Add the grpcnotrace build tag to exclude gRPC's tracing integration.
This reduces the size of buildctl by ~492 KiB (1.51%).
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This is the second patch release in the 1.5.z release series of runc,
which primarily includes a workaround for a Linux kernel bug causing
random runc crashes when using cgroup v2, and other fixes.
Fixed
- `runc exec -p` with a `process.json` lacking env now sets HOME again (a regression in runc 1.3.0).
- Worked around a Linux kernel bug (present since kernel v6.17, fixed in v7.2)
which caused the kernel to write past the end of the structure
provided by userspace (runc). This resulted in memory corruption inside runc
(manifesting as random crashes) when configuring device rules on cgroup v2
systems.
- `runc exec --cgroup` (and the equivalent libcontainer `Process.SubCgroupPaths`
API) no longer accepts a sub-cgroup path that escapes the container's cgroup
into a sibling cgroup sharing the same name prefix. Note that using
`--cgroup` requires the same privileges as running runc exec itself, so
this is a correctness rather than a security fix.
- Fixed a missing `O_CLOEXEC` when opening the cgroup v2 directory to set up
device rules.
- Some long-standing file-descriptor leaks on the eBPF devices cgroups were
fixed.
- When rootfsPropagation is set to `rslave`, the rootfs parent mount is no
longer made private before pivoting into the rootfs, so unmount/remount
events on host mountpoints under the rootfs are now propagated to the
running container.
- runc no longer misdetects a non-initial user namespace as the initial one
when that namespace has a full identity ID mapping (0 0 4294967295), as
used by systemd >= 260 units with `PrivateUsers=full`. Previously this made
runc skip its user namespace code paths, so starting a container in such a
unit failed with `bpf_prog_query(BPF_CGROUP_DEVICE) failed: operation not permitted`.
- Fixed a runc init panic (`SIGABRT`) on the error path, caused by SELinux
labels being reset after the cached libpathrs procfs handle was already
closed. This is fixed both by not resetting the labels on the init error
path, and by updating to libpathrs v0.2.6, which now handles a closed
procfs handle gracefully.
- Fixed various issues when the libseccomp version runc is run with differs
from the one it was compiled against (e.g. built with libseccomp >= 2.6.0 and
run with an older one), by updating to libseccomp-golang v0.12.0. This also
supersedes the `SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV` workaround added in
runc 1.5.1.
- The libseccomp library statically linked into release binaries is now built
with optimizations enabled (the default `-g -O2 CFLAGS`); previously it was
built unoptimized.
Changed
- Switched to opencontainers/cgroups v0.1.0, which no longer uses the
high-level cilium/ebpf API to manage cgroup v2 device rules. As a result,
the runc binary shrunk by about 1 MiB (7.5%) on amd64. This also means runc
no longer calls the cilium/ebpf code affected by GO-2026-6238.
- Updated golang.org/x/net to v0.55.0.
- Updated builds to libseccomp v2.6.1.
release-notes: https://github.com/opencontainers/runc/releases/tag/v1.5.2
full diff: https://github.com/opencontainers/runc/releases/compare/v1.5.1...v1.5.2
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Highlights
- Set SystemTemp environment variable on Windows so temp directory overrides work for SYSTEM services
Container Runtime Interface (CRI)
- Fix nil pointer dereference in NRI GetIPs during pod sandbox teardown or container exit
- Reject CreateContainer calls when the target sandbox is not running
- Ensure sandbox shutdown on RunPodSandbox hook failures to avoid mount leaks
Image Distribution
- Surface OCI error bodies in registry 403 responses by falling back to GET requests
Snapshotters
- Align default 4K mkfs block size for EROFS across all platforms
release notes: https://github.com/containerd/containerd/releases/tag/v2.3.3
full diff: https://github.com/containerd/containerd/compare/v2.3.2...v2.3.3
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This is the sixth patch release of the 1.3.z series of runc. Among some
performance improvements and bugfixes, it includes a fix for a low-severity
vulnerability ([CVE-2026-41579]) and users are encouraged to update. As it was
a low-severity vulnerability and it was reported by multiple people, we decided
to release it publicly with NO EMBARGO.
Security
This release includes a fix for the following low-severity security issue:
- CVE-2026-41579 allowed a malicious image with a /dev symlink to have
limited write access to the host filesystem in ways that our analysis
indicates was too limited to be problematic in practice. This bug was very
similar to those fixed in CVE-2025-31133, CVE-2025-52565, CVE-2025-31133
and was simply missed at the time when we hardened the rootfs preparation
code. We have conducted a deeper audit and not found any other problematic
cases.
Fixed
- A regression in runc v1.3.0 which can result in a stuck runc exec or
runc run when the container process runs for a short time.
- Various integration test improvements.
Changed
- When masking directories with maskPaths, runc will now re-use a single
tmpfs instance (which is not writable) to reduce the number tmpfs
superblocks that need to be reaped when containers die (in particular,
Kubernetes applies masks to per-CPU sysfs directories which get expensive
quickly).
[CVE-2026-41579]: https://github.com/opencontainers/runc/security/advisories/GHSA-xjvp-4fhw-gc47
full diff: https://github.com/opencontainers/runc/compare/v1.3.5...v1.3.6
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
containerd v2.2.3:
- Fix TOCTOU race bug in tar extraction
- fix(oci): handle absolute symlinks in rootfs user lookup
- fix(oci): apply absolute symlink resolution to /etc/group
- Preserve host cgroup mount options for privileged containers
- update github.com/moby/spdystream v0.5.1 to fix [CVE-2026-35469] / GHSA-pc3f-x583-g7j2
- update runhcs to v0.14.1 to fix Windows containers when running with process
isolation on Docker;
- shim: skip SandboxPlatform validation when platform is not explicitly set
- WCOW: restore support for client-mounted roots
full diff: https://github.com/containerd/containerd/compare/v2.2.2...v2.2.3
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Prior to this commit, the binaries of `runc`, `containerd`, `rootlesskit`, etc.
were overwritten by ones from the `docker-engine` stage.
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
Sebastiaan van Stijn