Skip to content

Releases: opencontainers/runc

runc 1.1.1 -- "Violence is the last refuge of the incompetent."

29 Mar 03:30
@kolyshkin kolyshkin
v1.1.1
This tag was signed with the committer’s verified signature.
kolyshkin Kir Kolyshkin
GPG key ID: 17DE5ECB75A1100E
Learn about vigilant mode.
52de29d
Compare
Choose a tag to compare
runc 1.1.1 -- "Violence is the last refuge of the incompetent."

This is the first stable release in the 1.1 branch, fixing a few issues
with runc 1.1.0.

Fixed:

  • runc run/start can now run a container with read-only /dev in OCI spec,
    rather than error out. (#3355)
  • runc exec now ensures that --cgroup argument is a sub-cgroup. (#3403)
  • libcontainer systemd v2 manager no longer errors out if one of the files
    listed in /sys/kernel/cgroup/delegate do not exist in container's
    cgroup. (#3387, #3404)
  • Loosen OCI spec validation to avoid bogus "Intel RDT is not supported"
    error. (#3406)
  • libcontainer/cgroups no longer panics in cgroup v1 managers if stat
    of /sys/fs/cgroup/unified returns an error other than ENOENT. (#3435)

Static Linking Notices

The runc binary distributed with this release are statically linked with
the following GNU LGPL-2.1 licensed libraries, with runc acting
as a "work that uses the Library":

The versions of these libraries were not modified from their upstream versions,
but in order to comply with the LGPL-2.1 (§6(a)), we have attached the
complete source code for those libraries which (when combined with the attached
runc source code) may be used to exercise your rights under the LGPL-2.1.

However we strongly suggest that you make use of your distribution's packages
or download them from the authoritative upstream sources, especially since
these libraries are related to the security of your containers.

Thanks to all of the contributors who made this release possible:

Signed-off-by: Kir Kolyshkin [email protected]

Assets 19
Loading

runc 1.1 -- "A plan depends as much upon execution as it does upon concept."

17 Jan 22:50
@cyphar cyphar
v1.1.0
This tag was signed with the committer’s verified signature. The key has been revoked.
cyphar Aleksa Sarai
GPG key ID: 9D94B96321B9D012
Revoked
Learn about vigilant mode.
067aaf8
This commit was signed with the committer’s verified signature. The key has been revoked.
cyphar Aleksa Sarai
GPG key ID: 9D94B96321B9D012
Revoked
Learn about vigilant mode.
Compare
Choose a tag to compare
runc 1.1 -- "A plan depends as much upon execution as it does upon concept."

This release only contains very minor changes from v1.1.0-rc.1 and is
the first release of the 1.1.y release series of runc. We do not plan to make
any new releases of the 1.0.y release series of runc, so users are strongly
encouraged to update to 1.1.0.

Changed:

  • libcontainer will now refuse to build without the nsenter package being
    correctly compiled (specifically this requires CGO to be enabled). This
    should avoid folks accidentally creating broken runc binaries (and
    incorrectly importing our internal libraries into their projects). (#3331)

Static Linking Notices

The runc binary distributed with this release are statically linked with
the following GNU LGPL-2.1 licensed libraries, with runc acting
as a "work that uses the Library":

The versions of these libraries were not modified from their upstream versions,
but in order to comply with the LGPL-2.1 (§6(a)), we have attached the
complete source code for those libraries which (when combined with the attached
runc source code) may be used to exercise your rights under the LGPL-2.1.

However we strongly suggest that you make use of your distribution's packages
or download them from the authoritative upstream sources, especially since
these libraries are related to the security of your containers.

Thanks to the following people who made this release possible:

Signed-off-by: Aleksa Sarai [email protected]

Assets 19
Loading

runc 1.1-rc1 -- "He who controls the spice controls the universe."

14 Dec 04:28
@cyphar cyphar
v1.1.0-rc.1
This tag was signed with the committer’s verified signature. The key has been revoked.
cyphar Aleksa Sarai
GPG key ID: 9D94B96321B9D012
Revoked
Learn about vigilant mode.
55df1fc
This commit was signed with the committer’s verified signature. The key has been revoked.
cyphar Aleksa Sarai
GPG key ID: 9D94B96321B9D012
Revoked
Learn about vigilant mode.
Compare
Choose a tag to compare
runc 1.1-rc1 -- "He who controls the spice controls the universe." Pre-release
Pre-release

This release is the first release candidate for the next minor release
following runc 1.0. It contains all of the bugfixes included in runc 1.0
patch releases (up to and including 1.0.3).

A fair few new features have been added, and several features have been
deprecated (with plans for removal in runc 1.2). At the moment we only
plan to do a single release candidate for runc 1.1, and once 1.1.0 is
released we will not continue updating the 1.0.z runc branch.

Deprecated:

  • runc run/start now warns if a new container cgroup is non-empty or frozen;
    this warning will become an error in runc 1.2. (#3132, #3223)
  • runc can only be built with Go 1.16 or later from this release onwards.
    (#3100, #3245)

Removed:

  • cgroup.GetHugePageSizes has been removed entirely, and been replaced with
    cgroup.HugePageSizes which is more efficient. (#3234)
  • intelrdt.GetIntelRdtPath has been removed. Users who were using this
    function to get the intelrdt root should use the new intelrdt.Root
    instead. (#2920, #3239)

Added:

  • Add support for RDMA cgroup added in Linux 4.11. (#2883)
  • runc exec now produces exit code of 255 when the exec failed.
    This may help in distinguishing between runc exec failures
    (such as invalid options, non-running container or non-existent
    binary etc.) and failures of the command being executed. (#3073)
  • runc run: new --keep option to skip removal exited containers artefacts.
    This might be useful to check the state (e.g. of cgroup controllers) after
    the container has exited. (#2817, #2825)
  • seccomp: add support for SCMP_ACT_KILL_PROCESS and SCMP_ACT_KILL_THREAD
    (the latter is just an alias for SCMP_ACT_KILL). (#3204)
  • seccomp: add support for SCMP_ACT_NOTIFY (seccomp actions). This allows
    users to create sophisticated seccomp filters where syscalls can be
    efficiently emulated by privileged processes on the host. (#2682)
  • checkpoint/restore: add an option (--lsm-mount-context) to set
    a different LSM mount context on restore. (#3068)
  • runc releases are now cross-compiled for several architectures. Static
    builds for said architectures will be available for all future releases.
    (#3197)
  • intelrdt: support ClosID parameter. (#2920)
  • runc exec --cgroup: an option to specify a (non-top) in-container cgroup
    to use for the process being executed. (#3040, #3059)
  • cgroup v1 controllers now support hybrid hierarchy (i.e. when on a cgroup v1
    machine a cgroup2 filesystem is mounted to /sys/fs/cgroup/unified, runc
    run/exec now adds the container to the appropriate cgroup under it). (#2087,
    #3059)
  • sysctl: allow slashes in sysctl names, to better match sysctl(8)'s
    behaviour. (#3254, #3257)
  • mounts: add support for bind-mounts which are inaccessible after switching
    the user namespace. Note that this does not permit the container any
    additional access to the host filesystem, it simply allows containers to
    have bind-mounts configured for paths the user can access but have
    restrictive access control settings for other users. (#2576)
  • Add support for recursive mount attributes using mount_setattr(2). These
    have the same names as the proposed mount(8) options -- just prepend r
    to the option name (such as rro). (#3272)
  • Add runc features subcommand to allow runc users to detect what features
    runc has been built with. This includes critical information such as
    supported mount flags, hook names, and so on. Note that the output of this
    command is subject to change and will not be considered stable until runc
    1.2 at the earliest. The runtime-spec specification for this feature is
    being developed in opencontainers/runtime-spec#1130. (#3296)

Changed:

  • system: improve performance of /proc/$pid/stat parsing. (#2696)
  • cgroup2: when /sys/fs/cgroup is configured as a read-write mount, change
    the ownership of certain cgroup control files (as per
    /sys/kernel/cgroup/delegate) to allow for proper deferral to the container
    process. (#3057)
  • docs: series of improvements to man pages to make them easier to read and
    use. (#3032)

Libcontainer API:

  • internal api: remove internal error types and handling system, switch to Go
    wrapped errors. (#3033)
  • New configs.Cgroup structure fields (#3177):
    • Systemd (whether to use systemd cgroup manager); and
    • Rootless (whether to use rootless cgroups).
  • New cgroups/manager package aiming to simplify cgroup manager instantiation.
    (#3177)
  • All cgroup managers' instantiation methods now initialize cgroup paths and
    can return errors. This allows to use any cgroup manager method (e.g.
    Exists, Destroy, Set, GetStats) right after instantiation, which was not
    possible before (as paths were initialized in Apply only). (#3178)

Fixed:

  • nsenter: do not try to close already-closed fds during container setup and
    bail on close(2) failures. (#3058)
  • runc checkpoint/restore: fixed for containers with an external bind mount
    which destination is a symlink. (#3047).
  • cgroup: improve openat2 handling for cgroup directory handle hardening.
    (#3030)
  • runc delete -f now succeeds (rather than timing out) on a paused
    container. (#3134)
  • runc run/start/exec now refuses a frozen cgroup (paused container in case of
    exec). Users can disable this using --ignore-paused. (#3132, #3223)
  • config: do not permit null bytes in mount fields. (#3287)

Static Linking Notices

The runc binary distributed with this release are statically linked with
the following GNU LGPL-2.1 licensed libraries, with runc acting
as a "work that uses the Library":

The versions of these libraries were not modified from their upstream versions,
but in order to comply with the LGPL-2.1 (§6(a)), we have attached the
complete source code for those libraries which (when combined with the attached
runc source code) may be used to exercise your rights under the LGPL-2.1.

However we strongly suggest that you make use of your distribution's packages
or download them from the authoritative upstream sources, especially since
these libraries are related to the security of your containers.

Thanks to the following people who made this release possible:

Signed-off-by: Aleksa Sarai [email protected]

Assets 19
Loading

runc 1.0.3 -- "If you were waiting for the opportune moment, that was it."

06 Dec 04:31
@cyphar cyphar
v1.0.3
This tag was signed with the committer’s verified signature. The key has been revoked.
cyphar Aleksa Sarai
GPG key ID: 9D94B96321B9D012
Revoked
Learn about vigilant mode.
f46b6ba
This commit was signed with the committer’s verified signature. The key has been revoked.
cyphar Aleksa Sarai
GPG key ID: 9D94B96321B9D012
Revoked
Learn about vigilant mode.
Compare
Choose a tag to compare
runc 1.0.3 -- "If you were waiting for the opportune moment, that was it."

This is the third stable release in the 1.0 branch, fixing a handful of medium
priority issues related to mounts and cgroups, as well as a potential security
vulnerability.

This release is expected to be the last point release in the 1.0 branch, as we
are planning to release runc 1.1 in the near future.

Security:

  • A potential vulnerability was discovered in runc (related to an internal
    usage of netlink), however upon further investigation we discovered that
    while this bug was exploitable on the master branch of runc, no released
    version of runc could be exploited using this bug. The exploit required
    being able to create a netlink attribute with a length that would overflow a
    uint16 but this was not possible in any released version of runc. For more
    information, see GHSA-v95c-p5hm-xq8f and CVE-2021-43784.

    Due to an abundance of caution we decided to do an emergency release with
    this fix, but to reiterate we do not believe this vulnerability was
    possible to exploit    . Thanks to Felix Wilhelm from Google Project Zero for
    discovering and reporting this vulnerability so quickly.

Bugfixes:

  • Fixed inability to start a container with read-write bind mount of a
    read-only fuse host mount (#3292)
  • Fixed inability to start when read-only /dev in set in spec (#3277)
  • Fixed not removing sub-cgroups upon container delete, when rootless cgroup v2
    is used with older systemd (#3297)
  • Fixed returning error from GetStats when hugetlb is unsupported (which causes
    excessive logging for kubernetes) (#3295)
  • [CI only] Fixed criu 3.16 compatibility issue (#3282)
  • [CI only] Add Go 1.17 to the testing matrix (#3299)

Enhancements:

  • Improved an error message when dbus-user-session is not installed and
    rootless + cgroup2 + systemd are used (#3212)

Static Linking Notices

The runc binary distributed with this release are statically linked with
the following GNU LGPL-2.1 licensed libraries, with runc acting
as a "work that uses the Library":

The versions of these libraries were not modified from their upstream versions,
but in order to comply with the LGPL-2.1 (§6(a)), we have attached the
complete source code for those libraries which (when combined with the attached
runc source code) may be used to exercise your rights under the LGPL-2.1.

However we strongly suggest that you make use of your distribution's packages
or download them from the authoritative upstream sources, especially since
these libraries are related to the security of your containers.

Thanks to all of the contributors who made this release possible:

Signed-off-by: Aleksa Sarai [email protected]

Assets 9
Loading

runc 1.0.2 -- "Given the right lever, you can move a planet."

23 Aug 08:11
@cyphar cyphar
v1.0.2
This tag was signed with the committer’s verified signature. The key has been revoked.
cyphar Aleksa Sarai
GPG key ID: 9D94B96321B9D012
Revoked
Learn about vigilant mode.
52b36a2
This commit was signed with the committer’s verified signature. The key has been revoked.
cyphar Aleksa Sarai
GPG key ID: 9D94B96321B9D012
Revoked
Learn about vigilant mode.
Compare
Choose a tag to compare
runc 1.0.2 -- "Given the right lever, you can move a planet."

This is the second stable release in the 1.0 branch, fixing a few medium and high
priority issues, including one that affect Kubernetes using runc's libcontainer.

Bugfixes:

  • Fixed a failure to set CPU quota period in some cases on cgroup v1. (#3115)
  • Fixed the inability to start a container with the "adding seccomp filter
    rule for syscall ..." error, caused by redundant seccomp rules (i.e. those
    that has action equal to the default one). Such redundant rules are now
    skipped. (#3129)
  • Made release builds reproducible from now on. (#3142)
  • Fixed a rare debug log race in runc init, which can result in occasional
    harmful "failed to decode ..." errors from runc run or exec. (#3130)
  • Fixed the check in cgroup v1 systemd manager if a container needs to be
    frozen before Set, and add a setting to skip such freeze unconditionally.
    The previous fix for that issue, done in runc 1.0.1, was not working.
    (#3167)

Static Linking Notices

The runc binary distributed with this release are statically linked with
the following GNU LGPL-2.1 licensed libraries, with runc acting
as a "work that uses the Library":

The versions of these libraries were not modified from their upstream versions,
but in order to comply with the LGPL-2.1 (§6(a)), we have attached the
complete source code for those libraries which (when combined with the attached
runc source code) may be used to exercise your rights under the LGPL-2.1.

However we strongly suggest that you make use of your distribution's packages
or download them from the authoritative upstream sources, especially since
these libraries are related to the security of your containers.

Thanks to all of the contributors who made this release possible:

Signed-off-by: Aleksa Sarai [email protected]

Assets 9
Loading

runc 1.0.1 -- "If in doubt, Meriadoc, always follow your nose."

16 Jul 15:02
@cyphar cyphar
v1.0.1
This tag was signed with the committer’s verified signature. The key has been revoked.
cyphar Aleksa Sarai
GPG key ID: 9D94B96321B9D012
Revoked
Learn about vigilant mode.
4144b63
This commit was signed with the committer’s verified signature. The key has been revoked.
cyphar Aleksa Sarai
GPG key ID: 9D94B96321B9D012
Revoked
Learn about vigilant mode.
Compare
Choose a tag to compare
runc 1.0.1 -- "If in doubt, Meriadoc, always follow your nose."

This is the first stable release in the 1.0 branch, fixing a few medium
and high priority issues with runc 1.0.0, including a few that affect
Kubernetes' usage of libcontainer.

Bugfixes:

  • Fixed occasional runc exec/run failure ("interrupted system call") on an
    Azure volume. (#3074)
  • Fixed "unable to find groups ... token too long" error with /etc/group
    containing lines longer than 64K characters. (#3079)
  • cgroup/systemd/v1: fix leaving cgroup frozen after Set if a parent cgroup is
    frozen. This is a regression in 1.0.0, not affecting runc itself but some
    of libcontainer users (e.g Kubernetes). (#3085)
  • cgroupv2: bpf: Ignore inaccessible existing programs in case of
    permission error when handling replacement of existing bpf cgroup
    programs. This fixes a regression in 1.0.0, where some SELinux
    policies would block runc from being able to run entirely. (#3087)
  • cgroup/systemd/v2: don't freeze cgroup on Set. (#3092)
  • cgroup/systemd/v1: avoid unnecessary freeze on Set. (#3093)

Static Linking Notices

The runc binary distributed with this release are statically linked with
the following GNU LGPL-2.1 licensed libraries, with runc acting
as a "work that uses the Library":

The versions of these libraries were not modified from their upstream versions,
but in order to comply with the LGPL-2.1 (§6(a)), we have attached the
complete source code for those libraries which (when combined with the attached
runc source code) may be used to exercise your rights under the LGPL-2.1.

However we strongly suggest that you make use of your distribution's packages
or download them from the authoritative upstream sources, especially since
these libraries are related to the security of your containers.

Thanks to all of the contributors who made this release possible:

Signed-off-by: Aleksa Sarai [email protected]

Assets 9
Loading

runc 1.0 -- "A wizard is never late, nor is he early, he arrives precisely when he means to."

22 Jun 06:09
@cyphar cyphar
v1.0.0
This tag was signed with the committer’s verified signature. The key has been revoked.
cyphar Aleksa Sarai
GPG key ID: 9D94B96321B9D012
Revoked
Learn about vigilant mode.
84113ee
This commit was signed with the committer’s verified signature. The key has been revoked.
cyphar Aleksa Sarai
GPG key ID: 9D94B96321B9D012
Revoked
Learn about vigilant mode.
Compare
Choose a tag to compare
runc 1.0 -- "A wizard is never late, nor is he early, he arrives precisely when he means to."

This release has quite a few last-minute bug-fixes and various correctness and
performance improvements (almost all of which are related to cgroup handling),
and is the first non-rc release of runc in 5 years (v1.0.0-rc1 was released in
2016). It's been a very long road, and we thank the many contributors and
maintainers that helped us get to this point (approximately 422 people in
total).

As runc follows Semantic Versioning, we will endeavor to not make any
breaking changes without bumping the major version number of runc.

However, it should be noted that Go API usage of runc's internal
implementation (libcontainer) is not covered by this policy -- for
historical reasons, this code was not moved into an "internal" package
(this feature did not exist in Go at the time) and because certain
projects currently depend on this, we have not yet moved this code into
an internal package. Despite this, we reserve the right to make breaking
changes in our Go APIs (though we will note such changes in our
changelog, and will try to avoid needless disruption if possible).

Breaking changes:

  • Removed libcontainer/configs.Device* identifiers (deprecated since rc94,
    use libcontainer/devices) (#2999)
  • Removed libcontainer/system.RunningInUserNS function (deprecated since
    rc94, use libcontainer/userns) (#2999)

Deprecations:

  • The usage of relative paths for mountpoints will now produce a warning
    (such configurations are outside of the spec, and in future runc will
    produce an error when given such configurations). (#2917, #3004)

Bugfixes:

  • cgroupv2: devices: rework the filter generation to produce consistent
    results with cgroupv1, and always clobber any existing eBPF
    program(s) to fix runc update and avoid leaking eBPF programs
    (resulting in errors when managing containers). (#2951)
  • cgroupv2: correctly convert "number of IOs" statistics in a
    cgroupv1-compatible way. (#2965, #2967, #2968, #2964)
  • cgroupv2: support larger than 32-bit IO statistics on 32-bit architectures.
  • cgroupv2: wait for freeze to finish before returning from the freezing
    code, optimize the method for checking whether a cgroup is frozen. (#2955)
  • cgroups/systemd: fixed "retry on dbus disconnect" logic introduced in rc94
  • cgroups/systemd: fixed returning "unit already exists" error from a systemd
    cgroup manager (regression in rc94) (#2997, #2996)

Improvements:

  • cgroupv2: support SkipDevices with systemd driver (#2958, #3019)
  • cgroup/systemd: return, not ignore, stop unit error from Destroy (#2946)
  • Fix all golangci-lint failures. (#2781, #2962)
  • Make "runc --version" output sane even when built with go get or
    otherwise outside of our build scripts. (#2962)
  • cgroups: set SkipDevices during runc update (so we don't modify
    cgroups at all during runc update). (#2994)
  • cgroup1: blkio: support BFQ weights. (#3010)
  • cgroupv2: set per-device io weights if BFQ IO scheduler is available.
    (#3022)

Static Linking Notices

The runc binary distributed with this release are statically linked with
the following GNU LGPL-2.1 licensed libraries, with runc acting
as a "work that uses the Library":

The versions of these libraries were not modified from their upstream versions,
but in order to comply with the LGPL-2.1 (§6(a)), we have attached the
complete source code for those libraries which (when combined with the attached
runc source code) may be used to exercise your rights under the LGPL-2.1.

However we strongly suggest that you make use of your distribution's packages
or download them from the authoritative upstream sources, especially since
these libraries are related to the security of your containers.

Thanks to the following people who made this release possible:

Vote: +5 -0 %2
Signed-off-by: Aleksa Sarai [email protected]

Assets 9
Loading

runc 1.0-rc95 -- "Just when I thought I was out, they pull me back in."

19 May 10:04
@cyphar cyphar
v1.0.0-rc95
This tag was signed with the committer’s verified signature. The key has been revoked.
cyphar Aleksa Sarai
GPG key ID: 9D94B96321B9D012
Revoked
Learn about vigilant mode.
b9ee9c6
This commit was signed with the committer’s verified signature. The key has been revoked.
cyphar Aleksa Sarai
GPG key ID: 9D94B96321B9D012
Revoked
Learn about vigilant mode.
Compare
Choose a tag to compare
runc 1.0-rc95 -- "Just when I thought I was out, they pull me back in."

This release of runc contains a fix for CVE-2021-30465, and users are
strongly recommended to update (especially if you are providing
semi-limited access to spawn containers to untrusted users).

Aside from this security fix, only a few other changes were made since
v1.0.0-rc94 (the only user-visible change was the addition of support
for defaultErrnoRet in seccomp profiles).

Static Linking Notices

The runc binary distributed with this release are statically linked with
the following GNU LGPL-2.1 licensed libraries, with runc acting
as a "work that uses the Library":

The versions of these libraries were not modified from their upstream versions,
but in order to comply with the LGPL-2.1 (§6(a)), we have attached the
complete source code for those libraries which (when combined with the attached
runc source code) may be used to exercise your rights under the LGPL-2.1.

However we strongly suggest that you make use of your distribution's packages
or download them from the authoritative upstream sources, especially since
these libraries are related to the security of your containers.

Thanks to the following people who made this release possible:

Due to the nature of this release, it didn't go through the normal
public release procedure. However, this break from procedure was agreed
upon on the security mailing list.

Signed-off-by: Aleksa Sarai [email protected]

Assets 9
Loading

runc 1.0-rc94 -- "Time is an illusion. Lunchtime doubly so."

10 May 14:43
@cyphar cyphar
v1.0.0-rc94
This tag was signed with the committer’s verified signature. The key has been revoked.
cyphar Aleksa Sarai
GPG key ID: 9D94B96321B9D012
Revoked
Learn about vigilant mode.
2c7861b
This commit was signed with the committer’s verified signature. The key has been revoked.
cyphar Aleksa Sarai
GPG key ID: 9D94B96321B9D012
Revoked
Learn about vigilant mode.
Compare
Choose a tag to compare
runc 1.0-rc94 -- "Time is an illusion. Lunchtime doubly so."

This release fixes several regressions found in v1.0.0-rc93. We
recommend users update as soon as possible. This release includes the
following notable changes:

Potentially breaking changes:

  • cgroupv1: kernel memory limits are now always ignored, as kmemcg has
    been effectively deprecated by the kernel. Users should make use of
    regular memory cgroup controls. (#2840)
  • libcontainer/cgroups: cgroup managers' Set now accept
    configs.Resources rather than configs.Cgroups (#2906)
  • libcontainer/cgroups/systemd: reconnect and retry in case dbus
    connection is closed (after dbus restart) (#2923)
  • libcontainer/cgroups/systemd: don't set limits in Apply (#2814)

Bugfixes:

  • seccomp: fix 32-bit compilation errors (regression in rc93, #2783)
  • cgroupv2: blkio weight value conversion fix (#2786)
  • runc init: fix a hang caused by deadlock in seccomp/ebpf loading code
    (regression in rc93, #2871)
  • runc start: fix "chdir to cwd: permission denied" for some setups
    (regression in rc93, #2894)
  • s390: fix broken terminal (regression in rc93, #2898)

Improvements:

  • runc start/exec: better diagnostics when container limits are too low
    (#2812)
  • runc start/exec: better cleanup after failed runc init (#2855)
  • cgroupv1: improve freezing chances (#2941, #2918, #2791)
  • cgroupv2: multiple GetStats improvements (#2816, #2873)
  • cgroupv2: fallback to setting io.weight if io.bfq.weight is not
    available (#2820)
  • capabilities: WARN, not ERROR, for unknown / unavailable capabilities
    (#2854)

Static Linking Notices

The runc binary distributed with this release are statically linked with
the following GNU LGPL-2.1 licensed libraries, with runc acting
as a "work that uses the Library":

The versions of these libraries were not modified from their upstream versions,
but in order to comply with the LGPL-2.1 (§6(a)), we have attached the
complete source code for those libraries which (when combined with the attached
runc source code) may be used to exercise your rights under the LGPL-2.1.

However we strongly suggest that you make use of your distribution's packages
or download them from the authoritative upstream sources, especially since
these libraries are related to the security of your containers.

Thanks to the following people who made this release possible:

Vote: +6 -0 !1
Signed-off-by: Aleksa Sarai [email protected]

Assets 9
Loading

runc 1.0-rc93 -- "I never could get the hang of Thursdays."

04 Feb 00:18
@cyphar cyphar
v1.0.0-rc93
This tag was signed with the committer’s verified signature. The key has been revoked.
cyphar Aleksa Sarai
GPG key ID: 9D94B96321B9D012
Revoked
Learn about vigilant mode.
12644e6
This commit was signed with the committer’s verified signature. The key has been revoked.
cyphar Aleksa Sarai
GPG key ID: 9D94B96321B9D012
Revoked
Learn about vigilant mode.
Compare
Choose a tag to compare
runc 1.0-rc93 -- "I never could get the hang of Thursdays."

This is the last feature-rich RC release and we are in a feature-freeze until
1.0. 1.0.0~rc94 will be released in a few weeks with minimal bug fixes only,
and 1.0.0 will be released soon afterwards.

  • runc's cgroupv2 support is no longer considered experimental. It is now
    believed to be fully ready for production deployments. In addition, runc's
    cgroup code has been improved:

    • The systemd cgroup driver has been improved to be more resilient and
      handle more systemd properties correctly.
    • We now make use of openat2(2) when possible to improve the security of
      cgroup operations (in future runc will be wholesale ported to libpathrs to
      get this protection in all codepaths).

  • runc's mountinfo parsing code has been reworked significantly, making
    container startup times significantly faster and less wasteful in general.

  • runc now has special handling for seccomp profiles to avoid making new
    syscalls unusable for glibc. This is done by installing a custom prefix to
    all seccomp filters which returns -ENOSYS for syscalls that are newer than
    any syscall in the profile (meaning they have a larger syscall number).

    This should not cause any regressions (because previously users would simply
    get -EPERM rather than -ENOSYS, and the rule applied above is the most
    conservative rule possible) but please report any regressions you find as a
    result of this change -- in particular, programs which have special fallback
    code that is only run in the case of -EPERM.

  • runc now supports the following new runtime-spec features:

    • The umask of a container can now be specified.
    • The new Linux 5.9 capabilities (CAP_PERFMON, CAP_BPF, and
      CAP_CHECKPOINT_RESTORE) are now supported.
    • The "unified" cgroup configuration option, which allows users to explicitly
      specify the limits based on the cgroup file names rather than abstracting
      them through OCI configuration. This is currently limited in scope to
      cgroupv2.

  • Various rootless containers improvements:

    • runc will no longer cause conflicts if a user specifies a custom device
      which conflicts with a user-configured device -- the user device takes
      precedence.
    • runc no longer panics if /sys/fs/cgroup is missing in rootless mode.

  • runc --root is now always treated as local to the current working directory.

  • The --no-pivot-root hardening was improved to handle nested mounts properly
    (please note that we still strongly recommend that users do not use
    --no-pivot-root -- it is still an insecure option).

  • A large number of code cleanliness and other various cleanups, including
    fairly large changes to our tests and CI to make them all run more
    efficiently.

For packagers the following changes have been made which will have impact on
your packaging of runc:

  • The "selinux" and "apparmor" buildtags have been removed, and now all runc
    builds will have SELinux and AppArmor support enabled. Note that "seccomp"
    is still optional (though we very highly recommend you enable it).

  • make install DESTDIR= now functions correctly.

Static Linking Notices

The runc binary distributed with this release are statically linked with
the following GNU LGPL-2.1 licensed libraries, with runc acting
as a "work that uses the Library":

The versions of these libraries were not modified from their upstream versions,
but in order to comply with the LGPL-2.1 (§6(a)), we have attached the
complete source code for those libraries which (when combined with the attached
runc source code) may be used to exercise your rights under the LGPL-2.1.

However we strongly suggest that you make use of your distribution's packages
or download them from the authoritative upstream sources, especially since
these libraries are related to the security of your containers.

Thanks to the following people who made this release possible:

Vote: +6 -0 #1
Signed-off-by: Aleksa Sarai [email protected]

Assets 9
Loading