Highlights
- Set SystemTemp environment variable on Windows so temp directory overrides work for SYSTEM services
Container Runtime Interface (CRI)
- Fix nil pointer dereference in NRI GetIPs during pod sandbox teardown or container exit
- Reject CreateContainer calls when the target sandbox is not running
- Ensure sandbox shutdown on RunPodSandbox hook failures to avoid mount leaks
Image Distribution
- Surface OCI error bodies in registry 403 responses by falling back to GET requests
Snapshotters
- Align default 4K mkfs block size for EROFS across all platforms
release notes: https://github.com/containerd/containerd/releases/tag/v2.3.3
full diff: https://github.com/containerd/containerd/compare/v2.3.2...v2.3.3
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This is the sixth patch release of the 1.3.z series of runc. Among some
performance improvements and bugfixes, it includes a fix for a low-severity
vulnerability ([CVE-2026-41579]) and users are encouraged to update. As it was
a low-severity vulnerability and it was reported by multiple people, we decided
to release it publicly with NO EMBARGO.
Security
This release includes a fix for the following low-severity security issue:
- CVE-2026-41579 allowed a malicious image with a /dev symlink to have
limited write access to the host filesystem in ways that our analysis
indicates was too limited to be problematic in practice. This bug was very
similar to those fixed in CVE-2025-31133, CVE-2025-52565, CVE-2025-31133
and was simply missed at the time when we hardened the rootfs preparation
code. We have conducted a deeper audit and not found any other problematic
cases.
Fixed
- A regression in runc v1.3.0 which can result in a stuck runc exec or
runc run when the container process runs for a short time.
- Various integration test improvements.
Changed
- When masking directories with maskPaths, runc will now re-use a single
tmpfs instance (which is not writable) to reduce the number tmpfs
superblocks that need to be reaped when containers die (in particular,
Kubernetes applies masks to per-CPU sysfs directories which get expensive
quickly).
[CVE-2026-41579]: https://github.com/opencontainers/runc/security/advisories/GHSA-xjvp-4fhw-gc47
full diff: https://github.com/opencontainers/runc/compare/v1.3.5...v1.3.6
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
containerd v2.2.3:
- Fix TOCTOU race bug in tar extraction
- fix(oci): handle absolute symlinks in rootfs user lookup
- fix(oci): apply absolute symlink resolution to /etc/group
- Preserve host cgroup mount options for privileged containers
- update github.com/moby/spdystream v0.5.1 to fix [CVE-2026-35469] / GHSA-pc3f-x583-g7j2
- update runhcs to v0.14.1 to fix Windows containers when running with process
isolation on Docker;
- shim: skip SandboxPlatform validation when platform is not explicitly set
- WCOW: restore support for client-mounted roots
full diff: https://github.com/containerd/containerd/compare/v2.2.2...v2.2.3
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Prior to this commit, the binaries of `runc`, `containerd`, `rootlesskit`, etc.
were overwritten by ones from the `docker-engine` stage.
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
Introduce a new entrypoint script for the Linux image that, if cgroup v2
is in use, creates a new cgroup and mount namespace for buildkitd within
a new entrypoint using `unshare` and remounts `/sys/fs/cgroup` to
restrict its view of the unified cgroup hierarchy. This will ensure its
`init` cgroup and all OCI worker managed cgroups are kept beneath the
root cgroup of the initial entrypoint process.
When buildkitd is run in a managed environment like Kubernetes without
its own cgroup namespace (the default behavior of privileged pods in
Kubernetes where cgroup v2 is in use; see [cgroup v2 KEP][kep]), the OCI
worker will spawn processes in cgroups that are outside of the cgroup
hierarchy that was created for the buildkitd container, leading to
incorrect resource accounting and enforcement which in turn can cause
OOM errors and CPU contention on the node.
Example behavior without this change:
```console
root@k8s-node:/# cat /proc/$(pgrep -n buildkitd)/cgroup
0::/init
root@k8s-node:/# cat /proc/$(pgrep -n some-build-process)/cgroup
0::/buildkit/{runc-container-id}
```
Example behavior with this change:
```console
root@k8s-node:/# cat /proc/$(pgrep -n buildkitd)/cgroup
0::/kubepods/burstable/pod{pod-id}/{container-id}/init
root@k8s-node:/# cat /proc/$(pgrep -n some-build-process)/cgroup
0::/kubepods/burstable/pod{pod-id}/{container-id}/buildkit/{runc-container-id}
```
Note this was developed as an alternative approach to moby/buildkit#6343
[kep]: 6d3210f7dd/keps/sig-node/2254-cgroup-v2 (cgroup-namespace)
Signed-off-by: Dan Duvall <dduvall@wikimedia.org>
Make it easier to reuse Docker tooling in dev container.
None of the scripts/tests depend on these being in the dev stage.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
The repository was renamed to https://github.com/dragonflyoss/nydus,
and while GitHub does provide redirects, their services have been
a bit flaky recently so sometimes the redirects would fail.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
