chore: test code to verify fd leaks

Dockerfile

@@ -659,6 +659,7 @@ COPY --chmod=0644 hack/cri-containerd.toml /rootfs/etc/cri/containerd.toml
 COPY --chmod=0644 hack/cri-plugin.part /rootfs/etc/cri/conf.d/00-base.part
 COPY --chmod=0644 hack/udevd/80-net-name-slot.rules /rootfs/usr/lib/udev/rules.d/
 COPY --chmod=0644 hack/lvm.conf /rootfs/etc/lvm/lvm.conf
+COPY --chmod=0755 hack/fdspy/fdspy /rootfs/usr/bin/fdspy
 RUN <<END
     ln -s /usr/share/zoneinfo/Etc/UTC /rootfs/etc/localtime
     touch /rootfs/etc/{extensions.yaml,resolv.conf,hosts,os-release,machine-id,cri/conf.d/cri.toml,cri/conf.d/01-registries.part,cri/conf.d/20-customization.part,ssl/certs/ca-certificates}

hack/fdspy/go.mod

@@ -0,0 +1,3 @@
+module github.com/siderolabs/fdspy
+
+go 1.23.1

hack/fdspy/main.go

@@ -0,0 +1,28 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package main
+
+import (
+	"fmt"
+	"os"
+)
+
+func main() {
+	fds, err := os.ReadDir("/proc/self/fd")
+	if err != nil {
+		panic(err)
+	}
+
+	for _, fd := range fds {
+		fname, err := os.Readlink(fmt.Sprintf("/proc/self/fd/%s", fd.Name()))
+		if err != nil {
+			fmt.Fprintln(os.Stderr, fd.Name(), " --> ", err)
+		} else {
+			fmt.Fprintln(os.Stderr, fd.Name(), " --> ", fname)
+		}
+	}
+
+	os.Exit(1)
+}

internal/app/machined/pkg/controllers/runtime/fdspy.go

@@ -0,0 +1,57 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package runtime
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/controller"
+	"github.com/siderolabs/go-cmd/pkg/cmd"
+	"go.uber.org/zap"
+)
+
+// FDSpyController activates LVM volumes when they are discovered by the block.DiscoveryController.
+type FDSpyController struct {
+}
+
+// Name implements controller.Controller interface.
+func (ctrl *FDSpyController) Name() string {
+	return "runtime.FDSpyController"
+}
+
+// Inputs implements controller.Controller interface.
+func (ctrl *FDSpyController) Inputs() []controller.Input {
+	return nil
+}
+
+// Outputs implements controller.Controller interface.
+func (ctrl *FDSpyController) Outputs() []controller.Output {
+	return nil
+}
+
+// Run implements controller.Controller interface.
+//
+//nolint:gocyclo
+func (ctrl *FDSpyController) Run(ctx context.Context, r controller.Runtime, logger *zap.Logger) error {
+	ticker := time.NewTicker(5 * time.Second)
+	defer ticker.Stop()
+
+	for {
+		select {
+		case <-ctx.Done():
+			return nil
+		case <-r.EventCh():
+		case <-ticker.C:
+		}
+
+		if _, err := cmd.RunContext(ctx,
+			"/usr/bin/fdspy",
+		); err != nil {
+			return fmt.Errorf("failed to run fdspy: %w", err)
+		}
+	}
+}

internal/app/machined/pkg/runtime/v1alpha2/v1alpha2_controller.go

@@ -298,6 +298,7 @@ func (ctrl *Controller) Run(ctx context.Context, drainer *runtime.Drainer) error
 			ConfigPath:       constants.ExtensionServiceConfigPath,
 		},
 		&runtimecontrollers.ExtensionStatusController{},
+		&runtimecontrollers.FDSpyController{},
 		&runtimecontrollers.KernelModuleConfigController{},
 		&runtimecontrollers.KernelModuleSpecController{
 			V1Alpha1Mode: ctrl.v1alpha1Runtime.State().Platform().Mode(),