sandboxsetup: export gofer mount setup functions for reuse

[shayonj]

Building a custom gVisor gofer that serves LisaFS-backed volumes requires
duplicating unexported mount setup code from runsc/cmd/gofer.go.
These are Gofer struct methods (setupRootFS, setupMounts, setupDev,
resolveMounts, writeMounts) that must be manually re-synced on every gVisor
version bump.

This is a continuation of the work in #12902 which exported standalone utility
functions. The remaining methods only access struct fields for mount
configurations, device FDs, and mount FDs that can be passed as explicit
parameters.

To avoid importing the heavy runsc/boot package from sandboxsetup, this change
moves GoferMountConf and related types from runsc/boot to runsc/specutils
(replacing the erofs.Name import with a hardcoded "erofs" string, consistent
with specutils.IsErofsMount). The boot package re-exports these via type
aliases for backward compatibility. sandboxsetup now uses the concrete
specutils.GoferMountConf type directly instead of an interface.

Also introduces a MountOpener callback to avoid importing runsc/container.

And fixes a nil pointer dereference in setupMounts where srcFile.Close()
was called unconditionally, but srcFile is nil when unix.Access succeeds.

[shayonj]

cc @EtiennePerot / @ayushr2 🙏🏾

[ayushr2]

Hmm I wonder if boot.GoferMountConf should be refactored out to a lighter package. Maybe specutils is a good place to hold such configuration.

The issue with interfaces is that when you convert a simple struct like boot.GoferMountConf to MountConf interface, Go runtime will heap allocate it. I think we're OK passing boot.GoferMountConf around by value and copying it, it is quite tiny (2 bytes + string).

[ayushr2]

I think you'd need to move the entirety of runsc/boot/gofer_conf.go. It has a dependency on fsimpl/erofs, because it wants to use erofs.Name. It is OK to do that in boot package but when this is refactored, you should not carry forward that dependency. This is similar to what specutils already does (just hard-codes the string "erofs":

gvisor/runsc/specutils/specutils.go

Lines 530 to 533 in ab52a70

	// IsErofsMount returns true if the given mount can be mounted as EROFS.
	func IsErofsMount(m specs.Mount) bool {
	return m.Type == "erofs"
	}

[shayonj]

Absolutely, makes sense. I did noticed the erofs.Name import but didn't search beyond that to see if there were any more. The interface was a sort of a deliberate choice to avoid the boot import without touching existing import sites, but you're right that moving the concrete type to a lighter package is cleaner as it avoids the interface indirection entirely and sandboxsetup already depends on specutils.

Updated