Commits on May 5, 2023

1. update runc binary to v1.1.6 …

   release notes: https://github.com/opencontainers/runc/releases/tag/v1.1.6
   full diff: opencontainers/runc@v1.1.5...v1.1.6
   
   This is the sixth patch release in the 1.1.z series of runc, which fixes
   a series of cgroup-related issues.
   
   Note that this release can no longer be built from sources using Go
   1.16. Using a latest maintained Go 1.20.x or Go 1.19.x release is
   recommended. Go 1.17 can still be used.
   
   - systemd cgroup v1 and v2 drivers were deliberately ignoring UnitExist error
     from systemd while trying to create a systemd unit, which in some scenarios
     may result in a container not being added to the proper systemd unit and
     cgroup.
   - systemd cgroup v2 driver was incorrectly translating cpuset range from spec's
     resources.cpu.cpus to systemd unit property (AllowedCPUs) in case of more
     than 8 CPUs, resulting in the wrong AllowedCPUs setting.
   - systemd cgroup v1 driver was prefixing container's cgroup path with the path
     of PID 1 cgroup, resulting in inability to place PID 1 in a non-root cgroup.
   - runc run/start may return "permission denied" error when starting a rootless
     container when the file to be executed does not have executable bit set for
     the user, not taking the CAP_DAC_OVERRIDE capability into account. This is
     a regression in runc 1.1.4, as well as in Go 1.20 and 1.20.1
   - cgroup v1 drivers are now aware of misc controller.
   
   Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
   (cherry picked from commit d0efca8)
   Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

   

   thaJeztah committed May 5, 2023
   Configuration menu

   • View commit details
   • Copy full SHA for 3f0402c
   • Browse repository at this point

   Copy the full SHA

   3f0402c View commit details

   Browse the repository at this point in the history

2. update runc binary to v1.1.7 …

   release notes: https://github.com/opencontainers/runc/releases/tag/v1.1.7
   full diff: opencontainers/runc@v1.1.6...v1.1.7
   
   This is the seventh patch release in the 1.1.z release of runc, and is
   the last planned release of the 1.1.z series. It contains a fix for
   cgroup device rules with systemd when handling device rules for devices
   that don't exist (though for devices whose drivers don't correctly
   register themselves in the kernel -- such as the NVIDIA devices -- the
   full fix only works with systemd v240+).
   
   - When used with systemd v240+, systemd cgroup drivers no longer skip
     DeviceAllow rules if the device does not exist (a regression introduced
     in runc 1.1.3). This fix also reverts the workaround added in runc 1.1.5,
     removing an extra warning emitted by runc run/start.
   - The source code now has a new file, runc.keyring, which contains the keys
     used to sign runc releases.
   
   Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
   (cherry picked from commit 2d0e899)
   Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

   

   thaJeztah committed May 5, 2023
   Configuration menu

   • View commit details
   • Copy full SHA for e73310d
   • Browse repository at this point

   Copy the full SHA

   e73310d View commit details

   Browse the repository at this point in the history