From 19675151a3d3b947501fcad1dcacbd00e6f4b23e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pawe=C5=82=20Gronowski?= Date: Wed, 5 Nov 2025 10:56:44 +0100 Subject: [PATCH] Dockerfile: update runc binary to v1.3.3 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Update the version used in CI and for the static binaries. - release notes: https://github.com/opencontainers/runc/releases/tag/v1.3.3 - full diff: https://github.com/opencontainers/runc/compare/v1.3.2...v1.3.3 This release contains fixes for three high-severity security vulnerabilities in runc (CVE-2025-31133, CVE-2025-52565, and CVE-2025-52881). All three vulnerabilities ultimately allow (through different methods) for full container breakouts by bypassing runc's restrictions for writing to arbitrary /proc files. Signed-off-by: Paweł Gronowski (cherry picked from commit 35f6a780829fca1d3ef49ff96a0b3031462faeed) Signed-off-by: Paweł Gronowski --- Dockerfile | 5 ++--- hack/dockerfile/install/runc.installer | 4 +--- 2 files changed, 3 insertions(+), 6 deletions(-) diff --git a/Dockerfile b/Dockerfile index 3cc88b5b03..9ac0ff880e 100644 --- a/Dockerfile +++ b/Dockerfile @@ -260,9 +260,8 @@ WORKDIR /usr/src/runc RUN git init . && git remote add origin "https://github.com/opencontainers/runc.git" # RUNC_VERSION should match the version that is used by the containerd version # that is used. If you need to update runc, open a pull request in the containerd -# project first, and update both after that is merged. When updating RUNC_VERSION, -# consider updating runc in vendor.mod accordingly. -ARG RUNC_VERSION=v1.3.0 +# project first, and update both after that is merged. +ARG RUNC_VERSION=v1.3.3 RUN git fetch -q --depth 1 origin "${RUNC_VERSION}" +refs/tags/*:refs/tags/* && git checkout -q FETCH_HEAD FROM base AS runc-build diff --git a/hack/dockerfile/install/runc.installer b/hack/dockerfile/install/runc.installer index 44eea006ea..01d54aa341 100755 --- a/hack/dockerfile/install/runc.installer +++ b/hack/dockerfile/install/runc.installer @@ -7,9 +7,7 @@ set -e # The version of runc should match the version that is used by the containerd # version that is used. If you need to update runc, open a pull request in # the containerd project first, and update both after that is merged. -# -# When updating RUNC_VERSION, consider updating runc in vendor.mod accordingly -: "${RUNC_VERSION:=v1.3.0}" +: "${RUNC_VERSION:=v1.3.3}" install_runc() { RUNC_BUILDTAGS="${RUNC_BUILDTAGS:-"seccomp"}"