Fix file descriptor leaks in remote import, save, and checkpoint operations

Fix four file descriptor leaks:

1. tunnel/images.go Import: os.Open(opts.Source) never closed
2. tunnel/images.go Save: second os.Open for oci-dir/docker-dir never closed
3. bindings/checkpoint.go Restore: os.Open(importPath) never closed
4. container_internal_common.go: os.Create in checkpoint volume export
   loop not closed on five error paths

These are the same class of bug fixed in #28723 and #28724.

Signed-off-by: Sebastien Tardif <sebtardif@ncf.ca>

Author: SebTardif

libpod/container_internal_common.go

@@ -1201,26 +1201,31 @@ func (c *Container) exportCheckpoint(options ContainerCheckpointOptions) error {
 
 			volume, err := c.runtime.GetVolume(v.Name)
 			if err != nil {
+				volumeTarFile.Close()
 				return err
 			}
 
 			mp, err := volume.MountPoint()
 			if err != nil {
+				volumeTarFile.Close()
 				return err
 			}
 			if mp == "" {
+				volumeTarFile.Close()
 				return fmt.Errorf("volume %s is not mounted, cannot export: %w", volume.Name(), define.ErrInternal)
 			}
 			input, err := chrootarchive.Tar(mp, &archive.TarOptions{
 				Compression:      archive.Uncompressed,
 				IncludeSourceDir: true,
 			}, mp)
 			if err != nil {
+				volumeTarFile.Close()
 				return fmt.Errorf("reading volume directory %q: %w", v.Dest, err)
 			}
 
 			_, err = io.Copy(volumeTarFile, input)
 			if err != nil {
+				volumeTarFile.Close()
 				return err
 			}
 			volumeTarFile.Close()

pkg/bindings/containers/checkpoint.go

@@ -88,10 +88,12 @@ func Restore(ctx context.Context, nameOrID string, options *RestoreOptions) (*ty
 	}
 	if i != "" {
 		params.Set("import", "true")
-		r, err = os.Open(i)
+		importFile, err := os.Open(i)
 		if err != nil {
 			return nil, err
 		}
+		defer importFile.Close()
+		r = importFile
 		// Hard-code the name since it will be ignored in any case.
 		nameOrID = "import"
 	}

pkg/domain/infra/tunnel/images.go

@@ -267,6 +267,7 @@ func (ir *ImageEngine) Import(_ context.Context, opts entities.ImageImportOption
 		if err != nil {
 			return nil, err
 		}
+		defer f.Close()
 	}
 	return images.Import(ir.ClientCtx, f, options)
 }
@@ -354,6 +355,7 @@ func (ir *ImageEngine) Save(_ context.Context, nameOrID string, tags []string, o
 	if err != nil {
 		return err
 	}
+	defer f.Close()
 	info, err := os.Stat(opts.Output)
 	switch {
 	case err == nil: