mirror of
https://github.com/containerd/containerd.git
synced 2026-11-06 05:17:02 +00:00
Paweł Gronowski
9bacf37b79
This release includes 1 security fix following the security policy: - crypto/x509: mitigation for security concerns with a specific Certificate Authority We're blocking trust in a small set of intermediate certificates due to specific security concerns around their operation. Verify will now filter out chains which contain these intermediates, preventing them from being returned to the caller. We highly recommend immediately upgrading to this release. This is CVE-2026-111943 and Go issue https://go.dev/issue/82345. release notes: https://go.dev/doc/devel/release#go1.27.3 Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
VM scripts
The scripts in this directory run the containerd integration tests inside a
virtual machine (Fedora or an EL distribution, with SELinux Enforcing by
default). They are used by the integration-vm job in
.github/workflows/ci.yml, but do not depend on Lima
and can be used with other VM environments too.
Local usage with Lima
# Boot a plain VM. template:almalinux-8, -9, and -10 are tested too.
# --plain keeps the guest pristine (no guest agent, no mounts, no port forwards).
limactl start --plain --name=default --cpus=2 --memory=4 --disk=60 template:fedora-44
# Copy the source tree into the guest.
limactl cp -r . default:containerd
lima bash -c 'sudo mkdir -p /go/src/github.com/containerd && sudo mv ~/containerd /go/src/github.com/containerd/containerd'
export LIMA_WORKDIR=/go/src/github.com/containerd/containerd
# Provision the guest (packages, Go, runc, CNI plugins, cri-tools, containerd, ...).
lima sudo script/vm/provision.sh
# Run the test suites.
lima sudo script/vm/test-integration.sh
lima sudo CGROUP_DRIVER=systemd script/vm/test-cri-integration.sh
lima sudo CGROUP_DRIVER=systemd script/vm/test-cri.sh
# Clean up.
limactl delete -f default
Environment variables
provision.sh:GO_VERSION,RUNC_FLAVOR(runcorcrun),SELINUX(Enforcing,Permissive, orDisabled),INSTALL_PACKAGEStest-integration.sh:RUNC_FLAVORtest-cri-integration.sh:CGROUP_DRIVER(empty orsystemd),RUNC_FLAVORtest-cri.sh:CGROUP_DRIVER(empty orsystemd),REPORT_DIR