runtime: container-aware GOMAXPROCS silently disabled when an nsfs mountinfo line precedes the cgroup mount #81864

#!/usr/bin/env bash
# Public, self-contained repro for the Go cgroup-mount-ordering GOMAXPROCS bug.
# Requires only a working Docker and public images:
# golang:1.26 (build) and debian:stable-slim (run).
set -euo pipefail

workdir="$(mktemp -d)"
cat > "$workdir/main.go" <<'EOF'
package main

import (
	"fmt"
	"runtime"
)

func main() {
	fmt.Printf("NumCPU=%d\n", runtime.NumCPU())
	fmt.Printf("GOMAXPROCS=%d\n", runtime.GOMAXPROCS(0))
}
EOF
cat > "$workdir/go.mod" <<'EOF'
module gomaxprocsrepro

go 1.25
EOF

echo "--- building static linux/arm64 binary with golang:1.27.1 ---"
echo docker run --rm -v "$workdir":/src -w /src -e CGO_ENABLED=0 golang:1.27.1 \
  go build -o gomaxprocs main.go
docker run --rm -v "$workdir":/src -w /src -e CGO_ENABLED=0 golang:1.27.1 \
  go build -o gomaxprocs main.go

echo "--- base container: --cpus=2 gives GOMAXPROCS=2 when NumCPU is greater ---"
docker run --rm --privileged --cpus=2 \
  -v "$workdir/gomaxprocs":/gomaxprocs:ro debian:stable-slim bash -c '
set -e
echo -- /proc/self/mountinfo --
grep -E "cgroup|nsfs" /proc/self/mountinfo
echo -- /sys/fs/cgroup/cpu.max --
cat /sys/fs/cgroup/cpu.max
echo -- /gomaxprocs output --
/gomaxprocs
'

echo
echo "--- reproduction: nsfs mount created then cgroup2 is remounted ---"
docker run --rm --privileged --cpus=2 \
  -v "$workdir/gomaxprocs":/gomaxprocs:ro debian:stable-slim bash -c '
set -e
apt-get update -qq >/dev/null 2>&1
apt-get install -y -qq iproute2 >/dev/null 2>&1

mkdir -p /run/netns
mount -t tmpfs tmpfs /run/netns
ip netns add foo

echo "[mountinfo baseline: cgroup2 line comes first]"
echo -- /proc/self/mountinfo --
grep -E "cgroup|nsfs" /proc/self/mountinfo
echo -- /sys/fs/cgroup/cpu.max --
cat /sys/fs/cgroup/cpu.max
echo -- /gomaxprocs output --
/gomaxprocs

# Remount cgroup2 so its mountinfo line now comes AFTER the nsfs line
# (this simulates any sequence of events on a long-lived host where a
# netns is created before the cgroup controller is (re)mounted/remounted,
# e.g. container runtime restart, cgroup migration, etc).
umount /sys/fs/cgroup
mount -t cgroup2 -o nosuid,nodev,noexec,relatime cgroup /sys/fs/cgroup

echo "[mountinfo after remount: nsfs line now comes first]"
echo -- /proc/self/mountinfo --
grep -E "cgroup|nsfs" /proc/self/mountinfo
echo -- /sys/fs/cgroup/cpu.max --
cat /sys/fs/cgroup/cpu.max
echo -- /gomaxprocs output --
/gomaxprocs
'

rm -rf "$workdir"