From e6048715e4512831aec2743672fd39dd098fca9b Mon Sep 17 00:00:00 2001
From: Kir Kolyshkin <kolyshkin@gmail.com>
Date: Tue, 1 Jun 2021 11:56:21 -0700
Subject: [PATCH] Use gofumpt to format code

gofumpt (mvdan.cc/gofumpt) is a fork of gofmt with stricter rules.

Brought to you by

	git ls-files \*.go | grep -v ^vendor/ | xargs gofumpt -s -w

Looking at the diff, all these changes make sense.

Also, replace gofmt with gofumpt in golangci.yml.

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
---
 .golangci.yml                                 |  2 +-
 checkpoint.go                                 |  3 +-
 contrib/cmd/recvtty/recvtty.go                |  2 +-
 libcontainer/cgroups/fs/blkio.go              | 17 +++++-----
 libcontainer/cgroups/fs/blkio_test.go         |  5 +--
 libcontainer/cgroups/fs/cpu.go                |  5 ++-
 libcontainer/cgroups/fs/cpu_test.go           |  3 +-
 libcontainer/cgroups/fs/cpuacct.go            |  5 ++-
 libcontainer/cgroups/fs/cpuacct_test.go       | 24 +++++++++-----
 libcontainer/cgroups/fs/cpuset.go             |  7 ++--
 libcontainer/cgroups/fs/cpuset_test.go        |  5 ++-
 libcontainer/cgroups/fs/freezer.go            |  3 +-
 libcontainer/cgroups/fs/fs.go                 |  8 +++--
 libcontainer/cgroups/fs/hugetlb.go            |  3 +-
 libcontainer/cgroups/fs/memory.go             |  3 +-
 libcontainer/cgroups/fs/memory_test.go        |  8 +++--
 libcontainer/cgroups/fs/net_cls.go            |  3 +-
 libcontainer/cgroups/fs/net_prio.go           |  3 +-
 libcontainer/cgroups/fs/net_prio_test.go      | 14 ++++----
 libcontainer/cgroups/fs/perf_event.go         |  3 +-
 libcontainer/cgroups/fs/pids.go               |  3 +-
 libcontainer/cgroups/fs/util_test.go          |  2 +-
 libcontainer/cgroups/fs2/cpu.go               |  1 +
 libcontainer/cgroups/fs2/create.go            |  2 +-
 libcontainer/cgroups/fs2/defaultpath.go       |  4 +--
 libcontainer/cgroups/fs2/devices.go           |  2 +-
 libcontainer/cgroups/fs2/fs2.go               |  4 +--
 libcontainer/cgroups/fs2/io_test.go           |  2 +-
 .../cgroups/fscommon/fscommon_test.go         |  2 +-
 libcontainer/cgroups/fscommon/open.go         |  4 +--
 libcontainer/cgroups/fscommon/utils.go        |  4 +--
 libcontainer/cgroups/fscommon/utils_test.go   | 10 +++---
 libcontainer/cgroups/systemd/dbus.go          |  3 +-
 libcontainer/cgroups/systemd/systemd_test.go  |  2 +-
 libcontainer/cgroups/systemd/v1.go            |  2 +-
 libcontainer/cgroups/utils.go                 |  1 -
 libcontainer/cgroups/utils_test.go            |  1 -
 libcontainer/configs/cgroup_unsupported.go    |  3 +-
 libcontainer/configs/config.go                |  8 +++--
 libcontainer/configs/config_linux_test.go     |  4 +--
 libcontainer/configs/config_test.go           |  2 +-
 .../configs/namespaces_unsupported.go         |  3 +-
 libcontainer/configs/validate/validator.go    |  3 +-
 libcontainer/console_linux.go                 |  2 +-
 libcontainer/container_linux.go               | 20 +++++------
 libcontainer/container_linux_test.go          |  4 +--
 libcontainer/devices/device_unix.go           |  6 ++--
 libcontainer/factory_linux.go                 |  2 +-
 libcontainer/integration/exec_test.go         | 10 +++---
 libcontainer/integration/execin_test.go       |  2 +-
 libcontainer/integration/utils_test.go        |  6 ++--
 libcontainer/intelrdt/cmt.go                  |  4 +--
 libcontainer/intelrdt/mbm.go                  |  6 ++--
 libcontainer/intelrdt/mbm_test.go             |  1 -
 libcontainer/intelrdt/monitoring.go           |  4 +--
 libcontainer/intelrdt/monitoring_test.go      |  1 -
 libcontainer/logs/logs.go                     |  2 +-
 libcontainer/network_linux.go                 |  3 +-
 libcontainer/notify_linux.go                  |  2 +-
 libcontainer/notify_linux_test.go             |  4 +--
 libcontainer/restored_process.go              |  4 +--
 libcontainer/rootfs_linux.go                  | 31 +++++++++--------
 libcontainer/seccomp/patchbpf/enosys_linux.go | 33 ++++++++++++-------
 libcontainer/specconv/spec_linux.go           | 16 ++++-----
 libcontainer/specconv/spec_linux_test.go      | 14 +++-----
 libcontainer/stacktrace/capture.go            |  4 +--
 libcontainer/user/user.go                     |  4 +--
 libcontainer/utils/utils_test.go              |  2 +-
 list.go                                       |  3 +-
 main.go                                       |  2 +-
 notify_socket.go                              |  4 +--
 rlimit_linux.go                               |  7 ++--
 spec.go                                       |  2 +-
 update.go                                     |  2 +-
 utils_linux.go                                |  6 ++--
 75 files changed, 195 insertions(+), 216 deletions(-)

diff --git a/.golangci.yml b/.golangci.yml
index d2cd076f5..afdad3136 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -6,4 +6,4 @@ run:
 
 linters:
   enable:
-    - gofmt
+    - gofumpt
diff --git a/checkpoint.go b/checkpoint.go
index c8c8e7458..bf773a9ba 100644
--- a/checkpoint.go
+++ b/checkpoint.go
@@ -85,7 +85,7 @@ func prepareImagePaths(context *cli.Context) (string, string, error) {
 		imagePath = getDefaultImagePath(context)
 	}
 
-	if err := os.MkdirAll(imagePath, 0600); err != nil {
+	if err := os.MkdirAll(imagePath, 0o600); err != nil {
 		return "", "", err
 	}
 
@@ -109,7 +109,6 @@ func prepareImagePaths(context *cli.Context) (string, string, error) {
 	}
 
 	return imagePath, parentPath, nil
-
 }
 
 func setPageServer(context *cli.Context, options *libcontainer.CriuOpts) {
diff --git a/contrib/cmd/recvtty/recvtty.go b/contrib/cmd/recvtty/recvtty.go
index cf2fddf76..777b3f1cc 100644
--- a/contrib/cmd/recvtty/recvtty.go
+++ b/contrib/cmd/recvtty/recvtty.go
@@ -224,7 +224,7 @@ func main() {
 		pidPath := ctx.String("pid-file")
 		if pidPath != "" {
 			pid := fmt.Sprintf("%d\n", os.Getpid())
-			if err := ioutil.WriteFile(pidPath, []byte(pid), 0644); err != nil {
+			if err := ioutil.WriteFile(pidPath, []byte(pid), 0o644); err != nil {
 				return err
 			}
 		}
diff --git a/libcontainer/cgroups/fs/blkio.go b/libcontainer/cgroups/fs/blkio.go
index 05fec2603..99407474d 100644
--- a/libcontainer/cgroups/fs/blkio.go
+++ b/libcontainer/cgroups/fs/blkio.go
@@ -14,8 +14,7 @@ import (
 	"github.com/opencontainers/runc/libcontainer/configs"
 )
 
-type BlkioGroup struct {
-}
+type BlkioGroup struct{}
 
 func (s *BlkioGroup) Name() string {
 	return "blkio"
@@ -161,7 +160,7 @@ func (s *BlkioGroup) GetStats(path string, stats *cgroups.Stats) error {
 		filename            string
 		blkioStatEntriesPtr *[]cgroups.BlkioStatEntry
 	}
-	var bfqDebugStats = []blkioStatInfo{
+	bfqDebugStats := []blkioStatInfo{
 		{
 			filename:            "blkio.bfq.sectors_recursive",
 			blkioStatEntriesPtr: &stats.BlkioStats.SectorsRecursive,
@@ -195,7 +194,7 @@ func (s *BlkioGroup) GetStats(path string, stats *cgroups.Stats) error {
 			blkioStatEntriesPtr: &stats.BlkioStats.IoServiceBytesRecursive,
 		},
 	}
-	var bfqStats = []blkioStatInfo{
+	bfqStats := []blkioStatInfo{
 		{
 			filename:            "blkio.bfq.io_serviced_recursive",
 			blkioStatEntriesPtr: &stats.BlkioStats.IoServicedRecursive,
@@ -205,7 +204,7 @@ func (s *BlkioGroup) GetStats(path string, stats *cgroups.Stats) error {
 			blkioStatEntriesPtr: &stats.BlkioStats.IoServiceBytesRecursive,
 		},
 	}
-	var cfqStats = []blkioStatInfo{
+	cfqStats := []blkioStatInfo{
 		{
 			filename:            "blkio.sectors_recursive",
 			blkioStatEntriesPtr: &stats.BlkioStats.SectorsRecursive,
@@ -239,7 +238,7 @@ func (s *BlkioGroup) GetStats(path string, stats *cgroups.Stats) error {
 			blkioStatEntriesPtr: &stats.BlkioStats.IoServiceBytesRecursive,
 		},
 	}
-	var throttleRecursiveStats = []blkioStatInfo{
+	throttleRecursiveStats := []blkioStatInfo{
 		{
 			filename:            "blkio.throttle.io_serviced_recursive",
 			blkioStatEntriesPtr: &stats.BlkioStats.IoServicedRecursive,
@@ -249,7 +248,7 @@ func (s *BlkioGroup) GetStats(path string, stats *cgroups.Stats) error {
 			blkioStatEntriesPtr: &stats.BlkioStats.IoServiceBytesRecursive,
 		},
 	}
-	var baseStats = []blkioStatInfo{
+	baseStats := []blkioStatInfo{
 		{
 			filename:            "blkio.throttle.io_serviced",
 			blkioStatEntriesPtr: &stats.BlkioStats.IoServicedRecursive,
@@ -259,7 +258,7 @@ func (s *BlkioGroup) GetStats(path string, stats *cgroups.Stats) error {
 			blkioStatEntriesPtr: &stats.BlkioStats.IoServiceBytesRecursive,
 		},
 	}
-	var orderedStats = [][]blkioStatInfo{
+	orderedStats := [][]blkioStatInfo{
 		bfqDebugStats,
 		bfqStats,
 		cfqStats,
@@ -280,7 +279,7 @@ func (s *BlkioGroup) GetStats(path string, stats *cgroups.Stats) error {
 				return err
 			}
 			*statInfo.blkioStatEntriesPtr = blkioStats
-			//finish if all stats are gathered
+			// finish if all stats are gathered
 			if i == len(statGroup)-1 {
 				return nil
 			}
diff --git a/libcontainer/cgroups/fs/blkio_test.go b/libcontainer/cgroups/fs/blkio_test.go
index bd96d242b..4dbb48ad0 100644
--- a/libcontainer/cgroups/fs/blkio_test.go
+++ b/libcontainer/cgroups/fs/blkio_test.go
@@ -459,7 +459,6 @@ func TestBlkioStatsNoFilesBFQDebug(t *testing.T) {
 		cpuset := &CpusetGroup{}
 		actualStats := *cgroups.NewStats()
 		err := cpuset.GetStats(helper.CgroupPath, &actualStats)
-
 		if err != nil {
 			t.Errorf(fmt.Sprintf("test case '%s' failed unexpectedly: %s", testCase.desc, err))
 		}
@@ -576,7 +575,6 @@ func TestBlkioStatsNoFilesCFQ(t *testing.T) {
 		cpuset := &CpusetGroup{}
 		actualStats := *cgroups.NewStats()
 		err := cpuset.GetStats(helper.CgroupPath, &actualStats)
-
 		if err != nil {
 			t.Errorf(fmt.Sprintf("test case '%s' failed unexpectedly: %s", testCase.desc, err))
 		}
@@ -759,6 +757,7 @@ func TestBlkioSetThrottleReadBpsDevice(t *testing.T) {
 		t.Fatal("Got the wrong value, set blkio.throttle.read_bps_device failed.")
 	}
 }
+
 func TestBlkioSetThrottleWriteBpsDevice(t *testing.T) {
 	helper := NewCgroupTestUtil("blkio", t)
 	defer helper.cleanup()
@@ -789,6 +788,7 @@ func TestBlkioSetThrottleWriteBpsDevice(t *testing.T) {
 		t.Fatal("Got the wrong value, set blkio.throttle.write_bps_device failed.")
 	}
 }
+
 func TestBlkioSetThrottleReadIOpsDevice(t *testing.T) {
 	helper := NewCgroupTestUtil("blkio", t)
 	defer helper.cleanup()
@@ -819,6 +819,7 @@ func TestBlkioSetThrottleReadIOpsDevice(t *testing.T) {
 		t.Fatal("Got the wrong value, set blkio.throttle.read_iops_device failed.")
 	}
 }
+
 func TestBlkioSetThrottleWriteIOpsDevice(t *testing.T) {
 	helper := NewCgroupTestUtil("blkio", t)
 	defer helper.cleanup()
diff --git a/libcontainer/cgroups/fs/cpu.go b/libcontainer/cgroups/fs/cpu.go
index 975df1c4e..062c9e88c 100644
--- a/libcontainer/cgroups/fs/cpu.go
+++ b/libcontainer/cgroups/fs/cpu.go
@@ -13,8 +13,7 @@ import (
 	"github.com/opencontainers/runc/libcontainer/configs"
 )
 
-type CpuGroup struct {
-}
+type CpuGroup struct{}
 
 func (s *CpuGroup) Name() string {
 	return "cpu"
@@ -26,7 +25,7 @@ func (s *CpuGroup) Apply(path string, d *cgroupData) error {
 	if path == "" {
 		return nil
 	}
-	if err := os.MkdirAll(path, 0755); err != nil {
+	if err := os.MkdirAll(path, 0o755); err != nil {
 		return err
 	}
 	// We should set the real-Time group scheduling settings before moving
diff --git a/libcontainer/cgroups/fs/cpu_test.go b/libcontainer/cgroups/fs/cpu_test.go
index b615594e6..adfe8c2d5 100644
--- a/libcontainer/cgroups/fs/cpu_test.go
+++ b/libcontainer/cgroups/fs/cpu_test.go
@@ -128,7 +128,8 @@ func TestCpuStats(t *testing.T) {
 	expectedStats := cgroups.ThrottlingData{
 		Periods:          nrPeriods,
 		ThrottledPeriods: nrThrottled,
-		ThrottledTime:    throttledTime}
+		ThrottledTime:    throttledTime,
+	}
 
 	expectThrottlingDataEquals(t, expectedStats, actualStats.CpuStats.ThrottlingData)
 }
diff --git a/libcontainer/cgroups/fs/cpuacct.go b/libcontainer/cgroups/fs/cpuacct.go
index 0445cd45b..94b845c11 100644
--- a/libcontainer/cgroups/fs/cpuacct.go
+++ b/libcontainer/cgroups/fs/cpuacct.go
@@ -32,8 +32,7 @@ const (
 	clockTicks uint64 = 100
 )
 
-type CpuacctGroup struct {
-}
+type CpuacctGroup struct{}
 
 func (s *CpuacctGroup) Name() string {
 	return "cpuacct"
@@ -144,7 +143,7 @@ func getPercpuUsageInModes(path string) ([]uint64, []uint64, error) {
 	defer file.Close()
 
 	scanner := bufio.NewScanner(file)
-	scanner.Scan() //skipping header line
+	scanner.Scan() // skipping header line
 
 	for scanner.Scan() {
 		lineFields := strings.SplitN(scanner.Text(), " ", cuacctUsageAllColumnsNumber+1)
diff --git a/libcontainer/cgroups/fs/cpuacct_test.go b/libcontainer/cgroups/fs/cpuacct_test.go
index bb69d9be3..009380814 100644
--- a/libcontainer/cgroups/fs/cpuacct_test.go
+++ b/libcontainer/cgroups/fs/cpuacct_test.go
@@ -44,12 +44,18 @@ func TestCpuacctStats(t *testing.T) {
 
 	expectedStats := cgroups.CpuUsage{
 		TotalUsage: uint64(12262454190222160),
-		PercpuUsage: []uint64{1564936537989058, 1583937096487821, 1604195415465681, 1596445226820187,
-			1481069084155629, 1478735613864327, 1477610593414743, 1476362015778086},
-		PercpuUsageInKernelmode: []uint64{637727786389114, 638197595421064, 638956774598358, 637985531181620,
-			638837766495476, 638763309884944, 640081778921247, 638716766259495},
-		PercpuUsageInUsermode: []uint64{962250696038415, 981956408513304, 1002658817529022, 994937703492523,
-			874843781648690, 872544369885276, 870104915696359, 870202363887496},
+		PercpuUsage: []uint64{
+			1564936537989058, 1583937096487821, 1604195415465681, 1596445226820187,
+			1481069084155629, 1478735613864327, 1477610593414743, 1476362015778086,
+		},
+		PercpuUsageInKernelmode: []uint64{
+			637727786389114, 638197595421064, 638956774598358, 637985531181620,
+			638837766495476, 638763309884944, 640081778921247, 638716766259495,
+		},
+		PercpuUsageInUsermode: []uint64{
+			962250696038415, 981956408513304, 1002658817529022, 994937703492523,
+			874843781648690, 872544369885276, 870104915696359, 870202363887496,
+		},
 		UsageInKernelmode: (uint64(291429664) * nanosecondsInSecond) / clockTicks,
 		UsageInUsermode:   (uint64(452278264) * nanosecondsInSecond) / clockTicks,
 	}
@@ -78,8 +84,10 @@ func TestCpuacctStatsWithoutUsageAll(t *testing.T) {
 
 	expectedStats := cgroups.CpuUsage{
 		TotalUsage: uint64(12262454190222160),
-		PercpuUsage: []uint64{1564936537989058, 1583937096487821, 1604195415465681, 1596445226820187,
-			1481069084155629, 1478735613864327, 1477610593414743, 1476362015778086},
+		PercpuUsage: []uint64{
+			1564936537989058, 1583937096487821, 1604195415465681, 1596445226820187,
+			1481069084155629, 1478735613864327, 1477610593414743, 1476362015778086,
+		},
 		PercpuUsageInKernelmode: []uint64{},
 		PercpuUsageInUsermode:   []uint64{},
 		UsageInKernelmode:       (uint64(291429664) * nanosecondsInSecond) / clockTicks,
diff --git a/libcontainer/cgroups/fs/cpuset.go b/libcontainer/cgroups/fs/cpuset.go
index 0591122bc..f9d3fb185 100644
--- a/libcontainer/cgroups/fs/cpuset.go
+++ b/libcontainer/cgroups/fs/cpuset.go
@@ -16,8 +16,7 @@ import (
 	"golang.org/x/sys/unix"
 )
 
-type CpusetGroup struct {
-}
+type CpusetGroup struct{}
 
 func (s *CpusetGroup) Name() string {
 	return "cpuset"
@@ -156,7 +155,7 @@ func (s *CpusetGroup) ApplyDir(dir string, r *configs.Resources, pid int) error
 	if err := cpusetEnsureParent(filepath.Dir(dir)); err != nil {
 		return err
 	}
-	if err := os.Mkdir(dir, 0755); err != nil && !os.IsExist(err) {
+	if err := os.Mkdir(dir, 0o755); err != nil && !os.IsExist(err) {
 		return err
 	}
 	// We didn't inherit cpuset configs from parent, but we have
@@ -206,7 +205,7 @@ func cpusetEnsureParent(current string) error {
 	if err := cpusetEnsureParent(parent); err != nil {
 		return err
 	}
-	if err := os.Mkdir(current, 0755); err != nil && !os.IsExist(err) {
+	if err := os.Mkdir(current, 0o755); err != nil && !os.IsExist(err) {
 		return err
 	}
 	return cpusetCopyIfNeeded(current, parent)
diff --git a/libcontainer/cgroups/fs/cpuset_test.go b/libcontainer/cgroups/fs/cpuset_test.go
index 5ac9a0372..2f0877c3e 100644
--- a/libcontainer/cgroups/fs/cpuset_test.go
+++ b/libcontainer/cgroups/fs/cpuset_test.go
@@ -118,12 +118,12 @@ func TestCPUSetStatsCorrect(t *testing.T) {
 		MemorySpreadSlab:      1,
 		MemoryPressure:        34377,
 		SchedLoadBalance:      1,
-		SchedRelaxDomainLevel: -1}
+		SchedRelaxDomainLevel: -1,
+	}
 	if !reflect.DeepEqual(expectedStats, actualStats.CPUSetStats) {
 		t.Fatalf("Expected Cpuset stats usage %#v but found %#v",
 			expectedStats, actualStats.CPUSetStats)
 	}
-
 }
 
 func TestCPUSetStatsMissingFiles(t *testing.T) {
@@ -226,7 +226,6 @@ func TestCPUSetStatsMissingFiles(t *testing.T) {
 				cpuset := &CpusetGroup{}
 				actualStats := *cgroups.NewStats()
 				err := cpuset.GetStats(helper.CgroupPath, &actualStats)
-
 				if err != nil {
 					t.Errorf("failed unexpectedly: %q", err)
 				}
diff --git a/libcontainer/cgroups/fs/freezer.go b/libcontainer/cgroups/fs/freezer.go
index cf2f948fe..f621c5996 100644
--- a/libcontainer/cgroups/fs/freezer.go
+++ b/libcontainer/cgroups/fs/freezer.go
@@ -16,8 +16,7 @@ import (
 	"golang.org/x/sys/unix"
 )
 
-type FreezerGroup struct {
-}
+type FreezerGroup struct{}
 
 func (s *FreezerGroup) Name() string {
 	return "freezer"
diff --git a/libcontainer/cgroups/fs/fs.go b/libcontainer/cgroups/fs/fs.go
index 7dc4b9e37..777b94f03 100644
--- a/libcontainer/cgroups/fs/fs.go
+++ b/libcontainer/cgroups/fs/fs.go
@@ -64,8 +64,10 @@ func NewManager(cg *configs.Cgroup, paths map[string]string, rootless bool) cgro
 }
 
 // The absolute path to the root of the cgroup hierarchies.
-var cgroupRootLock sync.Mutex
-var cgroupRoot string
+var (
+	cgroupRootLock sync.Mutex
+	cgroupRoot     string
+)
 
 const defaultCgroupRoot = "/sys/fs/cgroup"
 
@@ -393,7 +395,7 @@ func join(path string, pid int) error {
 	if path == "" {
 		return nil
 	}
-	if err := os.MkdirAll(path, 0755); err != nil {
+	if err := os.MkdirAll(path, 0o755); err != nil {
 		return err
 	}
 	return cgroups.WriteCgroupProc(path, pid)
diff --git a/libcontainer/cgroups/fs/hugetlb.go b/libcontainer/cgroups/fs/hugetlb.go
index cf2b93bc5..44f786daf 100644
--- a/libcontainer/cgroups/fs/hugetlb.go
+++ b/libcontainer/cgroups/fs/hugetlb.go
@@ -11,8 +11,7 @@ import (
 	"github.com/opencontainers/runc/libcontainer/configs"
 )
 
-type HugetlbGroup struct {
-}
+type HugetlbGroup struct{}
 
 func (s *HugetlbGroup) Name() string {
 	return "hugetlb"
diff --git a/libcontainer/cgroups/fs/memory.go b/libcontainer/cgroups/fs/memory.go
index 18641bf87..15820fa4c 100644
--- a/libcontainer/cgroups/fs/memory.go
+++ b/libcontainer/cgroups/fs/memory.go
@@ -25,8 +25,7 @@ const (
 	cgroupMemoryMaxUsage  = "memory.max_usage_in_bytes"
 )
 
-type MemoryGroup struct {
-}
+type MemoryGroup struct{}
 
 func (s *MemoryGroup) Name() string {
 	return "memory"
diff --git a/libcontainer/cgroups/fs/memory_test.go b/libcontainer/cgroups/fs/memory_test.go
index 589e2be32..da67fcc7d 100644
--- a/libcontainer/cgroups/fs/memory_test.go
+++ b/libcontainer/cgroups/fs/memory_test.go
@@ -194,7 +194,7 @@ func TestMemorySetMemorySwappinessDefault(t *testing.T) {
 	helper := NewCgroupTestUtil("memory", t)
 	defer helper.cleanup()
 
-	swappinessBefore := 60 //default is 60
+	swappinessBefore := 60 // default is 60
 	swappinessAfter := uint64(0)
 
 	helper.writeFileContents(map[string]string{
@@ -243,7 +243,8 @@ func TestMemoryStats(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	expectedStats := cgroups.MemoryStats{Cache: 512, Usage: cgroups.MemoryData{Usage: 2048, MaxUsage: 4096, Failcnt: 100, Limit: 8192}, SwapUsage: cgroups.MemoryData{Usage: 2048, MaxUsage: 4096, Failcnt: 100, Limit: 8192}, KernelUsage: cgroups.MemoryData{Usage: 2048, MaxUsage: 4096, Failcnt: 100, Limit: 8192}, Stats: map[string]uint64{"cache": 512, "rss": 1024}, UseHierarchy: true,
+	expectedStats := cgroups.MemoryStats{
+		Cache: 512, Usage: cgroups.MemoryData{Usage: 2048, MaxUsage: 4096, Failcnt: 100, Limit: 8192}, SwapUsage: cgroups.MemoryData{Usage: 2048, MaxUsage: 4096, Failcnt: 100, Limit: 8192}, KernelUsage: cgroups.MemoryData{Usage: 2048, MaxUsage: 4096, Failcnt: 100, Limit: 8192}, Stats: map[string]uint64{"cache": 512, "rss": 1024}, UseHierarchy: true,
 		PageUsageByNUMA: cgroups.PageUsageByNUMA{
 			PageUsageByNUMAInner: cgroups.PageUsageByNUMAInner{
 				Total:       cgroups.PageStats{Total: 44611, Nodes: map[uint8]uint64{0: 32631, 1: 7501, 2: 1982, 3: 2497}},
@@ -257,7 +258,8 @@ func TestMemoryStats(t *testing.T) {
 				Anon:        cgroups.PageStats{Total: 46096, Nodes: map[uint8]uint64{0: 12597, 1: 18890, 2: 283, 3: 14326}},
 				Unevictable: cgroups.PageStats{Total: 20, Nodes: map[uint8]uint64{0: 0, 1: 0, 2: 0, 3: 20}},
 			},
-		}}
+		},
+	}
 	expectMemoryStatEquals(t, expectedStats, actualStats.MemoryStats)
 }
 
diff --git a/libcontainer/cgroups/fs/net_cls.go b/libcontainer/cgroups/fs/net_cls.go
index c824db34d..9f0230404 100644
--- a/libcontainer/cgroups/fs/net_cls.go
+++ b/libcontainer/cgroups/fs/net_cls.go
@@ -10,8 +10,7 @@ import (
 	"github.com/opencontainers/runc/libcontainer/configs"
 )
 
-type NetClsGroup struct {
-}
+type NetClsGroup struct{}
 
 func (s *NetClsGroup) Name() string {
 	return "net_cls"
diff --git a/libcontainer/cgroups/fs/net_prio.go b/libcontainer/cgroups/fs/net_prio.go
index ce4bebc26..4944318cb 100644
--- a/libcontainer/cgroups/fs/net_prio.go
+++ b/libcontainer/cgroups/fs/net_prio.go
@@ -8,8 +8,7 @@ import (
 	"github.com/opencontainers/runc/libcontainer/configs"
 )
 
-type NetPrioGroup struct {
-}
+type NetPrioGroup struct{}
 
 func (s *NetPrioGroup) Name() string {
 	return "net_prio"
diff --git a/libcontainer/cgroups/fs/net_prio_test.go b/libcontainer/cgroups/fs/net_prio_test.go
index ef7cdb04e..3f48e04a0 100644
--- a/libcontainer/cgroups/fs/net_prio_test.go
+++ b/libcontainer/cgroups/fs/net_prio_test.go
@@ -10,14 +10,12 @@ import (
 	"github.com/opencontainers/runc/libcontainer/configs"
 )
 
-var (
-	prioMap = []*configs.IfPrioMap{
-		{
-			Interface: "test",
-			Priority:  5,
-		},
-	}
-)
+var prioMap = []*configs.IfPrioMap{
+	{
+		Interface: "test",
+		Priority:  5,
+	},
+}
 
 func TestNetPrioSetIfPrio(t *testing.T) {
 	helper := NewCgroupTestUtil("net_prio", t)
diff --git a/libcontainer/cgroups/fs/perf_event.go b/libcontainer/cgroups/fs/perf_event.go
index 5da4845fb..1a306fbe3 100644
--- a/libcontainer/cgroups/fs/perf_event.go
+++ b/libcontainer/cgroups/fs/perf_event.go
@@ -7,8 +7,7 @@ import (
 	"github.com/opencontainers/runc/libcontainer/configs"
 )
 
-type PerfEventGroup struct {
-}
+type PerfEventGroup struct{}
 
 func (s *PerfEventGroup) Name() string {
 	return "perf_event"
diff --git a/libcontainer/cgroups/fs/pids.go b/libcontainer/cgroups/fs/pids.go
index c12dafd16..49d2764ca 100644
--- a/libcontainer/cgroups/fs/pids.go
+++ b/libcontainer/cgroups/fs/pids.go
@@ -12,8 +12,7 @@ import (
 	"github.com/opencontainers/runc/libcontainer/configs"
 )
 
-type PidsGroup struct {
-}
+type PidsGroup struct{}
 
 func (s *PidsGroup) Name() string {
 	return "pids"
diff --git a/libcontainer/cgroups/fs/util_test.go b/libcontainer/cgroups/fs/util_test.go
index 32cbdfc94..572c3882b 100644
--- a/libcontainer/cgroups/fs/util_test.go
+++ b/libcontainer/cgroups/fs/util_test.go
@@ -50,7 +50,7 @@ func NewCgroupTestUtil(subsystem string, t *testing.T) *cgroupTestUtil {
 	}
 
 	// Ensure the full mock cgroup path exists.
-	err = os.MkdirAll(testCgroupPath, 0755)
+	err = os.MkdirAll(testCgroupPath, 0o755)
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/libcontainer/cgroups/fs2/cpu.go b/libcontainer/cgroups/fs2/cpu.go
index 404800e99..f09b7d516 100644
--- a/libcontainer/cgroups/fs2/cpu.go
+++ b/libcontainer/cgroups/fs2/cpu.go
@@ -47,6 +47,7 @@ func setCpu(dirPath string, r *configs.Resources) error {
 
 	return nil
 }
+
 func statCpu(dirPath string, stats *cgroups.Stats) error {
 	f, err := fscommon.OpenFile(dirPath, "cpu.stat", os.O_RDONLY)
 	if err != nil {
diff --git a/libcontainer/cgroups/fs2/create.go b/libcontainer/cgroups/fs2/create.go
index f7a9999b6..4246fbdcf 100644
--- a/libcontainer/cgroups/fs2/create.go
+++ b/libcontainer/cgroups/fs2/create.go
@@ -92,7 +92,7 @@ func CreateCgroupPath(path string, c *configs.Cgroup) (Err error) {
 	for i, e := range elements {
 		current = filepath.Join(current, e)
 		if i > 0 {
-			if err := os.Mkdir(current, 0755); err != nil {
+			if err := os.Mkdir(current, 0o755); err != nil {
 				if !os.IsExist(err) {
 					return err
 				}
diff --git a/libcontainer/cgroups/fs2/defaultpath.go b/libcontainer/cgroups/fs2/defaultpath.go
index 009126453..ba81ce0b4 100644
--- a/libcontainer/cgroups/fs2/defaultpath.go
+++ b/libcontainer/cgroups/fs2/defaultpath.go
@@ -82,9 +82,7 @@ func parseCgroupFile(path string) (string, error) {
 }
 
 func parseCgroupFromReader(r io.Reader) (string, error) {
-	var (
-		s = bufio.NewScanner(r)
-	)
+	s := bufio.NewScanner(r)
 	for s.Scan() {
 		var (
 			text  = s.Text()
diff --git a/libcontainer/cgroups/fs2/devices.go b/libcontainer/cgroups/fs2/devices.go
index 6b4b73a13..7c501cad8 100644
--- a/libcontainer/cgroups/fs2/devices.go
+++ b/libcontainer/cgroups/fs2/devices.go
@@ -62,7 +62,7 @@ func setDevices(dirPath string, r *configs.Resources) error {
 	if err != nil {
 		return err
 	}
-	dirFD, err := unix.Open(dirPath, unix.O_DIRECTORY|unix.O_RDONLY, 0600)
+	dirFD, err := unix.Open(dirPath, unix.O_DIRECTORY|unix.O_RDONLY, 0o600)
 	if err != nil {
 		return errors.Errorf("cannot get dir FD for %s", dirPath)
 	}
diff --git a/libcontainer/cgroups/fs2/fs2.go b/libcontainer/cgroups/fs2/fs2.go
index 5da6c51e5..39e017af0 100644
--- a/libcontainer/cgroups/fs2/fs2.go
+++ b/libcontainer/cgroups/fs2/fs2.go
@@ -98,9 +98,7 @@ func (m *manager) GetAllPids() ([]int, error) {
 }
 
 func (m *manager) GetStats() (*cgroups.Stats, error) {
-	var (
-		errs []error
-	)
+	var errs []error
 
 	st := cgroups.NewStats()
 
diff --git a/libcontainer/cgroups/fs2/io_test.go b/libcontainer/cgroups/fs2/io_test.go
index c6cb7a63a..71e5c7185 100644
--- a/libcontainer/cgroups/fs2/io_test.go
+++ b/libcontainer/cgroups/fs2/io_test.go
@@ -68,7 +68,7 @@ func TestStatIo(t *testing.T) {
 	defer os.RemoveAll(fakeCgroupDir)
 	statPath := filepath.Join(fakeCgroupDir, "io.stat")
 
-	if err := ioutil.WriteFile(statPath, []byte(exampleIoStatData), 0644); err != nil {
+	if err := ioutil.WriteFile(statPath, []byte(exampleIoStatData), 0o644); err != nil {
 		t.Fatal(err)
 	}
 
diff --git a/libcontainer/cgroups/fscommon/fscommon_test.go b/libcontainer/cgroups/fscommon/fscommon_test.go
index 710fea915..bed66cbbe 100644
--- a/libcontainer/cgroups/fscommon/fscommon_test.go
+++ b/libcontainer/cgroups/fscommon/fscommon_test.go
@@ -23,7 +23,7 @@ func TestWriteCgroupFileHandlesInterrupt(t *testing.T) {
 
 	cgroupName := fmt.Sprintf("test-eint-%d", time.Now().Nanosecond())
 	cgroupPath := filepath.Join(memoryCgroupMount, cgroupName)
-	if err := os.MkdirAll(cgroupPath, 0755); err != nil {
+	if err := os.MkdirAll(cgroupPath, 0o755); err != nil {
 		t.Fatal(err)
 	}
 	defer os.RemoveAll(cgroupPath)
diff --git a/libcontainer/cgroups/fscommon/open.go b/libcontainer/cgroups/fscommon/open.go
index 49af83b3c..e95876a21 100644
--- a/libcontainer/cgroups/fscommon/open.go
+++ b/libcontainer/cgroups/fscommon/open.go
@@ -28,7 +28,8 @@ var (
 func prepareOpenat2() error {
 	prepOnce.Do(func() {
 		fd, err := unix.Openat2(-1, cgroupfsDir, &unix.OpenHow{
-			Flags: unix.O_DIRECTORY | unix.O_PATH})
+			Flags: unix.O_DIRECTORY | unix.O_PATH,
+		})
 		if err != nil {
 			prepErr = &os.PathError{Op: "openat2", Path: cgroupfsDir, Err: err}
 			if err != unix.ENOSYS {
@@ -52,7 +53,6 @@ func prepareOpenat2() error {
 			// cgroupv2 has a single mountpoint and no "cpu,cpuacct" symlinks
 			resolveFlags |= unix.RESOLVE_NO_XDEV | unix.RESOLVE_NO_SYMLINKS
 		}
-
 	})
 
 	return prepErr
diff --git a/libcontainer/cgroups/fscommon/utils.go b/libcontainer/cgroups/fscommon/utils.go
index db0caded1..44d57f478 100644
--- a/libcontainer/cgroups/fscommon/utils.go
+++ b/libcontainer/cgroups/fscommon/utils.go
@@ -10,9 +10,7 @@ import (
 	"strings"
 )
 
-var (
-	ErrNotValidFormat = errors.New("line is not a valid key value format")
-)
+var ErrNotValidFormat = errors.New("line is not a valid key value format")
 
 // ParseUint converts a string to an uint64 integer.
 // Negative values are returned at zero as, due to kernel bugs,
diff --git a/libcontainer/cgroups/fscommon/utils_test.go b/libcontainer/cgroups/fscommon/utils_test.go
index f56cdd7ef..ba18435ee 100644
--- a/libcontainer/cgroups/fscommon/utils_test.go
+++ b/libcontainer/cgroups/fscommon/utils_test.go
@@ -31,7 +31,7 @@ func TestGetCgroupParamsInt(t *testing.T) {
 	tempFile := filepath.Join(tempDir, cgroupFile)
 
 	// Success.
-	err = ioutil.WriteFile(tempFile, []byte(floatString), 0755)
+	err = ioutil.WriteFile(tempFile, []byte(floatString), 0o755)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -43,7 +43,7 @@ func TestGetCgroupParamsInt(t *testing.T) {
 	}
 
 	// Success with new line.
-	err = ioutil.WriteFile(tempFile, []byte(floatString+"\n"), 0755)
+	err = ioutil.WriteFile(tempFile, []byte(floatString+"\n"), 0o755)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -55,7 +55,7 @@ func TestGetCgroupParamsInt(t *testing.T) {
 	}
 
 	// Success with negative values
-	err = ioutil.WriteFile(tempFile, []byte("-12345"), 0755)
+	err = ioutil.WriteFile(tempFile, []byte("-12345"), 0o755)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -68,7 +68,7 @@ func TestGetCgroupParamsInt(t *testing.T) {
 
 	// Success with negative values lesser than min int64
 	s := strconv.FormatFloat(math.MinInt64, 'f', -1, 64)
-	err = ioutil.WriteFile(tempFile, []byte(s), 0755)
+	err = ioutil.WriteFile(tempFile, []byte(s), 0o755)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -80,7 +80,7 @@ func TestGetCgroupParamsInt(t *testing.T) {
 	}
 
 	// Not a float.
-	err = ioutil.WriteFile(tempFile, []byte("not-a-float"), 0755)
+	err = ioutil.WriteFile(tempFile, []byte("not-a-float"), 0o755)
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/libcontainer/cgroups/systemd/dbus.go b/libcontainer/cgroups/systemd/dbus.go
index 0f7406cd9..3c30f6bb9 100644
--- a/libcontainer/cgroups/systemd/dbus.go
+++ b/libcontainer/cgroups/systemd/dbus.go
@@ -17,8 +17,7 @@ var (
 	dbusRootless bool
 )
 
-type dbusConnManager struct {
-}
+type dbusConnManager struct{}
 
 // newDbusConnManager initializes systemd dbus connection manager.
 func newDbusConnManager(rootless bool) *dbusConnManager {
diff --git a/libcontainer/cgroups/systemd/systemd_test.go b/libcontainer/cgroups/systemd/systemd_test.go
index a32acc190..e4190fa5d 100644
--- a/libcontainer/cgroups/systemd/systemd_test.go
+++ b/libcontainer/cgroups/systemd/systemd_test.go
@@ -13,7 +13,7 @@ import (
 )
 
 func TestSystemdVersion(t *testing.T) {
-	var systemdVersionTests = []struct {
+	systemdVersionTests := []struct {
 		verStr      string
 		expectedVer int
 		expectErr   bool
diff --git a/libcontainer/cgroups/systemd/v1.go b/libcontainer/cgroups/systemd/v1.go
index 503d565f0..06526c54c 100644
--- a/libcontainer/cgroups/systemd/v1.go
+++ b/libcontainer/cgroups/systemd/v1.go
@@ -238,7 +238,7 @@ func (m *legacyManager) joinCgroups(pid int) error {
 			}
 		default:
 			if path, ok := m.paths[name]; ok {
-				if err := os.MkdirAll(path, 0755); err != nil {
+				if err := os.MkdirAll(path, 0o755); err != nil {
 					return err
 				}
 				if err := cgroups.WriteCgroupProc(path, pid); err != nil {
diff --git a/libcontainer/cgroups/utils.go b/libcontainer/cgroups/utils.go
index 35ce2c1c2..35de12dd8 100644
--- a/libcontainer/cgroups/utils.go
+++ b/libcontainer/cgroups/utils.go
@@ -267,7 +267,6 @@ func RemovePaths(paths map[string]string) (err error) {
 				case retries - 1:
 					logrus.WithError(err).Error("Failed to remove cgroup")
 				}
-
 			}
 			_, err := os.Stat(p)
 			// We need this strange way of checking cgroups existence because
diff --git a/libcontainer/cgroups/utils_test.go b/libcontainer/cgroups/utils_test.go
index f7ed4db1b..d0de02b25 100644
--- a/libcontainer/cgroups/utils_test.go
+++ b/libcontainer/cgroups/utils_test.go
@@ -388,7 +388,6 @@ func TestParseCgroupString(t *testing.T) {
 			}
 		}
 	}
-
 }
 
 func TestIgnoreCgroup2Mount(t *testing.T) {
diff --git a/libcontainer/configs/cgroup_unsupported.go b/libcontainer/configs/cgroup_unsupported.go
index c0c23d700..afbc05004 100644
--- a/libcontainer/configs/cgroup_unsupported.go
+++ b/libcontainer/configs/cgroup_unsupported.go
@@ -4,5 +4,4 @@ package configs
 
 // TODO Windows: This can ultimately be entirely factored out on Windows as
 // cgroups are a Unix-specific construct.
-type Cgroup struct {
-}
+type Cgroup struct{}
diff --git a/libcontainer/configs/config.go b/libcontainer/configs/config.go
index c6b259e9f..4281593f0 100644
--- a/libcontainer/configs/config.go
+++ b/libcontainer/configs/config.go
@@ -208,9 +208,11 @@ type Config struct {
 	RootlessCgroups bool `json:"rootless_cgroups,omitempty"`
 }
 
-type HookName string
-type HookList []Hook
-type Hooks map[HookName]HookList
+type (
+	HookName string
+	HookList []Hook
+	Hooks    map[HookName]HookList
+)
 
 const (
 	// Prestart commands are executed after the container namespaces are created,
diff --git a/libcontainer/configs/config_linux_test.go b/libcontainer/configs/config_linux_test.go
index 981b86b1f..68d33e61a 100644
--- a/libcontainer/configs/config_linux_test.go
+++ b/libcontainer/configs/config_linux_test.go
@@ -4,9 +4,7 @@ import (
 	"testing"
 )
 
-var (
-	HookNameList = []HookName{Prestart, CreateRuntime, CreateContainer, StartContainer, Poststart, Poststop}
-)
+var HookNameList = []HookName{Prestart, CreateRuntime, CreateContainer, StartContainer, Poststart, Poststop}
 
 func TestRemoveNamespace(t *testing.T) {
 	ns := Namespaces{
diff --git a/libcontainer/configs/config_test.go b/libcontainer/configs/config_test.go
index a270f3780..ca825153f 100644
--- a/libcontainer/configs/config_test.go
+++ b/libcontainer/configs/config_test.go
@@ -190,7 +190,7 @@ exit 0
 	verifyCommand := fmt.Sprintf(verifyCommandTemplate, stateJson)
 	filename := "/tmp/runc-hooktest.sh"
 	os.Remove(filename)
-	if err := ioutil.WriteFile(filename, []byte(verifyCommand), 0700); err != nil {
+	if err := ioutil.WriteFile(filename, []byte(verifyCommand), 0o700); err != nil {
 		t.Fatalf("Failed to create tmp file: %v", err)
 	}
 	defer os.Remove(filename)
diff --git a/libcontainer/configs/namespaces_unsupported.go b/libcontainer/configs/namespaces_unsupported.go
index 19bf713de..cc76e2f58 100644
--- a/libcontainer/configs/namespaces_unsupported.go
+++ b/libcontainer/configs/namespaces_unsupported.go
@@ -4,5 +4,4 @@ package configs
 
 // Namespace defines configuration for each namespace.  It specifies an
 // alternate path that is able to be joined via setns.
-type Namespace struct {
-}
+type Namespace struct{}
diff --git a/libcontainer/configs/validate/validator.go b/libcontainer/configs/validate/validator.go
index 02de2abc8..0b38b8bde 100644
--- a/libcontainer/configs/validate/validator.go
+++ b/libcontainer/configs/validate/validator.go
@@ -23,8 +23,7 @@ func New() Validator {
 	return &ConfigValidator{}
 }
 
-type ConfigValidator struct {
-}
+type ConfigValidator struct{}
 
 type check func(config *configs.Config) error
 
diff --git a/libcontainer/console_linux.go b/libcontainer/console_linux.go
index 9997e93ed..7bfff026a 100644
--- a/libcontainer/console_linux.go
+++ b/libcontainer/console_linux.go
@@ -9,7 +9,7 @@ import (
 // mount initializes the console inside the rootfs mounting with the specified mount label
 // and applying the correct ownership of the console.
 func mountConsole(slavePath string) error {
-	oldMask := unix.Umask(0000)
+	oldMask := unix.Umask(0o000)
 	defer unix.Umask(oldMask)
 	f, err := os.Create("/dev/console")
 	if err != nil && !os.IsExist(err) {
diff --git a/libcontainer/container_linux.go b/libcontainer/container_linux.go
index 5b65f8896..59a0b677a 100644
--- a/libcontainer/container_linux.go
+++ b/libcontainer/container_linux.go
@@ -437,8 +437,8 @@ func (c *linuxContainer) createExecFifo() error {
 	if _, err := os.Stat(fifoName); err == nil {
 		return fmt.Errorf("exec fifo %s already exists", fifoName)
 	}
-	oldMask := unix.Umask(0000)
-	if err := unix.Mkfifo(fifoName, 0622); err != nil {
+	oldMask := unix.Umask(0o000)
+	if err := unix.Mkfifo(fifoName, 0o622); err != nil {
 		unix.Umask(oldMask)
 		return err
 	}
@@ -699,7 +699,6 @@ func (c *linuxContainer) NotifyMemoryPressure(level PressureLevel) (<-chan struc
 var criuFeatures *criurpc.CriuFeatures
 
 func (c *linuxContainer) checkCriuFeatures(criuOpts *CriuOpts, rpcOpts *criurpc.CriuOpts, criuFeat *criurpc.CriuFeatures) error {
-
 	t := criurpc.CriuReqType_FEATURE_CHECK
 
 	// make sure the features we are looking for are really not from
@@ -761,7 +760,6 @@ func compareCriuVersion(criuVersion int, minVersion int) error {
 
 // checkCriuVersion checks Criu version greater than or equal to minVersion
 func (c *linuxContainer) checkCriuVersion(minVersion int) error {
-
 	// If the version of criu has already been determined there is no need
 	// to ask criu for the version again. Use the value from c.criuVersion.
 	if c.criuVersion != 0 {
@@ -970,7 +968,7 @@ func (c *linuxContainer) Checkpoint(criuOpts *CriuOpts) error {
 
 	// Since a container can be C/R'ed multiple times,
 	// the checkpoint directory may already exist.
-	if err := os.Mkdir(criuOpts.ImagesDirectory, 0700); err != nil && !os.IsExist(err) {
+	if err := os.Mkdir(criuOpts.ImagesDirectory, 0o700); err != nil && !os.IsExist(err) {
 		return err
 	}
 
@@ -978,7 +976,7 @@ func (c *linuxContainer) Checkpoint(criuOpts *CriuOpts) error {
 		criuOpts.WorkDirectory = filepath.Join(c.root, "criu.work")
 	}
 
-	if err := os.Mkdir(criuOpts.WorkDirectory, 0700); err != nil && !os.IsExist(err) {
+	if err := os.Mkdir(criuOpts.WorkDirectory, 0o700); err != nil && !os.IsExist(err) {
 		return err
 	}
 
@@ -1048,7 +1046,7 @@ func (c *linuxContainer) Checkpoint(criuOpts *CriuOpts) error {
 		}
 	}
 
-	//pre-dump may need parentImage param to complete iterative migration
+	// pre-dump may need parentImage param to complete iterative migration
 	if criuOpts.ParentImage != "" {
 		rpcOpts.ParentImg = proto.String(criuOpts.ParentImage)
 		rpcOpts.TrackMem = proto.Bool(true)
@@ -1146,7 +1144,7 @@ func (c *linuxContainer) Checkpoint(criuOpts *CriuOpts) error {
 			return err
 		}
 
-		err = ioutil.WriteFile(filepath.Join(criuOpts.ImagesDirectory, descriptorsFilename), fdsJSON, 0600)
+		err = ioutil.WriteFile(filepath.Join(criuOpts.ImagesDirectory, descriptorsFilename), fdsJSON, 0o600)
 		if err != nil {
 			return err
 		}
@@ -1217,7 +1215,7 @@ func (c *linuxContainer) makeCriuRestoreMountpoints(m *configs.Mount) error {
 		if err := checkProcMount(c.config.Rootfs, dest, ""); err != nil {
 			return err
 		}
-		if err := os.MkdirAll(dest, 0755); err != nil {
+		if err := os.MkdirAll(dest, 0o755); err != nil {
 			return err
 		}
 	}
@@ -1318,7 +1316,7 @@ func (c *linuxContainer) Restore(process *Process, criuOpts *CriuOpts) error {
 	}
 	// Since a container can be C/R'ed multiple times,
 	// the work directory may already exist.
-	if err := os.Mkdir(criuOpts.WorkDirectory, 0700); err != nil && !os.IsExist(err) {
+	if err := os.Mkdir(criuOpts.WorkDirectory, 0o700); err != nil && !os.IsExist(err) {
 		return err
 	}
 	workDir, err := os.Open(criuOpts.WorkDirectory)
@@ -1340,7 +1338,7 @@ func (c *linuxContainer) Restore(process *Process, criuOpts *CriuOpts) error {
 	// c.config.Rootfs is bind-mounted to a temporary directory
 	// to satisfy these requirements.
 	root := filepath.Join(c.root, "criu-root")
-	if err := os.Mkdir(root, 0755); err != nil {
+	if err := os.Mkdir(root, 0o755); err != nil {
 		return err
 	}
 	defer os.Remove(root)
diff --git a/libcontainer/container_linux_test.go b/libcontainer/container_linux_test.go
index 880998d9a..4072ec1a7 100644
--- a/libcontainer/container_linux_test.go
+++ b/libcontainer/container_linux_test.go
@@ -333,9 +333,7 @@ func TestGetContainerState(t *testing.T) {
 }
 
 func TestGetContainerStateAfterUpdate(t *testing.T) {
-	var (
-		pid = os.Getpid()
-	)
+	pid := os.Getpid()
 	stat, err := system.Stat(pid)
 	if err != nil {
 		t.Fatal(err)
diff --git a/libcontainer/devices/device_unix.go b/libcontainer/devices/device_unix.go
index acb816998..c7fb2f1a9 100644
--- a/libcontainer/devices/device_unix.go
+++ b/libcontainer/devices/device_unix.go
@@ -11,10 +11,8 @@ import (
 	"golang.org/x/sys/unix"
 )
 
-var (
-	// ErrNotADevice denotes that a file is not a valid linux device.
-	ErrNotADevice = errors.New("not a device node")
-)
+// ErrNotADevice denotes that a file is not a valid linux device.
+var ErrNotADevice = errors.New("not a device node")
 
 // Testing dependencies
 var (
diff --git a/libcontainer/factory_linux.go b/libcontainer/factory_linux.go
index b3beba81e..dbd410b88 100644
--- a/libcontainer/factory_linux.go
+++ b/libcontainer/factory_linux.go
@@ -291,7 +291,7 @@ func (l *LinuxFactory) Load(id string) (Container, error) {
 	if l.Root == "" {
 		return nil, newGenericError(fmt.Errorf("invalid root"), ConfigInvalid)
 	}
-	//when load, we need to check id is valid or not.
+	// when load, we need to check id is valid or not.
 	if err := l.validateID(id); err != nil {
 		return nil, err
 	}
diff --git a/libcontainer/integration/exec_test.go b/libcontainer/integration/exec_test.go
index 08f272d32..6c4860e65 100644
--- a/libcontainer/integration/exec_test.go
+++ b/libcontainer/integration/exec_test.go
@@ -894,7 +894,7 @@ func TestPassExtraFiles(t *testing.T) {
 	if out != "0 1 2 3 4 5" {
 		t.Fatalf("expected to have the file descriptors '0 1 2 3 4 5' passed to init, got '%s'", out)
 	}
-	var buf = []byte{0}
+	buf := []byte{0}
 	_, err = pipeout1.Read(buf)
 	ok(t, err)
 	out1 := string(buf)
@@ -1245,7 +1245,7 @@ func TestHook(t *testing.T) {
 	}
 
 	// write config of json format into config.json under bundle
-	f, err := os.OpenFile(filepath.Join(bundle, "config.json"), os.O_CREATE|os.O_RDWR, 0644)
+	f, err := os.OpenFile(filepath.Join(bundle, "config.json"), os.O_CREATE|os.O_RDWR, 0o644)
 	ok(t, err)
 	ok(t, json.NewEncoder(f).Encode(config))
 
@@ -1347,7 +1347,8 @@ func TestRootfsPropagationSlaveMount(t *testing.T) {
 		Source:      dir1host,
 		Destination: dir1cont,
 		Device:      "bind",
-		Flags:       unix.MS_BIND | unix.MS_REC})
+		Flags:       unix.MS_BIND | unix.MS_REC,
+	})
 
 	container, err := newContainer(t, config)
 	ok(t, err)
@@ -1462,7 +1463,8 @@ func TestRootfsPropagationSharedMount(t *testing.T) {
 		Source:      dir1host,
 		Destination: dir1cont,
 		Device:      "bind",
-		Flags:       unix.MS_BIND | unix.MS_REC})
+		Flags:       unix.MS_BIND | unix.MS_REC,
+	})
 
 	container, err := newContainer(t, config)
 	ok(t, err)
diff --git a/libcontainer/integration/execin_test.go b/libcontainer/integration/execin_test.go
index 8af903648..bfdbac028 100644
--- a/libcontainer/integration/execin_test.go
+++ b/libcontainer/integration/execin_test.go
@@ -461,7 +461,7 @@ func TestExecinPassExtraFiles(t *testing.T) {
 	if out != "0 1 2 3 4 5" {
 		t.Fatalf("expected to have the file descriptors '0 1 2 3 4 5' passed to exec, got '%s'", out)
 	}
-	var buf = []byte{0}
+	buf := []byte{0}
 	_, err = pipeout1.Read(buf)
 	ok(t, err)
 	out1 := string(buf)
diff --git a/libcontainer/integration/utils_test.go b/libcontainer/integration/utils_test.go
index f3d176bf4..0ffbf179b 100644
--- a/libcontainer/integration/utils_test.go
+++ b/libcontainer/integration/utils_test.go
@@ -103,7 +103,7 @@ func newTestRoot() (string, error) {
 	if err != nil {
 		return "", err
 	}
-	if err := os.MkdirAll(dir, 0700); err != nil {
+	if err := os.MkdirAll(dir, 0o700); err != nil {
 		return "", err
 	}
 	testRoots = append(testRoots, dir)
@@ -115,7 +115,7 @@ func newTestBundle() (string, error) {
 	if err != nil {
 		return "", err
 	}
-	if err := os.MkdirAll(dir, 0700); err != nil {
+	if err := os.MkdirAll(dir, 0o700); err != nil {
 		return "", err
 	}
 	return dir, nil
@@ -127,7 +127,7 @@ func newRootfs() (string, error) {
 	if err != nil {
 		return "", err
 	}
-	if err := os.MkdirAll(dir, 0700); err != nil {
+	if err := os.MkdirAll(dir, 0o700); err != nil {
 		return "", err
 	}
 	if err := copyBusybox(dir); err != nil {
diff --git a/libcontainer/intelrdt/cmt.go b/libcontainer/intelrdt/cmt.go
index ed950973f..6480a1306 100644
--- a/libcontainer/intelrdt/cmt.go
+++ b/libcontainer/intelrdt/cmt.go
@@ -1,8 +1,6 @@
 package intelrdt
 
-var (
-	cmtEnabled bool
-)
+var cmtEnabled bool
 
 // Check if Intel RDT/CMT is enabled.
 func IsCMTEnabled() bool {
diff --git a/libcontainer/intelrdt/mbm.go b/libcontainer/intelrdt/mbm.go
index 93063ee01..0fbecdeb2 100644
--- a/libcontainer/intelrdt/mbm.go
+++ b/libcontainer/intelrdt/mbm.go
@@ -2,10 +2,8 @@
 
 package intelrdt
 
-var (
-	// The flag to indicate if Intel RDT/MBM is enabled
-	mbmEnabled bool
-)
+// The flag to indicate if Intel RDT/MBM is enabled
+var mbmEnabled bool
 
 // Check if Intel RDT/MBM is enabled.
 func IsMBMEnabled() bool {
diff --git a/libcontainer/intelrdt/mbm_test.go b/libcontainer/intelrdt/mbm_test.go
index ae0f202cd..9949f1238 100644
--- a/libcontainer/intelrdt/mbm_test.go
+++ b/libcontainer/intelrdt/mbm_test.go
@@ -64,5 +64,4 @@ func checkMBMStatCorrection(got MBMNumaNodeStats, expected MBMNumaNodeStats, t *
 			expected.MBMLocalBytes,
 			got.MBMLocalBytes)
 	}
-
 }
diff --git a/libcontainer/intelrdt/monitoring.go b/libcontainer/intelrdt/monitoring.go
index 78c2f624c..547c15470 100644
--- a/libcontainer/intelrdt/monitoring.go
+++ b/libcontainer/intelrdt/monitoring.go
@@ -10,9 +10,7 @@ import (
 	"github.com/sirupsen/logrus"
 )
 
-var (
-	enabledMonFeatures monFeatures
-)
+var enabledMonFeatures monFeatures
 
 type monFeatures struct {
 	mbmTotalBytes bool
diff --git a/libcontainer/intelrdt/monitoring_test.go b/libcontainer/intelrdt/monitoring_test.go
index ad8afcff4..66ce830eb 100644
--- a/libcontainer/intelrdt/monitoring_test.go
+++ b/libcontainer/intelrdt/monitoring_test.go
@@ -26,7 +26,6 @@ func TestParseMonFeatures(t *testing.T) {
 
 	t.Run("No features available", func(t *testing.T) {
 		parsedMonFeatures, err := parseMonFeatures(strings.NewReader(""))
-
 		if err != nil {
 			t.Errorf("Error while parsing mon features err = %v", err)
 		}
diff --git a/libcontainer/logs/logs.go b/libcontainer/logs/logs.go
index 27b968466..6610a1aae 100644
--- a/libcontainer/logs/logs.go
+++ b/libcontainer/logs/logs.go
@@ -85,7 +85,7 @@ func ConfigureLogging(config Config) error {
 	if config.LogPipeFd > 0 {
 		logrus.SetOutput(os.NewFile(uintptr(config.LogPipeFd), "logpipe"))
 	} else if config.LogFilePath != "" {
-		f, err := os.OpenFile(config.LogFilePath, os.O_CREATE|os.O_WRONLY|os.O_APPEND|os.O_SYNC, 0644)
+		f, err := os.OpenFile(config.LogFilePath, os.O_CREATE|os.O_WRONLY|os.O_APPEND|os.O_SYNC, 0o644)
 		if err != nil {
 			return err
 		}
diff --git a/libcontainer/network_linux.go b/libcontainer/network_linux.go
index a0a87b984..12e5800fc 100644
--- a/libcontainer/network_linux.go
+++ b/libcontainer/network_linux.go
@@ -83,8 +83,7 @@ func readSysfsNetworkStats(ethInterface, statsFile string) (uint64, error) {
 }
 
 // loopback is a network strategy that provides a basic loopback device
-type loopback struct {
-}
+type loopback struct{}
 
 func (l *loopback) create(n *network, nspid int) error {
 	return nil
diff --git a/libcontainer/notify_linux.go b/libcontainer/notify_linux.go
index d7d1de1ba..73a6f5946 100644
--- a/libcontainer/notify_linux.go
+++ b/libcontainer/notify_linux.go
@@ -35,7 +35,7 @@ func registerMemoryEvent(cgDir string, evName string, arg string) (<-chan struct
 
 	eventControlPath := filepath.Join(cgDir, "cgroup.event_control")
 	data := fmt.Sprintf("%d %d %s", eventfd.Fd(), evFile.Fd(), arg)
-	if err := ioutil.WriteFile(eventControlPath, []byte(data), 0700); err != nil {
+	if err := ioutil.WriteFile(eventControlPath, []byte(data), 0o700); err != nil {
 		eventfd.Close()
 		evFile.Close()
 		return nil, err
diff --git a/libcontainer/notify_linux_test.go b/libcontainer/notify_linux_test.go
index 6f8b6d307..b14cfc91e 100644
--- a/libcontainer/notify_linux_test.go
+++ b/libcontainer/notify_linux_test.go
@@ -23,10 +23,10 @@ func testMemoryNotification(t *testing.T, evName string, notify notifyFunc, targ
 	}
 	evFile := filepath.Join(memoryPath, evName)
 	eventPath := filepath.Join(memoryPath, "cgroup.event_control")
-	if err := ioutil.WriteFile(evFile, []byte{}, 0700); err != nil {
+	if err := ioutil.WriteFile(evFile, []byte{}, 0o700); err != nil {
 		t.Fatal(err)
 	}
-	if err := ioutil.WriteFile(eventPath, []byte{}, 0700); err != nil {
+	if err := ioutil.WriteFile(eventPath, []byte{}, 0o700); err != nil {
 		t.Fatal(err)
 	}
 	ch, err := notify(memoryPath)
diff --git a/libcontainer/restored_process.go b/libcontainer/restored_process.go
index 97565d7fa..34270e64e 100644
--- a/libcontainer/restored_process.go
+++ b/libcontainer/restored_process.go
@@ -11,9 +11,7 @@ import (
 )
 
 func newRestoredProcess(cmd *exec.Cmd, fds []string) (*restoredProcess, error) {
-	var (
-		err error
-	)
+	var err error
 	pid := cmd.Process.Pid
 	stat, err := system.Stat(pid)
 	if err != nil {
diff --git a/libcontainer/rootfs_linux.go b/libcontainer/rootfs_linux.go
index ff91b3dbc..430f490de 100644
--- a/libcontainer/rootfs_linux.go
+++ b/libcontainer/rootfs_linux.go
@@ -143,7 +143,7 @@ func prepareRootfs(pipe io.ReadWriter, iConfig *initConfig) (err error) {
 	if cwd := iConfig.Cwd; cwd != "" {
 		// Note that spec.Process.Cwd can contain unclean value like  "../../../../foo/bar...".
 		// However, we are safe to call MkDirAll directly because we are in the jail here.
-		if err := os.MkdirAll(cwd, 0755); err != nil {
+		if err := os.MkdirAll(cwd, 0o755); err != nil {
 			return err
 		}
 	}
@@ -176,7 +176,7 @@ func finalizeRootfs(config *configs.Config) (err error) {
 	if config.Umask != nil {
 		unix.Umask(int(*config.Umask))
 	} else {
-		unix.Umask(0022)
+		unix.Umask(0o022)
 	}
 	return nil
 }
@@ -262,7 +262,7 @@ func mountCgroupV1(m *configs.Mount, c *mountConfig) error {
 	for _, b := range binds {
 		if c.cgroupns {
 			subsystemPath := filepath.Join(c.root, b.Destination)
-			if err := os.MkdirAll(subsystemPath, 0755); err != nil {
+			if err := os.MkdirAll(subsystemPath, 0o755); err != nil {
 				return err
 			}
 			if err := utils.WithProcfd(c.root, b.Destination, func(procfd string) error {
@@ -306,7 +306,7 @@ func mountCgroupV2(m *configs.Mount, c *mountConfig) error {
 	if err != nil {
 		return err
 	}
-	if err := os.MkdirAll(dest, 0755); err != nil {
+	if err := os.MkdirAll(dest, 0o755); err != nil {
 		return err
 	}
 	return utils.WithProcfd(c.root, m.Destination, func(procfd string) error {
@@ -398,13 +398,13 @@ func mountToRootfs(m *configs.Mount, c *mountConfig) error {
 		} else if fi.Mode()&os.ModeDir == 0 {
 			return fmt.Errorf("filesystem %q must be mounted on ordinary directory", m.Device)
 		}
-		if err := os.MkdirAll(dest, 0755); err != nil {
+		if err := os.MkdirAll(dest, 0o755); err != nil {
 			return err
 		}
 		// Selinux kernels do not support labeling of /proc or /sys
 		return mountPropagate(m, rootfs, "")
 	case "mqueue":
-		if err := os.MkdirAll(dest, 0755); err != nil {
+		if err := os.MkdirAll(dest, 0o755); err != nil {
 			return err
 		}
 		if err := mountPropagate(m, rootfs, ""); err != nil {
@@ -414,7 +414,7 @@ func mountToRootfs(m *configs.Mount, c *mountConfig) error {
 	case "tmpfs":
 		stat, err := os.Stat(dest)
 		if err != nil {
-			if err := os.MkdirAll(dest, 0755); err != nil {
+			if err := os.MkdirAll(dest, 0o755); err != nil {
 				return err
 			}
 		}
@@ -473,7 +473,7 @@ func mountToRootfs(m *configs.Mount, c *mountConfig) error {
 		if err := checkProcMount(rootfs, dest, m.Source); err != nil {
 			return err
 		}
-		if err := os.MkdirAll(dest, 0755); err != nil {
+		if err := os.MkdirAll(dest, 0o755); err != nil {
 			return err
 		}
 		return mountPropagate(m, rootfs, mountLabel)
@@ -582,7 +582,7 @@ func isProc(path string) (bool, error) {
 }
 
 func setupDevSymlinks(rootfs string) error {
-	var links = [][2]string{
+	links := [][2]string{
 		{"/proc/self/fd", "/dev/fd"},
 		{"/proc/self/fd/0", "/dev/stdin"},
 		{"/proc/self/fd/1", "/dev/stdout"},
@@ -636,7 +636,7 @@ func reOpenDevNull() error {
 // Create the device nodes in the container.
 func createDevices(config *configs.Config) error {
 	useBindMount := userns.RunningInUserNS() || config.Namespaces.Contains(configs.NEWUSER)
-	oldMask := unix.Umask(0000)
+	oldMask := unix.Umask(0o000)
 	for _, node := range config.Devices {
 
 		// The /dev/ptmx device is setup by setupPtmx()
@@ -678,7 +678,7 @@ func createDeviceNode(rootfs string, node *devices.Device, bind bool) error {
 	if err != nil {
 		return err
 	}
-	if err := os.MkdirAll(filepath.Dir(dest), 0755); err != nil {
+	if err := os.MkdirAll(filepath.Dir(dest), 0o755); err != nil {
 		return err
 	}
 	if bind {
@@ -799,7 +799,6 @@ func setReadonly() error {
 	}
 	flags |= uintptr(s.Flags)
 	return unix.Mount("", "/", "", flags, "")
-
 }
 
 func setupPtmx(config *configs.Config) error {
@@ -947,12 +946,12 @@ func createIfNotExists(path string, isDir bool) error {
 	if _, err := os.Stat(path); err != nil {
 		if os.IsNotExist(err) {
 			if isDir {
-				return os.MkdirAll(path, 0755)
+				return os.MkdirAll(path, 0o755)
 			}
-			if err := os.MkdirAll(filepath.Dir(path), 0755); err != nil {
+			if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
 				return err
 			}
-			f, err := os.OpenFile(path, os.O_CREATE, 0755)
+			f, err := os.OpenFile(path, os.O_CREATE, 0o755)
 			if err != nil {
 				return err
 			}
@@ -1031,7 +1030,7 @@ func maskPath(path string, mountLabel string) error {
 // For e.g. net.ipv4.ip_forward translated to /proc/sys/net/ipv4/ip_forward.
 func writeSystemProperty(key, value string) error {
 	keyPath := strings.Replace(key, ".", "/", -1)
-	return ioutil.WriteFile(path.Join("/proc/sys", keyPath), []byte(value), 0644)
+	return ioutil.WriteFile(path.Join("/proc/sys", keyPath), []byte(value), 0o644)
 }
 
 func remount(m *configs.Mount, rootfs string) error {
diff --git a/libcontainer/seccomp/patchbpf/enosys_linux.go b/libcontainer/seccomp/patchbpf/enosys_linux.go
index a8432bfd4..3c6ef7a4c 100644
--- a/libcontainer/seccomp/patchbpf/enosys_linux.go
+++ b/libcontainer/seccomp/patchbpf/enosys_linux.go
@@ -324,7 +324,8 @@ func generateEnosysStub(lastSyscalls lastSyscallMap) ([]bpf.Instruction, error)
 					bpf.JumpIf{
 						Cond:     bpf.JumpGreaterThan,
 						Val:      uint32(sysno),
-						SkipTrue: uint8(baseJumpEnosys + 1)},
+						SkipTrue: uint8(baseJumpEnosys + 1),
+					},
 					// ja [baseJumpFilter]
 					bpf.Jump{Skip: baseJumpFilter},
 				}
@@ -353,16 +354,20 @@ func generateEnosysStub(lastSyscalls lastSyscallMap) ([]bpf.Instruction, error)
 				case libseccomp.ArchAMD64:
 					sectionTail = append([]bpf.Instruction{
 						// jset (1<<30),[len(tail)-1]
-						bpf.JumpIf{Cond: bpf.JumpBitsSet,
+						bpf.JumpIf{
+							Cond:     bpf.JumpBitsSet,
 							Val:      1 << 30,
-							SkipTrue: uint8(len(sectionTail) - 1)},
+							SkipTrue: uint8(len(sectionTail) - 1),
+						},
 					}, sectionTail...)
 				case libseccomp.ArchX32:
 					sectionTail = append([]bpf.Instruction{
 						// jset (1<<30),0,[len(tail)-1]
-						bpf.JumpIf{Cond: bpf.JumpBitsNotSet,
+						bpf.JumpIf{
+							Cond:     bpf.JumpBitsNotSet,
 							Val:      1 << 30,
-							SkipTrue: uint8(len(sectionTail) - 1)},
+							SkipTrue: uint8(len(sectionTail) - 1),
+						},
 					}, sectionTail...)
 				default:
 					return nil, errors.Errorf("unknown amd64 native architecture %#x", scmpArch)
@@ -402,12 +407,14 @@ func generateEnosysStub(lastSyscalls lastSyscallMap) ([]bpf.Instruction, error)
 					bpf.JumpIf{
 						Cond:     bpf.JumpGreaterThan,
 						Val:      uint32(x86sysno),
-						SkipTrue: uint8(baseJumpEnosys + 2), SkipFalse: 1},
+						SkipTrue: uint8(baseJumpEnosys + 2), SkipFalse: 1,
+					},
 					// jgt [x32 syscall],[baseJumpEnosys]
 					bpf.JumpIf{
 						Cond:     bpf.JumpGreaterThan,
 						Val:      uint32(x32sysno),
-						SkipTrue: uint8(baseJumpEnosys + 1)},
+						SkipTrue: uint8(baseJumpEnosys + 1),
+					},
 					// ja [baseJumpFilter]
 					bpf.Jump{Skip: baseJumpFilter},
 				}...)
@@ -426,12 +433,14 @@ func generateEnosysStub(lastSyscalls lastSyscallMap) ([]bpf.Instruction, error)
 					bpf.JumpIf{
 						Cond:     bpf.JumpGreaterThan,
 						Val:      uint32(x86sysno),
-						SkipTrue: 1, SkipFalse: 2},
+						SkipTrue: 1, SkipFalse: 2,
+					},
 					// jle [x32 syscall],[baseJumpEnosys]
 					bpf.JumpIf{
 						Cond:     bpf.JumpLessOrEqual,
 						Val:      uint32(x32sysno),
-						SkipTrue: 1},
+						SkipTrue: 1,
+					},
 					// ja [baseJumpEnosys+1]
 					bpf.Jump{Skip: baseJumpEnosys + 1},
 					// ja [baseJumpFilter]
@@ -478,7 +487,8 @@ func generateEnosysStub(lastSyscalls lastSyscallMap) ([]bpf.Instruction, error)
 				bpf.JumpIf{
 					Cond:     bpf.JumpEqual,
 					Val:      uint32(nativeArch),
-					SkipTrue: uint8(jump)},
+					SkipTrue: uint8(jump),
+				},
 			}, programTail...)
 		} else {
 			programTail = append([]bpf.Instruction{
@@ -486,7 +496,8 @@ func generateEnosysStub(lastSyscalls lastSyscallMap) ([]bpf.Instruction, error)
 				bpf.JumpIf{
 					Cond:     bpf.JumpNotEqual,
 					Val:      uint32(nativeArch),
-					SkipTrue: 1},
+					SkipTrue: 1,
+				},
 				// ja [jump]
 				bpf.Jump{Skip: jump},
 			}, programTail...)
diff --git a/libcontainer/specconv/spec_linux.go b/libcontainer/specconv/spec_linux.go
index 0c99a67ac..ac83123df 100644
--- a/libcontainer/specconv/spec_linux.go
+++ b/libcontainer/specconv/spec_linux.go
@@ -85,7 +85,7 @@ var AllowedDevices = []*devices.Device{
 	},
 	{
 		Path:     "/dev/null",
-		FileMode: 0666,
+		FileMode: 0o666,
 		Uid:      0,
 		Gid:      0,
 		Rule: devices.Rule{
@@ -98,7 +98,7 @@ var AllowedDevices = []*devices.Device{
 	},
 	{
 		Path:     "/dev/random",
-		FileMode: 0666,
+		FileMode: 0o666,
 		Uid:      0,
 		Gid:      0,
 		Rule: devices.Rule{
@@ -111,7 +111,7 @@ var AllowedDevices = []*devices.Device{
 	},
 	{
 		Path:     "/dev/full",
-		FileMode: 0666,
+		FileMode: 0o666,
 		Uid:      0,
 		Gid:      0,
 		Rule: devices.Rule{
@@ -124,7 +124,7 @@ var AllowedDevices = []*devices.Device{
 	},
 	{
 		Path:     "/dev/tty",
-		FileMode: 0666,
+		FileMode: 0o666,
 		Uid:      0,
 		Gid:      0,
 		Rule: devices.Rule{
@@ -137,7 +137,7 @@ var AllowedDevices = []*devices.Device{
 	},
 	{
 		Path:     "/dev/zero",
-		FileMode: 0666,
+		FileMode: 0o666,
 		Uid:      0,
 		Gid:      0,
 		Rule: devices.Rule{
@@ -150,7 +150,7 @@ var AllowedDevices = []*devices.Device{
 	},
 	{
 		Path:     "/dev/urandom",
-		FileMode: 0666,
+		FileMode: 0o666,
 		Uid:      0,
 		Gid:      0,
 		Rule: devices.Rule{
@@ -533,7 +533,7 @@ func CreateCgroupConfig(opts *CreateOpts, defaultDevs []*devices.Device) (*confi
 				if r.CPU.Shares != nil {
 					c.Resources.CpuShares = *r.CPU.Shares
 
-					//CpuWeight is used for cgroupv2 and should be converted
+					// CpuWeight is used for cgroupv2 and should be converted
 					c.Resources.CpuWeight = cgroups.ConvertCPUSharesToCgroupV2Value(c.Resources.CpuShares)
 				}
 				if r.CPU.Quota != nil {
@@ -691,7 +691,7 @@ next:
 	if spec.Linux != nil {
 		for _, d := range spec.Linux.Devices {
 			var uid, gid uint32
-			var filemode os.FileMode = 0666
+			var filemode os.FileMode = 0o666
 
 			if d.UID != nil {
 				uid = *d.UID
diff --git a/libcontainer/specconv/spec_linux_test.go b/libcontainer/specconv/spec_linux_test.go
index 1a0aae9a2..316a21e87 100644
--- a/libcontainer/specconv/spec_linux_test.go
+++ b/libcontainer/specconv/spec_linux_test.go
@@ -139,8 +139,8 @@ func TestCreateHooks(t *testing.T) {
 	if len(poststop) != 4 {
 		t.Error("Expected 4 Poststop hooks")
 	}
-
 }
+
 func TestSetupSeccomp(t *testing.T) {
 	conf := &specs.LinuxSeccomp{
 		DefaultAction: "SCMP_ACT_ERRNO",
@@ -173,7 +173,6 @@ func TestSetupSeccomp(t *testing.T) {
 		},
 	}
 	seccomp, err := SetupSeccomp(conf)
-
 	if err != nil {
 		t.Errorf("Couldn't create Seccomp config: %v", err)
 	}
@@ -214,7 +213,6 @@ func TestSetupSeccomp(t *testing.T) {
 		}
 
 	}
-
 }
 
 func TestLinuxCgroupWithMemoryResource(t *testing.T) {
@@ -298,7 +296,6 @@ func TestLinuxCgroupSystemd(t *testing.T) {
 	}
 
 	cgroup, err := CreateCgroupConfig(opts, nil)
-
 	if err != nil {
 		t.Errorf("Couldn't create Cgroup config: %v", err)
 	}
@@ -334,7 +331,6 @@ func TestLinuxCgroupSystemdWithEmptyPath(t *testing.T) {
 	}
 
 	cgroup, err := CreateCgroupConfig(opts, nil)
-
 	if err != nil {
 		t.Errorf("Couldn't create Cgroup config: %v", err)
 	}
@@ -373,6 +369,7 @@ func TestLinuxCgroupSystemdWithInvalidPath(t *testing.T) {
 		t.Error("Expected to produce an error if not using the correct format for cgroup paths belonging to systemd")
 	}
 }
+
 func TestLinuxCgroupsPathSpecified(t *testing.T) {
 	cgroupsPath := "/user/cgroups/path/id"
 
@@ -603,7 +600,7 @@ func TestInitSystemdProps(t *testing.T) {
 		spec.Annotations = map[string]string{tc.in.name: tc.in.value}
 
 		outMap, err := initSystemdProps(spec)
-		//t.Logf("input %+v, expected %+v, got err:%v out:%+v", tc.in, tc.exp, err, outMap)
+		// t.Logf("input %+v, expected %+v, got err:%v out:%+v", tc.in, tc.exp, err, outMap)
 
 		if tc.exp.isErr != (err != nil) {
 			t.Errorf("input %+v, expecting error: %v, got %v", tc.in, tc.exp.isErr, err)
@@ -637,7 +634,6 @@ func TestNullProcess(t *testing.T) {
 	_, err := CreateLibcontainerConfig(&CreateOpts{
 		Spec: spec,
 	})
-
 	if err != nil {
 		t.Errorf("Null process should be forbidden")
 	}
@@ -650,7 +646,7 @@ func TestCreateDevices(t *testing.T) {
 	// preferred the spec's device over the redundant default device
 	ttyUid := uint32(1000)
 	ttyGid := uint32(1000)
-	fm := os.FileMode(0666)
+	fm := os.FileMode(0o666)
 
 	spec.Linux = &specs.Linux{
 		Devices: []specs.LinuxDevice{
@@ -718,7 +714,7 @@ func TestCreateDevices(t *testing.T) {
 		if configDev.Path == "/dev/tty" {
 			wantDev := &devices.Device{
 				Path:     "/dev/tty",
-				FileMode: 0666,
+				FileMode: 0o666,
 				Uid:      1000,
 				Gid:      1000,
 				Rule: devices.Rule{
diff --git a/libcontainer/stacktrace/capture.go b/libcontainer/stacktrace/capture.go
index 0bbe14950..bfb89157b 100644
--- a/libcontainer/stacktrace/capture.go
+++ b/libcontainer/stacktrace/capture.go
@@ -13,8 +13,8 @@ func Capture(userSkip int) Stacktrace {
 	)
 	for i := skip; ; i++ {
 		pc, file, line, ok := runtime.Caller(i)
-		//detect if caller is repeated to avoid loop, gccgo
-		//currently runs  into a loop without this check
+		// detect if caller is repeated to avoid loop, gccgo
+		// currently runs  into a loop without this check
 		if !ok || pc == prevPc {
 			break
 		}
diff --git a/libcontainer/user/user.go b/libcontainer/user/user.go
index 68da4400d..110860b4e 100644
--- a/libcontainer/user/user.go
+++ b/libcontainer/user/user.go
@@ -12,7 +12,7 @@ import (
 
 const (
 	minId = 0
-	maxId = 1<<31 - 1 //for 32-bit systems compatibility
+	maxId = 1<<31 - 1 // for 32-bit systems compatibility
 )
 
 var (
@@ -401,7 +401,7 @@ func GetExecUser(userSpec string, defaults *ExecUser, passwd, group io.Reader) (
 // or the given group data is nil, the id will be returned as-is
 // provided it is in the legal range.
 func GetAdditionalGroups(additionalGroups []string, group io.Reader) ([]int, error) {
-	var groups = []Group{}
+	groups := []Group{}
 	if group != nil {
 		var err error
 		groups, err = ParseGroupFilter(group, func(g Group) bool {
diff --git a/libcontainer/utils/utils_test.go b/libcontainer/utils/utils_test.go
index d33662238..4dc951c6f 100644
--- a/libcontainer/utils/utils_test.go
+++ b/libcontainer/utils/utils_test.go
@@ -32,7 +32,7 @@ func TestSearchLabels(t *testing.T) {
 
 func TestResolveRootfs(t *testing.T) {
 	dir := "rootfs"
-	if err := os.Mkdir(dir, 0600); err != nil {
+	if err := os.Mkdir(dir, 0o600); err != nil {
 		t.Fatal(err)
 	}
 	defer os.Remove(dir)
diff --git a/list.go b/list.go
index 04dfca074..5a1c08503 100644
--- a/list.go
+++ b/list.go
@@ -3,6 +3,7 @@
 package main
 
 import (
+	"encoding/json"
 	"errors"
 	"fmt"
 	"io/ioutil"
@@ -12,8 +13,6 @@ import (
 	"text/tabwriter"
 	"time"
 
-	"encoding/json"
-
 	"github.com/opencontainers/runc/libcontainer"
 	"github.com/opencontainers/runc/libcontainer/user"
 	"github.com/opencontainers/runc/libcontainer/utils"
diff --git a/main.go b/main.go
index ba5e3c828..db29a8c19 100644
--- a/main.go
+++ b/main.go
@@ -137,7 +137,7 @@ func main() {
 			// According to the XDG specification, we need to set anything in
 			// XDG_RUNTIME_DIR to have a sticky bit if we don't want it to get
 			// auto-pruned.
-			if err := os.MkdirAll(root, 0700); err != nil {
+			if err := os.MkdirAll(root, 0o700); err != nil {
 				fmt.Fprintln(os.Stderr, "the path in $XDG_RUNTIME_DIR must be writable by the user")
 				fatal(err)
 			}
diff --git a/notify_socket.go b/notify_socket.go
index bb1dad778..e578dbf8a 100644
--- a/notify_socket.go
+++ b/notify_socket.go
@@ -68,7 +68,7 @@ func (s *notifySocket) bindSocket() error {
 		return err
 	}
 
-	err = os.Chmod(s.socketPath, 0777)
+	err = os.Chmod(s.socketPath, 0o777)
 	if err != nil {
 		socket.Close()
 		return err
@@ -79,7 +79,7 @@ func (s *notifySocket) bindSocket() error {
 }
 
 func (s *notifySocket) setupSocketDirectory() error {
-	return os.Mkdir(path.Dir(s.socketPath), 0755)
+	return os.Mkdir(path.Dir(s.socketPath), 0o755)
 }
 
 func notifySocketStart(context *cli.Context, notifySocketHost, id string) (*notifySocket, error) {
diff --git a/rlimit_linux.go b/rlimit_linux.go
index c94629511..1f7a20534 100644
--- a/rlimit_linux.go
+++ b/rlimit_linux.go
@@ -1,7 +1,10 @@
 package main
 
-import "fmt"
-import "golang.org/x/sys/unix"
+import (
+	"fmt"
+
+	"golang.org/x/sys/unix"
+)
 
 var rlimitMap = map[string]int{
 	"RLIMIT_CPU":        unix.RLIMIT_CPU,
diff --git a/spec.go b/spec.go
index 322a83d7a..4dc4c028b 100644
--- a/spec.go
+++ b/spec.go
@@ -111,7 +111,7 @@ created by an unprivileged user.
 		if err != nil {
 			return err
 		}
-		return ioutil.WriteFile(specConfig, data, 0666)
+		return ioutil.WriteFile(specConfig, data, 0o666)
 	},
 }
 
diff --git a/update.go b/update.go
index 127a6e71d..ce89de083 100644
--- a/update.go
+++ b/update.go
@@ -286,7 +286,7 @@ other options are ignored.
 		}
 
 		config.Cgroups.Resources.CpuShares = *r.CPU.Shares
-		//CpuWeight is used for cgroupv2 and should be converted
+		// CpuWeight is used for cgroupv2 and should be converted
 		config.Cgroups.Resources.CpuWeight = cgroups.ConvertCPUSharesToCgroupV2Value(*r.CPU.Shares)
 		config.Cgroups.Resources.CpuRtPeriod = *r.CPU.RealtimePeriod
 		config.Cgroups.Resources.CpuRtRuntime = *r.CPU.RealtimeRuntime
diff --git a/utils_linux.go b/utils_linux.go
index 8241d4232..4cfe88285 100644
--- a/utils_linux.go
+++ b/utils_linux.go
@@ -209,7 +209,7 @@ func createPidFile(path string, process *libcontainer.Process) error {
 		tmpDir  = filepath.Dir(path)
 		tmpName = filepath.Join(tmpDir, "."+filepath.Base(path))
 	)
-	f, err := os.OpenFile(tmpName, os.O_RDWR|os.O_CREATE|os.O_EXCL|os.O_SYNC, 0666)
+	f, err := os.OpenFile(tmpName, os.O_RDWR|os.O_CREATE|os.O_EXCL|os.O_SYNC, 0o666)
 	if err != nil {
 		return err
 	}
@@ -296,9 +296,7 @@ func (r *runner) run(config *specs.Process) (int, error) {
 	if err != nil {
 		return -1, err
 	}
-	var (
-		detach = r.detach || (r.action == CT_ACT_CREATE)
-	)
+	detach := r.detach || (r.action == CT_ACT_CREATE)
 	// Setting up IO is a two stage process. We need to modify process to deal
 	// with detaching containers, and then we get a tty after the container has
 	// started.