Import changes for goma server

  - ea652f7ec375df95e58c0253031dcd295fb1e5b6 fix copybara for public release
  - e11c8c928207920ff15fec47124c56e70f4c69e8 force to load configs when retrying
  - 28fcc0c2a7701320ab35a0ce446720af14b0730f command: Next uses ctx, and return ErrWatcherClosed when ...
  - b7b4fe5f6962f4724994639d6de3f23346ef95bf mitigate missing compiler.
  - a655123a3a6f56f6a1382d5aaf8515835f0a76cb roll cloud.google.com/go/pubsub v1.15.0 -> v1.16.0
  - d2ab42543f983c2d1e2b54b92118279a77b0801c roll github.com/fsnotify/fsnotify 1.5.0 -> 1.5.1
  - 33055aaba37c7e9309e84c3b435a8f9b526a7270 Use go 1.17
  - bef24828dd4e48c2e2886756463666a58872099c roll github.com/fsnotify/fsnotify v1.4.9 -> v1.5.0
  - 5a98c02b6b320161d1b8d4f8d328bc52704b2f61 roll cloud.google.com/go v0.91.1 -> v0.93.3
  - 6f1377417c1692d6045c02d6d4820c20c955b2a7 fix nsjail seccomp filter for cros glibc update.
  - c6bea44b2ead61f86d3c5afb642fa8bbd39c996e roll google.golang.org/grpc v1.39.1 -> v1.40.0
  - 1996177b91433409e15eb1903722c4f1bc758a65 roll cloud.google.com/go/pubsub v1.14.0 -> v1.15.0
  - 3bc5010f0175fb59e4b868814f451c2387898066 roll cloud.google.com/go v0.90.0 -> v0.91.1
  - 3bb8d7760d2642c70b0a2fda074d9ab42a267481 roll google.golang.org/grpc v1.39.0 -> v1.39.1
  - 3bcfbd6d24ca3113209608bd62cfb49a7d267543 roll go.uber.org/zap v1.18.1 -> v1.19.0
  - 88b038ddaa9d960e19f4001558a434aa03856f38 roll cloud.google.com/go/pubsub v1.13.0 -> v1.14.0
  - aac8393a118158a6064156a425b1d578f97ed63c roll cloud.google.com/go v0.89.0 -> v0.90.0
  - 85bdd8faac81be7ffe926dfa4b99257ff37000d7 roll google.golang.org/api v0.51.0 -> v0.52.0
  - a65c6dad61423b5d064aee1a1f5ad5d6495d980e roll cloud.google.com/go v0.88.0 -> v0.89.0

GitOrigin-RevId: ea652f7ec375df95e58c0253031dcd295fb1e5b6
Change-Id: I29d051072bb168d58edb0203655a97f9527c3f27
diff --git a/cipd_manifest.txt b/cipd_manifest.txt
index caabe22..9992998 100644
--- a/cipd_manifest.txt
+++ b/cipd_manifest.txt
@@ -13,7 +13,7 @@
 # https://chrome-infra-packages.appspot.com/
 
 # go
-infra/3pp/tools/go/${platform} version:2@1.16.6
+infra/3pp/tools/go/${platform} version:2@1.17
 
 # protoc
 infra/3pp/tools/protoc/${platform} version:2@3.17.3
diff --git a/cipd_manifest.versions b/cipd_manifest.versions
index 2e8acbe..8efca9c 100644
--- a/cipd_manifest.versions
+++ b/cipd_manifest.versions
@@ -2,8 +2,8 @@
 # Do not modify manually. All changes will be overwritten.
 
 infra/3pp/tools/go/linux-amd64
-	version:2@1.16.6
-	Or0bQc_mDY3sU10hn7yCmFPeBW31QXvk22n26ecEgq0C
+	version:2@1.17
+	B0oUjfQx1KB-yC98R0WTzyRH4UFdy2uM2VcLbGpFejQC
 
 infra/3pp/tools/protoc/linux-amd64
 	version:2@3.17.3
diff --git a/cmd/cache_server/client.go b/cmd/cache_server/client.go
index a0718bf..efedb94 100644
--- a/cmd/cache_server/client.go
+++ b/cmd/cache_server/client.go
@@ -1,6 +1,7 @@
 // Copyright 2017 The Goma Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
+//go:build ignore
 // +build ignore
 
 // client.go is sample client of cache server.
diff --git a/cmd/exec_server/main.go b/cmd/exec_server/main.go
index 25da2b8..a6104c0 100644
--- a/cmd/exec_server/main.go
+++ b/cmd/exec_server/main.go
@@ -25,6 +25,7 @@
 
 	"cloud.google.com/go/pubsub"
 	"cloud.google.com/go/storage"
+	gax "github.com/googleapis/gax-go/v2"
 	"github.com/googleapis/google-cloud-go-testing/storage/stiface"
 	"go.opencensus.io/plugin/ocgrpc"
 	"go.opencensus.io/stats"
@@ -172,17 +173,17 @@
 	return resp
 }
 
-func configureByLoader(ctx context.Context, loader *command.ConfigMapLoader, inventory *exec.Inventory) (string, error) {
+func configureByLoader(ctx context.Context, loader *command.ConfigMapLoader, inventory *exec.Inventory, force bool) (string, error) {
 	logger := log.FromContext(ctx)
 	start := time.Now()
-	resp, err := loader.Load(ctx)
-	logger.Infof("loader.Load finished in %s", time.Since(start))
+	resp, err := loader.Load(ctx, force)
+	logger.Infof("loader.Load finished in %s: %v", time.Since(start), err)
 	if err != nil {
 		return "", err
 	}
 	start = time.Now()
 	err = inventory.Configure(ctx, resp)
-	logger.Infof("inventory.Configure finished in %s", time.Since(start))
+	logger.Infof("inventory.Configure finished in %s: %v", time.Since(start), err)
 	if err != nil {
 		return "", err
 	}
@@ -251,9 +252,9 @@
 	return cs, nil
 }
 
-func (cs *configServer) configure(ctx context.Context) error {
+func (cs *configServer) configure(ctx context.Context, force bool) error {
 	logger := log.FromContext(ctx)
-	id, err := configureByLoader(ctx, cs.loader, cs.inventory)
+	id, err := configureByLoader(ctx, cs.loader, cs.inventory, force)
 	if err != nil {
 		if err != command.ErrNoUpdate {
 			recordConfigUpdate(ctx, err)
@@ -270,21 +271,48 @@
 	ctx, cancel := context.WithCancel(context.Background())
 	cs.cancel = cancel
 	logger := log.FromContext(ctx)
+	var backoff *gax.Backoff
 	for {
-		logger.Infof("waiting for config update...")
-		err := cs.w.Next(ctx)
+		wctx := ctx
+		cancel := func() {}
+		var timeout time.Duration
+		if backoff != nil {
+			timeout = backoff.Pause()
+			wctx, cancel = context.WithTimeout(wctx, timeout)
+		}
+		logger.Infof("waiting for config update... timeout:%s", timeout)
+		err := cs.w.Next(wctx)
+		cancel()
 		if err != nil {
 			logger.Errorf("watch failed %v", err)
-			return err
+			if backoff == nil {
+				return err
+			}
+			if errors.Is(err, command.ErrWatcherClosed) {
+				return err
+			}
+			// if backoff != nil, Next may return context.Canceled
+			// or so due to timeout in wctx.  Try loading anyway.
 		}
-		err = cs.configure(ctx)
+		force := backoff != nil
+		err = cs.configure(ctx, force)
 		if err == command.ErrNoUpdate {
+			backoff = nil
 			continue
 		}
 		if err != nil {
+			// loader  may not get all objects matched around storage@v1.15.0
+			// https://github.com/googleapis/google-cloud-go/issues/4676
 			logger.Errorf("config failed: %v", err)
+			if backoff == nil {
+				backoff = &gax.Backoff{
+					Initial: time.Minute,
+					Max:     time.Hour,
+				}
+			}
 			continue
 		}
+		backoff = nil
 	}
 }
 
@@ -502,7 +530,7 @@
 			logger.Fatalf("configServer: %v", err)
 		}
 		go func() {
-			ready <- cs.configure(ctx)
+			ready <- cs.configure(ctx, true)
 		}()
 		confServer = cs
 	}
diff --git a/cmd/file_server/client.go b/cmd/file_server/client.go
index 493b5a2..cb30a86 100644
--- a/cmd/file_server/client.go
+++ b/cmd/file_server/client.go
@@ -1,6 +1,7 @@
 // Copyright 2017 The Goma Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
+//go:build ignore
 // +build ignore
 
 // client.go is sample client of file server.
diff --git a/command/configmap.go b/command/configmap.go
index d08cddb..32bef30 100644
--- a/command/configmap.go
+++ b/command/configmap.go
@@ -36,6 +36,8 @@
 )
 
 var (
+	ErrWatcherClosed = errors.New("watcher closed")
+
 	pubsubErrors = stats.Int64(
 		"go.chromium.org/goma/command/configmap.pubsub-error",
 		"configmap pubsub error",
@@ -156,9 +158,15 @@
 func (w configMapBucketWatcher) Next(ctx context.Context) error {
 	logger := log.FromContext(ctx)
 	for {
-		msg, ok := <-w.ch
-		if !ok {
-			return errors.New("watcher closed")
+		var msg *pubsub.Message
+		var ok bool
+		select {
+		case msg, ok = <-w.ch:
+			if !ok {
+				return ErrWatcherClosed
+			}
+		case <-ctx.Done():
+			return ctx.Err()
 		}
 		// https://cloud.google.com/storage/docs/pubsub-notifications#attributes
 		eventType := msg.Attributes["eventType"]
@@ -423,8 +431,8 @@
 var ErrNoUpdate = errors.New("toolchain: configmap no update")
 
 // Load loads toolchain config.
-// It will return ErrNoUpdate if there is no seq change.
-func (c *ConfigMapLoader) Load(ctx context.Context) (*cmdpb.ConfigResp, error) {
+// It will return ErrNoUpdate if there is no seq change when force=false.
+func (c *ConfigMapLoader) Load(ctx context.Context, force bool) (*cmdpb.ConfigResp, error) {
 	logger := log.FromContext(ctx)
 	defer logger.Sync()
 
@@ -445,7 +453,10 @@
 		}
 	}
 	if len(updated) == 0 && len(deleted) == 0 {
-		return nil, ErrNoUpdate
+		if !force {
+			return nil, ErrNoUpdate
+		}
+		logger.Infof("configmap no update, but force to load")
 	}
 	for name := range deleted {
 		logger.Infof("delete config for %s", name)
@@ -707,11 +718,13 @@
 
 	// pagination?
 	var confs []*cmdpb.Config
-	logger.Infof("load from %s", bucket)
+	logger.Infof("load from %s prefix:%s", bucket, obj)
 	start := time.Now()
 	var attrsList []*storage.ObjectAttrs
 	for {
 		// iter does not have an API to read all, so just iterate everything.
+		// iter may not get all objects matched around storage@v1.15.0
+		// https://github.com/googleapis/google-cloud-go/issues/4676
 		attrs, err := iter.Next()
 		if err == iterator.Done {
 			break
@@ -797,6 +810,6 @@
 		confs = append(confs, conf)
 		logger.Infof("%s/%s: %s", bucket, attrs.Name, conf.CmdDescriptor.GetSelector())
 	}
-	logger.Infof("loaded from %s: %d configs using %v", bucket, len(confs), time.Since(start))
+	logger.Infof("loaded from %s prefix:%s: %d configs using %v", bucket, obj, len(confs), time.Since(start))
 	return confs, nil
 }
diff --git a/exec/inventory.go b/exec/inventory.go
index ff5107b..17ddd47 100644
--- a/exec/inventory.go
+++ b/exec/inventory.go
@@ -168,6 +168,14 @@
 	acl                *cmdpb.ACL
 }
 
+func numConfigs(configs map[string]map[selector]*cmdpb.Config) int {
+	n := 0
+	for _, m := range configs {
+		n += len(m)
+	}
+	return n
+}
+
 // Configure sets config in the inventory.
 func (in *Inventory) Configure(ctx context.Context, cfgs *cmdpb.ConfigResp) error {
 	ctx, span := trace.StartSpan(ctx, "go.chromium.org/goma/server/exec.Service.Configure")
@@ -228,6 +236,18 @@
 	}
 	in.mu.Lock()
 	defer in.mu.Unlock()
+	n0 := numConfigs(in.configs)
+	n1 := numConfigs(newConfigs)
+	logger.Infof("configure %s:%d -> %s:%d", in.versionID, n0, cfgs.VersionId, n1)
+	if diff := n0 - n1; n0 != 0 && 100*diff/n0 > 1 {
+		ratio := 100 * diff / n0
+		// mitigate for https://bugs.chromium.org/p/chromium/issues/detail?id=1243381
+		// if configs reduced more than 1%, reject it, and
+		// retry load.
+		// if it is a real removal, restaring server can forget
+		// the old one.
+		return fmt.Errorf("too many configs will be removed: %d -> %d: -%d%%. keep old ones.  Please restart the server if the config removal is intended", n0, n1, ratio)
+	}
 	in.versionID = cfgs.VersionId
 	in.addrs = newAddrs
 	in.configs = newConfigs
diff --git a/go.mod b/go.mod
index 59885e6..48ef79e 100644
--- a/go.mod
+++ b/go.mod
@@ -3,13 +3,17 @@
 go 1.12
 
 require (
-	cloud.google.com/go v0.88.0
-	cloud.google.com/go/pubsub v1.13.0
+	cloud.google.com/go v0.93.3
+	cloud.google.com/go/errorreporting v0.1.0
+	cloud.google.com/go/monitoring v0.1.0
+	cloud.google.com/go/profiler v0.1.0
+	cloud.google.com/go/pubsub v1.16.0
 	cloud.google.com/go/storage v1.16.0
+	cloud.google.com/go/trace v0.1.0 // indirect
 	contrib.go.opencensus.io/exporter/stackdriver v0.13.8
 	github.com/bazelbuild/remote-apis v0.0.0-20210520160108-3e385366f152
 	github.com/bazelbuild/remote-apis-sdks v0.0.0-20201118210229-b732553f9d45
-	github.com/fsnotify/fsnotify v1.4.9
+	github.com/fsnotify/fsnotify v1.5.1
 	github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e
 	github.com/gomodule/redigo v1.8.5
 	github.com/google/go-cmp v0.5.6
@@ -18,13 +22,13 @@
 	github.com/googleapis/google-cloud-go-testing v0.0.0-20190904031503-2d24dde44ba5
 	github.com/grpc-ecosystem/go-grpc-middleware v1.3.0
 	go.opencensus.io v0.23.0
-	go.uber.org/zap v1.18.1
+	go.uber.org/zap v1.19.0
 	golang.org/x/build v0.0.0-20191031202223-0706ea4fce0c
 	golang.org/x/net v0.0.0-20210505214959-0714010a04ed
-	golang.org/x/oauth2 v0.0.0-20210628180205-a41e5a781914
+	golang.org/x/oauth2 v0.0.0-20210805134026-6f1e6394065a
 	golang.org/x/sync v0.0.0-20210220032951-036812b2e83c
-	google.golang.org/api v0.51.0
-	google.golang.org/genproto v0.0.0-20210721163202-f1cecdd8b78a
-	google.golang.org/grpc v1.39.0
+	google.golang.org/api v0.54.0
+	google.golang.org/genproto v0.0.0-20210821163610-241b8fcbd6c8
+	google.golang.org/grpc v1.40.0
 	google.golang.org/protobuf v1.27.1
 )
diff --git a/go.sum b/go.sum
index 3b12d93..c646786 100644
--- a/go.sum
+++ b/go.sum
@@ -23,8 +23,11 @@
 cloud.google.com/go v0.83.0/go.mod h1:Z7MJUsANfY0pYPdw0lbnivPx4/vhy/e2FEkSkF7vAVY=
 cloud.google.com/go v0.84.0/go.mod h1:RazrYuxIK6Kb7YrzzhPoLmCVzl7Sup4NrbKPg8KHSUM=
 cloud.google.com/go v0.87.0/go.mod h1:TpDYlFy7vuLzZMMZ+B6iRiELaY7z/gJPaqbMx6mlWcY=
-cloud.google.com/go v0.88.0 h1:MZ2cf9Elnv1wqccq8ooKO2MqHQLc+ChCp/+QWObCpxg=
-cloud.google.com/go v0.88.0/go.mod h1:dnKwfYbP9hQhefiUvpbcAyoGSHUrOxR20JVElLiUvEY=
+cloud.google.com/go v0.90.0/go.mod h1:kRX0mNRHe0e2rC6oNakvwQqzyDmg57xJ+SZU1eT2aDQ=
+cloud.google.com/go v0.92.2/go.mod h1:8utlLll2EF5XMAV15woO4lSbWQlk8rer9aLOfLh7+YI=
+cloud.google.com/go v0.92.3/go.mod h1:8utlLll2EF5XMAV15woO4lSbWQlk8rer9aLOfLh7+YI=
+cloud.google.com/go v0.93.3 h1:wPBktZFzYBcCZVARvwVKqH1uEj+aLXofJEtrb4oOsio=
+cloud.google.com/go v0.93.3/go.mod h1:8utlLll2EF5XMAV15woO4lSbWQlk8rer9aLOfLh7+YI=
 cloud.google.com/go/bigquery v1.0.1/go.mod h1:i/xbL2UlR5RvWAURpBYZTtm/cXjCha9lbfbpx4poX+o=
 cloud.google.com/go/bigquery v1.3.0/go.mod h1:PjpwJnslEMmckchkHFfq+HTD2DmtT67aNFKH1/VBDHE=
 cloud.google.com/go/bigquery v1.4.0/go.mod h1:S8dzgnTigyfTmLBfrtrhyYhwRxG72rYxvftPBK2Dvzc=
@@ -33,12 +36,20 @@
 cloud.google.com/go/bigquery v1.8.0/go.mod h1:J5hqkt3O0uAFnINi6JXValWIb1v0goeZM77hZzJN/fQ=
 cloud.google.com/go/datastore v1.0.0/go.mod h1:LXYbyblFSglQ5pkeyhO+Qmw7ukd3C+pD7TKLgZqpHYE=
 cloud.google.com/go/datastore v1.1.0/go.mod h1:umbIZjpQpHh4hmRpGhH4tLFup+FVzqBi1b3c64qFpCk=
+cloud.google.com/go/errorreporting v0.1.0 h1:z40EhrjRspplwbpO+9DSnC4kgDokBi94T/gYwtdKL5Q=
+cloud.google.com/go/errorreporting v0.1.0/go.mod h1:cZSiBMvrnl0X13pD9DwKf9sQ8Eqy3EzHqkyKBZxiIrM=
+cloud.google.com/go/kms v0.1.0 h1:VXAb5OzejDcyhFzIDeZ5n5AUdlsFnCyexuascIwWMj0=
+cloud.google.com/go/kms v0.1.0/go.mod h1:8Qp8PCAypHg4FdmlyW1QRAv09BGQ9Uzh7JnmIZxPk+c=
+cloud.google.com/go/monitoring v0.1.0 h1:vssDZ792skH6AWCDH1OogKfs/FzgEVTB/yUAzfgBR24=
+cloud.google.com/go/monitoring v0.1.0/go.mod h1:Hpm3XfzJv+UTiXzCG5Ffp0wijzHTC7Cv4eR7o3x/fEE=
+cloud.google.com/go/profiler v0.1.0 h1:MG/rxKC1MztRfEWMGYKFISxyZak5hNh29f0A/z2tvWk=
+cloud.google.com/go/profiler v0.1.0/go.mod h1:D7S7LV/zKbRWkOzYL1b5xytpqt8Ikd/v/yvf1/Tx2pQ=
 cloud.google.com/go/pubsub v1.0.1/go.mod h1:R0Gpsv3s54REJCy4fxDixWD93lHJMoZTyQ2kNxGRt3I=
 cloud.google.com/go/pubsub v1.1.0/go.mod h1:EwwdRX2sKPjnvnqCa270oGRyludottCI76h+R3AArQw=
 cloud.google.com/go/pubsub v1.2.0/go.mod h1:jhfEVHT8odbXTkndysNHCcx0awwzvfOlguIAii9o8iA=
 cloud.google.com/go/pubsub v1.3.1/go.mod h1:i+ucay31+CNRpDW4Lu78I4xXG+O1r/MAHgjpRVR+TSU=
-cloud.google.com/go/pubsub v1.13.0 h1:Q27HxPAv+57FFR9povbiheKHbQh4THHFoKcUGBvDCyc=
-cloud.google.com/go/pubsub v1.13.0/go.mod h1:+XCTuHyie4clVTIqoz575g4/3mQ+YCSMfJx8vPHov7Q=
+cloud.google.com/go/pubsub v1.16.0 h1:N2WVmm3vmoBo8+cbBgwACB8ZKUP/YQvG2ujHx47/oXY=
+cloud.google.com/go/pubsub v1.16.0/go.mod h1:6A8EfoWZ/lUvCWStKGwAWauJZSiuV0Mkmu6WilK/TxQ=
 cloud.google.com/go/storage v1.0.0/go.mod h1:IhtSnM/ZTZV8YYJWCY8RULGVqBDmpoyjwiyrjsg+URw=
 cloud.google.com/go/storage v1.5.0/go.mod h1:tpKbwo567HUNpVclU5sGELwQWBDZ8gh0ZeosJ0Rtdos=
 cloud.google.com/go/storage v1.6.0/go.mod h1:N7U0C8pVQ/+NIKOBQyamJIeKQKkZ+mxpohlUTyfDhBk=
@@ -46,11 +57,14 @@
 cloud.google.com/go/storage v1.10.0/go.mod h1:FLPqc6j+Ki4BU591ie1oL6qBQGu2Bl/tZ9ullr3+Kg0=
 cloud.google.com/go/storage v1.16.0 h1:1UwAux2OZP4310YXg5ohqBEpV16Y93uZG4+qOX7K2Kg=
 cloud.google.com/go/storage v1.16.0/go.mod h1:ieKBmUyzcftN5tbxwnXClMKH00CfcQ+xL6NN0r5QfmE=
+cloud.google.com/go/trace v0.1.0 h1:nUGUK79FOkN0UGUXhBmVBkbu1PYsHe0YyFSPLOD9Npg=
+cloud.google.com/go/trace v0.1.0/go.mod h1:wxEwsoeRVPbeSkt7ZC9nWCgmoKQRAoySN7XHW2AmI7g=
 contrib.go.opencensus.io/exporter/stackdriver v0.13.8 h1:lIFYmQsqejvlq+GobFUbC5F0prD5gvhP6r0gWLZRDq4=
 contrib.go.opencensus.io/exporter/stackdriver v0.13.8/go.mod h1:huNtlWx75MwO7qMs0KrMxPZXzNNWebav1Sq/pm02JdQ=
 dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
 github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
+github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
 github.com/aclements/go-gg v0.0.0-20170323211221-abd1f791f5ee/go.mod h1:55qNq4vcpkIuHowELi5C8e+1yUHtoLoOUR9QU5j7Tes=
 github.com/aclements/go-moremath v0.0.0-20190830160640-d16893ddf098/go.mod h1:idZL3yvz4kzx1dsBOAC+oYv6L92P1oFEhUXUB1A/lwQ=
 github.com/ajstarks/deck v0.0.0-20191009173945-82d717002242/go.mod h1:j3f/59diR4DorW5A78eDYvRkdrkh+nps4p5LA1Tl05U=
@@ -72,6 +86,7 @@
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/census-instrumentation/opencensus-proto v0.3.0 h1:t/LhUZLVitR1Ow2YOnduCsavhwFUklBMoGVYUCqmCqk=
 github.com/census-instrumentation/opencensus-proto v0.3.0/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
+github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
 github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
 github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
 github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
@@ -108,8 +123,8 @@
 github.com/flynn/go-shlex v0.0.0-20150515145356-3f9db97f8568/go.mod h1:xEzjJPgXI435gkrCt3MPfRiAkVrwSbHsst4LCFVfpJc=
 github.com/fogleman/gg v1.3.0/go.mod h1:R/bRT+9gY/C5z7JzPU0zXsXHKM4/ayA+zqcVNZzPa1k=
 github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
-github.com/fsnotify/fsnotify v1.4.9 h1:hsms1Qyu0jgnwNXIxa+/V/PDsU6CfLf6CNO8H7IWoS4=
-github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ=
+github.com/fsnotify/fsnotify v1.5.1 h1:mZcQUHVQUQWoPXXtuf9yuEXKudkV2sx1E06UadKWpgI=
+github.com/fsnotify/fsnotify v1.5.1/go.mod h1:T3375wBYaZdLLcVNkcVbzGHY7f1l/uK5T5Ai1i3InKU=
 github.com/garyburd/redigo v1.6.0/go.mod h1:NR3MbYisc3/PwhQ00EMzDiPmrwpPxAn5GI05/YaO1SY=
 github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
 github.com/gliderlabs/ssh v0.1.1/go.mod h1:U7qILu1NlMHj9FlMhZLlkCdDnU1DBEAqr0aevW3Awn0=
@@ -206,8 +221,9 @@
 github.com/google/pprof v0.0.0-20210226084205-cbba55b83ad5/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
 github.com/google/pprof v0.0.0-20210601050228-01bbb1931b22/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
 github.com/google/pprof v0.0.0-20210609004039-a478d1d731e9/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
-github.com/google/pprof v0.0.0-20210715191844-86eeefc3e471 h1:WqmlwDwojb0rrPPtueSYqNrONX90T3SjwZeVUr4QCtI=
-github.com/google/pprof v0.0.0-20210715191844-86eeefc3e471/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
+github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
+github.com/google/pprof v0.0.0-20210804190019-f964ff605595 h1:uNrRgpnKjTfxu4qHaZAAs3eKTYV1EzGF3dAykpnxgDE=
+github.com/google/pprof v0.0.0-20210804190019-f964ff605595/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
 github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
 github.com/google/uuid v1.0.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
@@ -235,7 +251,6 @@
 github.com/jmespath/go-jmespath/internal/testify v1.5.1 h1:shLQSRRSCCPj3f2gpwzGwWFoC7ycTf1rcQZHOlsJ6N8=
 github.com/jmespath/go-jmespath/internal/testify v1.5.1/go.mod h1:L3OGu8Wl2/fWfCI6z80xFu9LTZmf1ZRjMHUOPmWr69U=
 github.com/jstemmer/go-junit-report v0.0.0-20190106144839-af01ea7f8024/go.mod h1:6v2b51hI/fHJwM22ozAgKL4VKDeJcHhJFhtBdhmNjmU=
-github.com/jstemmer/go-junit-report v0.9.1 h1:6QPYqodiu3GuPL+7mfx+NwDdp2eTkp9IfEUpgAwUN0o=
 github.com/jstemmer/go-junit-report v0.9.1/go.mod h1:Brl9GWCQeLvo8nXZwPNNblvFj/XSXhF0NWZEnDohbsk=
 github.com/jung-kurt/gofpdf v1.0.0/go.mod h1:7Id9E/uU8ce6rXgefFLlgrJj/GYY22cpxn+r32jIOes=
 github.com/jung-kurt/gofpdf v1.13.0/go.mod h1:1hl7y57EsiPAkLbOwzpzqgx1A30nQCk/YmFV8S2vmK0=
@@ -272,6 +287,7 @@
 github.com/ruudk/golang-pdf417 v0.0.0-20181029194003-1af4ab5afa58/go.mod h1:6lfFZQK844Gfx8o5WFuvpxWRwnSoipWe/p622j1v06w=
 github.com/rwcarlsen/goexif v0.0.0-20190401172101-9e8deecbddbd/go.mod h1:hPqNNc0+uJM6H+SuU8sEs5K5IQeKccPqeSjfgcKGgPk=
 github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
+github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.2.0/go.mod h1:qt09Ya8vawLte6SNmTgCsAVtYtaKzEcn8ATUoHMkEqE=
@@ -308,8 +324,8 @@
 go.uber.org/multierr v1.6.0 h1:y6IPFStTAIT5Ytl7/XYmHvzXQ7S3g/IeZW9hyZ5thw4=
 go.uber.org/multierr v1.6.0/go.mod h1:cdWPpRnG4AhwMwsgIHip0KRBQjJy5kYEpYjJxpXp9iU=
 go.uber.org/zap v1.10.0/go.mod h1:vwi/ZaCAaUcBkycHslxD9B2zi4UTXhF60s6SWpuDF0Q=
-go.uber.org/zap v1.18.1 h1:CSUJ2mjFszzEWt4CdKISEuChVIXGBn3lAPwkRGyVrc4=
-go.uber.org/zap v1.18.1/go.mod h1:xg/QME4nWcxGxrpdeYfq7UvYrLh66cuVKdrbD1XF/NI=
+go.uber.org/zap v1.19.0 h1:mZQZefskPPCMIBCSEH0v2/iUqqLrYtaeqwD6FUGUnFE=
+go.uber.org/zap v1.19.0/go.mod h1:xg/QME4nWcxGxrpdeYfq7UvYrLh66cuVKdrbD1XF/NI=
 go4.org v0.0.0-20180809161055-417644f6feb5/go.mod h1:MkTOUMDaeVYJUOUsaDXIhWPZYa1yOyC1qaOBpL57BhE=
 golang.org/x/build v0.0.0-20191031202223-0706ea4fce0c h1:jjNoDZTS0vmbqBhqD5MPXauZW+kcGyflfDDFBNCPSVI=
 golang.org/x/build v0.0.0-20191031202223-0706ea4fce0c/go.mod h1:Nl5grlQor/lxfX9FfGLe+g2cVSCiURG36KQgsg/ODs4=
@@ -416,8 +432,9 @@
 golang.org/x/oauth2 v0.0.0-20210313182246-cd4f82c27b84/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
 golang.org/x/oauth2 v0.0.0-20210514164344-f6687ab2804c/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
 golang.org/x/oauth2 v0.0.0-20210615190721-d04028783cf1/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.0.0-20210628180205-a41e5a781914 h1:3B43BWw0xEBsLZ/NO1VALz6fppU3481pik+2Ksv45z8=
 golang.org/x/oauth2 v0.0.0-20210628180205-a41e5a781914/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
+golang.org/x/oauth2 v0.0.0-20210805134026-6f1e6394065a h1:4Kd8OPUx1xgUwrHDaviWZO8MsgoZTZYC3g+8m16RBww=
+golang.org/x/oauth2 v0.0.0-20210805134026-6f1e6394065a/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
 golang.org/x/perf v0.0.0-20180704124530-6e6d33e29852/go.mod h1:JLpeXjPJfIyPr5TlbXLkXWLhP8nz10XfvxElABhCtcw=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -444,7 +461,6 @@
 golang.org/x/sys v0.0.0-20190624142023-c5567b49c5d0/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190726091711-fc99dfbffb4e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191001151750-bb3f8db39f24/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191005200804-aed5e4c7ecf9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191204072324-ce4227a45e2e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191228213918-04cbcbbfeed8/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200113162924-86b910548bc1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -478,8 +494,9 @@
 golang.org/x/sys v0.0.0-20210514084401-e8d321eab015/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210603125802-9665404d3644/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c h1:F1jZWGFhYfh0Ci55sIpILtKKK8p3i2/krTr0H1rg74I=
 golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210806184541-e5e7981a1069 h1:siQdpVirKtzPhKl3lZWozZraCFObP8S1v6PRp0bLrtU=
+golang.org/x/sys v0.0.0-20210806184541-e5e7981a1069/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -493,7 +510,7 @@
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.0.0-20210611083556-38a9dc6acbc6/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/time v0.0.0-20210723032227-1f47c861a9ac/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
@@ -582,8 +599,9 @@
 google.golang.org/api v0.48.0/go.mod h1:71Pr1vy+TAZRPkPs/xlCf5SsU8WjuAWv1Pfjbtukyy4=
 google.golang.org/api v0.49.0/go.mod h1:BECiH72wsfwUvOVn3+btPD5WHi0LzavZReBndi42L18=
 google.golang.org/api v0.50.0/go.mod h1:4bNT5pAuq5ji4SRZm+5QIkjny9JAyVD/3gaSihNefaw=
-google.golang.org/api v0.51.0 h1:SQaA2Cx57B+iPw2MBgyjEkoeMkRK2IenSGoia0U3lCk=
 google.golang.org/api v0.51.0/go.mod h1:t4HdrdoNgyN5cbEfm7Lum0lcLDLiise1F8qDKX00sOU=
+google.golang.org/api v0.54.0 h1:ECJUVngj71QI6XEm7b1sAf8BljU5inEhMbKPR8Lxhhk=
+google.golang.org/api v0.54.0/go.mod h1:7C4bFFOvVDGXjfDTAsgGwDgAxRDeQ4X8NvUedIt6z3k=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
 google.golang.org/appengine v1.5.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
@@ -644,10 +662,12 @@
 google.golang.org/genproto v0.0.0-20210624174822-c5cf32407d0a/go.mod h1:SzzZ/N+nwJDaO1kznhnlzqS8ocJICar6hYhVyhi++24=
 google.golang.org/genproto v0.0.0-20210624195500-8bfb893ecb84/go.mod h1:SzzZ/N+nwJDaO1kznhnlzqS8ocJICar6hYhVyhi++24=
 google.golang.org/genproto v0.0.0-20210713002101-d411969a0d9a/go.mod h1:AxrInvYm1dci+enl5hChSFPOmmUF1+uAa/UsgNRWd7k=
-google.golang.org/genproto v0.0.0-20210714021259-044028024a4f/go.mod h1:AxrInvYm1dci+enl5hChSFPOmmUF1+uAa/UsgNRWd7k=
 google.golang.org/genproto v0.0.0-20210716133855-ce7ef5c701ea/go.mod h1:AxrInvYm1dci+enl5hChSFPOmmUF1+uAa/UsgNRWd7k=
-google.golang.org/genproto v0.0.0-20210721163202-f1cecdd8b78a h1:17YmRUuEF4d+t2ygJZaDPhqNL2Hf17832xWKcMU7r2I=
-google.golang.org/genproto v0.0.0-20210721163202-f1cecdd8b78a/go.mod h1:ob2IJxKrgPT52GcgX759i1sleT07tiKowYBGbczaW48=
+google.golang.org/genproto v0.0.0-20210728212813-7823e685a01f/go.mod h1:ob2IJxKrgPT52GcgX759i1sleT07tiKowYBGbczaW48=
+google.golang.org/genproto v0.0.0-20210805201207-89edb61ffb67/go.mod h1:ob2IJxKrgPT52GcgX759i1sleT07tiKowYBGbczaW48=
+google.golang.org/genproto v0.0.0-20210813162853-db860fec028c/go.mod h1:cFeNkxwySK631ADgubI+/XFU/xp8FD5KIVV4rj8UC5w=
+google.golang.org/genproto v0.0.0-20210821163610-241b8fcbd6c8 h1:XosVttQUxX8erNhEruTu053/VchgYuksoS9Bj/OITjU=
+google.golang.org/genproto v0.0.0-20210821163610-241b8fcbd6c8/go.mod h1:eFjDcFEctNawg4eG61bRv87N7iHBWyVhJu7u1kqDUXY=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
 google.golang.org/grpc v1.21.1/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=
@@ -670,8 +690,10 @@
 google.golang.org/grpc v1.37.0/go.mod h1:NREThFqKR1f3iQ6oBuvc5LadQuXVGo9rkm5ZGrQdJfM=
 google.golang.org/grpc v1.37.1/go.mod h1:NREThFqKR1f3iQ6oBuvc5LadQuXVGo9rkm5ZGrQdJfM=
 google.golang.org/grpc v1.38.0/go.mod h1:NREThFqKR1f3iQ6oBuvc5LadQuXVGo9rkm5ZGrQdJfM=
-google.golang.org/grpc v1.39.0 h1:Klz8I9kdtkIN6EpHHUOMLCYhTn/2WAe5a0s1hcBkdTI=
 google.golang.org/grpc v1.39.0/go.mod h1:PImNr+rS9TWYb2O4/emRugxiyHZ5JyHW5F+RPnDzfrE=
+google.golang.org/grpc v1.39.1/go.mod h1:PImNr+rS9TWYb2O4/emRugxiyHZ5JyHW5F+RPnDzfrE=
+google.golang.org/grpc v1.40.0 h1:AGJ0Ih4mHjSeibYkFGh1dD9KJ/eOtZ93I6hoHhukQ5Q=
+google.golang.org/grpc v1.40.0/go.mod h1:ogyxbiOoUXAkP+4+xa6PZSE9DZgIHtSpzjDTB9KAK34=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.1.0/go.mod h1:6Kw0yEErY5E/yWrBtf03jp27GLLJujG4z/JK95pnjjw=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
diff --git a/proto/importer.go b/proto/importer.go
index 86aa88b..b9d6246 100644
--- a/proto/importer.go
+++ b/proto/importer.go
@@ -1,3 +1,5 @@
+// Copyright 2021 Google LLC. All Rights Reserved.
+//go:build ignore
 // +build ignore
 
 // Binary importer imports proto files.
diff --git a/remoteexec/exec_oss.go b/remoteexec/exec_oss.go
index 99abe79..90d7c2c 100644
--- a/remoteexec/exec_oss.go
+++ b/remoteexec/exec_oss.go
@@ -3,6 +3,7 @@
 // found in the LICENSE file.
 
 
+
 package remoteexec
 
 import (
diff --git a/remoteexec/nsjail.go b/remoteexec/nsjail.go
index 7a75e67..fc8e689 100644
--- a/remoteexec/nsjail.go
+++ b/remoteexec/nsjail.go
@@ -56,13 +56,14 @@
 seccomp_string: "  alarm,"
 seccomp_string: "  arch_prctl,"
 seccomp_string: "  brk,"
-seccomp_string: "  close,"
 seccomp_string: "  clone,"
+seccomp_string: "  close,"
 seccomp_string: "  connect,"
 seccomp_string: "  dup2,"
 seccomp_string: "  execve,"
 seccomp_string: "  exit_group,"
 seccomp_string: "  fcntl,"
+seccomp_string: "  fstatfs,"
 seccomp_string: "  futex,"
 seccomp_string: "  getcwd,"
 seccomp_string: "  getdents,"
@@ -73,9 +74,9 @@
 seccomp_string: "  getpgrp,"
 seccomp_string: "  getpid,"
 seccomp_string: "  getppid,"
-seccomp_string: "  getuid,"
-seccomp_string: "  gettid,"
 seccomp_string: "  getrlimit,"
+seccomp_string: "  gettid,"
+seccomp_string: "  getuid,"
 seccomp_string: "  ioctl,"
 seccomp_string: "  lseek,"
 seccomp_string: "  mmap,"