mirror/runc
1
0
Fork 0
mirror of https://github.com/opencontainers/runc.git synced 2026-07-11 06:03:57 +08:00
Code Issues Packages Projects Releases Wiki Activity
7,652 Commits 7 Branches 82 Tags
2aea8617ea5079a7b9a63eb3e6aa2401803e9067
Commit Graph

7652 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Kir Kolyshkin 2aea8617ea ci: bump golangci-lint to v2.5 
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
 2025-10-07 17:09:28 -07:00
Kir Kolyshkin b2f8a74de5 all: format sources with gofumpt v0.9.1 
Since gofumpt v0.9.0 there's a new formatting rule to "clothe" any naked
returns.

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
 2025-10-07 17:08:56 -07:00
Aleksa Sarai a672a5f36c merge #4726 into opencontainers/runc:main 
Antti Kervinen (1):
  Add memory policy support

LGTMs: lifubang AkihiroSuda cyphar
 2025-10-08 05:18:13 +11:00
Antti Kervinen eda7bdf80c Add memory policy support 
Implement support for Linux memory policy in OCI spec PR:
https://github.com/opencontainers/runtime-spec/pull/1282

Signed-off-by: Antti Kervinen <antti.kervinen@intel.com>
 2025-10-07 15:06:37 +03:00
Akihiro Suda bc432ce88c Merge pull request #4913 from MegaManSec/k 
fix(seccompagent): close received FDs, not loop index
 2025-10-06 19:38:51 +09:00
Akihiro Suda 39a87aae08 Merge pull request #4912 from cyphar/changelog-1.3.2 
CHANGELOG: add v1.3.2 entry
 2025-10-06 19:38:29 +09:00
Joshua Rogers 8c1b3f9608 fix(seccompagent): close received FDs, not loop index 
Prevents accidentally closing 0/1/2 on error paths.

Signed-off-by: Joshua Rogers <MegaManSec@users.noreply.github.com>
 2025-10-06 06:16:33 +08:00
Aleksa Sarai 918de6824a CHANGELOG: add v1.3.2 entry 
Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
 2025-10-04 21:17:35 +10:00
lfbzhm 80486a207f Merge pull request #4910 from cyphar/remove-libct-userns 
libcontainer: remove deprecated package "userns"
 2025-10-04 09:12:18 +08:00
dependabot[bot] 2c5d55e491 Merge pull request #4909 from opencontainers/dependabot/go_modules/google.golang.org/protobuf-1.36.10 2025-10-03 16:37:56 +00:00
Aleksa Sarai e4f99b5c95 libcontainer: remove deprecated package "userns" 
This package was marked deprecated in commit 9b60a93cf3
("libcontainer/userns: migrate to github.com/moby/sys/userns"), which
was included in runc 1.2. Users have thus had a year to migrate to
github.com/moby/sys/userns and it's okay for us to remove this wrapper
package.

Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
 2025-10-03 16:32:10 +10:00
Aleksa Sarai 984b35389c merge #4904 into opencontainers/runc:main 
Aleksa Sarai (1):
  lint/revive: add package doc comments

LGTMs: lifubang kolyshkin
 2025-10-03 16:21:42 +10:00
Aleksa Sarai 627054d246 lint/revive: add package doc comments 
This silences all of the "should have a package comment" lint warnings
from golangci-lint.

Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
 2025-10-03 15:17:43 +10:00
dependabot[bot] dbffd5cd08 build(deps): bump google.golang.org/protobuf from 1.36.9 to 1.36.10 
Bumps google.golang.org/protobuf from 1.36.9 to 1.36.10.

---
updated-dependencies:
- dependency-name: google.golang.org/protobuf
  dependency-version: 1.36.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2025-10-03 04:02:51 +00:00
Kir Kolyshkin 8b06dd8743 Merge pull request #4908 from ariel-anieli/context-after-func-libcontainer 
libcontainer: switch `goCreateMountSources()` to `ctx.AfterFunc`
 2025-10-02 19:29:44 -07:00
Ariel Otilibili 4404cdf94b libcontainer: switch goCreateMountSources() to ctx.AfterFunc 
ba0b5e26 ("libcontainer: remove all mount logic from nsexec") introduced
a request function that handles two tasks:
- the exchanges with the request and response channels
- the closing of the request channel.

From 1.21, the closing of the request channel may be done with
context.AfterFunc(). Moreover, context.AfterFunc() is guaranteed to run
once.

Link: https://pkg.go.dev/context#AfterFunc
Suggested-by: Aleksa Sarai <cyphar@cyphar.com>
Signed-off-by: Ariel Otilibili <otilibil@eurecom.fr>
 2025-10-02 16:46:31 +02:00
lfbzhm 00aec12c71 Merge pull request #4842 from tianon/busybox 
Update `busybox:glibc` in integration tests to latest builds
 2025-09-27 16:04:38 +08:00
lfbzhm 050a85361b Merge pull request #4812 from kolyshkin/exec-clone-into-cgroup 
runc exec: use CLONE_INTO_CGROUP
 2025-09-27 15:22:07 +08:00
Kir Kolyshkin 5af4dd4e64 runc exec: use CLONE_INTO_CGROUP when available 
It makes sense to make runc exec benefit from clone2(CLONE_INTO_CGROUP),
if it is available. Since it requires a recent kernel and might not work,
implement a fallback to older way of joining the cgroup.

Based on:
 - https://go-review.googlesource.com/c/go/+/417695
 - https://github.com/coreos/go-systemd/pull/458
 - https://github.com/opencontainers/cgroups/pull/26
 - https://github.com/opencontainers/runc/pull/4822

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
 2025-09-26 14:27:18 -07:00
Tianon Gravi ce5400da08 Update busybox:glibc in integration tests to latest (1.37.0) builds 
This removes `mips64le` (no longer supported by the image / upstream in Debian Trixie+) and adds `riscv64`.

Signed-off-by: Tianon Gravi <admwiggin@gmail.com>
 2025-09-25 17:06:20 -07:00
Kir Kolyshkin 7d81b21c1a Merge pull request #4900 from lifubang/fix-Personality-seccomp 
libct: setup personality before initializing seccomp
 2025-09-25 16:59:28 -07:00
lifubang 57f1bef422 test: runc run with personality syscall blocked by seccomp 
Signed-off-by: lifubang <lifubang@acmcoder.com>
 2025-09-25 09:54:08 +00:00
lifubang f7dda6e6dc libct: setup personality before initializing seccomp 
Set the process personality early to ensure it takes effect before
seccomp is initialized. If seccomp filters are applied first and they
block personality-related system calls (e.g., `personality(2)`),
subsequent attempts to set the personality will fail.

Signed-off-by: lifubang <lifubang@acmcoder.com>
 2025-09-25 09:39:36 +00:00
Kir Kolyshkin 77ead42c9f Merge pull request #4822 from kolyshkin/add-pid 
runc exec: use manager.AddPid
 2025-09-17 18:43:25 -07:00
Rodrigo Campos 184024da25 Merge pull request #4893 from donettom-1/runc_cgroup_test_fix_for_ppc64 
tests/int/cgroups: Use 64K aligned limits for memory.max
 2025-09-17 04:13:33 -03:00
Kir Kolyshkin 37b5acc2d7 libct: use manager.AddPid to add exec to cgroup 
The main benefit here is when we are using a systemd cgroup driver,
we actually ask systemd to add a PID, rather than doing it ourselves.
This way, we can add rootless exec PID to a cgroup.

This requires newer opencontainers/cgroups and coreos/go-systemd.

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
 2025-09-16 13:31:16 -07:00
Kir Kolyshkin 5730a141f1 libct: move exec sub-cgroup handling down the line 
Remove cgroupPaths field from struct setnsProcess, because:
 - we can get base cgroup paths from p.manager.GetPaths();
 - we can get sub-cgroup paths from p.process.SubCgroupPaths.

But mostly because we are going to need separate cgroup paths when
adopting cgroups.AddPid.

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
 2025-09-16 13:27:56 -07:00
Kir Kolyshkin 5560020cbb libct: split addIntoCgroup into V1 and V2 
The main idea is to maintain the code separately (and eventually kill V1
implementation).

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
 2025-09-16 13:27:56 -07:00
Kir Kolyshkin b39e0d6468 libct: factor out addIntoCgroup from setnsProcess.start 
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
 2025-09-16 13:27:56 -07:00
Kir Kolyshkin 7d6848f883 script/setup_rootless.sh: chown nit 
This fixes the following warning (seen on Fedora 42 and Ubuntu 24.04):

	+ sudo chown -R rootless.rootless /home/rootless
	chown: warning: '.' should be ':': ‘rootless.rootless’

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
 2025-09-16 13:27:56 -07:00
Kir Kolyshkin b5cb56413c Merge pull request #4830 from marquiz/devel/rdt-schemata-field 
libcontainer/intelrdt: add support for Schemata field
 2025-09-16 13:23:43 -07:00
donettom-1 830c479ae2 tests/int/cgroups: Use 64K aligned limits for memory.max 
When a non–page-aligned value is written to memory.max, the kernel aligns it
down to the nearest page boundary. On systems with a page size greater
than 4K (e.g., 64K), this caused failures because the configured
memory.max value was not 64K aligned.

This patch fixes the issue by explicitly aligning the memory.max value
to 64K. Since 64K is also a multiple of 4K, the value is correctly
aligned on both 4K and 64K page size systems.

However, this approach will still fail on systems where the hardcoded
memory.max value is not aligned to the system page size.

Fixes: https://github.com/opencontainers/runc/issues/4841

Signed-off-by: Vishal Chourasia <vishalc@linux.ibm.com>
Signed-off-by: Donet Tom <donettom@linux.ibm.com>
 2025-09-16 17:31:35 +05:30
Rodrigo Campos f3ea522a28 Merge pull request #4889 from tych0/allow-ucounts 
libcontainer/validator: allow setting user.* sysctls inside userns
 2025-09-15 09:18:58 -03:00
Markus Lehtonen 7be025fff3 events/intelrdt: report full schemata 
Signed-off-by: Markus Lehtonen <markus.lehtonen@intel.com>
 2025-09-15 15:09:06 +03:00
Markus Lehtonen 41553216ee libcontainer/intelrdt: add support for Schemata field 
Implement support for the linux.intelRdt.schemata field of the spec.
This allows management of the "schemata" file in the resctrl group in a
generic way.

Signed-off-by: Markus Lehtonen <markus.lehtonen@intel.com>
 2025-09-15 15:09:06 +03:00
Tycho Andersen 70d88bc449 libcontainer/validator: allow setting user.* sysctls inside userns 
These sysctls are all per-userns (termed `ucounts` in the kernel code) are
settable with CAP_SYS_RESOURCE in the user namespace.

Signed-off-by: Tycho Andersen <tycho@tycho.pizza>
 2025-09-12 12:40:44 -06:00
dependabot[bot] 55c90aaf02 Merge pull request #4888 from opencontainers/dependabot/go_modules/golang.org/x/net-0.44.0 2025-09-10 07:34:52 +00:00
dependabot[bot] ffe6d3a3c8 build(deps): bump golang.org/x/net from 0.43.0 to 0.44.0 
Bumps [golang.org/x/net](https://github.com/golang/net) from 0.43.0 to 0.44.0.
- [Commits](https://github.com/golang/net/compare/v0.43.0...v0.44.0)

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-version: 0.44.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2025-09-10 06:50:38 +00:00
Akihiro Suda 441d6f7528 Merge pull request #4887 from opencontainers/dependabot/go_modules/google.golang.org/protobuf-1.36.9 
build(deps): bump google.golang.org/protobuf from 1.36.8 to 1.36.9
 2025-09-10 15:49:38 +09:00
dependabot[bot] cbf8a4d933 build(deps): bump google.golang.org/protobuf from 1.36.8 to 1.36.9 
Bumps google.golang.org/protobuf from 1.36.8 to 1.36.9.

---
updated-dependencies:
- dependency-name: google.golang.org/protobuf
  dependency-version: 1.36.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2025-09-10 04:02:44 +00:00
Rodrigo Campos 1d80c2f9ad Merge pull request #4885 from opencontainers/dependabot/go_modules/golang.org/x/sys-0.36.0 
build(deps): bump golang.org/x/sys from 0.35.0 to 0.36.0
 2025-09-08 11:57:32 -03:00
dependabot[bot] 527d2e668f build(deps): bump golang.org/x/sys from 0.35.0 to 0.36.0 
Bumps [golang.org/x/sys](https://github.com/golang/sys) from 0.35.0 to 0.36.0.
- [Commits](https://github.com/golang/sys/compare/v0.35.0...v0.36.0)

---
updated-dependencies:
- dependency-name: golang.org/x/sys
  dependency-version: 0.36.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2025-09-08 04:02:59 +00:00
Rodrigo Campos 2998f90507 Merge pull request #4883 from opencontainers/dependabot/github_actions/actions/github-script-8 
build(deps): bump actions/github-script from 7 to 8
 2025-09-05 12:51:27 -03:00
Aleksa Sarai 650afdde5f merge #4881 into opencontainers/runc:main 
Aleksa Sarai (4):
  VERSION: back to development
  VERSION: release v1.4.0-rc.1
  CHANGELOG: forward-port v1.3.1 changelog
  CHANGELOG: forward-port v1.2.7 changelog

LGTMs: kolyshkin rata AkihiroSuda
 2025-09-05 23:48:59 +10:00
Aleksa Sarai 77367fca1f VERSION: back to development 
Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
 2025-09-05 19:03:49 +10:00
Aleksa Sarai b2ec7f9201 VERSION: release v1.4.0-rc.1 
Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
v1.4.0-rc.1 		2025-09-05 19:03:49 +10:00
Aleksa Sarai 081b8c25b3 CHANGELOG: forward-port v1.3.1 changelog 
Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
 2025-09-05 19:03:49 +10:00
Aleksa Sarai 1931ebf739 CHANGELOG: forward-port v1.2.7 changelog 
Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
 2025-09-05 19:03:49 +10:00
Akihiro Suda 95b448addf Merge pull request #4882 from opencontainers/dependabot/github_actions/actions/setup-go-6 
build(deps): bump actions/setup-go from 5 to 6
 2025-09-05 16:05:48 +09:00
dependabot[bot] 9408f6643d build(deps): bump actions/github-script from 7 to 8 
Bumps [actions/github-script](https://github.com/actions/github-script) from 7 to 8.
- [Release notes](https://github.com/actions/github-script/releases)
- [Commits](https://github.com/actions/github-script/compare/v7...v8)

---
updated-dependencies:
- dependency-name: actions/github-script
  dependency-version: '8'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2025-09-05 04:02:37 +00:00