Commit Graph

7891 Commits

Author SHA1 Message Date
Ariel Otilibili 34da991298 libcontainer/seccomp: Use for range over integers
The commit mentioned below has missed these changes.

Fixes: 17570625 ("Use for range over integers")
Signed-off-by: Ariel Otilibili <otilibil@eurecom.fr>
2025-10-23 12:48:49 +02:00
lfbzhm 3a56046197 Merge pull request #4945 from kolyshkin/int-cleanup-part1
tests/int: cleanup
2025-10-22 23:40:54 +08:00
Akihiro Suda 7f32e50085 Merge pull request #4938 from zhaixiaojuan/main
Add loong64 support in seccomp and PIE
2025-10-22 12:51:28 +09:00
zhaixiaojuan d12d6010de Merge branch 'main' into main 2025-10-21 10:10:33 +08:00
zhaixiaojuan 885509afdf Add loong64 support in seccomp and PIE
Signed-off-by: zhaixiaojuan <zhaixiaojuan@loongson.cn>
2025-10-21 09:41:49 +08:00
Aleksa Sarai a7651e0ee0 merge #4944 into opencontainers/runc:main
Kir Kolyshkin (2):
  ci: show criu version in criu-dev testing
  ci: bump bats to 1.11.1

LGTMs: AkihiroSuda cyphar
2025-10-20 19:29:58 +11:00
Kir Kolyshkin 3c2683f52f tests/int/cgroups: use heredoc to break a long line
This is mostly to improve readability. While at it, make the script more
robust by adding -e option to shell. The exception is echo $pid which is
opportunistic and may fail depending on the order of pids in the file.

Also, remove the empty comment and a shellcheck annotation.

Fixes: c91fe9ae
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
2025-10-18 15:35:51 -07:00
Kir Kolyshkin b82ae3afdc tests/int/delete: fix pause test for rootless case
The "runc delete --force [paused container]" test case does not check
runc pause exit code, and if added, the test fails in rootless tests,
because:
 - not all rootless tests have access to cgroups;
 - rootless containers doesn't have default cgroups path.

To fix, add:
  - setup for rootless case;
  - require cgroups_freezer;
  - runc pause exit code check.

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
2025-10-18 15:33:27 -07:00
Kir Kolyshkin ad72eab6c7 tests/int/checkpoint: fix using run twice
In our bats tests, runc itself is a wrapper which calls bats run helper,
so using "run runc" is wrong as it results in calling run helper twice.

Fixes: 8d180e965
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
2025-10-18 15:30:16 -07:00
Kir Kolyshkin 92f3d1b225 tests/int/cgroups.bats: fix a wrong comment
This misleading comment is obviously a copy/paste from the previous
test. Fix it.

Fixes: dd696235
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
2025-10-18 15:30:16 -07:00
Kir Kolyshkin b3a9f423b9 tests/int: remove bogus $status checks
Commands that are not run via "run" helper (cat, mkdir, __runc)
do not set $status, so it makes no sense to check it.

Fixes: 94505a04, ed548376
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
2025-10-18 15:30:16 -07:00
Kir Kolyshkin 693a471af8 tests/int: use run with a status check
...instead of an explicit or absent status check.

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
2025-10-18 15:30:16 -07:00
Kir Kolyshkin 773a44cc1d tests/int/netdev: slight refactoring
Move the repetitive code and comment into setup_netns.

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
2025-10-18 15:30:16 -07:00
Kir Kolyshkin 0eb03ef86f tests/int: remove useless/obvious comments
This is a bit opinionated, but some comments in integration tests do not
really help to understand the nature of the tests being performed by
stating something very obvious, like

	# run busybox detached
	runc run -d busybox

To make things worse, these not-so-helpful messages are being
copy/pasted over and over, and that is the main reason to remove them.

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
2025-10-18 15:30:16 -07:00
Kir Kolyshkin 772e91062d tests/int/README: update
1. Remove the devicemapper driver mentions, and is it no longer
   supported by docker (or podman).

2. Remove the test example -- we have plenty of real ones.

3. Add a link to (well written and extensive) bats documentation.

4. Fix capitalization in a sentence.

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
2025-10-18 15:30:16 -07:00
Kir Kolyshkin 2a7ce15e68 ci: show criu version in criu-dev testing
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
2025-10-16 12:09:46 -07:00
Kir Kolyshkin 6af1d637ba ci: bump bats to 1.11.1
Bump bats to the version from Fedora 42 (used in "fedora" job), so we
have the same version everywhere.

This also fixes an issue introduced by commit d31e6b87 (which forgot to
bump bats in GHA CI), and adds a note to the yaml in order to avoid the
same issue in the future.

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
2025-10-16 12:07:55 -07:00
lfbzhm d34ea2bc06 Merge pull request #4937 from kolyshkin/lint-extra
ci: only run lint-extra job on PRs to main
2025-10-16 08:58:04 +08:00
Kir Kolyshkin 1c4dba693f ci: only run lint-extra job on PRs to main
All the new code appears in main (not in the release branches),
and we only want extra linter rules to apply to new code.

Disable lint-extra job if the PR is not to the main branch.

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
2025-10-15 16:51:22 -07:00
Aleksa Sarai ef90082853 merge #4930 into opencontainers/runc:main
Kir Kolyshkin (2):
  libct: refactor setnsProcess.start
  libct: close child fds on prepareCgroupFD error

LGTMs: lifubang cyphar
2025-10-16 09:36:26 +11:00
lfbzhm f023e1c222 Merge pull request #4934 from AkihiroSuda/lima
CI: remove deprecated lima-vm/lima-actions/ssh
2025-10-15 09:22:23 +08:00
Kir Kolyshkin 871052b791 libct: refactor setnsProcess.start
Factor startWithCgroupFD out of start to reduce the start complexity.
This also implements a more future-proof way of calling p.comm.closeChild.

Co-authored-by: lifubang <lifubang@acmcoder.com>
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
2025-10-14 11:48:25 -07:00
Kir Kolyshkin 4e262509b8 libct: close child fds on prepareCgroupFD error
The (*setns).start is supposed to close child fds once the child has
started, or upon an error. Commit 5af4dd4e6 added a bug -- child fds
are not closed if prepareCgroupFD fails.

Fix by adding a missing call to closeChild.

I'm not sure how to write a good test case for it. Found when working
on PR 4928 (and tested in there).

Fixes: 5af4dd4e6
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
2025-10-14 11:48:25 -07:00
Akihiro Suda c0e6f42427 CI: remove deprecated lima-vm/lima-actions/ssh
`lima-vm/lima-actions/ssh` is now merged into
`lima-vm/lima-actions/setup`.

https://github.com/lima-vm/lima-actions/releases/tag/v1.1.0

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
2025-10-14 14:41:27 +09:00
lfbzhm 721d066576 Merge pull request #4902 from osamakader/fix-outdated-seccomp-todo
docs: update seccomp documentation
2025-10-14 08:11:27 +08:00
Osama Abdelkader e0632ccd1c docs: update seccomp documentation
Replace outdated TODO comment with updated information about runc's seccomp support.

Signed-off-by: Osama Abdelkader <osama.abdelkader@gmail.com>
2025-10-13 22:41:36 +03:00
lfbzhm fa1b69348e Merge pull request #4914 from osamakader/fix-stringsTitle-criu-linux
criu: replace deprecated strings.Title
2025-10-13 17:33:16 +08:00
Osama Abdelkader 1adb070b58 criu: replace deprecated strings.Title
strings.Title is deprecated since Go 1.18. Replace it with a simple
manual capitalization of the first character in criuNsToKey().

Signed-off-by: Osama Abdelkader <osama.abdelkader@gmail.com>
Co-authored-by: Kir Kolyshkin <kolyshkin@gmail.com>
2025-10-12 14:02:21 +03:00
Akihiro Suda 17938cd8b9 Merge pull request #4926 from cyphar/cpuset-fill
libct: switch to (*CPUSet).Fill
2025-10-09 16:41:02 +09:00
Aleksa Sarai 93f9a392cf libct: switch to (*CPUSet).Fill
Now that we've updated to golang.org/x/sys@v0.37.0, CPUSet has a Fill
helper that does the equivalent to our underflow trick to make setting
all CPUs efficient.

Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
2025-10-09 15:39:02 +11:00
Aleksa Sarai e3ab743998 Merge pull request #4924 from opencontainers/dependabot/go_modules/golang.org/x/net-0.46.0
build(deps): bump golang.org/x/net from 0.45.0 to 0.46.0
2025-10-09 15:37:03 +11:00
dependabot[bot] e59062cec9 build(deps): bump golang.org/x/net from 0.45.0 to 0.46.0
Bumps [golang.org/x/net](https://github.com/golang/net) from 0.45.0 to 0.46.0.
- [Commits](https://github.com/golang/net/compare/v0.45.0...v0.46.0)

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-version: 0.46.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
2025-10-09 04:02:50 +00:00
lfbzhm 6e6ac00eb3 Merge pull request #4898 from kolyshkin/hugetlb-unit-test
tests/int: add check for hugetlb stats
2025-10-08 17:12:07 +08:00
lfbzhm a217cb827d Merge pull request #4917 from kolyshkin/golangci-v25
ci: bump golangci-lint to v2.5
2025-10-08 16:10:11 +08:00
Kir Kolyshkin ef61b7f0be tests/int: add check for hugetlb stats
As promised in

	https://github.com/opencontainers/cgroups/pull/24#pullrequestreview-3007872832

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
2025-10-08 00:42:08 -07:00
Kir Kolyshkin 28daf53d7e Merge pull request #4832 from marquiz/devel/rdt-enablemonitoring
libcontainer/intelrdt: add support for EnableMonitoring field
2025-10-08 00:18:02 -07:00
Kir Kolyshkin b40777d41a Merge pull request #4919 from opencontainers/dependabot/go_modules/golang.org/x/net-0.45.0
build(deps): bump golang.org/x/net from 0.44.0 to 0.45.0
2025-10-07 22:00:29 -07:00
dependabot[bot] a35a0e0276 build(deps): bump golang.org/x/net from 0.44.0 to 0.45.0
Bumps [golang.org/x/net](https://github.com/golang/net) from 0.44.0 to 0.45.0.
- [Commits](https://github.com/golang/net/compare/v0.44.0...v0.45.0)

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-version: 0.45.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
2025-10-08 04:02:33 +00:00
Kir Kolyshkin 2aea8617ea ci: bump golangci-lint to v2.5
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
2025-10-07 17:09:28 -07:00
Kir Kolyshkin b2f8a74de5 all: format sources with gofumpt v0.9.1
Since gofumpt v0.9.0 there's a new formatting rule to "clothe" any naked
returns.

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
2025-10-07 17:08:56 -07:00
Aleksa Sarai a672a5f36c merge #4726 into opencontainers/runc:main
Antti Kervinen (1):
  Add memory policy support

LGTMs: lifubang AkihiroSuda cyphar
2025-10-08 05:18:13 +11:00
Antti Kervinen eda7bdf80c Add memory policy support
Implement support for Linux memory policy in OCI spec PR:
https://github.com/opencontainers/runtime-spec/pull/1282

Signed-off-by: Antti Kervinen <antti.kervinen@intel.com>
2025-10-07 15:06:37 +03:00
Akihiro Suda bc432ce88c Merge pull request #4913 from MegaManSec/k
fix(seccompagent): close received FDs, not loop index
2025-10-06 19:38:51 +09:00
Akihiro Suda 39a87aae08 Merge pull request #4912 from cyphar/changelog-1.3.2
CHANGELOG: add v1.3.2 entry
2025-10-06 19:38:29 +09:00
Joshua Rogers 8c1b3f9608 fix(seccompagent): close received FDs, not loop index
Prevents accidentally closing 0/1/2 on error paths.

Signed-off-by: Joshua Rogers <MegaManSec@users.noreply.github.com>
2025-10-06 06:16:33 +08:00
Aleksa Sarai 918de6824a CHANGELOG: add v1.3.2 entry
Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
2025-10-04 21:17:35 +10:00
lfbzhm 80486a207f Merge pull request #4910 from cyphar/remove-libct-userns
libcontainer: remove deprecated package "userns"
2025-10-04 09:12:18 +08:00
dependabot[bot] 2c5d55e491 Merge pull request #4909 from opencontainers/dependabot/go_modules/google.golang.org/protobuf-1.36.10 2025-10-03 16:37:56 +00:00
Aleksa Sarai e4f99b5c95 libcontainer: remove deprecated package "userns"
This package was marked deprecated in commit 9b60a93cf3
("libcontainer/userns: migrate to github.com/moby/sys/userns"), which
was included in runc 1.2. Users have thus had a year to migrate to
github.com/moby/sys/userns and it's okay for us to remove this wrapper
package.

Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
2025-10-03 16:32:10 +10:00
Aleksa Sarai 984b35389c merge #4904 into opencontainers/runc:main
Aleksa Sarai (1):
  lint/revive: add package doc comments

LGTMs: lifubang kolyshkin
2025-10-03 16:21:42 +10:00