From d3acc23a0c83bcb383d788c951dc2c57c0dc80d2 Mon Sep 17 00:00:00 2001 From: Sebastiaan van Stijn Date: Mon, 13 Nov 2023 16:01:02 +0100 Subject: [PATCH] update runc binary to v1.1.10 - full diff: https://github.com/opencontainers/runc/compare/v1.1.9...v1.1.10 - release notes: https://github.com/opencontainers/runc/releases/tag/v1.1.10 This is the tenth (and most likely final) patch release in the 1.1.z release branch of runc. It mainly fixes a few issues in cgroups, and a umask-related issue in tmpcopyup. - Add support for `hugetlb..rsvd` limiting and accounting. Fixes the issue of postgres failing when hugepage limits are set. - Fixed permissions of a newly created directories to not depend on the value of umask in tmpcopyup feature implementation. - libcontainer: cgroup v1 GetStats now ignores missing `kmem.limit_in_bytes` (fixes the compatibility with Linux kernel 6.1+). - Fix a semi-arbitrary cgroup write bug when given a malicious hugetlb configuration. This issue is not a security issue because it requires a malicious config.json, which is outside of our threat model. Signed-off-by: Sebastiaan van Stijn (cherry picked from commit 15bcc707e64d5c07949133adc411aa4e9e56b489) Signed-off-by: Sebastiaan van Stijn --- Dockerfile | 2 +- hack/dockerfile/install/runc.installer | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/Dockerfile b/Dockerfile index 98be0f2bc1..4be9d35091 100644 --- a/Dockerfile +++ b/Dockerfile @@ -279,7 +279,7 @@ RUN git init . && git remote add origin "https://github.com/opencontainers/runc. # that is used. If you need to update runc, open a pull request in the containerd # project first, and update both after that is merged. When updating RUNC_VERSION, # consider updating runc in vendor.mod accordingly. -ARG RUNC_VERSION=v1.1.9 +ARG RUNC_VERSION=v1.1.10 RUN git fetch -q --depth 1 origin "${RUNC_VERSION}" +refs/tags/*:refs/tags/* && git checkout -q FETCH_HEAD FROM base AS runc-build diff --git a/hack/dockerfile/install/runc.installer b/hack/dockerfile/install/runc.installer index 3ac1ddfbf5..82779c65eb 100755 --- a/hack/dockerfile/install/runc.installer +++ b/hack/dockerfile/install/runc.installer @@ -9,7 +9,7 @@ set -e # the containerd project first, and update both after that is merged. # # When updating RUNC_VERSION, consider updating runc in vendor.mod accordingly -: "${RUNC_VERSION:=v1.1.9}" +: "${RUNC_VERSION:=v1.1.10}" install_runc() { RUNC_BUILDTAGS="${RUNC_BUILDTAGS:-"seccomp"}"