Reapply "[image-builder-bob] bump up buildkit (#20690)" (#20693) (#20694)

* Reapply "[image-builder-bob] bump up buildkit (#20690)" (#20693)

This reverts commit 7137833.

Tool: gitpod/catfood.gitpod.cloud

* update

Tool: gitpod/catfood.gitpod.cloud

Author: iQQBot

.github/workflows/build.yml

@@ -4,6 +4,7 @@ permissions:
   contents: write # This is required for actions/checkout and create release
   pull-requests: write
   actions: write  # This is required for trigger another action which is used by JetBrains integrateion tests
+  packages: read
 on:
   pull_request:
     types: [ opened, edited ]
@@ -229,6 +230,12 @@ jobs:
           cat report.html >> $GITHUB_STEP_SUMMARY
 
           exit $RESULT
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
       - name: Leeway Build
         id: leeway
         shell: bash

components/image-builder-bob/leeway.Dockerfile

@@ -2,7 +2,7 @@
 # Licensed under the GNU Affero General Public License (AGPL).
 # See License.AGPL.txt in the project root for license information.
 
-FROM eu.gcr.io/gitpod-core-dev/build/buildkit:v0.12.5-gitpod.0
+FROM ghcr.io/gitpod-io/buildkit:v0.20.1-gitpod.2
 
 USER root
 RUN apk --no-cache add sudo bash \

components/workspacekit/pkg/seccomp/notify.go

@@ -275,7 +275,9 @@ func (h *InWorkspaceHandler) Mount(req *libseccomp.ScmpNotifReq) (val uint64, er
 		if strings.HasPrefix(dest, "/proc/self/") {
 			target = filepath.Join("/proc", strconv.Itoa(int(req.Pid)), strings.TrimPrefix(dest, "/proc/self/"))
 		}
-
+		if strings.HasPrefix(dest, "/proc/thread-self/") {
+			target = filepath.Join("/proc", strconv.Itoa(int(req.Pid)), strings.TrimPrefix(dest, "/proc/thread-self/"))
+		}
 		stat, err := os.Lstat(target)
 		if errors.Is(err, fs.ErrNotExist) {
 			err = os.MkdirAll(target, 0755)