From 97f79dbf591cc9c6d3a516bf4eb566ea65517be3 Mon Sep 17 00:00:00 2001 From: Aleksa Sarai Date: Thu, 26 Feb 2026 17:43:50 +1100 Subject: [PATCH] [1.4] README: document libpathrs build tag Ever since v0.6.0 of github.com/cyphar/filepath-securejoin, pathrs-lite has been able to transparently switch to using libpathrs as the backend for safe path resolution (at compile-time, using a build tag). Note that because build-tags apply globally, this allows for us to easily opt pure-Go dependencies into all using libpathrs as well for our binaries. In a future patch this will likely be enabled by default, but document that this is an option for downstreams that want to opt-in to using libpathrs. Signed-off-by: Aleksa Sarai (cherry picked from commit ab6f75dd25571cbf89ebe05fe4100a24f53ce864) Signed-off-by: Aleksa Sarai --- README.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/README.md b/README.md index bca08c2d2..cf1df2369 100644 --- a/README.md +++ b/README.md @@ -112,6 +112,7 @@ make EXTRA_BUILDTAGS="runc_nocriu" | Build Tag | Feature | Enabled by Default | Dependencies | |---------------|---------------------------------------|--------------------|---------------------| | `seccomp` | Syscall filtering using `libseccomp`. | yes | `libseccomp` | +| `libpathrs` | Use [`libpathrs`][] for path safety. | no | [`libpathrs`][] | | `runc_nocriu` | **Disables** runc checkpoint/restore. | no | `criu` | The following build tags were used earlier, but are now obsoleted: @@ -120,6 +121,8 @@ The following build tags were used earlier, but are now obsoleted: - **apparmor** (since runc v1.0.0-rc93 the feature is always enabled) - **selinux** (since runc v1.0.0-rc93 the feature is always enabled) +[`libpathrs`]: https://github.com/cyphar/libpathrs + ### Running the test suite `runc` currently supports running its test suite via Docker.