script/setup/install-runc: build runc statically

The test tarball from test/build.sh is built on the kubekins image and
run on other distros. A dynamic runc built on Debian trixie needs
GLIBC_2.38 and fails on AL2023 (kubernetes/kubernetes#142987).

Build with `make static` like the runc release binaries. EL has no
libseccomp-static, so the Fedora/EL VMs keep the dynamic build via
RUNC_DYNAMIC=1.

Signed-off-by: Davanum Srinivas <davanum@gmail.com>

script/setup/install-runc

@@ -38,7 +38,14 @@ function install_runc() {
 	git clone "${RUNC_REPO}" "${TMPROOT}"/runc
 	pushd "${TMPROOT}"/runc
 	git checkout "${RUNC_VERSION}"
-	env -u VERSION make BUILDTAGS='seccomp' runc
+	# Static build, like the runc release binaries, so the binary does not
+	# depend on the build host's glibc and libseccomp. Needs libseccomp.a;
+	# set RUNC_DYNAMIC=1 where it is not available (e.g. EL).
+	if [ -n "${RUNC_DYNAMIC:-}" ]; then
+		env -u VERSION make BUILDTAGS='seccomp' runc
+	else
+		env -u VERSION make BUILDTAGS='seccomp' static
+	fi
 	$SUDO make install
 	popd
 }

script/vm/provision.sh

@@ -78,8 +78,9 @@ fi
 
 cd "${containerd_dir}"
 
-# Install runc (pass RUNC_FLAVOR=crun to install crun as runc)
-RUNC_FLAVOR="${RUNC_FLAVOR}" script/setup/install-runc
+# Install runc (pass RUNC_FLAVOR=crun to install crun as runc).
+# EL has no libseccomp-static, so build runc dynamically like runc's own CI does.
+RUNC_FLAVOR="${RUNC_FLAVOR}" RUNC_DYNAMIC=1 script/setup/install-runc
 type runc
 runc --version
 # "type -ap" may print the same file under multiple names, e.g., on