From 3f0402cb68d293c849c8ebe45cb4e19bbf3c6cd9 Mon Sep 17 00:00:00 2001 From: Sebastiaan van Stijn Date: Thu, 13 Apr 2023 19:43:05 +0200 Subject: [PATCH 1/2] update runc binary to v1.1.6 release notes: https://github.com/opencontainers/runc/releases/tag/v1.1.6 full diff: https://github.com/opencontainers/runc/compare/v1.1.5...v1.1.6 This is the sixth patch release in the 1.1.z series of runc, which fixes a series of cgroup-related issues. Note that this release can no longer be built from sources using Go 1.16. Using a latest maintained Go 1.20.x or Go 1.19.x release is recommended. Go 1.17 can still be used. - systemd cgroup v1 and v2 drivers were deliberately ignoring UnitExist error from systemd while trying to create a systemd unit, which in some scenarios may result in a container not being added to the proper systemd unit and cgroup. - systemd cgroup v2 driver was incorrectly translating cpuset range from spec's resources.cpu.cpus to systemd unit property (AllowedCPUs) in case of more than 8 CPUs, resulting in the wrong AllowedCPUs setting. - systemd cgroup v1 driver was prefixing container's cgroup path with the path of PID 1 cgroup, resulting in inability to place PID 1 in a non-root cgroup. - runc run/start may return "permission denied" error when starting a rootless container when the file to be executed does not have executable bit set for the user, not taking the CAP_DAC_OVERRIDE capability into account. This is a regression in runc 1.1.4, as well as in Go 1.20 and 1.20.1 - cgroup v1 drivers are now aware of misc controller. Signed-off-by: Sebastiaan van Stijn (cherry picked from commit d0efca893b9ddb6864f1408f55b898441cbd7ec3) Signed-off-by: Sebastiaan van Stijn --- Dockerfile | 2 +- hack/dockerfile/install/runc.installer | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/Dockerfile b/Dockerfile index 30d9caa5e1625..60c4b0f7de50a 100644 --- a/Dockerfile +++ b/Dockerfile @@ -280,7 +280,7 @@ RUN git init . && git remote add origin "https://github.com/opencontainers/runc. # that is used. If you need to update runc, open a pull request in the containerd # project first, and update both after that is merged. When updating RUNC_VERSION, # consider updating runc in vendor.mod accordingly. -ARG RUNC_VERSION=v1.1.5 +ARG RUNC_VERSION=v1.1.6 RUN git fetch -q --depth 1 origin "${RUNC_VERSION}" +refs/tags/*:refs/tags/* && git checkout -q FETCH_HEAD FROM base AS runc-build diff --git a/hack/dockerfile/install/runc.installer b/hack/dockerfile/install/runc.installer index 277a9688960b7..71ff4e5b7c847 100755 --- a/hack/dockerfile/install/runc.installer +++ b/hack/dockerfile/install/runc.installer @@ -9,7 +9,7 @@ set -e # the containerd project first, and update both after that is merged. # # When updating RUNC_VERSION, consider updating runc in vendor.mod accordingly -: "${RUNC_VERSION:=v1.1.5}" +: "${RUNC_VERSION:=v1.1.6}" install_runc() { RUNC_BUILDTAGS="${RUNC_BUILDTAGS:-"seccomp"}" From e73310d8c91d17ea9f54eb4a9d903176a2abde23 Mon Sep 17 00:00:00 2001 From: Sebastiaan van Stijn Date: Thu, 27 Apr 2023 12:17:14 +0200 Subject: [PATCH 2/2] update runc binary to v1.1.7 release notes: https://github.com/opencontainers/runc/releases/tag/v1.1.7 full diff: https://github.com/opencontainers/runc/compare/v1.1.6...v1.1.7 This is the seventh patch release in the 1.1.z release of runc, and is the last planned release of the 1.1.z series. It contains a fix for cgroup device rules with systemd when handling device rules for devices that don't exist (though for devices whose drivers don't correctly register themselves in the kernel -- such as the NVIDIA devices -- the full fix only works with systemd v240+). - When used with systemd v240+, systemd cgroup drivers no longer skip DeviceAllow rules if the device does not exist (a regression introduced in runc 1.1.3). This fix also reverts the workaround added in runc 1.1.5, removing an extra warning emitted by runc run/start. - The source code now has a new file, runc.keyring, which contains the keys used to sign runc releases. Signed-off-by: Sebastiaan van Stijn (cherry picked from commit 2d0e899819089e910be5e60953deaae0eb9f272d) Signed-off-by: Sebastiaan van Stijn --- Dockerfile | 2 +- hack/dockerfile/install/runc.installer | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/Dockerfile b/Dockerfile index 60c4b0f7de50a..f19829343cffb 100644 --- a/Dockerfile +++ b/Dockerfile @@ -280,7 +280,7 @@ RUN git init . && git remote add origin "https://github.com/opencontainers/runc. # that is used. If you need to update runc, open a pull request in the containerd # project first, and update both after that is merged. When updating RUNC_VERSION, # consider updating runc in vendor.mod accordingly. -ARG RUNC_VERSION=v1.1.6 +ARG RUNC_VERSION=v1.1.7 RUN git fetch -q --depth 1 origin "${RUNC_VERSION}" +refs/tags/*:refs/tags/* && git checkout -q FETCH_HEAD FROM base AS runc-build diff --git a/hack/dockerfile/install/runc.installer b/hack/dockerfile/install/runc.installer index 71ff4e5b7c847..a58846c06f39e 100755 --- a/hack/dockerfile/install/runc.installer +++ b/hack/dockerfile/install/runc.installer @@ -9,7 +9,7 @@ set -e # the containerd project first, and update both after that is merged. # # When updating RUNC_VERSION, consider updating runc in vendor.mod accordingly -: "${RUNC_VERSION:=v1.1.6}" +: "${RUNC_VERSION:=v1.1.7}" install_runc() { RUNC_BUILDTAGS="${RUNC_BUILDTAGS:-"seccomp"}"