Go-runtime uses PROT_NONE mappings as place holders for future read-write
mappings.
However, we need to patch kernel otherwise we will get -EPERM (see arch/riscv/kvm/mmu.c)

Inherited FDs can cause conflict while remapping stdio FDs to startingStdioFD
and beyond. It can also cause failures in validateOpenFDs() which ensures no
directory FDs are open.

It is also better from a security perspective to not mistakenly leak file
descriptors from parent to the sandbox process.

Fixes #10232

PiperOrigin-RevId: 622032875

This is done to allow re-mapping of container IDs after the
container has been restored. Upon restore, container names
remain the same, but container ID may be (and likely are)
different.

Updates #1956

PiperOrigin-RevId: 621996848

GRO is getting moved and updated. This removes it in preparation for a
follow-up CL.

PiperOrigin-RevId: 621984030

PiperOrigin-RevId: 621954030

PiperOrigin-RevId: 621626382

PiperOrigin-RevId: 621599005

PiperOrigin-RevId: 621350009

PiperOrigin-RevId: 621276476

PiperOrigin-RevId: 620968670

PiperOrigin-RevId: 620610190

I am hitting the 15-second deadline for llama2-70b @ fp16. It's a beast of a
model with ~130GiB of RAM.

PiperOrigin-RevId: 620382594

PiperOrigin-RevId: 620360076

PiperOrigin-RevId: 620321751