mirror/runc
1
0
Fork 0
mirror of https://github.com/opencontainers/runc.git synced 2026-07-11 06:03:57 +08:00
Code Issues Packages Projects Releases Wiki Activity

CHANGELOG.md: forward-port 1.1.x changes

Browse Source 
This is a forward-port of commit 91fa032da4 ("ci: add basic checks for
CHANGELOG.md"), plus whatever changes were made in release-1.1 branch
(up to v1.1.3).

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
This commit is contained in:
Kir Kolyshkin
2022-07-01 15:49:57 -07:00
parent eca233d286
commit d2a5acd22a
3 changed files with 89 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CHANGELOG.md
+76 -8
View File
@@ -1,4 +1,4 @@
# Changelog/
# Changelog
This file documents all notable changes made to this project since runc 1.0.
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
@@ -27,6 +27,70 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
support would return `-EPERM` despite the existence of the `-ENOSYS` stub
code (this was due to how s390x does syscall multiplexing). (#3474)
## [1.1.3] - 2022-06-09
> In the beginning there was nothing, which exploded.
### Fixed
* Our seccomp `-ENOSYS` stub now correctly handles multiplexed syscalls on
s390 and s390x. This solves the issue where syscalls the host kernel did not
support would return `-EPERM` despite the existence of the `-ENOSYS` stub
code (this was due to how s390x does syscall multiplexing). (#3478)
* Retry on dbus disconnect logic in libcontainer/cgroups/systemd now works as
intended; this fix does not affect runc binary itself but is important for
libcontainer users such as Kubernetes. (#3476)
* Inability to compile with recent clang due to an issue with duplicate
constants in libseccomp-golang. (#3477)
* When using systemd cgroup driver, skip adding device paths that don't exist,
to stop systemd from emitting warnings about those paths. (#3504)
* Socket activation was failing when more than 3 sockets were used. (#3494)
* Various CI fixes. (#3472, #3479)
### Added
* Allow to bind mount /proc/sys/kernel/ns_last_pid to inside container. (#3493)
### Changed
* runc static binaries are now linked against libseccomp v2.5.4. (#3481)
## [1.1.2] - 2022-05-11
> I should think I'm going to be a perpetual student.
### Security
* A bug was found in runc where runc exec --cap executed processes with
non-empty inheritable Linux process capabilities, creating an atypical Linux
environment. For more information, see [GHSA-f3fp-gc8g-vw66][] and
CVE-2022-29162.
### Changed
* `runc spec` no longer sets any inheritable capabilities in the created
example OCI spec (`config.json`) file.
[GHSA-f3fp-gc8g-vw66]: https://github.com/opencontainers/runc/security/advisories/GHSA-f3fp-gc8g-vw66
## [1.1.1] - 2022-03-28
> Violence is the last refuge of the incompetent.
### Added
* CI is now also run on centos-stream-9. (#3436)
### Fixed
* `runc run/start` can now run a container with read-only `/dev` in OCI spec,
rather than error out. (#3355)
* `runc exec` now ensures that `--cgroup` argument is a sub-cgroup. (#3403)
* libcontainer systemd v2 manager no longer errors out if one of the files
listed in `/sys/kernel/cgroup/delegate` do not exist in container's cgroup.
(#3387, #3404)
* Loose OCI spec validation to avoid bogus "Intel RDT is not supported" error.
(#3406)
* libcontainer/cgroups no longer panics in cgroup v1 managers if `stat`
of `/sys/fs/cgroup/unified` returns an error other than ENOENT. (#3435)
## [1.1.0] - 2022-01-14
> A plan depends as much upon execution as it does upon concept.
@@ -37,6 +101,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
should avoid folks accidentally creating broken runc binaries (and
incorrectly importing our internal libraries into their projects). (#3331)
## [1.1.0-rc.1] - 2021-12-14
> He who controls the spice controls the universe.
@@ -62,7 +127,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
binary etc.) and failures of the command being executed. (#3073)
* runc run: new `--keep` option to skip removal exited containers artefacts.
This might be useful to check the state (e.g. of cgroup controllers) after
the container hasexited. (#2817, #2825)
the container has exited. (#2817, #2825)
* seccomp: add support for `SCMP_ACT_KILL_PROCESS` and `SCMP_ACT_KILL_THREAD`
(the latter is just an alias for `SCMP_ACT_KILL`). (#3204)
* seccomp: add support for `SCMP_ACT_NOTIFY` (seccomp actions). This allows
@@ -151,13 +216,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
### Fixed
* Fixed inability to start a container with read-write bind mount of a
read-only fuse host mount. (#3283, #3292)
* Fixed inability to start when read-only /dev in set in spec (#3276, #3277)
* Fixed inability to start when read-only /dev in set in spec. (#3276, #3277)
* Fixed not removing sub-cgroups upon container delete, when rootless cgroup v2
is used with older systemd. (#3226, #3297)
* Fixed returning error from GetStats when hugetlb is unsupported (which causes
excessive logging for Kubernetes). (#3233, #3295)
* Improved an error message when dbus-user-session is not installed and
rootless + cgroup2 + systemd are used (#3212)
rootless + cgroup2 + systemd are used. (#3212)
[GHSA-v95c-p5hm-xq8f]: https://github.com/opencontainers/runc/security/advisories/GHSA-v95c-p5hm-xq8f
@@ -237,7 +302,7 @@ implementation (libcontainer) is *not* covered by this policy.
code, optimize the method for checking whether a cgroup is frozen. (#2955)
* cgroups/systemd: fixed "retry on dbus disconnect" logic introduced in rc94
* cgroups/systemd: fixed returning "unit already exists" error from a systemd
cgroup manager (regression in rc94) (#2997, #2996)
cgroup manager (regression in rc94). (#2997, #2996)
### Added
* cgroupv2: support SkipDevices with systemd driver. (#2958, #3019)
@@ -246,7 +311,7 @@ implementation (libcontainer) is *not* covered by this policy.
(#3022)
### Changed
* cgroup/systemd: return, not ignore, stop unit error from Destroy (#2946)
* cgroup/systemd: return, not ignore, stop unit error from Destroy. (#2946)
* Fix all golangci-lint failures. (#2781, #2962)
* Make `runc --version` output sane even when built with `go get` or
otherwise outside of our build scripts. (#2962)
@@ -254,7 +319,7 @@ implementation (libcontainer) is *not* covered by this policy.
cgroups at all during `runc update`). (#2994)
<!-- minor releases -->
[Unreleased]: https://github.com/opencontainers/runc/compare/v1.1.0...HEAD
[Unreleased]: https://github.com/opencontainers/runc/compare/v1.1.3...HEAD
[1.1.0]: https://github.com/opencontainers/runc/compare/v1.1.0-rc.1...v1.1.0
[1.0.0]: https://github.com/opencontainers/runc/releases/tag/v1.0.0
@@ -265,5 +330,8 @@ implementation (libcontainer) is *not* covered by this policy.
[1.0.1]: https://github.com/opencontainers/runc/compare/v1.0.0...v1.0.1
<!-- 1.1.z patch releases -->
[Unreleased 1.1.z]: https://github.com/opencontainers/runc/compare/v1.1.0...release-1.1
[Unreleased 1.1.z]: https://github.com/opencontainers/runc/compare/v1.1.3...release-1.1
[1.1.3]: https://github.com/opencontainers/runc/compare/v1.1.2...v1.1.3
[1.1.2]: https://github.com/opencontainers/runc/compare/v1.1.1...v1.1.2
[1.1.1]: https://github.com/opencontainers/runc/compare/v1.1.0...v1.1.1
[1.1.0-rc.1]: https://github.com/opencontainers/runc/compare/v1.0.0...v1.1.0-rc.1