, 0x72, 0x65, 0x73, 0x70, 0x52, 0x04, 0x64, 0x75,
-	0x6d, 0x70, 0x12, 0x2c, 0x0a, 0x07, 0x72, 0x65, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x18, 0x04, 0x20,
-	0x01, 0x28, 0x0b, 0x32, 0x12, 0x2e, 0x63, 0x72, 0x69, 0x75, 0x5f, 0x72, 0x65, 0x73, 0x74, 0x6f,
-	0x72, 0x65, 0x5f, 0x72, 0x65, 0x73, 0x70, 0x52, 0x07, 0x72, 0x65, 0x73, 0x74, 0x6f, 0x72, 0x65,
-	0x12, 0x24, 0x0a, 0x06, 0x6e, 0x6f, 0x74, 0x69, 0x66, 0x79, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b,
-	0x32, 0x0c, 0x2e, 0x63, 0x72, 0x69, 0x75, 0x5f, 0x6e, 0x6f, 0x74, 0x69, 0x66, 0x79, 0x52, 0x06,
-	0x6e, 0x6f, 0x74, 0x69, 0x66, 0x79, 0x12, 0x26, 0x0a, 0x02, 0x70, 0x73, 0x18, 0x06, 0x20, 0x01,
-	0x28, 0x0b, 0x32, 0x16, 0x2e, 0x63, 0x72, 0x69, 0x75, 0x5f, 0x70, 0x61, 0x67, 0x65, 0x5f, 0x73,
-	0x65, 0x72, 0x76, 0x65, 0x72, 0x5f, 0x69, 0x6e, 0x66, 0x6f, 0x52, 0x02, 0x70, 0x73, 0x12, 0x19,
-	0x0a, 0x08, 0x63, 0x72, 0x5f, 0x65, 0x72, 0x72, 0x6e, 0x6f, 0x18, 0x07, 0x20, 0x01, 0x28, 0x05,
-	0x52, 0x07, 0x63, 0x72, 0x45, 0x72, 0x72, 0x6e, 0x6f, 0x12, 0x2a, 0x0a, 0x08, 0x66, 0x65, 0x61,
-	0x74, 0x75, 0x72, 0x65, 0x73, 0x18, 0x08, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x63, 0x72,
-	0x69, 0x75, 0x5f, 0x66, 0x65, 0x61, 0x74, 0x75, 0x72, 0x65, 0x73, 0x52, 0x08, 0x66, 0x65, 0x61,
-	0x74, 0x75, 0x72, 0x65, 0x73, 0x12, 0x1b, 0x0a, 0x09, 0x63, 0x72, 0x5f, 0x65, 0x72, 0x72, 0x6d,
-	0x73, 0x67, 0x18, 0x09, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x63, 0x72, 0x45, 0x72, 0x72, 0x6d,
-	0x73, 0x67, 0x12, 0x27, 0x0a, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x0a, 0x20,
-	0x01, 0x28, 0x0b, 0x32, 0x0d, 0x2e, 0x63, 0x72, 0x69, 0x75, 0x5f, 0x76, 0x65, 0x72, 0x73, 0x69,
-	0x6f, 0x6e, 0x52, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x16, 0x0a, 0x06, 0x73,
-	0x74, 0x61, 0x74, 0x75, 0x73, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x05, 0x52, 0x06, 0x73, 0x74, 0x61,
-	0x74, 0x75, 0x73, 0x22, 0xb0, 0x01, 0x0a, 0x0c, 0x63, 0x72, 0x69, 0x75, 0x5f, 0x76, 0x65, 0x72,
-	0x73, 0x69, 0x6f, 0x6e, 0x12, 0x21, 0x0a, 0x0c, 0x6d, 0x61, 0x6a, 0x6f, 0x72, 0x5f, 0x6e, 0x75,
-	0x6d, 0x62, 0x65, 0x72, 0x18, 0x01, 0x20, 0x02, 0x28, 0x05, 0x52, 0x0b, 0x6d, 0x61, 0x6a, 0x6f,
-	0x72, 0x4e, 0x75, 0x6d, 0x62, 0x65, 0x72, 0x12, 0x21, 0x0a, 0x0c, 0x6d, 0x69, 0x6e, 0x6f, 0x72,
-	0x5f, 0x6e, 0x75, 0x6d, 0x62, 0x65, 0x72, 0x18, 0x02, 0x20, 0x02, 0x28, 0x05, 0x52, 0x0b, 0x6d,
-	0x69, 0x6e, 0x6f, 0x72, 0x4e, 0x75, 0x6d, 0x62, 0x65, 0x72, 0x12, 0x14, 0x0a, 0x05, 0x67, 0x69,
-	0x74, 0x69, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x67, 0x69, 0x74, 0x69, 0x64,
-	0x12, 0x1a, 0x0a, 0x08, 0x73, 0x75, 0x62, 0x6c, 0x65, 0x76, 0x65, 0x6c, 0x18, 0x04, 0x20, 0x01,
-	0x28, 0x05, 0x52, 0x08, 0x73, 0x75, 0x62, 0x6c, 0x65, 0x76, 0x65, 0x6c, 0x12, 0x14, 0x0a, 0x05,
-	0x65, 0x78, 0x74, 0x72, 0x61, 0x18, 0x05, 0x20, 0x01, 0x28, 0x05, 0x52, 0x05, 0x65, 0x78, 0x74,
-	0x72, 0x61, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x2a, 0x5f, 0x0a, 0x0c, 0x63, 0x72, 0x69, 0x75, 0x5f, 0x63,
-	0x67, 0x5f, 0x6d, 0x6f, 0x64, 0x65, 0x12, 0x0a, 0x0a, 0x06, 0x49, 0x47, 0x4e, 0x4f, 0x52, 0x45,
-	0x10, 0x00, 0x12, 0x0b, 0x0a, 0x07, 0x43, 0x47, 0x5f, 0x4e, 0x4f, 0x4e, 0x45, 0x10, 0x01, 0x12,
-	0x09, 0x0a, 0x05, 0x50, 0x52, 0x4f, 0x50, 0x53, 0x10, 0x02, 0x12, 0x08, 0x0a, 0x04, 0x53, 0x4f,
-	0x46, 0x54, 0x10, 0x03, 0x12, 0x08, 0x0a, 0x04, 0x46, 0x55, 0x4c, 0x4c, 0x10, 0x04, 0x12, 0x0a,
-	0x0a, 0x06, 0x53, 0x54, 0x52, 0x49, 0x43, 0x54, 0x10, 0x05, 0x12, 0x0b, 0x0a, 0x07, 0x44, 0x45,
-	0x46, 0x41, 0x55, 0x4c, 0x54, 0x10, 0x06, 0x2a, 0x40, 0x0a, 0x18, 0x63, 0x72, 0x69, 0x75, 0x5f,
-	0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x5f, 0x6c, 0x6f, 0x63, 0x6b, 0x5f, 0x6d, 0x65, 0x74,
-	0x68, 0x6f, 0x64, 0x12, 0x0c, 0x0a, 0x08, 0x49, 0x50, 0x54, 0x41, 0x42, 0x4c, 0x45, 0x53, 0x10,
-	0x01, 0x12, 0x0c, 0x0a, 0x08, 0x4e, 0x46, 0x54, 0x41, 0x42, 0x4c, 0x45, 0x53, 0x10, 0x02, 0x12,
-	0x08, 0x0a, 0x04, 0x53, 0x4b, 0x49, 0x50, 0x10, 0x03, 0x2a, 0x2d, 0x0a, 0x12, 0x63, 0x72, 0x69,
-	0x75, 0x5f, 0x70, 0x72, 0x65, 0x5f, 0x64, 0x75, 0x6d, 0x70, 0x5f, 0x6d, 0x6f, 0x64, 0x65, 0x12,
-	0x0a, 0x0a, 0x06, 0x53, 0x50, 0x4c, 0x49, 0x43, 0x45, 0x10, 0x01, 0x12, 0x0b, 0x0a, 0x07, 0x56,
-	0x4d, 0x5f, 0x52, 0x45, 0x41, 0x44, 0x10, 0x02, 0x2a, 0xe5, 0x01, 0x0a, 0x0d, 0x63, 0x72, 0x69,
-	0x75, 0x5f, 0x72, 0x65, 0x71, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x12, 0x09, 0x0a, 0x05, 0x45, 0x4d,
-	0x50, 0x54, 0x59, 0x10, 0x00, 0x12, 0x08, 0x0a, 0x04, 0x44, 0x55, 0x4d, 0x50, 0x10, 0x01, 0x12,
-	0x0b, 0x0a, 0x07, 0x52, 0x45, 0x53, 0x54, 0x4f, 0x52, 0x45, 0x10, 0x02, 0x12, 0x09, 0x0a, 0x05,
-	0x43, 0x48, 0x45, 0x43, 0x4b, 0x10, 0x03, 0x12, 0x0c, 0x0a, 0x08, 0x50, 0x52, 0x45, 0x5f, 0x44,
-	0x55, 0x4d, 0x50, 0x10, 0x04, 0x12, 0x0f, 0x0a, 0x0b, 0x50, 0x41, 0x47, 0x45, 0x5f, 0x53, 0x45,
-	0x52, 0x56, 0x45, 0x52, 0x10, 0x05, 0x12, 0x0a, 0x0a, 0x06, 0x4e, 0x4f, 0x54, 0x49, 0x46, 0x59,
-	0x10, 0x06, 0x12, 0x10, 0x0a, 0x0c, 0x43, 0x50, 0x55, 0x49, 0x4e, 0x46, 0x4f, 0x5f, 0x44, 0x55,
-	0x4d, 0x50, 0x10, 0x07, 0x12, 0x11, 0x0a, 0x0d, 0x43, 0x50, 0x55, 0x49, 0x4e, 0x46, 0x4f, 0x5f,
-	0x43, 0x48, 0x45, 0x43, 0x4b, 0x10, 0x08, 0x12, 0x11, 0x0a, 0x0d, 0x46, 0x45, 0x41, 0x54, 0x55,
-	0x52, 0x45, 0x5f, 0x43, 0x48, 0x45, 0x43, 0x4b, 0x10, 0x09, 0x12, 0x0b, 0x0a, 0x07, 0x56, 0x45,
-	0x52, 0x53, 0x49, 0x4f, 0x4e, 0x10, 0x0a, 0x12, 0x0c, 0x0a, 0x08, 0x57, 0x41, 0x49, 0x54, 0x5f,
-	0x50, 0x49, 0x44, 0x10, 0x0b, 0x12, 0x14, 0x0a, 0x10, 0x50, 0x41, 0x47, 0x45, 0x5f, 0x53, 0x45,
-	0x52, 0x56, 0x45, 0x52, 0x5f, 0x43, 0x48, 0x4c, 0x44, 0x10, 0x0c, 0x12, 0x13, 0x0a, 0x0f, 0x53,
-	0x49, 0x4e, 0x47, 0x4c, 0x45, 0x5f, 0x50, 0x52, 0x45, 0x5f, 0x44, 0x55, 0x4d, 0x50, 0x10, 0x0d,
-}
-
-var (
-	file_rpc_rpc_proto_rawDescOnce sync.Once
-	file_rpc_rpc_proto_rawDescData = file_rpc_rpc_proto_rawDesc
-)
-
-func file_rpc_rpc_proto_rawDescGZIP() []byte {
-	file_rpc_rpc_proto_rawDescOnce.Do(func() {
-		file_rpc_rpc_proto_rawDescData = protoimpl.X.CompressGZIP(file_rpc_rpc_proto_rawDescData)
-	})
-	return file_rpc_rpc_proto_rawDescData
-}
-
-var file_rpc_rpc_proto_enumTypes = make([]protoimpl.EnumInfo, 4)
-var file_rpc_rpc_proto_msgTypes = make([]protoimpl.MessageInfo, 15)
-var file_rpc_rpc_proto_goTypes = []interface{}{
-	(CriuCgMode)(0),            // 0: criu_cg_mode
-	(CriuNetworkLockMethod)(0), // 1: criu_network_lock_method
-	(CriuPreDumpMode)(0),       // 2: criu_pre_dump_mode
-	(CriuReqType)(0),           // 3: criu_req_type
-	(*CriuPageServerInfo)(nil), // 4: criu_page_server_info
-	(*CriuVethPair)(nil),       // 5: criu_veth_pair
-	(*ExtMountMap)(nil),        // 6: ext_mount_map
-	(*JoinNamespace)(nil),      // 7: join_namespace
-	(*InheritFd)(nil),          // 8: inherit_fd
-	(*CgroupRoot)(nil),         // 9: cgroup_root
-	(*UnixSk)(nil),             // 10: unix_sk
-	(*CriuOpts)(nil),           // 11: criu_opts
-	(*CriuDumpResp)(nil),       // 12: criu_dump_resp
-	(*CriuRestoreResp)(nil),    // 13: criu_restore_resp
-	(*CriuNotify)(nil),         // 14: criu_notify
-	(*CriuFeatures)(nil),       // 15: criu_features
-	(*CriuReq)(nil),            // 16: criu_req
-	(*CriuResp)(nil),           // 17: criu_resp
-	(*CriuVersion)(nil),        // 18: criu_version
-}
-var file_rpc_rpc_proto_depIdxs = []int32{
-	4,  // 0: criu_opts.ps:type_name -> criu_page_server_info
-	5,  // 1: criu_opts.veths:type_name -> criu_veth_pair
-	6,  // 2: criu_opts.ext_mnt:type_name -> ext_mount_map
-	9,  // 3: criu_opts.cg_root:type_name -> cgroup_root
-	8,  // 4: criu_opts.inherit_fd:type_name -> inherit_fd
-	10, // 5: criu_opts.unix_sk_ino:type_name -> unix_sk
-	0,  // 6: criu_opts.manage_cgroups_mode:type_name -> criu_cg_mode
-	7,  // 7: criu_opts.join_ns:type_name -> join_namespace
-	2,  // 8: criu_opts.pre_dump_mode:type_name -> criu_pre_dump_mode
-	1,  // 9: criu_opts.network_lock:type_name -> criu_network_lock_method
-	3,  // 10: criu_req.type:type_name -> criu_req_type
-	11, // 11: criu_req.opts:type_name -> criu_opts
-	15, // 12: criu_req.features:type_name -> criu_features
-	3,  // 13: criu_resp.type:type_name -> criu_req_type
-	12, // 14: criu_resp.dump:type_name -> criu_dump_resp
-	13, // 15: criu_resp.restore:type_name -> criu_restore_resp
-	14, // 16: criu_resp.notify:type_name -> criu_notify
-	4,  // 17: criu_resp.ps:type_name -> criu_page_server_info
-	15, // 18: criu_resp.features:type_name -> criu_features
-	18, // 19: criu_resp.version:type_name -> criu_version
-	20, // [20:20] is the sub-list for method output_type
-	20, // [20:20] is the sub-list for method input_type
-	20, // [20:20] is the sub-list for extension type_name
-	20, // [20:20] is the sub-list for extension extendee
-	0,  // [0:20] is the sub-list for field type_name
-}
-
-func init() { file_rpc_rpc_proto_init() }
-func file_rpc_rpc_proto_init() {
-	if File_rpc_rpc_proto != nil {
-		return
-	}
-	if !protoimpl.UnsafeEnabled {
-		file_rpc_rpc_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*CriuPageServerInfo); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_rpc_rpc_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*CriuVethPair); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_rpc_rpc_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ExtMountMap); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_rpc_rpc_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*JoinNamespace); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_rpc_rpc_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*InheritFd); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_rpc_rpc_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*CgroupRoot); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_rpc_rpc_proto_msgTypes[6].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*UnixSk); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_rpc_rpc_proto_msgTypes[7].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*CriuOpts); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_rpc_rpc_proto_msgTypes[8].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*CriuDumpResp); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_rpc_rpc_proto_msgTypes[9].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*CriuRestoreResp); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_rpc_rpc_proto_msgTypes[10].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*CriuNotify); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_rpc_rpc_proto_msgTypes[11].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*CriuFeatures); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_rpc_rpc_proto_msgTypes[12].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*CriuReq); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_rpc_rpc_proto_msgTypes[13].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*CriuResp); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_rpc_rpc_proto_msgTypes[14].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*CriuVersion); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-	}
-	type x struct{}
-	out := protoimpl.TypeBuilder{
-		File: protoimpl.DescBuilder{
-			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
-			RawDescriptor: file_rpc_rpc_proto_rawDesc,
-			NumEnums:      4,
-			NumMessages:   15,
-			NumExtensions: 0,
-			NumServices:   0,
-		},
-		GoTypes:           file_rpc_rpc_proto_goTypes,
-		DependencyIndexes: file_rpc_rpc_proto_depIdxs,
-		EnumInfos:         file_rpc_rpc_proto_enumTypes,
-		MessageInfos:      file_rpc_rpc_proto_msgTypes,
-	}.Build()
-	File_rpc_rpc_proto = out.File
-	file_rpc_rpc_proto_rawDesc = nil
-	file_rpc_rpc_proto_goTypes = nil
-	file_rpc_rpc_proto_depIdxs = nil
-}
diff --git a/vendor/github.com/checkpoint-restore/go-criu/v7/.gitignore b/vendor/github.com/checkpoint-restore/go-criu/v8/.gitignore
similarity index 100%
rename from vendor/github.com/checkpoint-restore/go-criu/v7/.gitignore
rename to vendor/github.com/checkpoint-restore/go-criu/v8/.gitignore
diff --git a/vendor/github.com/checkpoint-restore/go-criu/v8/.golangci.yml b/vendor/github.com/checkpoint-restore/go-criu/v8/.golangci.yml
new file mode 100644
index 0000000000..6250268924
--- /dev/null
+++ b/vendor/github.com/checkpoint-restore/go-criu/v8/.golangci.yml
@@ -0,0 +1,46 @@
+version: "2"
+
+linters:
+  enable:
+    - bodyclose
+    - dupl
+    - durationcheck
+    - errcheck
+    - errorlint
+    - exhaustive
+    - gosec
+    - govet
+    - misspell
+    - nilerr
+    - prealloc
+    - rowserrcheck
+    - sqlclosecheck
+    - staticcheck
+    - unconvert
+    - unparam
+    - unused
+    - whitespace
+  disable:
+    - musttag
+    - noctx
+  exclusions:
+    generated: lax
+    presets:
+      - comments
+      - common-false-positives
+      - legacy
+      - std-error-handling
+  settings:
+    exhaustive:
+      default-signifies-exhaustive: true
+    gosec:
+      excludes:
+        # https://github.com/securego/gosec/issues/1185
+        - G115
+
+formatters:
+  enable:
+    - gofmt
+    - goimports
+  exclusions:
+    generated: lax
diff --git a/vendor/github.com/checkpoint-restore/go-criu/v8/CONTRIBUTING.md b/vendor/github.com/checkpoint-restore/go-criu/v8/CONTRIBUTING.md
new file mode 100644
index 0000000000..c32976f04a
--- /dev/null
+++ b/vendor/github.com/checkpoint-restore/go-criu/v8/CONTRIBUTING.md
@@ -0,0 +1,53 @@
+# How to contribute
+
+While bug fixes can first be identified via an "issue", that is not required.
+It's ok to just open up a PR with the fix, but make sure you include the same
+information you would have included in an issue - like how to reproduce it.
+
+PRs for new features should include some background on what use cases the
+new code is trying to address. When possible and when it makes sense, try to
+break-up larger PRs into smaller ones - it's easier to review smaller
+code changes. But only if those smaller ones make sense as stand-alone PRs.
+
+Regardless of the type of PR, all PRs should include:
+
+* well documented code changes;
+* additional testcases: ideally, they should fail w/o your code change applied;
+* documentation changes.
+
+Squash your commits into logical pieces of work that might want to be reviewed
+separate from the rest of the PRs. Ideally, each commit should implement a
+single idea, and the PR branch should pass the tests at every commit. GitHub
+makes it easy to review the cumulative effect of many commits; so, when in
+doubt, use smaller commits.
+
+This project tries to follow CRIU's commit message conventions, although they
+are not strictly enforced. For guidance on writing clear and effective commit
+messages, see [How to Write a Git Commit Message][git-commit].
+
+PRs that fix issues should include a reference like `Closes #XXXX` in the
+commit message so that github will automatically close the referenced issue
+when the PR is merged.
+
+Contributors must assert that they are in compliance with the [Developer
+Certificate of Origin 1.1](http://developercertificate.org/). This is achieved
+by adding a "Signed-off-by" line containing the contributor's name and e-mail
+to every commit message. Your signature certifies that you wrote the patch or
+otherwise have the right to pass it on as an open-source patch.
+
+The use of AI tools is welcome but should be correctly attributed, especially
+for substantial changes. You can use one of the following in your commit
+message:
+
+* `Assisted-by: <AI tool>`
+* `Co-authored-by: <AI tool>`
+* `Generated-by: <AI tool>`
+* Or mention it in the commit message body, e.g., "Generated with <AI tool>"
+
+Marking AI-assisted contributions helps preserve both legal clarity and
+community trust, and makes it easier for reviewers to evaluate the code
+in context. For more information, see [AI-assisted development and open source:
+Navigating the legal issues][ai-legal].
+
+[ai-legal]: https://www.redhat.com/en/blog/ai-assisted-development-and-open-source-navigating-legal-issues
+[git-commit]: https://chris.beams.io/posts/git-commit/
diff --git a/vendor/github.com/checkpoint-restore/go-criu/v7/LICENSE b/vendor/github.com/checkpoint-restore/go-criu/v8/LICENSE
similarity index 100%
rename from vendor/github.com/checkpoint-restore/go-criu/v7/LICENSE
rename to vendor/github.com/checkpoint-restore/go-criu/v8/LICENSE
diff --git a/vendor/github.com/checkpoint-restore/go-criu/v7/MAINTAINERS b/vendor/github.com/checkpoint-restore/go-criu/v8/MAINTAINERS
similarity index 100%
rename from vendor/github.com/checkpoint-restore/go-criu/v7/MAINTAINERS
rename to vendor/github.com/checkpoint-restore/go-criu/v8/MAINTAINERS
diff --git a/vendor/github.com/checkpoint-restore/go-criu/v7/Makefile b/vendor/github.com/checkpoint-restore/go-criu/v8/Makefile
similarity index 87%
rename from vendor/github.com/checkpoint-restore/go-criu/v7/Makefile
rename to vendor/github.com/checkpoint-restore/go-criu/v8/Makefile
index 12e064237a..418d737317 100644
--- a/vendor/github.com/checkpoint-restore/go-criu/v7/Makefile
+++ b/vendor/github.com/checkpoint-restore/go-criu/v8/Makefile
@@ -22,13 +22,13 @@ rpc/rpc.proto:
 	curl -sSL https://raw.githubusercontent.com/checkpoint-restore/criu/master/images/rpc.proto -o $@
 
 rpc/rpc.pb.go: rpc/rpc.proto
-	protoc --go_out=. --go_opt=M$^=rpc/ $^
+	protoc --go-lite_out=. --go-lite_opt=M$^=rpc/ $^
 
 stats/stats.proto:
 	curl -sSL https://raw.githubusercontent.com/checkpoint-restore/criu/master/images/stats.proto -o $@
 
 stats/stats.pb.go: stats/stats.proto
-	protoc --go_out=. --go_opt=M$^=stats/ $^
+	protoc --go-lite_out=. --go-lite_opt=M$^=stats/ $^
 
 vendor:
 	$(GO) mod tidy
diff --git a/vendor/github.com/checkpoint-restore/go-criu/v8/README.md b/vendor/github.com/checkpoint-restore/go-criu/v8/README.md
new file mode 100644
index 0000000000..7e268bf697
--- /dev/null
+++ b/vendor/github.com/checkpoint-restore/go-criu/v8/README.md
@@ -0,0 +1,85 @@
+<!-- markdownlint-configure-file { "no-hard-tabs": { "code_blocks": false } } -->
+# go-criu -- Go bindings for CRIU
+
+[![ci](https://github.com/checkpoint-restore/go-criu/actions/workflows/main.yml/badge.svg)](https://github.com/checkpoint-restore/go-criu/actions/workflows/main.yml)
+[![verify](https://github.com/checkpoint-restore/go-criu/actions/workflows/verify.yml/badge.svg)](https://github.com/checkpoint-restore/go-criu/actions/workflows/verify.yml)
+[![Go Reference](https://pkg.go.dev/badge/github.com/checkpoint-restore/go-criu.svg)](https://pkg.go.dev/github.com/checkpoint-restore/go-criu)
+
+This repository provides Go bindings for [CRIU](https://criu.org/).
+The code is based on the Go-based PHaul implementation from the CRIU repository.
+For easier inclusion into other Go projects, the CRIU Go bindings have been
+moved to this repository.
+
+## CRIU
+
+The Go bindings provide an easy way to use the CRIU RPC calls from Go without
+the need to set up all the infrastructure to make the actual RPC connection to CRIU.
+
+The following example would print the version of CRIU:
+
+```go
+import (
+	"log"
+
+	"github.com/checkpoint-restore/go-criu/v8"
+)
+
+func main() {
+	c := criu.MakeCriu()
+	version, err := c.GetCriuVersion()
+	if err != nil {
+		log.Fatalln(err)
+	}
+	log.Println(version)
+}
+```
+
+or to just check if at least a certain CRIU version is installed:
+
+```go
+	c := criu.MakeCriu()
+	result, err := c.IsCriuAtLeast(31100)
+```
+
+## CRIT
+
+The `crit` package provides bindings to decode, encode, and manipulate
+CRIU image files natively within Go. It also provides a CLI tool similar
+to the original CRIT Python tool. To get started with this, see the docs
+at [CRIT (Go library)](https://criu.org/CRIT_%28Go_library%29).
+
+## Releases
+
+The first go-criu release was 3.11 based on CRIU 3.11. The initial plan
+was to follow CRIU so that go-criu would carry the same version number as
+CRIU.
+
+As go-criu is imported in other projects and as Go modules are expected
+to follow Semantic Versioning go-criu will also follow Semantic Versioning
+starting with the 4.0.0 release.
+
+The following table shows the relation between go-criu and criu versions:
+
+| Major version  | Latest release | CRIU version |
+| -------------- | -------------- | ------------ |
+| v8             | 8.2.0          | 4.2          |
+| v7             | 7.2.0          | 3.19         |
+| v7             | 7.0.0          | 3.18         |
+| v6             | 6.3.0          | 3.17         |
+| v5             | 5.3.0          | 3.16         |
+| v5             | 5.0.0          | 3.15         |
+| v4             | 4.1.0          | 3.14         |
+
+## How to contribute
+
+See [CONTRIBUTING.md](CONTRIBUTING.md) for details on how to contribute to this
+project.
+
+## License and copyright
+
+Unless mentioned otherwise in a specific file's header, all code in
+this project is released under the Apache 2.0 license.
+
+The author of a change remains the copyright holder of their code
+(no copyright assignment). The list of authors and contributors can be
+retrieved from the git commit history and in some cases, the file headers.
diff --git a/vendor/github.com/checkpoint-restore/go-criu/v7/codecov.yml b/vendor/github.com/checkpoint-restore/go-criu/v8/codecov.yml
similarity index 100%
rename from vendor/github.com/checkpoint-restore/go-criu/v7/codecov.yml
rename to vendor/github.com/checkpoint-restore/go-criu/v8/codecov.yml
diff --git a/vendor/github.com/checkpoint-restore/go-criu/v7/features.go b/vendor/github.com/checkpoint-restore/go-criu/v8/features.go
similarity index 96%
rename from vendor/github.com/checkpoint-restore/go-criu/v7/features.go
rename to vendor/github.com/checkpoint-restore/go-criu/v8/features.go
index c62e69e064..fbece8b954 100644
--- a/vendor/github.com/checkpoint-restore/go-criu/v7/features.go
+++ b/vendor/github.com/checkpoint-restore/go-criu/v8/features.go
@@ -3,7 +3,7 @@ package criu
 import (
 	"errors"
 
-	"github.com/checkpoint-restore/go-criu/v7/rpc"
+	"github.com/checkpoint-restore/go-criu/v8/rpc"
 )
 
 // Feature checking in go-criu is based on the libcriu feature checking function.
diff --git a/vendor/github.com/checkpoint-restore/go-criu/v8/internal/proto/proto.go b/vendor/github.com/checkpoint-restore/go-criu/v8/internal/proto/proto.go
new file mode 100644
index 0000000000..ada6e44b62
--- /dev/null
+++ b/vendor/github.com/checkpoint-restore/go-criu/v8/internal/proto/proto.go
@@ -0,0 +1,13 @@
+// Package proto provides a small helper for constructing pointers to
+// scalar values, as used by proto2-generated optional/required fields.
+//
+// protobuf-go-lite does not ship the proto.String/Int32/Bool constructors
+// that google.golang.org/protobuf/proto offers, so Ptr replaces them.
+package proto
+
+// Ptr returns a pointer to v. It is handy for setting proto2 optional and
+// required scalar fields, e.g. Ptr("foo"), Ptr(true), Ptr[int32](4).
+//
+// TODO: drop this in favor of the built-in new(v) once the minimum
+// supported Go version is 1.26 or later.
+func Ptr[T any](v T) *T { return &v }
diff --git a/vendor/github.com/checkpoint-restore/go-criu/v7/main.go b/vendor/github.com/checkpoint-restore/go-criu/v8/main.go
similarity index 72%
rename from vendor/github.com/checkpoint-restore/go-criu/v7/main.go
rename to vendor/github.com/checkpoint-restore/go-criu/v8/main.go
index 8f29d2ee2d..1cf898982e 100644
--- a/vendor/github.com/checkpoint-restore/go-criu/v7/main.go
+++ b/vendor/github.com/checkpoint-restore/go-criu/v8/main.go
@@ -5,18 +5,24 @@ import (
 	"fmt"
 	"os"
 	"os/exec"
+	"sort"
 	"strconv"
 	"syscall"
 
-	"github.com/checkpoint-restore/go-criu/v7/rpc"
-	"google.golang.org/protobuf/proto"
+	proto "github.com/checkpoint-restore/go-criu/v8/internal/proto"
+	"github.com/checkpoint-restore/go-criu/v8/rpc"
 )
 
+// extraFilesStartFd is the first fd number assigned to cmd.ExtraFiles by os/exec.
+// As documented in os/exec: "entry i becomes file descriptor 3+i"
+const extraFilesStartFd = 3
+
 // Criu struct
 type Criu struct {
-	swrkCmd  *exec.Cmd
-	swrkSk   *os.File
-	swrkPath string
+	swrkCmd    *exec.Cmd
+	swrkSk     *os.File
+	swrkPath   string
+	inheritFds map[string]*os.File
 }
 
 // MakeCriu returns the Criu object required for most operations
@@ -32,8 +38,52 @@ func (c *Criu) SetCriuPath(path string) {
 	c.swrkPath = path
 }
 
+// AddInheritFd registers a file descriptor to be passed to CRIU.
+// If opts.InheritFd is not set for an operation, it will be populated
+// from these registrations using the same key order.
+func (c *Criu) AddInheritFd(key string, file *os.File) {
+	if c.inheritFds == nil {
+		c.inheritFds = make(map[string]*os.File)
+	}
+	c.inheritFds[key] = file
+}
+
+func (c *Criu) inheritFdKeys() []string {
+	if len(c.inheritFds) == 0 {
+		return nil
+	}
+	keys := make([]string, 0, len(c.inheritFds))
+	for k := range c.inheritFds {
+		keys = append(keys, k)
+	}
+	sort.Strings(keys)
+	return keys
+}
+
+func (c *Criu) ensureInheritFd(opts *rpc.CriuOpts) {
+	if opts == nil || len(opts.GetInheritFd()) > 0 || len(c.inheritFds) == 0 {
+		return
+	}
+	keys := c.inheritFdKeys()
+	if len(keys) == 0 {
+		return
+	}
+	opts.InheritFd = make([]*rpc.InheritFd, 0, len(keys))
+	for i, key := range keys {
+		fd := int32(extraFilesStartFd + i)
+		opts.InheritFd = append(opts.InheritFd, &rpc.InheritFd{
+			Key: proto.Ptr(key),
+			Fd:  proto.Ptr(fd),
+		})
+	}
+}
+
 // Prepare sets up everything for the RPC communication to CRIU
 func (c *Criu) Prepare() error {
+	return c.doPrepare(nil)
+}
+
+func (c *Criu) doPrepare(opts *rpc.CriuOpts) error {
 	fds, err := syscall.Socketpair(syscall.AF_LOCAL, syscall.SOCK_SEQPACKET, 0)
 	if err != nil {
 		return err
@@ -42,15 +92,28 @@ func (c *Criu) Prepare() error {
 	cln := os.NewFile(uintptr(fds[0]), "criu-xprt-cln")
 	syscall.CloseOnExec(fds[0])
 	srv := os.NewFile(uintptr(fds[1]), "criu-xprt-srv")
-	defer srv.Close()
+	defer func() { _ = srv.Close() }()
 
 	args := []string{"swrk", strconv.Itoa(fds[1])}
 	// #nosec G204
 	cmd := exec.Command(c.swrkPath, args...)
 
+	// Collect file descriptors to pass to child
+	inheritKeys := c.inheritFdKeys()
+	extraFiles := make([]*os.File, 0, len(inheritKeys))
+
+	// Add fds from AddInheritFd (sorted for stable ordering)
+	for _, k := range inheritKeys {
+		extraFiles = append(extraFiles, c.inheritFds[k])
+	}
+
+	c.ensureInheritFd(opts)
+
+	cmd.ExtraFiles = extraFiles
+
 	err = cmd.Start()
 	if err != nil {
-		cln.Close()
+		_ = cln.Close()
 		return err
 	}
 
@@ -106,13 +169,15 @@ func (c *Criu) doSwrk(reqType rpc.CriuReqType, opts *rpc.CriuOpts, nfy Notify) e
 }
 
 func (c *Criu) doSwrkWithResp(reqType rpc.CriuReqType, opts *rpc.CriuOpts, nfy Notify, features *rpc.CriuFeatures) (resp *rpc.CriuResp, retErr error) {
+	c.ensureInheritFd(opts)
+
 	req := rpc.CriuReq{
 		Type: &reqType,
 		Opts: opts,
 	}
 
 	if nfy != nil {
-		opts.NotifyScripts = proto.Bool(true)
+		opts.NotifyScripts = proto.Ptr(true)
 	}
 
 	if features != nil {
@@ -120,7 +185,7 @@ func (c *Criu) doSwrkWithResp(reqType rpc.CriuReqType, opts *rpc.CriuOpts, nfy N
 	}
 
 	if c.swrkCmd == nil {
-		err := c.Prepare()
+		err := c.doPrepare(opts)
 		if err != nil {
 			return nil, err
 		}
@@ -135,7 +200,7 @@ func (c *Criu) doSwrkWithResp(reqType rpc.CriuReqType, opts *rpc.CriuOpts, nfy N
 	}
 
 	for {
-		reqB, err := proto.Marshal(&req)
+		reqB, err := req.MarshalVT()
 		if err != nil {
 			return nil, err
 		}
@@ -146,7 +211,7 @@ func (c *Criu) doSwrkWithResp(reqType rpc.CriuReqType, opts *rpc.CriuOpts, nfy N
 		}
 
 		resp = &rpc.CriuResp{}
-		err = proto.Unmarshal(respB[:respS], resp)
+		err = resp.UnmarshalVT(respB[:respS])
 		if err != nil {
 			return nil, err
 		}
@@ -194,7 +259,7 @@ func (c *Criu) doSwrkWithResp(reqType rpc.CriuReqType, opts *rpc.CriuOpts, nfy N
 
 		req = rpc.CriuReq{
 			Type:          &respType,
-			NotifySuccess: proto.Bool(true),
+			NotifySuccess: proto.Ptr(true),
 		}
 	}
 
diff --git a/vendor/github.com/checkpoint-restore/go-criu/v7/notify.go b/vendor/github.com/checkpoint-restore/go-criu/v8/notify.go
similarity index 100%
rename from vendor/github.com/checkpoint-restore/go-criu/v7/notify.go
rename to vendor/github.com/checkpoint-restore/go-criu/v8/notify.go
diff --git a/vendor/github.com/checkpoint-restore/go-criu/v8/rpc/rpc.pb.go b/vendor/github.com/checkpoint-restore/go-criu/v8/rpc/rpc.pb.go
new file mode 100644
index 0000000000..4c053a9215
--- /dev/null
+++ b/vendor/github.com/checkpoint-restore/go-criu/v8/rpc/rpc.pb.go
@@ -0,0 +1,13032 @@
+// Code generated by protoc-gen-go-lite. DO NOT EDIT.
+// protoc-gen-go-lite version: v0.14.0
+// source: rpc.proto
+
+package rpc
+
+import (
+	fmt "fmt"
+	protobuf_go_lite "github.com/aperturerobotics/protobuf-go-lite"
+	io "io"
+	slices "slices"
+	strconv "strconv"
+	strings "strings"
+	unsafe "unsafe"
+)
+
+// SPDX-License-Identifier: MIT
+
+type CriuCgMode int32
+
+const (
+	CriuCgMode_IGNORE  CriuCgMode = 0
+	CriuCgMode_CG_NONE CriuCgMode = 1
+	CriuCgMode_PROPS   CriuCgMode = 2
+	CriuCgMode_SOFT    CriuCgMode = 3
+	CriuCgMode_FULL    CriuCgMode = 4
+	CriuCgMode_STRICT  CriuCgMode = 5
+	CriuCgMode_DEFAULT CriuCgMode = 6
+)
+
+// Enum value maps for CriuCgMode.
+var (
+	CriuCgMode_name = map[int32]string{
+		0: "IGNORE",
+		1: "CG_NONE",
+		2: "PROPS",
+		3: "SOFT",
+		4: "FULL",
+		5: "STRICT",
+		6: "DEFAULT",
+	}
+	CriuCgMode_value = map[string]int32{
+		"IGNORE":  0,
+		"CG_NONE": 1,
+		"PROPS":   2,
+		"SOFT":    3,
+		"FULL":    4,
+		"STRICT":  5,
+		"DEFAULT": 6,
+	}
+)
+
+func (x CriuCgMode) Enum() *CriuCgMode {
+	p := new(CriuCgMode)
+	*p = x
+	return p
+}
+
+func (x CriuCgMode) String() string {
+	name, valid := CriuCgMode_name[int32(x)]
+	if valid {
+		return name
+	}
+	return strconv.Itoa(int(x))
+}
+
+type CriuNetworkLockMethod int32
+
+const (
+	CriuNetworkLockMethod_IPTABLES CriuNetworkLockMethod = 1
+	CriuNetworkLockMethod_NFTABLES CriuNetworkLockMethod = 2
+	CriuNetworkLockMethod_SKIP     CriuNetworkLockMethod = 3
+)
+
+// Enum value maps for CriuNetworkLockMethod.
+var (
+	CriuNetworkLockMethod_name = map[int32]string{
+		1: "IPTABLES",
+		2: "NFTABLES",
+		3: "SKIP",
+	}
+	CriuNetworkLockMethod_value = map[string]int32{
+		"IPTABLES": 1,
+		"NFTABLES": 2,
+		"SKIP":     3,
+	}
+)
+
+func (x CriuNetworkLockMethod) Enum() *CriuNetworkLockMethod {
+	p := new(CriuNetworkLockMethod)
+	*p = x
+	return p
+}
+
+func (x CriuNetworkLockMethod) String() string {
+	name, valid := CriuNetworkLockMethod_name[int32(x)]
+	if valid {
+		return name
+	}
+	return strconv.Itoa(int(x))
+}
+
+type CriuPreDumpMode int32
+
+const (
+	CriuPreDumpMode_SPLICE  CriuPreDumpMode = 1
+	CriuPreDumpMode_VM_READ CriuPreDumpMode = 2
+)
+
+// Enum value maps for CriuPreDumpMode.
+var (
+	CriuPreDumpMode_name = map[int32]string{
+		1: "SPLICE",
+		2: "VM_READ",
+	}
+	CriuPreDumpMode_value = map[string]int32{
+		"SPLICE":  1,
+		"VM_READ": 2,
+	}
+)
+
+func (x CriuPreDumpMode) Enum() *CriuPreDumpMode {
+	p := new(CriuPreDumpMode)
+	*p = x
+	return p
+}
+
+func (x CriuPreDumpMode) String() string {
+	name, valid := CriuPreDumpMode_name[int32(x)]
+	if valid {
+		return name
+	}
+	return strconv.Itoa(int(x))
+}
+
+type CriuReqType int32
+
+const (
+	CriuReqType_EMPTY            CriuReqType = 0
+	CriuReqType_DUMP             CriuReqType = 1
+	CriuReqType_RESTORE          CriuReqType = 2
+	CriuReqType_CHECK            CriuReqType = 3
+	CriuReqType_PRE_DUMP         CriuReqType = 4
+	CriuReqType_PAGE_SERVER      CriuReqType = 5
+	CriuReqType_NOTIFY           CriuReqType = 6
+	CriuReqType_CPUINFO_DUMP     CriuReqType = 7
+	CriuReqType_CPUINFO_CHECK    CriuReqType = 8
+	CriuReqType_FEATURE_CHECK    CriuReqType = 9
+	CriuReqType_VERSION          CriuReqType = 10
+	CriuReqType_WAIT_PID         CriuReqType = 11
+	CriuReqType_PAGE_SERVER_CHLD CriuReqType = 12
+	CriuReqType_SINGLE_PRE_DUMP  CriuReqType = 13
+)
+
+// Enum value maps for CriuReqType.
+var (
+	CriuReqType_name = map[int32]string{
+		0:  "EMPTY",
+		1:  "DUMP",
+		2:  "RESTORE",
+		3:  "CHECK",
+		4:  "PRE_DUMP",
+		5:  "PAGE_SERVER",
+		6:  "NOTIFY",
+		7:  "CPUINFO_DUMP",
+		8:  "CPUINFO_CHECK",
+		9:  "FEATURE_CHECK",
+		10: "VERSION",
+		11: "WAIT_PID",
+		12: "PAGE_SERVER_CHLD",
+		13: "SINGLE_PRE_DUMP",
+	}
+	CriuReqType_value = map[string]int32{
+		"EMPTY":            0,
+		"DUMP":             1,
+		"RESTORE":          2,
+		"CHECK":            3,
+		"PRE_DUMP":         4,
+		"PAGE_SERVER":      5,
+		"NOTIFY":           6,
+		"CPUINFO_DUMP":     7,
+		"CPUINFO_CHECK":    8,
+		"FEATURE_CHECK":    9,
+		"VERSION":          10,
+		"WAIT_PID":         11,
+		"PAGE_SERVER_CHLD": 12,
+		"SINGLE_PRE_DUMP":  13,
+	}
+)
+
+func (x CriuReqType) Enum() *CriuReqType {
+	p := new(CriuReqType)
+	*p = x
+	return p
+}
+
+func (x CriuReqType) String() string {
+	name, valid := CriuReqType_name[int32(x)]
+	if valid {
+		return name
+	}
+	return strconv.Itoa(int(x))
+}
+
+type CriuPageServerInfo struct {
+	unknownFields []byte
+	Address       *string `protobuf:"bytes,1,opt,name=address" json:"address,omitempty"`
+	Port          *int32  `protobuf:"varint,2,opt,name=port" json:"port,omitempty"`
+	Pid           *int32  `protobuf:"varint,3,opt,name=pid" json:"pid,omitempty"`
+	Fd            *int32  `protobuf:"varint,4,opt,name=fd" json:"fd,omitempty"`
+}
+
+func (x *CriuPageServerInfo) Reset() {
+	*x = CriuPageServerInfo{}
+}
+
+func (*CriuPageServerInfo) ProtoMessage() {}
+
+func (x *CriuPageServerInfo) GetAddress() string {
+	if x != nil && x.Address != nil {
+		return *x.Address
+	}
+	return ""
+}
+
+func (x *CriuPageServerInfo) GetPort() int32 {
+	if x != nil && x.Port != nil {
+		return *x.Port
+	}
+	return 0
+}
+
+func (x *CriuPageServerInfo) GetPid() int32 {
+	if x != nil && x.Pid != nil {
+		return *x.Pid
+	}
+	return 0
+}
+
+func (x *CriuPageServerInfo) GetFd() int32 {
+	if x != nil && x.Fd != nil {
+		return *x.Fd
+	}
+	return 0
+}
+
+type CriuVethPair struct {
+	unknownFields []byte
+	IfIn          *string `protobuf:"bytes,1,req,name=if_in,json=ifIn" json:"ifIn,omitempty"`
+	IfOut         *string `protobuf:"bytes,2,req,name=if_out,json=ifOut" json:"ifOut,omitempty"`
+}
+
+func (x *CriuVethPair) Reset() {
+	*x = CriuVethPair{}
+}
+
+func (*CriuVethPair) ProtoMessage() {}
+
+func (x *CriuVethPair) GetIfIn() string {
+	if x != nil && x.IfIn != nil {
+		return *x.IfIn
+	}
+	return ""
+}
+
+func (x *CriuVethPair) GetIfOut() string {
+	if x != nil && x.IfOut != nil {
+		return *x.IfOut
+	}
+	return ""
+}
+
+type ExtMountMap struct {
+	unknownFields []byte
+	Key           *string `protobuf:"bytes,1,req,name=key" json:"key,omitempty"`
+	Val           *string `protobuf:"bytes,2,req,name=val" json:"val,omitempty"`
+}
+
+func (x *ExtMountMap) Reset() {
+	*x = ExtMountMap{}
+}
+
+func (*ExtMountMap) ProtoMessage() {}
+
+func (x *ExtMountMap) GetKey() string {
+	if x != nil && x.Key != nil {
+		return *x.Key
+	}
+	return ""
+}
+
+func (x *ExtMountMap) GetVal() string {
+	if x != nil && x.Val != nil {
+		return *x.Val
+	}
+	return ""
+}
+
+type JoinNamespace struct {
+	unknownFields []byte
+	Ns            *string `protobuf:"bytes,1,req,name=ns" json:"ns,omitempty"`
+	NsFile        *string `protobuf:"bytes,2,req,name=ns_file,json=nsFile" json:"nsFile,omitempty"`
+	ExtraOpt      *string `protobuf:"bytes,3,opt,name=extra_opt,json=extraOpt" json:"extraOpt,omitempty"`
+}
+
+func (x *JoinNamespace) Reset() {
+	*x = JoinNamespace{}
+}
+
+func (*JoinNamespace) ProtoMessage() {}
+
+func (x *JoinNamespace) GetNs() string {
+	if x != nil && x.Ns != nil {
+		return *x.Ns
+	}
+	return ""
+}
+
+func (x *JoinNamespace) GetNsFile() string {
+	if x != nil && x.NsFile != nil {
+		return *x.NsFile
+	}
+	return ""
+}
+
+func (x *JoinNamespace) GetExtraOpt() string {
+	if x != nil && x.ExtraOpt != nil {
+		return *x.ExtraOpt
+	}
+	return ""
+}
+
+type InheritFd struct {
+	unknownFields []byte
+	Key           *string `protobuf:"bytes,1,req,name=key" json:"key,omitempty"`
+	Fd            *int32  `protobuf:"varint,2,req,name=fd" json:"fd,omitempty"`
+}
+
+func (x *InheritFd) Reset() {
+	*x = InheritFd{}
+}
+
+func (*InheritFd) ProtoMessage() {}
+
+func (x *InheritFd) GetKey() string {
+	if x != nil && x.Key != nil {
+		return *x.Key
+	}
+	return ""
+}
+
+func (x *InheritFd) GetFd() int32 {
+	if x != nil && x.Fd != nil {
+		return *x.Fd
+	}
+	return 0
+}
+
+type CgroupRoot struct {
+	unknownFields []byte
+	Ctrl          *string `protobuf:"bytes,1,opt,name=ctrl" json:"ctrl,omitempty"`
+	Path          *string `protobuf:"bytes,2,req,name=path" json:"path,omitempty"`
+}
+
+func (x *CgroupRoot) Reset() {
+	*x = CgroupRoot{}
+}
+
+func (*CgroupRoot) ProtoMessage() {}
+
+func (x *CgroupRoot) GetCtrl() string {
+	if x != nil && x.Ctrl != nil {
+		return *x.Ctrl
+	}
+	return ""
+}
+
+func (x *CgroupRoot) GetPath() string {
+	if x != nil && x.Path != nil {
+		return *x.Path
+	}
+	return ""
+}
+
+type UnixSk struct {
+	unknownFields []byte
+	Inode         *uint32 `protobuf:"varint,1,req,name=inode" json:"inode,omitempty"`
+}
+
+func (x *UnixSk) Reset() {
+	*x = UnixSk{}
+}
+
+func (*UnixSk) ProtoMessage() {}
+
+func (x *UnixSk) GetInode() uint32 {
+	if x != nil && x.Inode != nil {
+		return *x.Inode
+	}
+	return 0
+}
+
+type CriuOpts struct {
+	unknownFields        []byte
+	ImagesDirFd          *int32                 `protobuf:"varint,1,req,name=images_dir_fd,json=imagesDirFd,def=-1" json:"imagesDirFd,omitempty"`
+	ImagesDir            *string                `protobuf:"bytes,68,opt,name=images_dir,json=imagesDir" json:"imagesDir,omitempty"` // used only if images_dir_fd == -1
+	Pid                  *int32                 `protobuf:"varint,2,opt,name=pid" json:"pid,omitempty"`                             // if not set on dump, will dump requesting process
+	LeaveRunning         *bool                  `protobuf:"varint,3,opt,name=leave_running,json=leaveRunning" json:"leaveRunning,omitempty"`
+	ExtUnixSk            *bool                  `protobuf:"varint,4,opt,name=ext_unix_sk,json=extUnixSk" json:"extUnixSk,omitempty"`
+	TcpEstablished       *bool                  `protobuf:"varint,5,opt,name=tcp_established,json=tcpEstablished" json:"tcpEstablished,omitempty"`
+	EvasiveDevices       *bool                  `protobuf:"varint,6,opt,name=evasive_devices,json=evasiveDevices" json:"evasiveDevices,omitempty"`
+	ShellJob             *bool                  `protobuf:"varint,7,opt,name=shell_job,json=shellJob" json:"shellJob,omitempty"`
+	FileLocks            *bool                  `protobuf:"varint,8,opt,name=file_locks,json=fileLocks" json:"fileLocks,omitempty"`
+	LogLevel             *int32                 `protobuf:"varint,9,opt,name=log_level,json=logLevel,def=2" json:"logLevel,omitempty"`
+	LogFile              *string                `protobuf:"bytes,10,opt,name=log_file,json=logFile" json:"logFile,omitempty"` // No subdirs are allowed. Consider using work-dir
+	Ps                   *CriuPageServerInfo    `protobuf:"bytes,11,opt,name=ps" json:"ps,omitempty"`
+	NotifyScripts        *bool                  `protobuf:"varint,12,opt,name=notify_scripts,json=notifyScripts" json:"notifyScripts,omitempty"`
+	Root                 *string                `protobuf:"bytes,13,opt,name=root" json:"root,omitempty"`
+	ParentImg            *string                `protobuf:"bytes,14,opt,name=parent_img,json=parentImg" json:"parentImg,omitempty"`
+	TrackMem             *bool                  `protobuf:"varint,15,opt,name=track_mem,json=trackMem" json:"trackMem,omitempty"`
+	AutoDedup            *bool                  `protobuf:"varint,16,opt,name=auto_dedup,json=autoDedup" json:"autoDedup,omitempty"`
+	WorkDirFd            *int32                 `protobuf:"varint,17,opt,name=work_dir_fd,json=workDirFd" json:"workDirFd,omitempty"`
+	LinkRemap            *bool                  `protobuf:"varint,18,opt,name=link_remap,json=linkRemap" json:"linkRemap,omitempty"`
+	Veths                []*CriuVethPair        `protobuf:"bytes,19,rep,name=veths" json:"veths,omitempty"` // DEPRECATED, use external instead
+	CpuCap               *uint32                `protobuf:"varint,20,opt,name=cpu_cap,json=cpuCap,def=4294967295" json:"cpuCap,omitempty"`
+	ForceIrmap           *bool                  `protobuf:"varint,21,opt,name=force_irmap,json=forceIrmap" json:"forceIrmap,omitempty"`
+	ExecCmd              []string               `protobuf:"bytes,22,rep,name=exec_cmd,json=execCmd" json:"execCmd,omitempty"`
+	ExtMnt               []*ExtMountMap         `protobuf:"bytes,23,rep,name=ext_mnt,json=extMnt" json:"extMnt,omitempty"`                       // DEPRECATED, use external instead
+	ManageCgroups        *bool                  `protobuf:"varint,24,opt,name=manage_cgroups,json=manageCgroups" json:"manageCgroups,omitempty"` // backward compatibility
+	CgRoot               []*CgroupRoot          `protobuf:"bytes,25,rep,name=cg_root,json=cgRoot" json:"cgRoot,omitempty"`
+	RstSibling           *bool                  `protobuf:"varint,26,opt,name=rst_sibling,json=rstSibling" json:"rstSibling,omitempty"` // swrk only
+	InheritFd            []*InheritFd           `protobuf:"bytes,27,rep,name=inherit_fd,json=inheritFd" json:"inheritFd,omitempty"`     // swrk only
+	AutoExtMnt           *bool                  `protobuf:"varint,28,opt,name=auto_ext_mnt,json=autoExtMnt" json:"autoExtMnt,omitempty"`
+	ExtSharing           *bool                  `protobuf:"varint,29,opt,name=ext_sharing,json=extSharing" json:"extSharing,omitempty"`
+	ExtMasters           *bool                  `protobuf:"varint,30,opt,name=ext_masters,json=extMasters" json:"extMasters,omitempty"`
+	SkipMnt              []string               `protobuf:"bytes,31,rep,name=skip_mnt,json=skipMnt" json:"skipMnt,omitempty"`
+	EnableFs             []string               `protobuf:"bytes,32,rep,name=enable_fs,json=enableFs" json:"enableFs,omitempty"`
+	UnixSkIno            []*UnixSk              `protobuf:"bytes,33,rep,name=unix_sk_ino,json=unixSkIno" json:"unixSkIno,omitempty"` // DEPRECATED, use external instead
+	ManageCgroupsMode    *CriuCgMode            `protobuf:"varint,34,opt,name=manage_cgroups_mode,json=manageCgroupsMode" json:"manageCgroupsMode,omitempty"`
+	GhostLimit           *uint32                `protobuf:"varint,35,opt,name=ghost_limit,json=ghostLimit,def=1048576" json:"ghostLimit,omitempty"`
+	IrmapScanPaths       []string               `protobuf:"bytes,36,rep,name=irmap_scan_paths,json=irmapScanPaths" json:"irmapScanPaths,omitempty"`
+	External             []string               `protobuf:"bytes,37,rep,name=external" json:"external,omitempty"`
+	EmptyNs              *uint32                `protobuf:"varint,38,opt,name=empty_ns,json=emptyNs" json:"emptyNs,omitempty"`
+	JoinNs               []*JoinNamespace       `protobuf:"bytes,39,rep,name=join_ns,json=joinNs" json:"joinNs,omitempty"`
+	CgroupProps          *string                `protobuf:"bytes,41,opt,name=cgroup_props,json=cgroupProps" json:"cgroupProps,omitempty"`
+	CgroupPropsFile      *string                `protobuf:"bytes,42,opt,name=cgroup_props_file,json=cgroupPropsFile" json:"cgroupPropsFile,omitempty"`
+	CgroupDumpController []string               `protobuf:"bytes,43,rep,name=cgroup_dump_controller,json=cgroupDumpController" json:"cgroupDumpController,omitempty"`
+	FreezeCgroup         *string                `protobuf:"bytes,44,opt,name=freeze_cgroup,json=freezeCgroup" json:"freezeCgroup,omitempty"`
+	Timeout              *uint32                `protobuf:"varint,45,opt,name=timeout" json:"timeout,omitempty"`
+	TcpSkipInFlight      *bool                  `protobuf:"varint,46,opt,name=tcp_skip_in_flight,json=tcpSkipInFlight" json:"tcpSkipInFlight,omitempty"`
+	WeakSysctls          *bool                  `protobuf:"varint,47,opt,name=weak_sysctls,json=weakSysctls" json:"weakSysctls,omitempty"`
+	LazyPages            *bool                  `protobuf:"varint,48,opt,name=lazy_pages,json=lazyPages" json:"lazyPages,omitempty"`
+	StatusFd             *int32                 `protobuf:"varint,49,opt,name=status_fd,json=statusFd" json:"statusFd,omitempty"`
+	OrphanPtsMaster      *bool                  `protobuf:"varint,50,opt,name=orphan_pts_master,json=orphanPtsMaster" json:"orphanPtsMaster,omitempty"`
+	ConfigFile           *string                `protobuf:"bytes,51,opt,name=config_file,json=configFile" json:"configFile,omitempty"`
+	TcpClose             *bool                  `protobuf:"varint,52,opt,name=tcp_close,json=tcpClose" json:"tcpClose,omitempty"`
+	LsmProfile           *string                `protobuf:"bytes,53,opt,name=lsm_profile,json=lsmProfile" json:"lsmProfile,omitempty"`
+	TlsCacert            *string                `protobuf:"bytes,54,opt,name=tls_cacert,json=tlsCacert" json:"tlsCacert,omitempty"`
+	TlsCacrl             *string                `protobuf:"bytes,55,opt,name=tls_cacrl,json=tlsCacrl" json:"tlsCacrl,omitempty"`
+	TlsCert              *string                `protobuf:"bytes,56,opt,name=tls_cert,json=tlsCert" json:"tlsCert,omitempty"`
+	TlsKey               *string                `protobuf:"bytes,57,opt,name=tls_key,json=tlsKey" json:"tlsKey,omitempty"`
+	Tls                  *bool                  `protobuf:"varint,58,opt,name=tls" json:"tls,omitempty"`
+	TlsNoCnVerify        *bool                  `protobuf:"varint,59,opt,name=tls_no_cn_verify,json=tlsNoCnVerify" json:"tlsNoCnVerify,omitempty"`
+	CgroupYard           *string                `protobuf:"bytes,60,opt,name=cgroup_yard,json=cgroupYard" json:"cgroupYard,omitempty"`
+	PreDumpMode          *CriuPreDumpMode       `protobuf:"varint,61,opt,name=pre_dump_mode,json=preDumpMode,def=1" json:"preDumpMode,omitempty"`
+	PidfdStoreSk         *int32                 `protobuf:"varint,62,opt,name=pidfd_store_sk,json=pidfdStoreSk" json:"pidfdStoreSk,omitempty"`
+	LsmMountContext      *string                `protobuf:"bytes,63,opt,name=lsm_mount_context,json=lsmMountContext" json:"lsmMountContext,omitempty"`
+	NetworkLock          *CriuNetworkLockMethod `protobuf:"varint,64,opt,name=network_lock,json=networkLock,def=1" json:"networkLock,omitempty"`
+	MntnsCompatMode      *bool                  `protobuf:"varint,65,opt,name=mntns_compat_mode,json=mntnsCompatMode" json:"mntnsCompatMode,omitempty"`
+	SkipFileRwxCheck     *bool                  `protobuf:"varint,66,opt,name=skip_file_rwx_check,json=skipFileRwxCheck" json:"skipFileRwxCheck,omitempty"`
+	Unprivileged         *bool                  `protobuf:"varint,67,opt,name=unprivileged" json:"unprivileged,omitempty"`
+	LeaveStopped         *bool                  `protobuf:"varint,69,opt,name=leave_stopped,json=leaveStopped" json:"leaveStopped,omitempty"`
+	DisplayStats         *bool                  `protobuf:"varint,70,opt,name=display_stats,json=displayStats" json:"displayStats,omitempty"`
+	LogToStderr          *bool                  `protobuf:"varint,71,opt,name=log_to_stderr,json=logToStderr" json:"logToStderr,omitempty"` //	optional bool			check_mounts		= 128;
+}
+
+// Default values for CriuOpts fields.
+const (
+	Default_CriuOpts_ImagesDirFd = int32(-1)
+	Default_CriuOpts_LogLevel    = int32(2)
+	Default_CriuOpts_CpuCap      = uint32(4294967295)
+	Default_CriuOpts_GhostLimit  = uint32(1048576)
+	Default_CriuOpts_PreDumpMode = CriuPreDumpMode_SPLICE
+	Default_CriuOpts_NetworkLock = CriuNetworkLockMethod_IPTABLES
+)
+
+func (x *CriuOpts) Reset() {
+	*x = CriuOpts{}
+}
+
+func (*CriuOpts) ProtoMessage() {}
+
+func (x *CriuOpts) GetImagesDirFd() int32 {
+	if x != nil && x.ImagesDirFd != nil {
+		return *x.ImagesDirFd
+	}
+	return Default_CriuOpts_ImagesDirFd
+}
+
+func (x *CriuOpts) GetImagesDir() string {
+	if x != nil && x.ImagesDir != nil {
+		return *x.ImagesDir
+	}
+	return ""
+}
+
+func (x *CriuOpts) GetPid() int32 {
+	if x != nil && x.Pid != nil {
+		return *x.Pid
+	}
+	return 0
+}
+
+func (x *CriuOpts) GetLeaveRunning() bool {
+	if x != nil && x.LeaveRunning != nil {
+		return *x.LeaveRunning
+	}
+	return false
+}
+
+func (x *CriuOpts) GetExtUnixSk() bool {
+	if x != nil && x.ExtUnixSk != nil {
+		return *x.ExtUnixSk
+	}
+	return false
+}
+
+func (x *CriuOpts) GetTcpEstablished() bool {
+	if x != nil && x.TcpEstablished != nil {
+		return *x.TcpEstablished
+	}
+	return false
+}
+
+func (x *CriuOpts) GetEvasiveDevices() bool {
+	if x != nil && x.EvasiveDevices != nil {
+		return *x.EvasiveDevices
+	}
+	return false
+}
+
+func (x *CriuOpts) GetShellJob() bool {
+	if x != nil && x.ShellJob != nil {
+		return *x.ShellJob
+	}
+	return false
+}
+
+func (x *CriuOpts) GetFileLocks() bool {
+	if x != nil && x.FileLocks != nil {
+		return *x.FileLocks
+	}
+	return false
+}
+
+func (x *CriuOpts) GetLogLevel() int32 {
+	if x != nil && x.LogLevel != nil {
+		return *x.LogLevel
+	}
+	return Default_CriuOpts_LogLevel
+}
+
+func (x *CriuOpts) GetLogFile() string {
+	if x != nil && x.LogFile != nil {
+		return *x.LogFile
+	}
+	return ""
+}
+
+func (x *CriuOpts) GetPs() *CriuPageServerInfo {
+	if x != nil {
+		return x.Ps
+	}
+	return nil
+}
+
+func (x *CriuOpts) GetNotifyScripts() bool {
+	if x != nil && x.NotifyScripts != nil {
+		return *x.NotifyScripts
+	}
+	return false
+}
+
+func (x *CriuOpts) GetRoot() string {
+	if x != nil && x.Root != nil {
+		return *x.Root
+	}
+	return ""
+}
+
+func (x *CriuOpts) GetParentImg() string {
+	if x != nil && x.ParentImg != nil {
+		return *x.ParentImg
+	}
+	return ""
+}
+
+func (x *CriuOpts) GetTrackMem() bool {
+	if x != nil && x.TrackMem != nil {
+		return *x.TrackMem
+	}
+	return false
+}
+
+func (x *CriuOpts) GetAutoDedup() bool {
+	if x != nil && x.AutoDedup != nil {
+		return *x.AutoDedup
+	}
+	return false
+}
+
+func (x *CriuOpts) GetWorkDirFd() int32 {
+	if x != nil && x.WorkDirFd != nil {
+		return *x.WorkDirFd
+	}
+	return 0
+}
+
+func (x *CriuOpts) GetLinkRemap() bool {
+	if x != nil && x.LinkRemap != nil {
+		return *x.LinkRemap
+	}
+	return false
+}
+
+func (x *CriuOpts) GetVeths() []*CriuVethPair {
+	if x != nil {
+		return x.Veths
+	}
+	return nil
+}
+
+func (x *CriuOpts) GetCpuCap() uint32 {
+	if x != nil && x.CpuCap != nil {
+		return *x.CpuCap
+	}
+	return Default_CriuOpts_CpuCap
+}
+
+func (x *CriuOpts) GetForceIrmap() bool {
+	if x != nil && x.ForceIrmap != nil {
+		return *x.ForceIrmap
+	}
+	return false
+}
+
+func (x *CriuOpts) GetExecCmd() []string {
+	if x != nil {
+		return x.ExecCmd
+	}
+	return nil
+}
+
+func (x *CriuOpts) GetExtMnt() []*ExtMountMap {
+	if x != nil {
+		return x.ExtMnt
+	}
+	return nil
+}
+
+func (x *CriuOpts) GetManageCgroups() bool {
+	if x != nil && x.ManageCgroups != nil {
+		return *x.ManageCgroups
+	}
+	return false
+}
+
+func (x *CriuOpts) GetCgRoot() []*CgroupRoot {
+	if x != nil {
+		return x.CgRoot
+	}
+	return nil
+}
+
+func (x *CriuOpts) GetRstSibling() bool {
+	if x != nil && x.RstSibling != nil {
+		return *x.RstSibling
+	}
+	return false
+}
+
+func (x *CriuOpts) GetInheritFd() []*InheritFd {
+	if x != nil {
+		return x.InheritFd
+	}
+	return nil
+}
+
+func (x *CriuOpts) GetAutoExtMnt() bool {
+	if x != nil && x.AutoExtMnt != nil {
+		return *x.AutoExtMnt
+	}
+	return false
+}
+
+func (x *CriuOpts) GetExtSharing() bool {
+	if x != nil && x.ExtSharing != nil {
+		return *x.ExtSharing
+	}
+	return false
+}
+
+func (x *CriuOpts) GetExtMasters() bool {
+	if x != nil && x.ExtMasters != nil {
+		return *x.ExtMasters
+	}
+	return false
+}
+
+func (x *CriuOpts) GetSkipMnt() []string {
+	if x != nil {
+		return x.SkipMnt
+	}
+	return nil
+}
+
+func (x *CriuOpts) GetEnableFs() []string {
+	if x != nil {
+		return x.EnableFs
+	}
+	return nil
+}
+
+func (x *CriuOpts) GetUnixSkIno() []*UnixSk {
+	if x != nil {
+		return x.UnixSkIno
+	}
+	return nil
+}
+
+func (x *CriuOpts) GetManageCgroupsMode() CriuCgMode {
+	if x != nil && x.ManageCgroupsMode != nil {
+		return *x.ManageCgroupsMode
+	}
+	return CriuCgMode_IGNORE
+}
+
+func (x *CriuOpts) GetGhostLimit() uint32 {
+	if x != nil && x.GhostLimit != nil {
+		return *x.GhostLimit
+	}
+	return Default_CriuOpts_GhostLimit
+}
+
+func (x *CriuOpts) GetIrmapScanPaths() []string {
+	if x != nil {
+		return x.IrmapScanPaths
+	}
+	return nil
+}
+
+func (x *CriuOpts) GetExternal() []string {
+	if x != nil {
+		return x.External
+	}
+	return nil
+}
+
+func (x *CriuOpts) GetEmptyNs() uint32 {
+	if x != nil && x.EmptyNs != nil {
+		return *x.EmptyNs
+	}
+	return 0
+}
+
+func (x *CriuOpts) GetJoinNs() []*JoinNamespace {
+	if x != nil {
+		return x.JoinNs
+	}
+	return nil
+}
+
+func (x *CriuOpts) GetCgroupProps() string {
+	if x != nil && x.CgroupProps != nil {
+		return *x.CgroupProps
+	}
+	return ""
+}
+
+func (x *CriuOpts) GetCgroupPropsFile() string {
+	if x != nil && x.CgroupPropsFile != nil {
+		return *x.CgroupPropsFile
+	}
+	return ""
+}
+
+func (x *CriuOpts) GetCgroupDumpController() []string {
+	if x != nil {
+		return x.CgroupDumpController
+	}
+	return nil
+}
+
+func (x *CriuOpts) GetFreezeCgroup() string {
+	if x != nil && x.FreezeCgroup != nil {
+		return *x.FreezeCgroup
+	}
+	return ""
+}
+
+func (x *CriuOpts) GetTimeout() uint32 {
+	if x != nil && x.Timeout != nil {
+		return *x.Timeout
+	}
+	return 0
+}
+
+func (x *CriuOpts) GetTcpSkipInFlight() bool {
+	if x != nil && x.TcpSkipInFlight != nil {
+		return *x.TcpSkipInFlight
+	}
+	return false
+}
+
+func (x *CriuOpts) GetWeakSysctls() bool {
+	if x != nil && x.WeakSysctls != nil {
+		return *x.WeakSysctls
+	}
+	return false
+}
+
+func (x *CriuOpts) GetLazyPages() bool {
+	if x != nil && x.LazyPages != nil {
+		return *x.LazyPages
+	}
+	return false
+}
+
+func (x *CriuOpts) GetStatusFd() int32 {
+	if x != nil && x.StatusFd != nil {
+		return *x.StatusFd
+	}
+	return 0
+}
+
+func (x *CriuOpts) GetOrphanPtsMaster() bool {
+	if x != nil && x.OrphanPtsMaster != nil {
+		return *x.OrphanPtsMaster
+	}
+	return false
+}
+
+func (x *CriuOpts) GetConfigFile() string {
+	if x != nil && x.ConfigFile != nil {
+		return *x.ConfigFile
+	}
+	return ""
+}
+
+func (x *CriuOpts) GetTcpClose() bool {
+	if x != nil && x.TcpClose != nil {
+		return *x.TcpClose
+	}
+	return false
+}
+
+func (x *CriuOpts) GetLsmProfile() string {
+	if x != nil && x.LsmProfile != nil {
+		return *x.LsmProfile
+	}
+	return ""
+}
+
+func (x *CriuOpts) GetTlsCacert() string {
+	if x != nil && x.TlsCacert != nil {
+		return *x.TlsCacert
+	}
+	return ""
+}
+
+func (x *CriuOpts) GetTlsCacrl() string {
+	if x != nil && x.TlsCacrl != nil {
+		return *x.TlsCacrl
+	}
+	return ""
+}
+
+func (x *CriuOpts) GetTlsCert() string {
+	if x != nil && x.TlsCert != nil {
+		return *x.TlsCert
+	}
+	return ""
+}
+
+func (x *CriuOpts) GetTlsKey() string {
+	if x != nil && x.TlsKey != nil {
+		return *x.TlsKey
+	}
+	return ""
+}
+
+func (x *CriuOpts) GetTls() bool {
+	if x != nil && x.Tls != nil {
+		return *x.Tls
+	}
+	return false
+}
+
+func (x *CriuOpts) GetTlsNoCnVerify() bool {
+	if x != nil && x.TlsNoCnVerify != nil {
+		return *x.TlsNoCnVerify
+	}
+	return false
+}
+
+func (x *CriuOpts) GetCgroupYard() string {
+	if x != nil && x.CgroupYard != nil {
+		return *x.CgroupYard
+	}
+	return ""
+}
+
+func (x *CriuOpts) GetPreDumpMode() CriuPreDumpMode {
+	if x != nil && x.PreDumpMode != nil {
+		return *x.PreDumpMode
+	}
+	return Default_CriuOpts_PreDumpMode
+}
+
+func (x *CriuOpts) GetPidfdStoreSk() int32 {
+	if x != nil && x.PidfdStoreSk != nil {
+		return *x.PidfdStoreSk
+	}
+	return 0
+}
+
+func (x *CriuOpts) GetLsmMountContext() string {
+	if x != nil && x.LsmMountContext != nil {
+		return *x.LsmMountContext
+	}
+	return ""
+}
+
+func (x *CriuOpts) GetNetworkLock() CriuNetworkLockMethod {
+	if x != nil && x.NetworkLock != nil {
+		return *x.NetworkLock
+	}
+	return Default_CriuOpts_NetworkLock
+}
+
+func (x *CriuOpts) GetMntnsCompatMode() bool {
+	if x != nil && x.MntnsCompatMode != nil {
+		return *x.MntnsCompatMode
+	}
+	return false
+}
+
+func (x *CriuOpts) GetSkipFileRwxCheck() bool {
+	if x != nil && x.SkipFileRwxCheck != nil {
+		return *x.SkipFileRwxCheck
+	}
+	return false
+}
+
+func (x *CriuOpts) GetUnprivileged() bool {
+	if x != nil && x.Unprivileged != nil {
+		return *x.Unprivileged
+	}
+	return false
+}
+
+func (x *CriuOpts) GetLeaveStopped() bool {
+	if x != nil && x.LeaveStopped != nil {
+		return *x.LeaveStopped
+	}
+	return false
+}
+
+func (x *CriuOpts) GetDisplayStats() bool {
+	if x != nil && x.DisplayStats != nil {
+		return *x.DisplayStats
+	}
+	return false
+}
+
+func (x *CriuOpts) GetLogToStderr() bool {
+	if x != nil && x.LogToStderr != nil {
+		return *x.LogToStderr
+	}
+	return false
+}
+
+type CriuDumpResp struct {
+	unknownFields []byte
+	Restored      *bool `protobuf:"varint,1,opt,name=restored" json:"restored,omitempty"`
+}
+
+func (x *CriuDumpResp) Reset() {
+	*x = CriuDumpResp{}
+}
+
+func (*CriuDumpResp) ProtoMessage() {}
+
+func (x *CriuDumpResp) GetRestored() bool {
+	if x != nil && x.Restored != nil {
+		return *x.Restored
+	}
+	return false
+}
+
+type CriuRestoreResp struct {
+	unknownFields []byte
+	Pid           *int32 `protobuf:"varint,1,req,name=pid" json:"pid,omitempty"`
+}
+
+func (x *CriuRestoreResp) Reset() {
+	*x = CriuRestoreResp{}
+}
+
+func (*CriuRestoreResp) ProtoMessage() {}
+
+func (x *CriuRestoreResp) GetPid() int32 {
+	if x != nil && x.Pid != nil {
+		return *x.Pid
+	}
+	return 0
+}
+
+type CriuNotify struct {
+	unknownFields []byte
+	Script        *string `protobuf:"bytes,1,opt,name=script" json:"script,omitempty"`
+	Pid           *int32  `protobuf:"varint,2,opt,name=pid" json:"pid,omitempty"`
+}
+
+func (x *CriuNotify) Reset() {
+	*x = CriuNotify{}
+}
+
+func (*CriuNotify) ProtoMessage() {}
+
+func (x *CriuNotify) GetScript() string {
+	if x != nil && x.Script != nil {
+		return *x.Script
+	}
+	return ""
+}
+
+func (x *CriuNotify) GetPid() int32 {
+	if x != nil && x.Pid != nil {
+		return *x.Pid
+	}
+	return 0
+}
+
+// List of features which can queried via
+// CRIU_REQ_TYPE__FEATURE_CHECK
+type CriuFeatures struct {
+	unknownFields []byte
+	MemTrack      *bool `protobuf:"varint,1,opt,name=mem_track,json=memTrack" json:"memTrack,omitempty"`
+	LazyPages     *bool `protobuf:"varint,2,opt,name=lazy_pages,json=lazyPages" json:"lazyPages,omitempty"`
+	PidfdStore    *bool `protobuf:"varint,3,opt,name=pidfd_store,json=pidfdStore" json:"pidfdStore,omitempty"`
+}
+
+func (x *CriuFeatures) Reset() {
+	*x = CriuFeatures{}
+}
+
+func (*CriuFeatures) ProtoMessage() {}
+
+func (x *CriuFeatures) GetMemTrack() bool {
+	if x != nil && x.MemTrack != nil {
+		return *x.MemTrack
+	}
+	return false
+}
+
+func (x *CriuFeatures) GetLazyPages() bool {
+	if x != nil && x.LazyPages != nil {
+		return *x.LazyPages
+	}
+	return false
+}
+
+func (x *CriuFeatures) GetPidfdStore() bool {
+	if x != nil && x.PidfdStore != nil {
+		return *x.PidfdStore
+	}
+	return false
+}
+
+type CriuReq struct {
+	unknownFields []byte
+	Type          *CriuReqType `protobuf:"varint,1,req,name=type" json:"type,omitempty"`
+	Opts          *CriuOpts    `protobuf:"bytes,2,opt,name=opts" json:"opts,omitempty"`
+	NotifySuccess *bool        `protobuf:"varint,3,opt,name=notify_success,json=notifySuccess" json:"notifySuccess,omitempty"`
+	// When set service won't close the connection but
+	// will wait for more req-s to appear. Works not
+	// for all request types.
+	KeepOpen *bool `protobuf:"varint,4,opt,name=keep_open,json=keepOpen" json:"keepOpen,omitempty"`
+	// 'features' can be used to query which features
+	// are supported by the installed criu/kernel
+	// via RPC.
+	Features *CriuFeatures `protobuf:"bytes,5,opt,name=features" json:"features,omitempty"`
+	// 'pid' is used for WAIT_PID
+	Pid *uint32 `protobuf:"varint,6,opt,name=pid" json:"pid,omitempty"`
+}
+
+func (x *CriuReq) Reset() {
+	*x = CriuReq{}
+}
+
+func (*CriuReq) ProtoMessage() {}
+
+func (x *CriuReq) GetType() CriuReqType {
+	if x != nil && x.Type != nil {
+		return *x.Type
+	}
+	return CriuReqType_EMPTY
+}
+
+func (x *CriuReq) GetOpts() *CriuOpts {
+	if x != nil {
+		return x.Opts
+	}
+	return nil
+}
+
+func (x *CriuReq) GetNotifySuccess() bool {
+	if x != nil && x.NotifySuccess != nil {
+		return *x.NotifySuccess
+	}
+	return false
+}
+
+func (x *CriuReq) GetKeepOpen() bool {
+	if x != nil && x.KeepOpen != nil {
+		return *x.KeepOpen
+	}
+	return false
+}
+
+func (x *CriuReq) GetFeatures() *CriuFeatures {
+	if x != nil {
+		return x.Features
+	}
+	return nil
+}
+
+func (x *CriuReq) GetPid() uint32 {
+	if x != nil && x.Pid != nil {
+		return *x.Pid
+	}
+	return 0
+}
+
+type CriuResp struct {
+	unknownFields []byte
+	Type          *CriuReqType        `protobuf:"varint,1,req,name=type" json:"type,omitempty"`
+	Success       *bool               `protobuf:"varint,2,req,name=success" json:"success,omitempty"`
+	Dump          *CriuDumpResp       `protobuf:"bytes,3,opt,name=dump" json:"dump,omitempty"`
+	Restore       *CriuRestoreResp    `protobuf:"bytes,4,opt,name=restore" json:"restore,omitempty"`
+	Notify        *CriuNotify         `protobuf:"bytes,5,opt,name=notify" json:"notify,omitempty"`
+	Ps            *CriuPageServerInfo `protobuf:"bytes,6,opt,name=ps" json:"ps,omitempty"`
+	CrErrno       *int32              `protobuf:"varint,7,opt,name=cr_errno,json=crErrno" json:"crErrno,omitempty"`
+	Features      *CriuFeatures       `protobuf:"bytes,8,opt,name=features" json:"features,omitempty"`
+	CrErrmsg      *string             `protobuf:"bytes,9,opt,name=cr_errmsg,json=crErrmsg" json:"crErrmsg,omitempty"`
+	Version       *CriuVersion        `protobuf:"bytes,10,opt,name=version" json:"version,omitempty"`
+	Status        *int32              `protobuf:"varint,11,opt,name=status" json:"status,omitempty"`
+}
+
+func (x *CriuResp) Reset() {
+	*x = CriuResp{}
+}
+
+func (*CriuResp) ProtoMessage() {}
+
+func (x *CriuResp) GetType() CriuReqType {
+	if x != nil && x.Type != nil {
+		return *x.Type
+	}
+	return CriuReqType_EMPTY
+}
+
+func (x *CriuResp) GetSuccess() bool {
+	if x != nil && x.Success != nil {
+		return *x.Success
+	}
+	return false
+}
+
+func (x *CriuResp) GetDump() *CriuDumpResp {
+	if x != nil {
+		return x.Dump
+	}
+	return nil
+}
+
+func (x *CriuResp) GetRestore() *CriuRestoreResp {
+	if x != nil {
+		return x.Restore
+	}
+	return nil
+}
+
+func (x *CriuResp) GetNotify() *CriuNotify {
+	if x != nil {
+		return x.Notify
+	}
+	return nil
+}
+
+func (x *CriuResp) GetPs() *CriuPageServerInfo {
+	if x != nil {
+		return x.Ps
+	}
+	return nil
+}
+
+func (x *CriuResp) GetCrErrno() int32 {
+	if x != nil && x.CrErrno != nil {
+		return *x.CrErrno
+	}
+	return 0
+}
+
+func (x *CriuResp) GetFeatures() *CriuFeatures {
+	if x != nil {
+		return x.Features
+	}
+	return nil
+}
+
+func (x *CriuResp) GetCrErrmsg() string {
+	if x != nil && x.CrErrmsg != nil {
+		return *x.CrErrmsg
+	}
+	return ""
+}
+
+func (x *CriuResp) GetVersion() *CriuVersion {
+	if x != nil {
+		return x.Version
+	}
+	return nil
+}
+
+func (x *CriuResp) GetStatus() int32 {
+	if x != nil && x.Status != nil {
+		return *x.Status
+	}
+	return 0
+}
+
+// Answer for criu_req_type.VERSION requests
+type CriuVersion struct {
+	unknownFields []byte
+	MajorNumber   *int32  `protobuf:"varint,1,req,name=major_number,json=majorNumber" json:"majorNumber,omitempty"`
+	MinorNumber   *int32  `protobuf:"varint,2,req,name=minor_number,json=minorNumber" json:"minorNumber,omitempty"`
+	Gitid         *string `protobuf:"bytes,3,opt,name=gitid" json:"gitid,omitempty"`
+	Sublevel      *int32  `protobuf:"varint,4,opt,name=sublevel" json:"sublevel,omitempty"`
+	Extra         *int32  `protobuf:"varint,5,opt,name=extra" json:"extra,omitempty"`
+	Name          *string `protobuf:"bytes,6,opt,name=name" json:"name,omitempty"`
+}
+
+func (x *CriuVersion) Reset() {
+	*x = CriuVersion{}
+}
+
+func (*CriuVersion) ProtoMessage() {}
+
+func (x *CriuVersion) GetMajorNumber() int32 {
+	if x != nil && x.MajorNumber != nil {
+		return *x.MajorNumber
+	}
+	return 0
+}
+
+func (x *CriuVersion) GetMinorNumber() int32 {
+	if x != nil && x.MinorNumber != nil {
+		return *x.MinorNumber
+	}
+	return 0
+}
+
+func (x *CriuVersion) GetGitid() string {
+	if x != nil && x.Gitid != nil {
+		return *x.Gitid
+	}
+	return ""
+}
+
+func (x *CriuVersion) GetSublevel() int32 {
+	if x != nil && x.Sublevel != nil {
+		return *x.Sublevel
+	}
+	return 0
+}
+
+func (x *CriuVersion) GetExtra() int32 {
+	if x != nil && x.Extra != nil {
+		return *x.Extra
+	}
+	return 0
+}
+
+func (x *CriuVersion) GetName() string {
+	if x != nil && x.Name != nil {
+		return *x.Name
+	}
+	return ""
+}
+
+func (m *CriuPageServerInfo) CloneVT() *CriuPageServerInfo {
+	if m == nil {
+		return (*CriuPageServerInfo)(nil)
+	}
+	r := new(CriuPageServerInfo)
+	if rhs := m.Address; rhs != nil {
+		tmpVal := *rhs
+		r.Address = &tmpVal
+	}
+	if rhs := m.Port; rhs != nil {
+		tmpVal := *rhs
+		r.Port = &tmpVal
+	}
+	if rhs := m.Pid; rhs != nil {
+		tmpVal := *rhs
+		r.Pid = &tmpVal
+	}
+	if rhs := m.Fd; rhs != nil {
+		tmpVal := *rhs
+		r.Fd = &tmpVal
+	}
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = slices.Clone(m.unknownFields)
+	}
+	return r
+}
+
+func (m *CriuPageServerInfo) CloneMessageVT() protobuf_go_lite.CloneMessage {
+	return m.CloneVT()
+}
+
+func (m *CriuVethPair) CloneVT() *CriuVethPair {
+	if m == nil {
+		return (*CriuVethPair)(nil)
+	}
+	r := new(CriuVethPair)
+	if rhs := m.IfIn; rhs != nil {
+		tmpVal := *rhs
+		r.IfIn = &tmpVal
+	}
+	if rhs := m.IfOut; rhs != nil {
+		tmpVal := *rhs
+		r.IfOut = &tmpVal
+	}
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = slices.Clone(m.unknownFields)
+	}
+	return r
+}
+
+func (m *CriuVethPair) CloneMessageVT() protobuf_go_lite.CloneMessage {
+	return m.CloneVT()
+}
+
+func (m *ExtMountMap) CloneVT() *ExtMountMap {
+	if m == nil {
+		return (*ExtMountMap)(nil)
+	}
+	r := new(ExtMountMap)
+	if rhs := m.Key; rhs != nil {
+		tmpVal := *rhs
+		r.Key = &tmpVal
+	}
+	if rhs := m.Val; rhs != nil {
+		tmpVal := *rhs
+		r.Val = &tmpVal
+	}
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = slices.Clone(m.unknownFields)
+	}
+	return r
+}
+
+func (m *ExtMountMap) CloneMessageVT() protobuf_go_lite.CloneMessage {
+	return m.CloneVT()
+}
+
+func (m *JoinNamespace) CloneVT() *JoinNamespace {
+	if m == nil {
+		return (*JoinNamespace)(nil)
+	}
+	r := new(JoinNamespace)
+	if rhs := m.Ns; rhs != nil {
+		tmpVal := *rhs
+		r.Ns = &tmpVal
+	}
+	if rhs := m.NsFile; rhs != nil {
+		tmpVal := *rhs
+		r.NsFile = &tmpVal
+	}
+	if rhs := m.ExtraOpt; rhs != nil {
+		tmpVal := *rhs
+		r.ExtraOpt = &tmpVal
+	}
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = slices.Clone(m.unknownFields)
+	}
+	return r
+}
+
+func (m *JoinNamespace) CloneMessageVT() protobuf_go_lite.CloneMessage {
+	return m.CloneVT()
+}
+
+func (m *InheritFd) CloneVT() *InheritFd {
+	if m == nil {
+		return (*InheritFd)(nil)
+	}
+	r := new(InheritFd)
+	if rhs := m.Key; rhs != nil {
+		tmpVal := *rhs
+		r.Key = &tmpVal
+	}
+	if rhs := m.Fd; rhs != nil {
+		tmpVal := *rhs
+		r.Fd = &tmpVal
+	}
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = slices.Clone(m.unknownFields)
+	}
+	return r
+}
+
+func (m *InheritFd) CloneMessageVT() protobuf_go_lite.CloneMessage {
+	return m.CloneVT()
+}
+
+func (m *CgroupRoot) CloneVT() *CgroupRoot {
+	if m == nil {
+		return (*CgroupRoot)(nil)
+	}
+	r := new(CgroupRoot)
+	if rhs := m.Ctrl; rhs != nil {
+		tmpVal := *rhs
+		r.Ctrl = &tmpVal
+	}
+	if rhs := m.Path; rhs != nil {
+		tmpVal := *rhs
+		r.Path = &tmpVal
+	}
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = slices.Clone(m.unknownFields)
+	}
+	return r
+}
+
+func (m *CgroupRoot) CloneMessageVT() protobuf_go_lite.CloneMessage {
+	return m.CloneVT()
+}
+
+func (m *UnixSk) CloneVT() *UnixSk {
+	if m == nil {
+		return (*UnixSk)(nil)
+	}
+	r := new(UnixSk)
+	if rhs := m.Inode; rhs != nil {
+		tmpVal := *rhs
+		r.Inode = &tmpVal
+	}
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = slices.Clone(m.unknownFields)
+	}
+	return r
+}
+
+func (m *UnixSk) CloneMessageVT() protobuf_go_lite.CloneMessage {
+	return m.CloneVT()
+}
+
+func (m *CriuOpts) CloneVT() *CriuOpts {
+	if m == nil {
+		return (*CriuOpts)(nil)
+	}
+	r := new(CriuOpts)
+	r.Ps = m.Ps.CloneVT()
+	if rhs := m.ImagesDirFd; rhs != nil {
+		tmpVal := *rhs
+		r.ImagesDirFd = &tmpVal
+	}
+	if rhs := m.ImagesDir; rhs != nil {
+		tmpVal := *rhs
+		r.ImagesDir = &tmpVal
+	}
+	if rhs := m.Pid; rhs != nil {
+		tmpVal := *rhs
+		r.Pid = &tmpVal
+	}
+	if rhs := m.LeaveRunning; rhs != nil {
+		tmpVal := *rhs
+		r.LeaveRunning = &tmpVal
+	}
+	if rhs := m.ExtUnixSk; rhs != nil {
+		tmpVal := *rhs
+		r.ExtUnixSk = &tmpVal
+	}
+	if rhs := m.TcpEstablished; rhs != nil {
+		tmpVal := *rhs
+		r.TcpEstablished = &tmpVal
+	}
+	if rhs := m.EvasiveDevices; rhs != nil {
+		tmpVal := *rhs
+		r.EvasiveDevices = &tmpVal
+	}
+	if rhs := m.ShellJob; rhs != nil {
+		tmpVal := *rhs
+		r.ShellJob = &tmpVal
+	}
+	if rhs := m.FileLocks; rhs != nil {
+		tmpVal := *rhs
+		r.FileLocks = &tmpVal
+	}
+	if rhs := m.LogLevel; rhs != nil {
+		tmpVal := *rhs
+		r.LogLevel = &tmpVal
+	}
+	if rhs := m.LogFile; rhs != nil {
+		tmpVal := *rhs
+		r.LogFile = &tmpVal
+	}
+	if rhs := m.NotifyScripts; rhs != nil {
+		tmpVal := *rhs
+		r.NotifyScripts = &tmpVal
+	}
+	if rhs := m.Root; rhs != nil {
+		tmpVal := *rhs
+		r.Root = &tmpVal
+	}
+	if rhs := m.ParentImg; rhs != nil {
+		tmpVal := *rhs
+		r.ParentImg = &tmpVal
+	}
+	if rhs := m.TrackMem; rhs != nil {
+		tmpVal := *rhs
+		r.TrackMem = &tmpVal
+	}
+	if rhs := m.AutoDedup; rhs != nil {
+		tmpVal := *rhs
+		r.AutoDedup = &tmpVal
+	}
+	if rhs := m.WorkDirFd; rhs != nil {
+		tmpVal := *rhs
+		r.WorkDirFd = &tmpVal
+	}
+	if rhs := m.LinkRemap; rhs != nil {
+		tmpVal := *rhs
+		r.LinkRemap = &tmpVal
+	}
+	if rhs := m.Veths; rhs != nil {
+		r.Veths = make([]*CriuVethPair, len(rhs))
+		for k, v := range rhs {
+			r.Veths[k] = v.CloneVT()
+		}
+	}
+	if rhs := m.CpuCap; rhs != nil {
+		tmpVal := *rhs
+		r.CpuCap = &tmpVal
+	}
+	if rhs := m.ForceIrmap; rhs != nil {
+		tmpVal := *rhs
+		r.ForceIrmap = &tmpVal
+	}
+	if rhs := m.ExecCmd; rhs != nil {
+		r.ExecCmd = slices.Clone(rhs)
+	}
+	if rhs := m.ExtMnt; rhs != nil {
+		r.ExtMnt = make([]*ExtMountMap, len(rhs))
+		for k, v := range rhs {
+			r.ExtMnt[k] = v.CloneVT()
+		}
+	}
+	if rhs := m.ManageCgroups; rhs != nil {
+		tmpVal := *rhs
+		r.ManageCgroups = &tmpVal
+	}
+	if rhs := m.CgRoot; rhs != nil {
+		r.CgRoot = make([]*CgroupRoot, len(rhs))
+		for k, v := range rhs {
+			r.CgRoot[k] = v.CloneVT()
+		}
+	}
+	if rhs := m.RstSibling; rhs != nil {
+		tmpVal := *rhs
+		r.RstSibling = &tmpVal
+	}
+	if rhs := m.InheritFd; rhs != nil {
+		r.InheritFd = make([]*InheritFd, len(rhs))
+		for k, v := range rhs {
+			r.InheritFd[k] = v.CloneVT()
+		}
+	}
+	if rhs := m.AutoExtMnt; rhs != nil {
+		tmpVal := *rhs
+		r.AutoExtMnt = &tmpVal
+	}
+	if rhs := m.ExtSharing; rhs != nil {
+		tmpVal := *rhs
+		r.ExtSharing = &tmpVal
+	}
+	if rhs := m.ExtMasters; rhs != nil {
+		tmpVal := *rhs
+		r.ExtMasters = &tmpVal
+	}
+	if rhs := m.SkipMnt; rhs != nil {
+		r.SkipMnt = slices.Clone(rhs)
+	}
+	if rhs := m.EnableFs; rhs != nil {
+		r.EnableFs = slices.Clone(rhs)
+	}
+	if rhs := m.UnixSkIno; rhs != nil {
+		r.UnixSkIno = make([]*UnixSk, len(rhs))
+		for k, v := range rhs {
+			r.UnixSkIno[k] = v.CloneVT()
+		}
+	}
+	if rhs := m.ManageCgroupsMode; rhs != nil {
+		tmpVal := *rhs
+		r.ManageCgroupsMode = &tmpVal
+	}
+	if rhs := m.GhostLimit; rhs != nil {
+		tmpVal := *rhs
+		r.GhostLimit = &tmpVal
+	}
+	if rhs := m.IrmapScanPaths; rhs != nil {
+		r.IrmapScanPaths = slices.Clone(rhs)
+	}
+	if rhs := m.External; rhs != nil {
+		r.External = slices.Clone(rhs)
+	}
+	if rhs := m.EmptyNs; rhs != nil {
+		tmpVal := *rhs
+		r.EmptyNs = &tmpVal
+	}
+	if rhs := m.JoinNs; rhs != nil {
+		r.JoinNs = make([]*JoinNamespace, len(rhs))
+		for k, v := range rhs {
+			r.JoinNs[k] = v.CloneVT()
+		}
+	}
+	if rhs := m.CgroupProps; rhs != nil {
+		tmpVal := *rhs
+		r.CgroupProps = &tmpVal
+	}
+	if rhs := m.CgroupPropsFile; rhs != nil {
+		tmpVal := *rhs
+		r.CgroupPropsFile = &tmpVal
+	}
+	if rhs := m.CgroupDumpController; rhs != nil {
+		r.CgroupDumpController = slices.Clone(rhs)
+	}
+	if rhs := m.FreezeCgroup; rhs != nil {
+		tmpVal := *rhs
+		r.FreezeCgroup = &tmpVal
+	}
+	if rhs := m.Timeout; rhs != nil {
+		tmpVal := *rhs
+		r.Timeout = &tmpVal
+	}
+	if rhs := m.TcpSkipInFlight; rhs != nil {
+		tmpVal := *rhs
+		r.TcpSkipInFlight = &tmpVal
+	}
+	if rhs := m.WeakSysctls; rhs != nil {
+		tmpVal := *rhs
+		r.WeakSysctls = &tmpVal
+	}
+	if rhs := m.LazyPages; rhs != nil {
+		tmpVal := *rhs
+		r.LazyPages = &tmpVal
+	}
+	if rhs := m.StatusFd; rhs != nil {
+		tmpVal := *rhs
+		r.StatusFd = &tmpVal
+	}
+	if rhs := m.OrphanPtsMaster; rhs != nil {
+		tmpVal := *rhs
+		r.OrphanPtsMaster = &tmpVal
+	}
+	if rhs := m.ConfigFile; rhs != nil {
+		tmpVal := *rhs
+		r.ConfigFile = &tmpVal
+	}
+	if rhs := m.TcpClose; rhs != nil {
+		tmpVal := *rhs
+		r.TcpClose = &tmpVal
+	}
+	if rhs := m.LsmProfile; rhs != nil {
+		tmpVal := *rhs
+		r.LsmProfile = &tmpVal
+	}
+	if rhs := m.TlsCacert; rhs != nil {
+		tmpVal := *rhs
+		r.TlsCacert = &tmpVal
+	}
+	if rhs := m.TlsCacrl; rhs != nil {
+		tmpVal := *rhs
+		r.TlsCacrl = &tmpVal
+	}
+	if rhs := m.TlsCert; rhs != nil {
+		tmpVal := *rhs
+		r.TlsCert = &tmpVal
+	}
+	if rhs := m.TlsKey; rhs != nil {
+		tmpVal := *rhs
+		r.TlsKey = &tmpVal
+	}
+	if rhs := m.Tls; rhs != nil {
+		tmpVal := *rhs
+		r.Tls = &tmpVal
+	}
+	if rhs := m.TlsNoCnVerify; rhs != nil {
+		tmpVal := *rhs
+		r.TlsNoCnVerify = &tmpVal
+	}
+	if rhs := m.CgroupYard; rhs != nil {
+		tmpVal := *rhs
+		r.CgroupYard = &tmpVal
+	}
+	if rhs := m.PreDumpMode; rhs != nil {
+		tmpVal := *rhs
+		r.PreDumpMode = &tmpVal
+	}
+	if rhs := m.PidfdStoreSk; rhs != nil {
+		tmpVal := *rhs
+		r.PidfdStoreSk = &tmpVal
+	}
+	if rhs := m.LsmMountContext; rhs != nil {
+		tmpVal := *rhs
+		r.LsmMountContext = &tmpVal
+	}
+	if rhs := m.NetworkLock; rhs != nil {
+		tmpVal := *rhs
+		r.NetworkLock = &tmpVal
+	}
+	if rhs := m.MntnsCompatMode; rhs != nil {
+		tmpVal := *rhs
+		r.MntnsCompatMode = &tmpVal
+	}
+	if rhs := m.SkipFileRwxCheck; rhs != nil {
+		tmpVal := *rhs
+		r.SkipFileRwxCheck = &tmpVal
+	}
+	if rhs := m.Unprivileged; rhs != nil {
+		tmpVal := *rhs
+		r.Unprivileged = &tmpVal
+	}
+	if rhs := m.LeaveStopped; rhs != nil {
+		tmpVal := *rhs
+		r.LeaveStopped = &tmpVal
+	}
+	if rhs := m.DisplayStats; rhs != nil {
+		tmpVal := *rhs
+		r.DisplayStats = &tmpVal
+	}
+	if rhs := m.LogToStderr; rhs != nil {
+		tmpVal := *rhs
+		r.LogToStderr = &tmpVal
+	}
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = slices.Clone(m.unknownFields)
+	}
+	return r
+}
+
+func (m *CriuOpts) CloneMessageVT() protobuf_go_lite.CloneMessage {
+	return m.CloneVT()
+}
+
+func (m *CriuDumpResp) CloneVT() *CriuDumpResp {
+	if m == nil {
+		return (*CriuDumpResp)(nil)
+	}
+	r := new(CriuDumpResp)
+	if rhs := m.Restored; rhs != nil {
+		tmpVal := *rhs
+		r.Restored = &tmpVal
+	}
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = slices.Clone(m.unknownFields)
+	}
+	return r
+}
+
+func (m *CriuDumpResp) CloneMessageVT() protobuf_go_lite.CloneMessage {
+	return m.CloneVT()
+}
+
+func (m *CriuRestoreResp) CloneVT() *CriuRestoreResp {
+	if m == nil {
+		return (*CriuRestoreResp)(nil)
+	}
+	r := new(CriuRestoreResp)
+	if rhs := m.Pid; rhs != nil {
+		tmpVal := *rhs
+		r.Pid = &tmpVal
+	}
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = slices.Clone(m.unknownFields)
+	}
+	return r
+}
+
+func (m *CriuRestoreResp) CloneMessageVT() protobuf_go_lite.CloneMessage {
+	return m.CloneVT()
+}
+
+func (m *CriuNotify) CloneVT() *CriuNotify {
+	if m == nil {
+		return (*CriuNotify)(nil)
+	}
+	r := new(CriuNotify)
+	if rhs := m.Script; rhs != nil {
+		tmpVal := *rhs
+		r.Script = &tmpVal
+	}
+	if rhs := m.Pid; rhs != nil {
+		tmpVal := *rhs
+		r.Pid = &tmpVal
+	}
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = slices.Clone(m.unknownFields)
+	}
+	return r
+}
+
+func (m *CriuNotify) CloneMessageVT() protobuf_go_lite.CloneMessage {
+	return m.CloneVT()
+}
+
+func (m *CriuFeatures) CloneVT() *CriuFeatures {
+	if m == nil {
+		return (*CriuFeatures)(nil)
+	}
+	r := new(CriuFeatures)
+	if rhs := m.MemTrack; rhs != nil {
+		tmpVal := *rhs
+		r.MemTrack = &tmpVal
+	}
+	if rhs := m.LazyPages; rhs != nil {
+		tmpVal := *rhs
+		r.LazyPages = &tmpVal
+	}
+	if rhs := m.PidfdStore; rhs != nil {
+		tmpVal := *rhs
+		r.PidfdStore = &tmpVal
+	}
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = slices.Clone(m.unknownFields)
+	}
+	return r
+}
+
+func (m *CriuFeatures) CloneMessageVT() protobuf_go_lite.CloneMessage {
+	return m.CloneVT()
+}
+
+func (m *CriuReq) CloneVT() *CriuReq {
+	if m == nil {
+		return (*CriuReq)(nil)
+	}
+	r := new(CriuReq)
+	r.Opts = m.Opts.CloneVT()
+	r.Features = m.Features.CloneVT()
+	if rhs := m.Type; rhs != nil {
+		tmpVal := *rhs
+		r.Type = &tmpVal
+	}
+	if rhs := m.NotifySuccess; rhs != nil {
+		tmpVal := *rhs
+		r.NotifySuccess = &tmpVal
+	}
+	if rhs := m.KeepOpen; rhs != nil {
+		tmpVal := *rhs
+		r.KeepOpen = &tmpVal
+	}
+	if rhs := m.Pid; rhs != nil {
+		tmpVal := *rhs
+		r.Pid = &tmpVal
+	}
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = slices.Clone(m.unknownFields)
+	}
+	return r
+}
+
+func (m *CriuReq) CloneMessageVT() protobuf_go_lite.CloneMessage {
+	return m.CloneVT()
+}
+
+func (m *CriuResp) CloneVT() *CriuResp {
+	if m == nil {
+		return (*CriuResp)(nil)
+	}
+	r := new(CriuResp)
+	r.Dump = m.Dump.CloneVT()
+	r.Restore = m.Restore.CloneVT()
+	r.Notify = m.Notify.CloneVT()
+	r.Ps = m.Ps.CloneVT()
+	r.Features = m.Features.CloneVT()
+	r.Version = m.Version.CloneVT()
+	if rhs := m.Type; rhs != nil {
+		tmpVal := *rhs
+		r.Type = &tmpVal
+	}
+	if rhs := m.Success; rhs != nil {
+		tmpVal := *rhs
+		r.Success = &tmpVal
+	}
+	if rhs := m.CrErrno; rhs != nil {
+		tmpVal := *rhs
+		r.CrErrno = &tmpVal
+	}
+	if rhs := m.CrErrmsg; rhs != nil {
+		tmpVal := *rhs
+		r.CrErrmsg = &tmpVal
+	}
+	if rhs := m.Status; rhs != nil {
+		tmpVal := *rhs
+		r.Status = &tmpVal
+	}
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = slices.Clone(m.unknownFields)
+	}
+	return r
+}
+
+func (m *CriuResp) CloneMessageVT() protobuf_go_lite.CloneMessage {
+	return m.CloneVT()
+}
+
+func (m *CriuVersion) CloneVT() *CriuVersion {
+	if m == nil {
+		return (*CriuVersion)(nil)
+	}
+	r := new(CriuVersion)
+	if rhs := m.MajorNumber; rhs != nil {
+		tmpVal := *rhs
+		r.MajorNumber = &tmpVal
+	}
+	if rhs := m.MinorNumber; rhs != nil {
+		tmpVal := *rhs
+		r.MinorNumber = &tmpVal
+	}
+	if rhs := m.Gitid; rhs != nil {
+		tmpVal := *rhs
+		r.Gitid = &tmpVal
+	}
+	if rhs := m.Sublevel; rhs != nil {
+		tmpVal := *rhs
+		r.Sublevel = &tmpVal
+	}
+	if rhs := m.Extra; rhs != nil {
+		tmpVal := *rhs
+		r.Extra = &tmpVal
+	}
+	if rhs := m.Name; rhs != nil {
+		tmpVal := *rhs
+		r.Name = &tmpVal
+	}
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = slices.Clone(m.unknownFields)
+	}
+	return r
+}
+
+func (m *CriuVersion) CloneMessageVT() protobuf_go_lite.CloneMessage {
+	return m.CloneVT()
+}
+
+func (this *CriuPageServerInfo) EqualVT(that *CriuPageServerInfo) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if p, q := this.Address, that.Address; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	if p, q := this.Port, that.Port; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	if p, q := this.Pid, that.Pid; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	if p, q := this.Fd, that.Fd; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *CriuPageServerInfo) EqualMessageVT(thatMsg any) bool {
+	that, ok := thatMsg.(*CriuPageServerInfo)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *CriuVethPair) EqualVT(that *CriuVethPair) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if p, q := this.IfIn, that.IfIn; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	if p, q := this.IfOut, that.IfOut; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *CriuVethPair) EqualMessageVT(thatMsg any) bool {
+	that, ok := thatMsg.(*CriuVethPair)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *ExtMountMap) EqualVT(that *ExtMountMap) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if p, q := this.Key, that.Key; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	if p, q := this.Val, that.Val; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *ExtMountMap) EqualMessageVT(thatMsg any) bool {
+	that, ok := thatMsg.(*ExtMountMap)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *JoinNamespace) EqualVT(that *JoinNamespace) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if p, q := this.Ns, that.Ns; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	if p, q := this.NsFile, that.NsFile; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	if p, q := this.ExtraOpt, that.ExtraOpt; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *JoinNamespace) EqualMessageVT(thatMsg any) bool {
+	that, ok := thatMsg.(*JoinNamespace)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *InheritFd) EqualVT(that *InheritFd) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if p, q := this.Key, that.Key; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	if p, q := this.Fd, that.Fd; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *InheritFd) EqualMessageVT(thatMsg any) bool {
+	that, ok := thatMsg.(*InheritFd)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *CgroupRoot) EqualVT(that *CgroupRoot) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if p, q := this.Ctrl, that.Ctrl; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	if p, q := this.Path, that.Path; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *CgroupRoot) EqualMessageVT(thatMsg any) bool {
+	that, ok := thatMsg.(*CgroupRoot)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *UnixSk) EqualVT(that *UnixSk) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if p, q := this.Inode, that.Inode; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *UnixSk) EqualMessageVT(thatMsg any) bool {
+	that, ok := thatMsg.(*UnixSk)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *CriuOpts) EqualVT(that *CriuOpts) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if p, q := this.ImagesDirFd, that.ImagesDirFd; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	if p, q := this.Pid, that.Pid; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	if p, q := this.LeaveRunning, that.LeaveRunning; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	if p, q := this.ExtUnixSk, that.ExtUnixSk; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	if p, q := this.TcpEstablished, that.TcpEstablished; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	if p, q := this.EvasiveDevices, that.EvasiveDevices; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	if p, q := this.ShellJob, that.ShellJob; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	if p, q := this.FileLocks, that.FileLocks; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	if p, q := this.LogLevel, that.LogLevel; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	if p, q := this.LogFile, that.LogFile; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	if !this.Ps.EqualVT(that.Ps) {
+		return false
+	}
+	if p, q := this.NotifyScripts, that.NotifyScripts; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	if p, q := this.Root, that.Root; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	if p, q := this.ParentImg, that.ParentImg; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	if p, q := this.TrackMem, that.TrackMem; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	if p, q := this.AutoDedup, that.AutoDedup; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	if p, q := this.WorkDirFd, that.WorkDirFd; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	if p, q := this.LinkRemap, that.LinkRemap; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	if len(this.Veths) != len(that.Veths) {
+		return false
+	}
+	for i, vx := range this.Veths {
+		vy := that.Veths[i]
+		if p, q := vx, vy; p != q {
+			if p == nil {
+				p = &CriuVethPair{}
+			}
+			if q == nil {
+				q = &CriuVethPair{}
+			}
+			if !p.EqualVT(q) {
+				return false
+			}
+		}
+	}
+	if p, q := this.CpuCap, that.CpuCap; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	if p, q := this.ForceIrmap, that.ForceIrmap; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	if len(this.ExecCmd) != len(that.ExecCmd) {
+		return false
+	}
+	for i, vx := range this.ExecCmd {
+		vy := that.ExecCmd[i]
+		if vx != vy {
+			return false
+		}
+	}
+	if len(this.ExtMnt) != len(that.ExtMnt) {
+		return false
+	}
+	for i, vx := range this.ExtMnt {
+		vy := that.ExtMnt[i]
+		if p, q := vx, vy; p != q {
+			if p == nil {
+				p = &ExtMountMap{}
+			}
+			if q == nil {
+				q = &ExtMountMap{}
+			}
+			if !p.EqualVT(q) {
+				return false
+			}
+		}
+	}
+	if p, q := this.ManageCgroups, that.ManageCgroups; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	if len(this.CgRoot) != len(that.CgRoot) {
+		return false
+	}
+	for i, vx := range this.CgRoot {
+		vy := that.CgRoot[i]
+		if p, q := vx, vy; p != q {
+			if p == nil {
+				p = &CgroupRoot{}
+			}
+			if q == nil {
+				q = &CgroupRoot{}
+			}
+			if !p.EqualVT(q) {
+				return false
+			}
+		}
+	}
+	if p, q := this.RstSibling, that.RstSibling; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	if len(this.InheritFd) != len(that.InheritFd) {
+		return false
+	}
+	for i, vx := range this.InheritFd {
+		vy := that.InheritFd[i]
+		if p, q := vx, vy; p != q {
+			if p == nil {
+				p = &InheritFd{}
+			}
+			if q == nil {
+				q = &InheritFd{}
+			}
+			if !p.EqualVT(q) {
+				return false
+			}
+		}
+	}
+	if p, q := this.AutoExtMnt, that.AutoExtMnt; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	if p, q := this.ExtSharing, that.ExtSharing; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	if p, q := this.ExtMasters, that.ExtMasters; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	if len(this.SkipMnt) != len(that.SkipMnt) {
+		return false
+	}
+	for i, vx := range this.SkipMnt {
+		vy := that.SkipMnt[i]
+		if vx != vy {
+			return false
+		}
+	}
+	if len(this.EnableFs) != len(that.EnableFs) {
+		return false
+	}
+	for i, vx := range this.EnableFs {
+		vy := that.EnableFs[i]
+		if vx != vy {
+			return false
+		}
+	}
+	if len(this.UnixSkIno) != len(that.UnixSkIno) {
+		return false
+	}
+	for i, vx := range this.UnixSkIno {
+		vy := that.UnixSkIno[i]
+		if p, q := vx, vy; p != q {
+			if p == nil {
+				p = &UnixSk{}
+			}
+			if q == nil {
+				q = &UnixSk{}
+			}
+			if !p.EqualVT(q) {
+				return false
+			}
+		}
+	}
+	if p, q := this.ManageCgroupsMode, that.ManageCgroupsMode; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	if p, q := this.GhostLimit, that.GhostLimit; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	if len(this.IrmapScanPaths) != len(that.IrmapScanPaths) {
+		return false
+	}
+	for i, vx := range this.IrmapScanPaths {
+		vy := that.IrmapScanPaths[i]
+		if vx != vy {
+			return false
+		}
+	}
+	if len(this.External) != len(that.External) {
+		return false
+	}
+	for i, vx := range this.External {
+		vy := that.External[i]
+		if vx != vy {
+			return false
+		}
+	}
+	if p, q := this.EmptyNs, that.EmptyNs; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	if len(this.JoinNs) != len(that.JoinNs) {
+		return false
+	}
+	for i, vx := range this.JoinNs {
+		vy := that.JoinNs[i]
+		if p, q := vx, vy; p != q {
+			if p == nil {
+				p = &JoinNamespace{}
+			}
+			if q == nil {
+				q = &JoinNamespace{}
+			}
+			if !p.EqualVT(q) {
+				return false
+			}
+		}
+	}
+	if p, q := this.CgroupProps, that.CgroupProps; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	if p, q := this.CgroupPropsFile, that.CgroupPropsFile; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	if len(this.CgroupDumpController) != len(that.CgroupDumpController) {
+		return false
+	}
+	for i, vx := range this.CgroupDumpController {
+		vy := that.CgroupDumpController[i]
+		if vx != vy {
+			return false
+		}
+	}
+	if p, q := this.FreezeCgroup, that.FreezeCgroup; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	if p, q := this.Timeout, that.Timeout; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	if p, q := this.TcpSkipInFlight, that.TcpSkipInFlight; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	if p, q := this.WeakSysctls, that.WeakSysctls; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	if p, q := this.LazyPages, that.LazyPages; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	if p, q := this.StatusFd, that.StatusFd; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	if p, q := this.OrphanPtsMaster, that.OrphanPtsMaster; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	if p, q := this.ConfigFile, that.ConfigFile; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	if p, q := this.TcpClose, that.TcpClose; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	if p, q := this.LsmProfile, that.LsmProfile; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	if p, q := this.TlsCacert, that.TlsCacert; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	if p, q := this.TlsCacrl, that.TlsCacrl; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	if p, q := this.TlsCert, that.TlsCert; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	if p, q := this.TlsKey, that.TlsKey; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	if p, q := this.Tls, that.Tls; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	if p, q := this.TlsNoCnVerify, that.TlsNoCnVerify; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	if p, q := this.CgroupYard, that.CgroupYard; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	if p, q := this.PreDumpMode, that.PreDumpMode; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	if p, q := this.PidfdStoreSk, that.PidfdStoreSk; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	if p, q := this.LsmMountContext, that.LsmMountContext; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	if p, q := this.NetworkLock, that.NetworkLock; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	if p, q := this.MntnsCompatMode, that.MntnsCompatMode; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	if p, q := this.SkipFileRwxCheck, that.SkipFileRwxCheck; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	if p, q := this.Unprivileged, that.Unprivileged; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	if p, q := this.ImagesDir, that.ImagesDir; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	if p, q := this.LeaveStopped, that.LeaveStopped; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	if p, q := this.DisplayStats, that.DisplayStats; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	if p, q := this.LogToStderr, that.LogToStderr; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *CriuOpts) EqualMessageVT(thatMsg any) bool {
+	that, ok := thatMsg.(*CriuOpts)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *CriuDumpResp) EqualVT(that *CriuDumpResp) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if p, q := this.Restored, that.Restored; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *CriuDumpResp) EqualMessageVT(thatMsg any) bool {
+	that, ok := thatMsg.(*CriuDumpResp)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *CriuRestoreResp) EqualVT(that *CriuRestoreResp) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if p, q := this.Pid, that.Pid; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *CriuRestoreResp) EqualMessageVT(thatMsg any) bool {
+	that, ok := thatMsg.(*CriuRestoreResp)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *CriuNotify) EqualVT(that *CriuNotify) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if p, q := this.Script, that.Script; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	if p, q := this.Pid, that.Pid; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *CriuNotify) EqualMessageVT(thatMsg any) bool {
+	that, ok := thatMsg.(*CriuNotify)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *CriuFeatures) EqualVT(that *CriuFeatures) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if p, q := this.MemTrack, that.MemTrack; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	if p, q := this.LazyPages, that.LazyPages; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	if p, q := this.PidfdStore, that.PidfdStore; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *CriuFeatures) EqualMessageVT(thatMsg any) bool {
+	that, ok := thatMsg.(*CriuFeatures)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *CriuReq) EqualVT(that *CriuReq) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if p, q := this.Type, that.Type; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	if !this.Opts.EqualVT(that.Opts) {
+		return false
+	}
+	if p, q := this.NotifySuccess, that.NotifySuccess; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	if p, q := this.KeepOpen, that.KeepOpen; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	if !this.Features.EqualVT(that.Features) {
+		return false
+	}
+	if p, q := this.Pid, that.Pid; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *CriuReq) EqualMessageVT(thatMsg any) bool {
+	that, ok := thatMsg.(*CriuReq)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *CriuResp) EqualVT(that *CriuResp) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if p, q := this.Type, that.Type; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	if p, q := this.Success, that.Success; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	if !this.Dump.EqualVT(that.Dump) {
+		return false
+	}
+	if !this.Restore.EqualVT(that.Restore) {
+		return false
+	}
+	if !this.Notify.EqualVT(that.Notify) {
+		return false
+	}
+	if !this.Ps.EqualVT(that.Ps) {
+		return false
+	}
+	if p, q := this.CrErrno, that.CrErrno; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	if !this.Features.EqualVT(that.Features) {
+		return false
+	}
+	if p, q := this.CrErrmsg, that.CrErrmsg; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	if !this.Version.EqualVT(that.Version) {
+		return false
+	}
+	if p, q := this.Status, that.Status; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *CriuResp) EqualMessageVT(thatMsg any) bool {
+	that, ok := thatMsg.(*CriuResp)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *CriuVersion) EqualVT(that *CriuVersion) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if p, q := this.MajorNumber, that.MajorNumber; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	if p, q := this.MinorNumber, that.MinorNumber; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	if p, q := this.Gitid, that.Gitid; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	if p, q := this.Sublevel, that.Sublevel; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	if p, q := this.Extra, that.Extra; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	if p, q := this.Name, that.Name; (p == nil && q != nil) || (p != nil && (q == nil || *p != *q)) {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *CriuVersion) EqualMessageVT(thatMsg any) bool {
+	that, ok := thatMsg.(*CriuVersion)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+
+// NOTE: protobuf-go-lite json only supports proto3 and editions: proto2 is not supported.
+
+func (m *CriuPageServerInfo) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *CriuPageServerInfo) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *CriuPageServerInfo) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.Fd != nil {
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(*m.Fd))
+		i--
+		dAtA[i] = 0x20
+	}
+	if m.Pid != nil {
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(*m.Pid))
+		i--
+		dAtA[i] = 0x18
+	}
+	if m.Port != nil {
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(*m.Port))
+		i--
+		dAtA[i] = 0x10
+	}
+	if m.Address != nil {
+		i -= len(*m.Address)
+		copy(dAtA[i:], *m.Address)
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(len(*m.Address)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *CriuVethPair) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *CriuVethPair) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *CriuVethPair) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.IfOut == nil {
+		return 0, fmt.Errorf("proto: required field if_out not set")
+	} else {
+		i -= len(*m.IfOut)
+		copy(dAtA[i:], *m.IfOut)
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(len(*m.IfOut)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if m.IfIn == nil {
+		return 0, fmt.Errorf("proto: required field if_in not set")
+	} else {
+		i -= len(*m.IfIn)
+		copy(dAtA[i:], *m.IfIn)
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(len(*m.IfIn)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *ExtMountMap) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ExtMountMap) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *ExtMountMap) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.Val == nil {
+		return 0, fmt.Errorf("proto: required field val not set")
+	} else {
+		i -= len(*m.Val)
+		copy(dAtA[i:], *m.Val)
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(len(*m.Val)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if m.Key == nil {
+		return 0, fmt.Errorf("proto: required field key not set")
+	} else {
+		i -= len(*m.Key)
+		copy(dAtA[i:], *m.Key)
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(len(*m.Key)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *JoinNamespace) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *JoinNamespace) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *JoinNamespace) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.ExtraOpt != nil {
+		i -= len(*m.ExtraOpt)
+		copy(dAtA[i:], *m.ExtraOpt)
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(len(*m.ExtraOpt)))
+		i--
+		dAtA[i] = 0x1a
+	}
+	if m.NsFile == nil {
+		return 0, fmt.Errorf("proto: required field ns_file not set")
+	} else {
+		i -= len(*m.NsFile)
+		copy(dAtA[i:], *m.NsFile)
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(len(*m.NsFile)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if m.Ns == nil {
+		return 0, fmt.Errorf("proto: required field ns not set")
+	} else {
+		i -= len(*m.Ns)
+		copy(dAtA[i:], *m.Ns)
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(len(*m.Ns)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *InheritFd) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *InheritFd) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *InheritFd) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.Fd == nil {
+		return 0, fmt.Errorf("proto: required field fd not set")
+	} else {
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(*m.Fd))
+		i--
+		dAtA[i] = 0x10
+	}
+	if m.Key == nil {
+		return 0, fmt.Errorf("proto: required field key not set")
+	} else {
+		i -= len(*m.Key)
+		copy(dAtA[i:], *m.Key)
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(len(*m.Key)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *CgroupRoot) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *CgroupRoot) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *CgroupRoot) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.Path == nil {
+		return 0, fmt.Errorf("proto: required field path not set")
+	} else {
+		i -= len(*m.Path)
+		copy(dAtA[i:], *m.Path)
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(len(*m.Path)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if m.Ctrl != nil {
+		i -= len(*m.Ctrl)
+		copy(dAtA[i:], *m.Ctrl)
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(len(*m.Ctrl)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *UnixSk) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *UnixSk) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *UnixSk) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.Inode == nil {
+		return 0, fmt.Errorf("proto: required field inode not set")
+	} else {
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(*m.Inode))
+		i--
+		dAtA[i] = 0x8
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *CriuOpts) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *CriuOpts) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *CriuOpts) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.LogToStderr != nil {
+		i--
+		if *m.LogToStderr {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x4
+		i--
+		dAtA[i] = 0xb8
+	}
+	if m.DisplayStats != nil {
+		i--
+		if *m.DisplayStats {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x4
+		i--
+		dAtA[i] = 0xb0
+	}
+	if m.LeaveStopped != nil {
+		i--
+		if *m.LeaveStopped {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x4
+		i--
+		dAtA[i] = 0xa8
+	}
+	if m.ImagesDir != nil {
+		i -= len(*m.ImagesDir)
+		copy(dAtA[i:], *m.ImagesDir)
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(len(*m.ImagesDir)))
+		i--
+		dAtA[i] = 0x4
+		i--
+		dAtA[i] = 0xa2
+	}
+	if m.Unprivileged != nil {
+		i--
+		if *m.Unprivileged {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x4
+		i--
+		dAtA[i] = 0x98
+	}
+	if m.SkipFileRwxCheck != nil {
+		i--
+		if *m.SkipFileRwxCheck {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x4
+		i--
+		dAtA[i] = 0x90
+	}
+	if m.MntnsCompatMode != nil {
+		i--
+		if *m.MntnsCompatMode {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x4
+		i--
+		dAtA[i] = 0x88
+	}
+	if m.NetworkLock != nil {
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(*m.NetworkLock))
+		i--
+		dAtA[i] = 0x4
+		i--
+		dAtA[i] = 0x80
+	}
+	if m.LsmMountContext != nil {
+		i -= len(*m.LsmMountContext)
+		copy(dAtA[i:], *m.LsmMountContext)
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(len(*m.LsmMountContext)))
+		i--
+		dAtA[i] = 0x3
+		i--
+		dAtA[i] = 0xfa
+	}
+	if m.PidfdStoreSk != nil {
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(*m.PidfdStoreSk))
+		i--
+		dAtA[i] = 0x3
+		i--
+		dAtA[i] = 0xf0
+	}
+	if m.PreDumpMode != nil {
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(*m.PreDumpMode))
+		i--
+		dAtA[i] = 0x3
+		i--
+		dAtA[i] = 0xe8
+	}
+	if m.CgroupYard != nil {
+		i -= len(*m.CgroupYard)
+		copy(dAtA[i:], *m.CgroupYard)
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(len(*m.CgroupYard)))
+		i--
+		dAtA[i] = 0x3
+		i--
+		dAtA[i] = 0xe2
+	}
+	if m.TlsNoCnVerify != nil {
+		i--
+		if *m.TlsNoCnVerify {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x3
+		i--
+		dAtA[i] = 0xd8
+	}
+	if m.Tls != nil {
+		i--
+		if *m.Tls {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x3
+		i--
+		dAtA[i] = 0xd0
+	}
+	if m.TlsKey != nil {
+		i -= len(*m.TlsKey)
+		copy(dAtA[i:], *m.TlsKey)
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(len(*m.TlsKey)))
+		i--
+		dAtA[i] = 0x3
+		i--
+		dAtA[i] = 0xca
+	}
+	if m.TlsCert != nil {
+		i -= len(*m.TlsCert)
+		copy(dAtA[i:], *m.TlsCert)
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(len(*m.TlsCert)))
+		i--
+		dAtA[i] = 0x3
+		i--
+		dAtA[i] = 0xc2
+	}
+	if m.TlsCacrl != nil {
+		i -= len(*m.TlsCacrl)
+		copy(dAtA[i:], *m.TlsCacrl)
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(len(*m.TlsCacrl)))
+		i--
+		dAtA[i] = 0x3
+		i--
+		dAtA[i] = 0xba
+	}
+	if m.TlsCacert != nil {
+		i -= len(*m.TlsCacert)
+		copy(dAtA[i:], *m.TlsCacert)
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(len(*m.TlsCacert)))
+		i--
+		dAtA[i] = 0x3
+		i--
+		dAtA[i] = 0xb2
+	}
+	if m.LsmProfile != nil {
+		i -= len(*m.LsmProfile)
+		copy(dAtA[i:], *m.LsmProfile)
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(len(*m.LsmProfile)))
+		i--
+		dAtA[i] = 0x3
+		i--
+		dAtA[i] = 0xaa
+	}
+	if m.TcpClose != nil {
+		i--
+		if *m.TcpClose {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x3
+		i--
+		dAtA[i] = 0xa0
+	}
+	if m.ConfigFile != nil {
+		i -= len(*m.ConfigFile)
+		copy(dAtA[i:], *m.ConfigFile)
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(len(*m.ConfigFile)))
+		i--
+		dAtA[i] = 0x3
+		i--
+		dAtA[i] = 0x9a
+	}
+	if m.OrphanPtsMaster != nil {
+		i--
+		if *m.OrphanPtsMaster {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x3
+		i--
+		dAtA[i] = 0x90
+	}
+	if m.StatusFd != nil {
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(*m.StatusFd))
+		i--
+		dAtA[i] = 0x3
+		i--
+		dAtA[i] = 0x88
+	}
+	if m.LazyPages != nil {
+		i--
+		if *m.LazyPages {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x3
+		i--
+		dAtA[i] = 0x80
+	}
+	if m.WeakSysctls != nil {
+		i--
+		if *m.WeakSysctls {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x2
+		i--
+		dAtA[i] = 0xf8
+	}
+	if m.TcpSkipInFlight != nil {
+		i--
+		if *m.TcpSkipInFlight {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x2
+		i--
+		dAtA[i] = 0xf0
+	}
+	if m.Timeout != nil {
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(*m.Timeout))
+		i--
+		dAtA[i] = 0x2
+		i--
+		dAtA[i] = 0xe8
+	}
+	if m.FreezeCgroup != nil {
+		i -= len(*m.FreezeCgroup)
+		copy(dAtA[i:], *m.FreezeCgroup)
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(len(*m.FreezeCgroup)))
+		i--
+		dAtA[i] = 0x2
+		i--
+		dAtA[i] = 0xe2
+	}
+	if len(m.CgroupDumpController) > 0 {
+		for iNdEx := len(m.CgroupDumpController) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.CgroupDumpController[iNdEx])
+			copy(dAtA[i:], m.CgroupDumpController[iNdEx])
+			i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(len(m.CgroupDumpController[iNdEx])))
+			i--
+			dAtA[i] = 0x2
+			i--
+			dAtA[i] = 0xda
+		}
+	}
+	if m.CgroupPropsFile != nil {
+		i -= len(*m.CgroupPropsFile)
+		copy(dAtA[i:], *m.CgroupPropsFile)
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(len(*m.CgroupPropsFile)))
+		i--
+		dAtA[i] = 0x2
+		i--
+		dAtA[i] = 0xd2
+	}
+	if m.CgroupProps != nil {
+		i -= len(*m.CgroupProps)
+		copy(dAtA[i:], *m.CgroupProps)
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(len(*m.CgroupProps)))
+		i--
+		dAtA[i] = 0x2
+		i--
+		dAtA[i] = 0xca
+	}
+	if len(m.JoinNs) > 0 {
+		for iNdEx := len(m.JoinNs) - 1; iNdEx >= 0; iNdEx-- {
+			size, err := m.JoinNs[iNdEx].MarshalToSizedBufferVT(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(size))
+			i--
+			dAtA[i] = 0x2
+			i--
+			dAtA[i] = 0xba
+		}
+	}
+	if m.EmptyNs != nil {
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(*m.EmptyNs))
+		i--
+		dAtA[i] = 0x2
+		i--
+		dAtA[i] = 0xb0
+	}
+	if len(m.External) > 0 {
+		for iNdEx := len(m.External) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.External[iNdEx])
+			copy(dAtA[i:], m.External[iNdEx])
+			i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(len(m.External[iNdEx])))
+			i--
+			dAtA[i] = 0x2
+			i--
+			dAtA[i] = 0xaa
+		}
+	}
+	if len(m.IrmapScanPaths) > 0 {
+		for iNdEx := len(m.IrmapScanPaths) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.IrmapScanPaths[iNdEx])
+			copy(dAtA[i:], m.IrmapScanPaths[iNdEx])
+			i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(len(m.IrmapScanPaths[iNdEx])))
+			i--
+			dAtA[i] = 0x2
+			i--
+			dAtA[i] = 0xa2
+		}
+	}
+	if m.GhostLimit != nil {
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(*m.GhostLimit))
+		i--
+		dAtA[i] = 0x2
+		i--
+		dAtA[i] = 0x98
+	}
+	if m.ManageCgroupsMode != nil {
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(*m.ManageCgroupsMode))
+		i--
+		dAtA[i] = 0x2
+		i--
+		dAtA[i] = 0x90
+	}
+	if len(m.UnixSkIno) > 0 {
+		for iNdEx := len(m.UnixSkIno) - 1; iNdEx >= 0; iNdEx-- {
+			size, err := m.UnixSkIno[iNdEx].MarshalToSizedBufferVT(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(size))
+			i--
+			dAtA[i] = 0x2
+			i--
+			dAtA[i] = 0x8a
+		}
+	}
+	if len(m.EnableFs) > 0 {
+		for iNdEx := len(m.EnableFs) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.EnableFs[iNdEx])
+			copy(dAtA[i:], m.EnableFs[iNdEx])
+			i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(len(m.EnableFs[iNdEx])))
+			i--
+			dAtA[i] = 0x2
+			i--
+			dAtA[i] = 0x82
+		}
+	}
+	if len(m.SkipMnt) > 0 {
+		for iNdEx := len(m.SkipMnt) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.SkipMnt[iNdEx])
+			copy(dAtA[i:], m.SkipMnt[iNdEx])
+			i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(len(m.SkipMnt[iNdEx])))
+			i--
+			dAtA[i] = 0x1
+			i--
+			dAtA[i] = 0xfa
+		}
+	}
+	if m.ExtMasters != nil {
+		i--
+		if *m.ExtMasters {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x1
+		i--
+		dAtA[i] = 0xf0
+	}
+	if m.ExtSharing != nil {
+		i--
+		if *m.ExtSharing {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x1
+		i--
+		dAtA[i] = 0xe8
+	}
+	if m.AutoExtMnt != nil {
+		i--
+		if *m.AutoExtMnt {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x1
+		i--
+		dAtA[i] = 0xe0
+	}
+	if len(m.InheritFd) > 0 {
+		for iNdEx := len(m.InheritFd) - 1; iNdEx >= 0; iNdEx-- {
+			size, err := m.InheritFd[iNdEx].MarshalToSizedBufferVT(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(size))
+			i--
+			dAtA[i] = 0x1
+			i--
+			dAtA[i] = 0xda
+		}
+	}
+	if m.RstSibling != nil {
+		i--
+		if *m.RstSibling {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x1
+		i--
+		dAtA[i] = 0xd0
+	}
+	if len(m.CgRoot) > 0 {
+		for iNdEx := len(m.CgRoot) - 1; iNdEx >= 0; iNdEx-- {
+			size, err := m.CgRoot[iNdEx].MarshalToSizedBufferVT(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(size))
+			i--
+			dAtA[i] = 0x1
+			i--
+			dAtA[i] = 0xca
+		}
+	}
+	if m.ManageCgroups != nil {
+		i--
+		if *m.ManageCgroups {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x1
+		i--
+		dAtA[i] = 0xc0
+	}
+	if len(m.ExtMnt) > 0 {
+		for iNdEx := len(m.ExtMnt) - 1; iNdEx >= 0; iNdEx-- {
+			size, err := m.ExtMnt[iNdEx].MarshalToSizedBufferVT(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(size))
+			i--
+			dAtA[i] = 0x1
+			i--
+			dAtA[i] = 0xba
+		}
+	}
+	if len(m.ExecCmd) > 0 {
+		for iNdEx := len(m.ExecCmd) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.ExecCmd[iNdEx])
+			copy(dAtA[i:], m.ExecCmd[iNdEx])
+			i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(len(m.ExecCmd[iNdEx])))
+			i--
+			dAtA[i] = 0x1
+			i--
+			dAtA[i] = 0xb2
+		}
+	}
+	if m.ForceIrmap != nil {
+		i--
+		if *m.ForceIrmap {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x1
+		i--
+		dAtA[i] = 0xa8
+	}
+	if m.CpuCap != nil {
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(*m.CpuCap))
+		i--
+		dAtA[i] = 0x1
+		i--
+		dAtA[i] = 0xa0
+	}
+	if len(m.Veths) > 0 {
+		for iNdEx := len(m.Veths) - 1; iNdEx >= 0; iNdEx-- {
+			size, err := m.Veths[iNdEx].MarshalToSizedBufferVT(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(size))
+			i--
+			dAtA[i] = 0x1
+			i--
+			dAtA[i] = 0x9a
+		}
+	}
+	if m.LinkRemap != nil {
+		i--
+		if *m.LinkRemap {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x1
+		i--
+		dAtA[i] = 0x90
+	}
+	if m.WorkDirFd != nil {
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(*m.WorkDirFd))
+		i--
+		dAtA[i] = 0x1
+		i--
+		dAtA[i] = 0x88
+	}
+	if m.AutoDedup != nil {
+		i--
+		if *m.AutoDedup {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x1
+		i--
+		dAtA[i] = 0x80
+	}
+	if m.TrackMem != nil {
+		i--
+		if *m.TrackMem {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x78
+	}
+	if m.ParentImg != nil {
+		i -= len(*m.ParentImg)
+		copy(dAtA[i:], *m.ParentImg)
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(len(*m.ParentImg)))
+		i--
+		dAtA[i] = 0x72
+	}
+	if m.Root != nil {
+		i -= len(*m.Root)
+		copy(dAtA[i:], *m.Root)
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(len(*m.Root)))
+		i--
+		dAtA[i] = 0x6a
+	}
+	if m.NotifyScripts != nil {
+		i--
+		if *m.NotifyScripts {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x60
+	}
+	if m.Ps != nil {
+		size, err := m.Ps.MarshalToSizedBufferVT(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0x5a
+	}
+	if m.LogFile != nil {
+		i -= len(*m.LogFile)
+		copy(dAtA[i:], *m.LogFile)
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(len(*m.LogFile)))
+		i--
+		dAtA[i] = 0x52
+	}
+	if m.LogLevel != nil {
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(*m.LogLevel))
+		i--
+		dAtA[i] = 0x48
+	}
+	if m.FileLocks != nil {
+		i--
+		if *m.FileLocks {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x40
+	}
+	if m.ShellJob != nil {
+		i--
+		if *m.ShellJob {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x38
+	}
+	if m.EvasiveDevices != nil {
+		i--
+		if *m.EvasiveDevices {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x30
+	}
+	if m.TcpEstablished != nil {
+		i--
+		if *m.TcpEstablished {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x28
+	}
+	if m.ExtUnixSk != nil {
+		i--
+		if *m.ExtUnixSk {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x20
+	}
+	if m.LeaveRunning != nil {
+		i--
+		if *m.LeaveRunning {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x18
+	}
+	if m.Pid != nil {
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(*m.Pid))
+		i--
+		dAtA[i] = 0x10
+	}
+	if m.ImagesDirFd == nil {
+		return 0, fmt.Errorf("proto: required field images_dir_fd not set")
+	} else {
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(*m.ImagesDirFd))
+		i--
+		dAtA[i] = 0x8
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *CriuDumpResp) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *CriuDumpResp) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *CriuDumpResp) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.Restored != nil {
+		i--
+		if *m.Restored {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x8
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *CriuRestoreResp) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *CriuRestoreResp) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *CriuRestoreResp) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.Pid == nil {
+		return 0, fmt.Errorf("proto: required field pid not set")
+	} else {
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(*m.Pid))
+		i--
+		dAtA[i] = 0x8
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *CriuNotify) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *CriuNotify) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *CriuNotify) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.Pid != nil {
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(*m.Pid))
+		i--
+		dAtA[i] = 0x10
+	}
+	if m.Script != nil {
+		i -= len(*m.Script)
+		copy(dAtA[i:], *m.Script)
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(len(*m.Script)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *CriuFeatures) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *CriuFeatures) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *CriuFeatures) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.PidfdStore != nil {
+		i--
+		if *m.PidfdStore {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x18
+	}
+	if m.LazyPages != nil {
+		i--
+		if *m.LazyPages {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x10
+	}
+	if m.MemTrack != nil {
+		i--
+		if *m.MemTrack {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x8
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *CriuReq) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *CriuReq) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *CriuReq) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.Pid != nil {
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(*m.Pid))
+		i--
+		dAtA[i] = 0x30
+	}
+	if m.Features != nil {
+		size, err := m.Features.MarshalToSizedBufferVT(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0x2a
+	}
+	if m.KeepOpen != nil {
+		i--
+		if *m.KeepOpen {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x20
+	}
+	if m.NotifySuccess != nil {
+		i--
+		if *m.NotifySuccess {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x18
+	}
+	if m.Opts != nil {
+		size, err := m.Opts.MarshalToSizedBufferVT(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0x12
+	}
+	if m.Type == nil {
+		return 0, fmt.Errorf("proto: required field type not set")
+	} else {
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(*m.Type))
+		i--
+		dAtA[i] = 0x8
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *CriuResp) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *CriuResp) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *CriuResp) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.Status != nil {
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(*m.Status))
+		i--
+		dAtA[i] = 0x58
+	}
+	if m.Version != nil {
+		size, err := m.Version.MarshalToSizedBufferVT(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0x52
+	}
+	if m.CrErrmsg != nil {
+		i -= len(*m.CrErrmsg)
+		copy(dAtA[i:], *m.CrErrmsg)
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(len(*m.CrErrmsg)))
+		i--
+		dAtA[i] = 0x4a
+	}
+	if m.Features != nil {
+		size, err := m.Features.MarshalToSizedBufferVT(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0x42
+	}
+	if m.CrErrno != nil {
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(*m.CrErrno))
+		i--
+		dAtA[i] = 0x38
+	}
+	if m.Ps != nil {
+		size, err := m.Ps.MarshalToSizedBufferVT(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0x32
+	}
+	if m.Notify != nil {
+		size, err := m.Notify.MarshalToSizedBufferVT(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0x2a
+	}
+	if m.Restore != nil {
+		size, err := m.Restore.MarshalToSizedBufferVT(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0x22
+	}
+	if m.Dump != nil {
+		size, err := m.Dump.MarshalToSizedBufferVT(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0x1a
+	}
+	if m.Success == nil {
+		return 0, fmt.Errorf("proto: required field success not set")
+	} else {
+		i--
+		if *m.Success {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x10
+	}
+	if m.Type == nil {
+		return 0, fmt.Errorf("proto: required field type not set")
+	} else {
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(*m.Type))
+		i--
+		dAtA[i] = 0x8
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *CriuVersion) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *CriuVersion) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *CriuVersion) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.Name != nil {
+		i -= len(*m.Name)
+		copy(dAtA[i:], *m.Name)
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(len(*m.Name)))
+		i--
+		dAtA[i] = 0x32
+	}
+	if m.Extra != nil {
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(*m.Extra))
+		i--
+		dAtA[i] = 0x28
+	}
+	if m.Sublevel != nil {
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(*m.Sublevel))
+		i--
+		dAtA[i] = 0x20
+	}
+	if m.Gitid != nil {
+		i -= len(*m.Gitid)
+		copy(dAtA[i:], *m.Gitid)
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(len(*m.Gitid)))
+		i--
+		dAtA[i] = 0x1a
+	}
+	if m.MinorNumber == nil {
+		return 0, fmt.Errorf("proto: required field minor_number not set")
+	} else {
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(*m.MinorNumber))
+		i--
+		dAtA[i] = 0x10
+	}
+	if m.MajorNumber == nil {
+		return 0, fmt.Errorf("proto: required field major_number not set")
+	} else {
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(*m.MajorNumber))
+		i--
+		dAtA[i] = 0x8
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *CriuPageServerInfo) MarshalVTStrict() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVTStrict(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *CriuPageServerInfo) MarshalToVTStrict(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVTStrict(dAtA[:size])
+}
+
+func (m *CriuPageServerInfo) MarshalToSizedBufferVTStrict(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.Fd != nil {
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(*m.Fd))
+		i--
+		dAtA[i] = 0x20
+	}
+	if m.Pid != nil {
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(*m.Pid))
+		i--
+		dAtA[i] = 0x18
+	}
+	if m.Port != nil {
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(*m.Port))
+		i--
+		dAtA[i] = 0x10
+	}
+	if m.Address != nil {
+		i -= len(*m.Address)
+		copy(dAtA[i:], *m.Address)
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(len(*m.Address)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *CriuVethPair) MarshalVTStrict() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVTStrict(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *CriuVethPair) MarshalToVTStrict(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVTStrict(dAtA[:size])
+}
+
+func (m *CriuVethPair) MarshalToSizedBufferVTStrict(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.IfOut == nil {
+		return 0, fmt.Errorf("proto: required field if_out not set")
+	} else {
+		i -= len(*m.IfOut)
+		copy(dAtA[i:], *m.IfOut)
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(len(*m.IfOut)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if m.IfIn == nil {
+		return 0, fmt.Errorf("proto: required field if_in not set")
+	} else {
+		i -= len(*m.IfIn)
+		copy(dAtA[i:], *m.IfIn)
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(len(*m.IfIn)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *ExtMountMap) MarshalVTStrict() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVTStrict(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ExtMountMap) MarshalToVTStrict(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVTStrict(dAtA[:size])
+}
+
+func (m *ExtMountMap) MarshalToSizedBufferVTStrict(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.Val == nil {
+		return 0, fmt.Errorf("proto: required field val not set")
+	} else {
+		i -= len(*m.Val)
+		copy(dAtA[i:], *m.Val)
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(len(*m.Val)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if m.Key == nil {
+		return 0, fmt.Errorf("proto: required field key not set")
+	} else {
+		i -= len(*m.Key)
+		copy(dAtA[i:], *m.Key)
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(len(*m.Key)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *JoinNamespace) MarshalVTStrict() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVTStrict(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *JoinNamespace) MarshalToVTStrict(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVTStrict(dAtA[:size])
+}
+
+func (m *JoinNamespace) MarshalToSizedBufferVTStrict(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.ExtraOpt != nil {
+		i -= len(*m.ExtraOpt)
+		copy(dAtA[i:], *m.ExtraOpt)
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(len(*m.ExtraOpt)))
+		i--
+		dAtA[i] = 0x1a
+	}
+	if m.NsFile == nil {
+		return 0, fmt.Errorf("proto: required field ns_file not set")
+	} else {
+		i -= len(*m.NsFile)
+		copy(dAtA[i:], *m.NsFile)
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(len(*m.NsFile)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if m.Ns == nil {
+		return 0, fmt.Errorf("proto: required field ns not set")
+	} else {
+		i -= len(*m.Ns)
+		copy(dAtA[i:], *m.Ns)
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(len(*m.Ns)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *InheritFd) MarshalVTStrict() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVTStrict(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *InheritFd) MarshalToVTStrict(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVTStrict(dAtA[:size])
+}
+
+func (m *InheritFd) MarshalToSizedBufferVTStrict(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.Fd == nil {
+		return 0, fmt.Errorf("proto: required field fd not set")
+	} else {
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(*m.Fd))
+		i--
+		dAtA[i] = 0x10
+	}
+	if m.Key == nil {
+		return 0, fmt.Errorf("proto: required field key not set")
+	} else {
+		i -= len(*m.Key)
+		copy(dAtA[i:], *m.Key)
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(len(*m.Key)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *CgroupRoot) MarshalVTStrict() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVTStrict(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *CgroupRoot) MarshalToVTStrict(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVTStrict(dAtA[:size])
+}
+
+func (m *CgroupRoot) MarshalToSizedBufferVTStrict(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.Path == nil {
+		return 0, fmt.Errorf("proto: required field path not set")
+	} else {
+		i -= len(*m.Path)
+		copy(dAtA[i:], *m.Path)
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(len(*m.Path)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if m.Ctrl != nil {
+		i -= len(*m.Ctrl)
+		copy(dAtA[i:], *m.Ctrl)
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(len(*m.Ctrl)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *UnixSk) MarshalVTStrict() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVTStrict(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *UnixSk) MarshalToVTStrict(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVTStrict(dAtA[:size])
+}
+
+func (m *UnixSk) MarshalToSizedBufferVTStrict(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.Inode == nil {
+		return 0, fmt.Errorf("proto: required field inode not set")
+	} else {
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(*m.Inode))
+		i--
+		dAtA[i] = 0x8
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *CriuOpts) MarshalVTStrict() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVTStrict(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *CriuOpts) MarshalToVTStrict(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVTStrict(dAtA[:size])
+}
+
+func (m *CriuOpts) MarshalToSizedBufferVTStrict(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.LogToStderr != nil {
+		i--
+		if *m.LogToStderr {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x4
+		i--
+		dAtA[i] = 0xb8
+	}
+	if m.DisplayStats != nil {
+		i--
+		if *m.DisplayStats {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x4
+		i--
+		dAtA[i] = 0xb0
+	}
+	if m.LeaveStopped != nil {
+		i--
+		if *m.LeaveStopped {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x4
+		i--
+		dAtA[i] = 0xa8
+	}
+	if m.ImagesDir != nil {
+		i -= len(*m.ImagesDir)
+		copy(dAtA[i:], *m.ImagesDir)
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(len(*m.ImagesDir)))
+		i--
+		dAtA[i] = 0x4
+		i--
+		dAtA[i] = 0xa2
+	}
+	if m.Unprivileged != nil {
+		i--
+		if *m.Unprivileged {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x4
+		i--
+		dAtA[i] = 0x98
+	}
+	if m.SkipFileRwxCheck != nil {
+		i--
+		if *m.SkipFileRwxCheck {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x4
+		i--
+		dAtA[i] = 0x90
+	}
+	if m.MntnsCompatMode != nil {
+		i--
+		if *m.MntnsCompatMode {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x4
+		i--
+		dAtA[i] = 0x88
+	}
+	if m.NetworkLock != nil {
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(*m.NetworkLock))
+		i--
+		dAtA[i] = 0x4
+		i--
+		dAtA[i] = 0x80
+	}
+	if m.LsmMountContext != nil {
+		i -= len(*m.LsmMountContext)
+		copy(dAtA[i:], *m.LsmMountContext)
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(len(*m.LsmMountContext)))
+		i--
+		dAtA[i] = 0x3
+		i--
+		dAtA[i] = 0xfa
+	}
+	if m.PidfdStoreSk != nil {
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(*m.PidfdStoreSk))
+		i--
+		dAtA[i] = 0x3
+		i--
+		dAtA[i] = 0xf0
+	}
+	if m.PreDumpMode != nil {
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(*m.PreDumpMode))
+		i--
+		dAtA[i] = 0x3
+		i--
+		dAtA[i] = 0xe8
+	}
+	if m.CgroupYard != nil {
+		i -= len(*m.CgroupYard)
+		copy(dAtA[i:], *m.CgroupYard)
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(len(*m.CgroupYard)))
+		i--
+		dAtA[i] = 0x3
+		i--
+		dAtA[i] = 0xe2
+	}
+	if m.TlsNoCnVerify != nil {
+		i--
+		if *m.TlsNoCnVerify {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x3
+		i--
+		dAtA[i] = 0xd8
+	}
+	if m.Tls != nil {
+		i--
+		if *m.Tls {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x3
+		i--
+		dAtA[i] = 0xd0
+	}
+	if m.TlsKey != nil {
+		i -= len(*m.TlsKey)
+		copy(dAtA[i:], *m.TlsKey)
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(len(*m.TlsKey)))
+		i--
+		dAtA[i] = 0x3
+		i--
+		dAtA[i] = 0xca
+	}
+	if m.TlsCert != nil {
+		i -= len(*m.TlsCert)
+		copy(dAtA[i:], *m.TlsCert)
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(len(*m.TlsCert)))
+		i--
+		dAtA[i] = 0x3
+		i--
+		dAtA[i] = 0xc2
+	}
+	if m.TlsCacrl != nil {
+		i -= len(*m.TlsCacrl)
+		copy(dAtA[i:], *m.TlsCacrl)
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(len(*m.TlsCacrl)))
+		i--
+		dAtA[i] = 0x3
+		i--
+		dAtA[i] = 0xba
+	}
+	if m.TlsCacert != nil {
+		i -= len(*m.TlsCacert)
+		copy(dAtA[i:], *m.TlsCacert)
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(len(*m.TlsCacert)))
+		i--
+		dAtA[i] = 0x3
+		i--
+		dAtA[i] = 0xb2
+	}
+	if m.LsmProfile != nil {
+		i -= len(*m.LsmProfile)
+		copy(dAtA[i:], *m.LsmProfile)
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(len(*m.LsmProfile)))
+		i--
+		dAtA[i] = 0x3
+		i--
+		dAtA[i] = 0xaa
+	}
+	if m.TcpClose != nil {
+		i--
+		if *m.TcpClose {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x3
+		i--
+		dAtA[i] = 0xa0
+	}
+	if m.ConfigFile != nil {
+		i -= len(*m.ConfigFile)
+		copy(dAtA[i:], *m.ConfigFile)
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(len(*m.ConfigFile)))
+		i--
+		dAtA[i] = 0x3
+		i--
+		dAtA[i] = 0x9a
+	}
+	if m.OrphanPtsMaster != nil {
+		i--
+		if *m.OrphanPtsMaster {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x3
+		i--
+		dAtA[i] = 0x90
+	}
+	if m.StatusFd != nil {
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(*m.StatusFd))
+		i--
+		dAtA[i] = 0x3
+		i--
+		dAtA[i] = 0x88
+	}
+	if m.LazyPages != nil {
+		i--
+		if *m.LazyPages {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x3
+		i--
+		dAtA[i] = 0x80
+	}
+	if m.WeakSysctls != nil {
+		i--
+		if *m.WeakSysctls {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x2
+		i--
+		dAtA[i] = 0xf8
+	}
+	if m.TcpSkipInFlight != nil {
+		i--
+		if *m.TcpSkipInFlight {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x2
+		i--
+		dAtA[i] = 0xf0
+	}
+	if m.Timeout != nil {
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(*m.Timeout))
+		i--
+		dAtA[i] = 0x2
+		i--
+		dAtA[i] = 0xe8
+	}
+	if m.FreezeCgroup != nil {
+		i -= len(*m.FreezeCgroup)
+		copy(dAtA[i:], *m.FreezeCgroup)
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(len(*m.FreezeCgroup)))
+		i--
+		dAtA[i] = 0x2
+		i--
+		dAtA[i] = 0xe2
+	}
+	if len(m.CgroupDumpController) > 0 {
+		for iNdEx := len(m.CgroupDumpController) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.CgroupDumpController[iNdEx])
+			copy(dAtA[i:], m.CgroupDumpController[iNdEx])
+			i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(len(m.CgroupDumpController[iNdEx])))
+			i--
+			dAtA[i] = 0x2
+			i--
+			dAtA[i] = 0xda
+		}
+	}
+	if m.CgroupPropsFile != nil {
+		i -= len(*m.CgroupPropsFile)
+		copy(dAtA[i:], *m.CgroupPropsFile)
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(len(*m.CgroupPropsFile)))
+		i--
+		dAtA[i] = 0x2
+		i--
+		dAtA[i] = 0xd2
+	}
+	if m.CgroupProps != nil {
+		i -= len(*m.CgroupProps)
+		copy(dAtA[i:], *m.CgroupProps)
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(len(*m.CgroupProps)))
+		i--
+		dAtA[i] = 0x2
+		i--
+		dAtA[i] = 0xca
+	}
+	if len(m.JoinNs) > 0 {
+		for iNdEx := len(m.JoinNs) - 1; iNdEx >= 0; iNdEx-- {
+			size, err := m.JoinNs[iNdEx].MarshalToSizedBufferVTStrict(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(size))
+			i--
+			dAtA[i] = 0x2
+			i--
+			dAtA[i] = 0xba
+		}
+	}
+	if m.EmptyNs != nil {
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(*m.EmptyNs))
+		i--
+		dAtA[i] = 0x2
+		i--
+		dAtA[i] = 0xb0
+	}
+	if len(m.External) > 0 {
+		for iNdEx := len(m.External) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.External[iNdEx])
+			copy(dAtA[i:], m.External[iNdEx])
+			i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(len(m.External[iNdEx])))
+			i--
+			dAtA[i] = 0x2
+			i--
+			dAtA[i] = 0xaa
+		}
+	}
+	if len(m.IrmapScanPaths) > 0 {
+		for iNdEx := len(m.IrmapScanPaths) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.IrmapScanPaths[iNdEx])
+			copy(dAtA[i:], m.IrmapScanPaths[iNdEx])
+			i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(len(m.IrmapScanPaths[iNdEx])))
+			i--
+			dAtA[i] = 0x2
+			i--
+			dAtA[i] = 0xa2
+		}
+	}
+	if m.GhostLimit != nil {
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(*m.GhostLimit))
+		i--
+		dAtA[i] = 0x2
+		i--
+		dAtA[i] = 0x98
+	}
+	if m.ManageCgroupsMode != nil {
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(*m.ManageCgroupsMode))
+		i--
+		dAtA[i] = 0x2
+		i--
+		dAtA[i] = 0x90
+	}
+	if len(m.UnixSkIno) > 0 {
+		for iNdEx := len(m.UnixSkIno) - 1; iNdEx >= 0; iNdEx-- {
+			size, err := m.UnixSkIno[iNdEx].MarshalToSizedBufferVTStrict(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(size))
+			i--
+			dAtA[i] = 0x2
+			i--
+			dAtA[i] = 0x8a
+		}
+	}
+	if len(m.EnableFs) > 0 {
+		for iNdEx := len(m.EnableFs) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.EnableFs[iNdEx])
+			copy(dAtA[i:], m.EnableFs[iNdEx])
+			i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(len(m.EnableFs[iNdEx])))
+			i--
+			dAtA[i] = 0x2
+			i--
+			dAtA[i] = 0x82
+		}
+	}
+	if len(m.SkipMnt) > 0 {
+		for iNdEx := len(m.SkipMnt) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.SkipMnt[iNdEx])
+			copy(dAtA[i:], m.SkipMnt[iNdEx])
+			i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(len(m.SkipMnt[iNdEx])))
+			i--
+			dAtA[i] = 0x1
+			i--
+			dAtA[i] = 0xfa
+		}
+	}
+	if m.ExtMasters != nil {
+		i--
+		if *m.ExtMasters {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x1
+		i--
+		dAtA[i] = 0xf0
+	}
+	if m.ExtSharing != nil {
+		i--
+		if *m.ExtSharing {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x1
+		i--
+		dAtA[i] = 0xe8
+	}
+	if m.AutoExtMnt != nil {
+		i--
+		if *m.AutoExtMnt {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x1
+		i--
+		dAtA[i] = 0xe0
+	}
+	if len(m.InheritFd) > 0 {
+		for iNdEx := len(m.InheritFd) - 1; iNdEx >= 0; iNdEx-- {
+			size, err := m.InheritFd[iNdEx].MarshalToSizedBufferVTStrict(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(size))
+			i--
+			dAtA[i] = 0x1
+			i--
+			dAtA[i] = 0xda
+		}
+	}
+	if m.RstSibling != nil {
+		i--
+		if *m.RstSibling {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x1
+		i--
+		dAtA[i] = 0xd0
+	}
+	if len(m.CgRoot) > 0 {
+		for iNdEx := len(m.CgRoot) - 1; iNdEx >= 0; iNdEx-- {
+			size, err := m.CgRoot[iNdEx].MarshalToSizedBufferVTStrict(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(size))
+			i--
+			dAtA[i] = 0x1
+			i--
+			dAtA[i] = 0xca
+		}
+	}
+	if m.ManageCgroups != nil {
+		i--
+		if *m.ManageCgroups {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x1
+		i--
+		dAtA[i] = 0xc0
+	}
+	if len(m.ExtMnt) > 0 {
+		for iNdEx := len(m.ExtMnt) - 1; iNdEx >= 0; iNdEx-- {
+			size, err := m.ExtMnt[iNdEx].MarshalToSizedBufferVTStrict(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(size))
+			i--
+			dAtA[i] = 0x1
+			i--
+			dAtA[i] = 0xba
+		}
+	}
+	if len(m.ExecCmd) > 0 {
+		for iNdEx := len(m.ExecCmd) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.ExecCmd[iNdEx])
+			copy(dAtA[i:], m.ExecCmd[iNdEx])
+			i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(len(m.ExecCmd[iNdEx])))
+			i--
+			dAtA[i] = 0x1
+			i--
+			dAtA[i] = 0xb2
+		}
+	}
+	if m.ForceIrmap != nil {
+		i--
+		if *m.ForceIrmap {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x1
+		i--
+		dAtA[i] = 0xa8
+	}
+	if m.CpuCap != nil {
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(*m.CpuCap))
+		i--
+		dAtA[i] = 0x1
+		i--
+		dAtA[i] = 0xa0
+	}
+	if len(m.Veths) > 0 {
+		for iNdEx := len(m.Veths) - 1; iNdEx >= 0; iNdEx-- {
+			size, err := m.Veths[iNdEx].MarshalToSizedBufferVTStrict(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(size))
+			i--
+			dAtA[i] = 0x1
+			i--
+			dAtA[i] = 0x9a
+		}
+	}
+	if m.LinkRemap != nil {
+		i--
+		if *m.LinkRemap {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x1
+		i--
+		dAtA[i] = 0x90
+	}
+	if m.WorkDirFd != nil {
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(*m.WorkDirFd))
+		i--
+		dAtA[i] = 0x1
+		i--
+		dAtA[i] = 0x88
+	}
+	if m.AutoDedup != nil {
+		i--
+		if *m.AutoDedup {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x1
+		i--
+		dAtA[i] = 0x80
+	}
+	if m.TrackMem != nil {
+		i--
+		if *m.TrackMem {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x78
+	}
+	if m.ParentImg != nil {
+		i -= len(*m.ParentImg)
+		copy(dAtA[i:], *m.ParentImg)
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(len(*m.ParentImg)))
+		i--
+		dAtA[i] = 0x72
+	}
+	if m.Root != nil {
+		i -= len(*m.Root)
+		copy(dAtA[i:], *m.Root)
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(len(*m.Root)))
+		i--
+		dAtA[i] = 0x6a
+	}
+	if m.NotifyScripts != nil {
+		i--
+		if *m.NotifyScripts {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x60
+	}
+	if m.Ps != nil {
+		size, err := m.Ps.MarshalToSizedBufferVTStrict(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0x5a
+	}
+	if m.LogFile != nil {
+		i -= len(*m.LogFile)
+		copy(dAtA[i:], *m.LogFile)
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(len(*m.LogFile)))
+		i--
+		dAtA[i] = 0x52
+	}
+	if m.LogLevel != nil {
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(*m.LogLevel))
+		i--
+		dAtA[i] = 0x48
+	}
+	if m.FileLocks != nil {
+		i--
+		if *m.FileLocks {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x40
+	}
+	if m.ShellJob != nil {
+		i--
+		if *m.ShellJob {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x38
+	}
+	if m.EvasiveDevices != nil {
+		i--
+		if *m.EvasiveDevices {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x30
+	}
+	if m.TcpEstablished != nil {
+		i--
+		if *m.TcpEstablished {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x28
+	}
+	if m.ExtUnixSk != nil {
+		i--
+		if *m.ExtUnixSk {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x20
+	}
+	if m.LeaveRunning != nil {
+		i--
+		if *m.LeaveRunning {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x18
+	}
+	if m.Pid != nil {
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(*m.Pid))
+		i--
+		dAtA[i] = 0x10
+	}
+	if m.ImagesDirFd == nil {
+		return 0, fmt.Errorf("proto: required field images_dir_fd not set")
+	} else {
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(*m.ImagesDirFd))
+		i--
+		dAtA[i] = 0x8
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *CriuDumpResp) MarshalVTStrict() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVTStrict(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *CriuDumpResp) MarshalToVTStrict(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVTStrict(dAtA[:size])
+}
+
+func (m *CriuDumpResp) MarshalToSizedBufferVTStrict(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.Restored != nil {
+		i--
+		if *m.Restored {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x8
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *CriuRestoreResp) MarshalVTStrict() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVTStrict(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *CriuRestoreResp) MarshalToVTStrict(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVTStrict(dAtA[:size])
+}
+
+func (m *CriuRestoreResp) MarshalToSizedBufferVTStrict(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.Pid == nil {
+		return 0, fmt.Errorf("proto: required field pid not set")
+	} else {
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(*m.Pid))
+		i--
+		dAtA[i] = 0x8
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *CriuNotify) MarshalVTStrict() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVTStrict(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *CriuNotify) MarshalToVTStrict(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVTStrict(dAtA[:size])
+}
+
+func (m *CriuNotify) MarshalToSizedBufferVTStrict(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.Pid != nil {
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(*m.Pid))
+		i--
+		dAtA[i] = 0x10
+	}
+	if m.Script != nil {
+		i -= len(*m.Script)
+		copy(dAtA[i:], *m.Script)
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(len(*m.Script)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *CriuFeatures) MarshalVTStrict() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVTStrict(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *CriuFeatures) MarshalToVTStrict(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVTStrict(dAtA[:size])
+}
+
+func (m *CriuFeatures) MarshalToSizedBufferVTStrict(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.PidfdStore != nil {
+		i--
+		if *m.PidfdStore {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x18
+	}
+	if m.LazyPages != nil {
+		i--
+		if *m.LazyPages {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x10
+	}
+	if m.MemTrack != nil {
+		i--
+		if *m.MemTrack {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x8
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *CriuReq) MarshalVTStrict() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVTStrict(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *CriuReq) MarshalToVTStrict(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVTStrict(dAtA[:size])
+}
+
+func (m *CriuReq) MarshalToSizedBufferVTStrict(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.Pid != nil {
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(*m.Pid))
+		i--
+		dAtA[i] = 0x30
+	}
+	if m.Features != nil {
+		size, err := m.Features.MarshalToSizedBufferVTStrict(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0x2a
+	}
+	if m.KeepOpen != nil {
+		i--
+		if *m.KeepOpen {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x20
+	}
+	if m.NotifySuccess != nil {
+		i--
+		if *m.NotifySuccess {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x18
+	}
+	if m.Opts != nil {
+		size, err := m.Opts.MarshalToSizedBufferVTStrict(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0x12
+	}
+	if m.Type == nil {
+		return 0, fmt.Errorf("proto: required field type not set")
+	} else {
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(*m.Type))
+		i--
+		dAtA[i] = 0x8
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *CriuResp) MarshalVTStrict() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVTStrict(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *CriuResp) MarshalToVTStrict(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVTStrict(dAtA[:size])
+}
+
+func (m *CriuResp) MarshalToSizedBufferVTStrict(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.Status != nil {
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(*m.Status))
+		i--
+		dAtA[i] = 0x58
+	}
+	if m.Version != nil {
+		size, err := m.Version.MarshalToSizedBufferVTStrict(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0x52
+	}
+	if m.CrErrmsg != nil {
+		i -= len(*m.CrErrmsg)
+		copy(dAtA[i:], *m.CrErrmsg)
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(len(*m.CrErrmsg)))
+		i--
+		dAtA[i] = 0x4a
+	}
+	if m.Features != nil {
+		size, err := m.Features.MarshalToSizedBufferVTStrict(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0x42
+	}
+	if m.CrErrno != nil {
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(*m.CrErrno))
+		i--
+		dAtA[i] = 0x38
+	}
+	if m.Ps != nil {
+		size, err := m.Ps.MarshalToSizedBufferVTStrict(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0x32
+	}
+	if m.Notify != nil {
+		size, err := m.Notify.MarshalToSizedBufferVTStrict(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0x2a
+	}
+	if m.Restore != nil {
+		size, err := m.Restore.MarshalToSizedBufferVTStrict(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0x22
+	}
+	if m.Dump != nil {
+		size, err := m.Dump.MarshalToSizedBufferVTStrict(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0x1a
+	}
+	if m.Success == nil {
+		return 0, fmt.Errorf("proto: required field success not set")
+	} else {
+		i--
+		if *m.Success {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x10
+	}
+	if m.Type == nil {
+		return 0, fmt.Errorf("proto: required field type not set")
+	} else {
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(*m.Type))
+		i--
+		dAtA[i] = 0x8
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *CriuVersion) MarshalVTStrict() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVTStrict(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *CriuVersion) MarshalToVTStrict(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVTStrict(dAtA[:size])
+}
+
+func (m *CriuVersion) MarshalToSizedBufferVTStrict(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.Name != nil {
+		i -= len(*m.Name)
+		copy(dAtA[i:], *m.Name)
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(len(*m.Name)))
+		i--
+		dAtA[i] = 0x32
+	}
+	if m.Extra != nil {
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(*m.Extra))
+		i--
+		dAtA[i] = 0x28
+	}
+	if m.Sublevel != nil {
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(*m.Sublevel))
+		i--
+		dAtA[i] = 0x20
+	}
+	if m.Gitid != nil {
+		i -= len(*m.Gitid)
+		copy(dAtA[i:], *m.Gitid)
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(len(*m.Gitid)))
+		i--
+		dAtA[i] = 0x1a
+	}
+	if m.MinorNumber == nil {
+		return 0, fmt.Errorf("proto: required field minor_number not set")
+	} else {
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(*m.MinorNumber))
+		i--
+		dAtA[i] = 0x10
+	}
+	if m.MajorNumber == nil {
+		return 0, fmt.Errorf("proto: required field major_number not set")
+	} else {
+		i = protobuf_go_lite.EncodeVarint(dAtA, i, uint64(*m.MajorNumber))
+		i--
+		dAtA[i] = 0x8
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *CriuPageServerInfo) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Address != nil {
+		l = len(*m.Address)
+		n += 1 + l + protobuf_go_lite.SizeOfVarint(uint64(l))
+	}
+	if m.Port != nil {
+		n += 1 + protobuf_go_lite.SizeOfVarint(uint64(*m.Port))
+	}
+	if m.Pid != nil {
+		n += 1 + protobuf_go_lite.SizeOfVarint(uint64(*m.Pid))
+	}
+	if m.Fd != nil {
+		n += 1 + protobuf_go_lite.SizeOfVarint(uint64(*m.Fd))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *CriuVethPair) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.IfIn != nil {
+		l = len(*m.IfIn)
+		n += 1 + l + protobuf_go_lite.SizeOfVarint(uint64(l))
+	}
+	if m.IfOut != nil {
+		l = len(*m.IfOut)
+		n += 1 + l + protobuf_go_lite.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *ExtMountMap) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Key != nil {
+		l = len(*m.Key)
+		n += 1 + l + protobuf_go_lite.SizeOfVarint(uint64(l))
+	}
+	if m.Val != nil {
+		l = len(*m.Val)
+		n += 1 + l + protobuf_go_lite.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *JoinNamespace) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Ns != nil {
+		l = len(*m.Ns)
+		n += 1 + l + protobuf_go_lite.SizeOfVarint(uint64(l))
+	}
+	if m.NsFile != nil {
+		l = len(*m.NsFile)
+		n += 1 + l + protobuf_go_lite.SizeOfVarint(uint64(l))
+	}
+	if m.ExtraOpt != nil {
+		l = len(*m.ExtraOpt)
+		n += 1 + l + protobuf_go_lite.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *InheritFd) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Key != nil {
+		l = len(*m.Key)
+		n += 1 + l + protobuf_go_lite.SizeOfVarint(uint64(l))
+	}
+	if m.Fd != nil {
+		n += 1 + protobuf_go_lite.SizeOfVarint(uint64(*m.Fd))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *CgroupRoot) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Ctrl != nil {
+		l = len(*m.Ctrl)
+		n += 1 + l + protobuf_go_lite.SizeOfVarint(uint64(l))
+	}
+	if m.Path != nil {
+		l = len(*m.Path)
+		n += 1 + l + protobuf_go_lite.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *UnixSk) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Inode != nil {
+		n += 1 + protobuf_go_lite.SizeOfVarint(uint64(*m.Inode))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *CriuOpts) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.ImagesDirFd != nil {
+		n += 1 + protobuf_go_lite.SizeOfVarint(uint64(*m.ImagesDirFd))
+	}
+	if m.Pid != nil {
+		n += 1 + protobuf_go_lite.SizeOfVarint(uint64(*m.Pid))
+	}
+	if m.LeaveRunning != nil {
+		n += 2
+	}
+	if m.ExtUnixSk != nil {
+		n += 2
+	}
+	if m.TcpEstablished != nil {
+		n += 2
+	}
+	if m.EvasiveDevices != nil {
+		n += 2
+	}
+	if m.ShellJob != nil {
+		n += 2
+	}
+	if m.FileLocks != nil {
+		n += 2
+	}
+	if m.LogLevel != nil {
+		n += 1 + protobuf_go_lite.SizeOfVarint(uint64(*m.LogLevel))
+	}
+	if m.LogFile != nil {
+		l = len(*m.LogFile)
+		n += 1 + l + protobuf_go_lite.SizeOfVarint(uint64(l))
+	}
+	if m.Ps != nil {
+		l = m.Ps.SizeVT()
+		n += 1 + l + protobuf_go_lite.SizeOfVarint(uint64(l))
+	}
+	if m.NotifyScripts != nil {
+		n += 2
+	}
+	if m.Root != nil {
+		l = len(*m.Root)
+		n += 1 + l + protobuf_go_lite.SizeOfVarint(uint64(l))
+	}
+	if m.ParentImg != nil {
+		l = len(*m.ParentImg)
+		n += 1 + l + protobuf_go_lite.SizeOfVarint(uint64(l))
+	}
+	if m.TrackMem != nil {
+		n += 2
+	}
+	if m.AutoDedup != nil {
+		n += 3
+	}
+	if m.WorkDirFd != nil {
+		n += 2 + protobuf_go_lite.SizeOfVarint(uint64(*m.WorkDirFd))
+	}
+	if m.LinkRemap != nil {
+		n += 3
+	}
+	if len(m.Veths) > 0 {
+		for _, e := range m.Veths {
+			l = e.SizeVT()
+			n += 2 + l + protobuf_go_lite.SizeOfVarint(uint64(l))
+		}
+	}
+	if m.CpuCap != nil {
+		n += 2 + protobuf_go_lite.SizeOfVarint(uint64(*m.CpuCap))
+	}
+	if m.ForceIrmap != nil {
+		n += 3
+	}
+	if len(m.ExecCmd) > 0 {
+		for _, s := range m.ExecCmd {
+			l = len(s)
+			n += 2 + l + protobuf_go_lite.SizeOfVarint(uint64(l))
+		}
+	}
+	if len(m.ExtMnt) > 0 {
+		for _, e := range m.ExtMnt {
+			l = e.SizeVT()
+			n += 2 + l + protobuf_go_lite.SizeOfVarint(uint64(l))
+		}
+	}
+	if m.ManageCgroups != nil {
+		n += 3
+	}
+	if len(m.CgRoot) > 0 {
+		for _, e := range m.CgRoot {
+			l = e.SizeVT()
+			n += 2 + l + protobuf_go_lite.SizeOfVarint(uint64(l))
+		}
+	}
+	if m.RstSibling != nil {
+		n += 3
+	}
+	if len(m.InheritFd) > 0 {
+		for _, e := range m.InheritFd {
+			l = e.SizeVT()
+			n += 2 + l + protobuf_go_lite.SizeOfVarint(uint64(l))
+		}
+	}
+	if m.AutoExtMnt != nil {
+		n += 3
+	}
+	if m.ExtSharing != nil {
+		n += 3
+	}
+	if m.ExtMasters != nil {
+		n += 3
+	}
+	if len(m.SkipMnt) > 0 {
+		for _, s := range m.SkipMnt {
+			l = len(s)
+			n += 2 + l + protobuf_go_lite.SizeOfVarint(uint64(l))
+		}
+	}
+	if len(m.EnableFs) > 0 {
+		for _, s := range m.EnableFs {
+			l = len(s)
+			n += 2 + l + protobuf_go_lite.SizeOfVarint(uint64(l))
+		}
+	}
+	if len(m.UnixSkIno) > 0 {
+		for _, e := range m.UnixSkIno {
+			l = e.SizeVT()
+			n += 2 + l + protobuf_go_lite.SizeOfVarint(uint64(l))
+		}
+	}
+	if m.ManageCgroupsMode != nil {
+		n += 2 + protobuf_go_lite.SizeOfVarint(uint64(*m.ManageCgroupsMode))
+	}
+	if m.GhostLimit != nil {
+		n += 2 + protobuf_go_lite.SizeOfVarint(uint64(*m.GhostLimit))
+	}
+	if len(m.IrmapScanPaths) > 0 {
+		for _, s := range m.IrmapScanPaths {
+			l = len(s)
+			n += 2 + l + protobuf_go_lite.SizeOfVarint(uint64(l))
+		}
+	}
+	if len(m.External) > 0 {
+		for _, s := range m.External {
+			l = len(s)
+			n += 2 + l + protobuf_go_lite.SizeOfVarint(uint64(l))
+		}
+	}
+	if m.EmptyNs != nil {
+		n += 2 + protobuf_go_lite.SizeOfVarint(uint64(*m.EmptyNs))
+	}
+	if len(m.JoinNs) > 0 {
+		for _, e := range m.JoinNs {
+			l = e.SizeVT()
+			n += 2 + l + protobuf_go_lite.SizeOfVarint(uint64(l))
+		}
+	}
+	if m.CgroupProps != nil {
+		l = len(*m.CgroupProps)
+		n += 2 + l + protobuf_go_lite.SizeOfVarint(uint64(l))
+	}
+	if m.CgroupPropsFile != nil {
+		l = len(*m.CgroupPropsFile)
+		n += 2 + l + protobuf_go_lite.SizeOfVarint(uint64(l))
+	}
+	if len(m.CgroupDumpController) > 0 {
+		for _, s := range m.CgroupDumpController {
+			l = len(s)
+			n += 2 + l + protobuf_go_lite.SizeOfVarint(uint64(l))
+		}
+	}
+	if m.FreezeCgroup != nil {
+		l = len(*m.FreezeCgroup)
+		n += 2 + l + protobuf_go_lite.SizeOfVarint(uint64(l))
+	}
+	if m.Timeout != nil {
+		n += 2 + protobuf_go_lite.SizeOfVarint(uint64(*m.Timeout))
+	}
+	if m.TcpSkipInFlight != nil {
+		n += 3
+	}
+	if m.WeakSysctls != nil {
+		n += 3
+	}
+	if m.LazyPages != nil {
+		n += 3
+	}
+	if m.StatusFd != nil {
+		n += 2 + protobuf_go_lite.SizeOfVarint(uint64(*m.StatusFd))
+	}
+	if m.OrphanPtsMaster != nil {
+		n += 3
+	}
+	if m.ConfigFile != nil {
+		l = len(*m.ConfigFile)
+		n += 2 + l + protobuf_go_lite.SizeOfVarint(uint64(l))
+	}
+	if m.TcpClose != nil {
+		n += 3
+	}
+	if m.LsmProfile != nil {
+		l = len(*m.LsmProfile)
+		n += 2 + l + protobuf_go_lite.SizeOfVarint(uint64(l))
+	}
+	if m.TlsCacert != nil {
+		l = len(*m.TlsCacert)
+		n += 2 + l + protobuf_go_lite.SizeOfVarint(uint64(l))
+	}
+	if m.TlsCacrl != nil {
+		l = len(*m.TlsCacrl)
+		n += 2 + l + protobuf_go_lite.SizeOfVarint(uint64(l))
+	}
+	if m.TlsCert != nil {
+		l = len(*m.TlsCert)
+		n += 2 + l + protobuf_go_lite.SizeOfVarint(uint64(l))
+	}
+	if m.TlsKey != nil {
+		l = len(*m.TlsKey)
+		n += 2 + l + protobuf_go_lite.SizeOfVarint(uint64(l))
+	}
+	if m.Tls != nil {
+		n += 3
+	}
+	if m.TlsNoCnVerify != nil {
+		n += 3
+	}
+	if m.CgroupYard != nil {
+		l = len(*m.CgroupYard)
+		n += 2 + l + protobuf_go_lite.SizeOfVarint(uint64(l))
+	}
+	if m.PreDumpMode != nil {
+		n += 2 + protobuf_go_lite.SizeOfVarint(uint64(*m.PreDumpMode))
+	}
+	if m.PidfdStoreSk != nil {
+		n += 2 + protobuf_go_lite.SizeOfVarint(uint64(*m.PidfdStoreSk))
+	}
+	if m.LsmMountContext != nil {
+		l = len(*m.LsmMountContext)
+		n += 2 + l + protobuf_go_lite.SizeOfVarint(uint64(l))
+	}
+	if m.NetworkLock != nil {
+		n += 2 + protobuf_go_lite.SizeOfVarint(uint64(*m.NetworkLock))
+	}
+	if m.MntnsCompatMode != nil {
+		n += 3
+	}
+	if m.SkipFileRwxCheck != nil {
+		n += 3
+	}
+	if m.Unprivileged != nil {
+		n += 3
+	}
+	if m.ImagesDir != nil {
+		l = len(*m.ImagesDir)
+		n += 2 + l + protobuf_go_lite.SizeOfVarint(uint64(l))
+	}
+	if m.LeaveStopped != nil {
+		n += 3
+	}
+	if m.DisplayStats != nil {
+		n += 3
+	}
+	if m.LogToStderr != nil {
+		n += 3
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *CriuDumpResp) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Restored != nil {
+		n += 2
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *CriuRestoreResp) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Pid != nil {
+		n += 1 + protobuf_go_lite.SizeOfVarint(uint64(*m.Pid))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *CriuNotify) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Script != nil {
+		l = len(*m.Script)
+		n += 1 + l + protobuf_go_lite.SizeOfVarint(uint64(l))
+	}
+	if m.Pid != nil {
+		n += 1 + protobuf_go_lite.SizeOfVarint(uint64(*m.Pid))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *CriuFeatures) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.MemTrack != nil {
+		n += 2
+	}
+	if m.LazyPages != nil {
+		n += 2
+	}
+	if m.PidfdStore != nil {
+		n += 2
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *CriuReq) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Type != nil {
+		n += 1 + protobuf_go_lite.SizeOfVarint(uint64(*m.Type))
+	}
+	if m.Opts != nil {
+		l = m.Opts.SizeVT()
+		n += 1 + l + protobuf_go_lite.SizeOfVarint(uint64(l))
+	}
+	if m.NotifySuccess != nil {
+		n += 2
+	}
+	if m.KeepOpen != nil {
+		n += 2
+	}
+	if m.Features != nil {
+		l = m.Features.SizeVT()
+		n += 1 + l + protobuf_go_lite.SizeOfVarint(uint64(l))
+	}
+	if m.Pid != nil {
+		n += 1 + protobuf_go_lite.SizeOfVarint(uint64(*m.Pid))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *CriuResp) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Type != nil {
+		n += 1 + protobuf_go_lite.SizeOfVarint(uint64(*m.Type))
+	}
+	if m.Success != nil {
+		n += 2
+	}
+	if m.Dump != nil {
+		l = m.Dump.SizeVT()
+		n += 1 + l + protobuf_go_lite.SizeOfVarint(uint64(l))
+	}
+	if m.Restore != nil {
+		l = m.Restore.SizeVT()
+		n += 1 + l + protobuf_go_lite.SizeOfVarint(uint64(l))
+	}
+	if m.Notify != nil {
+		l = m.Notify.SizeVT()
+		n += 1 + l + protobuf_go_lite.SizeOfVarint(uint64(l))
+	}
+	if m.Ps != nil {
+		l = m.Ps.SizeVT()
+		n += 1 + l + protobuf_go_lite.SizeOfVarint(uint64(l))
+	}
+	if m.CrErrno != nil {
+		n += 1 + protobuf_go_lite.SizeOfVarint(uint64(*m.CrErrno))
+	}
+	if m.Features != nil {
+		l = m.Features.SizeVT()
+		n += 1 + l + protobuf_go_lite.SizeOfVarint(uint64(l))
+	}
+	if m.CrErrmsg != nil {
+		l = len(*m.CrErrmsg)
+		n += 1 + l + protobuf_go_lite.SizeOfVarint(uint64(l))
+	}
+	if m.Version != nil {
+		l = m.Version.SizeVT()
+		n += 1 + l + protobuf_go_lite.SizeOfVarint(uint64(l))
+	}
+	if m.Status != nil {
+		n += 1 + protobuf_go_lite.SizeOfVarint(uint64(*m.Status))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *CriuVersion) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.MajorNumber != nil {
+		n += 1 + protobuf_go_lite.SizeOfVarint(uint64(*m.MajorNumber))
+	}
+	if m.MinorNumber != nil {
+		n += 1 + protobuf_go_lite.SizeOfVarint(uint64(*m.MinorNumber))
+	}
+	if m.Gitid != nil {
+		l = len(*m.Gitid)
+		n += 1 + l + protobuf_go_lite.SizeOfVarint(uint64(l))
+	}
+	if m.Sublevel != nil {
+		n += 1 + protobuf_go_lite.SizeOfVarint(uint64(*m.Sublevel))
+	}
+	if m.Extra != nil {
+		n += 1 + protobuf_go_lite.SizeOfVarint(uint64(*m.Extra))
+	}
+	if m.Name != nil {
+		l = len(*m.Name)
+		n += 1 + l + protobuf_go_lite.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (x CriuCgMode) MarshalProtoText() string {
+	return x.String()
+}
+func (x CriuNetworkLockMethod) MarshalProtoText() string {
+	return x.String()
+}
+func (x CriuPreDumpMode) MarshalProtoText() string {
+	return x.String()
+}
+func (x CriuReqType) MarshalProtoText() string {
+	return x.String()
+}
+func (x *CriuPageServerInfo) MarshalProtoText() string {
+	var sb strings.Builder
+	sb.WriteString("criu_page_server_info {")
+	if x.Address != nil {
+		if sb.Len() > 23 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("address: ")
+		sb.WriteString(strconv.Quote(*x.Address))
+	}
+	if x.Port != nil {
+		if sb.Len() > 23 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("port: ")
+		sb.WriteString(strconv.FormatInt(int64(*x.Port), 10))
+	}
+	if x.Pid != nil {
+		if sb.Len() > 23 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("pid: ")
+		sb.WriteString(strconv.FormatInt(int64(*x.Pid), 10))
+	}
+	if x.Fd != nil {
+		if sb.Len() > 23 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("fd: ")
+		sb.WriteString(strconv.FormatInt(int64(*x.Fd), 10))
+	}
+	sb.WriteString("}")
+	return sb.String()
+}
+
+func (x *CriuPageServerInfo) String() string {
+	return x.MarshalProtoText()
+}
+func (x *CriuVethPair) MarshalProtoText() string {
+	var sb strings.Builder
+	sb.WriteString("criu_veth_pair {")
+	if x.IfIn != nil {
+		if sb.Len() > 16 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("if_in: ")
+		sb.WriteString(strconv.Quote(*x.IfIn))
+	}
+	if x.IfOut != nil {
+		if sb.Len() > 16 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("if_out: ")
+		sb.WriteString(strconv.Quote(*x.IfOut))
+	}
+	sb.WriteString("}")
+	return sb.String()
+}
+
+func (x *CriuVethPair) String() string {
+	return x.MarshalProtoText()
+}
+func (x *ExtMountMap) MarshalProtoText() string {
+	var sb strings.Builder
+	sb.WriteString("ext_mount_map {")
+	if x.Key != nil {
+		if sb.Len() > 15 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("key: ")
+		sb.WriteString(strconv.Quote(*x.Key))
+	}
+	if x.Val != nil {
+		if sb.Len() > 15 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("val: ")
+		sb.WriteString(strconv.Quote(*x.Val))
+	}
+	sb.WriteString("}")
+	return sb.String()
+}
+
+func (x *ExtMountMap) String() string {
+	return x.MarshalProtoText()
+}
+func (x *JoinNamespace) MarshalProtoText() string {
+	var sb strings.Builder
+	sb.WriteString("join_namespace {")
+	if x.Ns != nil {
+		if sb.Len() > 16 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("ns: ")
+		sb.WriteString(strconv.Quote(*x.Ns))
+	}
+	if x.NsFile != nil {
+		if sb.Len() > 16 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("ns_file: ")
+		sb.WriteString(strconv.Quote(*x.NsFile))
+	}
+	if x.ExtraOpt != nil {
+		if sb.Len() > 16 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("extra_opt: ")
+		sb.WriteString(strconv.Quote(*x.ExtraOpt))
+	}
+	sb.WriteString("}")
+	return sb.String()
+}
+
+func (x *JoinNamespace) String() string {
+	return x.MarshalProtoText()
+}
+func (x *InheritFd) MarshalProtoText() string {
+	var sb strings.Builder
+	sb.WriteString("inherit_fd {")
+	if x.Key != nil {
+		if sb.Len() > 12 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("key: ")
+		sb.WriteString(strconv.Quote(*x.Key))
+	}
+	if x.Fd != nil {
+		if sb.Len() > 12 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("fd: ")
+		sb.WriteString(strconv.FormatInt(int64(*x.Fd), 10))
+	}
+	sb.WriteString("}")
+	return sb.String()
+}
+
+func (x *InheritFd) String() string {
+	return x.MarshalProtoText()
+}
+func (x *CgroupRoot) MarshalProtoText() string {
+	var sb strings.Builder
+	sb.WriteString("cgroup_root {")
+	if x.Ctrl != nil {
+		if sb.Len() > 13 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("ctrl: ")
+		sb.WriteString(strconv.Quote(*x.Ctrl))
+	}
+	if x.Path != nil {
+		if sb.Len() > 13 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("path: ")
+		sb.WriteString(strconv.Quote(*x.Path))
+	}
+	sb.WriteString("}")
+	return sb.String()
+}
+
+func (x *CgroupRoot) String() string {
+	return x.MarshalProtoText()
+}
+func (x *UnixSk) MarshalProtoText() string {
+	var sb strings.Builder
+	sb.WriteString("unix_sk {")
+	if x.Inode != nil {
+		if sb.Len() > 9 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("inode: ")
+		sb.WriteString(strconv.FormatUint(uint64(*x.Inode), 10))
+	}
+	sb.WriteString("}")
+	return sb.String()
+}
+
+func (x *UnixSk) String() string {
+	return x.MarshalProtoText()
+}
+func (x *CriuOpts) MarshalProtoText() string {
+	var sb strings.Builder
+	sb.WriteString("criu_opts {")
+	if x.ImagesDirFd != nil {
+		if sb.Len() > 11 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("images_dir_fd: ")
+		sb.WriteString(strconv.FormatInt(int64(*x.ImagesDirFd), 10))
+	}
+	if x.Pid != nil {
+		if sb.Len() > 11 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("pid: ")
+		sb.WriteString(strconv.FormatInt(int64(*x.Pid), 10))
+	}
+	if x.LeaveRunning != nil {
+		if sb.Len() > 11 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("leave_running: ")
+		sb.WriteString(strconv.FormatBool(*x.LeaveRunning))
+	}
+	if x.ExtUnixSk != nil {
+		if sb.Len() > 11 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("ext_unix_sk: ")
+		sb.WriteString(strconv.FormatBool(*x.ExtUnixSk))
+	}
+	if x.TcpEstablished != nil {
+		if sb.Len() > 11 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("tcp_established: ")
+		sb.WriteString(strconv.FormatBool(*x.TcpEstablished))
+	}
+	if x.EvasiveDevices != nil {
+		if sb.Len() > 11 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("evasive_devices: ")
+		sb.WriteString(strconv.FormatBool(*x.EvasiveDevices))
+	}
+	if x.ShellJob != nil {
+		if sb.Len() > 11 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("shell_job: ")
+		sb.WriteString(strconv.FormatBool(*x.ShellJob))
+	}
+	if x.FileLocks != nil {
+		if sb.Len() > 11 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("file_locks: ")
+		sb.WriteString(strconv.FormatBool(*x.FileLocks))
+	}
+	if x.LogLevel != nil {
+		if sb.Len() > 11 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("log_level: ")
+		sb.WriteString(strconv.FormatInt(int64(*x.LogLevel), 10))
+	}
+	if x.LogFile != nil {
+		if sb.Len() > 11 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("log_file: ")
+		sb.WriteString(strconv.Quote(*x.LogFile))
+	}
+	if x.Ps != nil {
+		if sb.Len() > 11 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("ps: ")
+		sb.WriteString(x.Ps.MarshalProtoText())
+	}
+	if x.NotifyScripts != nil {
+		if sb.Len() > 11 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("notify_scripts: ")
+		sb.WriteString(strconv.FormatBool(*x.NotifyScripts))
+	}
+	if x.Root != nil {
+		if sb.Len() > 11 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("root: ")
+		sb.WriteString(strconv.Quote(*x.Root))
+	}
+	if x.ParentImg != nil {
+		if sb.Len() > 11 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("parent_img: ")
+		sb.WriteString(strconv.Quote(*x.ParentImg))
+	}
+	if x.TrackMem != nil {
+		if sb.Len() > 11 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("track_mem: ")
+		sb.WriteString(strconv.FormatBool(*x.TrackMem))
+	}
+	if x.AutoDedup != nil {
+		if sb.Len() > 11 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("auto_dedup: ")
+		sb.WriteString(strconv.FormatBool(*x.AutoDedup))
+	}
+	if x.WorkDirFd != nil {
+		if sb.Len() > 11 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("work_dir_fd: ")
+		sb.WriteString(strconv.FormatInt(int64(*x.WorkDirFd), 10))
+	}
+	if x.LinkRemap != nil {
+		if sb.Len() > 11 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("link_remap: ")
+		sb.WriteString(strconv.FormatBool(*x.LinkRemap))
+	}
+	if len(x.Veths) > 0 {
+		if sb.Len() > 11 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("veths: [")
+		for i, v := range x.Veths {
+			if i > 0 {
+				sb.WriteString(", ")
+			}
+			if v == nil {
+				sb.WriteString((&CriuVethPair{}).MarshalProtoText())
+			} else {
+				sb.WriteString(v.MarshalProtoText())
+			}
+		}
+		sb.WriteString("]")
+	}
+	if x.CpuCap != nil {
+		if sb.Len() > 11 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("cpu_cap: ")
+		sb.WriteString(strconv.FormatUint(uint64(*x.CpuCap), 10))
+	}
+	if x.ForceIrmap != nil {
+		if sb.Len() > 11 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("force_irmap: ")
+		sb.WriteString(strconv.FormatBool(*x.ForceIrmap))
+	}
+	if len(x.ExecCmd) > 0 {
+		if sb.Len() > 11 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("exec_cmd: [")
+		for i, v := range x.ExecCmd {
+			if i > 0 {
+				sb.WriteString(", ")
+			}
+			sb.WriteString(strconv.Quote(v))
+		}
+		sb.WriteString("]")
+	}
+	if len(x.ExtMnt) > 0 {
+		if sb.Len() > 11 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("ext_mnt: [")
+		for i, v := range x.ExtMnt {
+			if i > 0 {
+				sb.WriteString(", ")
+			}
+			if v == nil {
+				sb.WriteString((&ExtMountMap{}).MarshalProtoText())
+			} else {
+				sb.WriteString(v.MarshalProtoText())
+			}
+		}
+		sb.WriteString("]")
+	}
+	if x.ManageCgroups != nil {
+		if sb.Len() > 11 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("manage_cgroups: ")
+		sb.WriteString(strconv.FormatBool(*x.ManageCgroups))
+	}
+	if len(x.CgRoot) > 0 {
+		if sb.Len() > 11 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("cg_root: [")
+		for i, v := range x.CgRoot {
+			if i > 0 {
+				sb.WriteString(", ")
+			}
+			if v == nil {
+				sb.WriteString((&CgroupRoot{}).MarshalProtoText())
+			} else {
+				sb.WriteString(v.MarshalProtoText())
+			}
+		}
+		sb.WriteString("]")
+	}
+	if x.RstSibling != nil {
+		if sb.Len() > 11 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("rst_sibling: ")
+		sb.WriteString(strconv.FormatBool(*x.RstSibling))
+	}
+	if len(x.InheritFd) > 0 {
+		if sb.Len() > 11 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("inherit_fd: [")
+		for i, v := range x.InheritFd {
+			if i > 0 {
+				sb.WriteString(", ")
+			}
+			if v == nil {
+				sb.WriteString((&InheritFd{}).MarshalProtoText())
+			} else {
+				sb.WriteString(v.MarshalProtoText())
+			}
+		}
+		sb.WriteString("]")
+	}
+	if x.AutoExtMnt != nil {
+		if sb.Len() > 11 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("auto_ext_mnt: ")
+		sb.WriteString(strconv.FormatBool(*x.AutoExtMnt))
+	}
+	if x.ExtSharing != nil {
+		if sb.Len() > 11 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("ext_sharing: ")
+		sb.WriteString(strconv.FormatBool(*x.ExtSharing))
+	}
+	if x.ExtMasters != nil {
+		if sb.Len() > 11 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("ext_masters: ")
+		sb.WriteString(strconv.FormatBool(*x.ExtMasters))
+	}
+	if len(x.SkipMnt) > 0 {
+		if sb.Len() > 11 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("skip_mnt: [")
+		for i, v := range x.SkipMnt {
+			if i > 0 {
+				sb.WriteString(", ")
+			}
+			sb.WriteString(strconv.Quote(v))
+		}
+		sb.WriteString("]")
+	}
+	if len(x.EnableFs) > 0 {
+		if sb.Len() > 11 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("enable_fs: [")
+		for i, v := range x.EnableFs {
+			if i > 0 {
+				sb.WriteString(", ")
+			}
+			sb.WriteString(strconv.Quote(v))
+		}
+		sb.WriteString("]")
+	}
+	if len(x.UnixSkIno) > 0 {
+		if sb.Len() > 11 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("unix_sk_ino: [")
+		for i, v := range x.UnixSkIno {
+			if i > 0 {
+				sb.WriteString(", ")
+			}
+			if v == nil {
+				sb.WriteString((&UnixSk{}).MarshalProtoText())
+			} else {
+				sb.WriteString(v.MarshalProtoText())
+			}
+		}
+		sb.WriteString("]")
+	}
+	if x.ManageCgroupsMode != nil {
+		if sb.Len() > 11 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("manage_cgroups_mode: ")
+		sb.WriteString("\"")
+		sb.WriteString(x.ManageCgroupsMode.String())
+		sb.WriteString("\"")
+	}
+	if x.GhostLimit != nil {
+		if sb.Len() > 11 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("ghost_limit: ")
+		sb.WriteString(strconv.FormatUint(uint64(*x.GhostLimit), 10))
+	}
+	if len(x.IrmapScanPaths) > 0 {
+		if sb.Len() > 11 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("irmap_scan_paths: [")
+		for i, v := range x.IrmapScanPaths {
+			if i > 0 {
+				sb.WriteString(", ")
+			}
+			sb.WriteString(strconv.Quote(v))
+		}
+		sb.WriteString("]")
+	}
+	if len(x.External) > 0 {
+		if sb.Len() > 11 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("external: [")
+		for i, v := range x.External {
+			if i > 0 {
+				sb.WriteString(", ")
+			}
+			sb.WriteString(strconv.Quote(v))
+		}
+		sb.WriteString("]")
+	}
+	if x.EmptyNs != nil {
+		if sb.Len() > 11 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("empty_ns: ")
+		sb.WriteString(strconv.FormatUint(uint64(*x.EmptyNs), 10))
+	}
+	if len(x.JoinNs) > 0 {
+		if sb.Len() > 11 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("join_ns: [")
+		for i, v := range x.JoinNs {
+			if i > 0 {
+				sb.WriteString(", ")
+			}
+			if v == nil {
+				sb.WriteString((&JoinNamespace{}).MarshalProtoText())
+			} else {
+				sb.WriteString(v.MarshalProtoText())
+			}
+		}
+		sb.WriteString("]")
+	}
+	if x.CgroupProps != nil {
+		if sb.Len() > 11 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("cgroup_props: ")
+		sb.WriteString(strconv.Quote(*x.CgroupProps))
+	}
+	if x.CgroupPropsFile != nil {
+		if sb.Len() > 11 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("cgroup_props_file: ")
+		sb.WriteString(strconv.Quote(*x.CgroupPropsFile))
+	}
+	if len(x.CgroupDumpController) > 0 {
+		if sb.Len() > 11 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("cgroup_dump_controller: [")
+		for i, v := range x.CgroupDumpController {
+			if i > 0 {
+				sb.WriteString(", ")
+			}
+			sb.WriteString(strconv.Quote(v))
+		}
+		sb.WriteString("]")
+	}
+	if x.FreezeCgroup != nil {
+		if sb.Len() > 11 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("freeze_cgroup: ")
+		sb.WriteString(strconv.Quote(*x.FreezeCgroup))
+	}
+	if x.Timeout != nil {
+		if sb.Len() > 11 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("timeout: ")
+		sb.WriteString(strconv.FormatUint(uint64(*x.Timeout), 10))
+	}
+	if x.TcpSkipInFlight != nil {
+		if sb.Len() > 11 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("tcp_skip_in_flight: ")
+		sb.WriteString(strconv.FormatBool(*x.TcpSkipInFlight))
+	}
+	if x.WeakSysctls != nil {
+		if sb.Len() > 11 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("weak_sysctls: ")
+		sb.WriteString(strconv.FormatBool(*x.WeakSysctls))
+	}
+	if x.LazyPages != nil {
+		if sb.Len() > 11 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("lazy_pages: ")
+		sb.WriteString(strconv.FormatBool(*x.LazyPages))
+	}
+	if x.StatusFd != nil {
+		if sb.Len() > 11 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("status_fd: ")
+		sb.WriteString(strconv.FormatInt(int64(*x.StatusFd), 10))
+	}
+	if x.OrphanPtsMaster != nil {
+		if sb.Len() > 11 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("orphan_pts_master: ")
+		sb.WriteString(strconv.FormatBool(*x.OrphanPtsMaster))
+	}
+	if x.ConfigFile != nil {
+		if sb.Len() > 11 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("config_file: ")
+		sb.WriteString(strconv.Quote(*x.ConfigFile))
+	}
+	if x.TcpClose != nil {
+		if sb.Len() > 11 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("tcp_close: ")
+		sb.WriteString(strconv.FormatBool(*x.TcpClose))
+	}
+	if x.LsmProfile != nil {
+		if sb.Len() > 11 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("lsm_profile: ")
+		sb.WriteString(strconv.Quote(*x.LsmProfile))
+	}
+	if x.TlsCacert != nil {
+		if sb.Len() > 11 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("tls_cacert: ")
+		sb.WriteString(strconv.Quote(*x.TlsCacert))
+	}
+	if x.TlsCacrl != nil {
+		if sb.Len() > 11 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("tls_cacrl: ")
+		sb.WriteString(strconv.Quote(*x.TlsCacrl))
+	}
+	if x.TlsCert != nil {
+		if sb.Len() > 11 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("tls_cert: ")
+		sb.WriteString(strconv.Quote(*x.TlsCert))
+	}
+	if x.TlsKey != nil {
+		if sb.Len() > 11 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("tls_key: ")
+		sb.WriteString(strconv.Quote(*x.TlsKey))
+	}
+	if x.Tls != nil {
+		if sb.Len() > 11 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("tls: ")
+		sb.WriteString(strconv.FormatBool(*x.Tls))
+	}
+	if x.TlsNoCnVerify != nil {
+		if sb.Len() > 11 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("tls_no_cn_verify: ")
+		sb.WriteString(strconv.FormatBool(*x.TlsNoCnVerify))
+	}
+	if x.CgroupYard != nil {
+		if sb.Len() > 11 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("cgroup_yard: ")
+		sb.WriteString(strconv.Quote(*x.CgroupYard))
+	}
+	if x.PreDumpMode != nil {
+		if sb.Len() > 11 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("pre_dump_mode: ")
+		sb.WriteString("\"")
+		sb.WriteString(x.PreDumpMode.String())
+		sb.WriteString("\"")
+	}
+	if x.PidfdStoreSk != nil {
+		if sb.Len() > 11 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("pidfd_store_sk: ")
+		sb.WriteString(strconv.FormatInt(int64(*x.PidfdStoreSk), 10))
+	}
+	if x.LsmMountContext != nil {
+		if sb.Len() > 11 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("lsm_mount_context: ")
+		sb.WriteString(strconv.Quote(*x.LsmMountContext))
+	}
+	if x.NetworkLock != nil {
+		if sb.Len() > 11 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("network_lock: ")
+		sb.WriteString("\"")
+		sb.WriteString(x.NetworkLock.String())
+		sb.WriteString("\"")
+	}
+	if x.MntnsCompatMode != nil {
+		if sb.Len() > 11 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("mntns_compat_mode: ")
+		sb.WriteString(strconv.FormatBool(*x.MntnsCompatMode))
+	}
+	if x.SkipFileRwxCheck != nil {
+		if sb.Len() > 11 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("skip_file_rwx_check: ")
+		sb.WriteString(strconv.FormatBool(*x.SkipFileRwxCheck))
+	}
+	if x.Unprivileged != nil {
+		if sb.Len() > 11 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("unprivileged: ")
+		sb.WriteString(strconv.FormatBool(*x.Unprivileged))
+	}
+	if x.ImagesDir != nil {
+		if sb.Len() > 11 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("images_dir: ")
+		sb.WriteString(strconv.Quote(*x.ImagesDir))
+	}
+	if x.LeaveStopped != nil {
+		if sb.Len() > 11 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("leave_stopped: ")
+		sb.WriteString(strconv.FormatBool(*x.LeaveStopped))
+	}
+	if x.DisplayStats != nil {
+		if sb.Len() > 11 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("display_stats: ")
+		sb.WriteString(strconv.FormatBool(*x.DisplayStats))
+	}
+	if x.LogToStderr != nil {
+		if sb.Len() > 11 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("log_to_stderr: ")
+		sb.WriteString(strconv.FormatBool(*x.LogToStderr))
+	}
+	sb.WriteString("}")
+	return sb.String()
+}
+
+func (x *CriuOpts) String() string {
+	return x.MarshalProtoText()
+}
+func (x *CriuDumpResp) MarshalProtoText() string {
+	var sb strings.Builder
+	sb.WriteString("criu_dump_resp {")
+	if x.Restored != nil {
+		if sb.Len() > 16 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("restored: ")
+		sb.WriteString(strconv.FormatBool(*x.Restored))
+	}
+	sb.WriteString("}")
+	return sb.String()
+}
+
+func (x *CriuDumpResp) String() string {
+	return x.MarshalProtoText()
+}
+func (x *CriuRestoreResp) MarshalProtoText() string {
+	var sb strings.Builder
+	sb.WriteString("criu_restore_resp {")
+	if x.Pid != nil {
+		if sb.Len() > 19 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("pid: ")
+		sb.WriteString(strconv.FormatInt(int64(*x.Pid), 10))
+	}
+	sb.WriteString("}")
+	return sb.String()
+}
+
+func (x *CriuRestoreResp) String() string {
+	return x.MarshalProtoText()
+}
+func (x *CriuNotify) MarshalProtoText() string {
+	var sb strings.Builder
+	sb.WriteString("criu_notify {")
+	if x.Script != nil {
+		if sb.Len() > 13 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("script: ")
+		sb.WriteString(strconv.Quote(*x.Script))
+	}
+	if x.Pid != nil {
+		if sb.Len() > 13 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("pid: ")
+		sb.WriteString(strconv.FormatInt(int64(*x.Pid), 10))
+	}
+	sb.WriteString("}")
+	return sb.String()
+}
+
+func (x *CriuNotify) String() string {
+	return x.MarshalProtoText()
+}
+func (x *CriuFeatures) MarshalProtoText() string {
+	var sb strings.Builder
+	sb.WriteString("criu_features {")
+	if x.MemTrack != nil {
+		if sb.Len() > 15 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("mem_track: ")
+		sb.WriteString(strconv.FormatBool(*x.MemTrack))
+	}
+	if x.LazyPages != nil {
+		if sb.Len() > 15 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("lazy_pages: ")
+		sb.WriteString(strconv.FormatBool(*x.LazyPages))
+	}
+	if x.PidfdStore != nil {
+		if sb.Len() > 15 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("pidfd_store: ")
+		sb.WriteString(strconv.FormatBool(*x.PidfdStore))
+	}
+	sb.WriteString("}")
+	return sb.String()
+}
+
+func (x *CriuFeatures) String() string {
+	return x.MarshalProtoText()
+}
+func (x *CriuReq) MarshalProtoText() string {
+	var sb strings.Builder
+	sb.WriteString("criu_req {")
+	if x.Type != nil {
+		if sb.Len() > 10 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("type: ")
+		sb.WriteString("\"")
+		sb.WriteString(x.Type.String())
+		sb.WriteString("\"")
+	}
+	if x.Opts != nil {
+		if sb.Len() > 10 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("opts: ")
+		sb.WriteString(x.Opts.MarshalProtoText())
+	}
+	if x.NotifySuccess != nil {
+		if sb.Len() > 10 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("notify_success: ")
+		sb.WriteString(strconv.FormatBool(*x.NotifySuccess))
+	}
+	if x.KeepOpen != nil {
+		if sb.Len() > 10 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("keep_open: ")
+		sb.WriteString(strconv.FormatBool(*x.KeepOpen))
+	}
+	if x.Features != nil {
+		if sb.Len() > 10 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("features: ")
+		sb.WriteString(x.Features.MarshalProtoText())
+	}
+	if x.Pid != nil {
+		if sb.Len() > 10 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("pid: ")
+		sb.WriteString(strconv.FormatUint(uint64(*x.Pid), 10))
+	}
+	sb.WriteString("}")
+	return sb.String()
+}
+
+func (x *CriuReq) String() string {
+	return x.MarshalProtoText()
+}
+func (x *CriuResp) MarshalProtoText() string {
+	var sb strings.Builder
+	sb.WriteString("criu_resp {")
+	if x.Type != nil {
+		if sb.Len() > 11 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("type: ")
+		sb.WriteString("\"")
+		sb.WriteString(x.Type.String())
+		sb.WriteString("\"")
+	}
+	if x.Success != nil {
+		if sb.Len() > 11 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("success: ")
+		sb.WriteString(strconv.FormatBool(*x.Success))
+	}
+	if x.Dump != nil {
+		if sb.Len() > 11 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("dump: ")
+		sb.WriteString(x.Dump.MarshalProtoText())
+	}
+	if x.Restore != nil {
+		if sb.Len() > 11 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("restore: ")
+		sb.WriteString(x.Restore.MarshalProtoText())
+	}
+	if x.Notify != nil {
+		if sb.Len() > 11 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("notify: ")
+		sb.WriteString(x.Notify.MarshalProtoText())
+	}
+	if x.Ps != nil {
+		if sb.Len() > 11 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("ps: ")
+		sb.WriteString(x.Ps.MarshalProtoText())
+	}
+	if x.CrErrno != nil {
+		if sb.Len() > 11 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("cr_errno: ")
+		sb.WriteString(strconv.FormatInt(int64(*x.CrErrno), 10))
+	}
+	if x.Features != nil {
+		if sb.Len() > 11 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("features: ")
+		sb.WriteString(x.Features.MarshalProtoText())
+	}
+	if x.CrErrmsg != nil {
+		if sb.Len() > 11 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("cr_errmsg: ")
+		sb.WriteString(strconv.Quote(*x.CrErrmsg))
+	}
+	if x.Version != nil {
+		if sb.Len() > 11 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("version: ")
+		sb.WriteString(x.Version.MarshalProtoText())
+	}
+	if x.Status != nil {
+		if sb.Len() > 11 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("status: ")
+		sb.WriteString(strconv.FormatInt(int64(*x.Status), 10))
+	}
+	sb.WriteString("}")
+	return sb.String()
+}
+
+func (x *CriuResp) String() string {
+	return x.MarshalProtoText()
+}
+func (x *CriuVersion) MarshalProtoText() string {
+	var sb strings.Builder
+	sb.WriteString("criu_version {")
+	if x.MajorNumber != nil {
+		if sb.Len() > 14 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("major_number: ")
+		sb.WriteString(strconv.FormatInt(int64(*x.MajorNumber), 10))
+	}
+	if x.MinorNumber != nil {
+		if sb.Len() > 14 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("minor_number: ")
+		sb.WriteString(strconv.FormatInt(int64(*x.MinorNumber), 10))
+	}
+	if x.Gitid != nil {
+		if sb.Len() > 14 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("gitid: ")
+		sb.WriteString(strconv.Quote(*x.Gitid))
+	}
+	if x.Sublevel != nil {
+		if sb.Len() > 14 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("sublevel: ")
+		sb.WriteString(strconv.FormatInt(int64(*x.Sublevel), 10))
+	}
+	if x.Extra != nil {
+		if sb.Len() > 14 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("extra: ")
+		sb.WriteString(strconv.FormatInt(int64(*x.Extra), 10))
+	}
+	if x.Name != nil {
+		if sb.Len() > 14 {
+			sb.WriteString(" ")
+		}
+		sb.WriteString("name: ")
+		sb.WriteString(strconv.Quote(*x.Name))
+	}
+	sb.WriteString("}")
+	return sb.String()
+}
+
+func (x *CriuVersion) String() string {
+	return x.MarshalProtoText()
+}
+func (m *CriuPageServerInfo) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	var err error
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		wire, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+		if err != nil {
+			return err
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: CriuPageServerInfo: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: CriuPageServerInfo: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Address", wireType)
+			}
+			var stringLen uint64
+			stringLen, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			s := string(dAtA[iNdEx:postIndex])
+			m.Address = &s
+			iNdEx = postIndex
+		case 2:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Port", wireType)
+			}
+			var v int32
+			v, iNdEx, err = protobuf_go_lite.DecodeVarintInt32(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			m.Port = &v
+		case 3:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Pid", wireType)
+			}
+			var v int32
+			v, iNdEx, err = protobuf_go_lite.DecodeVarintInt32(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			m.Pid = &v
+		case 4:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Fd", wireType)
+			}
+			var v int32
+			v, iNdEx, err = protobuf_go_lite.DecodeVarintInt32(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			m.Fd = &v
+		default:
+			iNdEx = preIndex
+			skippy, err := protobuf_go_lite.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *CriuVethPair) UnmarshalVT(dAtA []byte) error {
+	var hasFields [1]uint64
+	l := len(dAtA)
+	iNdEx := 0
+	var err error
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		wire, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+		if err != nil {
+			return err
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: CriuVethPair: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: CriuVethPair: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field IfIn", wireType)
+			}
+			var stringLen uint64
+			stringLen, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			s := string(dAtA[iNdEx:postIndex])
+			m.IfIn = &s
+			iNdEx = postIndex
+			hasFields[0] |= uint64(0x00000001)
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field IfOut", wireType)
+			}
+			var stringLen uint64
+			stringLen, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			s := string(dAtA[iNdEx:postIndex])
+			m.IfOut = &s
+			iNdEx = postIndex
+			hasFields[0] |= uint64(0x00000002)
+		default:
+			iNdEx = preIndex
+			skippy, err := protobuf_go_lite.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+	if hasFields[0]&uint64(0x00000001) == 0 {
+		return fmt.Errorf("proto: required field if_in not set")
+	}
+	if hasFields[0]&uint64(0x00000002) == 0 {
+		return fmt.Errorf("proto: required field if_out not set")
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *ExtMountMap) UnmarshalVT(dAtA []byte) error {
+	var hasFields [1]uint64
+	l := len(dAtA)
+	iNdEx := 0
+	var err error
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		wire, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+		if err != nil {
+			return err
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: ExtMountMap: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: ExtMountMap: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Key", wireType)
+			}
+			var stringLen uint64
+			stringLen, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			s := string(dAtA[iNdEx:postIndex])
+			m.Key = &s
+			iNdEx = postIndex
+			hasFields[0] |= uint64(0x00000001)
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Val", wireType)
+			}
+			var stringLen uint64
+			stringLen, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			s := string(dAtA[iNdEx:postIndex])
+			m.Val = &s
+			iNdEx = postIndex
+			hasFields[0] |= uint64(0x00000002)
+		default:
+			iNdEx = preIndex
+			skippy, err := protobuf_go_lite.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+	if hasFields[0]&uint64(0x00000001) == 0 {
+		return fmt.Errorf("proto: required field key not set")
+	}
+	if hasFields[0]&uint64(0x00000002) == 0 {
+		return fmt.Errorf("proto: required field val not set")
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *JoinNamespace) UnmarshalVT(dAtA []byte) error {
+	var hasFields [1]uint64
+	l := len(dAtA)
+	iNdEx := 0
+	var err error
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		wire, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+		if err != nil {
+			return err
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: JoinNamespace: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: JoinNamespace: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Ns", wireType)
+			}
+			var stringLen uint64
+			stringLen, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			s := string(dAtA[iNdEx:postIndex])
+			m.Ns = &s
+			iNdEx = postIndex
+			hasFields[0] |= uint64(0x00000001)
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field NsFile", wireType)
+			}
+			var stringLen uint64
+			stringLen, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			s := string(dAtA[iNdEx:postIndex])
+			m.NsFile = &s
+			iNdEx = postIndex
+			hasFields[0] |= uint64(0x00000002)
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ExtraOpt", wireType)
+			}
+			var stringLen uint64
+			stringLen, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			s := string(dAtA[iNdEx:postIndex])
+			m.ExtraOpt = &s
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protobuf_go_lite.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+	if hasFields[0]&uint64(0x00000001) == 0 {
+		return fmt.Errorf("proto: required field ns not set")
+	}
+	if hasFields[0]&uint64(0x00000002) == 0 {
+		return fmt.Errorf("proto: required field ns_file not set")
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *InheritFd) UnmarshalVT(dAtA []byte) error {
+	var hasFields [1]uint64
+	l := len(dAtA)
+	iNdEx := 0
+	var err error
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		wire, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+		if err != nil {
+			return err
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: InheritFd: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: InheritFd: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Key", wireType)
+			}
+			var stringLen uint64
+			stringLen, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			s := string(dAtA[iNdEx:postIndex])
+			m.Key = &s
+			iNdEx = postIndex
+			hasFields[0] |= uint64(0x00000001)
+		case 2:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Fd", wireType)
+			}
+			var v int32
+			v, iNdEx, err = protobuf_go_lite.DecodeVarintInt32(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			m.Fd = &v
+			hasFields[0] |= uint64(0x00000002)
+		default:
+			iNdEx = preIndex
+			skippy, err := protobuf_go_lite.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+	if hasFields[0]&uint64(0x00000001) == 0 {
+		return fmt.Errorf("proto: required field key not set")
+	}
+	if hasFields[0]&uint64(0x00000002) == 0 {
+		return fmt.Errorf("proto: required field fd not set")
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *CgroupRoot) UnmarshalVT(dAtA []byte) error {
+	var hasFields [1]uint64
+	l := len(dAtA)
+	iNdEx := 0
+	var err error
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		wire, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+		if err != nil {
+			return err
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: CgroupRoot: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: CgroupRoot: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Ctrl", wireType)
+			}
+			var stringLen uint64
+			stringLen, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			s := string(dAtA[iNdEx:postIndex])
+			m.Ctrl = &s
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Path", wireType)
+			}
+			var stringLen uint64
+			stringLen, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			s := string(dAtA[iNdEx:postIndex])
+			m.Path = &s
+			iNdEx = postIndex
+			hasFields[0] |= uint64(0x00000001)
+		default:
+			iNdEx = preIndex
+			skippy, err := protobuf_go_lite.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+	if hasFields[0]&uint64(0x00000001) == 0 {
+		return fmt.Errorf("proto: required field path not set")
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *UnixSk) UnmarshalVT(dAtA []byte) error {
+	var hasFields [1]uint64
+	l := len(dAtA)
+	iNdEx := 0
+	var err error
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		wire, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+		if err != nil {
+			return err
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: UnixSk: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: UnixSk: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Inode", wireType)
+			}
+			var v uint32
+			v, iNdEx, err = protobuf_go_lite.DecodeVarintUint32(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			m.Inode = &v
+			hasFields[0] |= uint64(0x00000001)
+		default:
+			iNdEx = preIndex
+			skippy, err := protobuf_go_lite.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+	if hasFields[0]&uint64(0x00000001) == 0 {
+		return fmt.Errorf("proto: required field inode not set")
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *CriuOpts) UnmarshalVT(dAtA []byte) error {
+	var hasFields [1]uint64
+	l := len(dAtA)
+	iNdEx := 0
+	var err error
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		wire, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+		if err != nil {
+			return err
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: CriuOpts: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: CriuOpts: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ImagesDirFd", wireType)
+			}
+			var v int32
+			v, iNdEx, err = protobuf_go_lite.DecodeVarintInt32(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			m.ImagesDirFd = &v
+			hasFields[0] |= uint64(0x00000001)
+		case 2:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Pid", wireType)
+			}
+			var v int32
+			v, iNdEx, err = protobuf_go_lite.DecodeVarintInt32(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			m.Pid = &v
+		case 3:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field LeaveRunning", wireType)
+			}
+			var v int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			v = int(_v)
+			if err != nil {
+				return err
+			}
+			b := bool(v != 0)
+			m.LeaveRunning = &b
+		case 4:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ExtUnixSk", wireType)
+			}
+			var v int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			v = int(_v)
+			if err != nil {
+				return err
+			}
+			b := bool(v != 0)
+			m.ExtUnixSk = &b
+		case 5:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field TcpEstablished", wireType)
+			}
+			var v int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			v = int(_v)
+			if err != nil {
+				return err
+			}
+			b := bool(v != 0)
+			m.TcpEstablished = &b
+		case 6:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field EvasiveDevices", wireType)
+			}
+			var v int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			v = int(_v)
+			if err != nil {
+				return err
+			}
+			b := bool(v != 0)
+			m.EvasiveDevices = &b
+		case 7:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ShellJob", wireType)
+			}
+			var v int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			v = int(_v)
+			if err != nil {
+				return err
+			}
+			b := bool(v != 0)
+			m.ShellJob = &b
+		case 8:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field FileLocks", wireType)
+			}
+			var v int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			v = int(_v)
+			if err != nil {
+				return err
+			}
+			b := bool(v != 0)
+			m.FileLocks = &b
+		case 9:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field LogLevel", wireType)
+			}
+			var v int32
+			v, iNdEx, err = protobuf_go_lite.DecodeVarintInt32(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			m.LogLevel = &v
+		case 10:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field LogFile", wireType)
+			}
+			var stringLen uint64
+			stringLen, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			s := string(dAtA[iNdEx:postIndex])
+			m.LogFile = &s
+			iNdEx = postIndex
+		case 11:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Ps", wireType)
+			}
+			var msglen int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			msglen = int(_v)
+			if err != nil {
+				return err
+			}
+			if msglen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Ps == nil {
+				m.Ps = &CriuPageServerInfo{}
+			}
+			if err := m.Ps.UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 12:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field NotifyScripts", wireType)
+			}
+			var v int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			v = int(_v)
+			if err != nil {
+				return err
+			}
+			b := bool(v != 0)
+			m.NotifyScripts = &b
+		case 13:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Root", wireType)
+			}
+			var stringLen uint64
+			stringLen, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			s := string(dAtA[iNdEx:postIndex])
+			m.Root = &s
+			iNdEx = postIndex
+		case 14:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ParentImg", wireType)
+			}
+			var stringLen uint64
+			stringLen, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			s := string(dAtA[iNdEx:postIndex])
+			m.ParentImg = &s
+			iNdEx = postIndex
+		case 15:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field TrackMem", wireType)
+			}
+			var v int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			v = int(_v)
+			if err != nil {
+				return err
+			}
+			b := bool(v != 0)
+			m.TrackMem = &b
+		case 16:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field AutoDedup", wireType)
+			}
+			var v int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			v = int(_v)
+			if err != nil {
+				return err
+			}
+			b := bool(v != 0)
+			m.AutoDedup = &b
+		case 17:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field WorkDirFd", wireType)
+			}
+			var v int32
+			v, iNdEx, err = protobuf_go_lite.DecodeVarintInt32(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			m.WorkDirFd = &v
+		case 18:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field LinkRemap", wireType)
+			}
+			var v int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			v = int(_v)
+			if err != nil {
+				return err
+			}
+			b := bool(v != 0)
+			m.LinkRemap = &b
+		case 19:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Veths", wireType)
+			}
+			var msglen int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			msglen = int(_v)
+			if err != nil {
+				return err
+			}
+			if msglen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Veths = append(m.Veths, &CriuVethPair{})
+			if err := m.Veths[len(m.Veths)-1].UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 20:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field CpuCap", wireType)
+			}
+			var v uint32
+			v, iNdEx, err = protobuf_go_lite.DecodeVarintUint32(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			m.CpuCap = &v
+		case 21:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ForceIrmap", wireType)
+			}
+			var v int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			v = int(_v)
+			if err != nil {
+				return err
+			}
+			b := bool(v != 0)
+			m.ForceIrmap = &b
+		case 22:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ExecCmd", wireType)
+			}
+			var stringLen uint64
+			stringLen, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ExecCmd = append(m.ExecCmd, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		case 23:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ExtMnt", wireType)
+			}
+			var msglen int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			msglen = int(_v)
+			if err != nil {
+				return err
+			}
+			if msglen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ExtMnt = append(m.ExtMnt, &ExtMountMap{})
+			if err := m.ExtMnt[len(m.ExtMnt)-1].UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 24:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ManageCgroups", wireType)
+			}
+			var v int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			v = int(_v)
+			if err != nil {
+				return err
+			}
+			b := bool(v != 0)
+			m.ManageCgroups = &b
+		case 25:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field CgRoot", wireType)
+			}
+			var msglen int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			msglen = int(_v)
+			if err != nil {
+				return err
+			}
+			if msglen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.CgRoot = append(m.CgRoot, &CgroupRoot{})
+			if err := m.CgRoot[len(m.CgRoot)-1].UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 26:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field RstSibling", wireType)
+			}
+			var v int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			v = int(_v)
+			if err != nil {
+				return err
+			}
+			b := bool(v != 0)
+			m.RstSibling = &b
+		case 27:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field InheritFd", wireType)
+			}
+			var msglen int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			msglen = int(_v)
+			if err != nil {
+				return err
+			}
+			if msglen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.InheritFd = append(m.InheritFd, &InheritFd{})
+			if err := m.InheritFd[len(m.InheritFd)-1].UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 28:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field AutoExtMnt", wireType)
+			}
+			var v int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			v = int(_v)
+			if err != nil {
+				return err
+			}
+			b := bool(v != 0)
+			m.AutoExtMnt = &b
+		case 29:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ExtSharing", wireType)
+			}
+			var v int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			v = int(_v)
+			if err != nil {
+				return err
+			}
+			b := bool(v != 0)
+			m.ExtSharing = &b
+		case 30:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ExtMasters", wireType)
+			}
+			var v int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			v = int(_v)
+			if err != nil {
+				return err
+			}
+			b := bool(v != 0)
+			m.ExtMasters = &b
+		case 31:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SkipMnt", wireType)
+			}
+			var stringLen uint64
+			stringLen, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.SkipMnt = append(m.SkipMnt, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		case 32:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field EnableFs", wireType)
+			}
+			var stringLen uint64
+			stringLen, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.EnableFs = append(m.EnableFs, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		case 33:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field UnixSkIno", wireType)
+			}
+			var msglen int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			msglen = int(_v)
+			if err != nil {
+				return err
+			}
+			if msglen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.UnixSkIno = append(m.UnixSkIno, &UnixSk{})
+			if err := m.UnixSkIno[len(m.UnixSkIno)-1].UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 34:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ManageCgroupsMode", wireType)
+			}
+			var v CriuCgMode
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			v = CriuCgMode(_v)
+			if err != nil {
+				return err
+			}
+			m.ManageCgroupsMode = &v
+		case 35:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field GhostLimit", wireType)
+			}
+			var v uint32
+			v, iNdEx, err = protobuf_go_lite.DecodeVarintUint32(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			m.GhostLimit = &v
+		case 36:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field IrmapScanPaths", wireType)
+			}
+			var stringLen uint64
+			stringLen, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.IrmapScanPaths = append(m.IrmapScanPaths, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		case 37:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field External", wireType)
+			}
+			var stringLen uint64
+			stringLen, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.External = append(m.External, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		case 38:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field EmptyNs", wireType)
+			}
+			var v uint32
+			v, iNdEx, err = protobuf_go_lite.DecodeVarintUint32(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			m.EmptyNs = &v
+		case 39:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field JoinNs", wireType)
+			}
+			var msglen int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			msglen = int(_v)
+			if err != nil {
+				return err
+			}
+			if msglen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.JoinNs = append(m.JoinNs, &JoinNamespace{})
+			if err := m.JoinNs[len(m.JoinNs)-1].UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 41:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field CgroupProps", wireType)
+			}
+			var stringLen uint64
+			stringLen, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			s := string(dAtA[iNdEx:postIndex])
+			m.CgroupProps = &s
+			iNdEx = postIndex
+		case 42:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field CgroupPropsFile", wireType)
+			}
+			var stringLen uint64
+			stringLen, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			s := string(dAtA[iNdEx:postIndex])
+			m.CgroupPropsFile = &s
+			iNdEx = postIndex
+		case 43:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field CgroupDumpController", wireType)
+			}
+			var stringLen uint64
+			stringLen, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.CgroupDumpController = append(m.CgroupDumpController, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		case 44:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field FreezeCgroup", wireType)
+			}
+			var stringLen uint64
+			stringLen, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			s := string(dAtA[iNdEx:postIndex])
+			m.FreezeCgroup = &s
+			iNdEx = postIndex
+		case 45:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Timeout", wireType)
+			}
+			var v uint32
+			v, iNdEx, err = protobuf_go_lite.DecodeVarintUint32(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			m.Timeout = &v
+		case 46:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field TcpSkipInFlight", wireType)
+			}
+			var v int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			v = int(_v)
+			if err != nil {
+				return err
+			}
+			b := bool(v != 0)
+			m.TcpSkipInFlight = &b
+		case 47:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field WeakSysctls", wireType)
+			}
+			var v int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			v = int(_v)
+			if err != nil {
+				return err
+			}
+			b := bool(v != 0)
+			m.WeakSysctls = &b
+		case 48:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field LazyPages", wireType)
+			}
+			var v int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			v = int(_v)
+			if err != nil {
+				return err
+			}
+			b := bool(v != 0)
+			m.LazyPages = &b
+		case 49:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field StatusFd", wireType)
+			}
+			var v int32
+			v, iNdEx, err = protobuf_go_lite.DecodeVarintInt32(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			m.StatusFd = &v
+		case 50:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field OrphanPtsMaster", wireType)
+			}
+			var v int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			v = int(_v)
+			if err != nil {
+				return err
+			}
+			b := bool(v != 0)
+			m.OrphanPtsMaster = &b
+		case 51:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ConfigFile", wireType)
+			}
+			var stringLen uint64
+			stringLen, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			s := string(dAtA[iNdEx:postIndex])
+			m.ConfigFile = &s
+			iNdEx = postIndex
+		case 52:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field TcpClose", wireType)
+			}
+			var v int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			v = int(_v)
+			if err != nil {
+				return err
+			}
+			b := bool(v != 0)
+			m.TcpClose = &b
+		case 53:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field LsmProfile", wireType)
+			}
+			var stringLen uint64
+			stringLen, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			s := string(dAtA[iNdEx:postIndex])
+			m.LsmProfile = &s
+			iNdEx = postIndex
+		case 54:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field TlsCacert", wireType)
+			}
+			var stringLen uint64
+			stringLen, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			s := string(dAtA[iNdEx:postIndex])
+			m.TlsCacert = &s
+			iNdEx = postIndex
+		case 55:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field TlsCacrl", wireType)
+			}
+			var stringLen uint64
+			stringLen, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			s := string(dAtA[iNdEx:postIndex])
+			m.TlsCacrl = &s
+			iNdEx = postIndex
+		case 56:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field TlsCert", wireType)
+			}
+			var stringLen uint64
+			stringLen, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			s := string(dAtA[iNdEx:postIndex])
+			m.TlsCert = &s
+			iNdEx = postIndex
+		case 57:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field TlsKey", wireType)
+			}
+			var stringLen uint64
+			stringLen, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			s := string(dAtA[iNdEx:postIndex])
+			m.TlsKey = &s
+			iNdEx = postIndex
+		case 58:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Tls", wireType)
+			}
+			var v int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			v = int(_v)
+			if err != nil {
+				return err
+			}
+			b := bool(v != 0)
+			m.Tls = &b
+		case 59:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field TlsNoCnVerify", wireType)
+			}
+			var v int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			v = int(_v)
+			if err != nil {
+				return err
+			}
+			b := bool(v != 0)
+			m.TlsNoCnVerify = &b
+		case 60:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field CgroupYard", wireType)
+			}
+			var stringLen uint64
+			stringLen, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			s := string(dAtA[iNdEx:postIndex])
+			m.CgroupYard = &s
+			iNdEx = postIndex
+		case 61:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field PreDumpMode", wireType)
+			}
+			var v CriuPreDumpMode
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			v = CriuPreDumpMode(_v)
+			if err != nil {
+				return err
+			}
+			m.PreDumpMode = &v
+		case 62:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field PidfdStoreSk", wireType)
+			}
+			var v int32
+			v, iNdEx, err = protobuf_go_lite.DecodeVarintInt32(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			m.PidfdStoreSk = &v
+		case 63:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field LsmMountContext", wireType)
+			}
+			var stringLen uint64
+			stringLen, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			s := string(dAtA[iNdEx:postIndex])
+			m.LsmMountContext = &s
+			iNdEx = postIndex
+		case 64:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field NetworkLock", wireType)
+			}
+			var v CriuNetworkLockMethod
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			v = CriuNetworkLockMethod(_v)
+			if err != nil {
+				return err
+			}
+			m.NetworkLock = &v
+		case 65:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field MntnsCompatMode", wireType)
+			}
+			var v int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			v = int(_v)
+			if err != nil {
+				return err
+			}
+			b := bool(v != 0)
+			m.MntnsCompatMode = &b
+		case 66:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SkipFileRwxCheck", wireType)
+			}
+			var v int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			v = int(_v)
+			if err != nil {
+				return err
+			}
+			b := bool(v != 0)
+			m.SkipFileRwxCheck = &b
+		case 67:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Unprivileged", wireType)
+			}
+			var v int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			v = int(_v)
+			if err != nil {
+				return err
+			}
+			b := bool(v != 0)
+			m.Unprivileged = &b
+		case 68:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ImagesDir", wireType)
+			}
+			var stringLen uint64
+			stringLen, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			s := string(dAtA[iNdEx:postIndex])
+			m.ImagesDir = &s
+			iNdEx = postIndex
+		case 69:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field LeaveStopped", wireType)
+			}
+			var v int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			v = int(_v)
+			if err != nil {
+				return err
+			}
+			b := bool(v != 0)
+			m.LeaveStopped = &b
+		case 70:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DisplayStats", wireType)
+			}
+			var v int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			v = int(_v)
+			if err != nil {
+				return err
+			}
+			b := bool(v != 0)
+			m.DisplayStats = &b
+		case 71:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field LogToStderr", wireType)
+			}
+			var v int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			v = int(_v)
+			if err != nil {
+				return err
+			}
+			b := bool(v != 0)
+			m.LogToStderr = &b
+		default:
+			iNdEx = preIndex
+			skippy, err := protobuf_go_lite.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+	if hasFields[0]&uint64(0x00000001) == 0 {
+		return fmt.Errorf("proto: required field images_dir_fd not set")
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *CriuDumpResp) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	var err error
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		wire, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+		if err != nil {
+			return err
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: CriuDumpResp: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: CriuDumpResp: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Restored", wireType)
+			}
+			var v int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			v = int(_v)
+			if err != nil {
+				return err
+			}
+			b := bool(v != 0)
+			m.Restored = &b
+		default:
+			iNdEx = preIndex
+			skippy, err := protobuf_go_lite.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *CriuRestoreResp) UnmarshalVT(dAtA []byte) error {
+	var hasFields [1]uint64
+	l := len(dAtA)
+	iNdEx := 0
+	var err error
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		wire, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+		if err != nil {
+			return err
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: CriuRestoreResp: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: CriuRestoreResp: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Pid", wireType)
+			}
+			var v int32
+			v, iNdEx, err = protobuf_go_lite.DecodeVarintInt32(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			m.Pid = &v
+			hasFields[0] |= uint64(0x00000001)
+		default:
+			iNdEx = preIndex
+			skippy, err := protobuf_go_lite.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+	if hasFields[0]&uint64(0x00000001) == 0 {
+		return fmt.Errorf("proto: required field pid not set")
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *CriuNotify) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	var err error
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		wire, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+		if err != nil {
+			return err
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: CriuNotify: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: CriuNotify: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Script", wireType)
+			}
+			var stringLen uint64
+			stringLen, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			s := string(dAtA[iNdEx:postIndex])
+			m.Script = &s
+			iNdEx = postIndex
+		case 2:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Pid", wireType)
+			}
+			var v int32
+			v, iNdEx, err = protobuf_go_lite.DecodeVarintInt32(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			m.Pid = &v
+		default:
+			iNdEx = preIndex
+			skippy, err := protobuf_go_lite.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *CriuFeatures) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	var err error
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		wire, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+		if err != nil {
+			return err
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: CriuFeatures: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: CriuFeatures: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field MemTrack", wireType)
+			}
+			var v int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			v = int(_v)
+			if err != nil {
+				return err
+			}
+			b := bool(v != 0)
+			m.MemTrack = &b
+		case 2:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field LazyPages", wireType)
+			}
+			var v int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			v = int(_v)
+			if err != nil {
+				return err
+			}
+			b := bool(v != 0)
+			m.LazyPages = &b
+		case 3:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field PidfdStore", wireType)
+			}
+			var v int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			v = int(_v)
+			if err != nil {
+				return err
+			}
+			b := bool(v != 0)
+			m.PidfdStore = &b
+		default:
+			iNdEx = preIndex
+			skippy, err := protobuf_go_lite.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *CriuReq) UnmarshalVT(dAtA []byte) error {
+	var hasFields [1]uint64
+	l := len(dAtA)
+	iNdEx := 0
+	var err error
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		wire, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+		if err != nil {
+			return err
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: CriuReq: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: CriuReq: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Type", wireType)
+			}
+			var v CriuReqType
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			v = CriuReqType(_v)
+			if err != nil {
+				return err
+			}
+			m.Type = &v
+			hasFields[0] |= uint64(0x00000001)
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Opts", wireType)
+			}
+			var msglen int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			msglen = int(_v)
+			if err != nil {
+				return err
+			}
+			if msglen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Opts == nil {
+				m.Opts = &CriuOpts{}
+			}
+			if err := m.Opts.UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 3:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field NotifySuccess", wireType)
+			}
+			var v int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			v = int(_v)
+			if err != nil {
+				return err
+			}
+			b := bool(v != 0)
+			m.NotifySuccess = &b
+		case 4:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field KeepOpen", wireType)
+			}
+			var v int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			v = int(_v)
+			if err != nil {
+				return err
+			}
+			b := bool(v != 0)
+			m.KeepOpen = &b
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Features", wireType)
+			}
+			var msglen int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			msglen = int(_v)
+			if err != nil {
+				return err
+			}
+			if msglen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Features == nil {
+				m.Features = &CriuFeatures{}
+			}
+			if err := m.Features.UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 6:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Pid", wireType)
+			}
+			var v uint32
+			v, iNdEx, err = protobuf_go_lite.DecodeVarintUint32(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			m.Pid = &v
+		default:
+			iNdEx = preIndex
+			skippy, err := protobuf_go_lite.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+	if hasFields[0]&uint64(0x00000001) == 0 {
+		return fmt.Errorf("proto: required field type not set")
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *CriuResp) UnmarshalVT(dAtA []byte) error {
+	var hasFields [1]uint64
+	l := len(dAtA)
+	iNdEx := 0
+	var err error
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		wire, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+		if err != nil {
+			return err
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: CriuResp: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: CriuResp: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Type", wireType)
+			}
+			var v CriuReqType
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			v = CriuReqType(_v)
+			if err != nil {
+				return err
+			}
+			m.Type = &v
+			hasFields[0] |= uint64(0x00000001)
+		case 2:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Success", wireType)
+			}
+			var v int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			v = int(_v)
+			if err != nil {
+				return err
+			}
+			b := bool(v != 0)
+			m.Success = &b
+			hasFields[0] |= uint64(0x00000002)
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Dump", wireType)
+			}
+			var msglen int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			msglen = int(_v)
+			if err != nil {
+				return err
+			}
+			if msglen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Dump == nil {
+				m.Dump = &CriuDumpResp{}
+			}
+			if err := m.Dump.UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Restore", wireType)
+			}
+			var msglen int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			msglen = int(_v)
+			if err != nil {
+				return err
+			}
+			if msglen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Restore == nil {
+				m.Restore = &CriuRestoreResp{}
+			}
+			if err := m.Restore.UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Notify", wireType)
+			}
+			var msglen int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			msglen = int(_v)
+			if err != nil {
+				return err
+			}
+			if msglen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Notify == nil {
+				m.Notify = &CriuNotify{}
+			}
+			if err := m.Notify.UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 6:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Ps", wireType)
+			}
+			var msglen int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			msglen = int(_v)
+			if err != nil {
+				return err
+			}
+			if msglen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Ps == nil {
+				m.Ps = &CriuPageServerInfo{}
+			}
+			if err := m.Ps.UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 7:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field CrErrno", wireType)
+			}
+			var v int32
+			v, iNdEx, err = protobuf_go_lite.DecodeVarintInt32(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			m.CrErrno = &v
+		case 8:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Features", wireType)
+			}
+			var msglen int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			msglen = int(_v)
+			if err != nil {
+				return err
+			}
+			if msglen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Features == nil {
+				m.Features = &CriuFeatures{}
+			}
+			if err := m.Features.UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 9:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field CrErrmsg", wireType)
+			}
+			var stringLen uint64
+			stringLen, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			s := string(dAtA[iNdEx:postIndex])
+			m.CrErrmsg = &s
+			iNdEx = postIndex
+		case 10:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Version", wireType)
+			}
+			var msglen int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			msglen = int(_v)
+			if err != nil {
+				return err
+			}
+			if msglen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Version == nil {
+				m.Version = &CriuVersion{}
+			}
+			if err := m.Version.UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 11:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+			}
+			var v int32
+			v, iNdEx, err = protobuf_go_lite.DecodeVarintInt32(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			m.Status = &v
+		default:
+			iNdEx = preIndex
+			skippy, err := protobuf_go_lite.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+	if hasFields[0]&uint64(0x00000001) == 0 {
+		return fmt.Errorf("proto: required field type not set")
+	}
+	if hasFields[0]&uint64(0x00000002) == 0 {
+		return fmt.Errorf("proto: required field success not set")
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *CriuVersion) UnmarshalVT(dAtA []byte) error {
+	var hasFields [1]uint64
+	l := len(dAtA)
+	iNdEx := 0
+	var err error
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		wire, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+		if err != nil {
+			return err
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: CriuVersion: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: CriuVersion: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field MajorNumber", wireType)
+			}
+			var v int32
+			v, iNdEx, err = protobuf_go_lite.DecodeVarintInt32(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			m.MajorNumber = &v
+			hasFields[0] |= uint64(0x00000001)
+		case 2:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field MinorNumber", wireType)
+			}
+			var v int32
+			v, iNdEx, err = protobuf_go_lite.DecodeVarintInt32(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			m.MinorNumber = &v
+			hasFields[0] |= uint64(0x00000002)
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Gitid", wireType)
+			}
+			var stringLen uint64
+			stringLen, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			s := string(dAtA[iNdEx:postIndex])
+			m.Gitid = &s
+			iNdEx = postIndex
+		case 4:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Sublevel", wireType)
+			}
+			var v int32
+			v, iNdEx, err = protobuf_go_lite.DecodeVarintInt32(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			m.Sublevel = &v
+		case 5:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Extra", wireType)
+			}
+			var v int32
+			v, iNdEx, err = protobuf_go_lite.DecodeVarintInt32(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			m.Extra = &v
+		case 6:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
+			}
+			var stringLen uint64
+			stringLen, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			s := string(dAtA[iNdEx:postIndex])
+			m.Name = &s
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protobuf_go_lite.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+	if hasFields[0]&uint64(0x00000001) == 0 {
+		return fmt.Errorf("proto: required field major_number not set")
+	}
+	if hasFields[0]&uint64(0x00000002) == 0 {
+		return fmt.Errorf("proto: required field minor_number not set")
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *CriuPageServerInfo) UnmarshalVTUnsafe(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	var err error
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		wire, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+		if err != nil {
+			return err
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: CriuPageServerInfo: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: CriuPageServerInfo: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Address", wireType)
+			}
+			var stringLen uint64
+			stringLen, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			var stringValue string
+			if intStringLen > 0 {
+				stringValue = unsafe.String(&dAtA[iNdEx], intStringLen)
+			}
+			s := stringValue
+			m.Address = &s
+			iNdEx = postIndex
+		case 2:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Port", wireType)
+			}
+			var v int32
+			v, iNdEx, err = protobuf_go_lite.DecodeVarintInt32(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			m.Port = &v
+		case 3:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Pid", wireType)
+			}
+			var v int32
+			v, iNdEx, err = protobuf_go_lite.DecodeVarintInt32(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			m.Pid = &v
+		case 4:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Fd", wireType)
+			}
+			var v int32
+			v, iNdEx, err = protobuf_go_lite.DecodeVarintInt32(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			m.Fd = &v
+		default:
+			iNdEx = preIndex
+			skippy, err := protobuf_go_lite.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *CriuVethPair) UnmarshalVTUnsafe(dAtA []byte) error {
+	var hasFields [1]uint64
+	l := len(dAtA)
+	iNdEx := 0
+	var err error
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		wire, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+		if err != nil {
+			return err
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: CriuVethPair: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: CriuVethPair: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field IfIn", wireType)
+			}
+			var stringLen uint64
+			stringLen, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			var stringValue string
+			if intStringLen > 0 {
+				stringValue = unsafe.String(&dAtA[iNdEx], intStringLen)
+			}
+			s := stringValue
+			m.IfIn = &s
+			iNdEx = postIndex
+			hasFields[0] |= uint64(0x00000001)
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field IfOut", wireType)
+			}
+			var stringLen uint64
+			stringLen, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			var stringValue string
+			if intStringLen > 0 {
+				stringValue = unsafe.String(&dAtA[iNdEx], intStringLen)
+			}
+			s := stringValue
+			m.IfOut = &s
+			iNdEx = postIndex
+			hasFields[0] |= uint64(0x00000002)
+		default:
+			iNdEx = preIndex
+			skippy, err := protobuf_go_lite.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+	if hasFields[0]&uint64(0x00000001) == 0 {
+		return fmt.Errorf("proto: required field if_in not set")
+	}
+	if hasFields[0]&uint64(0x00000002) == 0 {
+		return fmt.Errorf("proto: required field if_out not set")
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *ExtMountMap) UnmarshalVTUnsafe(dAtA []byte) error {
+	var hasFields [1]uint64
+	l := len(dAtA)
+	iNdEx := 0
+	var err error
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		wire, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+		if err != nil {
+			return err
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: ExtMountMap: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: ExtMountMap: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Key", wireType)
+			}
+			var stringLen uint64
+			stringLen, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			var stringValue string
+			if intStringLen > 0 {
+				stringValue = unsafe.String(&dAtA[iNdEx], intStringLen)
+			}
+			s := stringValue
+			m.Key = &s
+			iNdEx = postIndex
+			hasFields[0] |= uint64(0x00000001)
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Val", wireType)
+			}
+			var stringLen uint64
+			stringLen, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			var stringValue string
+			if intStringLen > 0 {
+				stringValue = unsafe.String(&dAtA[iNdEx], intStringLen)
+			}
+			s := stringValue
+			m.Val = &s
+			iNdEx = postIndex
+			hasFields[0] |= uint64(0x00000002)
+		default:
+			iNdEx = preIndex
+			skippy, err := protobuf_go_lite.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+	if hasFields[0]&uint64(0x00000001) == 0 {
+		return fmt.Errorf("proto: required field key not set")
+	}
+	if hasFields[0]&uint64(0x00000002) == 0 {
+		return fmt.Errorf("proto: required field val not set")
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *JoinNamespace) UnmarshalVTUnsafe(dAtA []byte) error {
+	var hasFields [1]uint64
+	l := len(dAtA)
+	iNdEx := 0
+	var err error
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		wire, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+		if err != nil {
+			return err
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: JoinNamespace: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: JoinNamespace: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Ns", wireType)
+			}
+			var stringLen uint64
+			stringLen, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			var stringValue string
+			if intStringLen > 0 {
+				stringValue = unsafe.String(&dAtA[iNdEx], intStringLen)
+			}
+			s := stringValue
+			m.Ns = &s
+			iNdEx = postIndex
+			hasFields[0] |= uint64(0x00000001)
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field NsFile", wireType)
+			}
+			var stringLen uint64
+			stringLen, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			var stringValue string
+			if intStringLen > 0 {
+				stringValue = unsafe.String(&dAtA[iNdEx], intStringLen)
+			}
+			s := stringValue
+			m.NsFile = &s
+			iNdEx = postIndex
+			hasFields[0] |= uint64(0x00000002)
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ExtraOpt", wireType)
+			}
+			var stringLen uint64
+			stringLen, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			var stringValue string
+			if intStringLen > 0 {
+				stringValue = unsafe.String(&dAtA[iNdEx], intStringLen)
+			}
+			s := stringValue
+			m.ExtraOpt = &s
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protobuf_go_lite.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+	if hasFields[0]&uint64(0x00000001) == 0 {
+		return fmt.Errorf("proto: required field ns not set")
+	}
+	if hasFields[0]&uint64(0x00000002) == 0 {
+		return fmt.Errorf("proto: required field ns_file not set")
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *InheritFd) UnmarshalVTUnsafe(dAtA []byte) error {
+	var hasFields [1]uint64
+	l := len(dAtA)
+	iNdEx := 0
+	var err error
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		wire, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+		if err != nil {
+			return err
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: InheritFd: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: InheritFd: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Key", wireType)
+			}
+			var stringLen uint64
+			stringLen, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			var stringValue string
+			if intStringLen > 0 {
+				stringValue = unsafe.String(&dAtA[iNdEx], intStringLen)
+			}
+			s := stringValue
+			m.Key = &s
+			iNdEx = postIndex
+			hasFields[0] |= uint64(0x00000001)
+		case 2:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Fd", wireType)
+			}
+			var v int32
+			v, iNdEx, err = protobuf_go_lite.DecodeVarintInt32(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			m.Fd = &v
+			hasFields[0] |= uint64(0x00000002)
+		default:
+			iNdEx = preIndex
+			skippy, err := protobuf_go_lite.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+	if hasFields[0]&uint64(0x00000001) == 0 {
+		return fmt.Errorf("proto: required field key not set")
+	}
+	if hasFields[0]&uint64(0x00000002) == 0 {
+		return fmt.Errorf("proto: required field fd not set")
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *CgroupRoot) UnmarshalVTUnsafe(dAtA []byte) error {
+	var hasFields [1]uint64
+	l := len(dAtA)
+	iNdEx := 0
+	var err error
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		wire, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+		if err != nil {
+			return err
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: CgroupRoot: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: CgroupRoot: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Ctrl", wireType)
+			}
+			var stringLen uint64
+			stringLen, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			var stringValue string
+			if intStringLen > 0 {
+				stringValue = unsafe.String(&dAtA[iNdEx], intStringLen)
+			}
+			s := stringValue
+			m.Ctrl = &s
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Path", wireType)
+			}
+			var stringLen uint64
+			stringLen, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			var stringValue string
+			if intStringLen > 0 {
+				stringValue = unsafe.String(&dAtA[iNdEx], intStringLen)
+			}
+			s := stringValue
+			m.Path = &s
+			iNdEx = postIndex
+			hasFields[0] |= uint64(0x00000001)
+		default:
+			iNdEx = preIndex
+			skippy, err := protobuf_go_lite.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+	if hasFields[0]&uint64(0x00000001) == 0 {
+		return fmt.Errorf("proto: required field path not set")
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *UnixSk) UnmarshalVTUnsafe(dAtA []byte) error {
+	var hasFields [1]uint64
+	l := len(dAtA)
+	iNdEx := 0
+	var err error
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		wire, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+		if err != nil {
+			return err
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: UnixSk: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: UnixSk: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Inode", wireType)
+			}
+			var v uint32
+			v, iNdEx, err = protobuf_go_lite.DecodeVarintUint32(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			m.Inode = &v
+			hasFields[0] |= uint64(0x00000001)
+		default:
+			iNdEx = preIndex
+			skippy, err := protobuf_go_lite.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+	if hasFields[0]&uint64(0x00000001) == 0 {
+		return fmt.Errorf("proto: required field inode not set")
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *CriuOpts) UnmarshalVTUnsafe(dAtA []byte) error {
+	var hasFields [1]uint64
+	l := len(dAtA)
+	iNdEx := 0
+	var err error
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		wire, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+		if err != nil {
+			return err
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: CriuOpts: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: CriuOpts: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ImagesDirFd", wireType)
+			}
+			var v int32
+			v, iNdEx, err = protobuf_go_lite.DecodeVarintInt32(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			m.ImagesDirFd = &v
+			hasFields[0] |= uint64(0x00000001)
+		case 2:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Pid", wireType)
+			}
+			var v int32
+			v, iNdEx, err = protobuf_go_lite.DecodeVarintInt32(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			m.Pid = &v
+		case 3:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field LeaveRunning", wireType)
+			}
+			var v int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			v = int(_v)
+			if err != nil {
+				return err
+			}
+			b := bool(v != 0)
+			m.LeaveRunning = &b
+		case 4:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ExtUnixSk", wireType)
+			}
+			var v int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			v = int(_v)
+			if err != nil {
+				return err
+			}
+			b := bool(v != 0)
+			m.ExtUnixSk = &b
+		case 5:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field TcpEstablished", wireType)
+			}
+			var v int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			v = int(_v)
+			if err != nil {
+				return err
+			}
+			b := bool(v != 0)
+			m.TcpEstablished = &b
+		case 6:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field EvasiveDevices", wireType)
+			}
+			var v int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			v = int(_v)
+			if err != nil {
+				return err
+			}
+			b := bool(v != 0)
+			m.EvasiveDevices = &b
+		case 7:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ShellJob", wireType)
+			}
+			var v int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			v = int(_v)
+			if err != nil {
+				return err
+			}
+			b := bool(v != 0)
+			m.ShellJob = &b
+		case 8:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field FileLocks", wireType)
+			}
+			var v int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			v = int(_v)
+			if err != nil {
+				return err
+			}
+			b := bool(v != 0)
+			m.FileLocks = &b
+		case 9:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field LogLevel", wireType)
+			}
+			var v int32
+			v, iNdEx, err = protobuf_go_lite.DecodeVarintInt32(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			m.LogLevel = &v
+		case 10:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field LogFile", wireType)
+			}
+			var stringLen uint64
+			stringLen, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			var stringValue string
+			if intStringLen > 0 {
+				stringValue = unsafe.String(&dAtA[iNdEx], intStringLen)
+			}
+			s := stringValue
+			m.LogFile = &s
+			iNdEx = postIndex
+		case 11:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Ps", wireType)
+			}
+			var msglen int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			msglen = int(_v)
+			if err != nil {
+				return err
+			}
+			if msglen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Ps == nil {
+				m.Ps = &CriuPageServerInfo{}
+			}
+			if err := m.Ps.UnmarshalVTUnsafe(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 12:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field NotifyScripts", wireType)
+			}
+			var v int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			v = int(_v)
+			if err != nil {
+				return err
+			}
+			b := bool(v != 0)
+			m.NotifyScripts = &b
+		case 13:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Root", wireType)
+			}
+			var stringLen uint64
+			stringLen, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			var stringValue string
+			if intStringLen > 0 {
+				stringValue = unsafe.String(&dAtA[iNdEx], intStringLen)
+			}
+			s := stringValue
+			m.Root = &s
+			iNdEx = postIndex
+		case 14:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ParentImg", wireType)
+			}
+			var stringLen uint64
+			stringLen, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			var stringValue string
+			if intStringLen > 0 {
+				stringValue = unsafe.String(&dAtA[iNdEx], intStringLen)
+			}
+			s := stringValue
+			m.ParentImg = &s
+			iNdEx = postIndex
+		case 15:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field TrackMem", wireType)
+			}
+			var v int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			v = int(_v)
+			if err != nil {
+				return err
+			}
+			b := bool(v != 0)
+			m.TrackMem = &b
+		case 16:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field AutoDedup", wireType)
+			}
+			var v int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			v = int(_v)
+			if err != nil {
+				return err
+			}
+			b := bool(v != 0)
+			m.AutoDedup = &b
+		case 17:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field WorkDirFd", wireType)
+			}
+			var v int32
+			v, iNdEx, err = protobuf_go_lite.DecodeVarintInt32(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			m.WorkDirFd = &v
+		case 18:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field LinkRemap", wireType)
+			}
+			var v int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			v = int(_v)
+			if err != nil {
+				return err
+			}
+			b := bool(v != 0)
+			m.LinkRemap = &b
+		case 19:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Veths", wireType)
+			}
+			var msglen int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			msglen = int(_v)
+			if err != nil {
+				return err
+			}
+			if msglen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Veths = append(m.Veths, &CriuVethPair{})
+			if err := m.Veths[len(m.Veths)-1].UnmarshalVTUnsafe(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 20:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field CpuCap", wireType)
+			}
+			var v uint32
+			v, iNdEx, err = protobuf_go_lite.DecodeVarintUint32(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			m.CpuCap = &v
+		case 21:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ForceIrmap", wireType)
+			}
+			var v int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			v = int(_v)
+			if err != nil {
+				return err
+			}
+			b := bool(v != 0)
+			m.ForceIrmap = &b
+		case 22:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ExecCmd", wireType)
+			}
+			var stringLen uint64
+			stringLen, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			var stringValue string
+			if intStringLen > 0 {
+				stringValue = unsafe.String(&dAtA[iNdEx], intStringLen)
+			}
+			m.ExecCmd = append(m.ExecCmd, stringValue)
+			iNdEx = postIndex
+		case 23:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ExtMnt", wireType)
+			}
+			var msglen int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			msglen = int(_v)
+			if err != nil {
+				return err
+			}
+			if msglen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ExtMnt = append(m.ExtMnt, &ExtMountMap{})
+			if err := m.ExtMnt[len(m.ExtMnt)-1].UnmarshalVTUnsafe(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 24:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ManageCgroups", wireType)
+			}
+			var v int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			v = int(_v)
+			if err != nil {
+				return err
+			}
+			b := bool(v != 0)
+			m.ManageCgroups = &b
+		case 25:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field CgRoot", wireType)
+			}
+			var msglen int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			msglen = int(_v)
+			if err != nil {
+				return err
+			}
+			if msglen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.CgRoot = append(m.CgRoot, &CgroupRoot{})
+			if err := m.CgRoot[len(m.CgRoot)-1].UnmarshalVTUnsafe(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 26:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field RstSibling", wireType)
+			}
+			var v int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			v = int(_v)
+			if err != nil {
+				return err
+			}
+			b := bool(v != 0)
+			m.RstSibling = &b
+		case 27:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field InheritFd", wireType)
+			}
+			var msglen int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			msglen = int(_v)
+			if err != nil {
+				return err
+			}
+			if msglen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.InheritFd = append(m.InheritFd, &InheritFd{})
+			if err := m.InheritFd[len(m.InheritFd)-1].UnmarshalVTUnsafe(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 28:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field AutoExtMnt", wireType)
+			}
+			var v int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			v = int(_v)
+			if err != nil {
+				return err
+			}
+			b := bool(v != 0)
+			m.AutoExtMnt = &b
+		case 29:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ExtSharing", wireType)
+			}
+			var v int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			v = int(_v)
+			if err != nil {
+				return err
+			}
+			b := bool(v != 0)
+			m.ExtSharing = &b
+		case 30:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ExtMasters", wireType)
+			}
+			var v int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			v = int(_v)
+			if err != nil {
+				return err
+			}
+			b := bool(v != 0)
+			m.ExtMasters = &b
+		case 31:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SkipMnt", wireType)
+			}
+			var stringLen uint64
+			stringLen, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			var stringValue string
+			if intStringLen > 0 {
+				stringValue = unsafe.String(&dAtA[iNdEx], intStringLen)
+			}
+			m.SkipMnt = append(m.SkipMnt, stringValue)
+			iNdEx = postIndex
+		case 32:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field EnableFs", wireType)
+			}
+			var stringLen uint64
+			stringLen, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			var stringValue string
+			if intStringLen > 0 {
+				stringValue = unsafe.String(&dAtA[iNdEx], intStringLen)
+			}
+			m.EnableFs = append(m.EnableFs, stringValue)
+			iNdEx = postIndex
+		case 33:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field UnixSkIno", wireType)
+			}
+			var msglen int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			msglen = int(_v)
+			if err != nil {
+				return err
+			}
+			if msglen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.UnixSkIno = append(m.UnixSkIno, &UnixSk{})
+			if err := m.UnixSkIno[len(m.UnixSkIno)-1].UnmarshalVTUnsafe(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 34:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ManageCgroupsMode", wireType)
+			}
+			var v CriuCgMode
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			v = CriuCgMode(_v)
+			if err != nil {
+				return err
+			}
+			m.ManageCgroupsMode = &v
+		case 35:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field GhostLimit", wireType)
+			}
+			var v uint32
+			v, iNdEx, err = protobuf_go_lite.DecodeVarintUint32(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			m.GhostLimit = &v
+		case 36:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field IrmapScanPaths", wireType)
+			}
+			var stringLen uint64
+			stringLen, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			var stringValue string
+			if intStringLen > 0 {
+				stringValue = unsafe.String(&dAtA[iNdEx], intStringLen)
+			}
+			m.IrmapScanPaths = append(m.IrmapScanPaths, stringValue)
+			iNdEx = postIndex
+		case 37:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field External", wireType)
+			}
+			var stringLen uint64
+			stringLen, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			var stringValue string
+			if intStringLen > 0 {
+				stringValue = unsafe.String(&dAtA[iNdEx], intStringLen)
+			}
+			m.External = append(m.External, stringValue)
+			iNdEx = postIndex
+		case 38:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field EmptyNs", wireType)
+			}
+			var v uint32
+			v, iNdEx, err = protobuf_go_lite.DecodeVarintUint32(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			m.EmptyNs = &v
+		case 39:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field JoinNs", wireType)
+			}
+			var msglen int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			msglen = int(_v)
+			if err != nil {
+				return err
+			}
+			if msglen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.JoinNs = append(m.JoinNs, &JoinNamespace{})
+			if err := m.JoinNs[len(m.JoinNs)-1].UnmarshalVTUnsafe(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 41:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field CgroupProps", wireType)
+			}
+			var stringLen uint64
+			stringLen, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			var stringValue string
+			if intStringLen > 0 {
+				stringValue = unsafe.String(&dAtA[iNdEx], intStringLen)
+			}
+			s := stringValue
+			m.CgroupProps = &s
+			iNdEx = postIndex
+		case 42:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field CgroupPropsFile", wireType)
+			}
+			var stringLen uint64
+			stringLen, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			var stringValue string
+			if intStringLen > 0 {
+				stringValue = unsafe.String(&dAtA[iNdEx], intStringLen)
+			}
+			s := stringValue
+			m.CgroupPropsFile = &s
+			iNdEx = postIndex
+		case 43:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field CgroupDumpController", wireType)
+			}
+			var stringLen uint64
+			stringLen, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			var stringValue string
+			if intStringLen > 0 {
+				stringValue = unsafe.String(&dAtA[iNdEx], intStringLen)
+			}
+			m.CgroupDumpController = append(m.CgroupDumpController, stringValue)
+			iNdEx = postIndex
+		case 44:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field FreezeCgroup", wireType)
+			}
+			var stringLen uint64
+			stringLen, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			var stringValue string
+			if intStringLen > 0 {
+				stringValue = unsafe.String(&dAtA[iNdEx], intStringLen)
+			}
+			s := stringValue
+			m.FreezeCgroup = &s
+			iNdEx = postIndex
+		case 45:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Timeout", wireType)
+			}
+			var v uint32
+			v, iNdEx, err = protobuf_go_lite.DecodeVarintUint32(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			m.Timeout = &v
+		case 46:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field TcpSkipInFlight", wireType)
+			}
+			var v int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			v = int(_v)
+			if err != nil {
+				return err
+			}
+			b := bool(v != 0)
+			m.TcpSkipInFlight = &b
+		case 47:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field WeakSysctls", wireType)
+			}
+			var v int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			v = int(_v)
+			if err != nil {
+				return err
+			}
+			b := bool(v != 0)
+			m.WeakSysctls = &b
+		case 48:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field LazyPages", wireType)
+			}
+			var v int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			v = int(_v)
+			if err != nil {
+				return err
+			}
+			b := bool(v != 0)
+			m.LazyPages = &b
+		case 49:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field StatusFd", wireType)
+			}
+			var v int32
+			v, iNdEx, err = protobuf_go_lite.DecodeVarintInt32(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			m.StatusFd = &v
+		case 50:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field OrphanPtsMaster", wireType)
+			}
+			var v int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			v = int(_v)
+			if err != nil {
+				return err
+			}
+			b := bool(v != 0)
+			m.OrphanPtsMaster = &b
+		case 51:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ConfigFile", wireType)
+			}
+			var stringLen uint64
+			stringLen, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			var stringValue string
+			if intStringLen > 0 {
+				stringValue = unsafe.String(&dAtA[iNdEx], intStringLen)
+			}
+			s := stringValue
+			m.ConfigFile = &s
+			iNdEx = postIndex
+		case 52:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field TcpClose", wireType)
+			}
+			var v int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			v = int(_v)
+			if err != nil {
+				return err
+			}
+			b := bool(v != 0)
+			m.TcpClose = &b
+		case 53:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field LsmProfile", wireType)
+			}
+			var stringLen uint64
+			stringLen, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			var stringValue string
+			if intStringLen > 0 {
+				stringValue = unsafe.String(&dAtA[iNdEx], intStringLen)
+			}
+			s := stringValue
+			m.LsmProfile = &s
+			iNdEx = postIndex
+		case 54:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field TlsCacert", wireType)
+			}
+			var stringLen uint64
+			stringLen, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			var stringValue string
+			if intStringLen > 0 {
+				stringValue = unsafe.String(&dAtA[iNdEx], intStringLen)
+			}
+			s := stringValue
+			m.TlsCacert = &s
+			iNdEx = postIndex
+		case 55:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field TlsCacrl", wireType)
+			}
+			var stringLen uint64
+			stringLen, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			var stringValue string
+			if intStringLen > 0 {
+				stringValue = unsafe.String(&dAtA[iNdEx], intStringLen)
+			}
+			s := stringValue
+			m.TlsCacrl = &s
+			iNdEx = postIndex
+		case 56:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field TlsCert", wireType)
+			}
+			var stringLen uint64
+			stringLen, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			var stringValue string
+			if intStringLen > 0 {
+				stringValue = unsafe.String(&dAtA[iNdEx], intStringLen)
+			}
+			s := stringValue
+			m.TlsCert = &s
+			iNdEx = postIndex
+		case 57:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field TlsKey", wireType)
+			}
+			var stringLen uint64
+			stringLen, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			var stringValue string
+			if intStringLen > 0 {
+				stringValue = unsafe.String(&dAtA[iNdEx], intStringLen)
+			}
+			s := stringValue
+			m.TlsKey = &s
+			iNdEx = postIndex
+		case 58:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Tls", wireType)
+			}
+			var v int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			v = int(_v)
+			if err != nil {
+				return err
+			}
+			b := bool(v != 0)
+			m.Tls = &b
+		case 59:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field TlsNoCnVerify", wireType)
+			}
+			var v int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			v = int(_v)
+			if err != nil {
+				return err
+			}
+			b := bool(v != 0)
+			m.TlsNoCnVerify = &b
+		case 60:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field CgroupYard", wireType)
+			}
+			var stringLen uint64
+			stringLen, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			var stringValue string
+			if intStringLen > 0 {
+				stringValue = unsafe.String(&dAtA[iNdEx], intStringLen)
+			}
+			s := stringValue
+			m.CgroupYard = &s
+			iNdEx = postIndex
+		case 61:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field PreDumpMode", wireType)
+			}
+			var v CriuPreDumpMode
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			v = CriuPreDumpMode(_v)
+			if err != nil {
+				return err
+			}
+			m.PreDumpMode = &v
+		case 62:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field PidfdStoreSk", wireType)
+			}
+			var v int32
+			v, iNdEx, err = protobuf_go_lite.DecodeVarintInt32(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			m.PidfdStoreSk = &v
+		case 63:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field LsmMountContext", wireType)
+			}
+			var stringLen uint64
+			stringLen, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			var stringValue string
+			if intStringLen > 0 {
+				stringValue = unsafe.String(&dAtA[iNdEx], intStringLen)
+			}
+			s := stringValue
+			m.LsmMountContext = &s
+			iNdEx = postIndex
+		case 64:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field NetworkLock", wireType)
+			}
+			var v CriuNetworkLockMethod
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			v = CriuNetworkLockMethod(_v)
+			if err != nil {
+				return err
+			}
+			m.NetworkLock = &v
+		case 65:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field MntnsCompatMode", wireType)
+			}
+			var v int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			v = int(_v)
+			if err != nil {
+				return err
+			}
+			b := bool(v != 0)
+			m.MntnsCompatMode = &b
+		case 66:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SkipFileRwxCheck", wireType)
+			}
+			var v int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			v = int(_v)
+			if err != nil {
+				return err
+			}
+			b := bool(v != 0)
+			m.SkipFileRwxCheck = &b
+		case 67:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Unprivileged", wireType)
+			}
+			var v int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			v = int(_v)
+			if err != nil {
+				return err
+			}
+			b := bool(v != 0)
+			m.Unprivileged = &b
+		case 68:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ImagesDir", wireType)
+			}
+			var stringLen uint64
+			stringLen, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			var stringValue string
+			if intStringLen > 0 {
+				stringValue = unsafe.String(&dAtA[iNdEx], intStringLen)
+			}
+			s := stringValue
+			m.ImagesDir = &s
+			iNdEx = postIndex
+		case 69:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field LeaveStopped", wireType)
+			}
+			var v int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			v = int(_v)
+			if err != nil {
+				return err
+			}
+			b := bool(v != 0)
+			m.LeaveStopped = &b
+		case 70:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DisplayStats", wireType)
+			}
+			var v int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			v = int(_v)
+			if err != nil {
+				return err
+			}
+			b := bool(v != 0)
+			m.DisplayStats = &b
+		case 71:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field LogToStderr", wireType)
+			}
+			var v int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			v = int(_v)
+			if err != nil {
+				return err
+			}
+			b := bool(v != 0)
+			m.LogToStderr = &b
+		default:
+			iNdEx = preIndex
+			skippy, err := protobuf_go_lite.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+	if hasFields[0]&uint64(0x00000001) == 0 {
+		return fmt.Errorf("proto: required field images_dir_fd not set")
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *CriuDumpResp) UnmarshalVTUnsafe(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	var err error
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		wire, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+		if err != nil {
+			return err
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: CriuDumpResp: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: CriuDumpResp: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Restored", wireType)
+			}
+			var v int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			v = int(_v)
+			if err != nil {
+				return err
+			}
+			b := bool(v != 0)
+			m.Restored = &b
+		default:
+			iNdEx = preIndex
+			skippy, err := protobuf_go_lite.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *CriuRestoreResp) UnmarshalVTUnsafe(dAtA []byte) error {
+	var hasFields [1]uint64
+	l := len(dAtA)
+	iNdEx := 0
+	var err error
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		wire, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+		if err != nil {
+			return err
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: CriuRestoreResp: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: CriuRestoreResp: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Pid", wireType)
+			}
+			var v int32
+			v, iNdEx, err = protobuf_go_lite.DecodeVarintInt32(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			m.Pid = &v
+			hasFields[0] |= uint64(0x00000001)
+		default:
+			iNdEx = preIndex
+			skippy, err := protobuf_go_lite.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+	if hasFields[0]&uint64(0x00000001) == 0 {
+		return fmt.Errorf("proto: required field pid not set")
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *CriuNotify) UnmarshalVTUnsafe(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	var err error
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		wire, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+		if err != nil {
+			return err
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: CriuNotify: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: CriuNotify: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Script", wireType)
+			}
+			var stringLen uint64
+			stringLen, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			var stringValue string
+			if intStringLen > 0 {
+				stringValue = unsafe.String(&dAtA[iNdEx], intStringLen)
+			}
+			s := stringValue
+			m.Script = &s
+			iNdEx = postIndex
+		case 2:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Pid", wireType)
+			}
+			var v int32
+			v, iNdEx, err = protobuf_go_lite.DecodeVarintInt32(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			m.Pid = &v
+		default:
+			iNdEx = preIndex
+			skippy, err := protobuf_go_lite.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *CriuFeatures) UnmarshalVTUnsafe(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	var err error
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		wire, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+		if err != nil {
+			return err
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: CriuFeatures: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: CriuFeatures: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field MemTrack", wireType)
+			}
+			var v int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			v = int(_v)
+			if err != nil {
+				return err
+			}
+			b := bool(v != 0)
+			m.MemTrack = &b
+		case 2:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field LazyPages", wireType)
+			}
+			var v int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			v = int(_v)
+			if err != nil {
+				return err
+			}
+			b := bool(v != 0)
+			m.LazyPages = &b
+		case 3:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field PidfdStore", wireType)
+			}
+			var v int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			v = int(_v)
+			if err != nil {
+				return err
+			}
+			b := bool(v != 0)
+			m.PidfdStore = &b
+		default:
+			iNdEx = preIndex
+			skippy, err := protobuf_go_lite.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *CriuReq) UnmarshalVTUnsafe(dAtA []byte) error {
+	var hasFields [1]uint64
+	l := len(dAtA)
+	iNdEx := 0
+	var err error
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		wire, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+		if err != nil {
+			return err
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: CriuReq: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: CriuReq: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Type", wireType)
+			}
+			var v CriuReqType
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			v = CriuReqType(_v)
+			if err != nil {
+				return err
+			}
+			m.Type = &v
+			hasFields[0] |= uint64(0x00000001)
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Opts", wireType)
+			}
+			var msglen int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			msglen = int(_v)
+			if err != nil {
+				return err
+			}
+			if msglen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Opts == nil {
+				m.Opts = &CriuOpts{}
+			}
+			if err := m.Opts.UnmarshalVTUnsafe(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 3:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field NotifySuccess", wireType)
+			}
+			var v int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			v = int(_v)
+			if err != nil {
+				return err
+			}
+			b := bool(v != 0)
+			m.NotifySuccess = &b
+		case 4:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field KeepOpen", wireType)
+			}
+			var v int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			v = int(_v)
+			if err != nil {
+				return err
+			}
+			b := bool(v != 0)
+			m.KeepOpen = &b
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Features", wireType)
+			}
+			var msglen int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			msglen = int(_v)
+			if err != nil {
+				return err
+			}
+			if msglen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Features == nil {
+				m.Features = &CriuFeatures{}
+			}
+			if err := m.Features.UnmarshalVTUnsafe(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 6:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Pid", wireType)
+			}
+			var v uint32
+			v, iNdEx, err = protobuf_go_lite.DecodeVarintUint32(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			m.Pid = &v
+		default:
+			iNdEx = preIndex
+			skippy, err := protobuf_go_lite.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+	if hasFields[0]&uint64(0x00000001) == 0 {
+		return fmt.Errorf("proto: required field type not set")
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *CriuResp) UnmarshalVTUnsafe(dAtA []byte) error {
+	var hasFields [1]uint64
+	l := len(dAtA)
+	iNdEx := 0
+	var err error
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		wire, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+		if err != nil {
+			return err
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: CriuResp: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: CriuResp: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Type", wireType)
+			}
+			var v CriuReqType
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			v = CriuReqType(_v)
+			if err != nil {
+				return err
+			}
+			m.Type = &v
+			hasFields[0] |= uint64(0x00000001)
+		case 2:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Success", wireType)
+			}
+			var v int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			v = int(_v)
+			if err != nil {
+				return err
+			}
+			b := bool(v != 0)
+			m.Success = &b
+			hasFields[0] |= uint64(0x00000002)
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Dump", wireType)
+			}
+			var msglen int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			msglen = int(_v)
+			if err != nil {
+				return err
+			}
+			if msglen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Dump == nil {
+				m.Dump = &CriuDumpResp{}
+			}
+			if err := m.Dump.UnmarshalVTUnsafe(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Restore", wireType)
+			}
+			var msglen int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			msglen = int(_v)
+			if err != nil {
+				return err
+			}
+			if msglen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Restore == nil {
+				m.Restore = &CriuRestoreResp{}
+			}
+			if err := m.Restore.UnmarshalVTUnsafe(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Notify", wireType)
+			}
+			var msglen int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			msglen = int(_v)
+			if err != nil {
+				return err
+			}
+			if msglen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Notify == nil {
+				m.Notify = &CriuNotify{}
+			}
+			if err := m.Notify.UnmarshalVTUnsafe(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 6:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Ps", wireType)
+			}
+			var msglen int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			msglen = int(_v)
+			if err != nil {
+				return err
+			}
+			if msglen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Ps == nil {
+				m.Ps = &CriuPageServerInfo{}
+			}
+			if err := m.Ps.UnmarshalVTUnsafe(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 7:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field CrErrno", wireType)
+			}
+			var v int32
+			v, iNdEx, err = protobuf_go_lite.DecodeVarintInt32(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			m.CrErrno = &v
+		case 8:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Features", wireType)
+			}
+			var msglen int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			msglen = int(_v)
+			if err != nil {
+				return err
+			}
+			if msglen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Features == nil {
+				m.Features = &CriuFeatures{}
+			}
+			if err := m.Features.UnmarshalVTUnsafe(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 9:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field CrErrmsg", wireType)
+			}
+			var stringLen uint64
+			stringLen, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			var stringValue string
+			if intStringLen > 0 {
+				stringValue = unsafe.String(&dAtA[iNdEx], intStringLen)
+			}
+			s := stringValue
+			m.CrErrmsg = &s
+			iNdEx = postIndex
+		case 10:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Version", wireType)
+			}
+			var msglen int
+			var _v uint64
+			_v, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			msglen = int(_v)
+			if err != nil {
+				return err
+			}
+			if msglen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Version == nil {
+				m.Version = &CriuVersion{}
+			}
+			if err := m.Version.UnmarshalVTUnsafe(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 11:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+			}
+			var v int32
+			v, iNdEx, err = protobuf_go_lite.DecodeVarintInt32(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			m.Status = &v
+		default:
+			iNdEx = preIndex
+			skippy, err := protobuf_go_lite.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+	if hasFields[0]&uint64(0x00000001) == 0 {
+		return fmt.Errorf("proto: required field type not set")
+	}
+	if hasFields[0]&uint64(0x00000002) == 0 {
+		return fmt.Errorf("proto: required field success not set")
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *CriuVersion) UnmarshalVTUnsafe(dAtA []byte) error {
+	var hasFields [1]uint64
+	l := len(dAtA)
+	iNdEx := 0
+	var err error
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		wire, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+		if err != nil {
+			return err
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: CriuVersion: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: CriuVersion: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field MajorNumber", wireType)
+			}
+			var v int32
+			v, iNdEx, err = protobuf_go_lite.DecodeVarintInt32(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			m.MajorNumber = &v
+			hasFields[0] |= uint64(0x00000001)
+		case 2:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field MinorNumber", wireType)
+			}
+			var v int32
+			v, iNdEx, err = protobuf_go_lite.DecodeVarintInt32(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			m.MinorNumber = &v
+			hasFields[0] |= uint64(0x00000002)
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Gitid", wireType)
+			}
+			var stringLen uint64
+			stringLen, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			var stringValue string
+			if intStringLen > 0 {
+				stringValue = unsafe.String(&dAtA[iNdEx], intStringLen)
+			}
+			s := stringValue
+			m.Gitid = &s
+			iNdEx = postIndex
+		case 4:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Sublevel", wireType)
+			}
+			var v int32
+			v, iNdEx, err = protobuf_go_lite.DecodeVarintInt32(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			m.Sublevel = &v
+		case 5:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Extra", wireType)
+			}
+			var v int32
+			v, iNdEx, err = protobuf_go_lite.DecodeVarintInt32(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			m.Extra = &v
+		case 6:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
+			}
+			var stringLen uint64
+			stringLen, iNdEx, err = protobuf_go_lite.DecodeVarint(dAtA, iNdEx)
+			if err != nil {
+				return err
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			var stringValue string
+			if intStringLen > 0 {
+				stringValue = unsafe.String(&dAtA[iNdEx], intStringLen)
+			}
+			s := stringValue
+			m.Name = &s
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protobuf_go_lite.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protobuf_go_lite.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+	if hasFields[0]&uint64(0x00000001) == 0 {
+		return fmt.Errorf("proto: required field major_number not set")
+	}
+	if hasFields[0]&uint64(0x00000002) == 0 {
+		return fmt.Errorf("proto: required field minor_number not set")
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
diff --git a/vendor/github.com/checkpoint-restore/go-criu/v7/rpc/rpc.proto b/vendor/github.com/checkpoint-restore/go-criu/v8/rpc/rpc.proto
similarity index 100%
rename from vendor/github.com/checkpoint-restore/go-criu/v7/rpc/rpc.proto
rename to vendor/github.com/checkpoint-restore/go-criu/v8/rpc/rpc.proto
diff --git a/vendor/github.com/cyphar/filepath-securejoin/CHANGELOG.md b/vendor/github.com/cyphar/filepath-securejoin/CHANGELOG.md
index 6d016d05c0..f8fbb6b62f 100644
--- a/vendor/github.com/cyphar/filepath-securejoin/CHANGELOG.md
+++ b/vendor/github.com/cyphar/filepath-securejoin/CHANGELOG.md
@@ -6,6 +6,17 @@ and this project adheres to [Semantic Versioning](http://semver.org/).
 
 ## [Unreleased] ##
 
+## [0.7.0] - 2025-06-17 ##
+
+> You talk of times of peace for all, and then prepare for war.
+
+### Changed ###
+- Update to `cyphar.com/go-pathrs@0.2.5`, which included a build-time API
+  breakage that we needed to work around. The API of this library is unchanged
+  by this, but users should make sure to update to `v0.7.0` of
+  `filepath-securejoin` if they use the `libpathrs` built tag and have update
+  to `libpathrs` `v0.2.5`.
+
 ## [0.6.1] - 2025-11-19 ##
 
 > At last up jumped the cunning spider, and fiercely held her fast.
diff --git a/vendor/github.com/cyphar/filepath-securejoin/VERSION b/vendor/github.com/cyphar/filepath-securejoin/VERSION
index ee6cdce3c2..faef31a435 100644
--- a/vendor/github.com/cyphar/filepath-securejoin/VERSION
+++ b/vendor/github.com/cyphar/filepath-securejoin/VERSION
@@ -1 +1 @@
-0.6.1
+0.7.0
diff --git a/vendor/github.com/cyphar/filepath-securejoin/pathrs-lite/open_libpathrs.go b/vendor/github.com/cyphar/filepath-securejoin/pathrs-lite/open_libpathrs.go
index 53352000e6..15205d1344 100644
--- a/vendor/github.com/cyphar/filepath-securejoin/pathrs-lite/open_libpathrs.go
+++ b/vendor/github.com/cyphar/filepath-securejoin/pathrs-lite/open_libpathrs.go
@@ -53,5 +53,5 @@ func Reopen(file *os.File, flags int) (*os.File, error) {
 	}
 	defer handle.Close() //nolint:errcheck // close failures aren't critical here
 
-	return handle.OpenFile(flags)
+	return handle.OpenFile(uint64(flags))
 }
diff --git a/vendor/github.com/godbus/dbus/v5/.cirrus.yml b/vendor/github.com/godbus/dbus/v5/.cirrus.yml
new file mode 100644
index 0000000000..6e2090296e
--- /dev/null
+++ b/vendor/github.com/godbus/dbus/v5/.cirrus.yml
@@ -0,0 +1,11 @@
+# See https://cirrus-ci.org/guide/FreeBSD/
+freebsd_instance:
+  image_family: freebsd-14-3
+
+task:
+  name: Test on FreeBSD
+  install_script: pkg install -y go125 dbus
+  test_script: |
+    /usr/local/etc/rc.d/dbus onestart && \
+    eval `dbus-launch --sh-syntax` && \
+    go125 test -v ./...
diff --git a/vendor/github.com/godbus/dbus/v5/.golangci.yml b/vendor/github.com/godbus/dbus/v5/.golangci.yml
new file mode 100644
index 0000000000..5bbdd9342b
--- /dev/null
+++ b/vendor/github.com/godbus/dbus/v5/.golangci.yml
@@ -0,0 +1,13 @@
+version: "2"
+
+linters:
+  enable:
+    - unconvert
+    - unparam
+  exclusions:
+    presets:
+      - std-error-handling
+
+formatters:
+  enable:
+    - gofumpt
diff --git a/vendor/github.com/godbus/dbus/v5/README.md b/vendor/github.com/godbus/dbus/v5/README.md
index 5c24125838..da848a98dc 100644
--- a/vendor/github.com/godbus/dbus/v5/README.md
+++ b/vendor/github.com/godbus/dbus/v5/README.md
@@ -14,7 +14,7 @@ D-Bus message bus system.
 
 ### Installation
 
-This packages requires Go 1.12 or later. It can be installed by running the command below:
+This packages requires Go 1.20 or later. It can be installed by running the command below:
 
 ```
 go get github.com/godbus/dbus/v5
@@ -23,7 +23,7 @@ go get github.com/godbus/dbus/v5
 ### Usage
 
 The complete package documentation and some simple examples are available at
-[godoc.org](http://godoc.org/github.com/godbus/dbus). Also, the
+[pkg.go.dev](https://pkg.go.dev/github.com/godbus/dbus/v5). Also, the
 [_examples](https://github.com/godbus/dbus/tree/master/_examples) directory
 gives a short overview over the basic usage. 
 
@@ -34,6 +34,7 @@ gives a short overview over the basic usage.
 - [iwd](https://github.com/shibumi/iwd) go bindings for the internet wireless daemon "iwd".
 - [notify](https://github.com/esiqveland/notify) provides desktop notifications over dbus into a library.
 - [playerbm](https://github.com/altdesktop/playerbm) a bookmark utility for media players.
+- [rpic](https://github.com/stephenhu/rpic) lightweight web app and RESTful API for managing a Raspberry Pi
 
 Please note that the API is considered unstable for now and may change without
 further notice.
diff --git a/vendor/github.com/godbus/dbus/v5/SECURITY.md b/vendor/github.com/godbus/dbus/v5/SECURITY.md
new file mode 100644
index 0000000000..7d262fbbfc
--- /dev/null
+++ b/vendor/github.com/godbus/dbus/v5/SECURITY.md
@@ -0,0 +1,13 @@
+# Security Policy
+
+## Supported Versions
+
+Security updates are applied only to the latest release.
+
+## Reporting a Vulnerability
+
+If you have discovered a security vulnerability in this project, please report it privately. **Do not disclose it as a public issue.** This gives us time to work with you to fix the issue before public exposure, reducing the chance that the exploit will be used before a patch is released.
+
+Please disclose it at [security advisory](https://github.com/godbus/dbus/security/advisories/new).
+
+This project is maintained by a team of volunteers on a reasonable-effort basis. As such, vulnerabilities will be disclosed in a best effort base.
diff --git a/vendor/github.com/godbus/dbus/v5/auth.go b/vendor/github.com/godbus/dbus/v5/auth.go
index 0f3b252c07..c56dbaad3a 100644
--- a/vendor/github.com/godbus/dbus/v5/auth.go
+++ b/vendor/github.com/godbus/dbus/v5/auth.go
@@ -54,10 +54,10 @@ type Auth interface {
 func (conn *Conn) Auth(methods []Auth) error {
 	if methods == nil {
 		uid := strconv.Itoa(os.Geteuid())
-		methods = []Auth{AuthExternal(uid), AuthCookieSha1(uid, getHomeDir())}
+		methods = getDefaultAuthMethods(uid)
 	}
 	in := bufio.NewReader(conn.transport)
-	err := conn.transport.SendNullByte()
+	err := conn.SendNullByte()
 	if err != nil {
 		return err
 	}
@@ -83,9 +83,9 @@ func (conn *Conn) Auth(methods []Auth) error {
 				}
 				switch status {
 				case AuthOk:
-					err, ok = conn.tryAuth(m, waitingForOk, in)
+					ok, err = conn.tryAuth(m, waitingForOk, in)
 				case AuthContinue:
-					err, ok = conn.tryAuth(m, waitingForData, in)
+					ok, err = conn.tryAuth(m, waitingForData, in)
 				default:
 					panic("dbus: invalid authentication status")
 				}
@@ -125,21 +125,21 @@ func (conn *Conn) Auth(methods []Auth) error {
 }
 
 // tryAuth tries to authenticate with m as the mechanism, using state as the
-// initial authState and in for reading input. It returns (nil, true) on
-// success, (nil, false) on a REJECTED and (someErr, false) if some other
+// initial authState and in for reading input. It returns (true, nil) on
+// success, (false, nil) on a REJECTED and (false, someErr) if some other
 // error occurred.
-func (conn *Conn) tryAuth(m Auth, state authState, in *bufio.Reader) (error, bool) {
+func (conn *Conn) tryAuth(m Auth, state authState, in *bufio.Reader) (bool, error) {
 	for {
 		s, err := authReadLine(in)
 		if err != nil {
-			return err, false
+			return false, err
 		}
 		switch {
 		case state == waitingForData && string(s[0]) == "DATA":
 			if len(s) != 2 {
 				err = authWriteLine(conn.transport, []byte("ERROR"))
 				if err != nil {
-					return err, false
+					return false, err
 				}
 				continue
 			}
@@ -149,7 +149,7 @@ func (conn *Conn) tryAuth(m Auth, state authState, in *bufio.Reader) (error, boo
 				if len(data) != 0 {
 					err = authWriteLine(conn.transport, []byte("DATA"), data)
 					if err != nil {
-						return err, false
+						return false, err
 					}
 				}
 				if status == AuthOk {
@@ -158,66 +158,66 @@ func (conn *Conn) tryAuth(m Auth, state authState, in *bufio.Reader) (error, boo
 			case AuthError:
 				err = authWriteLine(conn.transport, []byte("ERROR"))
 				if err != nil {
-					return err, false
+					return false, err
 				}
 			}
 		case state == waitingForData && string(s[0]) == "REJECTED":
-			return nil, false
+			return false, nil
 		case state == waitingForData && string(s[0]) == "ERROR":
 			err = authWriteLine(conn.transport, []byte("CANCEL"))
 			if err != nil {
-				return err, false
+				return false, err
 			}
 			state = waitingForReject
 		case state == waitingForData && string(s[0]) == "OK":
 			if len(s) != 2 {
 				err = authWriteLine(conn.transport, []byte("CANCEL"))
 				if err != nil {
-					return err, false
+					return false, err
 				}
 				state = waitingForReject
 			} else {
 				conn.uuid = string(s[1])
-				return nil, true
+				return true, nil
 			}
 		case state == waitingForData:
 			err = authWriteLine(conn.transport, []byte("ERROR"))
 			if err != nil {
-				return err, false
+				return false, err
 			}
 		case state == waitingForOk && string(s[0]) == "OK":
 			if len(s) != 2 {
 				err = authWriteLine(conn.transport, []byte("CANCEL"))
 				if err != nil {
-					return err, false
+					return false, err
 				}
 				state = waitingForReject
 			} else {
 				conn.uuid = string(s[1])
-				return nil, true
+				return true, nil
 			}
 		case state == waitingForOk && string(s[0]) == "DATA":
 			err = authWriteLine(conn.transport, []byte("DATA"))
 			if err != nil {
-				return err, false
+				return false, nil
 			}
 		case state == waitingForOk && string(s[0]) == "REJECTED":
-			return nil, false
+			return false, nil
 		case state == waitingForOk && string(s[0]) == "ERROR":
 			err = authWriteLine(conn.transport, []byte("CANCEL"))
 			if err != nil {
-				return err, false
+				return false, err
 			}
 			state = waitingForReject
 		case state == waitingForOk:
 			err = authWriteLine(conn.transport, []byte("ERROR"))
 			if err != nil {
-				return err, false
+				return false, err
 			}
 		case state == waitingForReject && string(s[0]) == "REJECTED":
-			return nil, false
+			return false, nil
 		case state == waitingForReject:
-			return errors.New("dbus: authentication protocol error"), false
+			return false, errors.New("dbus: authentication protocol error")
 		default:
 			panic("dbus: invalid auth state")
 		}
diff --git a/vendor/github.com/godbus/dbus/v5/auth_default_other.go b/vendor/github.com/godbus/dbus/v5/auth_default_other.go
new file mode 100644
index 0000000000..e112ccfe96
--- /dev/null
+++ b/vendor/github.com/godbus/dbus/v5/auth_default_other.go
@@ -0,0 +1,7 @@
+//go:build !windows
+
+package dbus
+
+func getDefaultAuthMethods(user string) []Auth {
+	return []Auth{AuthExternal(user)}
+}
diff --git a/vendor/github.com/godbus/dbus/v5/auth_default_windows.go b/vendor/github.com/godbus/dbus/v5/auth_default_windows.go
new file mode 100644
index 0000000000..2289850a8e
--- /dev/null
+++ b/vendor/github.com/godbus/dbus/v5/auth_default_windows.go
@@ -0,0 +1,5 @@
+package dbus
+
+func getDefaultAuthMethods(user string) []Auth {
+	return []Auth{AuthCookieSha1(user, getHomeDir())}
+}
diff --git a/vendor/github.com/godbus/dbus/v5/auth_sha1.go b/vendor/github.com/godbus/dbus/v5/auth_sha1_windows.go
similarity index 95%
rename from vendor/github.com/godbus/dbus/v5/auth_sha1.go
rename to vendor/github.com/godbus/dbus/v5/auth_sha1_windows.go
index 80286700b6..0c5480eee1 100644
--- a/vendor/github.com/godbus/dbus/v5/auth_sha1.go
+++ b/vendor/github.com/godbus/dbus/v5/auth_sha1_windows.go
@@ -100,3 +100,10 @@ func (a authCookieSha1) generateChallenge() []byte {
 	hex.Encode(enc, b)
 	return enc
 }
+
+func getHomeDir() string {
+	if dir, err := os.UserHomeDir(); err == nil {
+		return dir
+	}
+	return "/"
+}
diff --git a/vendor/github.com/godbus/dbus/v5/call.go b/vendor/github.com/godbus/dbus/v5/call.go
index b06b063580..d16171ab91 100644
--- a/vendor/github.com/godbus/dbus/v5/call.go
+++ b/vendor/github.com/godbus/dbus/v5/call.go
@@ -2,17 +2,14 @@ package dbus
 
 import (
 	"context"
-	"errors"
 )
 
-var errSignature = errors.New("dbus: mismatched signature")
-
 // Call represents a pending or completed method call.
 type Call struct {
 	Destination string
 	Path        ObjectPath
 	Method      string
-	Args        []interface{}
+	Args        []any
 
 	// Strobes when the call is complete.
 	Done chan *Call
@@ -22,7 +19,7 @@ type Call struct {
 	Err error
 
 	// Holds the response once the call is done.
-	Body []interface{}
+	Body []any
 
 	// ResponseSequence stores the sequence number of the DBus message containing
 	// the call response (or error). This can be compared to the sequence number
@@ -55,7 +52,7 @@ func (c *Call) ContextCancel() {
 // Store stores the body of the reply into the provided pointers. It returns
 // an error if the signatures of the body and retvalues don't match, or if
 // the error status is not nil.
-func (c *Call) Store(retvalues ...interface{}) error {
+func (c *Call) Store(retvalues ...any) error {
 	if c.Err != nil {
 		return c.Err
 	}
diff --git a/vendor/github.com/godbus/dbus/v5/conn.go b/vendor/github.com/godbus/dbus/v5/conn.go
index 69978ea26a..8a22acc98b 100644
--- a/vendor/github.com/godbus/dbus/v5/conn.go
+++ b/vendor/github.com/godbus/dbus/v5/conn.go
@@ -3,6 +3,7 @@ package dbus
 import (
 	"context"
 	"errors"
+	"fmt"
 	"io"
 	"os"
 	"strings"
@@ -76,7 +77,6 @@ func SessionBus() (conn *Conn, err error) {
 func getSessionBusAddress(autolaunch bool) (string, error) {
 	if address := os.Getenv("DBUS_SESSION_BUS_ADDRESS"); address != "" && address != "autolaunch:" {
 		return address, nil
-
 	} else if address := tryDiscoverDbusSessionBusAddress(); address != "" {
 		os.Setenv("DBUS_SESSION_BUS_ADDRESS", address)
 		return address, nil
@@ -97,7 +97,7 @@ func SessionBusPrivate(opts ...ConnOption) (*Conn, error) {
 	return Dial(address, opts...)
 }
 
-// SessionBusPrivate returns a new private connection to the session bus.  If
+// SessionBusPrivateNoAutoStartup returns a new private connection to the session bus.  If
 // the session bus is not already open, do not attempt to launch it.
 func SessionBusPrivateNoAutoStartup(opts ...ConnOption) (*Conn, error) {
 	address, err := getSessionBusAddress(false)
@@ -108,7 +108,7 @@ func SessionBusPrivateNoAutoStartup(opts ...ConnOption) (*Conn, error) {
 	return Dial(address, opts...)
 }
 
-// SessionBusPrivate returns a new private connection to the session bus.
+// SessionBusPrivateHandler returns a new private connection to the session bus.
 //
 // Deprecated: use SessionBusPrivate with options instead.
 func SessionBusPrivateHandler(handler Handler, signalHandler SignalHandler) (*Conn, error) {
@@ -445,7 +445,8 @@ func (conn *Conn) handleSignal(sequence Sequence, msg *Message) {
 	// sender is optional for signals.
 	sender, _ := msg.Headers[FieldSender].value.(string)
 	if iface == "org.freedesktop.DBus" && sender == "org.freedesktop.DBus" {
-		if member == "NameLost" {
+		switch member {
+		case "NameLost":
 			// If we lost the name on the bus, remove it from our
 			// tracking list.
 			name, ok := msg.Body[0].(string)
@@ -453,7 +454,7 @@ func (conn *Conn) handleSignal(sequence Sequence, msg *Message) {
 				panic("Unable to read the lost name")
 			}
 			conn.names.loseName(name)
-		} else if member == "NameAcquired" {
+		case "NameAcquired":
 			// If we acquired the name on the bus, add it to our
 			// tracking list.
 			name, ok := msg.Body[0].(string)
@@ -485,7 +486,7 @@ func (conn *Conn) Object(dest string, path ObjectPath) BusObject {
 	return &Object{conn, dest, path}
 }
 
-func (conn *Conn) sendMessageAndIfClosed(msg *Message, ifClosed func()) {
+func (conn *Conn) sendMessageAndIfClosed(msg *Message, ifClosed func()) error {
 	if msg.serial == 0 {
 		msg.serial = conn.getSerial()
 	}
@@ -498,14 +499,30 @@ func (conn *Conn) sendMessageAndIfClosed(msg *Message, ifClosed func()) {
 	} else if msg.Type != TypeMethodCall {
 		conn.serialGen.RetireSerial(msg.serial)
 	}
+	return err
+}
+
+func isEncodingError(err error) bool {
+	switch err.(type) {
+	case FormatError:
+		return true
+	case InvalidMessageError:
+		return true
+	}
+	return false
 }
 
 func (conn *Conn) handleSendError(msg *Message, err error) {
-	if msg.Type == TypeMethodCall {
+	switch msg.Type {
+	case TypeMethodCall:
 		conn.calls.handleSendError(msg, err)
-	} else if msg.Type == TypeMethodReply {
-		if _, ok := err.(FormatError); ok {
-			conn.sendError(err, msg.Headers[FieldDestination].value.(string), msg.Headers[FieldReplySerial].value.(uint32))
+	case TypeMethodReply:
+		if isEncodingError(err) {
+			// Make sure that the caller gets some kind of error response if
+			// the application code tried to respond, but the resulting message
+			// was malformed in the end
+			returnedErr := fmt.Errorf("destination tried to respond with invalid message (%w)", err)
+			conn.sendError(returnedErr, msg.Headers[FieldDestination].value.(string), msg.Headers[FieldReplySerial].value.(uint32))
 		}
 	}
 	conn.serialGen.RetireSerial(msg.serial)
@@ -560,7 +577,8 @@ func (conn *Conn) send(ctx context.Context, msg *Message, ch chan *Call) *Call {
 			<-ctx.Done()
 			conn.calls.handleSendError(msg, ctx.Err())
 		}()
-		conn.sendMessageAndIfClosed(msg, func() {
+		// error is handled in handleSendError
+		_ = conn.sendMessageAndIfClosed(msg, func() {
 			conn.calls.handleSendError(msg, ErrClosed)
 			canceler()
 		})
@@ -568,7 +586,8 @@ func (conn *Conn) send(ctx context.Context, msg *Message, ch chan *Call) *Call {
 		canceler()
 		call = &Call{Err: nil, Done: ch}
 		ch <- call
-		conn.sendMessageAndIfClosed(msg, func() {
+		// error is handled in handleSendError
+		_ = conn.sendMessageAndIfClosed(msg, func() {
 			call = &Call{Err: ErrClosed}
 		})
 	}
@@ -602,12 +621,13 @@ func (conn *Conn) sendError(err error, dest string, serial uint32) {
 	if len(e.Body) > 0 {
 		msg.Headers[FieldSignature] = MakeVariant(SignatureOf(e.Body...))
 	}
-	conn.sendMessageAndIfClosed(msg, nil)
+	// not much we can do to handle a possible error here
+	_ = conn.sendMessageAndIfClosed(msg, nil)
 }
 
 // sendReply creates a method reply message corresponding to the parameters and
 // sends it to conn.out.
-func (conn *Conn) sendReply(dest string, serial uint32, values ...interface{}) {
+func (conn *Conn) sendReply(dest string, serial uint32, values ...any) {
 	msg := new(Message)
 	msg.Type = TypeMethodReply
 	msg.Headers = make(map[HeaderField]Variant)
@@ -619,7 +639,8 @@ func (conn *Conn) sendReply(dest string, serial uint32, values ...interface{}) {
 	if len(values) > 0 {
 		msg.Headers[FieldSignature] = MakeVariant(SignatureOf(values...))
 	}
-	conn.sendMessageAndIfClosed(msg, nil)
+	// not much we can do to handle a possible error here
+	_ = conn.sendMessageAndIfClosed(msg, nil)
 }
 
 // AddMatchSignal registers the given match rule to receive broadcast
@@ -630,7 +651,7 @@ func (conn *Conn) AddMatchSignal(options ...MatchOption) error {
 
 // AddMatchSignalContext acts like AddMatchSignal but takes a context.
 func (conn *Conn) AddMatchSignalContext(ctx context.Context, options ...MatchOption) error {
-	options = append([]MatchOption{withMatchType("signal")}, options...)
+	options = append([]MatchOption{withMatchTypeSignal()}, options...)
 	return conn.busObj.CallWithContext(
 		ctx,
 		"org.freedesktop.DBus.AddMatch", 0,
@@ -645,7 +666,7 @@ func (conn *Conn) RemoveMatchSignal(options ...MatchOption) error {
 
 // RemoveMatchSignalContext acts like RemoveMatchSignal but takes a context.
 func (conn *Conn) RemoveMatchSignalContext(ctx context.Context, options ...MatchOption) error {
-	options = append([]MatchOption{withMatchType("signal")}, options...)
+	options = append([]MatchOption{withMatchTypeSignal()}, options...)
 	return conn.busObj.CallWithContext(
 		ctx,
 		"org.freedesktop.DBus.RemoveMatch", 0,
@@ -694,10 +715,10 @@ func (conn *Conn) SupportsUnixFDs() bool {
 // Error represents a D-Bus message of type Error.
 type Error struct {
 	Name string
-	Body []interface{}
+	Body []any
 }
 
-func NewError(name string, body []interface{}) *Error {
+func NewError(name string, body []any) *Error {
 	return &Error{name, body}
 }
 
@@ -717,7 +738,7 @@ type Signal struct {
 	Sender   string
 	Path     ObjectPath
 	Name     string
-	Body     []interface{}
+	Body     []any
 	Sequence Sequence
 }
 
@@ -740,9 +761,7 @@ type transport interface {
 	SendMessage(*Message) error
 }
 
-var (
-	transports = make(map[string]func(string) (transport, error))
-)
+var transports = make(map[string]func(string) (transport, error))
 
 func getTransport(address string) (transport, error) {
 	var err error
@@ -770,10 +789,10 @@ func getTransport(address string) (transport, error) {
 
 // getKey gets a key from a the list of keys. Returns "" on error / not found...
 func getKey(s, key string) string {
-	for _, keyEqualsValue := range strings.Split(s, ",") {
-		keyValue := strings.SplitN(keyEqualsValue, "=", 2)
-		if len(keyValue) == 2 && keyValue[0] == key {
-			val, err := UnescapeBusAddressValue(keyValue[1])
+	keyEq := key + "="
+	for _, kv := range strings.Split(s, ",") {
+		if v, ok := strings.CutPrefix(kv, keyEq); ok {
+			val, err := UnescapeBusAddressValue(v)
 			if err != nil {
 				// No way to return an error.
 				return ""
@@ -853,16 +872,19 @@ type nameTracker struct {
 func newNameTracker() *nameTracker {
 	return &nameTracker{names: map[string]struct{}{}}
 }
+
 func (tracker *nameTracker) acquireUniqueConnectionName(name string) {
 	tracker.lck.Lock()
 	defer tracker.lck.Unlock()
 	tracker.unique = name
 }
+
 func (tracker *nameTracker) acquireName(name string) {
 	tracker.lck.Lock()
 	defer tracker.lck.Unlock()
 	tracker.names[name] = struct{}{}
 }
+
 func (tracker *nameTracker) loseName(name string) {
 	tracker.lck.Lock()
 	defer tracker.lck.Unlock()
@@ -874,12 +896,14 @@ func (tracker *nameTracker) uniqueNameIsKnown() bool {
 	defer tracker.lck.RUnlock()
 	return tracker.unique != ""
 }
+
 func (tracker *nameTracker) isKnownName(name string) bool {
 	tracker.lck.RLock()
 	defer tracker.lck.RUnlock()
 	_, ok := tracker.names[name]
 	return ok || name == tracker.unique
 }
+
 func (tracker *nameTracker) listKnownNames() []string {
 	tracker.lck.RLock()
 	defer tracker.lck.RUnlock()
@@ -941,18 +965,7 @@ func (tracker *callTracker) handleSendError(msg *Message, err error) {
 	}
 }
 
-// finalize was the only func that did not strobe Done
-func (tracker *callTracker) finalize(sn uint32) {
-	tracker.lck.Lock()
-	defer tracker.lck.Unlock()
-	c, ok := tracker.calls[sn]
-	if ok {
-		delete(tracker.calls, sn)
-		c.ContextCancel()
-	}
-}
-
-func (tracker *callTracker) finalizeWithBody(sn uint32, sequence Sequence, body []interface{}) {
+func (tracker *callTracker) finalizeWithBody(sn uint32, sequence Sequence, body []any) {
 	tracker.lck.Lock()
 	c, ok := tracker.calls[sn]
 	if ok {
diff --git a/vendor/github.com/godbus/dbus/v5/conn_darwin.go b/vendor/github.com/godbus/dbus/v5/conn_darwin.go
index 6e2e402021..cb2325a01b 100644
--- a/vendor/github.com/godbus/dbus/v5/conn_darwin.go
+++ b/vendor/github.com/godbus/dbus/v5/conn_darwin.go
@@ -12,7 +12,6 @@ const defaultSystemBusAddress = "unix:path=/opt/local/var/run/dbus/system_bus_so
 func getSessionBusPlatformAddress() (string, error) {
 	cmd := exec.Command("launchctl", "getenv", "DBUS_LAUNCHD_SESSION_BUS_SOCKET")
 	b, err := cmd.CombinedOutput()
-
 	if err != nil {
 		return "", err
 	}
diff --git a/vendor/github.com/godbus/dbus/v5/conn_other.go b/vendor/github.com/godbus/dbus/v5/conn_other.go
index 90289ca85a..4c6eb305d0 100644
--- a/vendor/github.com/godbus/dbus/v5/conn_other.go
+++ b/vendor/github.com/godbus/dbus/v5/conn_other.go
@@ -1,4 +1,4 @@
-// +build !darwin
+//go:build !darwin
 
 package dbus
 
@@ -6,7 +6,6 @@ import (
 	"bytes"
 	"errors"
 	"fmt"
-	"io/ioutil"
 	"os"
 	"os/exec"
 	"os/user"
@@ -19,7 +18,6 @@ var execCommand = exec.Command
 func getSessionBusPlatformAddress() (string, error) {
 	cmd := execCommand("dbus-launch")
 	b, err := cmd.CombinedOutput()
-
 	if err != nil {
 		return "", err
 	}
@@ -42,10 +40,10 @@ func getSessionBusPlatformAddress() (string, error) {
 // It tries different techniques employed by different operating systems,
 // returning the first valid address it finds, or an empty string.
 //
-// * /run/user/<uid>/bus           if this exists, it *is* the bus socket. present on
-//                                 Ubuntu 18.04
-// * /run/user/<uid>/dbus-session: if this exists, it can be parsed for the bus
-//                                 address. present on Ubuntu 16.04
+//   - /run/user/<uid>/bus           if this exists, it *is* the bus socket. present on
+//     Ubuntu 18.04
+//   - /run/user/<uid>/dbus-session: if this exists, it can be parsed for the bus
+//     address. present on Ubuntu 16.04
 //
 // See https://dbus.freedesktop.org/doc/dbus-launch.1.html
 func tryDiscoverDbusSessionBusAddress() string {
@@ -61,14 +59,9 @@ func tryDiscoverDbusSessionBusAddress() string {
 			// text file // containing the address of the socket, e.g.:
 			// DBUS_SESSION_BUS_ADDRESS=unix:abstract=/tmp/dbus-E1c73yNqrG
 
-			if f, err := ioutil.ReadFile(runUserSessionDbusFile); err == nil {
-				fileContent := string(f)
-
-				prefix := "DBUS_SESSION_BUS_ADDRESS="
-
-				if strings.HasPrefix(fileContent, prefix) {
-					address := strings.TrimRight(strings.TrimPrefix(fileContent, prefix), "\n\r")
-					return address
+			if f, err := os.ReadFile(runUserSessionDbusFile); err == nil {
+				if addr, ok := strings.CutPrefix(string(f), "DBUS_SESSION_BUS_ADDRESS="); ok {
+					return strings.TrimRight(addr, "\n\r")
 				}
 			}
 		}
diff --git a/vendor/github.com/godbus/dbus/v5/conn_unix.go b/vendor/github.com/godbus/dbus/v5/conn_unix.go
index 58aee7d2af..77d6bf1a47 100644
--- a/vendor/github.com/godbus/dbus/v5/conn_unix.go
+++ b/vendor/github.com/godbus/dbus/v5/conn_unix.go
@@ -1,8 +1,9 @@
-//+build !windows,!solaris,!darwin
+//go:build !windows && !solaris && !darwin
 
 package dbus
 
 import (
+	"net"
 	"os"
 )
 
@@ -15,3 +16,25 @@ func getSystemBusPlatformAddress() string {
 	}
 	return defaultSystemBusAddress
 }
+
+// DialUnix establishes a new private connection to the message bus specified by UnixConn.
+func DialUnix(conn *net.UnixConn, opts ...ConnOption) (*Conn, error) {
+	tr := newUnixTransportFromConn(conn)
+	return newConn(tr, opts...)
+}
+
+func ConnectUnix(uconn *net.UnixConn, opts ...ConnOption) (*Conn, error) {
+	conn, err := DialUnix(uconn, opts...)
+	if err != nil {
+		return nil, err
+	}
+	if err = conn.Auth(conn.auth); err != nil {
+		_ = conn.Close()
+		return nil, err
+	}
+	if err = conn.Hello(); err != nil {
+		_ = conn.Close()
+		return nil, err
+	}
+	return conn, nil
+}
diff --git a/vendor/github.com/godbus/dbus/v5/conn_windows.go b/vendor/github.com/godbus/dbus/v5/conn_windows.go
index 4291e4519c..fa839d2a22 100644
--- a/vendor/github.com/godbus/dbus/v5/conn_windows.go
+++ b/vendor/github.com/godbus/dbus/v5/conn_windows.go
@@ -1,5 +1,3 @@
-//+build windows
-
 package dbus
 
 import "os"
diff --git a/vendor/github.com/godbus/dbus/v5/dbus.go b/vendor/github.com/godbus/dbus/v5/dbus.go
index c188d10485..d3622d8079 100644
--- a/vendor/github.com/godbus/dbus/v5/dbus.go
+++ b/vendor/github.com/godbus/dbus/v5/dbus.go
@@ -10,11 +10,8 @@ import (
 var (
 	byteType        = reflect.TypeOf(byte(0))
 	boolType        = reflect.TypeOf(false)
-	uint8Type       = reflect.TypeOf(uint8(0))
 	int16Type       = reflect.TypeOf(int16(0))
 	uint16Type      = reflect.TypeOf(uint16(0))
-	intType         = reflect.TypeOf(int(0))
-	uintType        = reflect.TypeOf(uint(0))
 	int32Type       = reflect.TypeOf(int32(0))
 	uint32Type      = reflect.TypeOf(uint32(0))
 	int64Type       = reflect.TypeOf(int64(0))
@@ -24,8 +21,8 @@ var (
 	signatureType   = reflect.TypeOf(Signature{""})
 	objectPathType  = reflect.TypeOf(ObjectPath(""))
 	variantType     = reflect.TypeOf(Variant{Signature{""}, nil})
-	interfacesType  = reflect.TypeOf([]interface{}{})
-	interfaceType   = reflect.TypeOf((*interface{})(nil)).Elem()
+	interfacesType  = reflect.TypeOf([]any{})
+	interfaceType   = reflect.TypeOf((*any)(nil)).Elem()
 	unixFDType      = reflect.TypeOf(UnixFD(0))
 	unixFDIndexType = reflect.TypeOf(UnixFDIndex(0))
 	errType         = reflect.TypeOf((*error)(nil)).Elem()
@@ -45,7 +42,7 @@ func (e InvalidTypeError) Error() string {
 // pointers. It converts slices of interfaces from src to corresponding structs
 // in dest. An error is returned if the lengths of src and dest or the types of
 // their elements don't match.
-func Store(src []interface{}, dest ...interface{}) error {
+func Store(src []any, dest ...any) error {
 	if len(src) != len(dest) {
 		return errors.New("dbus.Store: length mismatch")
 	}
@@ -58,7 +55,7 @@ func Store(src []interface{}, dest ...interface{}) error {
 	return nil
 }
 
-func storeInterfaces(src, dest interface{}) error {
+func storeInterfaces(src, dest any) error {
 	return store(reflect.ValueOf(dest), reflect.ValueOf(src))
 }
 
@@ -85,7 +82,7 @@ func storeBase(dest, src reflect.Value) error {
 
 func setDest(dest, src reflect.Value) error {
 	if !isVariant(src.Type()) && isVariant(dest.Type()) {
-		//special conversion for dbus.Variant
+		// special conversion for dbus.Variant
 		dest.Set(reflect.ValueOf(MakeVariant(src.Interface())))
 		return nil
 	}
@@ -166,8 +163,8 @@ func storeMapIntoVariant(dest, src reflect.Value) error {
 func storeMapIntoInterface(dest, src reflect.Value) error {
 	var dv reflect.Value
 	if isVariant(src.Type().Elem()) {
-		//Convert variants to interface{} recursively when converting
-		//to interface{}
+		// Convert variants to interface{} recursively when converting
+		// to interface{}
 		dv = reflect.MakeMap(
 			reflect.MapOf(src.Type().Key(), interfaceType))
 	} else {
@@ -200,7 +197,7 @@ func storeMapIntoMap(dest, src reflect.Value) error {
 func storeSlice(dest, src reflect.Value) error {
 	switch {
 	case src.Type() == interfacesType && dest.Kind() == reflect.Struct:
-		//The decoder always decodes structs as slices of interface{}
+		// The decoder always decodes structs as slices of interface{}
 		return storeStruct(dest, src)
 	case !kindsAreCompatible(dest.Type(), src.Type()):
 		return fmt.Errorf(
@@ -225,7 +222,7 @@ func storeStruct(dest, src reflect.Value) error {
 	if isVariant(dest.Type()) {
 		return storeBase(dest, src)
 	}
-	dval := make([]interface{}, 0, dest.NumField())
+	dval := make([]any, 0, dest.NumField())
 	dtype := dest.Type()
 	for i := 0; i < dest.NumField(); i++ {
 		field := dest.Field(i)
@@ -245,7 +242,7 @@ func storeStruct(dest, src reflect.Value) error {
 				"enough fields need: %d have: %d",
 			src.Len(), len(dval))
 	}
-	return Store(src.Interface().([]interface{}), dval...)
+	return Store(src.Interface().([]any), dval...)
 }
 
 func storeSliceIntoVariant(dest, src reflect.Value) error {
@@ -260,8 +257,8 @@ func storeSliceIntoVariant(dest, src reflect.Value) error {
 func storeSliceIntoInterface(dest, src reflect.Value) error {
 	var dv reflect.Value
 	if isVariant(src.Type().Elem()) {
-		//Convert variants to interface{} recursively when converting
-		//to interface{}
+		// Convert variants to interface{} recursively when converting
+		// to interface{}
 		dv = reflect.MakeSlice(reflect.SliceOf(interfaceType),
 			src.Len(), src.Cap())
 	} else {
@@ -334,7 +331,7 @@ func (o ObjectPath) IsValid() bool {
 }
 
 // A UnixFD is a Unix file descriptor sent over the wire. See the package-level
-// documentation for more information about Unix file descriptor passsing.
+// documentation for more information about Unix file descriptor passing.
 type UnixFD int32
 
 // A UnixFDIndex is the representation of a Unix file descriptor in a message.
diff --git a/vendor/github.com/godbus/dbus/v5/decoder.go b/vendor/github.com/godbus/dbus/v5/decoder.go
index 89bfed9d1a..05af8cdd34 100644
--- a/vendor/github.com/godbus/dbus/v5/decoder.go
+++ b/vendor/github.com/godbus/dbus/v5/decoder.go
@@ -4,6 +4,7 @@ import (
 	"encoding/binary"
 	"io"
 	"reflect"
+	"unsafe"
 )
 
 type decoder struct {
@@ -11,6 +12,12 @@ type decoder struct {
 	order binary.ByteOrder
 	pos   int
 	fds   []int
+
+	// The following fields are used to reduce memory allocs.
+	conv *stringConverter
+	buf  []byte
+	d    float64
+	y    [1]byte
 }
 
 // newDecoder returns a new decoder that reads values from in. The input is
@@ -20,29 +27,39 @@ func newDecoder(in io.Reader, order binary.ByteOrder, fds []int) *decoder {
 	dec.in = in
 	dec.order = order
 	dec.fds = fds
+	dec.conv = newStringConverter(stringConverterBufferSize)
 	return dec
 }
 
+// Reset resets the decoder to be reading from in.
+func (dec *decoder) Reset(in io.Reader, order binary.ByteOrder, fds []int) {
+	dec.in = in
+	dec.order = order
+	dec.pos = 0
+	dec.fds = fds
+
+	if dec.conv == nil {
+		dec.conv = newStringConverter(stringConverterBufferSize)
+	}
+}
+
 // align aligns the input to the given boundary and panics on error.
 func (dec *decoder) align(n int) {
 	if dec.pos%n != 0 {
 		newpos := (dec.pos + n - 1) & ^(n - 1)
-		empty := make([]byte, newpos-dec.pos)
-		if _, err := io.ReadFull(dec.in, empty); err != nil {
-			panic(err)
-		}
+		dec.read2buf(newpos - dec.pos)
 		dec.pos = newpos
 	}
 }
 
 // Calls binary.Read(dec.in, dec.order, v) and panics on read errors.
-func (dec *decoder) binread(v interface{}) {
+func (dec *decoder) binread(v any) {
 	if err := binary.Read(dec.in, dec.order, v); err != nil {
 		panic(err)
 	}
 }
 
-func (dec *decoder) Decode(sig Signature) (vs []interface{}, err error) {
+func (dec *decoder) Decode(sig Signature) (vs []any, err error) {
 	defer func() {
 		var ok bool
 		v := recover()
@@ -52,7 +69,7 @@ func (dec *decoder) Decode(sig Signature) (vs []interface{}, err error) {
 			}
 		}
 	}()
-	vs = make([]interface{}, 0)
+	vs = make([]any, 0)
 	s := sig.str
 	for s != "" {
 		err, rem := validSingle(s, &depthCounter{})
@@ -66,79 +83,89 @@ func (dec *decoder) Decode(sig Signature) (vs []interface{}, err error) {
 	return vs, nil
 }
 
-func (dec *decoder) decode(s string, depth int) interface{} {
+// read2buf reads exactly n bytes from the reader dec.in into the buffer dec.buf
+// to reduce memory allocs.
+// The buffer grows automatically.
+func (dec *decoder) read2buf(n int) {
+	if cap(dec.buf) < n {
+		dec.buf = make([]byte, n)
+	} else {
+		dec.buf = dec.buf[:n]
+	}
+	if _, err := io.ReadFull(dec.in, dec.buf); err != nil {
+		panic(err)
+	}
+}
+
+// decodeU decodes uint32 obtained from the reader dec.in.
+// The goal is to reduce memory allocs.
+func (dec *decoder) decodeU() uint32 {
+	dec.align(4)
+	dec.read2buf(4)
+	dec.pos += 4
+	return dec.order.Uint32(dec.buf)
+}
+
+func (dec *decoder) decode(s string, depth int) any {
 	dec.align(alignment(typeFor(s)))
 	switch s[0] {
 	case 'y':
-		var b [1]byte
-		if _, err := dec.in.Read(b[:]); err != nil {
+		if _, err := dec.in.Read(dec.y[:]); err != nil {
 			panic(err)
 		}
 		dec.pos++
-		return b[0]
+		return dec.y[0]
 	case 'b':
-		i := dec.decode("u", depth).(uint32)
-		switch {
-		case i == 0:
+		switch dec.decodeU() {
+		case 0:
 			return false
-		case i == 1:
+		case 1:
 			return true
 		default:
 			panic(FormatError("invalid value for boolean"))
 		}
 	case 'n':
-		var i int16
-		dec.binread(&i)
+		dec.read2buf(2)
 		dec.pos += 2
-		return i
+		return int16(dec.order.Uint16(dec.buf))
 	case 'i':
-		var i int32
-		dec.binread(&i)
+		dec.read2buf(4)
 		dec.pos += 4
-		return i
+		return int32(dec.order.Uint32(dec.buf))
 	case 'x':
-		var i int64
-		dec.binread(&i)
+		dec.read2buf(8)
 		dec.pos += 8
-		return i
+		return int64(dec.order.Uint64(dec.buf))
 	case 'q':
-		var i uint16
-		dec.binread(&i)
+		dec.read2buf(2)
 		dec.pos += 2
-		return i
+		return dec.order.Uint16(dec.buf)
 	case 'u':
-		var i uint32
-		dec.binread(&i)
-		dec.pos += 4
-		return i
+		return dec.decodeU()
 	case 't':
-		var i uint64
-		dec.binread(&i)
+		dec.read2buf(8)
 		dec.pos += 8
-		return i
+		return dec.order.Uint64(dec.buf)
 	case 'd':
-		var f float64
-		dec.binread(&f)
+		dec.binread(&dec.d)
 		dec.pos += 8
-		return f
+		return dec.d
 	case 's':
-		length := dec.decode("u", depth).(uint32)
-		b := make([]byte, int(length)+1)
-		if _, err := io.ReadFull(dec.in, b); err != nil {
-			panic(err)
-		}
-		dec.pos += int(length) + 1
-		return string(b[:len(b)-1])
+		length := dec.decodeU()
+		p := int(length) + 1
+		dec.read2buf(p)
+		dec.pos += p
+		return dec.conv.String(dec.buf[:len(dec.buf)-1])
 	case 'o':
 		return ObjectPath(dec.decode("s", depth).(string))
 	case 'g':
 		length := dec.decode("y", depth).(byte)
-		b := make([]byte, int(length)+1)
-		if _, err := io.ReadFull(dec.in, b); err != nil {
-			panic(err)
-		}
-		dec.pos += int(length) + 1
-		sig, err := ParseSignature(string(b[:len(b)-1]))
+		p := int(length) + 1
+		dec.read2buf(p)
+		dec.pos += p
+		sig, err := ParseSignature(
+			dec.conv.String(dec.buf[:len(dec.buf)-1]),
+		)
 		if err != nil {
 			panic(err)
 		}
@@ -163,7 +190,7 @@ func (dec *decoder) decode(s string, depth int) interface{} {
 		variant.value = dec.decode(sig.str, depth+1)
 		return variant
 	case 'h':
-		idx := dec.decode("u", depth).(uint32)
+		idx := dec.decodeU()
 		if int(idx) < len(dec.fds) {
 			return UnixFD(dec.fds[idx])
 		}
@@ -176,7 +203,7 @@ func (dec *decoder) decode(s string, depth int) interface{} {
 			if depth >= 63 {
 				panic(FormatError("input exceeds container depth limit"))
 			}
-			length := dec.decode("u", depth).(uint32)
+			length := dec.decodeU()
 			// Even for empty maps, the correct padding must be included
 			dec.align(8)
 			spos := dec.pos
@@ -195,7 +222,7 @@ func (dec *decoder) decode(s string, depth int) interface{} {
 			panic(FormatError("input exceeds container depth limit"))
 		}
 		sig := s[1:]
-		length := dec.decode("u", depth).(uint32)
+		length := dec.decodeU()
 		// capacity can be determined only for fixed-size element types
 		var capacity int
 		if s := sigByteSize(sig); s != 0 {
@@ -205,9 +232,9 @@ func (dec *decoder) decode(s string, depth int) interface{} {
 		// Even for empty arrays, the correct padding must be included
 		align := alignment(typeFor(s[1:]))
 		if len(s) > 1 && s[1] == '(' {
-			//Special case for arrays of structs
-			//structs decode as a slice of interface{} values
-			//but the dbus alignment does not match this
+			// Special case for arrays of structs
+			// structs decode as a slice of interface{} values
+			// but the dbus alignment does not match this
 			align = 8
 		}
 		dec.align(align)
@@ -222,7 +249,7 @@ func (dec *decoder) decode(s string, depth int) interface{} {
 			panic(FormatError("input exceeds container depth limit"))
 		}
 		dec.align(8)
-		v := make([]interface{}, 0)
+		v := make([]any, 0)
 		s = s[1 : len(s)-1]
 		for s != "" {
 			err, rem := validSingle(s, &depthCounter{})
@@ -264,9 +291,10 @@ func sigByteSize(sig string) int {
 			i := 1
 			depth := 1
 			for i < len(sig[offset:]) && depth != 0 {
-				if sig[offset+i] == '(' {
+				switch sig[offset+i] {
+				case '(':
 					depth++
-				} else if sig[offset+i] == ')' {
+				case ')':
 					depth--
 				}
 				i++
@@ -290,3 +318,59 @@ type FormatError string
 func (e FormatError) Error() string {
 	return "dbus: wire format error: " + string(e)
 }
+
+// stringConverterBufferSize defines the recommended buffer size of 4KB.
+// It showed good results in a benchmark when decoding 35KB message,
+// see https://github.com/marselester/systemd#testing.
+const stringConverterBufferSize = 4096
+
+func newStringConverter(capacity int) *stringConverter {
+	return &stringConverter{
+		buf:    make([]byte, 0, capacity),
+		offset: 0,
+	}
+}
+
+// stringConverter converts bytes to strings with less allocs.
+// The idea is to accumulate bytes in a buffer with specified capacity
+// and create strings with unsafe package using bytes from a buffer.
+// For example, 10 "fizz" strings written to a 40-byte buffer
+// will result in 1 alloc instead of 10.
+//
+// Once a buffer is filled, a new one is created with the same capacity.
+// Old buffers will be eventually GC-ed
+// with no side effects to the returned strings.
+type stringConverter struct {
+	// buf is a temporary buffer where decoded strings are batched.
+	buf []byte
+	// offset is a buffer position where the last string was written.
+	offset int
+}
+
+// String converts bytes to a string.
+func (c *stringConverter) String(b []byte) string {
+	n := len(b)
+	if n == 0 {
+		return ""
+	}
+	// Must allocate because a string doesn't fit into the buffer.
+	if n > cap(c.buf) {
+		return string(b)
+	}
+
+	if len(c.buf)+n > cap(c.buf) {
+		c.buf = make([]byte, 0, cap(c.buf))
+		c.offset = 0
+	}
+	c.buf = append(c.buf, b...)
+
+	b = c.buf[c.offset:]
+	s := toString(b)
+	c.offset += n
+	return s
+}
+
+// toString converts a byte slice to a string without allocating.
+func toString(b []byte) string {
+	return unsafe.String(&b[0], len(b))
+}
diff --git a/vendor/github.com/godbus/dbus/v5/default_handler.go b/vendor/github.com/godbus/dbus/v5/default_handler.go
index 13132c6b47..c17ab0b97d 100644
--- a/vendor/github.com/godbus/dbus/v5/default_handler.go
+++ b/vendor/github.com/godbus/dbus/v5/default_handler.go
@@ -18,9 +18,9 @@ func newIntrospectIntf(h *defaultHandler) *exportedIntf {
 	return newExportedIntf(methods, true)
 }
 
-//NewDefaultHandler returns an instance of the default
-//call handler. This is useful if you want to implement only
-//one of the two handlers but not both.
+// NewDefaultHandler returns an instance of the default
+// call handler. This is useful if you want to implement only
+// one of the two handlers but not both.
 //
 // Deprecated: this is the default value, don't use it, it will be unexported.
 func NewDefaultHandler() *defaultHandler {
@@ -52,9 +52,9 @@ func (h *defaultHandler) introspectPath(path ObjectPath) string {
 		if p != "/" {
 			p += "/"
 		}
-		if strings.HasPrefix(string(obj), p) {
-			node_name := strings.Split(string(obj[len(p):]), "/")[0]
-			subpath[node_name] = struct{}{}
+		if after, ok := strings.CutPrefix(string(obj), p); ok {
+			name, _, _ := strings.Cut(after, "/")
+			subpath[name] = struct{}{}
 		}
 	}
 	for s := range subpath {
@@ -117,7 +117,7 @@ type exportedMethod struct {
 	reflect.Value
 }
 
-func (m exportedMethod) Call(args ...interface{}) ([]interface{}, error) {
+func (m exportedMethod) Call(args ...any) ([]any, error) {
 	t := m.Type()
 
 	params := make([]reflect.Value, len(args))
@@ -143,12 +143,12 @@ func (m exportedMethod) Call(args ...interface{}) ([]interface{}, error) {
 			ret = ret[:t.NumOut()-1]
 		}
 	}
-	out := make([]interface{}, len(ret))
+	out := make([]any, len(ret))
 	for i, val := range ret {
 		out[i] = val.Interface()
 	}
 	if nilErr || err == nil {
-		//concrete type to interface nil is a special case
+		// concrete type to interface nil is a special case
 		return out, nil
 	}
 	return out, err
@@ -158,7 +158,7 @@ func (m exportedMethod) NumArguments() int {
 	return m.Value.Type().NumIn()
 }
 
-func (m exportedMethod) ArgumentValue(i int) interface{} {
+func (m exportedMethod) ArgumentValue(i int) any {
 	return reflect.Zero(m.Type().In(i)).Interface()
 }
 
@@ -166,7 +166,7 @@ func (m exportedMethod) NumReturns() int {
 	return m.Value.Type().NumOut()
 }
 
-func (m exportedMethod) ReturnValue(i int) interface{} {
+func (m exportedMethod) ReturnValue(i int) any {
 	return reflect.Zero(m.Type().Out(i)).Interface()
 }
 
@@ -215,10 +215,6 @@ func (obj *exportedObj) LookupMethod(name string) (Method, bool) {
 	return nil, false
 }
 
-func (obj *exportedObj) isFallbackInterface() bool {
-	return false
-}
-
 func newExportedIntf(methods map[string]Method, includeSubtree bool) *exportedIntf {
 	return &exportedIntf{
 		methods:        methods,
@@ -242,9 +238,9 @@ func (obj *exportedIntf) isFallbackInterface() bool {
 	return obj.includeSubtree
 }
 
-//NewDefaultSignalHandler returns an instance of the default
-//signal handler. This is useful if you want to implement only
-//one of the two handlers but not both.
+// NewDefaultSignalHandler returns an instance of the default
+// signal handler. This is useful if you want to implement only
+// one of the two handlers but not both.
 //
 // Deprecated: this is the default value, don't use it, it will be unexported.
 func NewDefaultSignalHandler() *defaultSignalHandler {
diff --git a/vendor/github.com/godbus/dbus/v5/doc.go b/vendor/github.com/godbus/dbus/v5/doc.go
index 8f25a00d61..09eedc71e6 100644
--- a/vendor/github.com/godbus/dbus/v5/doc.go
+++ b/vendor/github.com/godbus/dbus/v5/doc.go
@@ -7,7 +7,7 @@ on remote objects and emit or receive signals. Using the Export method, you can
 arrange D-Bus methods calls to be directly translated to method calls on a Go
 value.
 
-Conversion Rules
+# Conversion Rules
 
 For outgoing messages, Go types are automatically converted to the
 corresponding D-Bus types. See the official specification at
@@ -15,25 +15,25 @@ https://dbus.freedesktop.org/doc/dbus-specification.html#type-system for more
 information on the D-Bus type system. The following types are directly encoded
 as their respective D-Bus equivalents:
 
-     Go type     | D-Bus type
-     ------------+-----------
-     byte        | BYTE
-     bool        | BOOLEAN
-     int16       | INT16
-     uint16      | UINT16
-     int         | INT32
-     uint        | UINT32
-     int32       | INT32
-     uint32      | UINT32
-     int64       | INT64
-     uint64      | UINT64
-     float64     | DOUBLE
-     string      | STRING
-     ObjectPath  | OBJECT_PATH
-     Signature   | SIGNATURE
-     Variant     | VARIANT
-     interface{} | VARIANT
-     UnixFDIndex | UNIX_FD
+	Go type     | D-Bus type
+	------------+-----------
+	byte        | BYTE
+	bool        | BOOLEAN
+	int16       | INT16
+	uint16      | UINT16
+	int         | INT32
+	uint        | UINT32
+	int32       | INT32
+	uint32      | UINT32
+	int64       | INT64
+	uint64      | UINT64
+	float64     | DOUBLE
+	string      | STRING
+	ObjectPath  | OBJECT_PATH
+	Signature   | SIGNATURE
+	Variant     | VARIANT
+	interface{} | VARIANT
+	UnixFDIndex | UNIX_FD
 
 Slices and arrays encode as ARRAYs of their element type.
 
@@ -57,7 +57,7 @@ of STRUCTs. Incoming STRUCTS are represented as a slice of empty interfaces
 containing the struct fields in the correct order. The Store function can be
 used to convert such values to Go structs.
 
-Unix FD passing
+# Unix FD passing
 
 Handling Unix file descriptors deserves special mention. To use them, you should
 first check that they are supported on a connection by calling SupportsUnixFDs.
@@ -66,6 +66,5 @@ UnixFD's to messages that are accompanied by the given file descriptors with the
 UnixFD values being substituted by the correct indices. Similarly, the indices
 of incoming messages are automatically resolved. It shouldn't be necessary to use
 UnixFDIndex.
-
 */
 package dbus
diff --git a/vendor/github.com/godbus/dbus/v5/encoder.go b/vendor/github.com/godbus/dbus/v5/encoder.go
index 015b26cd5c..5901ab42a9 100644
--- a/vendor/github.com/godbus/dbus/v5/encoder.go
+++ b/vendor/github.com/godbus/dbus/v5/encoder.go
@@ -59,7 +59,7 @@ func (enc *encoder) padding(offset, algn int) int {
 }
 
 // Calls binary.Write(enc.out, enc.order, v) and panics on write errors.
-func (enc *encoder) binwrite(v interface{}) {
+func (enc *encoder) binwrite(v any) {
 	if err := binary.Write(enc.out, enc.order, v); err != nil {
 		panic(err)
 	}
@@ -67,7 +67,7 @@ func (enc *encoder) binwrite(v interface{}) {
 
 // Encode encodes the given values to the underlying reader. All written values
 // are aligned properly as required by the D-Bus spec.
-func (enc *encoder) Encode(vs ...interface{}) (err error) {
+func (enc *encoder) Encode(vs ...any) (err error) {
 	defer func() {
 		err, _ = recover().(error)
 	}()
diff --git a/vendor/github.com/godbus/dbus/v5/export.go b/vendor/github.com/godbus/dbus/v5/export.go
index d3dd9f7cd6..20d8cb38fa 100644
--- a/vendor/github.com/godbus/dbus/v5/export.go
+++ b/vendor/github.com/godbus/dbus/v5/export.go
@@ -11,47 +11,47 @@ import (
 var (
 	ErrMsgInvalidArg = Error{
 		"org.freedesktop.DBus.Error.InvalidArgs",
-		[]interface{}{"Invalid type / number of args"},
+		[]any{"Invalid type / number of args"},
 	}
 	ErrMsgNoObject = Error{
 		"org.freedesktop.DBus.Error.NoSuchObject",
-		[]interface{}{"No such object"},
+		[]any{"No such object"},
 	}
 	ErrMsgUnknownMethod = Error{
 		"org.freedesktop.DBus.Error.UnknownMethod",
-		[]interface{}{"Unknown / invalid method"},
+		[]any{"Unknown / invalid method"},
 	}
 	ErrMsgUnknownInterface = Error{
 		"org.freedesktop.DBus.Error.UnknownInterface",
-		[]interface{}{"Object does not implement the interface"},
+		[]any{"Object does not implement the interface"},
 	}
 )
 
 func MakeNoObjectError(path ObjectPath) Error {
 	return Error{
 		"org.freedesktop.DBus.Error.NoSuchObject",
-		[]interface{}{fmt.Sprintf("No such object '%s'", string(path))},
+		[]any{fmt.Sprintf("No such object '%s'", string(path))},
 	}
 }
 
 func MakeUnknownMethodError(methodName string) Error {
 	return Error{
 		"org.freedesktop.DBus.Error.UnknownMethod",
-		[]interface{}{fmt.Sprintf("Unknown / invalid method '%s'", methodName)},
+		[]any{fmt.Sprintf("Unknown / invalid method '%s'", methodName)},
 	}
 }
 
 func MakeUnknownInterfaceError(ifaceName string) Error {
 	return Error{
 		"org.freedesktop.DBus.Error.UnknownInterface",
-		[]interface{}{fmt.Sprintf("Object does not implement the interface '%s'", ifaceName)},
+		[]any{fmt.Sprintf("Object does not implement the interface '%s'", ifaceName)},
 	}
 }
 
 func MakeFailedError(err error) *Error {
 	return &Error{
 		"org.freedesktop.DBus.Error.Failed",
-		[]interface{}{err.Error()},
+		[]any{err.Error()},
 	}
 }
 
@@ -67,7 +67,7 @@ func computeMethodName(name string, mapping map[string]string) string {
 	return name
 }
 
-func getMethods(in interface{}, mapping map[string]string) map[string]reflect.Value {
+func getMethods(in any, mapping map[string]string) map[string]reflect.Value {
 	if in == nil {
 		return nil
 	}
@@ -91,7 +91,7 @@ func getMethods(in interface{}, mapping map[string]string) map[string]reflect.Va
 	return methods
 }
 
-func getAllMethods(in interface{}, mapping map[string]string) map[string]reflect.Value {
+func getAllMethods(in any, mapping map[string]string) map[string]reflect.Value {
 	if in == nil {
 		return nil
 	}
@@ -107,9 +107,9 @@ func getAllMethods(in interface{}, mapping map[string]string) map[string]reflect
 	return methods
 }
 
-func standardMethodArgumentDecode(m Method, sender string, msg *Message, body []interface{}) ([]interface{}, error) {
-	pointers := make([]interface{}, m.NumArguments())
-	decode := make([]interface{}, 0, len(body))
+func standardMethodArgumentDecode(m Method, sender string, msg *Message, body []any) ([]any, error) {
+	pointers := make([]any, m.NumArguments())
+	decode := make([]any, 0, len(body))
 
 	for i := 0; i < m.NumArguments(); i++ {
 		tp := reflect.TypeOf(m.ArgumentValue(i))
@@ -135,7 +135,7 @@ func standardMethodArgumentDecode(m Method, sender string, msg *Message, body []
 	return pointers, nil
 }
 
-func (conn *Conn) decodeArguments(m Method, sender string, msg *Message) ([]interface{}, error) {
+func (conn *Conn) decodeArguments(m Method, sender string, msg *Message) ([]any, error) {
 	if decoder, ok := m.(ArgumentDecoder); ok {
 		return decoder.DecodeArguments(conn, sender, msg, msg.Body)
 	}
@@ -204,23 +204,21 @@ func (conn *Conn) handleCall(msg *Message) {
 			reply.Headers[FieldDestination] = msg.Headers[FieldSender]
 		}
 		reply.Headers[FieldReplySerial] = MakeVariant(msg.serial)
-		reply.Body = make([]interface{}, len(ret))
-		for i := 0; i < len(ret); i++ {
-			reply.Body[i] = ret[i]
-		}
+		reply.Body = make([]any, len(ret))
+		copy(reply.Body, ret)
 		reply.Headers[FieldSignature] = MakeVariant(SignatureOf(reply.Body...))
 
-		if err := reply.IsValid(); err != nil {
-			fmt.Fprintf(os.Stderr, "dbus: dropping invalid reply to %s.%s on obj %s: %s\n", ifaceName, name, path, err)
-		} else {
-			conn.sendMessageAndIfClosed(reply, nil)
+		if err := conn.sendMessageAndIfClosed(reply, nil); err != nil {
+			if _, ok := err.(FormatError); ok {
+				fmt.Fprintf(os.Stderr, "dbus: replacing invalid reply to %s.%s on obj %s: %s\n", ifaceName, name, path, err)
+			}
 		}
 	}
 }
 
 // Emit emits the given signal on the message bus. The name parameter must be
 // formatted as "interface.member", e.g., "org.freedesktop.DBus.NameLost".
-func (conn *Conn) Emit(path ObjectPath, name string, values ...interface{}) error {
+func (conn *Conn) Emit(path ObjectPath, name string, values ...any) error {
 	i := strings.LastIndex(name, ".")
 	if i == -1 {
 		return errors.New("dbus: invalid method name")
@@ -237,18 +235,15 @@ func (conn *Conn) Emit(path ObjectPath, name string, values ...interface{}) erro
 	if len(values) > 0 {
 		msg.Headers[FieldSignature] = MakeVariant(SignatureOf(values...))
 	}
-	if err := msg.IsValid(); err != nil {
-		return err
-	}
 
 	var closed bool
-	conn.sendMessageAndIfClosed(msg, func() {
+	err := conn.sendMessageAndIfClosed(msg, func() {
 		closed = true
 	})
 	if closed {
 		return ErrClosed
 	}
-	return nil
+	return err
 }
 
 // Export registers the given value to be exported as an object on the
@@ -279,7 +274,7 @@ func (conn *Conn) Emit(path ObjectPath, name string, values ...interface{}) erro
 // the given combination of path and interface.
 //
 // Export returns an error if path is not a valid path name.
-func (conn *Conn) Export(v interface{}, path ObjectPath, iface string) error {
+func (conn *Conn) Export(v any, path ObjectPath, iface string) error {
 	return conn.ExportWithMap(v, nil, path, iface)
 }
 
@@ -291,7 +286,7 @@ func (conn *Conn) Export(v interface{}, path ObjectPath, iface string) error {
 // type parameter to your method signature. If the error returned is not nil,
 // it is sent back to the caller as an error. Otherwise, a method reply is
 // sent with the other return values as its body.
-func (conn *Conn) ExportAll(v interface{}, path ObjectPath, iface string) error {
+func (conn *Conn) ExportAll(v any, path ObjectPath, iface string) error {
 	return conn.export(getAllMethods(v, nil), path, iface, false)
 }
 
@@ -300,7 +295,7 @@ func (conn *Conn) ExportAll(v interface{}, path ObjectPath, iface string) error
 //
 // The keys in the map are the real method names (exported on the struct), and
 // the values are the method names to be exported on DBus.
-func (conn *Conn) ExportWithMap(v interface{}, mapping map[string]string, path ObjectPath, iface string) error {
+func (conn *Conn) ExportWithMap(v any, mapping map[string]string, path ObjectPath, iface string) error {
 	return conn.export(getMethods(v, mapping), path, iface, false)
 }
 
@@ -314,7 +309,7 @@ func (conn *Conn) ExportWithMap(v interface{}, mapping map[string]string, path O
 // Note that more specific export paths take precedence over less specific. For
 // example, a method call using the ObjectPath /foo/bar/baz will call a method
 // exported on /foo/bar before a method exported on /foo.
-func (conn *Conn) ExportSubtree(v interface{}, path ObjectPath, iface string) error {
+func (conn *Conn) ExportSubtree(v any, path ObjectPath, iface string) error {
 	return conn.ExportSubtreeWithMap(v, nil, path, iface)
 }
 
@@ -323,7 +318,7 @@ func (conn *Conn) ExportSubtree(v interface{}, path ObjectPath, iface string) er
 //
 // The keys in the map are the real method names (exported on the struct), and
 // the values are the method names to be exported on DBus.
-func (conn *Conn) ExportSubtreeWithMap(v interface{}, mapping map[string]string, path ObjectPath, iface string) error {
+func (conn *Conn) ExportSubtreeWithMap(v any, mapping map[string]string, path ObjectPath, iface string) error {
 	return conn.export(getMethods(v, mapping), path, iface, true)
 }
 
@@ -337,16 +332,16 @@ func (conn *Conn) ExportSubtreeWithMap(v interface{}, mapping map[string]string,
 // methods on the fly.
 //
 // Any non-function objects in the method table are ignored.
-func (conn *Conn) ExportMethodTable(methods map[string]interface{}, path ObjectPath, iface string) error {
+func (conn *Conn) ExportMethodTable(methods map[string]any, path ObjectPath, iface string) error {
 	return conn.exportMethodTable(methods, path, iface, false)
 }
 
 // Like ExportSubtree, but with the same caveats as ExportMethodTable.
-func (conn *Conn) ExportSubtreeMethodTable(methods map[string]interface{}, path ObjectPath, iface string) error {
+func (conn *Conn) ExportSubtreeMethodTable(methods map[string]any, path ObjectPath, iface string) error {
 	return conn.exportMethodTable(methods, path, iface, true)
 }
 
-func (conn *Conn) exportMethodTable(methods map[string]interface{}, path ObjectPath, iface string, includeSubtree bool) error {
+func (conn *Conn) exportMethodTable(methods map[string]any, path ObjectPath, iface string, includeSubtree bool) error {
 	var out map[string]reflect.Value
 	if methods != nil {
 		out = make(map[string]reflect.Value)
@@ -443,6 +438,18 @@ const (
 	ReleaseNameReplyNotOwner
 )
 
+func (rep ReleaseNameReply) String() string {
+	switch rep {
+	case ReleaseNameReplyReleased:
+		return "released"
+	case ReleaseNameReplyNonExistent:
+		return "non existent"
+	case ReleaseNameReplyNotOwner:
+		return "not owner"
+	}
+	return "unknown"
+}
+
 // RequestNameFlags represents the possible flags for a RequestName call.
 type RequestNameFlags uint32
 
@@ -461,3 +468,17 @@ const (
 	RequestNameReplyExists
 	RequestNameReplyAlreadyOwner
 )
+
+func (rep RequestNameReply) String() string {
+	switch rep {
+	case RequestNameReplyPrimaryOwner:
+		return "primary owner"
+	case RequestNameReplyInQueue:
+		return "in queue"
+	case RequestNameReplyExists:
+		return "exists"
+	case RequestNameReplyAlreadyOwner:
+		return "already owner"
+	}
+	return "unknown"
+}
diff --git a/vendor/github.com/godbus/dbus/v5/homedir.go b/vendor/github.com/godbus/dbus/v5/homedir.go
deleted file mode 100644
index c44d9b5fc2..0000000000
--- a/vendor/github.com/godbus/dbus/v5/homedir.go
+++ /dev/null
@@ -1,25 +0,0 @@
-package dbus
-
-import (
-	"os"
-	"os/user"
-)
-
-// Get returns the home directory of the current user, which is usually the
-// value of HOME environment variable. In case it is not set or empty, os/user
-// package is used.
-//
-// If linking statically with cgo enabled against glibc, make sure the
-// osusergo build tag is used.
-//
-// If needing to do nss lookups, do not disable cgo or set osusergo.
-func getHomeDir() string {
-	homeDir := os.Getenv("HOME")
-	if homeDir != "" {
-		return homeDir
-	}
-	if u, err := user.Current(); err == nil {
-		return u.HomeDir
-	}
-	return "/"
-}
diff --git a/vendor/github.com/godbus/dbus/v5/match.go b/vendor/github.com/godbus/dbus/v5/match.go
index 5a607e53e4..ffb0134475 100644
--- a/vendor/github.com/godbus/dbus/v5/match.go
+++ b/vendor/github.com/godbus/dbus/v5/match.go
@@ -26,10 +26,10 @@ func WithMatchOption(key, value string) MatchOption {
 	return MatchOption{key, value}
 }
 
-// doesn't make sense to export this option because clients can only
-// subscribe to messages with signal type.
-func withMatchType(typ string) MatchOption {
-	return WithMatchOption("type", typ)
+// It does not make sense to have a public WithMatchType function
+// because clients can only subscribe to messages with signal type.
+func withMatchTypeSignal() MatchOption {
+	return WithMatchOption("type", "signal")
 }
 
 // WithMatchSender sets sender match option.
diff --git a/vendor/github.com/godbus/dbus/v5/message.go b/vendor/github.com/godbus/dbus/v5/message.go
index bdf43fdd6e..097ca3a7fa 100644
--- a/vendor/github.com/godbus/dbus/v5/message.go
+++ b/vendor/github.com/godbus/dbus/v5/message.go
@@ -108,7 +108,7 @@ type Message struct {
 	Type
 	Flags
 	Headers map[HeaderField]Variant
-	Body    []interface{}
+	Body    []any
 
 	serial uint32
 }
@@ -158,7 +158,9 @@ func DecodeMessageWithFDs(rd io.Reader, fds []int) (msg *Message, err error) {
 	if err != nil {
 		return nil, err
 	}
-	binary.Read(bytes.NewBuffer(b), order, &hlength)
+	if err := binary.Read(bytes.NewBuffer(b), order, &hlength); err != nil {
+		return nil, err
+	}
 	if hlength+length+16 > 1<<27 {
 		return nil, InvalidMessageError("message is too long")
 	}
@@ -186,7 +188,7 @@ func DecodeMessageWithFDs(rd io.Reader, fds []int) (msg *Message, err error) {
 		}
 	}
 
-	if err = msg.IsValid(); err != nil {
+	if err = msg.validateHeader(); err != nil {
 		return nil, err
 	}
 	sig, _ := msg.Headers[FieldSignature].value.(Signature)
@@ -230,7 +232,7 @@ func (msg *Message) EncodeToWithFDs(out io.Writer, order binary.ByteOrder) (fds
 	if err := msg.validateHeader(); err != nil {
 		return nil, err
 	}
-	var vs [7]interface{}
+	var vs [7]any
 	switch order {
 	case binary.LittleEndian:
 		vs[0] = byte('l')
@@ -265,12 +267,14 @@ func (msg *Message) EncodeToWithFDs(out io.Writer, order binary.ByteOrder) (fds
 		return
 	}
 	enc.align(8)
-	body.WriteTo(&buf)
+	if _, err := body.WriteTo(&buf); err != nil {
+		return nil, err
+	}
 	if buf.Len() > 1<<27 {
-		return make([]int, 0), InvalidMessageError("message is too long")
+		return nil, InvalidMessageError("message is too long")
 	}
 	if _, err := buf.WriteTo(out); err != nil {
-		return make([]int, 0), err
+		return nil, err
 	}
 	return enc.fds, nil
 }
@@ -286,8 +290,7 @@ func (msg *Message) EncodeTo(out io.Writer, order binary.ByteOrder) (err error)
 // IsValid checks whether msg is a valid message and returns an
 // InvalidMessageError or FormatError if it is not.
 func (msg *Message) IsValid() error {
-	var b bytes.Buffer
-	return msg.EncodeTo(&b, nativeEndian)
+	return msg.EncodeTo(io.Discard, nativeEndian)
 }
 
 func (msg *Message) validateHeader() error {
diff --git a/vendor/github.com/godbus/dbus/v5/object.go b/vendor/github.com/godbus/dbus/v5/object.go
index 664abb7fba..954d380712 100644
--- a/vendor/github.com/godbus/dbus/v5/object.go
+++ b/vendor/github.com/godbus/dbus/v5/object.go
@@ -9,15 +9,15 @@ import (
 // BusObject is the interface of a remote object on which methods can be
 // invoked.
 type BusObject interface {
-	Call(method string, flags Flags, args ...interface{}) *Call
-	CallWithContext(ctx context.Context, method string, flags Flags, args ...interface{}) *Call
-	Go(method string, flags Flags, ch chan *Call, args ...interface{}) *Call
-	GoWithContext(ctx context.Context, method string, flags Flags, ch chan *Call, args ...interface{}) *Call
+	Call(method string, flags Flags, args ...any) *Call
+	CallWithContext(ctx context.Context, method string, flags Flags, args ...any) *Call
+	Go(method string, flags Flags, ch chan *Call, args ...any) *Call
+	GoWithContext(ctx context.Context, method string, flags Flags, ch chan *Call, args ...any) *Call
 	AddMatchSignal(iface, member string, options ...MatchOption) *Call
 	RemoveMatchSignal(iface, member string, options ...MatchOption) *Call
 	GetProperty(p string) (Variant, error)
-	StoreProperty(p string, value interface{}) error
-	SetProperty(p string, v interface{}) error
+	StoreProperty(p string, value any) error
+	SetProperty(p string, v any) error
 	Destination() string
 	Path() ObjectPath
 }
@@ -30,12 +30,12 @@ type Object struct {
 }
 
 // Call calls a method with (*Object).Go and waits for its reply.
-func (o *Object) Call(method string, flags Flags, args ...interface{}) *Call {
+func (o *Object) Call(method string, flags Flags, args ...any) *Call {
 	return <-o.createCall(context.Background(), method, flags, make(chan *Call, 1), args...).Done
 }
 
 // CallWithContext acts like Call but takes a context
-func (o *Object) CallWithContext(ctx context.Context, method string, flags Flags, args ...interface{}) *Call {
+func (o *Object) CallWithContext(ctx context.Context, method string, flags Flags, args ...any) *Call {
 	return <-o.createCall(ctx, method, flags, make(chan *Call, 1), args...).Done
 }
 
@@ -46,7 +46,7 @@ func (o *Object) CallWithContext(ctx context.Context, method string, flags Flags
 // Deprecated: use (*Conn) AddMatchSignal instead.
 func (o *Object) AddMatchSignal(iface, member string, options ...MatchOption) *Call {
 	base := []MatchOption{
-		withMatchType("signal"),
+		withMatchTypeSignal(),
 		WithMatchInterface(iface),
 		WithMatchMember(member),
 	}
@@ -65,7 +65,7 @@ func (o *Object) AddMatchSignal(iface, member string, options ...MatchOption) *C
 // Deprecated: use (*Conn) RemoveMatchSignal instead.
 func (o *Object) RemoveMatchSignal(iface, member string, options ...MatchOption) *Call {
 	base := []MatchOption{
-		withMatchType("signal"),
+		withMatchTypeSignal(),
 		WithMatchInterface(iface),
 		WithMatchMember(member),
 	}
@@ -89,16 +89,16 @@ func (o *Object) RemoveMatchSignal(iface, member string, options ...MatchOption)
 //
 // If the method parameter contains a dot ('.'), the part before the last dot
 // specifies the interface on which the method is called.
-func (o *Object) Go(method string, flags Flags, ch chan *Call, args ...interface{}) *Call {
+func (o *Object) Go(method string, flags Flags, ch chan *Call, args ...any) *Call {
 	return o.createCall(context.Background(), method, flags, ch, args...)
 }
 
 // GoWithContext acts like Go but takes a context
-func (o *Object) GoWithContext(ctx context.Context, method string, flags Flags, ch chan *Call, args ...interface{}) *Call {
+func (o *Object) GoWithContext(ctx context.Context, method string, flags Flags, ch chan *Call, args ...any) *Call {
 	return o.createCall(ctx, method, flags, ch, args...)
 }
 
-func (o *Object) createCall(ctx context.Context, method string, flags Flags, ch chan *Call, args ...interface{}) *Call {
+func (o *Object) createCall(ctx context.Context, method string, flags Flags, ch chan *Call, args ...any) *Call {
 	if ctx == nil {
 		panic("nil context")
 	}
@@ -136,7 +136,7 @@ func (o *Object) GetProperty(p string) (Variant, error) {
 // StoreProperty calls org.freedesktop.DBus.Properties.Get on the given
 // object. The property name must be given in interface.member notation.
 // It stores the returned property into the provided value.
-func (o *Object) StoreProperty(p string, value interface{}) error {
+func (o *Object) StoreProperty(p string, value any) error {
 	idx := strings.LastIndex(p, ".")
 	if idx == -1 || idx+1 == len(p) {
 		return errors.New("dbus: invalid property " + p)
@@ -151,7 +151,14 @@ func (o *Object) StoreProperty(p string, value interface{}) error {
 
 // SetProperty calls org.freedesktop.DBus.Properties.Set on the given
 // object. The property name must be given in interface.member notation.
-func (o *Object) SetProperty(p string, v interface{}) error {
+// Panics if v is not a valid Variant type.
+func (o *Object) SetProperty(p string, v any) error {
+	// v might already be a variant...
+	variant, ok := v.(Variant)
+	if !ok {
+		// Otherwise, make it into one.
+		variant = MakeVariant(v)
+	}
 	idx := strings.LastIndex(p, ".")
 	if idx == -1 || idx+1 == len(p) {
 		return errors.New("dbus: invalid property " + p)
@@ -160,7 +167,7 @@ func (o *Object) SetProperty(p string, v interface{}) error {
 	iface := p[:idx]
 	prop := p[idx+1:]
 
-	return o.Call("org.freedesktop.DBus.Properties.Set", 0, iface, prop, v).Err
+	return o.Call("org.freedesktop.DBus.Properties.Set", 0, iface, prop, variant).Err
 }
 
 // Destination returns the destination that calls on (o *Object) are sent to.
diff --git a/vendor/github.com/godbus/dbus/v5/sequential_handler.go b/vendor/github.com/godbus/dbus/v5/sequential_handler.go
index ef2fcdba17..886b5eb16b 100644
--- a/vendor/github.com/godbus/dbus/v5/sequential_handler.go
+++ b/vendor/github.com/godbus/dbus/v5/sequential_handler.go
@@ -93,7 +93,7 @@ func (scd *sequentialSignalChannelData) bufferSignals() {
 	var queue []*Signal
 	for {
 		if len(queue) == 0 {
-			signal, ok := <- scd.in
+			signal, ok := <-scd.in
 			if !ok {
 				return
 			}
diff --git a/vendor/github.com/godbus/dbus/v5/server_interfaces.go b/vendor/github.com/godbus/dbus/v5/server_interfaces.go
index e4e0389fdf..24d4ad6329 100644
--- a/vendor/github.com/godbus/dbus/v5/server_interfaces.go
+++ b/vendor/github.com/godbus/dbus/v5/server_interfaces.go
@@ -22,7 +22,7 @@ type Handler interface {
 // of Interface lookup is up to the implementation of
 // the ServerObject. The ServerObject implementation may
 // choose to implement empty string as a valid interface
-// represeting all methods or not per the D-Bus specification.
+// representing all methods or not per the D-Bus specification.
 type ServerObject interface {
 	LookupInterface(name string) (Interface, bool)
 }
@@ -38,17 +38,17 @@ type Interface interface {
 // A Method represents the exposed methods on D-Bus.
 type Method interface {
 	// Call requires that all arguments are decoded before being passed to it.
-	Call(args ...interface{}) ([]interface{}, error)
+	Call(args ...any) ([]any, error)
 	NumArguments() int
 	NumReturns() int
 	// ArgumentValue returns a representative value for the argument at position
 	// it should be of the proper type. reflect.Zero would be a good mechanism
 	// to use for this Value.
-	ArgumentValue(position int) interface{}
+	ArgumentValue(position int) any
 	// ReturnValue returns a representative value for the return at position
 	// it should be of the proper type. reflect.Zero would be a good mechanism
 	// to use for this Value.
-	ReturnValue(position int) interface{}
+	ReturnValue(position int) any
 }
 
 // An Argument Decoder can decode arguments using the non-standard mechanism
@@ -65,7 +65,7 @@ type ArgumentDecoder interface {
 	// To decode the arguments of a method the sender and message are
 	// provided in case the semantics of the implementer provides access
 	// to these as part of the method invocation.
-	DecodeArguments(conn *Conn, sender string, msg *Message, args []interface{}) ([]interface{}, error)
+	DecodeArguments(conn *Conn, sender string, msg *Message, args []any) ([]any, error)
 }
 
 // A SignalHandler is responsible for delivering a signal.
@@ -93,7 +93,7 @@ type SignalRegistrar interface {
 // "org.freedesktop.DBus.Error.Failed" error. By implementing this
 // interface as well a custom encoding may be provided.
 type DBusError interface {
-	DBusError() (string, []interface{})
+	DBusError() (string, []any)
 }
 
 // SerialGenerator is responsible for serials generation.
diff --git a/vendor/github.com/godbus/dbus/v5/sig.go b/vendor/github.com/godbus/dbus/v5/sig.go
index 6b9cadb5fb..de49f860de 100644
--- a/vendor/github.com/godbus/dbus/v5/sig.go
+++ b/vendor/github.com/godbus/dbus/v5/sig.go
@@ -31,7 +31,7 @@ type Signature struct {
 
 // SignatureOf returns the concatenation of all the signatures of the given
 // values. It panics if one of them is not representable in D-Bus.
-func SignatureOf(vs ...interface{}) Signature {
+func SignatureOf(vs ...any) Signature {
 	var s string
 	for _, v := range vs {
 		s += getSignature(reflect.TypeOf(v), &depthCounter{})
@@ -89,9 +89,10 @@ func getSignature(t reflect.Type, depth *depthCounter) (sig string) {
 		}
 		return "s"
 	case reflect.Struct:
-		if t == variantType {
+		switch t {
+		case variantType:
 			return "v"
-		} else if t == signatureType {
+		case signatureType:
 			return "g"
 		}
 		var s string
@@ -202,7 +203,7 @@ func (cnt depthCounter) EnterDictEntry() *depthCounter {
 // and rem is the remaining unparsed part. Otherwise, err is a non-nil
 // SignatureError and rem is "". depth is the current recursion depth which may
 // not be greater than 64 and should be given as 0 on the first call.
-func validSingle(s string, depth *depthCounter) (err error, rem string) {
+func validSingle(s string, depth *depthCounter) (err error, rem string) { //nolint:staticcheck // Ignore "ST1008: error should be returned as the last argument".
 	if s == "" {
 		return SignatureError{Sig: s, Reason: "empty signature"}, ""
 	}
@@ -221,6 +222,9 @@ func validSingle(s string, depth *depthCounter) (err error, rem string) {
 			i++
 			rem = s[i+1:]
 			s = s[2:i]
+			if len(s) == 0 {
+				return SignatureError{Sig: s, Reason: "empty dict"}, ""
+			}
 			if err, _ = validSingle(s[:1], depth.EnterArray().EnterDictEntry()); err != nil {
 				return err, ""
 			}
@@ -255,9 +259,10 @@ func validSingle(s string, depth *depthCounter) (err error, rem string) {
 func findMatching(s string, left, right rune) int {
 	n := 0
 	for i, v := range s {
-		if v == left {
+		switch v {
+		case left:
 			n++
-		} else if v == right {
+		case right:
 			n--
 		}
 		if n == 0 {
diff --git a/vendor/github.com/godbus/dbus/v5/transport_nonce_tcp.go b/vendor/github.com/godbus/dbus/v5/transport_nonce_tcp.go
index 697739efaf..9ffdeb0c0d 100644
--- a/vendor/github.com/godbus/dbus/v5/transport_nonce_tcp.go
+++ b/vendor/github.com/godbus/dbus/v5/transport_nonce_tcp.go
@@ -1,11 +1,11 @@
-//+build !windows
+//go:build !windows
 
 package dbus
 
 import (
 	"errors"
-	"io/ioutil"
 	"net"
+	"os"
 )
 
 func init() {
@@ -27,12 +27,14 @@ func newNonceTcpTransport(keys string) (transport, error) {
 	if err != nil {
 		return nil, err
 	}
-	b, err := ioutil.ReadFile(noncefile)
+	b, err := os.ReadFile(noncefile)
 	if err != nil {
+		socket.Close()
 		return nil, err
 	}
 	_, err = socket.Write(b)
 	if err != nil {
+		socket.Close()
 		return nil, err
 	}
 	return NewConn(socket)
diff --git a/vendor/github.com/godbus/dbus/v5/transport_unix.go b/vendor/github.com/godbus/dbus/v5/transport_unix.go
index 0a8c712ebd..3baad2e9af 100644
--- a/vendor/github.com/godbus/dbus/v5/transport_unix.go
+++ b/vendor/github.com/godbus/dbus/v5/transport_unix.go
@@ -1,4 +1,4 @@
-//+build !windows,!solaris
+//go:build !windows && !solaris
 
 package dbus
 
@@ -11,10 +11,29 @@ import (
 	"syscall"
 )
 
+// msghead represents the part of the message header
+// that has a constant size (byte order + 15 bytes).
+type msghead struct {
+	Type      Type
+	Flags     Flags
+	Proto     byte
+	BodyLen   uint32
+	Serial    uint32
+	HeaderLen uint32
+}
+
 type oobReader struct {
 	conn *net.UnixConn
 	oob  []byte
 	buf  [4096]byte
+
+	// The following fields are used to reduce memory allocs.
+	headers  []header
+	csheader []byte
+	b        *bytes.Buffer
+	r        *bytes.Reader
+	dec      *decoder
+	msghead
 }
 
 func (o *oobReader) Read(b []byte) (n int, err error) {
@@ -35,6 +54,14 @@ type unixTransport struct {
 	hasUnixFDs bool
 }
 
+func newUnixTransportFromConn(conn *net.UnixConn) transport {
+	t := new(unixTransport)
+	t.UnixConn = conn
+	t.hasUnixFDs = true
+
+	return t
+}
+
 func newUnixTransport(keys string) (transport, error) {
 	var err error
 
@@ -70,28 +97,36 @@ func (t *unixTransport) EnableUnixFDs() {
 }
 
 func (t *unixTransport) ReadMessage() (*Message, error) {
-	var (
-		blen, hlen uint32
-		csheader   [16]byte
-		headers    []header
-		order      binary.ByteOrder
-		unixfds    uint32
-	)
 	// To be sure that all bytes of out-of-band data are read, we use a special
 	// reader that uses ReadUnix on the underlying connection instead of Read
 	// and gathers the out-of-band data in a buffer.
 	if t.rdr == nil {
-		t.rdr = &oobReader{conn: t.UnixConn}
+		t.rdr = &oobReader{
+			conn: t.UnixConn,
+			// This buffer is used to decode the part of the header that has a constant size.
+			csheader: make([]byte, 16),
+			b:        &bytes.Buffer{},
+			// The reader helps to read from the buffer several times.
+			r:   &bytes.Reader{},
+			dec: &decoder{},
+		}
 	} else {
-		t.rdr.oob = nil
+		t.rdr.oob = t.rdr.oob[:0]
+		t.rdr.headers = t.rdr.headers[:0]
 	}
+	var (
+		r   = t.rdr.r
+		b   = t.rdr.b
+		dec = t.rdr.dec
+	)
 
-	// read the first 16 bytes (the part of the header that has a constant size),
-	// from which we can figure out the length of the rest of the message
-	if _, err := io.ReadFull(t.rdr, csheader[:]); err != nil {
+	_, err := io.ReadFull(t.rdr, t.rdr.csheader)
+	if err != nil {
 		return nil, err
 	}
-	switch csheader[0] {
+
+	var order binary.ByteOrder
+	switch t.rdr.csheader[0] {
 	case 'l':
 		order = binary.LittleEndian
 	case 'B':
@@ -99,38 +134,62 @@ func (t *unixTransport) ReadMessage() (*Message, error) {
 	default:
 		return nil, InvalidMessageError("invalid byte order")
 	}
-	// csheader[4:8] -> length of message body, csheader[12:16] -> length of
-	// header fields (without alignment)
-	binary.Read(bytes.NewBuffer(csheader[4:8]), order, &blen)
-	binary.Read(bytes.NewBuffer(csheader[12:]), order, &hlen)
+
+	r.Reset(t.rdr.csheader[1:])
+	if err := binary.Read(r, order, &t.rdr.msghead); err != nil {
+		return nil, err
+	}
+
+	msg := &Message{
+		Type:   t.rdr.Type,
+		Flags:  t.rdr.Flags,
+		serial: t.rdr.Serial,
+	}
+	// Length of header fields (without alignment).
+	hlen := t.rdr.HeaderLen
 	if hlen%8 != 0 {
 		hlen += 8 - (hlen % 8)
 	}
+	if hlen+t.rdr.BodyLen+16 > 1<<27 {
+		return nil, InvalidMessageError("message is too long")
+	}
 
-	// decode headers and look for unix fds
-	headerdata := make([]byte, hlen+4)
-	copy(headerdata, csheader[12:])
-	if _, err := io.ReadFull(t.rdr, headerdata[4:]); err != nil {
+	// Decode headers and look for unix fds.
+	b.Reset()
+	if _, err = b.Write(t.rdr.csheader[12:]); err != nil {
 		return nil, err
 	}
-	dec := newDecoder(bytes.NewBuffer(headerdata), order, make([]int, 0))
+	if _, err = io.CopyN(b, t.rdr, int64(hlen)); err != nil {
+		return nil, err
+	}
+	dec.Reset(b, order, nil)
 	dec.pos = 12
 	vs, err := dec.Decode(Signature{"a(yv)"})
 	if err != nil {
 		return nil, err
 	}
-	Store(vs, &headers)
-	for _, v := range headers {
+	if err = Store(vs, &t.rdr.headers); err != nil {
+		return nil, err
+	}
+	var unixfds uint32
+	for _, v := range t.rdr.headers {
 		if v.Field == byte(FieldUnixFDs) {
-			unixfds, _ = v.Variant.value.(uint32)
+			unixfds, _ = v.value.(uint32)
 		}
 	}
-	all := make([]byte, 16+hlen+blen)
-	copy(all, csheader[:])
-	copy(all[16:], headerdata[4:])
-	if _, err := io.ReadFull(t.rdr, all[16+hlen:]); err != nil {
+
+	msg.Headers = make(map[HeaderField]Variant)
+	for _, v := range t.rdr.headers {
+		msg.Headers[HeaderField(v.Field)] = v.Variant
+	}
+
+	dec.align(8)
+	body := make([]byte, t.rdr.BodyLen)
+	if _, err = io.ReadFull(t.rdr, body); err != nil {
 		return nil, err
 	}
+	r.Reset(body)
+
 	if unixfds != 0 {
 		if !t.hasUnixFDs {
 			return nil, errors.New("dbus: got unix fds on unsupported transport")
@@ -147,8 +206,8 @@ func (t *unixTransport) ReadMessage() (*Message, error) {
 		if err != nil {
 			return nil, err
 		}
-		msg, err := DecodeMessageWithFDs(bytes.NewBuffer(all), fds)
-		if err != nil {
+		dec.Reset(r, order, fds)
+		if err = decodeMessageBody(msg, dec); err != nil {
 			return nil, err
 		}
 		// substitute the values in the message body (which are indices for the
@@ -173,7 +232,27 @@ func (t *unixTransport) ReadMessage() (*Message, error) {
 		}
 		return msg, nil
 	}
-	return DecodeMessage(bytes.NewBuffer(all))
+
+	dec.Reset(r, order, nil)
+	if err = decodeMessageBody(msg, dec); err != nil {
+		return nil, err
+	}
+	return msg, nil
+}
+
+func decodeMessageBody(msg *Message, dec *decoder) error {
+	if err := msg.validateHeader(); err != nil {
+		return err
+	}
+
+	sig, _ := msg.Headers[FieldSignature].value.(Signature)
+	if sig.str == "" {
+		return nil
+	}
+
+	var err error
+	msg.Body, err = dec.Decode(sig)
+	return err
 }
 
 func (t *unixTransport) SendMessage(msg *Message) error {
@@ -192,7 +271,7 @@ func (t *unixTransport) SendMessage(msg *Message) error {
 			return err
 		}
 		oob := syscall.UnixRights(fds...)
-		n, oobn, err := t.UnixConn.WriteMsgUnix(buf.Bytes(), oob, nil)
+		n, oobn, err := t.WriteMsgUnix(buf.Bytes(), oob, nil)
 		if err != nil {
 			return err
 		}
diff --git a/vendor/github.com/godbus/dbus/v5/transport_unixcred_freebsd.go b/vendor/github.com/godbus/dbus/v5/transport_unixcred_freebsd.go
index 1b5ed2089d..ff2284c838 100644
--- a/vendor/github.com/godbus/dbus/v5/transport_unixcred_freebsd.go
+++ b/vendor/github.com/godbus/dbus/v5/transport_unixcred_freebsd.go
@@ -7,39 +7,41 @@
 
 package dbus
 
-/*
-const int sizeofPtr = sizeof(void*);
-#define _WANT_UCRED
-#include <sys/types.h>
-#include <sys/ucred.h>
-*/
-import "C"
-
 import (
 	"io"
 	"os"
 	"syscall"
 	"unsafe"
+
+	"golang.org/x/sys/unix"
 )
 
 // http://golang.org/src/pkg/syscall/ztypes_linux_amd64.go
 // https://golang.org/src/syscall/ztypes_freebsd_amd64.go
+//
+// Note: FreeBSD actually uses a 'struct cmsgcred' which starts with
+// these fields and adds a list of the additional groups for the
+// sender.
 type Ucred struct {
-	Pid int32
-	Uid uint32
-	Gid uint32
+	Pid  int32
+	Uid  uint32
+	Euid uint32
+	Gid  uint32
 }
 
-// http://golang.org/src/pkg/syscall/types_linux.go
-// https://golang.org/src/syscall/types_freebsd.go
-// https://github.com/freebsd/freebsd/blob/master/sys/sys/ucred.h
+// https://github.com/freebsd/freebsd/blob/master/sys/sys/socket.h
+//
+// The cmsgcred structure contains the above four fields, followed by
+// a uint16 count of additional groups, uint16 padding to align and a
+// 16 element array of uint32 for the additional groups. The size is
+// the same across all supported platforms.
 const (
-	SizeofUcred = C.sizeof_struct_ucred
+	SizeofCmsgcred = 84 // 4*4 + 2*2 + 16*4
 )
 
 // http://golang.org/src/pkg/syscall/sockcmsg_unix.go
 func cmsgAlignOf(salen int) int {
-	salign := C.sizeofPtr
+	salign := unix.SizeofPtr
 
 	return (salen + salign - 1) & ^(salign - 1)
 }
@@ -54,11 +56,11 @@ func cmsgData(h *syscall.Cmsghdr) unsafe.Pointer {
 // for sending to another process. This can be used for
 // authentication.
 func UnixCredentials(ucred *Ucred) []byte {
-	b := make([]byte, syscall.CmsgSpace(SizeofUcred))
+	b := make([]byte, syscall.CmsgSpace(SizeofCmsgcred))
 	h := (*syscall.Cmsghdr)(unsafe.Pointer(&b[0]))
 	h.Level = syscall.SOL_SOCKET
 	h.Type = syscall.SCM_CREDS
-	h.SetLen(syscall.CmsgLen(SizeofUcred))
+	h.SetLen(syscall.CmsgLen(SizeofCmsgcred))
 	*((*Ucred)(cmsgData(h))) = *ucred
 	return b
 }
diff --git a/vendor/github.com/godbus/dbus/v5/transport_unixcred_linux.go b/vendor/github.com/godbus/dbus/v5/transport_unixcred_linux.go
index d9dfdf6982..2d5d7f612f 100644
--- a/vendor/github.com/godbus/dbus/v5/transport_unixcred_linux.go
+++ b/vendor/github.com/godbus/dbus/v5/transport_unixcred_linux.go
@@ -14,7 +14,7 @@ import (
 func (t *unixTransport) SendNullByte() error {
 	ucred := &syscall.Ucred{Pid: int32(os.Getpid()), Uid: uint32(os.Getuid()), Gid: uint32(os.Getgid())}
 	b := syscall.UnixCredentials(ucred)
-	_, oobn, err := t.UnixConn.WriteMsgUnix([]byte{0}, b, nil)
+	_, oobn, err := t.WriteMsgUnix([]byte{0}, b, nil)
 	if err != nil {
 		return err
 	}
diff --git a/vendor/github.com/godbus/dbus/v5/variant.go b/vendor/github.com/godbus/dbus/v5/variant.go
index ca3dbe16a4..bf98ddea73 100644
--- a/vendor/github.com/godbus/dbus/v5/variant.go
+++ b/vendor/github.com/godbus/dbus/v5/variant.go
@@ -11,17 +11,17 @@ import (
 // Variant represents the D-Bus variant type.
 type Variant struct {
 	sig   Signature
-	value interface{}
+	value any
 }
 
 // MakeVariant converts the given value to a Variant. It panics if v cannot be
 // represented as a D-Bus type.
-func MakeVariant(v interface{}) Variant {
+func MakeVariant(v any) Variant {
 	return MakeVariantWithSignature(v, SignatureOf(v))
 }
 
 // MakeVariantWithSignature converts the given value to a Variant.
-func MakeVariantWithSignature(v interface{}, s Signature) Variant {
+func MakeVariantWithSignature(v any, s Signature) Variant {
 	return Variant{s, v}
 }
 
@@ -73,7 +73,7 @@ func (v Variant) format() (string, bool) {
 	}
 	rv := reflect.ValueOf(v.value)
 	switch rv.Kind() {
-	case reflect.Slice:
+	case reflect.Slice, reflect.Array:
 		if rv.Len() == 0 {
 			return "[]", false
 		}
@@ -119,6 +119,25 @@ func (v Variant) format() (string, bool) {
 		}
 		buf.WriteByte('}')
 		return buf.String(), unamb
+	case reflect.Struct:
+		if rv.NumField() == 0 {
+			return "()", false
+		}
+		unamb := true
+		var buf bytes.Buffer
+		buf.WriteByte('(')
+		for i := 0; i < rv.NumField(); i++ {
+			s, b := MakeVariant(rv.Field(i).Interface()).format()
+			unamb = unamb && b
+			buf.WriteString(s)
+			buf.WriteString(",")
+			if i != rv.NumField()-1 {
+				buf.WriteString(" ")
+			}
+		}
+		buf.WriteByte(')')
+		return buf.String(), unamb
+
 	}
 	return `"INVALID"`, true
 }
@@ -139,12 +158,12 @@ func (v Variant) String() string {
 }
 
 // Value returns the underlying value of v.
-func (v Variant) Value() interface{} {
+func (v Variant) Value() any {
 	return v.value
 }
 
 // Store converts the variant into a native go type using the same
 // mechanism as the "Store" function.
-func (v Variant) Store(value interface{}) error {
+func (v Variant) Store(value any) error {
 	return storeInterfaces(v.value, value)
 }
diff --git a/vendor/github.com/godbus/dbus/v5/variant_lexer.go b/vendor/github.com/godbus/dbus/v5/variant_lexer.go
index bf1398c8f0..a0649c5ca5 100644
--- a/vendor/github.com/godbus/dbus/v5/variant_lexer.go
+++ b/vendor/github.com/godbus/dbus/v5/variant_lexer.go
@@ -67,7 +67,7 @@ func (l *varLexer) emit(t varTokenType) {
 	l.start = l.pos
 }
 
-func (l *varLexer) errorf(format string, v ...interface{}) lexState {
+func (l *varLexer) errorf(format string, v ...any) lexState {
 	l.tokens = append(l.tokens, varToken{
 		tokError,
 		fmt.Sprintf(format, v...),
diff --git a/vendor/github.com/godbus/dbus/v5/variant_parser.go b/vendor/github.com/godbus/dbus/v5/variant_parser.go
index d20f5da6dd..bc0bd945c8 100644
--- a/vendor/github.com/godbus/dbus/v5/variant_parser.go
+++ b/vendor/github.com/godbus/dbus/v5/variant_parser.go
@@ -33,7 +33,7 @@ type varNode interface {
 	Infer() (Signature, error)
 	String() string
 	Sigs() sigSet
-	Value(Signature) (interface{}, error)
+	Value(Signature) (any, error)
 }
 
 func varMakeNode(p *varParser) (varNode, error) {
@@ -134,7 +134,7 @@ func (s sigSet) ToArray() sigSet {
 type numNode struct {
 	sig Signature
 	str string
-	val interface{}
+	val any
 }
 
 var numSigSet = sigSet{
@@ -169,7 +169,7 @@ func (n numNode) Sigs() sigSet {
 	return numSigSet
 }
 
-func (n numNode) Value(sig Signature) (interface{}, error) {
+func (n numNode) Value(sig Signature) (any, error) {
 	if n.sig.str != "" && n.sig != sig {
 		return nil, varTypeError{n.str, sig}
 	}
@@ -190,7 +190,7 @@ func varMakeNumNode(tok varToken, sig Signature) (varNode, error) {
 	return numNode{sig: sig, val: num}, nil
 }
 
-func varNumAs(s string, sig Signature) (interface{}, error) {
+func varNumAs(s string, sig Signature) (any, error) {
 	isUnsigned := false
 	size := 32
 	switch sig.str {
@@ -220,20 +220,20 @@ func varNumAs(s string, sig Signature) (interface{}, error) {
 		return nil, varTypeError{s, sig}
 	}
 	base := 10
-	if strings.HasPrefix(s, "0x") {
+	if after, ok := strings.CutPrefix(s, "0x"); ok {
 		base = 16
-		s = s[2:]
+		s = after
 	}
-	if strings.HasPrefix(s, "0") && len(s) != 1 {
+	if after, ok := strings.CutPrefix(s, "0"); ok && len(s) != 1 {
 		base = 8
-		s = s[1:]
+		s = after
 	}
 	if isUnsigned {
 		i, err := strconv.ParseUint(s, base, size)
 		if err != nil {
 			return nil, err
 		}
-		var v interface{} = i
+		var v any = i
 		switch sig.str {
 		case "y":
 			v = byte(i)
@@ -248,7 +248,7 @@ func varNumAs(s string, sig Signature) (interface{}, error) {
 	if err != nil {
 		return nil, err
 	}
-	var v interface{} = i
+	var v any = i
 	switch sig.str {
 	case "n":
 		v = int16(i)
@@ -260,8 +260,8 @@ func varNumAs(s string, sig Signature) (interface{}, error) {
 
 type stringNode struct {
 	sig Signature
-	str string      // parsed
-	val interface{} // has correct type
+	str string // parsed
+	val any    // has correct type
 }
 
 var stringSigSet = sigSet{
@@ -285,19 +285,19 @@ func (n stringNode) Sigs() sigSet {
 	return stringSigSet
 }
 
-func (n stringNode) Value(sig Signature) (interface{}, error) {
+func (n stringNode) Value(sig Signature) (any, error) {
 	if n.sig.str != "" && n.sig != sig {
 		return nil, varTypeError{n.str, sig}
 	}
 	if n.val != nil {
 		return n.val, nil
 	}
-	switch {
-	case sig.str == "g":
+	switch sig.str {
+	case "g":
 		return Signature{n.str}, nil
-	case sig.str == "o":
+	case "o":
 		return ObjectPath(n.str), nil
-	case sig.str == "s":
+	case "s":
 		return n.str, nil
 	default:
 		return nil, varTypeError{n.str, sig}
@@ -407,7 +407,7 @@ func (boolNode) Sigs() sigSet {
 	return boolSigSet
 }
 
-func (b boolNode) Value(sig Signature) (interface{}, error) {
+func (b boolNode) Value(sig Signature) (any, error) {
 	if sig.str != "b" {
 		return nil, varTypeError{b.String(), sig}
 	}
@@ -417,7 +417,6 @@ func (b boolNode) Value(sig Signature) (interface{}, error) {
 type arrayNode struct {
 	set      sigSet
 	children []varNode
-	val      interface{}
 }
 
 func (n arrayNode) Infer() (Signature, error) {
@@ -446,7 +445,7 @@ func (n arrayNode) Sigs() sigSet {
 	return n.set
 }
 
-func (n arrayNode) Value(sig Signature) (interface{}, error) {
+func (n arrayNode) Value(sig Signature) (any, error) {
 	if n.set.Empty() {
 		// no type information whatsoever, so this must be an empty slice
 		return reflect.MakeSlice(typeFor(sig.str), 0, 0).Interface(), nil
@@ -537,7 +536,7 @@ func (variantNode) Sigs() sigSet {
 	return variantSet
 }
 
-func (n variantNode) Value(sig Signature) (interface{}, error) {
+func (n variantNode) Value(sig Signature) (any, error) {
 	if sig.str != "v" {
 		return nil, varTypeError{n.String(), sig}
 	}
@@ -574,7 +573,6 @@ type dictEntry struct {
 type dictNode struct {
 	kset, vset sigSet
 	children   []dictEntry
-	val        interface{}
 }
 
 func (n dictNode) Infer() (Signature, error) {
@@ -614,7 +612,7 @@ func (n dictNode) Sigs() sigSet {
 	return r
 }
 
-func (n dictNode) Value(sig Signature) (interface{}, error) {
+func (n dictNode) Value(sig Signature) (any, error) {
 	set := n.Sigs()
 	if set.Empty() {
 		// no type information -> empty dict
@@ -749,7 +747,7 @@ func (b byteStringNode) Sigs() sigSet {
 	return byteStringSet
 }
 
-func (b byteStringNode) Value(sig Signature) (interface{}, error) {
+func (b byteStringNode) Value(sig Signature) (any, error) {
 	if sig.str != "ay" {
 		return nil, varTypeError{b.String(), sig}
 	}
diff --git a/vendor/github.com/moby/sys/devices/LICENSE b/vendor/github.com/moby/sys/devices/LICENSE
new file mode 100644
index 0000000000..d645695673
--- /dev/null
+++ b/vendor/github.com/moby/sys/devices/LICENSE
@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/devices/device_unix.go b/vendor/github.com/moby/sys/devices/device_unix.go
similarity index 62%
rename from vendor/github.com/opencontainers/runc/libcontainer/devices/device_unix.go
rename to vendor/github.com/moby/sys/devices/device_unix.go
index 409e58e963..bd401d3b75 100644
--- a/vendor/github.com/opencontainers/runc/libcontainer/devices/device_unix.go
+++ b/vendor/github.com/moby/sys/devices/device_unix.go
@@ -1,5 +1,25 @@
 //go:build !windows
 
+// SPDX-License-Identifier: Apache-2.0
+/*
+ * Copyright (C) 2015-2026 Open Containers Initiative Contributors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+// This code originally comes from runc and was taken from this tree:
+// <https://github.com/opencontainers/runc/tree/v1.4.0/libcontainer/devices>.
+
 package devices
 
 import (
@@ -7,6 +27,7 @@ import (
 	"os"
 	"path/filepath"
 
+	"github.com/opencontainers/cgroups/devices/config"
 	"golang.org/x/sys/unix"
 )
 
@@ -22,7 +43,7 @@ var (
 // DeviceFromPath takes the path to a device and its cgroup_permissions (which
 // cannot be easily queried) to look up the information about a linux device
 // and returns that information as a Device struct.
-func DeviceFromPath(path, permissions string) (*Device, error) {
+func DeviceFromPath(path, permissions string) (*config.Device, error) {
 	var stat unix.Stat_t
 	err := unixLstat(path, &stat)
 	if err != nil {
@@ -30,7 +51,7 @@ func DeviceFromPath(path, permissions string) (*Device, error) {
 	}
 
 	var (
-		devType   Type
+		devType   config.Type
 		mode      = stat.Mode
 		devNumber = uint64(stat.Rdev) //nolint:unconvert // Rdev is uint32 on e.g. MIPS.
 		major     = unix.Major(devNumber)
@@ -38,20 +59,20 @@ func DeviceFromPath(path, permissions string) (*Device, error) {
 	)
 	switch mode & unix.S_IFMT {
 	case unix.S_IFBLK:
-		devType = BlockDevice
+		devType = config.BlockDevice
 	case unix.S_IFCHR:
-		devType = CharDevice
+		devType = config.CharDevice
 	case unix.S_IFIFO:
-		devType = FifoDevice
+		devType = config.FifoDevice
 	default:
 		return nil, ErrNotADevice
 	}
-	return &Device{
-		Rule: Rule{
+	return &config.Device{
+		Rule: config.Rule{
 			Type:        devType,
 			Major:       int64(major),
 			Minor:       int64(minor),
-			Permissions: Permissions(permissions),
+			Permissions: config.Permissions(permissions),
 		},
 		Path:     path,
 		FileMode: os.FileMode(mode &^ unix.S_IFMT),
@@ -61,18 +82,18 @@ func DeviceFromPath(path, permissions string) (*Device, error) {
 }
 
 // HostDevices returns all devices that can be found under /dev directory.
-func HostDevices() ([]*Device, error) {
+func HostDevices() ([]*config.Device, error) {
 	return GetDevices("/dev")
 }
 
 // GetDevices recursively traverses a directory specified by path
 // and returns all devices found there.
-func GetDevices(path string) ([]*Device, error) {
+func GetDevices(path string) ([]*config.Device, error) {
 	files, err := osReadDir(path)
 	if err != nil {
 		return nil, err
 	}
-	var out []*Device
+	var out []*config.Device
 	for _, f := range files {
 		switch {
 		case f.IsDir():
@@ -103,7 +124,7 @@ func GetDevices(path string) ([]*Device, error) {
 			}
 			return nil, err
 		}
-		if device.Type == FifoDevice {
+		if device.Type == config.FifoDevice {
 			continue
 		}
 		out = append(out, device)
diff --git a/vendor/github.com/moby/sys/devices/doc.go b/vendor/github.com/moby/sys/devices/doc.go
new file mode 100644
index 0000000000..a590f4495a
--- /dev/null
+++ b/vendor/github.com/moby/sys/devices/doc.go
@@ -0,0 +1,4 @@
+// Package devices provides some helper functions for constructing device
+// configurations for runc. These are exclusively used by higher-level runtimes
+// that need to configure runc's device list based on existing devices.
+package devices
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/utils/cmsg.go b/vendor/github.com/opencontainers/runc/internal/cmsg/cmsg.go
similarity index 97%
rename from vendor/github.com/opencontainers/runc/libcontainer/utils/cmsg.go
rename to vendor/github.com/opencontainers/runc/internal/cmsg/cmsg.go
index 93bfbbd7f5..b3a02fb255 100644
--- a/vendor/github.com/opencontainers/runc/libcontainer/utils/cmsg.go
+++ b/vendor/github.com/opencontainers/runc/internal/cmsg/cmsg.go
@@ -1,4 +1,6 @@
-package utils
+// Package cmsg provides helpers for sending and receiving SCM_RIGHTS messages
+// via sockets.
+package cmsg
 
 /*
  * Copyright 2016, 2017 SUSE LLC
@@ -21,8 +23,9 @@ import (
 	"os"
 	"runtime"
 
-	"github.com/opencontainers/runc/internal/linux"
 	"golang.org/x/sys/unix"
+
+	"github.com/opencontainers/runc/internal/linux"
 )
 
 // MaxNameLen is the maximum length of the name of a file descriptor being sent
diff --git a/vendor/github.com/opencontainers/runc/internal/pathrs/mkdirall.go b/vendor/github.com/opencontainers/runc/internal/pathrs/mkdirall.go
index 3a896f4841..31cc08579e 100644
--- a/vendor/github.com/opencontainers/runc/internal/pathrs/mkdirall.go
+++ b/vendor/github.com/opencontainers/runc/internal/pathrs/mkdirall.go
@@ -24,6 +24,14 @@ import (
 	"path/filepath"
 )
 
+func splitPath(path string) (dirPath, filename string, err error) {
+	dirPath, filename = filepath.Split(path)
+	if filepath.Join("/", filename) == "/" {
+		return "", "", fmt.Errorf("root subpath %q has bad trailing component %q", path, filename)
+	}
+	return dirPath, filename, nil
+}
+
 // MkdirAllParentInRoot is like [MkdirAllInRoot] except that it only creates
 // the parent directory of the target path, returning the trailing component so
 // the caller has more flexibility around constructing the final inode.
@@ -31,19 +39,19 @@ import (
 // Callers need to be very careful operating on the trailing path, as trivial
 // mistakes like following symlinks can cause security bugs. Most people
 // should probably just use [MkdirAllInRoot] or [CreateInRoot].
-func MkdirAllParentInRoot(root, unsafePath string, mode os.FileMode) (*os.File, string, error) {
+func MkdirAllParentInRoot(root *os.File, unsafePath string, mode os.FileMode) (*os.File, string, error) {
 	// MkdirAllInRoot also does hallucinateUnsafePath, but we need to do it
 	// here first because when we split unsafePath into (dir, file) components
 	// we want to be doing so with the hallucinated path (so that trailing
 	// dangling symlinks are treated correctly).
-	unsafePath, err := hallucinateUnsafePath(root, unsafePath)
+	unsafePath, err := hallucinateUnsafePath(root.Name(), unsafePath)
 	if err != nil {
 		return nil, "", fmt.Errorf("failed to construct hallucinated target path: %w", err)
 	}
 
-	dirPath, filename := filepath.Split(unsafePath)
-	if filepath.Join("/", filename) == "/" {
-		return nil, "", fmt.Errorf("create parent dir in root subpath %q has bad trailing component %q", unsafePath, filename)
+	dirPath, filename, err := splitPath(unsafePath)
+	if err != nil {
+		return nil, "", fmt.Errorf("split path %q for mkdir parent: %w", unsafePath, err)
 	}
 
 	dirFd, err := MkdirAllInRoot(root, dirPath, mode)
diff --git a/vendor/github.com/opencontainers/runc/internal/pathrs/mkdirall_pathrslite.go b/vendor/github.com/opencontainers/runc/internal/pathrs/mkdirall_pathrslite.go
index c2578e051f..0a6f25ebdc 100644
--- a/vendor/github.com/opencontainers/runc/internal/pathrs/mkdirall_pathrslite.go
+++ b/vendor/github.com/opencontainers/runc/internal/pathrs/mkdirall_pathrslite.go
@@ -24,12 +24,11 @@ import (
 
 	"github.com/cyphar/filepath-securejoin/pathrs-lite"
 	"github.com/sirupsen/logrus"
-	"golang.org/x/sys/unix"
 )
 
 // MkdirAllInRoot attempts to make
 //
-//	path, _ := securejoin.SecureJoin(root, unsafePath)
+//	path, _ := securejoin.SecureJoin(root.Name(), unsafePath)
 //	os.MkdirAll(path, mode)
 //	os.Open(path)
 //
@@ -48,8 +47,8 @@ import (
 // handling if unsafePath has already been scoped within the rootfs (this is
 // needed for a lot of runc callers and fixing this would require reworking a
 // lot of path logic).
-func MkdirAllInRoot(root, unsafePath string, mode os.FileMode) (*os.File, error) {
-	unsafePath, err := hallucinateUnsafePath(root, unsafePath)
+func MkdirAllInRoot(root *os.File, unsafePath string, mode os.FileMode) (*os.File, error) {
+	unsafePath, err := hallucinateUnsafePath(root.Name(), unsafePath)
 	if err != nil {
 		return nil, fmt.Errorf("failed to construct hallucinated target path: %w", err)
 	}
@@ -67,13 +66,7 @@ func MkdirAllInRoot(root, unsafePath string, mode os.FileMode) (*os.File, error)
 		mode &= 0o1777
 	}
 
-	rootDir, err := os.OpenFile(root, unix.O_DIRECTORY|unix.O_CLOEXEC, 0)
-	if err != nil {
-		return nil, fmt.Errorf("open root handle: %w", err)
-	}
-	defer rootDir.Close()
-
 	return retryEAGAIN(func() (*os.File, error) {
-		return pathrs.MkdirAllHandle(rootDir, unsafePath, mode)
+		return pathrs.MkdirAllHandle(root, unsafePath, mode)
 	})
 }
diff --git a/vendor/github.com/opencontainers/runc/internal/pathrs/root_pathrslite.go b/vendor/github.com/opencontainers/runc/internal/pathrs/root_pathrslite.go
index 51db77440d..fc5114a856 100644
--- a/vendor/github.com/opencontainers/runc/internal/pathrs/root_pathrslite.go
+++ b/vendor/github.com/opencontainers/runc/internal/pathrs/root_pathrslite.go
@@ -19,7 +19,9 @@
 package pathrs
 
 import (
+	"fmt"
 	"os"
+	"path/filepath"
 
 	"github.com/cyphar/filepath-securejoin/pathrs-lite"
 	"golang.org/x/sys/unix"
@@ -28,11 +30,11 @@ import (
 )
 
 // OpenInRoot opens the given path inside the root with the provided flags. It
-// is effectively shorthand for [securejoin.OpenInRoot] followed by
+// is effectively shorthand for [securejoin.OpenatInRoot] followed by
 // [securejoin.Reopen].
-func OpenInRoot(root, subpath string, flags int) (*os.File, error) {
+func OpenInRoot(root *os.File, subpath string, flags int) (*os.File, error) {
 	handle, err := retryEAGAIN(func() (*os.File, error) {
-		return pathrs.OpenInRoot(root, subpath)
+		return pathrs.OpenatInRoot(root, subpath)
 	})
 	if err != nil {
 		return nil, err
@@ -47,7 +49,7 @@ func OpenInRoot(root, subpath string, flags int) (*os.File, error) {
 // open(O_CREAT|O_NOFOLLOW) semantics. If you want the creation to use O_EXCL,
 // include it in the passed flags. The fileMode argument uses unix.* mode bits,
 // *not* os.FileMode.
-func CreateInRoot(root, subpath string, flags int, fileMode uint32) (*os.File, error) {
+func CreateInRoot(root *os.File, subpath string, flags int, fileMode uint32) (*os.File, error) {
 	dirFd, filename, err := MkdirAllParentInRoot(root, subpath, 0o755)
 	if err != nil {
 		return nil, err
@@ -63,5 +65,48 @@ func CreateInRoot(root, subpath string, flags int, fileMode uint32) (*os.File, e
 	if err != nil {
 		return nil, err
 	}
-	return os.NewFile(uintptr(fd), root+"/"+subpath), nil
+	return os.NewFile(uintptr(fd), root.Name()+"/"+subpath), nil
+}
+
+// UnlinkInRoot deletes the inode specified at the given subpath. If you pass
+// [unix.AT_REMOVEDIR] it will remove directories, otherwise it will remove
+// non-directory inodes.
+func UnlinkInRoot(root *os.File, subpath string, flags int) error {
+	dirPath, filename, err := splitPath(subpath)
+	if err != nil {
+		return fmt.Errorf("split path %q for unlink: %w", subpath, err)
+	}
+
+	dirFd := root
+	if filepath.Join("/", dirPath) != "/" {
+		newDirFd, err := OpenInRoot(root, dirPath, unix.O_DIRECTORY|unix.O_PATH)
+		if err != nil {
+			return fmt.Errorf("failed to open parent directory %q for unlink: %w", dirPath, err)
+		}
+		dirFd = newDirFd
+		defer dirFd.Close()
+	}
+
+	err = unix.Unlinkat(int(dirFd.Fd()), filename, flags)
+	if err != nil {
+		err = &os.PathError{Op: "unlinkat", Path: dirFd.Name() + "/" + filename, Err: err}
+	}
+	return err
+}
+
+// SymlinkInRoot creates a symlink inside a root with the given target (as well
+// as creating any missing parent directories). If the subpath already exists,
+// an error is returned.
+func SymlinkInRoot(linktarget string, root *os.File, subpath string) error {
+	dirFd, filename, err := MkdirAllParentInRoot(root, subpath, 0o755)
+	if err != nil {
+		return err
+	}
+	defer dirFd.Close()
+
+	err = unix.Symlinkat(linktarget, int(dirFd.Fd()), filename)
+	if err != nil {
+		err = &os.PathError{Op: "symlinkat", Path: dirFd.Name() + "/" + filename, Err: err}
+	}
+	return err
 }
diff --git a/vendor/github.com/opencontainers/runc/internal/sys/sysctl_linux.go b/vendor/github.com/opencontainers/runc/internal/sys/sysctl_linux.go
index 96876a55ff..e5f2805c2e 100644
--- a/vendor/github.com/opencontainers/runc/internal/sys/sysctl_linux.go
+++ b/vendor/github.com/opencontainers/runc/internal/sys/sysctl_linux.go
@@ -2,7 +2,6 @@ package sys
 
 import (
 	"fmt"
-	"io"
 	"os"
 	"strings"
 
@@ -42,10 +41,7 @@ func WriteSysctls(sysctls map[string]string) error {
 		}
 		defer sysctlFile.Close()
 
-		n, err := io.WriteString(sysctlFile, value)
-		if n != len(value) && err == nil {
-			err = fmt.Errorf("short write to file (%d bytes != %d bytes)", n, len(value))
-		}
+		_, err = sysctlFile.WriteString(value)
 		if err != nil {
 			return fmt.Errorf("failed to write sysctl %s = %q: %w", key, value, err)
 		}
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/README.md b/vendor/github.com/opencontainers/runc/libcontainer/README.md
index 901351edb7..2e4bd00e96 100644
--- a/vendor/github.com/opencontainers/runc/libcontainer/README.md
+++ b/vendor/github.com/opencontainers/runc/libcontainer/README.md
@@ -14,6 +14,8 @@ host system and which is (optionally) isolated from other containers in the syst
 
 ## Using libcontainer
 
+For a brief overview of using libcontainer, see [example_test.go](example_test.go).
+
 ### Container init
 
 Because containers are spawned in a two step process you will need a binary that
@@ -23,223 +25,10 @@ arg "init", we call the first step process "bootstrap", so you always need a "in
 function as the entry of "bootstrap".
 
 In addition to the go init function the early stage bootstrap is handled by importing
-[nsenter](https://github.com/opencontainers/runc/blob/master/libcontainer/nsenter/README.md).
+[nsenter](../nsenter/README.md).
 
 For details on how runc implements such "init", see
-[init.go](https://github.com/opencontainers/runc/blob/master/init.go)
-and [libcontainer/init_linux.go](https://github.com/opencontainers/runc/blob/master/libcontainer/init_linux.go).
-
-### Device management
-
-If you want containers that have access to some devices, you need to import
-this package into your code:
-
-```go
-    import (
-        _ "github.com/opencontainers/cgroups/devices"
-    )
-```
-
-Without doing this, libcontainer cgroup manager won't be able to set up device
-access rules, and will fail if devices are specified in the container
-configuration.
-
-### Container creation
-
-To create a container you first have to create a configuration
-struct describing how the container is to be created. A sample would look similar to this:
-
-```go
-defaultMountFlags := unix.MS_NOEXEC | unix.MS_NOSUID | unix.MS_NODEV
-var devices []*devices.Rule
-for _, device := range specconv.AllowedDevices {
-	devices = append(devices, &device.Rule)
-}
-config := &configs.Config{
-	Rootfs: "/your/path/to/rootfs",
-	Capabilities: &configs.Capabilities{
-		Bounding: []string{
-			"CAP_KILL",
-			"CAP_AUDIT_WRITE",
-		},
-		Effective: []string{
-			"CAP_KILL",
-			"CAP_AUDIT_WRITE",
-		},
-		Permitted: []string{
-			"CAP_KILL",
-			"CAP_AUDIT_WRITE",
-		},
-	},
-	Namespaces: configs.Namespaces([]configs.Namespace{
-		{Type: configs.NEWNS},
-		{Type: configs.NEWUTS},
-		{Type: configs.NEWIPC},
-		{Type: configs.NEWPID},
-		{Type: configs.NEWUSER},
-		{Type: configs.NEWNET},
-		{Type: configs.NEWCGROUP},
-	}),
-	Cgroups: &configs.Cgroup{
-		Name:   "test-container",
-		Parent: "system",
-		Resources: &configs.Resources{
-			MemorySwappiness: nil,
-			Devices:          devices,
-		},
-	},
-	MaskPaths: []string{
-		"/proc/kcore",
-		"/sys/firmware",
-	},
-	ReadonlyPaths: []string{
-		"/proc/sys", "/proc/sysrq-trigger", "/proc/irq", "/proc/bus",
-	},
-	Devices:  specconv.AllowedDevices,
-	Hostname: "testing",
-	Mounts: []*configs.Mount{
-		{
-			Source:      "proc",
-			Destination: "/proc",
-			Device:      "proc",
-			Flags:       defaultMountFlags,
-		},
-		{
-			Source:      "tmpfs",
-			Destination: "/dev",
-			Device:      "tmpfs",
-			Flags:       unix.MS_NOSUID | unix.MS_STRICTATIME,
-			Data:        "mode=755",
-		},
-		{
-			Source:      "devpts",
-			Destination: "/dev/pts",
-			Device:      "devpts",
-			Flags:       unix.MS_NOSUID | unix.MS_NOEXEC,
-			Data:        "newinstance,ptmxmode=0666,mode=0620,gid=5",
-		},
-		{
-			Device:      "tmpfs",
-			Source:      "shm",
-			Destination: "/dev/shm",
-			Data:        "mode=1777,size=65536k",
-			Flags:       defaultMountFlags,
-		},
-		{
-			Source:      "mqueue",
-			Destination: "/dev/mqueue",
-			Device:      "mqueue",
-			Flags:       defaultMountFlags,
-		},
-		{
-			Source:      "sysfs",
-			Destination: "/sys",
-			Device:      "sysfs",
-			Flags:       defaultMountFlags | unix.MS_RDONLY,
-		},
-	},
-	UIDMappings: []configs.IDMap{
-		{
-			ContainerID: 0,
-			HostID: 1000,
-			Size: 65536,
-		},
-	},
-	GIDMappings: []configs.IDMap{
-		{
-			ContainerID: 0,
-			HostID: 1000,
-			Size: 65536,
-		},
-	},
-	Networks: []*configs.Network{
-		{
-			Type:    "loopback",
-			Address: "127.0.0.1/0",
-			Gateway: "localhost",
-		},
-	},
-	Rlimits: []configs.Rlimit{
-		{
-			Type: unix.RLIMIT_NOFILE,
-			Hard: uint64(1025),
-			Soft: uint64(1025),
-		},
-	},
-}
-```
-
-Once you have the configuration populated you can create a container
-with a specified ID under a specified state directory:
-
-```go
-container, err := libcontainer.Create("/run/containers", "container-id", config)
-if err != nil {
-	logrus.Fatal(err)
-	return
-}
-```
-
-To spawn bash as the initial process inside the container and have the
-processes pid returned in order to wait, signal, or kill the process:
-
-```go
-process := &libcontainer.Process{
-	Args:   []string{"/bin/bash"},
-	Env:    []string{"PATH=/bin"},
-	User:   "daemon",
-	Stdin:  os.Stdin,
-	Stdout: os.Stdout,
-	Stderr: os.Stderr,
-	Init:   true,
-}
-
-err := container.Run(process)
-if err != nil {
-	container.Destroy()
-	logrus.Fatal(err)
-	return
-}
-
-// wait for the process to finish.
-_, err := process.Wait()
-if err != nil {
-	logrus.Fatal(err)
-}
-
-// destroy the container.
-container.Destroy()
-```
-
-Additional ways to interact with a running container are:
-
-```go
-// return all the pids for all processes running inside the container.
-processes, err := container.Processes()
-
-// get detailed cpu, memory, io, and network statistics for the container and
-// it's processes.
-stats, err := container.Stats()
-
-// pause all processes inside the container.
-container.Pause()
-
-// resume all paused processes.
-container.Resume()
-
-// send signal to container's init process.
-container.Signal(signal)
-
-// update container resource constraints.
-container.Set(config)
-
-// get current status of the container.
-status, err := container.Status()
-
-// get current container's state information.
-state, err := container.State()
-```
-
+[../init.go](../init.go) and [init_linux.go](init_linux.go).
 
 ## Checkpoint & Restore
 
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/SPEC.md b/vendor/github.com/opencontainers/runc/libcontainer/SPEC.md
index c6fe4eaa8a..e81005c6c1 100644
--- a/vendor/github.com/opencontainers/runc/libcontainer/SPEC.md
+++ b/vendor/github.com/opencontainers/runc/libcontainer/SPEC.md
@@ -367,7 +367,25 @@ profile <profile_name> flags=(attach_disconnected,mediate_deleted) {
 }
 ```
 
-*TODO: seccomp work is being done to find a good default config*
+[seccomp](https://en.wikipedia.org/wiki/Seccomp) can be used to apply filters
+to the system calls used in a container. The set of filter expressions allows
+you to match against syscall numbers (automatically resolved from syscall
+names) and apply various comparison operators to syscall arguments.
+
+When a filter rule matches, the associated action is executed - such as killing
+the process or thread, returning an errno value without executing the syscall,
+forwarding the request to a user-space agent to handle, emitting a log entry,
+or permitting the syscall to execute.
+
+The primary use-case is to provide an explicit allow-list of syscalls for a
+container, to reduce the kernel API attack surface exposed to the container.
+Historically, seccomp has protected containers against various kernel 0-day
+vulnerabilities, so a strong seccomp filter is highly recommended.
+
+libcontainer does not provide a default filter, but higher-level
+runtimes tend to define their own filters for use with runc (see
+[oci-runtime-seccomp](https://github.com/opencontainers/runtime-spec/blob/v1.2.1/config-linux.md#seccomp)
+for more information on how to write your own filters).
 
 ### Runtime and Init Process
 
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/apparmor/apparmor.go b/vendor/github.com/opencontainers/runc/libcontainer/apparmor/apparmor.go
index e2a26488e0..e58f22825f 100644
--- a/vendor/github.com/opencontainers/runc/libcontainer/apparmor/apparmor.go
+++ b/vendor/github.com/opencontainers/runc/libcontainer/apparmor/apparmor.go
@@ -1,3 +1,6 @@
+// Package apparmor provides a minimal set of helpers to configure the AppArmor
+// profile of the current process, effectively acting as a very stripped-down
+// version of libapparmor.
 package apparmor
 
 import "errors"
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/capabilities/capabilities.go b/vendor/github.com/opencontainers/runc/libcontainer/capabilities/capabilities.go
index b5963a3281..6ac6dc9663 100644
--- a/vendor/github.com/opencontainers/runc/libcontainer/capabilities/capabilities.go
+++ b/vendor/github.com/opencontainers/runc/libcontainer/capabilities/capabilities.go
@@ -1,5 +1,6 @@
 //go:build linux
 
+// Package capabilities provides helpers for managing Linux capabilities.
 package capabilities
 
 import (
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/configs/cgroup_deprecated.go b/vendor/github.com/opencontainers/runc/libcontainer/configs/cgroup_deprecated.go
deleted file mode 100644
index 7836b240ab..0000000000
--- a/vendor/github.com/opencontainers/runc/libcontainer/configs/cgroup_deprecated.go
+++ /dev/null
@@ -1,29 +0,0 @@
-package configs
-
-import "github.com/opencontainers/cgroups"
-
-// Deprecated: use [github.com/opencontainers/cgroups].
-type (
-	Cgroup         = cgroups.Cgroup
-	Resources      = cgroups.Resources
-	FreezerState   = cgroups.FreezerState
-	LinuxRdma      = cgroups.LinuxRdma
-	BlockIODevice  = cgroups.BlockIODevice
-	WeightDevice   = cgroups.WeightDevice
-	ThrottleDevice = cgroups.ThrottleDevice
-	HugepageLimit  = cgroups.HugepageLimit
-	IfPrioMap      = cgroups.IfPrioMap
-)
-
-// Deprecated: use [github.com/opencontainers/cgroups].
-const (
-	Undefined = cgroups.Undefined
-	Frozen    = cgroups.Frozen
-	Thawed    = cgroups.Thawed
-)
-
-// Deprecated: use [github.com/opencontainers/cgroups].
-var (
-	NewWeightDevice   = cgroups.NewWeightDevice
-	NewThrottleDevice = cgroups.NewThrottleDevice
-)
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/configs/config.go b/vendor/github.com/opencontainers/runc/libcontainer/configs/config.go
index 6141c018fb..b8f2321c24 100644
--- a/vendor/github.com/opencontainers/runc/libcontainer/configs/config.go
+++ b/vendor/github.com/opencontainers/runc/libcontainer/configs/config.go
@@ -466,17 +466,6 @@ type Capabilities struct {
 	Ambient []string `json:"Ambient,omitempty"`
 }
 
-// Deprecated: use [Hooks.Run] instead.
-func (hooks HookList) RunHooks(state *specs.State) error {
-	for i, h := range hooks {
-		if err := h.Run(state); err != nil {
-			return fmt.Errorf("error running hook #%d: %w", i, err)
-		}
-	}
-
-	return nil
-}
-
 func (hooks *Hooks) UnmarshalJSON(b []byte) error {
 	var state map[HookName][]CommandHook
 
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/configs/config_linux.go b/vendor/github.com/opencontainers/runc/libcontainer/configs/config_linux.go
index e401f5331b..0e58bdc15d 100644
--- a/vendor/github.com/opencontainers/runc/libcontainer/configs/config_linux.go
+++ b/vendor/github.com/opencontainers/runc/libcontainer/configs/config_linux.go
@@ -26,67 +26,67 @@ type LinuxPersonality struct {
 
 // HostUID gets the translated uid for the process on host which could be
 // different when user namespaces are enabled.
-func (c Config) HostUID(containerId int) (int, error) {
+func (c *Config) HostUID(containerID int) (int, error) {
 	if c.Namespaces.Contains(NEWUSER) {
 		if len(c.UIDMappings) == 0 {
 			return -1, errNoUIDMap
 		}
-		id, found := c.hostIDFromMapping(int64(containerId), c.UIDMappings)
+		id, found := c.hostIDFromMapping(int64(containerID), c.UIDMappings)
 		if !found {
-			return -1, fmt.Errorf("user namespaces enabled, but no mapping found for uid %d", containerId)
+			return -1, fmt.Errorf("user namespaces enabled, but no mapping found for uid %d", containerID)
 		}
 		// If we are a 32-bit binary running on a 64-bit system, it's possible
 		// the mapped user is too large to store in an int, which means we
 		// cannot do the mapping. We can't just return an int64, because
 		// os.Setuid() takes an int.
 		if id > math.MaxInt {
-			return -1, fmt.Errorf("mapping for uid %d (host id %d) is larger than native integer size (%d)", containerId, id, math.MaxInt)
+			return -1, fmt.Errorf("mapping for uid %d (host id %d) is larger than native integer size (%d)", containerID, id, math.MaxInt)
 		}
 		return int(id), nil
 	}
 	// Return unchanged id.
-	return containerId, nil
+	return containerID, nil
 }
 
 // HostRootUID gets the root uid for the process on host which could be non-zero
 // when user namespaces are enabled.
-func (c Config) HostRootUID() (int, error) {
+func (c *Config) HostRootUID() (int, error) {
 	return c.HostUID(0)
 }
 
 // HostGID gets the translated gid for the process on host which could be
 // different when user namespaces are enabled.
-func (c Config) HostGID(containerId int) (int, error) {
+func (c *Config) HostGID(containerID int) (int, error) {
 	if c.Namespaces.Contains(NEWUSER) {
 		if len(c.GIDMappings) == 0 {
 			return -1, errNoGIDMap
 		}
-		id, found := c.hostIDFromMapping(int64(containerId), c.GIDMappings)
+		id, found := c.hostIDFromMapping(int64(containerID), c.GIDMappings)
 		if !found {
-			return -1, fmt.Errorf("user namespaces enabled, but no mapping found for gid %d", containerId)
+			return -1, fmt.Errorf("user namespaces enabled, but no mapping found for gid %d", containerID)
 		}
 		// If we are a 32-bit binary running on a 64-bit system, it's possible
 		// the mapped user is too large to store in an int, which means we
 		// cannot do the mapping. We can't just return an int64, because
 		// os.Setgid() takes an int.
 		if id > math.MaxInt {
-			return -1, fmt.Errorf("mapping for gid %d (host id %d) is larger than native integer size (%d)", containerId, id, math.MaxInt)
+			return -1, fmt.Errorf("mapping for gid %d (host id %d) is larger than native integer size (%d)", containerID, id, math.MaxInt)
 		}
 		return int(id), nil
 	}
 	// Return unchanged id.
-	return containerId, nil
+	return containerID, nil
 }
 
 // HostRootGID gets the root gid for the process on host which could be non-zero
 // when user namespaces are enabled.
-func (c Config) HostRootGID() (int, error) {
+func (c *Config) HostRootGID() (int, error) {
 	return c.HostGID(0)
 }
 
 // Utility function that gets a host ID for a container ID from user namespace map
 // if that ID is present in the map.
-func (c Config) hostIDFromMapping(containerID int64, uMap []IDMap) (int64, bool) {
+func (c *Config) hostIDFromMapping(containerID int64, uMap []IDMap) (int64, bool) {
 	for _, m := range uMap {
 		if (containerID >= m.ContainerID) && (containerID <= (m.ContainerID + m.Size - 1)) {
 			hostID := m.HostID + (containerID - m.ContainerID)
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/configs/memorypolicy.go b/vendor/github.com/opencontainers/runc/libcontainer/configs/memorypolicy.go
index b7b9c6bce1..81bff0d10e 100644
--- a/vendor/github.com/opencontainers/runc/libcontainer/configs/memorypolicy.go
+++ b/vendor/github.com/opencontainers/runc/libcontainer/configs/memorypolicy.go
@@ -2,25 +2,6 @@ package configs
 
 import "golang.org/x/sys/unix"
 
-// Memory policy modes and flags as defined in /usr/include/linux/mempolicy.h
-//
-// Deprecated: use constants from [unix] instead.
-//
-//nolint:revive,staticcheck,nolintlint // ignore ALL_CAPS errors in consts from numaif.h, will match unix.* in the future
-const (
-	MPOL_DEFAULT             = unix.MPOL_DEFAULT
-	MPOL_PREFERRED           = unix.MPOL_PREFERRED
-	MPOL_BIND                = unix.MPOL_BIND
-	MPOL_INTERLEAVE          = unix.MPOL_INTERLEAVE
-	MPOL_LOCAL               = unix.MPOL_LOCAL
-	MPOL_PREFERRED_MANY      = unix.MPOL_PREFERRED_MANY
-	MPOL_WEIGHTED_INTERLEAVE = unix.MPOL_WEIGHTED_INTERLEAVE
-
-	MPOL_F_STATIC_NODES   = unix.MPOL_F_STATIC_NODES
-	MPOL_F_RELATIVE_NODES = unix.MPOL_F_RELATIVE_NODES
-	MPOL_F_NUMA_BALANCING = unix.MPOL_F_NUMA_BALANCING
-)
-
 // LinuxMemoryPolicy contains memory policy configuration.
 type LinuxMemoryPolicy struct {
 	// Mode specifies memory policy mode without mode flags. See
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/configs/mount_linux.go b/vendor/github.com/opencontainers/runc/libcontainer/configs/mount_linux.go
index 87b18bac3d..6db1b3918f 100644
--- a/vendor/github.com/opencontainers/runc/libcontainer/configs/mount_linux.go
+++ b/vendor/github.com/opencontainers/runc/libcontainer/configs/mount_linux.go
@@ -43,8 +43,10 @@ type Mount struct {
 	// Mount data applied to the mount.
 	Data string `json:"data,omitempty"`
 
-	// Relabel source if set, "z" indicates shared, "Z" indicates unshared.
-	Relabel string `json:"relabel,omitempty"`
+	// Relabel field is ignored.
+	//
+	// Deprecated: do not use. This field will be removed in runc 1.7.
+	Relabel string `json:"-"`
 
 	// RecAttr represents mount properties to be applied recursively (AT_RECURSIVE), see mount_setattr(2).
 	RecAttr *unix.MountAttr `json:"rec_attr,omitempty"`
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/criu_linux.go b/vendor/github.com/opencontainers/runc/libcontainer/criu_linux.go
index 322e439578..0b0cdeb8b0 100644
--- a/vendor/github.com/opencontainers/runc/libcontainer/criu_linux.go
+++ b/vendor/github.com/opencontainers/runc/libcontainer/criu_linux.go
@@ -15,15 +15,16 @@ import (
 	"reflect"
 	"strings"
 	"time"
+	"unicode"
 
-	"github.com/checkpoint-restore/go-criu/v7"
-	criurpc "github.com/checkpoint-restore/go-criu/v7/rpc"
+	"github.com/checkpoint-restore/go-criu/v8"
+	criurpc "github.com/checkpoint-restore/go-criu/v8/rpc"
 	securejoin "github.com/cyphar/filepath-securejoin"
 	"github.com/sirupsen/logrus"
 	"golang.org/x/sys/unix"
-	"google.golang.org/protobuf/proto"
 
 	"github.com/opencontainers/cgroups"
+	"github.com/opencontainers/runc/internal/cmsg"
 	"github.com/opencontainers/runc/internal/pathrs"
 	"github.com/opencontainers/runc/libcontainer/configs"
 	"github.com/opencontainers/runc/libcontainer/utils"
@@ -108,14 +109,17 @@ func (c *Container) checkCriuVersion(minVersion int) error {
 
 const descriptorsFilename = "descriptors.json"
 
+// TODO: replace with new(v) once Go < 1.26 is not supported.
+func mkPtr[T any](v T) *T { return &v }
+
 func (c *Container) addCriuDumpMount(req *criurpc.CriuReq, m *configs.Mount) {
 	mountDest := strings.TrimPrefix(m.Destination, c.config.Rootfs)
 	if dest, err := securejoin.SecureJoin(c.config.Rootfs, mountDest); err == nil {
 		mountDest = dest[len(c.config.Rootfs):]
 	}
 	extMnt := &criurpc.ExtMountMap{
-		Key: proto.String(mountDest),
-		Val: proto.String(mountDest),
+		Key: mkPtr(mountDest),
+		Val: mkPtr(mountDest),
 	}
 	req.Opts.ExtMnt = append(req.Opts.ExtMnt, extMnt)
 }
@@ -134,8 +138,8 @@ func (c *Container) addMaskPaths(req *criurpc.CriuReq) error {
 		}
 
 		extMnt := &criurpc.ExtMountMap{
-			Key: proto.String(path),
-			Val: proto.String("/dev/null"),
+			Key: mkPtr(path),
+			Val: mkPtr("/dev/null"),
 		}
 		req.Opts.ExtMnt = append(req.Opts.ExtMnt, extMnt)
 	}
@@ -155,7 +159,7 @@ func (c *Container) handleCriuConfigurationFile(rpcOpts *criurpc.CriuOpts) {
 		// configuration file. If the file does not exist, CRIU
 		// will just ignore it.
 		if configFile != "" {
-			rpcOpts.ConfigFile = proto.String(configFile)
+			rpcOpts.ConfigFile = mkPtr(configFile)
 		}
 		// If 'org.criu.config' exists and is set to an empty
 		// string, a runc specific CRIU configuration file will
@@ -163,7 +167,7 @@ func (c *Container) handleCriuConfigurationFile(rpcOpts *criurpc.CriuOpts) {
 	} else {
 		// If the mentioned annotation has not been found, specify
 		// a default CRIU configuration file.
-		rpcOpts.ConfigFile = proto.String("/etc/criu/runc.conf")
+		rpcOpts.ConfigFile = mkPtr("/etc/criu/runc.conf")
 	}
 }
 
@@ -184,7 +188,19 @@ func (c *Container) criuSupportsExtNS(t configs.NamespaceType) bool {
 }
 
 func criuNsToKey(t configs.NamespaceType) string {
-	return "extRoot" + strings.Title(configs.NsName(t)) + "NS" //nolint:staticcheck // SA1019: strings.Title is deprecated
+	// Construct "extRoot" + capitalize(nsName) + "NS" without allocations.
+	// Result format: "extRootNetNS", "extRootPidNS", etc.
+	nsName := configs.NsName(t)
+	out := make([]byte, 0, 32)
+	out = append(out, "extRoot"...)
+	// Capitalize the first character (this assumes it's in the a-z range).
+	if len(nsName) > 0 {
+		out = append(out, byte(unicode.ToUpper(rune(nsName[0]))))
+		out = append(out, nsName[1:]...)
+	}
+	out = append(out, "NS"...)
+
+	return string(out)
 }
 
 func (c *Container) handleCheckpointingExternalNamespaces(rpcOpts *criurpc.CriuOpts, t configs.NamespaceType) error {
@@ -238,8 +254,8 @@ func (c *Container) handleRestoringNamespaces(rpcOpts *criurpc.CriuOpts, extraFi
 			// CRIU will issue a warning for NEWUSER:
 			// criu/namespaces.c: 'join-ns with user-namespace is not fully tested and dangerous'
 			rpcOpts.JoinNs = append(rpcOpts.JoinNs, &criurpc.JoinNamespace{
-				Ns:     proto.String(configs.NsName(ns.Type)),
-				NsFile: proto.String(nsPath),
+				Ns:     mkPtr(configs.NsName(ns.Type)),
+				NsFile: mkPtr(nsPath),
 			})
 		}
 	}
@@ -266,10 +282,10 @@ func (c *Container) handleRestoringExternalNamespaces(rpcOpts *criurpc.CriuOpts,
 		return fmt.Errorf("Requested network namespace %v does not exist", nsPath)
 	}
 	inheritFd := &criurpc.InheritFd{
-		Key: proto.String(criuNsToKey(t)),
+		Key: mkPtr(criuNsToKey(t)),
 		// The offset of four is necessary because 0, 1, 2 and 3 are
 		// already used by stdin, stdout, stderr, 'criu swrk' socket.
-		Fd: proto.Int32(int32(4 + len(*extraFiles))),
+		Fd: mkPtr(int32(4 + len(*extraFiles))),
 	}
 	rpcOpts.InheritFd = append(rpcOpts.InheritFd, inheritFd)
 	// All open FDs need to be transferred to CRIU via extraFiles
@@ -317,25 +333,25 @@ func (c *Container) Checkpoint(criuOpts *CriuOpts) error {
 	defer imageDir.Close()
 
 	rpcOpts := criurpc.CriuOpts{
-		ImagesDirFd:       proto.Int32(int32(imageDir.Fd())),
-		LogLevel:          proto.Int32(4),
-		LogFile:           proto.String(logFile),
-		Root:              proto.String(c.config.Rootfs),
-		ManageCgroups:     proto.Bool(true), // Obsoleted by ManageCgroupsMode.
+		ImagesDirFd:       mkPtr(int32(imageDir.Fd())),
+		LogLevel:          mkPtr(int32(4)),
+		LogFile:           mkPtr(logFile),
+		Root:              mkPtr(c.config.Rootfs),
+		ManageCgroups:     mkPtr(true), // Obsoleted by ManageCgroupsMode.
 		ManageCgroupsMode: &cgMode,
-		NotifyScripts:     proto.Bool(true),
-		Pid:               proto.Int32(int32(c.initProcess.pid())),
-		ShellJob:          proto.Bool(criuOpts.ShellJob),
-		LeaveRunning:      proto.Bool(criuOpts.LeaveRunning),
-		TcpEstablished:    proto.Bool(criuOpts.TcpEstablished),
-		TcpSkipInFlight:   proto.Bool(criuOpts.TcpSkipInFlight),
-		LinkRemap:         proto.Bool(criuOpts.LinkRemap),
-		ExtUnixSk:         proto.Bool(criuOpts.ExternalUnixConnections),
-		FileLocks:         proto.Bool(criuOpts.FileLocks),
-		EmptyNs:           proto.Uint32(criuOpts.EmptyNs),
-		OrphanPtsMaster:   proto.Bool(true),
-		AutoDedup:         proto.Bool(criuOpts.AutoDedup),
-		LazyPages:         proto.Bool(criuOpts.LazyPages),
+		NotifyScripts:     mkPtr(true),
+		Pid:               mkPtr(int32(c.initProcess.pid())),
+		ShellJob:          mkPtr(criuOpts.ShellJob),
+		LeaveRunning:      mkPtr(criuOpts.LeaveRunning),
+		TcpEstablished:    mkPtr(criuOpts.TcpEstablished),
+		TcpSkipInFlight:   mkPtr(criuOpts.TcpSkipInFlight),
+		LinkRemap:         mkPtr(criuOpts.LinkRemap),
+		ExtUnixSk:         mkPtr(criuOpts.ExternalUnixConnections),
+		FileLocks:         mkPtr(criuOpts.FileLocks),
+		EmptyNs:           mkPtr(criuOpts.EmptyNs),
+		OrphanPtsMaster:   mkPtr(true),
+		AutoDedup:         mkPtr(criuOpts.AutoDedup),
+		LazyPages:         mkPtr(criuOpts.LazyPages),
 	}
 
 	// if criuOpts.WorkDirectory is not set, criu default is used.
@@ -348,7 +364,7 @@ func (c *Container) Checkpoint(criuOpts *CriuOpts) error {
 			return err
 		}
 		defer workDir.Close()
-		rpcOpts.WorkDirFd = proto.Int32(int32(workDir.Fd()))
+		rpcOpts.WorkDirFd = mkPtr(int32(workDir.Fd()))
 		logDir = criuOpts.WorkDirectory
 	}
 
@@ -374,28 +390,28 @@ func (c *Container) Checkpoint(criuOpts *CriuOpts) error {
 	// Note cgroup v2 freezer is only supported since CRIU release 3.14.
 	if !cgroups.IsCgroup2UnifiedMode() || c.checkCriuVersion(31400) == nil {
 		if fcg := c.cgroupManager.Path("freezer"); fcg != "" {
-			rpcOpts.FreezeCgroup = proto.String(fcg)
+			rpcOpts.FreezeCgroup = mkPtr(fcg)
 		}
 	}
 
 	// append optional criu opts, e.g., page-server and port
 	if criuOpts.PageServer.Address != "" && criuOpts.PageServer.Port != 0 {
 		rpcOpts.Ps = &criurpc.CriuPageServerInfo{
-			Address: proto.String(criuOpts.PageServer.Address),
-			Port:    proto.Int32(criuOpts.PageServer.Port),
+			Address: mkPtr(criuOpts.PageServer.Address),
+			Port:    mkPtr(criuOpts.PageServer.Port),
 		}
 	}
 
 	// pre-dump may need parentImage param to complete iterative migration
 	if criuOpts.ParentImage != "" {
-		rpcOpts.ParentImg = proto.String(criuOpts.ParentImage)
-		rpcOpts.TrackMem = proto.Bool(true)
+		rpcOpts.ParentImg = mkPtr(criuOpts.ParentImage)
+		rpcOpts.TrackMem = mkPtr(true)
 	}
 
 	var t criurpc.CriuReqType
 	if criuOpts.PreDump {
 		feat := criurpc.CriuFeatures{
-			MemTrack: proto.Bool(true),
+			MemTrack: mkPtr(true),
 		}
 
 		if err := c.checkCriuFeatures(criuOpts, &feat); err != nil {
@@ -410,7 +426,7 @@ func (c *Container) Checkpoint(criuOpts *CriuOpts) error {
 	if criuOpts.LazyPages {
 		// lazy migration requested; check if criu supports it
 		feat := criurpc.CriuFeatures{
-			LazyPages: proto.Bool(true),
+			LazyPages: mkPtr(true),
 		}
 		if err := c.checkCriuFeatures(criuOpts, &feat); err != nil {
 			return err
@@ -430,7 +446,7 @@ func (c *Container) Checkpoint(criuOpts *CriuOpts) error {
 			if c.checkCriuVersion(31500) != nil {
 				// For criu 3.15+, use notifications (see case "status-ready"
 				// in criuNotifications). Otherwise, rely on criu status fd.
-				rpcOpts.StatusFd = proto.Int32(int32(fd))
+				rpcOpts.StatusFd = mkPtr(int32(fd))
 			}
 		}
 	}
@@ -498,8 +514,8 @@ func (c *Container) addCriuRestoreMount(req *criurpc.CriuReq, m *configs.Mount)
 		mountDest = dest[len(c.config.Rootfs):]
 	}
 	extMnt := &criurpc.ExtMountMap{
-		Key: proto.String(mountDest),
-		Val: proto.String(m.Source),
+		Key: mkPtr(mountDest),
+		Val: mkPtr(m.Source),
 	}
 	req.Opts.ExtMnt = append(req.Opts.ExtMnt, extMnt)
 }
@@ -509,8 +525,8 @@ func (c *Container) restoreNetwork(req *criurpc.CriuReq, criuOpts *CriuOpts) {
 		switch iface.Type {
 		case "veth":
 			veth := new(criurpc.CriuVethPair)
-			veth.IfOut = proto.String(iface.HostInterfaceName)
-			veth.IfIn = proto.String(iface.Name)
+			veth.IfOut = mkPtr(iface.HostInterfaceName)
+			veth.IfIn = mkPtr(iface.Name)
 			req.Opts.Veths = append(req.Opts.Veths, veth)
 		case "loopback":
 			// Do nothing
@@ -518,8 +534,8 @@ func (c *Container) restoreNetwork(req *criurpc.CriuReq, criuOpts *CriuOpts) {
 	}
 	for _, i := range criuOpts.VethPairs {
 		veth := new(criurpc.CriuVethPair)
-		veth.IfOut = proto.String(i.HostInterfaceName)
-		veth.IfIn = proto.String(i.ContainerInterfaceName)
+		veth.IfOut = mkPtr(i.HostInterfaceName)
+		veth.IfIn = mkPtr(i.ContainerInterfaceName)
 		req.Opts.Veths = append(req.Opts.Veths, veth)
 	}
 }
@@ -540,10 +556,16 @@ func isOnTmpfs(path string, mounts []*configs.Mount) bool {
 // This function also creates missing mountpoints as long as they
 // are not on top of a tmpfs, as CRIU will restore tmpfs content anyway.
 func (c *Container) prepareCriuRestoreMounts(mounts []*configs.Mount) error {
+	rootFd, err := os.OpenFile(c.config.Rootfs, unix.O_DIRECTORY|unix.O_CLOEXEC|unix.O_PATH, 0)
+	if err != nil {
+		return fmt.Errorf("open rootfs handle: %w", err)
+	}
+	defer rootFd.Close()
+
 	umounts := []string{}
 	defer func() {
 		for _, u := range umounts {
-			mntFile, err := pathrs.OpenInRoot(c.config.Rootfs, u, unix.O_PATH)
+			mntFile, err := pathrs.OpenInRoot(rootFd, u, unix.O_PATH)
 			if err != nil {
 				logrus.Warnf("Error during cleanup unmounting %s: open handle: %v", u, err)
 				continue
@@ -577,7 +599,7 @@ func (c *Container) prepareCriuRestoreMounts(mounts []*configs.Mount) error {
 			continue
 		}
 		me := mountEntry{Mount: m}
-		if err := me.createOpenMountpoint(c.config.Rootfs); err != nil {
+		if err := me.createOpenMountpoint(rootFd); err != nil {
 			return fmt.Errorf("create criu restore mountpoint for %s mount: %w", me.Destination, err)
 		}
 		if me.dstFile != nil {
@@ -667,23 +689,23 @@ func (c *Container) Restore(process *Process, criuOpts *CriuOpts) error {
 	req := &criurpc.CriuReq{
 		Type: &t,
 		Opts: &criurpc.CriuOpts{
-			ImagesDirFd:       proto.Int32(int32(imageDir.Fd())),
-			EvasiveDevices:    proto.Bool(true),
-			LogLevel:          proto.Int32(4),
-			LogFile:           proto.String(logFile),
-			RstSibling:        proto.Bool(true),
-			Root:              proto.String(root),
-			ManageCgroups:     proto.Bool(true), // Obsoleted by ManageCgroupsMode.
+			ImagesDirFd:       mkPtr(int32(imageDir.Fd())),
+			EvasiveDevices:    mkPtr(true),
+			LogLevel:          mkPtr(int32(4)),
+			LogFile:           mkPtr(logFile),
+			RstSibling:        mkPtr(true),
+			Root:              mkPtr(root),
+			ManageCgroups:     mkPtr(true), // Obsoleted by ManageCgroupsMode.
 			ManageCgroupsMode: &cgMode,
-			NotifyScripts:     proto.Bool(true),
-			ShellJob:          proto.Bool(criuOpts.ShellJob),
-			ExtUnixSk:         proto.Bool(criuOpts.ExternalUnixConnections),
-			TcpEstablished:    proto.Bool(criuOpts.TcpEstablished),
-			FileLocks:         proto.Bool(criuOpts.FileLocks),
-			EmptyNs:           proto.Uint32(criuOpts.EmptyNs),
-			OrphanPtsMaster:   proto.Bool(true),
-			AutoDedup:         proto.Bool(criuOpts.AutoDedup),
-			LazyPages:         proto.Bool(criuOpts.LazyPages),
+			NotifyScripts:     mkPtr(true),
+			ShellJob:          mkPtr(criuOpts.ShellJob),
+			ExtUnixSk:         mkPtr(criuOpts.ExternalUnixConnections),
+			TcpEstablished:    mkPtr(criuOpts.TcpEstablished),
+			FileLocks:         mkPtr(criuOpts.FileLocks),
+			EmptyNs:           mkPtr(criuOpts.EmptyNs),
+			OrphanPtsMaster:   mkPtr(true),
+			AutoDedup:         mkPtr(criuOpts.AutoDedup),
+			LazyPages:         mkPtr(criuOpts.LazyPages),
 		},
 	}
 
@@ -693,13 +715,13 @@ func (c *Container) Restore(process *Process, criuOpts *CriuOpts) error {
 		if err := c.checkCriuVersion(31600); err != nil {
 			return errors.New("--lsm-profile requires at least CRIU 3.16")
 		}
-		req.Opts.LsmProfile = proto.String(criuOpts.LsmProfile)
+		req.Opts.LsmProfile = mkPtr(criuOpts.LsmProfile)
 	}
 	if criuOpts.LsmMountContext != "" {
 		if err := c.checkCriuVersion(31600); err != nil {
 			return errors.New("--lsm-mount-context requires at least CRIU 3.16")
 		}
-		req.Opts.LsmMountContext = proto.String(criuOpts.LsmMountContext)
+		req.Opts.LsmMountContext = mkPtr(criuOpts.LsmMountContext)
 	}
 
 	if criuOpts.WorkDirectory != "" {
@@ -713,7 +735,7 @@ func (c *Container) Restore(process *Process, criuOpts *CriuOpts) error {
 			return err
 		}
 		defer workDir.Close()
-		req.Opts.WorkDirFd = proto.Int32(int32(workDir.Fd()))
+		req.Opts.WorkDirFd = mkPtr(int32(workDir.Fd()))
 		logDir = criuOpts.WorkDirectory
 	}
 	c.handleCriuConfigurationFile(req.Opts)
@@ -776,8 +798,8 @@ func (c *Container) Restore(process *Process, criuOpts *CriuOpts) error {
 	for i := range fds {
 		if s := fds[i]; strings.Contains(s, "pipe:") {
 			inheritFd := new(criurpc.InheritFd)
-			inheritFd.Key = proto.String(s)
-			inheritFd.Fd = proto.Int32(int32(i))
+			inheritFd.Key = mkPtr(s)
+			inheritFd.Fd = mkPtr(int32(i))
 			req.Opts.InheritFd = append(req.Opts.InheritFd, inheritFd)
 		}
 	}
@@ -869,8 +891,8 @@ func (c *Container) criuApplyCgroups(pid int, req *criurpc.CriuReq) error {
 
 	for c, p := range cgroupsPaths {
 		cgroupRoot := &criurpc.CgroupRoot{
-			Ctrl: proto.String(c),
-			Path: proto.String(p),
+			Ctrl: mkPtr(c),
+			Path: mkPtr(p),
 		}
 		req.Opts.CgRoot = append(req.Opts.CgRoot, cgroupRoot)
 	}
@@ -964,7 +986,7 @@ func (c *Container) criuSwrk(process *Process, req *criurpc.CriuReq, opts *CriuO
 			}
 		}
 	}
-	data, err := proto.Marshal(req)
+	data, err := req.MarshalVT()
 	if err != nil {
 		return err
 	}
@@ -997,7 +1019,7 @@ func (c *Container) criuSwrk(process *Process, req *criurpc.CriuReq, opts *CriuO
 		}
 
 		resp := new(criurpc.CriuResp)
-		err = proto.Unmarshal(buf[:n], resp)
+		err = resp.UnmarshalVT(buf[:n])
 		if err != nil {
 			return err
 		}
@@ -1016,9 +1038,9 @@ func (c *Container) criuSwrk(process *Process, req *criurpc.CriuReq, opts *CriuO
 			}
 			req = &criurpc.CriuReq{
 				Type:          &t,
-				NotifySuccess: proto.Bool(true),
+				NotifySuccess: mkPtr(true),
 			}
-			data, err = proto.Marshal(req)
+			data, err = req.MarshalVT()
 			if err != nil {
 				return err
 			}
@@ -1174,7 +1196,7 @@ func (c *Container) criuNotifications(resp *criurpc.CriuResp, process *Process,
 		defer master.Close()
 
 		// While we can access console.master, using the API is a good idea.
-		if err := utils.SendFile(process.ConsoleSocket, master); err != nil {
+		if err := cmsg.SendFile(process.ConsoleSocket, master); err != nil {
 			return err
 		}
 	case "status-ready":
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/devices/device_deprecated.go b/vendor/github.com/opencontainers/runc/libcontainer/devices/device_deprecated.go
deleted file mode 100644
index 9483f054dc..0000000000
--- a/vendor/github.com/opencontainers/runc/libcontainer/devices/device_deprecated.go
+++ /dev/null
@@ -1,20 +0,0 @@
-package devices
-
-import "github.com/opencontainers/cgroups/devices/config"
-
-// Deprecated: use [github.com/opencontainers/cgroups/devices/config].
-const (
-	Wildcard       = config.Wildcard
-	WildcardDevice = config.WildcardDevice
-	BlockDevice    = config.BlockDevice
-	CharDevice     = config.CharDevice
-	FifoDevice     = config.FifoDevice
-)
-
-// Deprecated: use [github.com/opencontainers/cgroups/devices/config].
-type (
-	Device      = config.Device
-	Permissions = config.Permissions
-	Type        = config.Type
-	Rule        = config.Rule
-)
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/devices/device_deprecated_unix.go b/vendor/github.com/opencontainers/runc/libcontainer/devices/device_deprecated_unix.go
new file mode 100644
index 0000000000..f562b44c52
--- /dev/null
+++ b/vendor/github.com/opencontainers/runc/libcontainer/devices/device_deprecated_unix.go
@@ -0,0 +1,55 @@
+//go:build !windows
+
+// Package devices provides some helper functions for constructing device
+// configurations for runc. These are exclusively used by higher-level runtimes
+// that need to configure runc's device list based on existing devices.
+//
+// Deprecated: Use github.com/moby/sys/devices instead. This package will be
+// removed in runc 1.6.
+package devices
+
+import (
+	"github.com/moby/sys/devices"
+	"github.com/opencontainers/cgroups/devices/config"
+)
+
+// ErrNotADevice denotes that a file is not a valid linux device.
+//
+// Deprecated: Use [devices.ErrNotADevice] instead. This package will be
+// removed in runc 1.6.
+//
+//go:fix inline
+var ErrNotADevice = devices.ErrNotADevice
+
+// DeviceFromPath takes the path to a device and its cgroup_permissions (which
+// cannot be easily queried) to look up the information about a linux device
+// and returns that information as a Device struct.
+//
+// Deprecated: Use [devices.DeviceFromPath] instead. This package will be
+// removed in runc 1.6.
+//
+//go:fix inline
+func DeviceFromPath(path, permissions string) (*config.Device, error) {
+	return devices.DeviceFromPath(path, permissions)
+}
+
+// HostDevices returns all devices that can be found under /dev directory.
+//
+// Deprecated: Use [devices.HostDevices] instead. This package will be
+// removed in runc 1.6.
+//
+//go:fix inline
+func HostDevices() ([]*config.Device, error) {
+	return devices.HostDevices()
+}
+
+// GetDevices recursively traverses a directory specified by path
+// and returns all devices found there.
+//
+// Deprecated: Use [devices.GetDevices] instead. This package will be
+// removed in runc 1.6.
+//
+//go:fix inline
+func GetDevices(path string) ([]*config.Device, error) {
+	return devices.GetDevices(path)
+}
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/exeseal/doc.go b/vendor/github.com/opencontainers/runc/libcontainer/exeseal/doc.go
new file mode 100644
index 0000000000..56fe697a64
--- /dev/null
+++ b/vendor/github.com/opencontainers/runc/libcontainer/exeseal/doc.go
@@ -0,0 +1,3 @@
+// Package exeseal provides mechanisms for sealing /proc/self/exe and thus
+// protecting the runc binary against CVE-2019-5736-style attacks.
+package exeseal
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/init_linux.go b/vendor/github.com/opencontainers/runc/libcontainer/init_linux.go
index 632d7c3491..6dad311433 100644
--- a/vendor/github.com/opencontainers/runc/libcontainer/init_linux.go
+++ b/vendor/github.com/opencontainers/runc/libcontainer/init_linux.go
@@ -21,6 +21,7 @@ import (
 	"golang.org/x/sys/unix"
 
 	"github.com/opencontainers/cgroups"
+	"github.com/opencontainers/runc/internal/cmsg"
 	"github.com/opencontainers/runc/internal/linux"
 	"github.com/opencontainers/runc/internal/pathrs"
 	"github.com/opencontainers/runc/libcontainer/capabilities"
@@ -406,7 +407,7 @@ func setupConsole(socket *os.File, config *initConfig, mount bool) error {
 		}
 	}
 	// While we can access console.master, using the API is a good idea.
-	if err := utils.SendRawFd(socket, pty.Name(), pty.Fd()); err != nil {
+	if err := cmsg.SendRawFd(socket, pty.Name(), pty.Fd()); err != nil {
 		return err
 	}
 	runtime.KeepAlive(pty)
@@ -728,7 +729,7 @@ func setupPidfd(socket *os.File, initType string) error {
 		return fmt.Errorf("failed to pidfd_open: %w", err)
 	}
 
-	if err := utils.SendRawFd(socket, initType, uintptr(pidFd)); err != nil {
+	if err := cmsg.SendRawFd(socket, initType, uintptr(pidFd)); err != nil {
 		unix.Close(pidFd)
 		return fmt.Errorf("failed to send pidfd on socket: %w", err)
 	}
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/intelrdt/intelrdt.go b/vendor/github.com/opencontainers/runc/libcontainer/intelrdt/intelrdt.go
index 3dcd71b7e0..40e738b031 100644
--- a/vendor/github.com/opencontainers/runc/libcontainer/intelrdt/intelrdt.go
+++ b/vendor/github.com/opencontainers/runc/libcontainer/intelrdt/intelrdt.go
@@ -147,10 +147,11 @@ import (
  */
 
 type Manager struct {
-	mu     sync.Mutex
-	config *configs.Config
-	id     string
-	path   string
+	mu               sync.Mutex
+	config           *configs.Config
+	id               string
+	path             string
+	shouldCleanupDir bool
 }
 
 // NewManager returns a new instance of Manager, or nil if the Intel RDT
@@ -460,7 +461,10 @@ func (m *Manager) Apply(pid int) (err error) {
 		}
 	}
 
-	if err := os.Mkdir(path, 0o755); err != nil && !errors.Is(err, os.ErrExist) {
+	if err := os.Mkdir(path, 0o755); err == nil || errors.Is(err, os.ErrExist) {
+		// Only clean up the directory if we actually created it.
+		m.shouldCleanupDir = err == nil
+	} else {
 		return newLastCmdError(err)
 	}
 
@@ -489,8 +493,9 @@ func (m *Manager) Destroy() error {
 	}
 	// Don't remove resctrl group if closid has been explicitly specified. The
 	// group is likely externally managed, i.e. by some other entity than us.
-	// There are probably other containers/tasks sharing the same group.
-	if m.config.IntelRdt.ClosID == "" {
+	// There are probably other containers/tasks sharing the same group. Also
+	// only remove the directory if it was created by us.
+	if m.config.IntelRdt.ClosID == "" && m.shouldCleanupDir {
 		m.mu.Lock()
 		defer m.mu.Unlock()
 		if err := os.Remove(m.GetPath()); err != nil && !errors.Is(err, os.ErrNotExist) {
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/internal/userns/doc.go b/vendor/github.com/opencontainers/runc/libcontainer/internal/userns/doc.go
new file mode 100644
index 0000000000..431d65cd5a
--- /dev/null
+++ b/vendor/github.com/opencontainers/runc/libcontainer/internal/userns/doc.go
@@ -0,0 +1,2 @@
+// Package userns provides helpers for interacting with Linux user namespaces.
+package userns
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/internal/userns/usernsfd_linux.go b/vendor/github.com/opencontainers/runc/libcontainer/internal/userns/usernsfd_linux.go
index a1151a3fb3..35ac373cd4 100644
--- a/vendor/github.com/opencontainers/runc/libcontainer/internal/userns/usernsfd_linux.go
+++ b/vendor/github.com/opencontainers/runc/libcontainer/internal/userns/usernsfd_linux.go
@@ -41,10 +41,11 @@ func (m Mapping) toSys() (uids, gids []syscall.SysProcIDMap) {
 // the uid and gid mappings (because the order doesn't matter to the kernel).
 // The set of userns handles is indexed using this ID.
 func (m Mapping) id() string {
-	var uids, gids []string
+	uids := make([]string, 0, len(m.UIDMappings))
 	for _, idmap := range m.UIDMappings {
 		uids = append(uids, fmt.Sprintf("%d:%d:%d", idmap.ContainerID, idmap.HostID, idmap.Size))
 	}
+	gids := make([]string, 0, len(m.GIDMappings))
 	for _, idmap := range m.GIDMappings {
 		gids = append(gids, fmt.Sprintf("%d:%d:%d", idmap.ContainerID, idmap.HostID, idmap.Size))
 	}
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/keys/keyctl.go b/vendor/github.com/opencontainers/runc/libcontainer/keys/keyctl.go
index f3a6c5343f..ea3ee9f97f 100644
--- a/vendor/github.com/opencontainers/runc/libcontainer/keys/keyctl.go
+++ b/vendor/github.com/opencontainers/runc/libcontainer/keys/keyctl.go
@@ -1,3 +1,4 @@
+// Package keys provides helpers for Linux keyrings.
 package keys
 
 import (
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/logs/logs.go b/vendor/github.com/opencontainers/runc/libcontainer/logs/logs.go
index 8594e1fec5..8cb2ff9aa8 100644
--- a/vendor/github.com/opencontainers/runc/libcontainer/logs/logs.go
+++ b/vendor/github.com/opencontainers/runc/libcontainer/logs/logs.go
@@ -1,3 +1,5 @@
+// Package logs provides helpers for logging used within runc (specifically for
+// forwarding logs from "runc init" to the main runc process).
 package logs
 
 import (
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/process.go b/vendor/github.com/opencontainers/runc/libcontainer/process.go
index 7fca1febce..25cabbe13e 100644
--- a/vendor/github.com/opencontainers/runc/libcontainer/process.go
+++ b/vendor/github.com/opencontainers/runc/libcontainer/process.go
@@ -127,7 +127,7 @@ type Process struct {
 
 // Wait waits for the process to exit.
 // Wait releases any resources associated with the Process
-func (p Process) Wait() (*os.ProcessState, error) {
+func (p *Process) Wait() (*os.ProcessState, error) {
 	if p.ops == nil {
 		return nil, errInvalidProcess
 	}
@@ -135,7 +135,7 @@ func (p Process) Wait() (*os.ProcessState, error) {
 }
 
 // Pid returns the process ID
-func (p Process) Pid() (int, error) {
+func (p *Process) Pid() (int, error) {
 	// math.MinInt32 is returned here, because it's invalid value
 	// for the kill() system call.
 	if p.ops == nil {
@@ -145,7 +145,7 @@ func (p Process) Pid() (int, error) {
 }
 
 // Signal sends a signal to the Process.
-func (p Process) Signal(sig os.Signal) error {
+func (p *Process) Signal(sig os.Signal) error {
 	if p.ops == nil {
 		return errInvalidProcess
 	}
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/process_linux.go b/vendor/github.com/opencontainers/runc/libcontainer/process_linux.go
index d9c441ec58..f7722535af 100644
--- a/vendor/github.com/opencontainers/runc/libcontainer/process_linux.go
+++ b/vendor/github.com/opencontainers/runc/libcontainer/process_linux.go
@@ -16,7 +16,6 @@ import (
 	"runtime"
 	"strconv"
 	"strings"
-	"sync"
 	"syscall"
 	"time"
 
@@ -27,6 +26,7 @@ import (
 
 	"github.com/opencontainers/cgroups"
 	"github.com/opencontainers/cgroups/fs2"
+	"github.com/opencontainers/runc/internal/cmsg"
 	"github.com/opencontainers/runc/internal/linux"
 	"github.com/opencontainers/runc/libcontainer/configs"
 	"github.com/opencontainers/runc/libcontainer/intelrdt"
@@ -689,6 +689,8 @@ func (p *initProcess) goCreateMountSources(ctx context.Context) (mountSourceRequ
 	responseCh := make(chan response)
 
 	ctx, cancelFn := context.WithTimeout(ctx, 1*time.Minute)
+	context.AfterFunc(ctx, func() { close(requestCh) })
+
 	go func() {
 		// We lock this thread because we need to setns(2) here. There is no
 		// UnlockOSThread() here, to ensure that the Go runtime will kill this
@@ -751,8 +753,6 @@ func (p *initProcess) goCreateMountSources(ctx context.Context) (mountSourceRequ
 		return nil, nil, err
 	}
 
-	// TODO: Switch to context.AfterFunc when we switch to Go 1.21.
-	var requestChCloseOnce sync.Once
 	requestFn := func(m *configs.Mount) (*mountSource, error) {
 		var err error
 		select {
@@ -762,13 +762,13 @@ func (p *initProcess) goCreateMountSources(ctx context.Context) (mountSourceRequ
 				if ok {
 					return resp.src, resp.err
 				}
+				err = fmt.Errorf("response channel closed unexpectedly")
 			case <-ctx.Done():
 				err = fmt.Errorf("receive mount source context cancelled: %w", ctx.Err())
 			}
 		case <-ctx.Done():
 			err = fmt.Errorf("send mount request cancelled: %w", ctx.Err())
 		}
-		requestChCloseOnce.Do(func() { close(requestCh) })
 		return nil, err
 	}
 	return requestFn, cancelFn, nil
@@ -1133,7 +1133,7 @@ func sendContainerProcessState(listenerPath string, state *specs.ContainerProces
 		return fmt.Errorf("cannot marshall seccomp state: %w", err)
 	}
 
-	if err := utils.SendRawFd(socket, string(b), file.Fd()); err != nil {
+	if err := cmsg.SendRawFd(socket, string(b), file.Fd()); err != nil {
 		return fmt.Errorf("cannot send seccomp fd to %s: %w", listenerPath, err)
 	}
 	runtime.KeepAlive(file)
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/rootfs_linux.go b/vendor/github.com/opencontainers/runc/libcontainer/rootfs_linux.go
index 7aaa70d109..1d65c871ba 100644
--- a/vendor/github.com/opencontainers/runc/libcontainer/rootfs_linux.go
+++ b/vendor/github.com/opencontainers/runc/libcontainer/rootfs_linux.go
@@ -35,7 +35,7 @@ const defaultMountFlags = unix.MS_NOEXEC | unix.MS_NOSUID | unix.MS_NODEV
 
 // mountConfig contains mount data not specific to a mount point.
 type mountConfig struct {
-	root            string
+	root            *os.File
 	label           string
 	cgroup2Path     string
 	rootlessCgroups bool
@@ -97,6 +97,19 @@ func needsSetupDev(config *configs.Config) bool {
 	return true
 }
 
+func doSetupDev(rootFd *os.File, config *configs.Config) error {
+	if err := createDevices(rootFd, config); err != nil {
+		return fmt.Errorf("error creating device nodes: %w", err)
+	}
+	if err := setupPtmx(rootFd); err != nil {
+		return fmt.Errorf("error setting up ptmx: %w", err)
+	}
+	if err := setupDevSymlinks(rootFd); err != nil {
+		return fmt.Errorf("error setting up /dev symlinks: %w", err)
+	}
+	return nil
+}
+
 // setupAndMountToRootfs sets up the mount for a single mount point and mounts it to the rootfs.
 func setupAndMountToRootfs(pipe *syncSocket, config *configs.Config, mountConfig *mountConfig, m *configs.Mount) error {
 	entry := mountEntry{Mount: m}
@@ -160,8 +173,17 @@ func prepareRootfs(pipe *syncSocket, iConfig *initConfig) (err error) {
 		return fmt.Errorf("error preparing rootfs: %w", err)
 	}
 
+	// Pre-open rootfs. NOTE that if we need to re-enable support for mounting
+	// on top of container root (see issue 5070), we will need to reopen rootFd
+	// after such mounts.
+	rootFd, err := os.OpenFile(config.Rootfs, unix.O_DIRECTORY|unix.O_CLOEXEC|unix.O_PATH, 0)
+	if err != nil {
+		return fmt.Errorf("open rootfs handle: %w", err)
+	}
+	defer rootFd.Close()
+
 	mountConfig := &mountConfig{
-		root:            config.Rootfs,
+		root:            rootFd,
 		label:           config.MountLabel,
 		cgroup2Path:     iConfig.Cgroup2Path,
 		rootlessCgroups: config.RootlessCgroups,
@@ -175,14 +197,8 @@ func prepareRootfs(pipe *syncSocket, iConfig *initConfig) (err error) {
 
 	setupDev := needsSetupDev(config)
 	if setupDev {
-		if err := createDevices(config); err != nil {
-			return fmt.Errorf("error creating device nodes: %w", err)
-		}
-		if err := setupPtmx(config); err != nil {
-			return fmt.Errorf("error setting up ptmx: %w", err)
-		}
-		if err := setupDevSymlinks(config.Rootfs); err != nil {
-			return fmt.Errorf("error setting up /dev symlinks: %w", err)
+		if err := doSetupDev(rootFd, config); err != nil {
+			return fmt.Errorf("configuring container /dev: %w", err)
 		}
 	}
 
@@ -203,7 +219,7 @@ func prepareRootfs(pipe *syncSocket, iConfig *initConfig) (err error) {
 	// container. It's just cleaner to do this here (at the expense of the
 	// operation not being perfectly split).
 
-	if err := unix.Chdir(config.Rootfs); err != nil {
+	if err := unix.Fchdir(int(rootFd.Fd())); err != nil {
 		return &os.PathError{Op: "chdir", Path: config.Rootfs, Err: err}
 	}
 
@@ -218,13 +234,14 @@ func prepareRootfs(pipe *syncSocket, iConfig *initConfig) (err error) {
 	if config.NoPivotRoot {
 		err = msMoveRoot(config.Rootfs)
 	} else if config.Namespaces.Contains(configs.NEWNS) {
-		err = pivotRoot(config.Rootfs)
+		err = pivotRoot(rootFd)
 	} else {
 		err = chroot()
 	}
 	if err != nil {
 		return fmt.Errorf("error jailing process inside rootfs: %w", err)
 	}
+	rootFd.Close()
 
 	// Apply root mount propagation flags.
 	// This must be done after pivot_root/chroot because the mount propagation flag is applied
@@ -336,10 +353,8 @@ func mountCgroupV1(m mountEntry, c *mountConfig) error {
 			// We just created the tmpfs, and so we can just use filepath.Join
 			// here (not to mention we want to make sure we create the path
 			// inside the tmpfs, so we don't want to resolve symlinks).
-			// TODO: Why not just use b.Destination (c.root is the root here)?
-			subsystemPath := filepath.Join(c.root, b.Destination)
 			subsystemName := filepath.Base(b.Destination)
-			subsystemDir, err := pathrs.MkdirAllInRoot(c.root, subsystemPath, 0o755)
+			subsystemDir, err := pathrs.MkdirAllInRoot(c.root, b.Destination, 0o755)
 			if err != nil {
 				return err
 			}
@@ -372,7 +387,8 @@ func mountCgroupV1(m mountEntry, c *mountConfig) error {
 			// symlink(2) is very dumb, it will just shove the path into
 			// the link and doesn't do any checks or relative path
 			// conversion. Also, don't error out if the cgroup already exists.
-			if err := os.Symlink(mc, filepath.Join(c.root, m.Destination, ss)); err != nil && !errors.Is(err, os.ErrExist) {
+			ssPath := filepath.Join(m.Destination, ss)
+			if err := pathrs.SymlinkInRoot(mc, c.root, ssPath); err != nil && !errors.Is(err, os.ErrExist) {
 				return err
 			}
 		}
@@ -411,7 +427,7 @@ func mountCgroupV2(m mountEntry, c *mountConfig) error {
 		// Mask `/sys/fs/cgroup` to ensure it is read-only, even when `/sys` is mounted
 		// with `rbind,ro` (`runc spec --rootless` produces `rbind,ro` for `/sys`).
 		err = utils.WithProcfdFile(m.dstFile, func(procfd string) error {
-			return maskPaths([]string{procfd}, c.label)
+			return maskDir(procfd, c.label)
 		})
 	}
 	return err
@@ -436,15 +452,22 @@ func doTmpfsCopyUp(m mountEntry, mountLabel string) (Err error) {
 	}
 	defer tmpDirFile.Close()
 
+	hostRootFd, err := os.OpenFile("/", unix.O_DIRECTORY|unix.O_CLOEXEC|unix.O_PATH, 0)
+	if err != nil {
+		return fmt.Errorf("tmpcopyup: open host root: %w", err)
+	}
+	defer hostRootFd.Close()
+
 	// Configure the *host* tmpdir as if it's the container mount. We change
 	// m.dstFile since we are going to mount *on the host*.
 	hostMount := mountEntry{
 		Mount:   m.Mount,
 		dstFile: tmpDirFile,
 	}
-	if err := hostMount.mountPropagate("/", mountLabel); err != nil {
+	if err := hostMount.mountPropagate(hostRootFd, mountLabel); err != nil {
 		return err
 	}
+	hostRootFd.Close()
 	defer func() {
 		if Err != nil {
 			if err := unmount(tmpDir, unix.MNT_DETACH); err != nil {
@@ -513,9 +536,10 @@ func statfsToMountFlags(st unix.Statfs_t) int {
 	return flags
 }
 
-func (m *mountEntry) createOpenMountpoint(rootfs string) (Err error) {
+func (m *mountEntry) createOpenMountpoint(root *os.File) (Err error) {
+	rootfs := root.Name()
 	unsafePath := pathrs.LexicallyStripRoot(rootfs, m.Destination)
-	dstFile, err := pathrs.OpenInRoot(rootfs, unsafePath, unix.O_PATH)
+	dstFile, err := pathrs.OpenInRoot(root, unsafePath, unix.O_PATH)
 	defer func() {
 		if dstFile != nil && Err != nil {
 			_ = dstFile.Close()
@@ -552,9 +576,9 @@ func (m *mountEntry) createOpenMountpoint(rootfs string) (Err error) {
 			dstIsFile = !fi.IsDir()
 		}
 		if dstIsFile {
-			dstFile, err = pathrs.CreateInRoot(rootfs, unsafePath, unix.O_CREAT|unix.O_EXCL|unix.O_NOFOLLOW, 0o644)
+			dstFile, err = pathrs.CreateInRoot(root, unsafePath, unix.O_CREAT|unix.O_EXCL|unix.O_NOFOLLOW, 0o644)
 		} else {
-			dstFile, err = pathrs.MkdirAllInRoot(rootfs, unsafePath, 0o755)
+			dstFile, err = pathrs.MkdirAllInRoot(root, unsafePath, 0o755)
 		}
 		if err != nil {
 			return fmt.Errorf("make mountpoint %q: %w", m.Destination, err)
@@ -584,7 +608,6 @@ func (m *mountEntry) createOpenMountpoint(rootfs string) (Err error) {
 }
 
 func mountToRootfs(c *mountConfig, m mountEntry) error {
-	rootfs := c.root
 	defer func() {
 		if m.dstFile != nil {
 			_ = m.dstFile.Close()
@@ -601,6 +624,7 @@ func mountToRootfs(c *mountConfig, m mountEntry) error {
 		// has been a "fun" attack scenario in the past.
 		// TODO: This won't be necessary once we switch to libpathrs and we can
 		//       stop all of these symlink-exchange attacks.
+		rootfs := c.root.Name()
 		dest := filepath.Clean(m.Destination)
 		if !pathrs.IsLexicallyInRoot(rootfs, dest) {
 			// Do not use securejoin as it resolves symlinks.
@@ -616,7 +640,7 @@ func mountToRootfs(c *mountConfig, m mountEntry) error {
 		} else if !fi.IsDir() {
 			return fmt.Errorf("filesystem %q must be mounted on ordinary directory", m.Device)
 		}
-		dstFile, err := pathrs.MkdirAllInRoot(rootfs, dest, 0o755)
+		dstFile, err := pathrs.MkdirAllInRoot(c.root, dest, 0o755)
 		if err != nil {
 			return err
 		}
@@ -624,17 +648,17 @@ func mountToRootfs(c *mountConfig, m mountEntry) error {
 		// "proc" and "sys" mounts need special handling (without resolving the
 		// destination) to avoid attacks.
 		m.dstFile = dstFile
-		return m.mountPropagate(rootfs, "")
+		return m.mountPropagate(c.root, "")
 	}
 
 	mountLabel := c.label
-	if err := m.createOpenMountpoint(rootfs); err != nil {
+	if err := m.createOpenMountpoint(c.root); err != nil {
 		return fmt.Errorf("create mountpoint for %s mount: %w", m.Destination, err)
 	}
 
 	switch m.Device {
 	case "mqueue":
-		if err := m.mountPropagate(rootfs, ""); err != nil {
+		if err := m.mountPropagate(c.root, ""); err != nil {
 			return err
 		}
 		return utils.WithProcfdFile(m.dstFile, func(dstFd string) error {
@@ -645,12 +669,12 @@ func mountToRootfs(c *mountConfig, m mountEntry) error {
 		if m.Extensions&configs.EXT_COPYUP == configs.EXT_COPYUP {
 			err = doTmpfsCopyUp(m, mountLabel)
 		} else {
-			err = m.mountPropagate(rootfs, mountLabel)
+			err = m.mountPropagate(c.root, mountLabel)
 		}
 		return err
 	case "bind":
 		// open_tree()-related shenanigans are all handled in mountViaFds.
-		if err := m.mountPropagate(rootfs, mountLabel); err != nil {
+		if err := m.mountPropagate(c.root, mountLabel); err != nil {
 			return err
 		}
 
@@ -755,16 +779,6 @@ func mountToRootfs(c *mountConfig, m mountEntry) error {
 				return fmt.Errorf("failed to set user-requested vfs flags on bind-mount: %w", err)
 			}
 		}
-
-		if m.Relabel != "" {
-			if err := label.Validate(m.Relabel); err != nil {
-				return err
-			}
-			shared := label.IsShared(m.Relabel)
-			if err := label.Relabel(m.Source, mountLabel, shared); err != nil {
-				return err
-			}
-		}
 		return setRecAttr(m)
 	case "cgroup":
 		if cgroups.IsCgroup2UnifiedMode() {
@@ -772,7 +786,7 @@ func mountToRootfs(c *mountConfig, m mountEntry) error {
 		}
 		return mountCgroupV1(m, c)
 	default:
-		return m.mountPropagate(rootfs, mountLabel)
+		return m.mountPropagate(c.root, mountLabel)
 	}
 }
 
@@ -887,7 +901,7 @@ func checkProcMount(rootfs, dest string, m mountEntry) error {
 	return fmt.Errorf("%q cannot be mounted because it is inside /proc", dest)
 }
 
-func setupDevSymlinks(rootfs string) error {
+func setupDevSymlinks(rootFd *os.File) error {
 	// In theory, these should be links to /proc/thread-self, but systems
 	// expect these to be /proc/self and this matches how most distributions
 	// work.
@@ -903,11 +917,8 @@ func setupDevSymlinks(rootfs string) error {
 		links = append(links, [2]string{"/proc/kcore", "/dev/core"})
 	}
 	for _, link := range links {
-		var (
-			src = link[0]
-			dst = filepath.Join(rootfs, link[1])
-		)
-		if err := os.Symlink(src, dst); err != nil && !errors.Is(err, os.ErrExist) {
+		target, devName := link[0], link[1]
+		if err := pathrs.SymlinkInRoot(target, rootFd, devName); err != nil && !errors.Is(err, os.ErrExist) {
 			return err
 		}
 	}
@@ -943,7 +954,7 @@ func reOpenDevNull() error {
 }
 
 // Create the device nodes in the container.
-func createDevices(config *configs.Config) error {
+func createDevices(rootFd *os.File, config *configs.Config) error {
 	useBindMount := userns.RunningInUserNS() || config.Namespaces.Contains(configs.NEWUSER)
 	for _, node := range config.Devices {
 
@@ -954,7 +965,7 @@ func createDevices(config *configs.Config) error {
 
 		// containers running in a user namespace are not allowed to mknod
 		// devices so we can just bind mount it from the host.
-		if err := createDeviceNode(config.Rootfs, node, useBindMount); err != nil {
+		if err := createDeviceNode(rootFd, node, useBindMount); err != nil {
 			return err
 		}
 	}
@@ -974,12 +985,12 @@ func bindMountDeviceNode(destDir *os.File, destName string, node *devices.Device
 }
 
 // Creates the device node in the rootfs of the container.
-func createDeviceNode(rootfs string, node *devices.Device, bind bool) error {
+func createDeviceNode(rootFd *os.File, node *devices.Device, bind bool) error {
 	if node.Path == "" {
 		// The node only exists for cgroup reasons, ignore it here.
 		return nil
 	}
-	destDir, destName, err := pathrs.MkdirAllParentInRoot(rootfs, node.Path, 0o755)
+	destDir, destName, err := pathrs.MkdirAllParentInRoot(rootFd, node.Path, 0o755)
 	if err != nil {
 		return fmt.Errorf("mkdir parent of device inode %q: %w", node.Path, err)
 	}
@@ -1115,41 +1126,31 @@ func setReadonly() error {
 	return mount("", "/", "", flags, "")
 }
 
-func setupPtmx(config *configs.Config) error {
-	ptmx := filepath.Join(config.Rootfs, "dev/ptmx")
-	if err := os.Remove(ptmx); err != nil && !errors.Is(err, os.ErrNotExist) {
+func setupPtmx(rootFd *os.File) error {
+	if err := pathrs.UnlinkInRoot(rootFd, "/dev/ptmx", 0); err != nil && !errors.Is(err, os.ErrNotExist) {
 		return err
 	}
-	if err := os.Symlink("pts/ptmx", ptmx); err != nil {
-		return err
-	}
-	return nil
+	return pathrs.SymlinkInRoot("pts/ptmx", rootFd, "/dev/ptmx")
 }
 
 // pivotRoot will call pivot_root such that rootfs becomes the new root
 // filesystem, and everything else is cleaned up.
-func pivotRoot(rootfs string) error {
+func pivotRoot(root *os.File) error {
 	// While the documentation may claim otherwise, pivot_root(".", ".") is
 	// actually valid. What this results in is / being the new root but
 	// /proc/self/cwd being the old root. Since we can play around with the cwd
 	// with pivot_root this allows us to pivot without creating directories in
 	// the rootfs. Shout-outs to the LXC developers for giving us this idea.
 
-	oldroot, err := linux.Open("/", unix.O_DIRECTORY|unix.O_RDONLY, 0)
+	oldroot, err := linux.Open("/", unix.O_DIRECTORY|unix.O_RDONLY|unix.O_PATH, 0)
 	if err != nil {
 		return err
 	}
 	defer unix.Close(oldroot)
 
-	newroot, err := linux.Open(rootfs, unix.O_DIRECTORY|unix.O_RDONLY, 0)
-	if err != nil {
-		return err
-	}
-	defer unix.Close(newroot)
-
 	// Change to the new root so that the pivot_root actually acts on it.
-	if err := unix.Fchdir(newroot); err != nil {
-		return &os.PathError{Op: "fchdir", Path: "fd " + strconv.Itoa(newroot), Err: err}
+	if err := unix.Fchdir(int(root.Fd())); err != nil {
+		return &os.PathError{Op: "chdir", Path: root.Name(), Err: err}
 	}
 
 	if err := unix.PivotRoot(".", "."); err != nil {
@@ -1320,12 +1321,20 @@ func verifyDevNull(f *os.File) error {
 	})
 }
 
+// maskDir mounts a read-only tmpfs on top of the specified path.
+func maskDir(path, mountLabel string) error {
+	return mount("tmpfs", path, "tmpfs", unix.MS_RDONLY, label.FormatMountLabel("nr_blocks=1,nr_inodes=1", mountLabel))
+}
+
 // maskPaths masks the top of the specified paths inside a container to avoid
 // security issues from processes reading information from non-namespace aware
 // mounts ( proc/kcore ).
 // For files, maskPath bind mounts /dev/null over the top of the specified path.
 // For directories, maskPath mounts read-only tmpfs over the top of the specified path.
-func maskPaths(paths []string, mountLabel string) error {
+func maskPaths(rootFs string, paths []string, mountLabel string) error {
+	if len(paths) == 0 {
+		return nil
+	}
 	devNull, err := os.OpenFile("/dev/null", unix.O_PATH, 0)
 	if err != nil {
 		return fmt.Errorf("can't mask paths: %w", err)
@@ -1338,6 +1347,17 @@ func maskPaths(paths []string, mountLabel string) error {
 	procSelfFd, closer := utils.ProcThreadSelf("fd/")
 	defer closer()
 
+	var (
+		sharedMaskFile *os.File
+		sharedMaskSrc  *mountSource
+		bindFailed     bool
+	)
+	defer func() {
+		if sharedMaskFile != nil {
+			_ = sharedMaskFile.Close()
+		}
+	}()
+	maskedPaths := make(map[string]struct{})
 	for _, path := range paths {
 		// Open the target path; skip if it doesn't exist.
 		dstFh, err := os.OpenFile(path, unix.O_PATH|unix.O_CLOEXEC, 0)
@@ -1352,11 +1372,48 @@ func maskPaths(paths []string, mountLabel string) error {
 			dstFh.Close()
 			return fmt.Errorf("can't mask path %q: %w", path, err)
 		}
+		// skip duplicate masked paths.
+		cleanPath := pathrs.LexicallyCleanPath(path)
+		if _, ok := maskedPaths[cleanPath]; ok {
+			dstFh.Close()
+			continue
+		}
+		maskedPaths[cleanPath] = struct{}{}
+
 		var dstType string
 		if st.IsDir() {
 			// Destination is a directory: bind mount a ro tmpfs over it.
 			dstType = "dir"
-			err = mount("tmpfs", path, "tmpfs", unix.MS_RDONLY, label.FormatMountLabel("", mountLabel))
+			if !bindFailed && sharedMaskSrc != nil {
+				dstFd := filepath.Join(procSelfFd, strconv.Itoa(int(dstFh.Fd())))
+				err = mountViaFds("", sharedMaskSrc, path, dstFd, "", unix.MS_BIND, "")
+				if err != nil {
+					// A bind-mount inherits MNT_READONLY from the source vfsmount,
+					// but if it fails fall back to individual tmpfs mounts.
+					bindFailed = true
+					logrus.WithError(err).Warn("maskPaths: shared tmpfs bind-mount failed, falling back to per-directory tmpfs")
+				}
+			}
+			if bindFailed || sharedMaskSrc == nil {
+				err = maskDir(path, mountLabel)
+				if err == nil && !bindFailed && sharedMaskSrc == nil {
+					// Establish this mount as the reusable shared source. reopenAfterMount
+					// resolves the underlying inode via procfs and re-opens it through
+					// rootFd, so the resulting fd is anchored to the real path inside the
+					// container rootfs even if path was a /proc/self/fd/N alias.
+					rootFd, err := os.OpenFile(rootFs, unix.O_DIRECTORY|unix.O_CLOEXEC|unix.O_PATH, 0)
+					if err != nil {
+						return fmt.Errorf("open rootfs handle for masked paths: %w", err)
+					}
+					reopened, err := reopenAfterMount(rootFd, dstFh, unix.O_PATH|unix.O_CLOEXEC)
+					rootFd.Close()
+					if err != nil {
+						return fmt.Errorf("can't reopen shared directory mask: %w", err)
+					}
+					sharedMaskFile = reopened
+					sharedMaskSrc = &mountSource{Type: mountSourcePlain, file: sharedMaskFile}
+				}
+			}
 		} else {
 			// Destination is a file: mount it to /dev/null.
 			dstType = "path"
@@ -1372,16 +1429,17 @@ func maskPaths(paths []string, mountLabel string) error {
 	return nil
 }
 
-func reopenAfterMount(rootfs string, f *os.File, flags int) (_ *os.File, Err error) {
+func reopenAfterMount(rootFd, f *os.File, flags int) (_ *os.File, Err error) {
 	fullPath, err := procfs.ProcSelfFdReadlink(f)
 	if err != nil {
 		return nil, fmt.Errorf("get full path: %w", err)
 	}
+	rootfs := rootFd.Name()
 	if !pathrs.IsLexicallyInRoot(rootfs, fullPath) {
 		return nil, fmt.Errorf("mountpoint %q is outside of rootfs %q", fullPath, rootfs)
 	}
 	unsafePath := pathrs.LexicallyStripRoot(rootfs, fullPath)
-	reopened, err := pathrs.OpenInRoot(rootfs, unsafePath, flags)
+	reopened, err := pathrs.OpenInRoot(rootFd, unsafePath, flags)
 	if err != nil {
 		return nil, fmt.Errorf("re-open mountpoint %q: %w", unsafePath, err)
 	}
@@ -1411,7 +1469,7 @@ func reopenAfterMount(rootfs string, f *os.File, flags int) (_ *os.File, Err err
 
 // Do the mount operation followed by additional mounts required to take care
 // of propagation flags. This will always be scoped inside the container rootfs.
-func (m *mountEntry) mountPropagate(rootfs, mountLabel string) error {
+func (m *mountEntry) mountPropagate(rootFd *os.File, mountLabel string) error {
 	var (
 		data  = label.FormatMountLabel(m.Data, mountLabel)
 		flags = m.Flags
@@ -1437,7 +1495,7 @@ func (m *mountEntry) mountPropagate(rootfs, mountLabel string) error {
 	//
 	// TODO: Use move_mount(2) on newer kernels so that this is no longer
 	// necessary on modern systems.
-	newDstFile, err := reopenAfterMount(rootfs, m.dstFile, unix.O_PATH)
+	newDstFile, err := reopenAfterMount(rootFd, m.dstFile, unix.O_PATH)
 	if err != nil {
 		return fmt.Errorf("reopen mountpoint after mount: %w", err)
 	}
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/seccomp/config.go b/vendor/github.com/opencontainers/runc/libcontainer/seccomp/config.go
index 476f51d588..5c08b4ef62 100644
--- a/vendor/github.com/opencontainers/runc/libcontainer/seccomp/config.go
+++ b/vendor/github.com/opencontainers/runc/libcontainer/seccomp/config.go
@@ -109,6 +109,7 @@ var flags = []string{
 	flagTsync,
 	string(specs.LinuxSeccompFlagSpecAllow),
 	string(specs.LinuxSeccompFlagLog),
+	string(specs.LinuxSeccompFlagWaitKillableRecv),
 }
 
 // KnownFlags returns the list of the known filter flags.
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/seccomp/doc.go b/vendor/github.com/opencontainers/runc/libcontainer/seccomp/doc.go
new file mode 100644
index 0000000000..4e71750a3f
--- /dev/null
+++ b/vendor/github.com/opencontainers/runc/libcontainer/seccomp/doc.go
@@ -0,0 +1,3 @@
+// Package seccomp provides runc-specific helpers for loading and managing
+// seccomp profiles.
+package seccomp
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/seccomp/patchbpf/doc.go b/vendor/github.com/opencontainers/runc/libcontainer/seccomp/patchbpf/doc.go
new file mode 100644
index 0000000000..f2bf6e69fa
--- /dev/null
+++ b/vendor/github.com/opencontainers/runc/libcontainer/seccomp/patchbpf/doc.go
@@ -0,0 +1,3 @@
+// Package patchbpf provides utilities for patching libseccomp-generated cBPF
+// programs in order to handle unknown syscalls and ENOSYS more gracefully.
+package patchbpf
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/seccomp/patchbpf/enosys_linux.go b/vendor/github.com/opencontainers/runc/libcontainer/seccomp/patchbpf/enosys_linux.go
index 035d0c0d83..b9a0be8c8f 100644
--- a/vendor/github.com/opencontainers/runc/libcontainer/seccomp/patchbpf/enosys_linux.go
+++ b/vendor/github.com/opencontainers/runc/libcontainer/seccomp/patchbpf/enosys_linux.go
@@ -51,6 +51,11 @@ const uintptr_t C_FILTER_FLAG_SPEC_ALLOW = SECCOMP_FILTER_FLAG_SPEC_ALLOW;
 #endif
 const uintptr_t C_FILTER_FLAG_NEW_LISTENER = SECCOMP_FILTER_FLAG_NEW_LISTENER;
 
+#ifndef SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV
+#	define SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV (1UL << 5)
+#endif
+const uintptr_t C_FILTER_FLAG_WAIT_KILLABLE_RECV = SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV;
+
 #ifndef AUDIT_ARCH_RISCV64
 #ifndef EM_RISCV
 #define EM_RISCV		243
@@ -667,6 +672,13 @@ func filterFlags(config *configs.Seccomp, filter *libseccomp.ScmpFilter) (flags
 			flags |= uint(C.C_FILTER_FLAG_SPEC_ALLOW)
 		}
 	}
+	if apiLevel >= 7 {
+		if waitKill, err := filter.GetWaitKill(); err != nil {
+			return 0, false, fmt.Errorf("unable to fetch SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV bit: %w", err)
+		} else if waitKill {
+			flags |= uint(C.C_FILTER_FLAG_WAIT_KILLABLE_RECV)
+		}
+	}
 	// XXX: add newly supported filter flags above this line.
 
 	for _, call := range config.Syscalls {
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/seccomp/seccomp_linux.go b/vendor/github.com/opencontainers/runc/libcontainer/seccomp/seccomp_linux.go
index e399972aa5..7b3805b50b 100644
--- a/vendor/github.com/opencontainers/runc/libcontainer/seccomp/seccomp_linux.go
+++ b/vendor/github.com/opencontainers/runc/libcontainer/seccomp/seccomp_linux.go
@@ -159,6 +159,11 @@ func setFlag(filter *libseccomp.ScmpFilter, flag specs.LinuxSeccompFlag) error {
 			return fmt.Errorf("error adding SSB flag to seccomp filter: %w", err)
 		}
 		return nil
+	case specs.LinuxSeccompFlagWaitKillableRecv:
+		if err := filter.SetWaitKill(true); err != nil {
+			return fmt.Errorf("error adding WaitKill flag to seccomp filter: %w", err)
+		}
+		return nil
 	}
 	// NOTE when adding more flags above, do not forget to also:
 	// - add new flags to `flags` slice in config.go;
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/standard_init_linux.go b/vendor/github.com/opencontainers/runc/libcontainer/standard_init_linux.go
index 570472bd41..933c1de344 100644
--- a/vendor/github.com/opencontainers/runc/libcontainer/standard_init_linux.go
+++ b/vendor/github.com/opencontainers/runc/libcontainer/standard_init_linux.go
@@ -142,9 +142,10 @@ func (l *linuxStandardInit) Init() error {
 		}
 	}
 
-	if err := maskPaths(l.config.Config.MaskPaths, l.config.Config.MountLabel); err != nil {
+	if err := maskPaths("/", l.config.Config.MaskPaths, l.config.Config.MountLabel); err != nil {
 		return err
 	}
+
 	pdeath, err := system.GetParentDeathSignal()
 	if err != nil {
 		return fmt.Errorf("can't get pdeath signal: %w", err)
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/sync.go b/vendor/github.com/opencontainers/runc/libcontainer/sync.go
index 90cf49b86f..07befdbbc6 100644
--- a/vendor/github.com/opencontainers/runc/libcontainer/sync.go
+++ b/vendor/github.com/opencontainers/runc/libcontainer/sync.go
@@ -8,9 +8,9 @@ import (
 	"os"
 	"strconv"
 
-	"github.com/opencontainers/runc/libcontainer/utils"
-
 	"github.com/sirupsen/logrus"
+
+	"github.com/opencontainers/runc/internal/cmsg"
 )
 
 type syncType string
@@ -102,7 +102,7 @@ func doWriteSync(pipe *syncSocket, sync syncT) error {
 	}
 	if sync.Flags&syncFlagHasFd != 0 {
 		logrus.Debugf("writing sync file %s", sync)
-		if err := utils.SendFile(pipe.File(), sync.File); err != nil {
+		if err := cmsg.SendFile(pipe.File(), sync.File); err != nil {
 			return fmt.Errorf("sending file after sync %q: %w", sync.Type, err)
 		}
 	}
@@ -149,7 +149,7 @@ func doReadSync(pipe *syncSocket) (syncT, error) {
 	}
 	if sync.Flags&syncFlagHasFd != 0 {
 		logrus.Debugf("reading sync file %s", sync)
-		file, err := utils.RecvFile(pipe.File())
+		file, err := cmsg.RecvFile(pipe.File())
 		if err != nil {
 			return sync, fmt.Errorf("receiving fd from sync %v failed: %w", sync.Type, err)
 		}
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/system/doc.go b/vendor/github.com/opencontainers/runc/libcontainer/system/doc.go
new file mode 100644
index 0000000000..0326601f47
--- /dev/null
+++ b/vendor/github.com/opencontainers/runc/libcontainer/system/doc.go
@@ -0,0 +1,2 @@
+// Package system provides wrappers for Linux system operations.
+package system
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/utils/cmsg_deprecated.go b/vendor/github.com/opencontainers/runc/libcontainer/utils/cmsg_deprecated.go
new file mode 100644
index 0000000000..1da908a2b7
--- /dev/null
+++ b/vendor/github.com/opencontainers/runc/libcontainer/utils/cmsg_deprecated.go
@@ -0,0 +1,35 @@
+package utils
+
+import (
+	"os"
+
+	"github.com/opencontainers/runc/internal/cmsg"
+)
+
+// RecvFile waits for a file descriptor to be sent over the given AF_UNIX
+// socket. The file name of the remote file descriptor will be recreated
+// locally (it is sent as non-auxiliary data in the same payload).
+//
+// Deprecated: This method is deprecated and has been moved to an internal
+// package (see [cmsg.RecvFile]). It will be removed in runc 1.6.
+func RecvFile(socket *os.File) (*os.File, error) {
+	return cmsg.RecvFile(socket)
+}
+
+// SendFile sends a file over the given AF_UNIX socket. file.Name() is also
+// included so that if the other end uses RecvFile, the file will have the same
+// name information.
+//
+// Deprecated: This method is deprecated and has been moved to an internal
+// package (see [cmsg.SendFile]). It will be removed in runc 1.6.
+func SendFile(socket, file *os.File) error {
+	return cmsg.SendFile(socket, file)
+}
+
+// SendRawFd sends a specific file descriptor over the given AF_UNIX socket.
+//
+// Deprecated: This method is deprecated and has been moved to an internal
+// package (see [cmsg.SendRawFd]). It will be removed in runc 1.6.
+func SendRawFd(socket *os.File, msg string, fd uintptr) error {
+	return cmsg.SendRawFd(socket, msg, fd)
+}
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/utils/utils.go b/vendor/github.com/opencontainers/runc/libcontainer/utils/utils.go
index 6c3baf0153..2685172dc1 100644
--- a/vendor/github.com/opencontainers/runc/libcontainer/utils/utils.go
+++ b/vendor/github.com/opencontainers/runc/libcontainer/utils/utils.go
@@ -1,3 +1,4 @@
+// Package utils provides general helper utilities used in libcontainer.
 package utils
 
 import (
@@ -6,8 +7,6 @@ import (
 	"strings"
 
 	"golang.org/x/sys/unix"
-
-	"github.com/opencontainers/runc/internal/pathrs"
 )
 
 const (
@@ -66,23 +65,3 @@ func Annotations(labels []string) (bundle string, userAnnotations map[string]str
 	}
 	return bundle, userAnnotations
 }
-
-// CleanPath makes a path safe for use with filepath.Join. This is done by not
-// only cleaning the path, but also (if the path is relative) adding a leading
-// '/' and cleaning it (then removing the leading '/'). This ensures that a
-// path resulting from prepending another path will always resolve to lexically
-// be a subdirectory of the prefixed path. This is all done lexically, so paths
-// that include symlinks won't be safe as a result of using CleanPath.
-//
-// Deprecated: This function has been moved to internal/pathrs and this wrapper
-// will be removed in runc 1.5.
-var CleanPath = pathrs.LexicallyCleanPath
-
-// StripRoot returns the passed path, stripping the root path if it was
-// (lexicially) inside it. Note that both passed paths will always be treated
-// as absolute, and the returned path will also always be absolute. In
-// addition, the paths are cleaned before stripping the root.
-//
-// Deprecated: This function has been moved to internal/pathrs and this wrapper
-// will be removed in runc 1.5.
-var StripRoot = pathrs.LexicallyStripRoot
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/utils/utils_unix.go b/vendor/github.com/opencontainers/runc/libcontainer/utils/utils_unix.go
index af5689e9a2..91264f0d3a 100644
--- a/vendor/github.com/opencontainers/runc/libcontainer/utils/utils_unix.go
+++ b/vendor/github.com/opencontainers/runc/libcontainer/utils/utils_unix.go
@@ -6,13 +6,11 @@ import (
 	"fmt"
 	"math"
 	"os"
-	"path/filepath"
 	"runtime"
 	"strconv"
 	"sync"
 	_ "unsafe" // for go:linkname
 
-	securejoin "github.com/cyphar/filepath-securejoin"
 	"github.com/sirupsen/logrus"
 	"golang.org/x/sys/unix"
 
@@ -146,44 +144,6 @@ func NewSockPair(name string) (parent, child *os.File, err error) {
 	return os.NewFile(uintptr(fds[1]), name+"-p"), os.NewFile(uintptr(fds[0]), name+"-c"), nil
 }
 
-// WithProcfd runs the passed closure with a procfd path (/proc/self/fd/...)
-// corresponding to the unsafePath resolved within the root. Before passing the
-// fd, this path is verified to have been inside the root -- so operating on it
-// through the passed fdpath should be safe. Do not access this path through
-// the original path strings, and do not attempt to use the pathname outside of
-// the passed closure (the file handle will be freed once the closure returns).
-//
-// Deprecated: This function is an internal implementation detail of runc and
-// is no longer used. It will be removed in runc 1.5.
-func WithProcfd(root, unsafePath string, fn func(procfd string) error) error {
-	// Remove the root then forcefully resolve inside the root.
-	unsafePath = pathrs.LexicallyStripRoot(root, unsafePath)
-	fullPath, err := securejoin.SecureJoin(root, unsafePath)
-	if err != nil {
-		return fmt.Errorf("resolving path inside rootfs failed: %w", err)
-	}
-
-	procSelfFd, closer := ProcThreadSelf("fd/")
-	defer closer()
-
-	// Open the target path.
-	fh, err := os.OpenFile(fullPath, unix.O_PATH|unix.O_CLOEXEC, 0)
-	if err != nil {
-		return fmt.Errorf("open o_path procfd: %w", err)
-	}
-	defer fh.Close()
-
-	procfd := filepath.Join(procSelfFd, strconv.Itoa(int(fh.Fd())))
-	// Double-check the path is the one we expected.
-	if realpath, err := os.Readlink(procfd); err != nil {
-		return fmt.Errorf("procfd verification failed: %w", err)
-	} else if realpath != fullPath {
-		return fmt.Errorf("possibly malicious path detected -- refusing to operate on %s", realpath)
-	}
-
-	return fn(procfd)
-}
-
 // WithProcfdFile is a very minimal wrapper around [ProcThreadSelfFd]. The
 // caller is responsible for making sure that the provided file handle is
 // actually safe to operate on.
diff --git a/vendor/github.com/opencontainers/runc/types/events.go b/vendor/github.com/opencontainers/runc/types/events.go
index 4d8782782e..9dac1cd5d7 100644
--- a/vendor/github.com/opencontainers/runc/types/events.go
+++ b/vendor/github.com/opencontainers/runc/types/events.go
@@ -1,3 +1,5 @@
+// Package types defines the types used for the cgroup-related events APIs
+// provided by "runc events".
 package types
 
 import (
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 8060c68489..1730d4a061 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -1,4 +1,4 @@
-# cyphar.com/go-pathrs v0.2.4
+# cyphar.com/go-pathrs v0.2.5
 ## explicit; go 1.18
 cyphar.com/go-pathrs
 cyphar.com/go-pathrs/internal/fdutils
@@ -31,6 +31,9 @@ github.com/OneOfOne/xxhash
 # github.com/agnivade/levenshtein v1.2.0
 ## explicit; go 1.21
 github.com/agnivade/levenshtein
+# github.com/aperturerobotics/protobuf-go-lite v0.14.0
+## explicit; go 1.23
+github.com/aperturerobotics/protobuf-go-lite
 # github.com/beorn7/perks v1.0.1
 ## explicit; go 1.11
 github.com/beorn7/perks/quantile
@@ -43,10 +46,11 @@ github.com/cenkalti/backoff/v4
 # github.com/cespare/xxhash/v2 v2.3.0
 ## explicit; go 1.11
 github.com/cespare/xxhash/v2
-# github.com/checkpoint-restore/go-criu/v7 v7.2.0
-## explicit; go 1.20
-github.com/checkpoint-restore/go-criu/v7
-github.com/checkpoint-restore/go-criu/v7/rpc
+# github.com/checkpoint-restore/go-criu/v8 v8.3.0
+## explicit; go 1.25.0
+github.com/checkpoint-restore/go-criu/v8
+github.com/checkpoint-restore/go-criu/v8/internal/proto
+github.com/checkpoint-restore/go-criu/v8/rpc
 # github.com/cilium/ebpf v0.17.3
 ## explicit; go 1.22
 github.com/cilium/ebpf
@@ -150,7 +154,7 @@ github.com/coreos/go-systemd/v22/dbus
 # github.com/cpuguy83/go-md2man/v2 v2.0.7
 ## explicit; go 1.12
 github.com/cpuguy83/go-md2man/v2/md2man
-# github.com/cyphar/filepath-securejoin v0.6.1
+# github.com/cyphar/filepath-securejoin v0.7.0
 ## explicit; go 1.18
 github.com/cyphar/filepath-securejoin
 github.com/cyphar/filepath-securejoin/internal/consts
@@ -215,8 +219,8 @@ github.com/goccy/go-json/internal/encoder/vm_color_indent
 github.com/goccy/go-json/internal/encoder/vm_indent
 github.com/goccy/go-json/internal/errors
 github.com/goccy/go-json/internal/runtime
-# github.com/godbus/dbus/v5 v5.1.0
-## explicit; go 1.12
+# github.com/godbus/dbus/v5 v5.2.2
+## explicit; go 1.20
 github.com/godbus/dbus/v5
 # github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8
 ## explicit; go 1.20
@@ -315,6 +319,9 @@ github.com/mdlayher/vsock
 # github.com/moby/sys/capability v0.4.0
 ## explicit; go 1.21
 github.com/moby/sys/capability
+# github.com/moby/sys/devices v0.1.0
+## explicit; go 1.24
+github.com/moby/sys/devices
 # github.com/moby/sys/mountinfo v0.7.2
 ## explicit; go 1.17
 github.com/moby/sys/mountinfo
@@ -437,8 +444,9 @@ github.com/opencontainers/go-digest
 ## explicit; go 1.18
 github.com/opencontainers/image-spec/specs-go
 github.com/opencontainers/image-spec/specs-go/v1
-# github.com/opencontainers/runc v1.4.2
-## explicit; go 1.24.0
+# github.com/opencontainers/runc v1.5.0
+## explicit; go 1.25.0
+github.com/opencontainers/runc/internal/cmsg
 github.com/opencontainers/runc/internal/linux
 github.com/opencontainers/runc/internal/pathrs
 github.com/opencontainers/runc/internal/sys