Annotations 从 libcontainer 状态返回包路径和用户定义的注释。我们需要删除包，因为这是 libcontainer 添加的标签。.

ProcThreadSelf returns a string that is equivalent to /proc/thread-self/<subpath>, with a graceful fallback on older kernels where /proc/thread-self doesn't exist.

ProcThreadSelfFd is small wrapper around ProcThreadSelf to make it easier to create a /proc/thread-self handle for given file descriptor.

RecvFile waits for a file descriptor to be sent over the given AF_UNIX socket.

SendFile sends a file over the given AF_UNIX socket.

SendRawFd sends a specific file descriptor over the given AF_UNIX socket.

UnsafeCloseFrom closes all file descriptors greater or equal to minFd in the current process, except for those critical to Go's runtime (such as the netpoll management descriptors).

WithProcfd 在根目录内解析的不安全路径对应的 procfd 路径（/proc/self/fd/...）上运行传入的闭包。 在传递 fd 之前，会验证此路径是否位于根目录内——因此通过传入的 fdpath 对其进行操作应该是安全的。 不要通过原始的路径字符串访问此路径，也不要尝试在传入的闭包之外使用该路径名（文件句柄将在闭包返回后释放）。.

WriteJSON writes the provided struct v to w using standard json marshaling without a trailing newline.