[project] change syscall to /x/sys/unix|windows

Changes most references of syscall to golang.org/x/sys/
Ones aren't changes include, Errno, Signal and SysProcAttr
as they haven't been implemented in /x/sys/.

Signed-off-by: Christopher Jones <tophj@linux.vnet.ibm.com>

[s390x] switch utsname from unsigned to signed

per https://github.com/golang/sys/commit/33267e036fd93fcd26ea95b7bdaf2d8306cb743c
char in s390x in the /x/sys/unix package is now signed, so
change the buildtags

Signed-off-by: Christopher Jones <tophj@linux.vnet.ibm.com>

cmd/dockerd/daemon_solaris.go

@@ -7,10 +7,10 @@ import (
 	"net"
 	"os"
 	"path/filepath"
-	"syscall"
 
 	"github.com/docker/docker/libcontainerd"
 	"github.com/docker/docker/pkg/system"
+	"golang.org/x/sys/unix"
 )
 
 const defaultDaemonConfigFile = ""
@@ -30,8 +30,8 @@ func currentUserIsOwner(f string) bool {
 // caused by custom umask
 func setDefaultUmask() error {
 	desiredUmask := 0022
-	syscall.Umask(desiredUmask)
-	if umask := syscall.Umask(desiredUmask); umask != desiredUmask {
+	unix.Umask(desiredUmask)
+	if umask := unix.Umask(desiredUmask); umask != desiredUmask {
 		return fmt.Errorf("failed to set umask: expected %#o, got %#o", desiredUmask, umask)
 	}
 

cmd/dockerd/daemon_unix.go

@@ -9,12 +9,12 @@ import (
 	"os/signal"
 	"path/filepath"
 	"strconv"
-	"syscall"
 
 	"github.com/docker/docker/cmd/dockerd/hack"
 	"github.com/docker/docker/daemon"
 	"github.com/docker/docker/libcontainerd"
 	"github.com/docker/libnetwork/portallocator"
+	"golang.org/x/sys/unix"
 )
 
 const defaultDaemonConfigFile = "/etc/docker/daemon.json"
@@ -23,8 +23,8 @@ const defaultDaemonConfigFile = "/etc/docker/daemon.json"
 // caused by custom umask
 func setDefaultUmask() error {
 	desiredUmask := 0022
-	syscall.Umask(desiredUmask)
-	if umask := syscall.Umask(desiredUmask); umask != desiredUmask {
+	unix.Umask(desiredUmask)
+	if umask := unix.Umask(desiredUmask); umask != desiredUmask {
 		return fmt.Errorf("failed to set umask: expected %#o, got %#o", desiredUmask, umask)
 	}
 
@@ -38,7 +38,7 @@ func getDaemonConfDir(_ string) string {
 // setupConfigReloadTrap configures the USR2 signal to reload the configuration.
 func (cli *DaemonCli) setupConfigReloadTrap() {
 	c := make(chan os.Signal, 1)
-	signal.Notify(c, syscall.SIGHUP)
+	signal.Notify(c, unix.SIGHUP)
 	go func() {
 		for range c {
 			cli.reloadConfig()

cmd/dockerd/daemon_windows.go

@@ -5,11 +5,11 @@ import (
 	"net"
 	"os"
 	"path/filepath"
-	"syscall"
 
 	"github.com/Sirupsen/logrus"
 	"github.com/docker/docker/libcontainerd"
 	"github.com/docker/docker/pkg/system"
+	"golang.org/x/sys/windows"
 )
 
 var defaultDaemonConfigFile = ""
@@ -58,14 +58,14 @@ func notifyShutdown(err error) {
 // setupConfigReloadTrap configures a Win32 event to reload the configuration.
 func (cli *DaemonCli) setupConfigReloadTrap() {
 	go func() {
-		sa := syscall.SecurityAttributes{
+		sa := windows.SecurityAttributes{
 			Length: 0,
 		}
 		ev := "Global\\docker-daemon-config-" + fmt.Sprint(os.Getpid())
 		if h, _ := system.CreateEvent(&sa, false, false, ev); h != 0 {
 			logrus.Debugf("Config reload - waiting signal at %s", ev)
 			for {
-				syscall.WaitForSingleObject(h, syscall.INFINITE)
+				windows.WaitForSingleObject(h, windows.INFINITE)
 				cli.reloadConfig()
 			}
 		}

cmd/dockerd/service_windows.go

@@ -9,7 +9,6 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
-	"syscall"
 	"time"
 	"unsafe"
 
@@ -30,7 +29,7 @@ var (
 	flRunService        *bool
 
 	setStdHandle = windows.NewLazySystemDLL("kernel32.dll").NewProc("SetStdHandle")
-	oldStderr    syscall.Handle
+	oldStderr    windows.Handle
 	panicFile    *os.File
 
 	service *handler
@@ -131,14 +130,14 @@ func (h *etwHook) Fire(e *logrus.Entry) error {
 		err error
 	)
 
-	ss[0], err = syscall.UTF16PtrFromString(e.Message)
+	ss[0], err = windows.UTF16PtrFromString(e.Message)
 	if err != nil {
 		return err
 	}
 
 	count := uint16(1)
 	if exts != "" {
-		ss[1], err = syscall.UTF16PtrFromString(exts)
+		ss[1], err = windows.UTF16PtrFromString(exts)
 		if err != nil {
 			return err
 		}
@@ -397,8 +396,8 @@ func initPanicFile(path string) error {
 	// Update STD_ERROR_HANDLE to point to the panic file so that Go writes to
 	// it when it panics. Remember the old stderr to restore it before removing
 	// the panic file.
-	sh := syscall.STD_ERROR_HANDLE
-	h, err := syscall.GetStdHandle(sh)
+	sh := windows.STD_ERROR_HANDLE
+	h, err := windows.GetStdHandle(sh)
 	if err != nil {
 		return err
 	}
@@ -422,7 +421,7 @@ func initPanicFile(path string) error {
 func removePanicFile() {
 	if st, err := panicFile.Stat(); err == nil {
 		if st.Size() == 0 {
-			sh := syscall.STD_ERROR_HANDLE
+			sh := windows.STD_ERROR_HANDLE
 			setStdHandle.Call(uintptr(sh), uintptr(oldStderr))
 			panicFile.Close()
 			os.Remove(panicFile.Name())

daemon/container_operations_unix.go

@@ -9,7 +9,6 @@ import (
 	"os"
 	"path/filepath"
 	"strconv"
-	"syscall"
 	"time"
 
 	"github.com/Sirupsen/logrus"
@@ -22,6 +21,7 @@ import (
 	"github.com/docker/libnetwork"
 	"github.com/opencontainers/selinux/go-selinux/label"
 	"github.com/pkg/errors"
+	"golang.org/x/sys/unix"
 )
 
 func (daemon *Daemon) setupLinkedContainers(container *container.Container) ([]string, error) {
@@ -125,7 +125,7 @@ func (daemon *Daemon) setupIpcDirs(c *container.Container) error {
 				shmSize = c.HostConfig.ShmSize
 			}
 			shmproperty := "mode=1777,size=" + strconv.FormatInt(shmSize, 10)
-			if err := syscall.Mount("shm", shmPath, "tmpfs", uintptr(syscall.MS_NOEXEC|syscall.MS_NOSUID|syscall.MS_NODEV), label.FormatMountLabel(shmproperty, c.GetMountLabel())); err != nil {
+			if err := unix.Mount("shm", shmPath, "tmpfs", uintptr(unix.MS_NOEXEC|unix.MS_NOSUID|unix.MS_NODEV), label.FormatMountLabel(shmproperty, c.GetMountLabel())); err != nil {
 				return fmt.Errorf("mounting shm tmpfs: %s", err)
 			}
 			if err := os.Chown(shmPath, rootIDs.UID, rootIDs.GID); err != nil {
@@ -301,8 +301,8 @@ func killProcessDirectly(cntr *container.Container) error {
 		// Ensure that we don't kill ourselves
 		if pid := cntr.GetPID(); pid != 0 {
 			logrus.Infof("Container %s failed to exit within 10 seconds of kill - trying direct SIGKILL", stringid.TruncateID(cntr.ID))
-			if err := syscall.Kill(pid, 9); err != nil {
-				if err != syscall.ESRCH {
+			if err := unix.Kill(pid, 9); err != nil {
+				if err != unix.ESRCH {
 					return err
 				}
 				e := errNoSuchProcess{pid, 9}
@@ -315,7 +315,7 @@ func killProcessDirectly(cntr *container.Container) error {
 }
 
 func detachMounted(path string) error {
-	return syscall.Unmount(path, syscall.MNT_DETACH)
+	return unix.Unmount(path, unix.MNT_DETACH)
 }
 
 func isLinkable(child *container.Container) bool {

daemon/debugtrap_unix.go

@@ -5,15 +5,15 @@ package daemon
 import (
 	"os"
 	"os/signal"
-	"syscall"
 
 	"github.com/Sirupsen/logrus"
 	stackdump "github.com/docker/docker/pkg/signal"
+	"golang.org/x/sys/unix"
 )
 
 func (d *Daemon) setupDumpStackTrap(root string) {
 	c := make(chan os.Signal, 1)
-	signal.Notify(c, syscall.SIGUSR1)
+	signal.Notify(c, unix.SIGUSR1)
 	go func() {
 		for range c {
 			path, err := stackdump.DumpStacks(root)

daemon/debugtrap_windows.go

@@ -3,13 +3,13 @@ package daemon
 import (
 	"fmt"
 	"os"
-	"syscall"
 	"unsafe"
 
 	winio "github.com/Microsoft/go-winio"
 	"github.com/Sirupsen/logrus"
 	"github.com/docker/docker/pkg/signal"
 	"github.com/docker/docker/pkg/system"
+	"golang.org/x/sys/windows"
 )
 
 func (d *Daemon) setupDumpStackTrap(root string) {
@@ -22,7 +22,7 @@ func (d *Daemon) setupDumpStackTrap(root string) {
 		logrus.Errorf("failed to get security descriptor for debug stackdump event %s: %s", ev, err.Error())
 		return
 	}
-	var sa syscall.SecurityAttributes
+	var sa windows.SecurityAttributes
 	sa.Length = uint32(unsafe.Sizeof(sa))
 	sa.InheritHandle = 1
 	sa.SecurityDescriptor = uintptr(unsafe.Pointer(&sd[0]))
@@ -34,7 +34,7 @@ func (d *Daemon) setupDumpStackTrap(root string) {
 	go func() {
 		logrus.Debugf("Stackdump - waiting signal at %s", ev)
 		for {
-			syscall.WaitForSingleObject(h, syscall.INFINITE)
+			windows.WaitForSingleObject(h, windows.INFINITE)
 			path, err := signal.DumpStacks(root)
 			if err != nil {
 				logrus.WithError(err).Error("failed to write goroutines dump")

daemon/graphdriver/aufs/aufs.go

@@ -33,12 +33,9 @@ import (
 	"path/filepath"
 	"strings"
 	"sync"
-	"syscall"
 	"time"
 
 	"github.com/Sirupsen/logrus"
-	"github.com/vbatts/tar-split/tar/storage"
-
 	"github.com/docker/docker/daemon/graphdriver"
 	"github.com/docker/docker/pkg/archive"
 	"github.com/docker/docker/pkg/chrootarchive"
@@ -47,9 +44,10 @@ import (
 	"github.com/docker/docker/pkg/locker"
 	mountpk "github.com/docker/docker/pkg/mount"
 	"github.com/docker/docker/pkg/system"
-
 	rsystem "github.com/opencontainers/runc/libcontainer/system"
 	"github.com/opencontainers/selinux/go-selinux/label"
+	"github.com/vbatts/tar-split/tar/storage"
+	"golang.org/x/sys/unix"
 )
 
 var (
@@ -295,7 +293,7 @@ func (a *Driver) Remove(id string) error {
 		}
 
 		if err := a.unmount(mountpoint); err != nil {
-			if err != syscall.EBUSY {
+			if err != unix.EBUSY {
 				return fmt.Errorf("aufs: unmount error: %s: %v", mountpoint, err)
 			}
 			if retries >= 5 {
@@ -315,7 +313,7 @@ func (a *Driver) Remove(id string) error {
 	// the whole tree.
 	tmpMntPath := path.Join(a.mntPath(), fmt.Sprintf("%s-removing", id))
 	if err := os.Rename(mountpoint, tmpMntPath); err != nil && !os.IsNotExist(err) {
-		if err == syscall.EBUSY {
+		if err == unix.EBUSY {
 			logrus.Warn("os.Rename err due to EBUSY")
 		}
 		return err
@@ -575,7 +573,7 @@ func (a *Driver) aufsMount(ro []string, rw, target, mountLabel string) (err erro
 	if useDirperm() {
 		offset += len(",dirperm1")
 	}
-	b := make([]byte, syscall.Getpagesize()-len(mountLabel)-offset) // room for xino & mountLabel
+	b := make([]byte, unix.Getpagesize()-len(mountLabel)-offset) // room for xino & mountLabel
 	bp := copy(b, fmt.Sprintf("br:%s=rw", rw))
 
 	index := 0
@@ -599,7 +597,7 @@ func (a *Driver) aufsMount(ro []string, rw, target, mountLabel string) (err erro
 	for ; index < len(ro); index++ {
 		layer := fmt.Sprintf(":%s=ro+wh", ro[index])
 		data := label.FormatMountLabel(fmt.Sprintf("append%s", layer), mountLabel)
-		if err = mount("none", target, "aufs", syscall.MS_REMOUNT, data); err != nil {
+		if err = mount("none", target, "aufs", unix.MS_REMOUNT, data); err != nil {
 			return
 		}
 	}

daemon/graphdriver/aufs/mount.go

@@ -4,9 +4,9 @@ package aufs
 
 import (
 	"os/exec"
-	"syscall"
 
 	"github.com/Sirupsen/logrus"
+	"golang.org/x/sys/unix"
 )
 
 // Unmount the target specified.
@@ -14,7 +14,7 @@ func Unmount(target string) error {
 	if err := exec.Command("auplink", target, "flush").Run(); err != nil {
 		logrus.Warnf("Couldn't run auplink before unmount %s: %s", target, err)
 	}
-	if err := syscall.Unmount(target, 0); err != nil {
+	if err := unix.Unmount(target, 0); err != nil {
 		return err
 	}
 	return nil

daemon/graphdriver/aufs/mount_linux.go

@@ -1,7 +1,7 @@
 package aufs
 
-import "syscall"
+import "golang.org/x/sys/unix"
 
 func mount(source string, target string, fstype string, flags uintptr, data string) error {
-	return syscall.Mount(source, target, fstype, flags, data)
+	return unix.Mount(source, target, fstype, flags, data)
 }

daemon/graphdriver/btrfs/btrfs.go

@@ -24,7 +24,6 @@ import (
 	"strconv"
 	"strings"
 	"sync"
-	"syscall"
 	"unsafe"
 
 	"github.com/Sirupsen/logrus"
@@ -35,6 +34,7 @@ import (
 	"github.com/docker/docker/pkg/system"
 	"github.com/docker/go-units"
 	"github.com/opencontainers/selinux/go-selinux/label"
+	"golang.org/x/sys/unix"
 )
 
 func init() {
@@ -197,7 +197,7 @@ func subvolCreate(path, name string) error {
 		args.name[i] = C.char(c)
 	}
 
-	_, _, errno := syscall.Syscall(syscall.SYS_IOCTL, getDirFd(dir), C.BTRFS_IOC_SUBVOL_CREATE,
+	_, _, errno := unix.Syscall(unix.SYS_IOCTL, getDirFd(dir), C.BTRFS_IOC_SUBVOL_CREATE,
 		uintptr(unsafe.Pointer(&args)))
 	if errno != 0 {
 		return fmt.Errorf("Failed to create btrfs subvolume: %v", errno.Error())
@@ -225,7 +225,7 @@ func subvolSnapshot(src, dest, name string) error {
 	C.set_name_btrfs_ioctl_vol_args_v2(&args, cs)
 	C.free(unsafe.Pointer(cs))
 
-	_, _, errno := syscall.Syscall(syscall.SYS_IOCTL, getDirFd(destDir), C.BTRFS_IOC_SNAP_CREATE_V2,
+	_, _, errno := unix.Syscall(unix.SYS_IOCTL, getDirFd(destDir), C.BTRFS_IOC_SNAP_CREATE_V2,
 		uintptr(unsafe.Pointer(&args)))
 	if errno != 0 {
 		return fmt.Errorf("Failed to create btrfs snapshot: %v", errno.Error())
@@ -234,8 +234,8 @@ func subvolSnapshot(src, dest, name string) error {
 }
 
 func isSubvolume(p string) (bool, error) {
-	var bufStat syscall.Stat_t
-	if err := syscall.Lstat(p, &bufStat); err != nil {
+	var bufStat unix.Stat_t
+	if err := unix.Lstat(p, &bufStat); err != nil {
 		return false, err
 	}
 
@@ -287,7 +287,7 @@ func subvolDelete(dirpath, name string, quotaEnabled bool) error {
 			var args C.struct_btrfs_ioctl_qgroup_create_args
 			args.qgroupid = C.__u64(qgroupid)
 
-			_, _, errno := syscall.Syscall(syscall.SYS_IOCTL, getDirFd(dir), C.BTRFS_IOC_QGROUP_CREATE,
+			_, _, errno := unix.Syscall(unix.SYS_IOCTL, getDirFd(dir), C.BTRFS_IOC_QGROUP_CREATE,
 				uintptr(unsafe.Pointer(&args)))
 			if errno != 0 {
 				logrus.Errorf("Failed to delete btrfs qgroup %v for %s: %v", qgroupid, fullPath, errno.Error())
@@ -302,7 +302,7 @@ func subvolDelete(dirpath, name string, quotaEnabled bool) error {
 	for i, c := range []byte(name) {
 		args.name[i] = C.char(c)
 	}
-	_, _, errno := syscall.Syscall(syscall.SYS_IOCTL, getDirFd(dir), C.BTRFS_IOC_SNAP_DESTROY,
+	_, _, errno := unix.Syscall(unix.SYS_IOCTL, getDirFd(dir), C.BTRFS_IOC_SNAP_DESTROY,
 		uintptr(unsafe.Pointer(&args)))
 	if errno != 0 {
 		return fmt.Errorf("Failed to destroy btrfs snapshot %s for %s: %v", dirpath, name, errno.Error())
@@ -338,7 +338,7 @@ func (d *Driver) subvolEnableQuota() error {
 
 	var args C.struct_btrfs_ioctl_quota_ctl_args
 	args.cmd = C.BTRFS_QUOTA_CTL_ENABLE
-	_, _, errno := syscall.Syscall(syscall.SYS_IOCTL, getDirFd(dir), C.BTRFS_IOC_QUOTA_CTL,
+	_, _, errno := unix.Syscall(unix.SYS_IOCTL, getDirFd(dir), C.BTRFS_IOC_QUOTA_CTL,
 		uintptr(unsafe.Pointer(&args)))
 	if errno != 0 {
 		return fmt.Errorf("Failed to enable btrfs quota for %s: %v", dir, errno.Error())
@@ -364,7 +364,7 @@ func (d *Driver) subvolDisableQuota() error {
 
 	var args C.struct_btrfs_ioctl_quota_ctl_args
 	args.cmd = C.BTRFS_QUOTA_CTL_DISABLE
-	_, _, errno := syscall.Syscall(syscall.SYS_IOCTL, getDirFd(dir), C.BTRFS_IOC_QUOTA_CTL,
+	_, _, errno := unix.Syscall(unix.SYS_IOCTL, getDirFd(dir), C.BTRFS_IOC_QUOTA_CTL,
 		uintptr(unsafe.Pointer(&args)))
 	if errno != 0 {
 		return fmt.Errorf("Failed to disable btrfs quota for %s: %v", dir, errno.Error())
@@ -389,7 +389,7 @@ func (d *Driver) subvolRescanQuota() error {
 	defer closeDir(dir)
 
 	var args C.struct_btrfs_ioctl_quota_rescan_args
-	_, _, errno := syscall.Syscall(syscall.SYS_IOCTL, getDirFd(dir), C.BTRFS_IOC_QUOTA_RESCAN_WAIT,
+	_, _, errno := unix.Syscall(unix.SYS_IOCTL, getDirFd(dir), C.BTRFS_IOC_QUOTA_RESCAN_WAIT,
 		uintptr(unsafe.Pointer(&args)))
 	if errno != 0 {
 		return fmt.Errorf("Failed to rescan btrfs quota for %s: %v", dir, errno.Error())
@@ -408,7 +408,7 @@ func subvolLimitQgroup(path string, size uint64) error {
 	var args C.struct_btrfs_ioctl_qgroup_limit_args
 	args.lim.max_referenced = C.__u64(size)
 	args.lim.flags = C.BTRFS_QGROUP_LIMIT_MAX_RFER
-	_, _, errno := syscall.Syscall(syscall.SYS_IOCTL, getDirFd(dir), C.BTRFS_IOC_QGROUP_LIMIT,
+	_, _, errno := unix.Syscall(unix.SYS_IOCTL, getDirFd(dir), C.BTRFS_IOC_QGROUP_LIMIT,
 		uintptr(unsafe.Pointer(&args)))
 	if errno != 0 {
 		return fmt.Errorf("Failed to limit qgroup for %s: %v", dir, errno.Error())
@@ -437,7 +437,7 @@ func subvolQgroupStatus(path string) error {
 	args.key.max_transid = C.__u64(math.MaxUint64)
 	args.key.nr_items = 4096
 
-	_, _, errno := syscall.Syscall(syscall.SYS_IOCTL, getDirFd(dir), C.BTRFS_IOC_TREE_SEARCH,
+	_, _, errno := unix.Syscall(unix.SYS_IOCTL, getDirFd(dir), C.BTRFS_IOC_TREE_SEARCH,
 		uintptr(unsafe.Pointer(&args)))
 	if errno != 0 {
 		return fmt.Errorf("Failed to search qgroup for %s: %v", path, errno.Error())
@@ -459,7 +459,7 @@ func subvolLookupQgroup(path string) (uint64, error) {
 	var args C.struct_btrfs_ioctl_ino_lookup_args
 	args.objectid = C.BTRFS_FIRST_FREE_OBJECTID
 
-	_, _, errno := syscall.Syscall(syscall.SYS_IOCTL, getDirFd(dir), C.BTRFS_IOC_INO_LOOKUP,
+	_, _, errno := unix.Syscall(unix.SYS_IOCTL, getDirFd(dir), C.BTRFS_IOC_INO_LOOKUP,
 		uintptr(unsafe.Pointer(&args)))
 	if errno != 0 {
 		return 0, fmt.Errorf("Failed to lookup qgroup for %s: %v", dir, errno.Error())

daemon/graphdriver/devmapper/deviceset.go

@@ -20,7 +20,6 @@ import (
 	"time"
 
 	"github.com/Sirupsen/logrus"
-
 	"github.com/docker/docker/daemon/graphdriver"
 	"github.com/docker/docker/dockerversion"
 	"github.com/docker/docker/pkg/devicemapper"
@@ -29,9 +28,9 @@ import (
 	"github.com/docker/docker/pkg/mount"
 	"github.com/docker/docker/pkg/parsers"
 	units "github.com/docker/go-units"
-	"github.com/pkg/errors"
-
 	"github.com/opencontainers/selinux/go-selinux/label"
+	"github.com/pkg/errors"
+	"golang.org/x/sys/unix"
 )
 
 var (
@@ -1197,7 +1196,7 @@ func (devices *DeviceSet) growFS(info *devInfo) error {
 		return fmt.Errorf("Error mounting '%s' on '%s': %s", info.DevName(), fsMountPoint, err)
 	}
 
-	defer syscall.Unmount(fsMountPoint, syscall.MNT_DETACH)
+	defer unix.Unmount(fsMountPoint, unix.MNT_DETACH)
 
 	switch devices.BaseDeviceFilesystem {
 	case "ext4":
@@ -1266,7 +1265,7 @@ func setCloseOnExec(name string) {
 			if link == name {
 				fd, err := strconv.Atoi(i.Name())
 				if err == nil {
-					syscall.CloseOnExec(fd)
+					unix.CloseOnExec(fd)
 				}
 			}
 		}
@@ -2287,7 +2286,7 @@ func (devices *DeviceSet) Shutdown(home string) error {
 			// We use MNT_DETACH here in case it is still busy in some running
 			// container. This means it'll go away from the global scope directly,
 			// and the device will be released when that container dies.
-			if err := syscall.Unmount(p, syscall.MNT_DETACH); err != nil {
+			if err := unix.Unmount(p, unix.MNT_DETACH); err != nil {
 				logrus.Debugf("devmapper: Shutdown unmounting %s, error: %s", p, err)
 			}
 		}
@@ -2400,7 +2399,7 @@ func (devices *DeviceSet) MountDevice(hash, path, mountLabel string) error {
 
 	if fstype == "xfs" && devices.xfsNospaceRetries != "" {
 		if err := devices.xfsSetNospaceRetries(info); err != nil {
-			syscall.Unmount(path, syscall.MNT_DETACH)
+			unix.Unmount(path, unix.MNT_DETACH)
 			devices.deactivateDevice(info)
 			return err
 		}
@@ -2426,7 +2425,7 @@ func (devices *DeviceSet) UnmountDevice(hash, mountPath string) error {
 	defer devices.Unlock()
 
 	logrus.Debugf("devmapper: Unmount(%s)", mountPath)
-	if err := syscall.Unmount(mountPath, syscall.MNT_DETACH); err != nil {
+	if err := unix.Unmount(mountPath, unix.MNT_DETACH); err != nil {
 		return err
 	}
 	logrus.Debug("devmapper: Unmount done")
@@ -2523,8 +2522,8 @@ func (devices *DeviceSet) MetadataDevicePath() string {
 }
 
 func (devices *DeviceSet) getUnderlyingAvailableSpace(loopFile string) (uint64, error) {
-	buf := new(syscall.Statfs_t)
-	if err := syscall.Statfs(loopFile, buf); err != nil {
+	buf := new(unix.Statfs_t)
+	if err := unix.Statfs(loopFile, buf); err != nil {
 		logrus.Warnf("devmapper: Couldn't stat loopfile filesystem %v: %v", loopFile, err)
 		return 0, err
 	}

daemon/graphdriver/driver_freebsd.go

@@ -1,6 +1,6 @@
 package graphdriver
 
-import "syscall"
+import "golang.org/x/sys/unix"
 
 var (
 	// Slice of drivers that should be used in an order
@@ -11,7 +11,7 @@ var (
 
 // Mounted checks if the given path is mounted as the fs type
 func Mounted(fsType FsMagic, mountPath string) (bool, error) {
-	var buf syscall.Statfs_t
+	var buf unix.Statfs_t
 	if err := syscall.Statfs(mountPath, &buf); err != nil {
 		return false, err
 	}

daemon/graphdriver/driver_linux.go

@@ -4,9 +4,9 @@ package graphdriver
 
 import (
 	"path/filepath"
-	"syscall"
 
 	"github.com/docker/docker/pkg/mount"
+	"golang.org/x/sys/unix"
 )
 
 const (
@@ -88,8 +88,8 @@ var (
 
 // GetFSMagic returns the filesystem id given the path.
 func GetFSMagic(rootpath string) (FsMagic, error) {
-	var buf syscall.Statfs_t
-	if err := syscall.Statfs(filepath.Dir(rootpath), &buf); err != nil {
+	var buf unix.Statfs_t
+	if err := unix.Statfs(filepath.Dir(rootpath), &buf); err != nil {
 		return 0, err
 	}
 	return FsMagic(buf.Type), nil
@@ -127,8 +127,8 @@ func (c *defaultChecker) IsMounted(path string) bool {
 
 // Mounted checks if the given path is mounted as the fs type
 func Mounted(fsType FsMagic, mountPath string) (bool, error) {
-	var buf syscall.Statfs_t
-	if err := syscall.Statfs(mountPath, &buf); err != nil {
+	var buf unix.Statfs_t
+	if err := unix.Statfs(mountPath, &buf); err != nil {
 		return false, err
 	}
 	return FsMagic(buf.Type) == fsType, nil

daemon/graphdriver/graphtest/graphtest_unix.go

@@ -9,7 +9,6 @@ import (
 	"os"
 	"path"
 	"reflect"
-	"syscall"
 	"testing"
 	"unsafe"
 
@@ -18,6 +17,7 @@ import (
 	"github.com/docker/go-units"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"golang.org/x/sys/unix"
 )
 
 var (
@@ -329,8 +329,8 @@ func DriverTestSetQuota(t *testing.T, drivername string) {
 
 	quota := uint64(50 * units.MiB)
 	err = writeRandomFile(path.Join(mountPath, "file"), quota*2)
-	if pathError, ok := err.(*os.PathError); ok && pathError.Err != syscall.EDQUOT {
-		t.Fatalf("expect write() to fail with %v, got %v", syscall.EDQUOT, err)
+	if pathError, ok := err.(*os.PathError); ok && pathError.Err != unix.EDQUOT {
+		t.Fatalf("expect write() to fail with %v, got %v", unix.EDQUOT, err)
 	}
 
 }

daemon/graphdriver/graphtest/testutil_unix.go

@@ -12,6 +12,7 @@ import (
 	"github.com/docker/docker/daemon/graphdriver"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"golang.org/x/sys/unix"
 )
 
 func verifyFile(t testing.TB, path string, mode os.FileMode, uid, gid uint32) {
@@ -33,8 +34,8 @@ func verifyFile(t testing.TB, path string, mode os.FileMode, uid, gid uint32) {
 
 func createBase(t testing.TB, driver graphdriver.Driver, name string) {
 	// We need to be able to set any perms
-	oldmask := syscall.Umask(0)
-	defer syscall.Umask(oldmask)
+	oldmask := unix.Umask(0)
+	defer unix.Umask(oldmask)
 
 	err := driver.CreateReadWrite(name, "", nil)
 	require.NoError(t, err)

daemon/graphdriver/overlay/copy.go

@@ -12,6 +12,7 @@ import (
 	"github.com/docker/docker/pkg/pools"
 	"github.com/docker/docker/pkg/system"
 	rsystem "github.com/opencontainers/runc/libcontainer/system"
+	"golang.org/x/sys/unix"
 )
 
 type copyFlags int
@@ -110,12 +111,12 @@ func copyDir(srcDir, dstDir string, flags copyFlags) error {
 				// cannot create a device if running in user namespace
 				return nil
 			}
-			if err := syscall.Mkfifo(dstPath, stat.Mode); err != nil {
+			if err := unix.Mkfifo(dstPath, stat.Mode); err != nil {
 				return err
 			}
 
 		case os.ModeDevice:
-			if err := syscall.Mknod(dstPath, stat.Mode, int(stat.Rdev)); err != nil {
+			if err := unix.Mknod(dstPath, stat.Mode, int(stat.Rdev)); err != nil {
 				return err
 			}
 

daemon/graphdriver/overlay/overlay.go

@@ -11,7 +11,6 @@ import (
 	"os/exec"
 	"path"
 	"strconv"
-	"syscall"
 
 	"github.com/Sirupsen/logrus"
 	"github.com/docker/docker/daemon/graphdriver"
@@ -23,6 +22,7 @@ import (
 	"github.com/docker/docker/pkg/mount"
 	"github.com/docker/docker/pkg/system"
 	"github.com/opencontainers/selinux/go-selinux/label"
+	"golang.org/x/sys/unix"
 )
 
 // This is a small wrapper over the NaiveDiffWriter that lets us have a custom
@@ -363,7 +363,7 @@ func (d *Driver) Get(id string, mountLabel string) (s string, err error) {
 	defer func() {
 		if err != nil {
 			if c := d.ctr.Decrement(mergedDir); c <= 0 {
-				syscall.Unmount(mergedDir, 0)
+				unix.Unmount(mergedDir, 0)
 			}
 		}
 	}()
@@ -377,7 +377,7 @@ func (d *Driver) Get(id string, mountLabel string) (s string, err error) {
 		workDir  = path.Join(dir, "work")
 		opts     = fmt.Sprintf("lowerdir=%s,upperdir=%s,workdir=%s", lowerDir, upperDir, workDir)
 	)
-	if err := syscall.Mount("overlay", mergedDir, "overlay", 0, label.FormatMountLabel(opts, mountLabel)); err != nil {
+	if err := unix.Mount("overlay", mergedDir, "overlay", 0, label.FormatMountLabel(opts, mountLabel)); err != nil {
 		return "", fmt.Errorf("error creating overlay mount to %s: %v", mergedDir, err)
 	}
 	// chown "workdir/work" to the remapped root UID/GID. Overlay fs inside a
@@ -404,7 +404,7 @@ func (d *Driver) Put(id string) error {
 	if count := d.ctr.Decrement(mountpoint); count > 0 {
 		return nil
 	}
-	if err := syscall.Unmount(mountpoint, syscall.MNT_DETACH); err != nil {
+	if err := unix.Unmount(mountpoint, unix.MNT_DETACH); err != nil {
 		logrus.Debugf("Failed to unmount %s overlay: %v", id, err)
 	}
 	return nil

daemon/graphdriver/overlay2/check.go

@@ -8,11 +8,11 @@ import (
 	"os"
 	"path"
 	"path/filepath"
-	"syscall"
 
 	"github.com/Sirupsen/logrus"
 	"github.com/docker/docker/pkg/system"
 	"github.com/pkg/errors"
+	"golang.org/x/sys/unix"
 )
 
 // hasOpaqueCopyUpBug checks whether the filesystem has a bug
@@ -52,11 +52,11 @@ func hasOpaqueCopyUpBug(d string) error {
 	}
 
 	opts := fmt.Sprintf("lowerdir=%s:%s,upperdir=%s,workdir=%s", path.Join(td, "l2"), path.Join(td, "l1"), path.Join(td, "l3"), path.Join(td, "work"))
-	if err := syscall.Mount("overlay", filepath.Join(td, "merged"), "overlay", 0, opts); err != nil {
+	if err := unix.Mount("overlay", filepath.Join(td, "merged"), "overlay", 0, opts); err != nil {
 		return errors.Wrap(err, "failed to mount overlay")
 	}
 	defer func() {
-		if err := syscall.Unmount(filepath.Join(td, "merged"), 0); err != nil {
+		if err := unix.Unmount(filepath.Join(td, "merged"), 0); err != nil {
 			logrus.Warnf("Failed to unmount check directory %v: %v", filepath.Join(td, "merged"), err)
 		}
 	}()

daemon/graphdriver/overlay2/mount.go

@@ -9,9 +9,9 @@ import (
 	"fmt"
 	"os"
 	"runtime"
-	"syscall"
 
 	"github.com/docker/docker/pkg/reexec"
+	"golang.org/x/sys/unix"
 )
 
 func init() {
@@ -80,7 +80,7 @@ func mountFromMain() {
 		fatal(err)
 	}
 
-	if err := syscall.Mount(options.Device, options.Target, options.Type, uintptr(options.Flag), options.Label); err != nil {
+	if err := unix.Mount(options.Device, options.Target, options.Type, uintptr(options.Flag), options.Label); err != nil {
 		fatal(err)
 	}
 

daemon/graphdriver/overlay2/overlay.go

@@ -15,7 +15,6 @@ import (
 	"strconv"
 	"strings"
 	"sync"
-	"syscall"
 
 	"github.com/Sirupsen/logrus"
 
@@ -35,6 +34,7 @@ import (
 	units "github.com/docker/go-units"
 
 	"github.com/opencontainers/selinux/go-selinux/label"
+	"golang.org/x/sys/unix"
 )
 
 var (
@@ -539,7 +539,7 @@ func (d *Driver) Get(id string, mountLabel string) (s string, err error) {
 	defer func() {
 		if err != nil {
 			if c := d.ctr.Decrement(mergedDir); c <= 0 {
-				syscall.Unmount(mergedDir, 0)
+				unix.Unmount(mergedDir, 0)
 			}
 		}
 	}()
@@ -552,10 +552,10 @@ func (d *Driver) Get(id string, mountLabel string) (s string, err error) {
 	}
 	opts := fmt.Sprintf("lowerdir=%s,upperdir=%s,workdir=%s", strings.Join(absLowers, ":"), path.Join(dir, "diff"), path.Join(dir, "work"))
 	mountData := label.FormatMountLabel(opts, mountLabel)
-	mount := syscall.Mount
+	mount := unix.Mount
 	mountTarget := mergedDir
 
-	pageSize := syscall.Getpagesize()
+	pageSize := unix.Getpagesize()
 
 	// Go can return a larger page size than supported by the system
 	// as of go 1.7. This will be fixed in 1.8 and this block can be
@@ -619,7 +619,7 @@ func (d *Driver) Put(id string) error {
 	if count := d.ctr.Decrement(mountpoint); count > 0 {
 		return nil
 	}
-	if err := syscall.Unmount(mountpoint, syscall.MNT_DETACH); err != nil {
+	if err := unix.Unmount(mountpoint, unix.MNT_DETACH); err != nil {
 		logrus.Debugf("Failed to unmount %s overlay: %s - %v", id, mountpoint, err)
 	}
 	return nil

daemon/graphdriver/overlay2/overlay_test.go

@@ -5,13 +5,13 @@ package overlay2
 import (
 	"io/ioutil"
 	"os"
-	"syscall"
 	"testing"
 
 	"github.com/docker/docker/daemon/graphdriver"
 	"github.com/docker/docker/daemon/graphdriver/graphtest"
 	"github.com/docker/docker/pkg/archive"
 	"github.com/docker/docker/pkg/reexec"
+	"golang.org/x/sys/unix"
 )
 
 func init() {
@@ -31,7 +31,7 @@ func cdMountFrom(dir, device, target, mType, label string) error {
 	os.Chdir(dir)
 	defer os.Chdir(wd)
 
-	return syscall.Mount(device, target, mType, 0, label)
+	return unix.Mount(device, target, mType, 0, label)
 }
 
 func skipIfNaive(t *testing.T) {

daemon/graphdriver/overlay2/randomid.go

@@ -12,6 +12,7 @@ import (
 	"time"
 
 	"github.com/Sirupsen/logrus"
+	"golang.org/x/sys/unix"
 )
 
 // generateID creates a new random string identifier with the given length
@@ -69,7 +70,7 @@ func retryOnError(err error) bool {
 	case *os.PathError:
 		return retryOnError(err.Err) // unpack the target error
 	case syscall.Errno:
-		if err == syscall.EPERM {
+		if err == unix.EPERM {
 			// EPERM represents an entropy pool exhaustion, a condition under
 			// which we backoff and retry.
 			return true

daemon/graphdriver/quota/projectquota.go

@@ -59,6 +59,7 @@ import (
 	"unsafe"
 
 	"github.com/Sirupsen/logrus"
+	"golang.org/x/sys/unix"
 )
 
 // Quota limit params - currently we only control blocks hard limit
@@ -184,7 +185,7 @@ func setProjectQuota(backingFsBlockDev string, projectID uint32, quota Quota) er
 	var cs = C.CString(backingFsBlockDev)
 	defer C.free(unsafe.Pointer(cs))
 
-	_, _, errno := syscall.Syscall6(syscall.SYS_QUOTACTL, C.Q_XSETPQLIM,
+	_, _, errno := unix.Syscall6(unix.SYS_QUOTACTL, C.Q_XSETPQLIM,
 		uintptr(unsafe.Pointer(cs)), uintptr(d.d_id),
 		uintptr(unsafe.Pointer(&d)), 0, 0)
 	if errno != 0 {
@@ -211,7 +212,7 @@ func (q *Control) GetQuota(targetPath string, quota *Quota) error {
 	var cs = C.CString(q.backingFsBlockDev)
 	defer C.free(unsafe.Pointer(cs))
 
-	_, _, errno := syscall.Syscall6(syscall.SYS_QUOTACTL, C.Q_XGETPQUOTA,
+	_, _, errno := unix.Syscall6(unix.SYS_QUOTACTL, C.Q_XGETPQUOTA,
 		uintptr(unsafe.Pointer(cs)), uintptr(C.__u32(projectID)),
 		uintptr(unsafe.Pointer(&d)), 0, 0)
 	if errno != 0 {
@@ -232,7 +233,7 @@ func getProjectID(targetPath string) (uint32, error) {
 	defer closeDir(dir)
 
 	var fsx C.struct_fsxattr
-	_, _, errno := syscall.Syscall(syscall.SYS_IOCTL, getDirFd(dir), C.FS_IOC_FSGETXATTR,
+	_, _, errno := unix.Syscall(unix.SYS_IOCTL, getDirFd(dir), C.FS_IOC_FSGETXATTR,
 		uintptr(unsafe.Pointer(&fsx)))
 	if errno != 0 {
 		return 0, fmt.Errorf("Failed to get projid for %s: %v", targetPath, errno.Error())
@@ -250,14 +251,14 @@ func setProjectID(targetPath string, projectID uint32) error {
 	defer closeDir(dir)
 
 	var fsx C.struct_fsxattr
-	_, _, errno := syscall.Syscall(syscall.SYS_IOCTL, getDirFd(dir), C.FS_IOC_FSGETXATTR,
+	_, _, errno := unix.Syscall(unix.SYS_IOCTL, getDirFd(dir), C.FS_IOC_FSGETXATTR,
 		uintptr(unsafe.Pointer(&fsx)))
 	if errno != 0 {
 		return fmt.Errorf("Failed to get projid for %s: %v", targetPath, errno.Error())
 	}
 	fsx.fsx_projid = C.__u32(projectID)
 	fsx.fsx_xflags |= C.FS_XFLAG_PROJINHERIT
-	_, _, errno = syscall.Syscall(syscall.SYS_IOCTL, getDirFd(dir), C.FS_IOC_FSSETXATTR,
+	_, _, errno = unix.Syscall(unix.SYS_IOCTL, getDirFd(dir), C.FS_IOC_FSSETXATTR,
 		uintptr(unsafe.Pointer(&fsx)))
 	if errno != 0 {
 		return fmt.Errorf("Failed to set projid for %s: %v", targetPath, errno.Error())
@@ -329,9 +330,9 @@ func makeBackingFsDev(home string) (string, error) {
 
 	backingFsBlockDev := path.Join(home, "backingFsBlockDev")
 	// Re-create just in case someone copied the home directory over to a new device
-	syscall.Unlink(backingFsBlockDev)
+	unix.Unlink(backingFsBlockDev)
 	stat := fileinfo.Sys().(*syscall.Stat_t)
-	if err := syscall.Mknod(backingFsBlockDev, syscall.S_IFBLK|0600, int(stat.Dev)); err != nil {
+	if err := unix.Mknod(backingFsBlockDev, unix.S_IFBLK|0600, int(stat.Dev)); err != nil {
 		return "", fmt.Errorf("Failed to mknod %s: %v", backingFsBlockDev, err)
 	}
 

daemon/graphdriver/windows/windows.go

@@ -124,7 +124,7 @@ func getFileSystemType(drive string) (fsType string, hr error) {
 		modkernel32              = windows.NewLazySystemDLL("kernel32.dll")
 		procGetVolumeInformation = modkernel32.NewProc("GetVolumeInformationW")
 		buf                      = make([]uint16, 255)
-		size                     = syscall.MAX_PATH + 1
+		size                     = windows.MAX_PATH + 1
 	)
 	if len(drive) != 1 {
 		hr = errors.New("getFileSystemType must be called with a drive letter")
@@ -132,11 +132,11 @@ func getFileSystemType(drive string) (fsType string, hr error) {
 	}
 	drive += `:\`
 	n := uintptr(unsafe.Pointer(nil))
-	r0, _, _ := syscall.Syscall9(procGetVolumeInformation.Addr(), 8, uintptr(unsafe.Pointer(syscall.StringToUTF16Ptr(drive))), n, n, n, n, n, uintptr(unsafe.Pointer(&buf[0])), uintptr(size), 0)
+	r0, _, _ := syscall.Syscall9(procGetVolumeInformation.Addr(), 8, uintptr(unsafe.Pointer(windows.StringToUTF16Ptr(drive))), n, n, n, n, n, uintptr(unsafe.Pointer(&buf[0])), uintptr(size), 0)
 	if int32(r0) < 0 {
 		hr = syscall.Errno(win32FromHresult(r0))
 	}
-	fsType = syscall.UTF16ToString(buf)
+	fsType = windows.UTF16ToString(buf)
 	return
 }
 
@@ -904,12 +904,12 @@ func (fg *fileGetCloserWithBackupPrivileges) Get(filename string) (io.ReadCloser
 	// standby list - Microsoft VSO Bug Tracker #9900466
 	err := winio.RunWithPrivilege(winio.SeBackupPrivilege, func() error {
 		path := longpath.AddPrefix(filepath.Join(fg.path, filename))
-		p, err := syscall.UTF16FromString(path)
+		p, err := windows.UTF16FromString(path)
 		if err != nil {
 			return err
 		}
 		const fileFlagSequentialScan = 0x08000000 // FILE_FLAG_SEQUENTIAL_SCAN
-		h, err := syscall.CreateFile(&p[0], syscall.GENERIC_READ, syscall.FILE_SHARE_READ, nil, syscall.OPEN_EXISTING, syscall.FILE_FLAG_BACKUP_SEMANTICS|fileFlagSequentialScan, 0)
+		h, err := windows.CreateFile(&p[0], windows.GENERIC_READ, windows.FILE_SHARE_READ, nil, windows.OPEN_EXISTING, windows.FILE_FLAG_BACKUP_SEMANTICS|fileFlagSequentialScan, 0)
 		if err != nil {
 			return &os.PathError{Op: "open", Path: path, Err: err}
 		}

daemon/graphdriver/zfs/zfs.go

@@ -10,7 +10,6 @@ import (
 	"strconv"
 	"strings"
 	"sync"
-	"syscall"
 	"time"
 
 	"github.com/Sirupsen/logrus"
@@ -20,6 +19,7 @@ import (
 	"github.com/docker/docker/pkg/parsers"
 	zfs "github.com/mistifyio/go-zfs"
 	"github.com/opencontainers/selinux/go-selinux/label"
+	"golang.org/x/sys/unix"
 )
 
 type zfsOptions struct {
@@ -141,8 +141,8 @@ func parseOptions(opt []string) (zfsOptions, error) {
 }
 
 func lookupZfsDataset(rootdir string) (string, error) {
-	var stat syscall.Stat_t
-	if err := syscall.Stat(rootdir, &stat); err != nil {
+	var stat unix.Stat_t
+	if err := unix.Stat(rootdir, &stat); err != nil {
 		return "", fmt.Errorf("Failed to access '%s': %s", rootdir, err)
 	}
 	wantedDev := stat.Dev
@@ -152,7 +152,7 @@ func lookupZfsDataset(rootdir string) (string, error) {
 		return "", err
 	}
 	for _, m := range mounts {
-		if err := syscall.Stat(m.Mountpoint, &stat); err != nil {
+		if err := unix.Stat(m.Mountpoint, &stat); err != nil {
 			logrus.Debugf("[zfs] failed to stat '%s' while scanning for zfs mount: %v", m.Mountpoint, err)
 			continue // may fail on fuse file systems
 		}

daemon/graphdriver/zfs/zfs_freebsd.go

@@ -3,15 +3,15 @@ package zfs
 import (
 	"fmt"
 	"strings"
-	"syscall"
 
 	"github.com/Sirupsen/logrus"
 	"github.com/docker/docker/daemon/graphdriver"
+	"golang.org/x/sys/unix"
 )
 
 func checkRootdirFs(rootdir string) error {
-	var buf syscall.Statfs_t
-	if err := syscall.Statfs(rootdir, &buf); err != nil {
+	var buf unix.Statfs_t
+	if err := unix.Statfs(rootdir, &buf); err != nil {
 		return fmt.Errorf("Failed to access '%s': %s", rootdir, err)
 	}
 

daemon/graphdriver/zfs/zfs_linux.go

@@ -2,15 +2,15 @@ package zfs
 
 import (
 	"fmt"
-	"syscall"
 
 	"github.com/Sirupsen/logrus"
 	"github.com/docker/docker/daemon/graphdriver"
+	"golang.org/x/sys/unix"
 )
 
 func checkRootdirFs(rootdir string) error {
-	var buf syscall.Statfs_t
-	if err := syscall.Statfs(rootdir, &buf); err != nil {
+	var buf unix.Statfs_t
+	if err := unix.Statfs(rootdir, &buf); err != nil {
 		return fmt.Errorf("Failed to access '%s': %s", rootdir, err)
 	}
 

daemon/initlayer/setup_unix.go

@@ -6,9 +6,9 @@ import (
 	"os"
 	"path/filepath"
 	"strings"
-	"syscall"
 
 	"github.com/docker/docker/pkg/idtools"
+	"golang.org/x/sys/unix"
 )
 
 // Setup populates a directory with mountpoints suitable
@@ -33,7 +33,7 @@ func Setup(initLayer string, rootIDs idtools.IDPair) error {
 		prev := "/"
 		for _, p := range parts[1:] {
 			prev = filepath.Join(prev, p)
-			syscall.Unlink(filepath.Join(initLayer, prev))
+			unix.Unlink(filepath.Join(initLayer, prev))
 		}
 
 		if _, err := os.Stat(filepath.Join(initLayer, pth)); err != nil {

daemon/logger/etwlogs/etwlogs_windows.go

@@ -16,7 +16,6 @@ import (
 	"errors"
 	"fmt"
 	"sync"
-	"syscall"
 	"unsafe"
 
 	"github.com/Sirupsen/logrus"
@@ -42,12 +41,12 @@ var (
 	procEventWriteString = modAdvapi32.NewProc("EventWriteString")
 	procEventUnregister  = modAdvapi32.NewProc("EventUnregister")
 )
-var providerHandle syscall.Handle
+var providerHandle windows.Handle
 var refCount int
 var mu sync.Mutex
 
 func init() {
-	providerHandle = syscall.InvalidHandle
+	providerHandle = windows.InvalidHandle
 	if err := logger.RegisterLogDriver(name, New); err != nil {
 		logrus.Fatal(err)
 	}
@@ -70,7 +69,7 @@ func New(info logger.Info) (logger.Logger, error) {
 
 // Log logs the message to the ETW stream.
 func (etwLogger *etwLogs) Log(msg *logger.Message) error {
-	if providerHandle == syscall.InvalidHandle {
+	if providerHandle == windows.InvalidHandle {
 		// This should never be hit, if it is, it indicates a programming error.
 		errorMessage := "ETWLogs cannot log the message, because the event provider has not been registered."
 		logrus.Error(errorMessage)
@@ -121,7 +120,7 @@ func unregisterETWProvider() {
 	if refCount == 1 {
 		if callEventUnregister() {
 			refCount--
-			providerHandle = syscall.InvalidHandle
+			providerHandle = windows.InvalidHandle
 		}
 		// Not returning an error if EventUnregister fails, because etwLogs will continue to work
 	} else {
@@ -131,7 +130,7 @@ func unregisterETWProvider() {
 
 func callEventRegister() error {
 	// The provider's GUID is {a3693192-9ed6-46d2-a981-f8226c8363bd}
-	guid := syscall.GUID{
+	guid := windows.GUID{
 		Data1: 0xa3693192,
 		Data2: 0x9ed6,
 		Data3: 0x46d2,
@@ -148,7 +147,7 @@ func callEventRegister() error {
 }
 
 func callEventWriteString(message string) error {
-	utf16message, err := syscall.UTF16FromString(message)
+	utf16message, err := windows.UTF16FromString(message)
 
 	if err != nil {
 		return err

daemon/metrics_unix.go

@@ -7,7 +7,6 @@ import (
 	"net/http"
 	"os"
 	"path/filepath"
-	"syscall"
 
 	"github.com/Sirupsen/logrus"
 	"github.com/docker/docker/pkg/mount"
@@ -15,11 +14,12 @@ import (
 	"github.com/docker/docker/pkg/plugins"
 	metrics "github.com/docker/go-metrics"
 	"github.com/pkg/errors"
+	"golang.org/x/sys/unix"
 )
 
 func (daemon *Daemon) listenMetricsSock() (string, error) {
 	path := filepath.Join(daemon.configStore.ExecRoot, "metrics.sock")
-	syscall.Unlink(path)
+	unix.Unlink(path)
 	l, err := net.Listen("unix", path)
 	if err != nil {
 		return "", errors.Wrap(err, "error setting up metrics plugin listener")

daemon/oci_windows.go

@@ -1,14 +1,13 @@
 package daemon
 
 import (
-	"syscall"
-
 	containertypes "github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/container"
 	"github.com/docker/docker/oci"
 	"github.com/docker/docker/pkg/sysinfo"
 	"github.com/docker/docker/pkg/system"
 	"github.com/opencontainers/runtime-spec/specs-go"
+	"golang.org/x/sys/windows"
 )
 
 func (daemon *Daemon) createSpec(c *container.Container) (*specs.Spec, error) {
@@ -196,7 +195,7 @@ func (daemon *Daemon) createSpecLinuxFields(c *container.Container, s *specs.Spe
 func escapeArgs(args []string) []string {
 	escapedArgs := make([]string, len(args))
 	for i, a := range args {
-		escapedArgs[i] = syscall.EscapeArg(a)
+		escapedArgs[i] = windows.EscapeArg(a)
 	}
 	return escapedArgs
 }

distribution/errors.go

@@ -113,7 +113,7 @@ func continueOnError(err error) bool {
 	case ImageConfigPullError:
 		return false
 	case error:
-		return !strings.Contains(err.Error(), strings.ToLower(syscall.ENOSPC.Error()))
+		return !strings.Contains(err.Error(), strings.ToLower(syscall.ESRCH.Error()))
 	}
 	// let's be nice and fallback if the error is a completely
 	// unexpected one.

integration-cli/daemon/daemon_unix.go

@@ -5,9 +5,9 @@ package daemon
 import (
 	"os"
 	"path/filepath"
-	"syscall"
 
 	"github.com/go-check/check"
+	"golang.org/x/sys/unix"
 )
 
 func cleanupExecRoot(c *check.C, execRoot string) {
@@ -18,7 +18,7 @@ func cleanupExecRoot(c *check.C, execRoot string) {
 	// new exec root.
 	netnsPath := filepath.Join(execRoot, "netns")
 	filepath.Walk(netnsPath, func(path string, info os.FileInfo, err error) error {
-		if err := syscall.Unmount(path, syscall.MNT_FORCE); err != nil {
+		if err := unix.Unmount(path, unix.MNT_FORCE); err != nil {
 			c.Logf("unmount of %s failed: %v", path, err)
 		}
 		os.Remove(path)
@@ -28,9 +28,9 @@ func cleanupExecRoot(c *check.C, execRoot string) {
 
 // SignalDaemonDump sends a signal to the daemon to write a dump file
 func SignalDaemonDump(pid int) {
-	syscall.Kill(pid, syscall.SIGQUIT)
+	unix.Kill(pid, unix.SIGQUIT)
 }
 
 func signalDaemonReload(pid int) error {
-	return syscall.Kill(pid, syscall.SIGHUP)
+	return unix.Kill(pid, unix.SIGHUP)
 }

integration-cli/daemon/daemon_windows.go

@@ -10,21 +10,21 @@ import (
 	"golang.org/x/sys/windows"
 )
 
-func openEvent(desiredAccess uint32, inheritHandle bool, name string, proc *windows.LazyProc) (handle syscall.Handle, err error) {
-	namep, _ := syscall.UTF16PtrFromString(name)
+func openEvent(desiredAccess uint32, inheritHandle bool, name string, proc *windows.LazyProc) (handle windows.Handle, err error) {
+	namep, _ := windows.UTF16PtrFromString(name)
 	var _p2 uint32
 	if inheritHandle {
 		_p2 = 1
 	}
 	r0, _, e1 := proc.Call(uintptr(desiredAccess), uintptr(_p2), uintptr(unsafe.Pointer(namep)))
-	handle = syscall.Handle(r0)
-	if handle == syscall.InvalidHandle {
+	handle = windows.Handle(r0)
+	if handle == windows.InvalidHandle {
 		err = e1
 	}
 	return
 }
 
-func pulseEvent(handle syscall.Handle, proc *windows.LazyProc) (err error) {
+func pulseEvent(handle windows.Handle, proc *windows.LazyProc) (err error) {
 	r0, _, _ := proc.Call(uintptr(handle))
 	if r0 != 0 {
 		err = syscall.Errno(r0)

integration-cli/docker_api_swarm_service_test.go

@@ -7,7 +7,6 @@ import (
 	"path"
 	"strconv"
 	"strings"
-	"syscall"
 	"time"
 
 	"github.com/docker/docker/api/types/swarm"
@@ -17,6 +16,7 @@ import (
 	"github.com/docker/docker/integration-cli/fixtures/plugin"
 	"github.com/go-check/check"
 	"golang.org/x/net/context"
+	"golang.org/x/sys/unix"
 )
 
 func setPortConfig(portConfig []swarm.PortConfig) daemon.ServiceConstructor {
@@ -584,7 +584,7 @@ func (s *DockerSwarmSuite) TestAPISwarmServicesStateReporting(c *check.C) {
 	c.Assert(err, checker.IsNil)
 	pid, err := strconv.Atoi(strings.TrimSpace(pidStr))
 	c.Assert(err, checker.IsNil)
-	c.Assert(syscall.Kill(pid, syscall.SIGKILL), checker.IsNil)
+	c.Assert(unix.Kill(pid, unix.SIGKILL), checker.IsNil)
 
 	time.Sleep(time.Second) // give some time to handle the signal
 

integration-cli/docker_cli_daemon_plugins_test.go

@@ -6,12 +6,12 @@ import (
 	"os"
 	"path/filepath"
 	"strings"
-	"syscall"
 
 	"github.com/docker/docker/integration-cli/checker"
 	"github.com/docker/docker/pkg/mount"
 	icmd "github.com/docker/docker/pkg/testutil/cmd"
 	"github.com/go-check/check"
+	"golang.org/x/sys/unix"
 )
 
 // TestDaemonRestartWithPluginEnabled tests state restore for an enabled plugin
@@ -145,7 +145,7 @@ func (s *DockerDaemonSuite) TestDaemonShutdownWithPlugins(c *check.C) {
 	}
 
 	for {
-		if err := syscall.Kill(s.d.Pid(), 0); err == syscall.ESRCH {
+		if err := unix.Kill(s.d.Pid(), 0); err == unix.ESRCH {
 			break
 		}
 	}

integration-cli/docker_cli_daemon_test.go

@@ -19,7 +19,6 @@ import (
 	"strconv"
 	"strings"
 	"sync"
-	"syscall"
 	"time"
 
 	"crypto/tls"
@@ -42,6 +41,7 @@ import (
 	"github.com/docker/libtrust"
 	"github.com/go-check/check"
 	"github.com/kr/pty"
+	"golang.org/x/sys/unix"
 )
 
 // TestLegacyDaemonCommand test starting docker daemon using "deprecated" docker daemon
@@ -2309,8 +2309,8 @@ func (s *DockerDaemonSuite) TestDaemonMaxConcurrencyWithConfigFile(c *check.C) {
 	fmt.Fprintf(configFile, "%s", daemonConfig)
 	configFile.Close()
 
-	c.Assert(s.d.Signal(syscall.SIGHUP), checker.IsNil)
-	// syscall.Kill(s.d.cmd.Process.Pid, syscall.SIGHUP)
+	c.Assert(s.d.Signal(unix.SIGHUP), checker.IsNil)
+	// unix.Kill(s.d.cmd.Process.Pid, unix.SIGHUP)
 
 	time.Sleep(3 * time.Second)
 
@@ -2350,8 +2350,8 @@ func (s *DockerDaemonSuite) TestDaemonMaxConcurrencyWithConfigFileReload(c *chec
 	fmt.Fprintf(configFile, "%s", daemonConfig)
 	configFile.Close()
 
-	c.Assert(s.d.Signal(syscall.SIGHUP), checker.IsNil)
-	// syscall.Kill(s.d.cmd.Process.Pid, syscall.SIGHUP)
+	c.Assert(s.d.Signal(unix.SIGHUP), checker.IsNil)
+	// unix.Kill(s.d.cmd.Process.Pid, unix.SIGHUP)
 
 	time.Sleep(3 * time.Second)
 
@@ -2368,7 +2368,7 @@ func (s *DockerDaemonSuite) TestDaemonMaxConcurrencyWithConfigFileReload(c *chec
 	fmt.Fprintf(configFile, "%s", daemonConfig)
 	configFile.Close()
 
-	c.Assert(s.d.Signal(syscall.SIGHUP), checker.IsNil)
+	c.Assert(s.d.Signal(unix.SIGHUP), checker.IsNil)
 
 	time.Sleep(3 * time.Second)
 
@@ -2455,7 +2455,7 @@ func (s *DockerDaemonSuite) TestRunWithRuntimeFromConfigFile(c *check.C) {
 }
 `
 	ioutil.WriteFile(configName, []byte(config), 0644)
-	c.Assert(s.d.Signal(syscall.SIGHUP), checker.IsNil)
+	c.Assert(s.d.Signal(unix.SIGHUP), checker.IsNil)
 	// Give daemon time to reload config
 	<-time.After(1 * time.Second)
 
@@ -2484,7 +2484,7 @@ func (s *DockerDaemonSuite) TestRunWithRuntimeFromConfigFile(c *check.C) {
 }
 `
 	ioutil.WriteFile(configName, []byte(config), 0644)
-	c.Assert(s.d.Signal(syscall.SIGHUP), checker.IsNil)
+	c.Assert(s.d.Signal(unix.SIGHUP), checker.IsNil)
 	// Give daemon time to reload config
 	<-time.After(1 * time.Second)
 
@@ -2510,7 +2510,7 @@ func (s *DockerDaemonSuite) TestRunWithRuntimeFromConfigFile(c *check.C) {
 }
 `
 	ioutil.WriteFile(configName, []byte(config), 0644)
-	c.Assert(s.d.Signal(syscall.SIGHUP), checker.IsNil)
+	c.Assert(s.d.Signal(unix.SIGHUP), checker.IsNil)
 	// Give daemon time to reload config
 	<-time.After(1 * time.Second)
 
@@ -2762,7 +2762,7 @@ func (s *DockerDaemonSuite) TestDaemonShutdownTimeout(c *check.C) {
 	_, err := s.d.Cmd("run", "-d", "busybox", "top")
 	c.Assert(err, check.IsNil)
 
-	c.Assert(s.d.Signal(syscall.SIGINT), checker.IsNil)
+	c.Assert(s.d.Signal(unix.SIGINT), checker.IsNil)
 
 	select {
 	case <-s.d.Wait:
@@ -2796,7 +2796,7 @@ func (s *DockerDaemonSuite) TestDaemonShutdownTimeoutWithConfigFile(c *check.C)
 	fmt.Fprintf(configFile, "%s", daemonConfig)
 	configFile.Close()
 
-	c.Assert(s.d.Signal(syscall.SIGHUP), checker.IsNil)
+	c.Assert(s.d.Signal(unix.SIGHUP), checker.IsNil)
 
 	select {
 	case <-s.d.Wait:
@@ -2897,7 +2897,7 @@ func (s *DockerDaemonSuite) TestRestartPolicyWithLiveRestore(c *check.C) {
 	pidint, err := strconv.Atoi(strings.TrimSpace(pid))
 	c.Assert(err, check.IsNil)
 	c.Assert(pidint, checker.GreaterThan, 0)
-	c.Assert(syscall.Kill(pidint, syscall.SIGKILL), check.IsNil)
+	c.Assert(unix.Kill(pidint, unix.SIGKILL), check.IsNil)
 
 	ticker := time.NewTicker(50 * time.Millisecond)
 	timeout := time.After(10 * time.Second)

integration-cli/docker_cli_events_unix_test.go

@@ -10,7 +10,6 @@ import (
 	"os"
 	"os/exec"
 	"strings"
-	"syscall"
 	"time"
 	"unicode"
 
@@ -18,6 +17,7 @@ import (
 	"github.com/docker/docker/integration-cli/cli/build"
 	"github.com/go-check/check"
 	"github.com/kr/pty"
+	"golang.org/x/sys/unix"
 )
 
 // #5979
@@ -421,7 +421,7 @@ func (s *DockerDaemonSuite) TestDaemonEvents(c *check.C) {
 	fmt.Fprintf(configFile, "%s", daemonConfig)
 	configFile.Close()
 
-	c.Assert(s.d.Signal(syscall.SIGHUP), checker.IsNil)
+	c.Assert(s.d.Signal(unix.SIGHUP), checker.IsNil)
 
 	time.Sleep(3 * time.Second)
 
@@ -459,7 +459,7 @@ func (s *DockerDaemonSuite) TestDaemonEventsWithFilters(c *check.C) {
 	}
 	c.Assert(daemonID, checker.Not(checker.Equals), "")
 
-	c.Assert(s.d.Signal(syscall.SIGHUP), checker.IsNil)
+	c.Assert(s.d.Signal(unix.SIGHUP), checker.IsNil)
 
 	time.Sleep(3 * time.Second)
 

integration-cli/docker_cli_network_unix_test.go

@@ -12,7 +12,6 @@ import (
 	"os"
 	"path/filepath"
 	"strings"
-	"syscall"
 	"time"
 
 	"github.com/docker/docker/api/types"
@@ -30,6 +29,7 @@ import (
 	"github.com/docker/libnetwork/netlabel"
 	"github.com/go-check/check"
 	"github.com/vishvananda/netlink"
+	"golang.org/x/sys/unix"
 )
 
 const dummyNetworkDriver = "dummy-network-driver"
@@ -1810,12 +1810,12 @@ func (s *DockerNetworkSuite) TestConntrackFlowsLeak(c *check.C) {
 	cli.DockerCmd(c, "run", "-d", "--name", "client", "--net=host", "appropriate/nc", "sh", "-c", cmd)
 
 	// Get all the flows using netlink
-	flows, err := netlink.ConntrackTableList(netlink.ConntrackTable, syscall.AF_INET)
+	flows, err := netlink.ConntrackTableList(netlink.ConntrackTable, unix.AF_INET)
 	c.Assert(err, check.IsNil)
 	var flowMatch int
 	for _, flow := range flows {
 		// count only the flows that we are interested in, skipping others that can be laying around the host
-		if flow.Forward.Protocol == syscall.IPPROTO_UDP &&
+		if flow.Forward.Protocol == unix.IPPROTO_UDP &&
 			flow.Forward.DstIP.Equal(net.ParseIP("192.168.10.1")) &&
 			flow.Forward.DstPort == 8080 {
 			flowMatch++
@@ -1828,11 +1828,11 @@ func (s *DockerNetworkSuite) TestConntrackFlowsLeak(c *check.C) {
 	cli.DockerCmd(c, "rm", "-fv", "server")
 
 	// Fetch again all the flows and validate that there is no server flow in the conntrack laying around
-	flows, err = netlink.ConntrackTableList(netlink.ConntrackTable, syscall.AF_INET)
+	flows, err = netlink.ConntrackTableList(netlink.ConntrackTable, unix.AF_INET)
 	c.Assert(err, check.IsNil)
 	flowMatch = 0
 	for _, flow := range flows {
-		if flow.Forward.Protocol == syscall.IPPROTO_UDP &&
+		if flow.Forward.Protocol == unix.IPPROTO_UDP &&
 			flow.Forward.DstIP.Equal(net.ParseIP("192.168.10.1")) &&
 			flow.Forward.DstPort == 8080 {
 			flowMatch++

libcontainerd/client_linux.go

@@ -5,7 +5,6 @@ import (
 	"os"
 	"strings"
 	"sync"
-	"syscall"
 	"time"
 
 	"github.com/Sirupsen/logrus"
@@ -17,6 +16,7 @@ import (
 	"github.com/golang/protobuf/ptypes/timestamp"
 	specs "github.com/opencontainers/runtime-spec/specs-go"
 	"golang.org/x/net/context"
+	"golang.org/x/sys/unix"
 )
 
 type client struct {
@@ -95,9 +95,9 @@ func (clnt *client) AddProcess(ctx context.Context, containerID, processFriendly
 			AdditionalGids: sp.User.AdditionalGids,
 		},
 		Pid:             processFriendlyName,
-		Stdin:           p.fifo(syscall.Stdin),
-		Stdout:          p.fifo(syscall.Stdout),
-		Stderr:          p.fifo(syscall.Stderr),
+		Stdin:           p.fifo(unix.Stdin),
+		Stdout:          p.fifo(unix.Stdout),
+		Stderr:          p.fifo(unix.Stderr),
 		Capabilities:    sp.Capabilities.Effective,
 		ApparmorProfile: sp.ApparmorProfile,
 		SelinuxLabel:    sp.SelinuxLabel,
@@ -226,7 +226,7 @@ func (clnt *client) cleanupOldRootfs(containerID string) {
 	if mts, err := mount.GetMounts(); err == nil {
 		for _, mts := range mts {
 			if strings.HasSuffix(mts.Mountpoint, containerID+"/rootfs") {
-				if err := syscall.Unmount(mts.Mountpoint, syscall.MNT_DETACH); err == nil {
+				if err := unix.Unmount(mts.Mountpoint, unix.MNT_DETACH); err == nil {
 					os.RemoveAll(strings.TrimSuffix(mts.Mountpoint, "/rootfs"))
 				}
 				break
@@ -524,7 +524,7 @@ func (clnt *client) Restore(containerID string, attachStdio StdioCallback, optio
 
 	container.discardFifos()
 
-	if err := clnt.Signal(containerID, int(syscall.SIGTERM)); err != nil {
+	if err := clnt.Signal(containerID, int(unix.SIGTERM)); err != nil {
 		logrus.Errorf("libcontainerd: error sending sigterm to %v: %v", containerID, err)
 	}
 
@@ -541,7 +541,7 @@ func (clnt *client) Restore(containerID string, attachStdio StdioCallback, optio
 
 	select {
 	case <-time.After(10 * time.Second):
-		if err := clnt.Signal(containerID, int(syscall.SIGKILL)); err != nil {
+		if err := clnt.Signal(containerID, int(unix.SIGKILL)); err != nil {
 			logrus.Errorf("libcontainerd: error sending sigkill to %v: %v", containerID, err)
 		}
 		select {

libcontainerd/container_unix.go

@@ -9,7 +9,6 @@ import (
 	"os"
 	"path/filepath"
 	"sync"
-	"syscall"
 	"time"
 
 	"github.com/Sirupsen/logrus"
@@ -18,6 +17,7 @@ import (
 	specs "github.com/opencontainers/runtime-spec/specs-go"
 	"github.com/tonistiigi/fifo"
 	"golang.org/x/net/context"
+	"golang.org/x/sys/unix"
 )
 
 type container struct {
@@ -69,7 +69,7 @@ func (ctr *container) clean() error {
 // Caller needs to lock container ID before calling this method.
 func (ctr *container) cleanProcess(id string) {
 	if p, ok := ctr.processes[id]; ok {
-		for _, i := range []int{syscall.Stdin, syscall.Stdout, syscall.Stderr} {
+		for _, i := range []int{unix.Stdin, unix.Stdout, unix.Stderr} {
 			if err := os.Remove(p.fifo(i)); err != nil && !os.IsNotExist(err) {
 				logrus.Warnf("libcontainerd: failed to remove %v for process %v: %v", p.fifo(i), id, err)
 			}
@@ -137,9 +137,9 @@ func (ctr *container) start(spec *specs.Spec, checkpoint, checkpointDir string,
 	r := &containerd.CreateContainerRequest{
 		Id:            ctr.containerID,
 		BundlePath:    ctr.dir,
-		Stdin:         ctr.fifo(syscall.Stdin),
-		Stdout:        ctr.fifo(syscall.Stdout),
-		Stderr:        ctr.fifo(syscall.Stderr),
+		Stdin:         ctr.fifo(unix.Stdin),
+		Stdout:        ctr.fifo(unix.Stdout),
+		Stderr:        ctr.fifo(unix.Stderr),
 		Checkpoint:    checkpoint,
 		CheckpointDir: checkpointDir,
 		// check to see if we are running in ramdisk to disable pivot root
@@ -233,8 +233,8 @@ func (ctr *container) handleEvent(e *containerd.Event) error {
 // that may be blocked on the writer side.
 func (ctr *container) discardFifos() {
 	ctx, _ := context.WithTimeout(context.Background(), 3*time.Second)
-	for _, i := range []int{syscall.Stdout, syscall.Stderr} {
-		f, err := fifo.OpenFifo(ctx, ctr.fifo(i), syscall.O_RDONLY|syscall.O_NONBLOCK, 0)
+	for _, i := range []int{unix.Stdout, unix.Stderr} {
+		f, err := fifo.OpenFifo(ctx, ctr.fifo(i), unix.O_RDONLY|unix.O_NONBLOCK, 0)
 		if err != nil {
 			logrus.Warnf("error opening fifo %v for discarding: %+v", f, err)
 			continue

libcontainerd/container_windows.go

@@ -6,13 +6,13 @@ import (
 	"io"
 	"io/ioutil"
 	"strings"
-	"syscall"
 	"time"
 
 	"github.com/Microsoft/hcsshim"
 	"github.com/Sirupsen/logrus"
 	"github.com/docker/docker/pkg/system"
 	"github.com/opencontainers/runtime-spec/specs-go"
+	"golang.org/x/sys/windows"
 )
 
 type container struct {
@@ -185,7 +185,7 @@ func (ctr *container) waitProcessExitCode(process *process) int {
 	// Block indefinitely for the process to exit.
 	err := process.hcsProcess.Wait()
 	if err != nil {
-		if herr, ok := err.(*hcsshim.ProcessError); ok && herr.Err != syscall.ERROR_BROKEN_PIPE {
+		if herr, ok := err.(*hcsshim.ProcessError); ok && herr.Err != windows.ERROR_BROKEN_PIPE {
 			logrus.Warnf("libcontainerd: Wait() failed (container may have been killed): %s", err)
 		}
 		// Fall through here, do not return. This ensures we attempt to continue the
@@ -195,7 +195,7 @@ func (ctr *container) waitProcessExitCode(process *process) int {
 
 	exitCode, err := process.hcsProcess.ExitCode()
 	if err != nil {
-		if herr, ok := err.(*hcsshim.ProcessError); ok && herr.Err != syscall.ERROR_BROKEN_PIPE {
+		if herr, ok := err.(*hcsshim.ProcessError); ok && herr.Err != windows.ERROR_BROKEN_PIPE {
 			logrus.Warnf("libcontainerd: unable to get exit code from container %s", ctr.containerID)
 		}
 		// Since we got an error retrieving the exit code, make sure that the code we return

libcontainerd/remote_unix.go

@@ -15,7 +15,6 @@ import (
 	"strconv"
 	"strings"
 	"sync"
-	"syscall"
 	"time"
 
 	"github.com/Sirupsen/logrus"
@@ -25,6 +24,7 @@ import (
 	"github.com/golang/protobuf/ptypes"
 	"github.com/golang/protobuf/ptypes/timestamp"
 	"golang.org/x/net/context"
+	"golang.org/x/sys/unix"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/grpclog"
 	"google.golang.org/grpc/health/grpc_health_v1"
@@ -185,7 +185,7 @@ func (r *remote) Cleanup() {
 	r.closedManually = true
 	r.rpcConn.Close()
 	// Ask the daemon to quit
-	syscall.Kill(r.daemonPid, syscall.SIGTERM)
+	unix.Kill(r.daemonPid, unix.SIGTERM)
 
 	// Wait up to 15secs for it to stop
 	for i := time.Duration(0); i < containerdShutdownTimeout; i += time.Second {
@@ -197,7 +197,7 @@ func (r *remote) Cleanup() {
 
 	if system.IsProcessAlive(r.daemonPid) {
 		logrus.Warnf("libcontainerd: containerd (%d) didn't stop within 15 secs, killing it\n", r.daemonPid)
-		syscall.Kill(r.daemonPid, syscall.SIGKILL)
+		unix.Kill(r.daemonPid, unix.SIGKILL)
 	}
 
 	// cleanup some files
@@ -224,7 +224,7 @@ func (r *remote) Client(b Backend) (Client, error) {
 }
 
 func (r *remote) updateEventTimestamp(t time.Time) {
-	f, err := os.OpenFile(r.eventTsPath, syscall.O_CREAT|syscall.O_WRONLY|syscall.O_TRUNC, 0600)
+	f, err := os.OpenFile(r.eventTsPath, unix.O_CREAT|unix.O_WRONLY|unix.O_TRUNC, 0600)
 	if err != nil {
 		logrus.Warnf("libcontainerd: failed to open event timestamp file: %v", err)
 		return

libcontainerd/utils_linux.go

@@ -5,6 +5,7 @@ import (
 
 	containerd "github.com/containerd/containerd/api/grpc/types"
 	"github.com/opencontainers/runtime-spec/specs-go"
+	"golang.org/x/sys/unix"
 )
 
 func getRootIDs(s specs.Spec) (int, int, error) {
@@ -57,6 +58,6 @@ func convertRlimits(sr []specs.LinuxRlimit) (cr []*containerd.Rlimit) {
 func setSysProcAttr(sid bool) *syscall.SysProcAttr {
 	return &syscall.SysProcAttr{
 		Setsid:    sid,
-		Pdeathsig: syscall.SIGKILL,
+		Pdeathsig: unix.SIGKILL,
 	}
 }

pkg/archive/archive_linux.go

@@ -5,9 +5,9 @@ import (
 	"os"
 	"path/filepath"
 	"strings"
-	"syscall"
 
 	"github.com/docker/docker/pkg/system"
+	"golang.org/x/sys/unix"
 )
 
 func getWhiteoutConverter(format WhiteoutFormat) tarWhiteoutConverter {
@@ -67,7 +67,7 @@ func (overlayWhiteoutConverter) ConvertRead(hdr *tar.Header, path string) (bool,
 
 	// if a directory is marked as opaque by the AUFS special file, we need to translate that to overlay
 	if base == WhiteoutOpaqueDir {
-		err := syscall.Setxattr(dir, "trusted.overlay.opaque", []byte{'y'}, 0)
+		err := unix.Setxattr(dir, "trusted.overlay.opaque", []byte{'y'}, 0)
 		// don't write the file itself
 		return false, err
 	}
@@ -77,7 +77,7 @@ func (overlayWhiteoutConverter) ConvertRead(hdr *tar.Header, path string) (bool,
 		originalBase := base[len(WhiteoutPrefix):]
 		originalPath := filepath.Join(dir, originalBase)
 
-		if err := syscall.Mknod(originalPath, syscall.S_IFCHR, 0); err != nil {
+		if err := unix.Mknod(originalPath, unix.S_IFCHR, 0); err != nil {
 			return false, err
 		}
 		if err := os.Chown(originalPath, hdr.Uid, hdr.Gid); err != nil {

pkg/archive/archive_linux_test.go

@@ -8,6 +8,7 @@ import (
 	"testing"
 
 	"github.com/docker/docker/pkg/system"
+	"golang.org/x/sys/unix"
 )
 
 // setupOverlayTestDir creates files in a directory with overlay whiteouts
@@ -51,7 +52,7 @@ func setupOverlayTestDir(t *testing.T, src string) {
 		t.Fatal(err)
 	}
 
-	if err := system.Mknod(filepath.Join(src, "d3", "f1"), syscall.S_IFCHR, 0); err != nil {
+	if err := system.Mknod(filepath.Join(src, "d3", "f1"), unix.S_IFCHR, 0); err != nil {
 		t.Fatal(err)
 	}
 }

pkg/archive/archive_unix.go

@@ -12,6 +12,7 @@ import (
 	"github.com/docker/docker/pkg/idtools"
 	"github.com/docker/docker/pkg/system"
 	rsystem "github.com/opencontainers/runc/libcontainer/system"
+	"golang.org/x/sys/unix"
 )
 
 // fixVolumePathPrefix does platform specific processing to ensure that if
@@ -47,8 +48,8 @@ func setHeaderForSpecialDevice(hdr *tar.Header, name string, stat interface{}) (
 
 	if ok {
 		// Currently go does not fill in the major/minors
-		if s.Mode&syscall.S_IFBLK != 0 ||
-			s.Mode&syscall.S_IFCHR != 0 {
+		if s.Mode&unix.S_IFBLK != 0 ||
+			s.Mode&unix.S_IFCHR != 0 {
 			hdr.Devmajor = int64(major(uint64(s.Rdev)))
 			hdr.Devminor = int64(minor(uint64(s.Rdev)))
 		}
@@ -95,11 +96,11 @@ func handleTarTypeBlockCharFifo(hdr *tar.Header, path string) error {
 	mode := uint32(hdr.Mode & 07777)
 	switch hdr.Typeflag {
 	case tar.TypeBlock:
-		mode |= syscall.S_IFBLK
+		mode |= unix.S_IFBLK
 	case tar.TypeChar:
-		mode |= syscall.S_IFCHR
+		mode |= unix.S_IFCHR
 	case tar.TypeFifo:
-		mode |= syscall.S_IFIFO
+		mode |= unix.S_IFIFO
 	}
 
 	return system.Mknod(path, mode, int(system.Mkdev(hdr.Devmajor, hdr.Devminor)))

pkg/archive/archive_unix_test.go

@@ -13,6 +13,7 @@ import (
 	"testing"
 
 	"github.com/docker/docker/pkg/system"
+	"golang.org/x/sys/unix"
 )
 
 func TestCanonicalTarNameForPath(t *testing.T) {
@@ -159,13 +160,13 @@ func TestTarWithBlockCharFifo(t *testing.T) {
 	if err := ioutil.WriteFile(filepath.Join(origin, "1"), []byte("hello world"), 0700); err != nil {
 		t.Fatal(err)
 	}
-	if err := system.Mknod(filepath.Join(origin, "2"), syscall.S_IFBLK, int(system.Mkdev(int64(12), int64(5)))); err != nil {
+	if err := system.Mknod(filepath.Join(origin, "2"), unix.S_IFBLK, int(system.Mkdev(int64(12), int64(5)))); err != nil {
 		t.Fatal(err)
 	}
-	if err := system.Mknod(filepath.Join(origin, "3"), syscall.S_IFCHR, int(system.Mkdev(int64(12), int64(5)))); err != nil {
+	if err := system.Mknod(filepath.Join(origin, "3"), unix.S_IFCHR, int(system.Mkdev(int64(12), int64(5)))); err != nil {
 		t.Fatal(err)
 	}
-	if err := system.Mknod(filepath.Join(origin, "4"), syscall.S_IFIFO, int(system.Mkdev(int64(12), int64(5)))); err != nil {
+	if err := system.Mknod(filepath.Join(origin, "4"), unix.S_IFIFO, int(system.Mkdev(int64(12), int64(5)))); err != nil {
 		t.Fatal(err)
 	}
 

pkg/archive/changes_linux.go

@@ -10,6 +10,7 @@ import (
 	"unsafe"
 
 	"github.com/docker/docker/pkg/system"
+	"golang.org/x/sys/unix"
 )
 
 // walker is used to implement collectFileInfoForChanges on linux. Where this
@@ -233,7 +234,7 @@ func readdirnames(dirname string) (names []nameIno, err error) {
 		// Refill the buffer if necessary
 		if bufp >= nbuf {
 			bufp = 0
-			nbuf, err = syscall.ReadDirent(int(f.Fd()), buf) // getdents on linux
+			nbuf, err = unix.ReadDirent(int(f.Fd()), buf) // getdents on linux
 			if nbuf < 0 {
 				nbuf = 0
 			}
@@ -255,12 +256,12 @@ func readdirnames(dirname string) (names []nameIno, err error) {
 	return sl, nil
 }
 
-// parseDirent is a minor modification of syscall.ParseDirent (linux version)
+// parseDirent is a minor modification of unix.ParseDirent (linux version)
 // which returns {name,inode} pairs instead of just names.
 func parseDirent(buf []byte, names []nameIno) (consumed int, newnames []nameIno) {
 	origlen := len(buf)
 	for len(buf) > 0 {
-		dirent := (*syscall.Dirent)(unsafe.Pointer(&buf[0]))
+		dirent := (*unix.Dirent)(unsafe.Pointer(&buf[0]))
 		buf = buf[dirent.Reclen:]
 		if dirent.Ino == 0 { // File absent in directory.
 			continue

pkg/archive/changes_unix.go

@@ -7,6 +7,7 @@ import (
 	"syscall"
 
 	"github.com/docker/docker/pkg/system"
+	"golang.org/x/sys/unix"
 )
 
 func statDifferent(oldStat *system.StatT, newStat *system.StatT) bool {
@@ -16,7 +17,7 @@ func statDifferent(oldStat *system.StatT, newStat *system.StatT) bool {
 		oldStat.GID() != newStat.GID() ||
 		oldStat.Rdev() != newStat.Rdev() ||
 		// Don't look at size for dirs, its not a good measure of change
-		(oldStat.Mode()&syscall.S_IFDIR != syscall.S_IFDIR &&
+		(oldStat.Mode()&unix.S_IFDIR != unix.S_IFDIR &&
 			(!sameFsTimeSpec(oldStat.Mtim(), newStat.Mtim()) || (oldStat.Size() != newStat.Size()))) {
 		return true
 	}
@@ -24,7 +25,7 @@ func statDifferent(oldStat *system.StatT, newStat *system.StatT) bool {
 }
 
 func (info *FileInfo) isDir() bool {
-	return info.parent == nil || info.stat.Mode()&syscall.S_IFDIR != 0
+	return info.parent == nil || info.stat.Mode()&unix.S_IFDIR != 0
 }
 
 func getIno(fi os.FileInfo) uint64 {

pkg/chrootarchive/chroot_linux.go

@@ -5,10 +5,10 @@ import (
 	"io/ioutil"
 	"os"
 	"path/filepath"
-	"syscall"
 
 	"github.com/docker/docker/pkg/mount"
 	rsystem "github.com/opencontainers/runc/libcontainer/system"
+	"golang.org/x/sys/unix"
 )
 
 // chroot on linux uses pivot_root instead of chroot
@@ -22,7 +22,7 @@ func chroot(path string) (err error) {
 	if rsystem.RunningInUserNS() {
 		return realChroot(path)
 	}
-	if err := syscall.Unshare(syscall.CLONE_NEWNS); err != nil {
+	if err := unix.Unshare(unix.CLONE_NEWNS); err != nil {
 		return fmt.Errorf("Error creating mount namespace before pivot: %v", err)
 	}
 
@@ -47,7 +47,7 @@ func chroot(path string) (err error) {
 	defer func() {
 		if mounted {
 			// make sure pivotDir is not mounted before we try to remove it
-			if errCleanup := syscall.Unmount(pivotDir, syscall.MNT_DETACH); errCleanup != nil {
+			if errCleanup := unix.Unmount(pivotDir, unix.MNT_DETACH); errCleanup != nil {
 				if err == nil {
 					err = errCleanup
 				}
@@ -66,7 +66,7 @@ func chroot(path string) (err error) {
 		}
 	}()
 
-	if err := syscall.PivotRoot(path, pivotDir); err != nil {
+	if err := unix.PivotRoot(path, pivotDir); err != nil {
 		// If pivot fails, fall back to the normal chroot after cleaning up temp dir
 		if err := os.Remove(pivotDir); err != nil {
 			return fmt.Errorf("Error cleaning up after failed pivot: %v", err)
@@ -79,17 +79,17 @@ func chroot(path string) (err error) {
 	// This dir contains the rootfs of the caller, which we need to remove so it is not visible during extraction
 	pivotDir = filepath.Join("/", filepath.Base(pivotDir))
 
-	if err := syscall.Chdir("/"); err != nil {
+	if err := unix.Chdir("/"); err != nil {
 		return fmt.Errorf("Error changing to new root: %v", err)
 	}
 
 	// Make the pivotDir (where the old root lives) private so it can be unmounted without propagating to the host
-	if err := syscall.Mount("", pivotDir, "", syscall.MS_PRIVATE|syscall.MS_REC, ""); err != nil {
+	if err := unix.Mount("", pivotDir, "", unix.MS_PRIVATE|unix.MS_REC, ""); err != nil {
 		return fmt.Errorf("Error making old root private after pivot: %v", err)
 	}
 
 	// Now unmount the old root so it's no longer visible from the new root
-	if err := syscall.Unmount(pivotDir, syscall.MNT_DETACH); err != nil {
+	if err := unix.Unmount(pivotDir, unix.MNT_DETACH); err != nil {
 		return fmt.Errorf("Error while unmounting old root after pivot: %v", err)
 	}
 	mounted = false
@@ -98,10 +98,10 @@ func chroot(path string) (err error) {
 }
 
 func realChroot(path string) error {
-	if err := syscall.Chroot(path); err != nil {
+	if err := unix.Chroot(path); err != nil {
 		return fmt.Errorf("Error after fallback to chroot: %v", err)
 	}
-	if err := syscall.Chdir("/"); err != nil {
+	if err := unix.Chdir("/"); err != nil {
 		return fmt.Errorf("Error changing to new root after chroot: %v", err)
 	}
 	return nil

pkg/chrootarchive/chroot_unix.go

@@ -2,11 +2,11 @@
 
 package chrootarchive
 
-import "syscall"
+import "golang.org/x/sys/unix"
 
 func chroot(path string) error {
-	if err := syscall.Chroot(path); err != nil {
+	if err := unix.Chroot(path); err != nil {
 		return err
 	}
-	return syscall.Chdir("/")
+	return unix.Chdir("/")
 }

pkg/devicemapper/devmapper.go

@@ -7,10 +7,10 @@ import (
 	"fmt"
 	"os"
 	"runtime"
-	"syscall"
 	"unsafe"
 
 	"github.com/Sirupsen/logrus"
+	"golang.org/x/sys/unix"
 )
 
 // DevmapperLogger defines methods for logging with devicemapper.
@@ -449,7 +449,7 @@ func BlockDeviceDiscard(path string) error {
 
 	// Without this sometimes the remove of the device that happens after
 	// discard fails with EBUSY.
-	syscall.Sync()
+	unix.Sync()
 
 	return nil
 }

pkg/devicemapper/ioctl.go

@@ -3,13 +3,14 @@
 package devicemapper
 
 import (
-	"syscall"
 	"unsafe"
+
+	"golang.org/x/sys/unix"
 )
 
 func ioctlBlkGetSize64(fd uintptr) (int64, error) {
 	var size int64
-	if _, _, err := syscall.Syscall(syscall.SYS_IOCTL, fd, BlkGetSize64, uintptr(unsafe.Pointer(&size))); err != 0 {
+	if _, _, err := unix.Syscall(unix.SYS_IOCTL, fd, BlkGetSize64, uintptr(unsafe.Pointer(&size))); err != 0 {
 		return 0, err
 	}
 	return size, nil
@@ -20,7 +21,7 @@ func ioctlBlkDiscard(fd uintptr, offset, length uint64) error {
 	r[0] = offset
 	r[1] = length
 
-	if _, _, err := syscall.Syscall(syscall.SYS_IOCTL, fd, BlkDiscard, uintptr(unsafe.Pointer(&r[0]))); err != 0 {
+	if _, _, err := unix.Syscall(unix.SYS_IOCTL, fd, BlkDiscard, uintptr(unsafe.Pointer(&r[0]))); err != 0 {
 		return err
 	}
 	return nil

pkg/fsutils/fsutils_linux.go

@@ -6,8 +6,9 @@ import (
 	"fmt"
 	"io/ioutil"
 	"os"
-	"syscall"
 	"unsafe"
+
+	"golang.org/x/sys/unix"
 )
 
 func locateDummyIfEmpty(path string) (string, error) {
@@ -40,9 +41,9 @@ func SupportsDType(path string) (bool, error) {
 
 	visited := 0
 	supportsDType := true
-	fn := func(ent *syscall.Dirent) bool {
+	fn := func(ent *unix.Dirent) bool {
 		visited++
-		if ent.Type == syscall.DT_UNKNOWN {
+		if ent.Type == unix.DT_UNKNOWN {
 			supportsDType = false
 			// stop iteration
 			return true
@@ -59,7 +60,7 @@ func SupportsDType(path string) (bool, error) {
 	return supportsDType, nil
 }
 
-func iterateReadDir(path string, fn func(*syscall.Dirent) bool) error {
+func iterateReadDir(path string, fn func(*unix.Dirent) bool) error {
 	d, err := os.Open(path)
 	if err != nil {
 		return err
@@ -68,7 +69,7 @@ func iterateReadDir(path string, fn func(*syscall.Dirent) bool) error {
 	fd := int(d.Fd())
 	buf := make([]byte, 4096)
 	for {
-		nbytes, err := syscall.ReadDirent(fd, buf)
+		nbytes, err := unix.ReadDirent(fd, buf)
 		if err != nil {
 			return err
 		}
@@ -76,7 +77,7 @@ func iterateReadDir(path string, fn func(*syscall.Dirent) bool) error {
 			break
 		}
 		for off := 0; off < nbytes; {
-			ent := (*syscall.Dirent)(unsafe.Pointer(&buf[off]))
+			ent := (*unix.Dirent)(unsafe.Pointer(&buf[off]))
 			if stop := fn(ent); stop {
 				return nil
 			}

pkg/fsutils/fsutils_linux_test.go

@@ -6,8 +6,9 @@ import (
 	"io/ioutil"
 	"os"
 	"os/exec"
-	"syscall"
 	"testing"
+
+	"golang.org/x/sys/unix"
 )
 
 func testSupportsDType(t *testing.T, expected bool, mkfsCommand string, mkfsArg ...string) {
@@ -53,7 +54,7 @@ func testSupportsDType(t *testing.T, expected bool, mkfsCommand string, mkfsArg
 	}
 
 	// loopback-mount the image.
-	// for ease of setting up loopback device, we use os/exec rather than syscall.Mount
+	// for ease of setting up loopback device, we use os/exec rather than unix.Mount
 	out, err = exec.Command("mount", "-o", "loop", imageFileName, mountpoint).CombinedOutput()
 	if len(out) > 0 {
 		t.Log(string(out))
@@ -62,7 +63,7 @@ func testSupportsDType(t *testing.T, expected bool, mkfsCommand string, mkfsArg
 		t.Skip("skipping the test because mount failed")
 	}
 	defer func() {
-		if err := syscall.Unmount(mountpoint, 0); err != nil {
+		if err := unix.Unmount(mountpoint, 0); err != nil {
 			t.Fatal(err)
 		}
 	}()

pkg/loopback/attach_loopback.go

@@ -6,9 +6,9 @@ import (
 	"errors"
 	"fmt"
 	"os"
-	"syscall"
 
 	"github.com/Sirupsen/logrus"
+	"golang.org/x/sys/unix"
 )
 
 // Loopback related errors
@@ -69,7 +69,7 @@ func openNextAvailableLoopback(index int, sparseFile *os.File) (loopFile *os.Fil
 			loopFile.Close()
 
 			// If the error is EBUSY, then try the next loopback
-			if err != syscall.EBUSY {
+			if err != unix.EBUSY {
 				logrus.Errorf("Cannot set up loopback device %s: %s", target, err)
 				return nil, ErrAttachLoopbackDevice
 			}

pkg/loopback/ioctl.go

@@ -3,12 +3,13 @@
 package loopback
 
 import (
-	"syscall"
 	"unsafe"
+
+	"golang.org/x/sys/unix"
 )
 
 func ioctlLoopCtlGetFree(fd uintptr) (int, error) {
-	index, _, err := syscall.Syscall(syscall.SYS_IOCTL, fd, LoopCtlGetFree, 0)
+	index, _, err := unix.Syscall(unix.SYS_IOCTL, fd, LoopCtlGetFree, 0)
 	if err != 0 {
 		return 0, err
 	}
@@ -16,21 +17,21 @@ func ioctlLoopCtlGetFree(fd uintptr) (int, error) {
 }
 
 func ioctlLoopSetFd(loopFd, sparseFd uintptr) error {
-	if _, _, err := syscall.Syscall(syscall.SYS_IOCTL, loopFd, LoopSetFd, sparseFd); err != 0 {
+	if _, _, err := unix.Syscall(unix.SYS_IOCTL, loopFd, LoopSetFd, sparseFd); err != 0 {
 		return err
 	}
 	return nil
 }
 
 func ioctlLoopSetStatus64(loopFd uintptr, loopInfo *loopInfo64) error {
-	if _, _, err := syscall.Syscall(syscall.SYS_IOCTL, loopFd, LoopSetStatus64, uintptr(unsafe.Pointer(loopInfo))); err != 0 {
+	if _, _, err := unix.Syscall(unix.SYS_IOCTL, loopFd, LoopSetStatus64, uintptr(unsafe.Pointer(loopInfo))); err != 0 {
 		return err
 	}
 	return nil
 }
 
 func ioctlLoopClrFd(loopFd uintptr) error {
-	if _, _, err := syscall.Syscall(syscall.SYS_IOCTL, loopFd, LoopClrFd, 0); err != 0 {
+	if _, _, err := unix.Syscall(unix.SYS_IOCTL, loopFd, LoopClrFd, 0); err != 0 {
 		return err
 	}
 	return nil
@@ -39,14 +40,14 @@ func ioctlLoopClrFd(loopFd uintptr) error {
 func ioctlLoopGetStatus64(loopFd uintptr) (*loopInfo64, error) {
 	loopInfo := &loopInfo64{}
 
-	if _, _, err := syscall.Syscall(syscall.SYS_IOCTL, loopFd, LoopGetStatus64, uintptr(unsafe.Pointer(loopInfo))); err != 0 {
+	if _, _, err := unix.Syscall(unix.SYS_IOCTL, loopFd, LoopGetStatus64, uintptr(unsafe.Pointer(loopInfo))); err != 0 {
 		return nil, err
 	}
 	return loopInfo, nil
 }
 
 func ioctlLoopSetCapacity(loopFd uintptr, value int) error {
-	if _, _, err := syscall.Syscall(syscall.SYS_IOCTL, loopFd, LoopSetCapacity, uintptr(value)); err != 0 {
+	if _, _, err := unix.Syscall(unix.SYS_IOCTL, loopFd, LoopSetCapacity, uintptr(value)); err != 0 {
 		return err
 	}
 	return nil

pkg/mount/flags_linux.go

@@ -1,87 +1,87 @@
 package mount
 
 import (
-	"syscall"
+	"golang.org/x/sys/unix"
 )
 
 const (
 	// RDONLY will mount the file system read-only.
-	RDONLY = syscall.MS_RDONLY
+	RDONLY = unix.MS_RDONLY
 
 	// NOSUID will not allow set-user-identifier or set-group-identifier bits to
 	// take effect.
-	NOSUID = syscall.MS_NOSUID
+	NOSUID = unix.MS_NOSUID
 
 	// NODEV will not interpret character or block special devices on the file
 	// system.
-	NODEV = syscall.MS_NODEV
+	NODEV = unix.MS_NODEV
 
 	// NOEXEC will not allow execution of any binaries on the mounted file system.
-	NOEXEC = syscall.MS_NOEXEC
+	NOEXEC = unix.MS_NOEXEC
 
 	// SYNCHRONOUS will allow I/O to the file system to be done synchronously.
-	SYNCHRONOUS = syscall.MS_SYNCHRONOUS
+	SYNCHRONOUS = unix.MS_SYNCHRONOUS
 
 	// DIRSYNC will force all directory updates within the file system to be done
 	// synchronously. This affects the following system calls: create, link,
 	// unlink, symlink, mkdir, rmdir, mknod and rename.
-	DIRSYNC = syscall.MS_DIRSYNC
+	DIRSYNC = unix.MS_DIRSYNC
 
 	// REMOUNT will attempt to remount an already-mounted file system. This is
 	// commonly used to change the mount flags for a file system, especially to
 	// make a readonly file system writeable. It does not change device or mount
 	// point.
-	REMOUNT = syscall.MS_REMOUNT
+	REMOUNT = unix.MS_REMOUNT
 
 	// MANDLOCK will force mandatory locks on a filesystem.
-	MANDLOCK = syscall.MS_MANDLOCK
+	MANDLOCK = unix.MS_MANDLOCK
 
 	// NOATIME will not update the file access time when reading from a file.
-	NOATIME = syscall.MS_NOATIME
+	NOATIME = unix.MS_NOATIME
 
 	// NODIRATIME will not update the directory access time.
-	NODIRATIME = syscall.MS_NODIRATIME
+	NODIRATIME = unix.MS_NODIRATIME
 
 	// BIND remounts a subtree somewhere else.
-	BIND = syscall.MS_BIND
+	BIND = unix.MS_BIND
 
 	// RBIND remounts a subtree and all possible submounts somewhere else.
-	RBIND = syscall.MS_BIND | syscall.MS_REC
+	RBIND = unix.MS_BIND | unix.MS_REC
 
 	// UNBINDABLE creates a mount which cannot be cloned through a bind operation.
-	UNBINDABLE = syscall.MS_UNBINDABLE
+	UNBINDABLE = unix.MS_UNBINDABLE
 
 	// RUNBINDABLE marks the entire mount tree as UNBINDABLE.
-	RUNBINDABLE = syscall.MS_UNBINDABLE | syscall.MS_REC
+	RUNBINDABLE = unix.MS_UNBINDABLE | unix.MS_REC
 
 	// PRIVATE creates a mount which carries no propagation abilities.
-	PRIVATE = syscall.MS_PRIVATE
+	PRIVATE = unix.MS_PRIVATE
 
 	// RPRIVATE marks the entire mount tree as PRIVATE.
-	RPRIVATE = syscall.MS_PRIVATE | syscall.MS_REC
+	RPRIVATE = unix.MS_PRIVATE | unix.MS_REC
 
 	// SLAVE creates a mount which receives propagation from its master, but not
 	// vice versa.
-	SLAVE = syscall.MS_SLAVE
+	SLAVE = unix.MS_SLAVE
 
 	// RSLAVE marks the entire mount tree as SLAVE.
-	RSLAVE = syscall.MS_SLAVE | syscall.MS_REC
+	RSLAVE = unix.MS_SLAVE | unix.MS_REC
 
 	// SHARED creates a mount which provides the ability to create mirrors of
 	// that mount such that mounts and unmounts within any of the mirrors
 	// propagate to the other mirrors.
-	SHARED = syscall.MS_SHARED
+	SHARED = unix.MS_SHARED
 
 	// RSHARED marks the entire mount tree as SHARED.
-	RSHARED = syscall.MS_SHARED | syscall.MS_REC
+	RSHARED = unix.MS_SHARED | unix.MS_REC
 
 	// RELATIME updates inode access times relative to modify or change time.
-	RELATIME = syscall.MS_RELATIME
+	RELATIME = unix.MS_RELATIME
 
 	// STRICTATIME allows to explicitly request full atime updates.  This makes
 	// it possible for the kernel to default to relatime or noatime but still
 	// allow userspace to override it.
-	STRICTATIME = syscall.MS_STRICTATIME
+	STRICTATIME = unix.MS_STRICTATIME
 
-	mntDetach = syscall.MNT_DETACH
+	mntDetach = unix.MNT_DETACH
 )

pkg/mount/mounter_freebsd.go

@@ -13,8 +13,9 @@ import "C"
 import (
 	"fmt"
 	"strings"
-	"syscall"
 	"unsafe"
+
+	"golang.org/x/sys/unix"
 )
 
 func allocateIOVecs(options []string) []C.struct_iovec {
@@ -55,5 +56,5 @@ func mount(device, target, mType string, flag uintptr, data string) error {
 }
 
 func unmount(target string, flag int) error {
-	return syscall.Unmount(target, flag)
+	return unix.Unmount(target, flag)
 }

pkg/mount/mounter_linux.go

@@ -1,18 +1,18 @@
 package mount
 
 import (
-	"syscall"
+	"golang.org/x/sys/unix"
 )
 
 const (
 	// ptypes is the set propagation types.
-	ptypes = syscall.MS_SHARED | syscall.MS_PRIVATE | syscall.MS_SLAVE | syscall.MS_UNBINDABLE
+	ptypes = unix.MS_SHARED | unix.MS_PRIVATE | unix.MS_SLAVE | unix.MS_UNBINDABLE
 
 	// pflags is the full set valid flags for a change propagation call.
-	pflags = ptypes | syscall.MS_REC | syscall.MS_SILENT
+	pflags = ptypes | unix.MS_REC | unix.MS_SILENT
 
 	// broflags is the combination of bind and read only
-	broflags = syscall.MS_BIND | syscall.MS_RDONLY
+	broflags = unix.MS_BIND | unix.MS_RDONLY
 )
 
 // isremount returns true if either device name or flags identify a remount request, false otherwise.
@@ -20,7 +20,7 @@ func isremount(device string, flags uintptr) bool {
 	switch {
 	// We treat device "" and "none" as a remount request to provide compatibility with
 	// requests that don't explicitly set MS_REMOUNT such as those manipulating bind mounts.
-	case flags&syscall.MS_REMOUNT != 0, device == "", device == "none":
+	case flags&unix.MS_REMOUNT != 0, device == "", device == "none":
 		return true
 	default:
 		return false
@@ -31,26 +31,26 @@ func mount(device, target, mType string, flags uintptr, data string) error {
 	oflags := flags &^ ptypes
 	if !isremount(device, flags) {
 		// Initial call applying all non-propagation flags.
-		if err := syscall.Mount(device, target, mType, oflags, data); err != nil {
+		if err := unix.Mount(device, target, mType, oflags, data); err != nil {
 			return err
 		}
 	}
 
 	if flags&ptypes != 0 {
 		// Change the propagation type.
-		if err := syscall.Mount("", target, "", flags&pflags, ""); err != nil {
+		if err := unix.Mount("", target, "", flags&pflags, ""); err != nil {
 			return err
 		}
 	}
 
 	if oflags&broflags == broflags {
 		// Remount the bind to apply read only.
-		return syscall.Mount("", target, "", oflags|syscall.MS_REMOUNT, "")
+		return unix.Mount("", target, "", oflags|unix.MS_REMOUNT, "")
 	}
 
 	return nil
 }
 
 func unmount(target string, flag int) error {
-	return syscall.Unmount(target, flag)
+	return unix.Unmount(target, flag)
 }

pkg/mount/sharedsubtree_linux_test.go

@@ -5,8 +5,9 @@ package mount
 import (
 	"os"
 	"path"
-	"syscall"
 	"testing"
+
+	"golang.org/x/sys/unix"
 )
 
 // nothing is propagated in or out
@@ -309,7 +310,7 @@ func TestSubtreeUnbindable(t *testing.T) {
 	}()
 
 	// then attempt to mount it to target. It should fail
-	if err := Mount(sourceDir, targetDir, "none", "bind,rw"); err != nil && err != syscall.EINVAL {
+	if err := Mount(sourceDir, targetDir, "none", "bind,rw"); err != nil && err != unix.EINVAL {
 		t.Fatal(err)
 	} else if err == nil {
 		t.Fatalf("%q should not have been bindable", sourceDir)

pkg/parsers/kernel/kernel_windows.go

@@ -4,8 +4,9 @@ package kernel
 
 import (
 	"fmt"
-	"syscall"
 	"unsafe"
+
+	"golang.org/x/sys/windows"
 )
 
 // VersionInfo holds information about the kernel.
@@ -24,28 +25,28 @@ func (k *VersionInfo) String() string {
 func GetKernelVersion() (*VersionInfo, error) {
 
 	var (
-		h         syscall.Handle
+		h         windows.Handle
 		dwVersion uint32
 		err       error
 	)
 
 	KVI := &VersionInfo{"Unknown", 0, 0, 0}
 
-	if err = syscall.RegOpenKeyEx(syscall.HKEY_LOCAL_MACHINE,
-		syscall.StringToUTF16Ptr(`SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\`),
+	if err = windows.RegOpenKeyEx(windows.HKEY_LOCAL_MACHINE,
+		windows.StringToUTF16Ptr(`SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\`),
 		0,
-		syscall.KEY_READ,
+		windows.KEY_READ,
 		&h); err != nil {
 		return KVI, err
 	}
-	defer syscall.RegCloseKey(h)
+	defer windows.RegCloseKey(h)
 
 	var buf [1 << 10]uint16
 	var typ uint32
 	n := uint32(len(buf) * 2) // api expects array of bytes, not uint16
 
-	if err = syscall.RegQueryValueEx(h,
-		syscall.StringToUTF16Ptr("BuildLabEx"),
+	if err = windows.RegQueryValueEx(h,
+		windows.StringToUTF16Ptr("BuildLabEx"),
 		nil,
 		&typ,
 		(*byte)(unsafe.Pointer(&buf[0])),
@@ -53,11 +54,11 @@ func GetKernelVersion() (*VersionInfo, error) {
 		return KVI, err
 	}
 
-	KVI.kvi = syscall.UTF16ToString(buf[:])
+	KVI.kvi = windows.UTF16ToString(buf[:])
 
 	// Important - docker.exe MUST be manifested for this API to return
 	// the correct information.
-	if dwVersion, err = syscall.GetVersion(); err != nil {
+	if dwVersion, err = windows.GetVersion(); err != nil {
 		return KVI, err
 	}
 

pkg/parsers/kernel/uname_linux.go

@@ -1,18 +1,16 @@
 package kernel
 
-import (
-	"syscall"
-)
+import "golang.org/x/sys/unix"
 
 // Utsname represents the system name structure.
-// It is passthrough for syscall.Utsname in order to make it portable with
+// It is passthrough for unix.Utsname in order to make it portable with
 // other platforms where it is not available.
-type Utsname syscall.Utsname
+type Utsname unix.Utsname
 
-func uname() (*syscall.Utsname, error) {
-	uts := &syscall.Utsname{}
+func uname() (*unix.Utsname, error) {
+	uts := &unix.Utsname{}
 
-	if err := syscall.Uname(uts); err != nil {
+	if err := unix.Uname(uts); err != nil {
 		return nil, err
 	}
 	return uts, nil

pkg/parsers/operatingsystem/operatingsystem_windows.go

@@ -1,8 +1,9 @@
 package operatingsystem
 
 import (
-	"syscall"
 	"unsafe"
+
+	"golang.org/x/sys/windows"
 )
 
 // See https://code.google.com/p/go/source/browse/src/pkg/mime/type_windows.go?r=d14520ac25bf6940785aabb71f5be453a286f58c
@@ -11,33 +12,33 @@ import (
 // GetOperatingSystem gets the name of the current operating system.
 func GetOperatingSystem() (string, error) {
 
-	var h syscall.Handle
+	var h windows.Handle
 
 	// Default return value
 	ret := "Unknown Operating System"
 
-	if err := syscall.RegOpenKeyEx(syscall.HKEY_LOCAL_MACHINE,
-		syscall.StringToUTF16Ptr(`SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\`),
+	if err := windows.RegOpenKeyEx(windows.HKEY_LOCAL_MACHINE,
+		windows.StringToUTF16Ptr(`SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\`),
 		0,
-		syscall.KEY_READ,
+		windows.KEY_READ,
 		&h); err != nil {
 		return ret, err
 	}
-	defer syscall.RegCloseKey(h)
+	defer windows.RegCloseKey(h)
 
 	var buf [1 << 10]uint16
 	var typ uint32
 	n := uint32(len(buf) * 2) // api expects array of bytes, not uint16
 
-	if err := syscall.RegQueryValueEx(h,
-		syscall.StringToUTF16Ptr("ProductName"),
+	if err := windows.RegQueryValueEx(h,
+		windows.StringToUTF16Ptr("ProductName"),
 		nil,
 		&typ,
 		(*byte)(unsafe.Pointer(&buf[0])),
 		&n); err != nil {
 		return ret, err
 	}
-	ret = syscall.UTF16ToString(buf[:])
+	ret = windows.UTF16ToString(buf[:])
 
 	return ret, nil
 }

pkg/pidfile/pidfile_darwin.go

@@ -3,12 +3,12 @@
 package pidfile
 
 import (
-	"syscall"
+	"golang.org/x/sys/unix"
 )
 
 func processExists(pid int) bool {
 	// OS X does not have a proc filesystem.
 	// Use kill -0 pid to judge if the process exists.
-	err := syscall.Kill(pid, 0)
+	err := unix.Kill(pid, 0)
 	return err == nil
 }

pkg/pidfile/pidfile_windows.go

@@ -1,6 +1,8 @@
 package pidfile
 
-import "syscall"
+import (
+	"golang.org/x/sys/windows"
+)
 
 const (
 	processQueryLimitedInformation = 0x1000
@@ -9,13 +11,13 @@ const (
 )
 
 func processExists(pid int) bool {
-	h, err := syscall.OpenProcess(processQueryLimitedInformation, false, uint32(pid))
+	h, err := windows.OpenProcess(processQueryLimitedInformation, false, uint32(pid))
 	if err != nil {
 		return false
 	}
 	var c uint32
-	err = syscall.GetExitCodeProcess(h, &c)
-	syscall.Close(h)
+	err = windows.GetExitCodeProcess(h, &c)
+	windows.Close(h)
 	if err != nil {
 		return c == stillActive
 	}

pkg/platform/architecture_linux.go

@@ -3,13 +3,13 @@
 package platform
 
 import (
-	"syscall"
+	"golang.org/x/sys/unix"
 )
 
 // runtimeArchitecture gets the name of the current architecture (x86, x86_64, …)
 func runtimeArchitecture() (string, error) {
-	utsname := &syscall.Utsname{}
-	if err := syscall.Uname(utsname); err != nil {
+	utsname := &unix.Utsname{}
+	if err := unix.Uname(utsname); err != nil {
 		return "", err
 	}
 	return charsToString(utsname.Machine), nil

pkg/platform/utsname_int8.go

@@ -1,5 +1,5 @@
-// +build linux,386 linux,amd64 linux,arm64
-// see golang's sources src/syscall/ztypes_linux_*.go that use int8
+// +build linux,386 linux,amd64 linux,arm64 s390x
+// see golang's sources golang.org/x/sys/unix/ztypes_linux_*.go that use int8
 
 package platform
 

pkg/platform/utsname_int8_test.go

@@ -1,4 +1,4 @@
-// +build linux,386 linux,amd64 linux,arm64
+// +build linux,386 linux,amd64 linux,arm64 s390x
 
 package platform
 

pkg/platform/utsname_uint8.go

@@ -1,5 +1,5 @@
-// +build linux,arm linux,ppc64 linux,ppc64le s390x
-// see golang's sources src/syscall/ztypes_linux_*.go that use uint8
+// +build linux,arm linux,ppc64 linux,ppc64le
+// see golang's sources golang.org/x/sys/unix/ztypes_linux_*.go that use uint8
 
 package platform
 

pkg/platform/utsname_uint8_test.go

@@ -1,4 +1,4 @@
-// +build linux,arm linux,ppc64 linux,ppc64le s390x
+// +build linux,arm linux,ppc64 linux,ppc64le
 
 package platform
 

pkg/reexec/command_linux.go

@@ -5,6 +5,8 @@ package reexec
 import (
 	"os/exec"
 	"syscall"
+
+	"golang.org/x/sys/unix"
 )
 
 // Self returns the path to the current process's binary.
@@ -22,7 +24,7 @@ func Command(args ...string) *exec.Cmd {
 		Path: Self(),
 		Args: args,
 		SysProcAttr: &syscall.SysProcAttr{
-			Pdeathsig: syscall.SIGTERM,
+			Pdeathsig: unix.SIGTERM,
 		},
 	}
 }

pkg/signal/signal_linux.go

@@ -2,6 +2,8 @@ package signal
 
 import (
 	"syscall"
+
+	"golang.org/x/sys/unix"
 )
 
 const (
@@ -11,41 +13,41 @@ const (
 
 // SignalMap is a map of Linux signals.
 var SignalMap = map[string]syscall.Signal{
-	"ABRT":     syscall.SIGABRT,
-	"ALRM":     syscall.SIGALRM,
-	"BUS":      syscall.SIGBUS,
-	"CHLD":     syscall.SIGCHLD,
-	"CLD":      syscall.SIGCLD,
-	"CONT":     syscall.SIGCONT,
-	"FPE":      syscall.SIGFPE,
-	"HUP":      syscall.SIGHUP,
-	"ILL":      syscall.SIGILL,
-	"INT":      syscall.SIGINT,
-	"IO":       syscall.SIGIO,
-	"IOT":      syscall.SIGIOT,
-	"KILL":     syscall.SIGKILL,
-	"PIPE":     syscall.SIGPIPE,
-	"POLL":     syscall.SIGPOLL,
-	"PROF":     syscall.SIGPROF,
-	"PWR":      syscall.SIGPWR,
-	"QUIT":     syscall.SIGQUIT,
-	"SEGV":     syscall.SIGSEGV,
-	"STKFLT":   syscall.SIGSTKFLT,
-	"STOP":     syscall.SIGSTOP,
-	"SYS":      syscall.SIGSYS,
-	"TERM":     syscall.SIGTERM,
-	"TRAP":     syscall.SIGTRAP,
-	"TSTP":     syscall.SIGTSTP,
-	"TTIN":     syscall.SIGTTIN,
-	"TTOU":     syscall.SIGTTOU,
-	"UNUSED":   syscall.SIGUNUSED,
-	"URG":      syscall.SIGURG,
-	"USR1":     syscall.SIGUSR1,
-	"USR2":     syscall.SIGUSR2,
-	"VTALRM":   syscall.SIGVTALRM,
-	"WINCH":    syscall.SIGWINCH,
-	"XCPU":     syscall.SIGXCPU,
-	"XFSZ":     syscall.SIGXFSZ,
+	"ABRT":     unix.SIGABRT,
+	"ALRM":     unix.SIGALRM,
+	"BUS":      unix.SIGBUS,
+	"CHLD":     unix.SIGCHLD,
+	"CLD":      unix.SIGCLD,
+	"CONT":     unix.SIGCONT,
+	"FPE":      unix.SIGFPE,
+	"HUP":      unix.SIGHUP,
+	"ILL":      unix.SIGILL,
+	"INT":      unix.SIGINT,
+	"IO":       unix.SIGIO,
+	"IOT":      unix.SIGIOT,
+	"KILL":     unix.SIGKILL,
+	"PIPE":     unix.SIGPIPE,
+	"POLL":     unix.SIGPOLL,
+	"PROF":     unix.SIGPROF,
+	"PWR":      unix.SIGPWR,
+	"QUIT":     unix.SIGQUIT,
+	"SEGV":     unix.SIGSEGV,
+	"STKFLT":   unix.SIGSTKFLT,
+	"STOP":     unix.SIGSTOP,
+	"SYS":      unix.SIGSYS,
+	"TERM":     unix.SIGTERM,
+	"TRAP":     unix.SIGTRAP,
+	"TSTP":     unix.SIGTSTP,
+	"TTIN":     unix.SIGTTIN,
+	"TTOU":     unix.SIGTTOU,
+	"UNUSED":   unix.SIGUNUSED,
+	"URG":      unix.SIGURG,
+	"USR1":     unix.SIGUSR1,
+	"USR2":     unix.SIGUSR2,
+	"VTALRM":   unix.SIGVTALRM,
+	"WINCH":    unix.SIGWINCH,
+	"XCPU":     unix.SIGXCPU,
+	"XFSZ":     unix.SIGXFSZ,
 	"RTMIN":    sigrtmin,
 	"RTMIN+1":  sigrtmin + 1,
 	"RTMIN+2":  sigrtmin + 2,

pkg/symlink/fs_windows.go

@@ -6,49 +6,49 @@ import (
 	"os"
 	"path/filepath"
 	"strings"
-	"syscall"
 
 	"github.com/docker/docker/pkg/longpath"
+	"golang.org/x/sys/windows"
 )
 
 func toShort(path string) (string, error) {
-	p, err := syscall.UTF16FromString(path)
+	p, err := windows.UTF16FromString(path)
 	if err != nil {
 		return "", err
 	}
 	b := p // GetShortPathName says we can reuse buffer
-	n, err := syscall.GetShortPathName(&p[0], &b[0], uint32(len(b)))
+	n, err := windows.GetShortPathName(&p[0], &b[0], uint32(len(b)))
 	if err != nil {
 		return "", err
 	}
 	if n > uint32(len(b)) {
 		b = make([]uint16, n)
-		if _, err = syscall.GetShortPathName(&p[0], &b[0], uint32(len(b))); err != nil {
+		if _, err = windows.GetShortPathName(&p[0], &b[0], uint32(len(b))); err != nil {
 			return "", err
 		}
 	}
-	return syscall.UTF16ToString(b), nil
+	return windows.UTF16ToString(b), nil
 }
 
 func toLong(path string) (string, error) {
-	p, err := syscall.UTF16FromString(path)
+	p, err := windows.UTF16FromString(path)
 	if err != nil {
 		return "", err
 	}
 	b := p // GetLongPathName says we can reuse buffer
-	n, err := syscall.GetLongPathName(&p[0], &b[0], uint32(len(b)))
+	n, err := windows.GetLongPathName(&p[0], &b[0], uint32(len(b)))
 	if err != nil {
 		return "", err
 	}
 	if n > uint32(len(b)) {
 		b = make([]uint16, n)
-		n, err = syscall.GetLongPathName(&p[0], &b[0], uint32(len(b)))
+		n, err = windows.GetLongPathName(&p[0], &b[0], uint32(len(b)))
 		if err != nil {
 			return "", err
 		}
 	}
 	b = b[:n]
-	return syscall.UTF16ToString(b), nil
+	return windows.UTF16ToString(b), nil
 }
 
 func evalSymlinks(path string) (string, error) {
@@ -65,7 +65,7 @@ func evalSymlinks(path string) (string, error) {
 	if err != nil {
 		return "", err
 	}
-	// syscall.GetLongPathName does not change the case of the drive letter,
+	// windows.GetLongPathName does not change the case of the drive letter,
 	// but the result of EvalSymlinks must be unique, so we have
 	// EvalSymlinks(`c:\a`) == EvalSymlinks(`C:\a`).
 	// Make drive letter upper case.

pkg/sysinfo/numcpu_linux.go

@@ -4,8 +4,9 @@ package sysinfo
 
 import (
 	"runtime"
-	"syscall"
 	"unsafe"
+
+	"golang.org/x/sys/unix"
 )
 
 // numCPU queries the system for the count of threads available
@@ -15,10 +16,10 @@ import (
 // Returns 0 on errors. Use |runtime.NumCPU| in that case.
 func numCPU() int {
 	// Gets the affinity mask for a process: The very one invoking this function.
-	pid, _, _ := syscall.RawSyscall(syscall.SYS_GETPID, 0, 0, 0)
+	pid, _, _ := unix.RawSyscall(unix.SYS_GETPID, 0, 0, 0)
 
 	var mask [1024 / 64]uintptr
-	_, _, err := syscall.RawSyscall(syscall.SYS_SCHED_GETAFFINITY, pid, uintptr(len(mask)*8), uintptr(unsafe.Pointer(&mask[0])))
+	_, _, err := unix.RawSyscall(unix.SYS_SCHED_GETAFFINITY, pid, uintptr(len(mask)*8), uintptr(unsafe.Pointer(&mask[0])))
 	if err != 0 {
 		return 0
 	}

pkg/sysinfo/sysinfo_linux.go

@@ -6,10 +6,10 @@ import (
 	"os"
 	"path"
 	"strings"
-	"syscall"
 
 	"github.com/Sirupsen/logrus"
 	"github.com/opencontainers/runc/libcontainer/cgroups"
+	"golang.org/x/sys/unix"
 )
 
 const (
@@ -60,9 +60,9 @@ func New(quiet bool) *SysInfo {
 	}
 
 	// Check if Seccomp is supported, via CONFIG_SECCOMP.
-	if _, _, err := syscall.RawSyscall(syscall.SYS_PRCTL, syscall.PR_GET_SECCOMP, 0, 0); err != syscall.EINVAL {
+	if _, _, err := unix.RawSyscall(unix.SYS_PRCTL, unix.PR_GET_SECCOMP, 0, 0); err != unix.EINVAL {
 		// Make sure the kernel has CONFIG_SECCOMP_FILTER.
-		if _, _, err := syscall.RawSyscall(syscall.SYS_PRCTL, syscall.PR_SET_SECCOMP, SeccompModeFilter, 0); err != syscall.EINVAL {
+		if _, _, err := unix.RawSyscall(unix.SYS_PRCTL, unix.PR_SET_SECCOMP, SeccompModeFilter, 0); err != unix.EINVAL {
 			sysInfo.Seccomp = true
 		}
 	}

pkg/system/chtimes_windows.go

@@ -3,25 +3,26 @@
 package system
 
 import (
-	"syscall"
 	"time"
+
+	"golang.org/x/sys/windows"
 )
 
 //setCTime will set the create time on a file. On Windows, this requires
 //calling SetFileTime and explicitly including the create time.
 func setCTime(path string, ctime time.Time) error {
-	ctimespec := syscall.NsecToTimespec(ctime.UnixNano())
-	pathp, e := syscall.UTF16PtrFromString(path)
+	ctimespec := windows.NsecToTimespec(ctime.UnixNano())
+	pathp, e := windows.UTF16PtrFromString(path)
 	if e != nil {
 		return e
 	}
-	h, e := syscall.CreateFile(pathp,
-		syscall.FILE_WRITE_ATTRIBUTES, syscall.FILE_SHARE_WRITE, nil,
-		syscall.OPEN_EXISTING, syscall.FILE_FLAG_BACKUP_SEMANTICS, 0)
+	h, e := windows.CreateFile(pathp,
+		windows.FILE_WRITE_ATTRIBUTES, windows.FILE_SHARE_WRITE, nil,
+		windows.OPEN_EXISTING, windows.FILE_FLAG_BACKUP_SEMANTICS, 0)
 	if e != nil {
 		return e
 	}
-	defer syscall.Close(h)
-	c := syscall.NsecToFiletime(syscall.TimespecToNsec(ctimespec))
-	return syscall.SetFileTime(h, &c, nil, nil)
+	defer windows.Close(h)
+	c := windows.NsecToFiletime(windows.TimespecToNsec(ctimespec))
+	return windows.SetFileTime(h, &c, nil, nil)
 }

pkg/system/events_windows.go

@@ -19,8 +19,8 @@ var (
 )
 
 // CreateEvent implements win32 CreateEventW func in golang. It will create an event object.
-func CreateEvent(eventAttributes *syscall.SecurityAttributes, manualReset bool, initialState bool, name string) (handle syscall.Handle, err error) {
-	namep, _ := syscall.UTF16PtrFromString(name)
+func CreateEvent(eventAttributes *windows.SecurityAttributes, manualReset bool, initialState bool, name string) (handle windows.Handle, err error) {
+	namep, _ := windows.UTF16PtrFromString(name)
 	var _p1 uint32
 	if manualReset {
 		_p1 = 1
@@ -31,45 +31,45 @@ func CreateEvent(eventAttributes *syscall.SecurityAttributes, manualReset bool,
 	}
 	r0, _, e1 := procCreateEvent.Call(uintptr(unsafe.Pointer(eventAttributes)), uintptr(_p1), uintptr(_p2), uintptr(unsafe.Pointer(namep)))
 	use(unsafe.Pointer(namep))
-	handle = syscall.Handle(r0)
-	if handle == syscall.InvalidHandle {
+	handle = windows.Handle(r0)
+	if handle == windows.InvalidHandle {
 		err = e1
 	}
 	return
 }
 
 // OpenEvent implements win32 OpenEventW func in golang. It opens an event object.
-func OpenEvent(desiredAccess uint32, inheritHandle bool, name string) (handle syscall.Handle, err error) {
-	namep, _ := syscall.UTF16PtrFromString(name)
+func OpenEvent(desiredAccess uint32, inheritHandle bool, name string) (handle windows.Handle, err error) {
+	namep, _ := windows.UTF16PtrFromString(name)
 	var _p1 uint32
 	if inheritHandle {
 		_p1 = 1
 	}
 	r0, _, e1 := procOpenEvent.Call(uintptr(desiredAccess), uintptr(_p1), uintptr(unsafe.Pointer(namep)))
 	use(unsafe.Pointer(namep))
-	handle = syscall.Handle(r0)
-	if handle == syscall.InvalidHandle {
+	handle = windows.Handle(r0)
+	if handle == windows.InvalidHandle {
 		err = e1
 	}
 	return
 }
 
 // SetEvent implements win32 SetEvent func in golang.
-func SetEvent(handle syscall.Handle) (err error) {
+func SetEvent(handle windows.Handle) (err error) {
 	return setResetPulse(handle, procSetEvent)
 }
 
 // ResetEvent implements win32 ResetEvent func in golang.
-func ResetEvent(handle syscall.Handle) (err error) {
+func ResetEvent(handle windows.Handle) (err error) {
 	return setResetPulse(handle, procResetEvent)
 }
 
 // PulseEvent implements win32 PulseEvent func in golang.
-func PulseEvent(handle syscall.Handle) (err error) {
+func PulseEvent(handle windows.Handle) (err error) {
 	return setResetPulse(handle, procPulseEvent)
 }
 
-func setResetPulse(handle syscall.Handle, proc *windows.LazyProc) (err error) {
+func setResetPulse(handle windows.Handle, proc *windows.LazyProc) (err error) {
 	r0, _, _ := proc.Call(uintptr(handle))
 	if r0 != 0 {
 		err = syscall.Errno(r0)

pkg/system/filesys_windows.go

@@ -14,6 +14,7 @@ import (
 	"unsafe"
 
 	winio "github.com/Microsoft/go-winio"
+	"golang.org/x/sys/windows"
 )
 
 const (
@@ -99,13 +100,12 @@ func mkdirall(path string, applyACL bool, sddl string) error {
 // mkdirWithACL creates a new directory. If there is an error, it will be of
 // type *PathError. .
 //
-// This is a modified and combined version of os.Mkdir and syscall.Mkdir
+// This is a modified and combined version of os.Mkdir and windows.Mkdir
 // in golang to cater for creating a directory am ACL permitting full
 // access, with inheritance, to any subfolder/file for Built-in Administrators
 // and Local System.
 func mkdirWithACL(name string, sddl string) error {
-	sa := syscall.SecurityAttributes{Length: 0}
-
+	sa := windows.SecurityAttributes{Length: 0}
 	sd, err := winio.SddlToSecurityDescriptor(sddl)
 	if err != nil {
 		return &os.PathError{Op: "mkdir", Path: name, Err: err}
@@ -114,12 +114,12 @@ func mkdirWithACL(name string, sddl string) error {
 	sa.InheritHandle = 1
 	sa.SecurityDescriptor = uintptr(unsafe.Pointer(&sd[0]))
 
-	namep, err := syscall.UTF16PtrFromString(name)
+	namep, err := windows.UTF16PtrFromString(name)
 	if err != nil {
 		return &os.PathError{Op: "mkdir", Path: name, Err: err}
 	}
 
-	e := syscall.CreateDirectory(namep, &sa)
+	e := windows.CreateDirectory(namep, &sa)
 	if e != nil {
 		return &os.PathError{Op: "mkdir", Path: name, Err: e}
 	}
@@ -142,7 +142,7 @@ func IsAbs(path string) bool {
 	return true
 }
 
-// The origin of the functions below here are the golang OS and syscall packages,
+// The origin of the functions below here are the golang OS and windows packages,
 // slightly modified to only cope with files, not directories due to the
 // specific use case.
 //
@@ -174,74 +174,74 @@ func OpenFileSequential(name string, flag int, _ os.FileMode) (*os.File, error)
 	if name == "" {
 		return nil, &os.PathError{Op: "open", Path: name, Err: syscall.ENOENT}
 	}
-	r, errf := syscallOpenFileSequential(name, flag, 0)
+	r, errf := windowsOpenFileSequential(name, flag, 0)
 	if errf == nil {
 		return r, nil
 	}
 	return nil, &os.PathError{Op: "open", Path: name, Err: errf}
 }
 
-func syscallOpenFileSequential(name string, flag int, _ os.FileMode) (file *os.File, err error) {
-	r, e := syscallOpenSequential(name, flag|syscall.O_CLOEXEC, 0)
+func windowsOpenFileSequential(name string, flag int, _ os.FileMode) (file *os.File, err error) {
+	r, e := windowsOpenSequential(name, flag|windows.O_CLOEXEC, 0)
 	if e != nil {
 		return nil, e
 	}
 	return os.NewFile(uintptr(r), name), nil
 }
 
-func makeInheritSa() *syscall.SecurityAttributes {
-	var sa syscall.SecurityAttributes
+func makeInheritSa() *windows.SecurityAttributes {
+	var sa windows.SecurityAttributes
 	sa.Length = uint32(unsafe.Sizeof(sa))
 	sa.InheritHandle = 1
 	return &sa
 }
 
-func syscallOpenSequential(path string, mode int, _ uint32) (fd syscall.Handle, err error) {
+func windowsOpenSequential(path string, mode int, _ uint32) (fd windows.Handle, err error) {
 	if len(path) == 0 {
-		return syscall.InvalidHandle, syscall.ERROR_FILE_NOT_FOUND
+		return windows.InvalidHandle, windows.ERROR_FILE_NOT_FOUND
 	}
-	pathp, err := syscall.UTF16PtrFromString(path)
+	pathp, err := windows.UTF16PtrFromString(path)
 	if err != nil {
-		return syscall.InvalidHandle, err
+		return windows.InvalidHandle, err
 	}
 	var access uint32
-	switch mode & (syscall.O_RDONLY | syscall.O_WRONLY | syscall.O_RDWR) {
-	case syscall.O_RDONLY:
-		access = syscall.GENERIC_READ
-	case syscall.O_WRONLY:
-		access = syscall.GENERIC_WRITE
-	case syscall.O_RDWR:
-		access = syscall.GENERIC_READ | syscall.GENERIC_WRITE
+	switch mode & (windows.O_RDONLY | windows.O_WRONLY | windows.O_RDWR) {
+	case windows.O_RDONLY:
+		access = windows.GENERIC_READ
+	case windows.O_WRONLY:
+		access = windows.GENERIC_WRITE
+	case windows.O_RDWR:
+		access = windows.GENERIC_READ | windows.GENERIC_WRITE
 	}
-	if mode&syscall.O_CREAT != 0 {
-		access |= syscall.GENERIC_WRITE
+	if mode&windows.O_CREAT != 0 {
+		access |= windows.GENERIC_WRITE
 	}
-	if mode&syscall.O_APPEND != 0 {
-		access &^= syscall.GENERIC_WRITE
-		access |= syscall.FILE_APPEND_DATA
+	if mode&windows.O_APPEND != 0 {
+		access &^= windows.GENERIC_WRITE
+		access |= windows.FILE_APPEND_DATA
 	}
-	sharemode := uint32(syscall.FILE_SHARE_READ | syscall.FILE_SHARE_WRITE)
-	var sa *syscall.SecurityAttributes
-	if mode&syscall.O_CLOEXEC == 0 {
+	sharemode := uint32(windows.FILE_SHARE_READ | windows.FILE_SHARE_WRITE)
+	var sa *windows.SecurityAttributes
+	if mode&windows.O_CLOEXEC == 0 {
 		sa = makeInheritSa()
 	}
 	var createmode uint32
 	switch {
-	case mode&(syscall.O_CREAT|syscall.O_EXCL) == (syscall.O_CREAT | syscall.O_EXCL):
-		createmode = syscall.CREATE_NEW
-	case mode&(syscall.O_CREAT|syscall.O_TRUNC) == (syscall.O_CREAT | syscall.O_TRUNC):
-		createmode = syscall.CREATE_ALWAYS
-	case mode&syscall.O_CREAT == syscall.O_CREAT:
-		createmode = syscall.OPEN_ALWAYS
-	case mode&syscall.O_TRUNC == syscall.O_TRUNC:
-		createmode = syscall.TRUNCATE_EXISTING
+	case mode&(windows.O_CREAT|windows.O_EXCL) == (windows.O_CREAT | windows.O_EXCL):
+		createmode = windows.CREATE_NEW
+	case mode&(windows.O_CREAT|windows.O_TRUNC) == (windows.O_CREAT | windows.O_TRUNC):
+		createmode = windows.CREATE_ALWAYS
+	case mode&windows.O_CREAT == windows.O_CREAT:
+		createmode = windows.OPEN_ALWAYS
+	case mode&windows.O_TRUNC == windows.O_TRUNC:
+		createmode = windows.TRUNCATE_EXISTING
 	default:
-		createmode = syscall.OPEN_EXISTING
+		createmode = windows.OPEN_EXISTING
 	}
 	// Use FILE_FLAG_SEQUENTIAL_SCAN rather than FILE_ATTRIBUTE_NORMAL as implemented in golang.
 	//https://msdn.microsoft.com/en-us/library/windows/desktop/aa363858(v=vs.85).aspx
 	const fileFlagSequentialScan = 0x08000000 // FILE_FLAG_SEQUENTIAL_SCAN
-	h, e := syscall.CreateFile(pathp, access, sharemode, sa, createmode, fileFlagSequentialScan, 0)
+	h, e := windows.CreateFile(pathp, access, sharemode, sa, createmode, fileFlagSequentialScan, 0)
 	return h, e
 }
 

pkg/system/lstat_unix.go

@@ -2,7 +2,9 @@
 
 package system
 
-import "syscall"
+import (
+	"syscall"
+)
 
 // Lstat takes a path to a file and returns
 // a system.StatT type pertaining to that file.

pkg/system/mknod.go

@@ -3,13 +3,13 @@
 package system
 
 import (
-	"syscall"
+	"golang.org/x/sys/unix"
 )
 
 // Mknod creates a filesystem node (file, device special file or named pipe) named path
 // with attributes specified by mode and dev.
 func Mknod(path string, mode uint32, dev int) error {
-	return syscall.Mknod(path, mode, dev)
+	return unix.Mknod(path, mode, dev)
 }
 
 // Mkdev is used to build the value of linux devices (in /dev/) which specifies major

pkg/system/process_unix.go

@@ -4,12 +4,14 @@ package system
 
 import (
 	"syscall"
+
+	"golang.org/x/sys/unix"
 )
 
 // IsProcessAlive returns true if process with a given pid is running.
 func IsProcessAlive(pid int) bool {
-	err := syscall.Kill(pid, syscall.Signal(0))
-	if err == nil || err == syscall.EPERM {
+	err := unix.Kill(pid, syscall.Signal(0))
+	if err == nil || err == unix.EPERM {
 		return true
 	}
 
@@ -18,5 +20,5 @@ func IsProcessAlive(pid int) bool {
 
 // KillProcess force-stops a process.
 func KillProcess(pid int) {
-	syscall.Kill(pid, syscall.SIGKILL)
+	unix.Kill(pid, unix.SIGKILL)
 }

pkg/system/stat_unix.go

@@ -2,7 +2,9 @@
 
 package system
 
-import "syscall"
+import (
+	"syscall"
+)
 
 // StatT type contains status of a file. It contains metadata
 // like permission, owner, group, size, etc about a file.

pkg/system/syscall_unix.go

@@ -2,12 +2,12 @@
 
 package system
 
-import "syscall"
+import "golang.org/x/sys/unix"
 
 // Unmount is a platform-specific helper function to call
 // the unmount syscall.
 func Unmount(dest string) error {
-	return syscall.Unmount(dest, 0)
+	return unix.Unmount(dest, 0)
 }
 
 // CommandLineToArgv should not be used on Unix.

pkg/system/syscall_windows.go

@@ -1,14 +1,14 @@
 package system
 
 import (
-	"syscall"
 	"unsafe"
 
 	"github.com/Sirupsen/logrus"
+	"golang.org/x/sys/windows"
 )
 
 var (
-	ntuserApiset       = syscall.NewLazyDLL("ext-ms-win-ntuser-window-l1-1-0")
+	ntuserApiset       = windows.NewLazyDLL("ext-ms-win-ntuser-window-l1-1-0")
 	procGetVersionExW  = modkernel32.NewProc("GetVersionExW")
 	procGetProductInfo = modkernel32.NewProc("GetProductInfo")
 )
@@ -42,7 +42,7 @@ type osVersionInfoEx struct {
 func GetOSVersion() OSVersion {
 	var err error
 	osv := OSVersion{}
-	osv.Version, err = syscall.GetVersion()
+	osv.Version, err = windows.GetVersion()
 	if err != nil {
 		// GetVersion never fails.
 		panic(err)
@@ -93,20 +93,20 @@ func Unmount(dest string) error {
 func CommandLineToArgv(commandLine string) ([]string, error) {
 	var argc int32
 
-	argsPtr, err := syscall.UTF16PtrFromString(commandLine)
+	argsPtr, err := windows.UTF16PtrFromString(commandLine)
 	if err != nil {
 		return nil, err
 	}
 
-	argv, err := syscall.CommandLineToArgv(argsPtr, &argc)
+	argv, err := windows.CommandLineToArgv(argsPtr, &argc)
 	if err != nil {
 		return nil, err
 	}
-	defer syscall.LocalFree(syscall.Handle(uintptr(unsafe.Pointer(argv))))
+	defer windows.LocalFree(windows.Handle(uintptr(unsafe.Pointer(argv))))
 
 	newArgs := make([]string, argc)
 	for i, v := range (*argv)[:argc] {
-		newArgs[i] = string(syscall.UTF16ToString((*v)[:]))
+		newArgs[i] = string(windows.UTF16ToString((*v)[:]))
 	}
 
 	return newArgs, nil

pkg/system/umask.go

@@ -3,11 +3,11 @@
 package system
 
 import (
-	"syscall"
+	"golang.org/x/sys/unix"
 )
 
 // Umask sets current process's file mode creation mask to newmask
 // and returns oldmask.
 func Umask(newmask int) (oldmask int, err error) {
-	return syscall.Umask(newmask), nil
+	return unix.Umask(newmask), nil
 }

pkg/system/utimes_freebsd.go

@@ -3,18 +3,20 @@ package system
 import (
 	"syscall"
 	"unsafe"
+
+	"golang.org/x/sys/unix"
 )
 
 // LUtimesNano is used to change access and modification time of the specified path.
-// It's used for symbol link file because syscall.UtimesNano doesn't support a NOFOLLOW flag atm.
+// It's used for symbol link file because unix.UtimesNano doesn't support a NOFOLLOW flag atm.
 func LUtimesNano(path string, ts []syscall.Timespec) error {
 	var _path *byte
-	_path, err := syscall.BytePtrFromString(path)
+	_path, err := unix.BytePtrFromString(path)
 	if err != nil {
 		return err
 	}
 
-	if _, _, err := syscall.Syscall(syscall.SYS_LUTIMES, uintptr(unsafe.Pointer(_path)), uintptr(unsafe.Pointer(&ts[0])), 0); err != 0 && err != syscall.ENOSYS {
+	if _, _, err := unix.Syscall(unix.SYS_LUTIMES, uintptr(unsafe.Pointer(_path)), uintptr(unsafe.Pointer(&ts[0])), 0); err != 0 && err != unix.ENOSYS {
 		return err
 	}
 

pkg/system/utimes_linux.go

@@ -3,22 +3,21 @@ package system
 import (
 	"syscall"
 	"unsafe"
+
+	"golang.org/x/sys/unix"
 )
 
 // LUtimesNano is used to change access and modification time of the specified path.
-// It's used for symbol link file because syscall.UtimesNano doesn't support a NOFOLLOW flag atm.
+// It's used for symbol link file because unix.UtimesNano doesn't support a NOFOLLOW flag atm.
 func LUtimesNano(path string, ts []syscall.Timespec) error {
-	// These are not currently available in syscall
-	atFdCwd := -100
-	atSymLinkNoFollow := 0x100
+	atFdCwd := unix.AT_FDCWD
 
 	var _path *byte
-	_path, err := syscall.BytePtrFromString(path)
+	_path, err := unix.BytePtrFromString(path)
 	if err != nil {
 		return err
 	}
-
-	if _, _, err := syscall.Syscall6(syscall.SYS_UTIMENSAT, uintptr(atFdCwd), uintptr(unsafe.Pointer(_path)), uintptr(unsafe.Pointer(&ts[0])), uintptr(atSymLinkNoFollow), 0, 0); err != 0 && err != syscall.ENOSYS {
+	if _, _, err := unix.Syscall6(unix.SYS_UTIMENSAT, uintptr(atFdCwd), uintptr(unsafe.Pointer(_path)), uintptr(unsafe.Pointer(&ts[0])), unix.AT_SYMLINK_NOFOLLOW, 0, 0); err != 0 && err != unix.ENOSYS {
 		return err
 	}
 

pkg/system/xattrs_linux.go

@@ -1,33 +1,34 @@
 package system
 
 import (
-	"syscall"
 	"unsafe"
+
+	"golang.org/x/sys/unix"
 )
 
 // Lgetxattr retrieves the value of the extended attribute identified by attr
 // and associated with the given path in the file system.
 // It will returns a nil slice and nil error if the xattr is not set.
 func Lgetxattr(path string, attr string) ([]byte, error) {
-	pathBytes, err := syscall.BytePtrFromString(path)
+	pathBytes, err := unix.BytePtrFromString(path)
 	if err != nil {
 		return nil, err
 	}
-	attrBytes, err := syscall.BytePtrFromString(attr)
+	attrBytes, err := unix.BytePtrFromString(attr)
 	if err != nil {
 		return nil, err
 	}
 
 	dest := make([]byte, 128)
 	destBytes := unsafe.Pointer(&dest[0])
-	sz, _, errno := syscall.Syscall6(syscall.SYS_LGETXATTR, uintptr(unsafe.Pointer(pathBytes)), uintptr(unsafe.Pointer(attrBytes)), uintptr(destBytes), uintptr(len(dest)), 0, 0)
-	if errno == syscall.ENODATA {
+	sz, _, errno := unix.Syscall6(unix.SYS_LGETXATTR, uintptr(unsafe.Pointer(pathBytes)), uintptr(unsafe.Pointer(attrBytes)), uintptr(destBytes), uintptr(len(dest)), 0, 0)
+	if errno == unix.ENODATA {
 		return nil, nil
 	}
-	if errno == syscall.ERANGE {
+	if errno == unix.ERANGE {
 		dest = make([]byte, sz)
 		destBytes := unsafe.Pointer(&dest[0])
-		sz, _, errno = syscall.Syscall6(syscall.SYS_LGETXATTR, uintptr(unsafe.Pointer(pathBytes)), uintptr(unsafe.Pointer(attrBytes)), uintptr(destBytes), uintptr(len(dest)), 0, 0)
+		sz, _, errno = unix.Syscall6(unix.SYS_LGETXATTR, uintptr(unsafe.Pointer(pathBytes)), uintptr(unsafe.Pointer(attrBytes)), uintptr(destBytes), uintptr(len(dest)), 0, 0)
 	}
 	if errno != 0 {
 		return nil, errno
@@ -41,11 +42,11 @@ var _zero uintptr
 // Lsetxattr sets the value of the extended attribute identified by attr
 // and associated with the given path in the file system.
 func Lsetxattr(path string, attr string, data []byte, flags int) error {
-	pathBytes, err := syscall.BytePtrFromString(path)
+	pathBytes, err := unix.BytePtrFromString(path)
 	if err != nil {
 		return err
 	}
-	attrBytes, err := syscall.BytePtrFromString(attr)
+	attrBytes, err := unix.BytePtrFromString(attr)
 	if err != nil {
 		return err
 	}
@@ -55,7 +56,7 @@ func Lsetxattr(path string, attr string, data []byte, flags int) error {
 	} else {
 		dataBytes = unsafe.Pointer(&_zero)
 	}
-	_, _, errno := syscall.Syscall6(syscall.SYS_LSETXATTR, uintptr(unsafe.Pointer(pathBytes)), uintptr(unsafe.Pointer(attrBytes)), uintptr(dataBytes), uintptr(len(data)), uintptr(flags), 0)
+	_, _, errno := unix.Syscall6(unix.SYS_LSETXATTR, uintptr(unsafe.Pointer(pathBytes)), uintptr(unsafe.Pointer(attrBytes)), uintptr(dataBytes), uintptr(len(data)), uintptr(flags), 0)
 	if errno != 0 {
 		return errno
 	}

plugin/manager_linux.go

@@ -8,7 +8,6 @@ import (
 	"net"
 	"os"
 	"path/filepath"
-	"syscall"
 	"time"
 
 	"github.com/Sirupsen/logrus"
@@ -23,6 +22,7 @@ import (
 	"github.com/opencontainers/go-digest"
 	specs "github.com/opencontainers/runtime-spec/specs-go"
 	"github.com/pkg/errors"
+	"golang.org/x/sys/unix"
 )
 
 func (pm *Manager) enable(p *v2.Plugin, c *controller, force bool) error {
@@ -146,7 +146,7 @@ func (pm *Manager) restore(p *v2.Plugin) error {
 func shutdownPlugin(p *v2.Plugin, c *controller, containerdClient libcontainerd.Client) {
 	pluginID := p.GetID()
 
-	err := containerdClient.Signal(pluginID, int(syscall.SIGTERM))
+	err := containerdClient.Signal(pluginID, int(unix.SIGTERM))
 	if err != nil {
 		logrus.Errorf("Sending SIGTERM to plugin failed with error: %v", err)
 	} else {
@@ -155,7 +155,7 @@ func shutdownPlugin(p *v2.Plugin, c *controller, containerdClient libcontainerd.
 			logrus.Debug("Clean shutdown of plugin")
 		case <-time.After(time.Second * 10):
 			logrus.Debug("Force shutdown plugin")
-			if err := containerdClient.Signal(pluginID, int(syscall.SIGKILL)); err != nil {
+			if err := containerdClient.Signal(pluginID, int(unix.SIGKILL)); err != nil {
 				logrus.Errorf("Sending SIGKILL to plugin failed with error: %v", err)
 			}
 		}

profiles/seccomp/seccomp_default.go

@@ -3,9 +3,8 @@
 package seccomp
 
 import (
-	"syscall"
-
 	"github.com/docker/docker/api/types"
+	"golang.org/x/sys/unix"
 )
 
 func arches() []types.Architecture {
@@ -510,7 +509,7 @@ func DefaultProfile() *types.Seccomp {
 			Args: []*types.Arg{
 				{
 					Index:    0,
-					Value:    syscall.CLONE_NEWNS | syscall.CLONE_NEWUTS | syscall.CLONE_NEWIPC | syscall.CLONE_NEWUSER | syscall.CLONE_NEWPID | syscall.CLONE_NEWNET,
+					Value:    unix.CLONE_NEWNS | unix.CLONE_NEWUTS | unix.CLONE_NEWIPC | unix.CLONE_NEWUSER | unix.CLONE_NEWPID | unix.CLONE_NEWNET,
 					ValueTwo: 0,
 					Op:       types.OpMaskedEqual,
 				},
@@ -528,7 +527,7 @@ func DefaultProfile() *types.Seccomp {
 			Args: []*types.Arg{
 				{
 					Index:    1,
-					Value:    syscall.CLONE_NEWNS | syscall.CLONE_NEWUTS | syscall.CLONE_NEWIPC | syscall.CLONE_NEWUSER | syscall.CLONE_NEWPID | syscall.CLONE_NEWNET,
+					Value:    unix.CLONE_NEWNS | unix.CLONE_NEWUTS | unix.CLONE_NEWIPC | unix.CLONE_NEWUSER | unix.CLONE_NEWPID | unix.CLONE_NEWNET,
 					ValueTwo: 0,
 					Op:       types.OpMaskedEqual,
 				},