This is the second patch release in the 1.5.z release series of runc,
which primarily includes a workaround for a Linux kernel bug causing
random runc crashes when using cgroup v2, and other fixes.

Fixed

• runc exec -p with a process.json lacking env now sets HOME again
  (a regression in runc 1.3.0). (#5265, #5266, #5459)
• Worked around a Linux kernel bug (present since kernel v6.17, fixed in v7.2)
  which caused the kernel to write past the end of the structure
  provided by userspace (runc). This resulted in memory corruption inside runc
  (manifesting as random crashes) when configuring device rules on cgroup v2
  systems. (#5403, #5428)
• runc exec --cgroup (and the equivalent libcontainer Process.SubCgroupPaths
  API) no longer accepts a sub-cgroup path that escapes the container's cgroup
  into a sibling cgroup sharing the same name prefix. Note that using
  --cgroup requires the same privileges as running runc exec itself, so
  this is a correctness rather than a security fix. (#5403, #5457)
• Fixed a missing O_CLOEXEC when opening the cgroup v2 directory to set up
  device rules. (#5403, #5428)
• Some long-standing file-descriptor leaks on the eBPF devices cgroups were
  fixed. (#5403, #5428)
• When rootfsPropagation is set to rslave, the rootfs parent mount is no
  longer made private before pivoting into the rootfs, so unmount/remount
  events on host mountpoints under the rootfs are now propagated to the
  running container. (#5192, #5200, #5458)
• runc no longer misdetects a non-initial user namespace as the initial one
  when that namespace has a full identity ID mapping (0 0 4294967295), as
  used by systemd >= 260 units with PrivateUsers=full. Previously this made
  runc skip its user namespace code paths, so starting a container in such a
  unit failed with bpf_prog_query(BPF_CGROUP_DEVICE) failed: operation not permitted.
  (#5396, #5411, #5451, moby/sys#239)
• Fixed a runc init panic (SIGABRT) on the error path, caused by SELinux
  labels being reset after the cached libpathrs procfs handle was already
  closed. This is fixed both by not resetting the labels on the init error
  path, and by updating to libpathrs v0.2.6, which now handles a closed
  procfs handle gracefully. (#5438, #5439, #5442, #5448, #5449, #5467,
  #5469)
• Fixed various issues when the libseccomp version runc is run with differs
  from the one it was compiled against (e.g. built with libseccomp >= 2.6.0 and
  run with an older one), by updating to libseccomp-golang v0.12.0. This also
  supersedes the SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV workaround added in
  runc 1.5.1. (#5436, #5461)
• The libseccomp library statically linked into release binaries is now built
  with optimizations enabled (the default -g -O2 CFLAGS); previously it was
  built unoptimized. (#5464, #5465)

Changed

• Switched to opencontainers/cgroups v0.1.0, which no longer uses the
  high-level cilium/ebpf API to manage cgroup v2 device rules. As a result,
  the runc binary shrunk by about 1 MiB (7.5%) on amd64. This also means runc
  no longer calls the cilium/ebpf code affected by GO-2026-6238. (#5403, #5428)
• Updated golang.org/x/net to v0.55.0. (#5379, #5381)
• Updated builds to libseccomp v2.6.1. (#5376, #5460)

Static Linking Notices

The runc binaries distributed with this release are statically linked with
the following GNU LGPL-2.1 licensed libraries, with runc acting
as a "work that uses the Library":

• libseccomp

Similarly, the runc binaries distributed with this release are also
statically linked with the following MPLv2 licensed libraries,
with runc acting as a "Larger Work":

• libpathrs

The versions of these libraries were not modified from their upstream versions,
but in order to comply with their corresponding licenses, we have attached the
complete source code for those libraries which (when combined with the attached
runc source code) may be used to exercise your rights under their respective
licenses.

However, we strongly suggest that you make use of your distribution's packages
or download them from the authoritative upstream sources, especially since
these libraries are related to the security of your containers.

Thanks to the following contributors who made this release possible:

• Aleksa Sarai cyphar@cyphar.com
• Ali alliasgher123@gmail.com
• Alvaro Leiva Geisse aleivag@gmail.com
• Ciprian Hacman ciprian@hakman.dev
• Kir Kolyshkin kolyshkin@gmail.com
• Li Fu Bang lifubang@acmcoder.com
• Matthew Dabit mdabit@x.ai
• Rodrigo Campos rodrigo@amutable.com
• sean xujihui1985@gmail.com
• Sebastiaan van Stijn github@gone.nl
• xingyaner longfor2025@gmail.com

Signed-off-by: Kir Kolyshkin kolyshkin@gmail.com

This is the first patch release in the 1.5.z release series of runc, and
primarily includes a fix for a serious regression on Ubuntu 20.04
kernels.

Fixed

• There was a regression reported in with the maskPaths optimisation added in
  1.5.0-rc.3 (#5275). On Ubuntu Focal (20.04), attempts to mount tmpfs with
  the nr_inodes=1 option will fail due to a downstream kernel patch
  (ironically originating from AUFS). We now have a fallback path using
  nr_inodes=2 instead if the operation fails. (#5348, #5358, #5359)
• Properly handle EINVAL for seccomp SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV
  when trying to rewrite the filter. This appears to only happen if you compile
  runc with libseccomp >= 2.6.0 and then run it with an < 2.6.0 libseccomp.
  (#5347, #5354)

Static Linking Notices

The runc binaries distributed with this release are statically linked with
the following GNU LGPL-2.1 licensed libraries, with runc acting
as a "work that uses the Library":

• libseccomp

Similarly, the runc binaries distributed with this release are also
statically linked with the following MPLv2 licensed libraries,
with runc acting as a "Larger Work":

• libpathrs

The versions of these libraries were not modified from their upstream versions,
but in order to comply with their corresponding licenses, we have attached the
complete source code for those libraries which (when combined with the attached
runc source code) may be used to exercise your rights under their respective
licenses.

However, we strongly suggest that you make use of your distribution's packages
or download them from the authoritative upstream sources, especially since
these libraries are related to the security of your containers.

Thanks to the following contributors who made this release possible:

• Akihiro Suda akihiro.suda.cz@hco.ntt.co.jp
• Aleksa Sarai cyphar@cyphar.com
• Kir Kolyshkin kolyshkin@gmail.com
• Paco Xu roollingstone@gmail.com
• Rodrigo Campos Catelin rodrigo@amutable.com
• lifubang lifubang@acmcoder.com

Signed-off-by: Aleksa Sarai cyphar@cyphar.com

This is the somewhat-delayed^Wlong-awaited first stable release of the
1.5.z release branch of runc. It contains a handful of fixes for issues
found in 1.5.0-rc.3 and an important dependency bump for libpathrs.

This is the third release of runc following our new release and support
policy (see RELEASES.md for more details). This means that, as of this
release:

• The runc 1.2.z (and earlier) release branches are now completely
  unsupported.
• The runc 1.3.z release branch will now only receive high severity
  CVE fixes, and will no longer be supported in less than 6 months (end
  of October 2026).
• The runc 1.4.z release branch will now only recieve security and
  "significant" bugfixes.
• Users are encouraged to plan migrating to runc 1.5.0 as soon as
  possible.
• Despite this release being delayed by over a month, users should
  still expect a runc 1.6.0 release in late October 2026.

Added

• runc version and runc features now provide version information about
  libpathrs (when runc is built with the libpathrs build tag). (#5291, #5328)

Fixed

• Since runc 1.3.0, the org.opencontainers.runc.version annotation included
  in runc features contained an extraneous \n, possibly causing issues with
  tools that parse the output. It is now properly stripped. (#5329, #5330,
  #5331, #5335)

Changed

• runc (when built with the libpathrs build tag) now depends on libpathrs
  v0.2.5 or later, and attempting to build with older versions will cause
  compilation errors. (#5291, #5328)
• Switched to go-criu v8.3.0, which reduces our binary size from ~16MB to
  ~14MB. (#5312, #5326)

Static Linking Notices

The runc binaries distributed with this release are statically linked with
the following GNU LGPL-2.1 licensed libraries, with runc acting
as a "work that uses the Library":

• libseccomp

Similarly, the runc binaries distributed with this release are also
statically linked with the following MPLv2 licensed libraries,
with runc acting as a "Larger Work":

• libpathrs

The versions of these libraries were not modified from their upstream versions,
but in order to comply with their corresponding licenses, we have attached the
complete source code for those libraries which (when combined with the attached
runc source code) may be used to exercise your rights under their respective
licenses.

However, we strongly suggest that you make use of your distribution's packages
or download them from the authoritative upstream sources, especially since
these libraries are related to the security of your containers.

Thanks to the following contributors who made this release possible:

• Akihiro Suda akihiro.suda.cz@hco.ntt.co.jp
• Aleksa Sarai cyphar@cyphar.com
• Kir Kolyshkin kolyshkin@gmail.com
• Rodrigo Campos Catelin rodrigo@amutable.com

Signed-off-by: Aleksa Sarai cyphar@cyphar.com

This is the third release candidate for the 1.5.z series of runc. Among
some performance improvements and bugfixes, it includes a fix for a
low-severity vulnerability (CVE-2026-41579) and users are encouraged to
update. As it was a low-severity vulnerability and it was reported by
multiple people, we decided to release it publicly with NO EMBARGO.

We plan to release 1.5.0 in the next two weeks.

Security

This release includes a fix for the following low-severity security issue:

• CVE-2026-41579 allowed a malicious image with a /dev symlink to have
  limited write access to the host filesystem in ways that our analysis
  indicates was too limited to be problematic in practice. This bug was very
  similar to those fixed in CVE-2025-31133, CVE-2025-52565,
  CVE-2025-31133 and was simply missed at the time when we hardened the
  rootfs preparation code. We have conducted a deeper audit and not found any
  other problematic cases.

libcontainer API

• The cmsg helpers from github.com/opencontainers/runc/libcontainer/utils
  have been moved to an internal package. We have included wrapper functions
  but they will be removed in runc 1.6. (#5227, #5231)
• Added //go:fix inline to ease migration for libcontainer/devices symbols
  that are deprecated and scheduled for removal in runc 1.6. (#5223, #5225)

Fixed

• runc list now correctly handles non-existant --root arguments. (#5297,
  #5301)
• Various integration test improvements. (#5222, #5226, #5232, #5239, #5230,
  #5236, #5246, #5248, #5279, #5283, #5269, #5286, #5295, #5303)

Changed

• When masking directories with maskPaths, runc will now re-use a single
  tmpfs instance (which is not writable) to reduce the number tmpfs
  superblocks that need to be reaped when containers die (in particular,
  Kubernetes applies masks to per-CPU sysfs directories which get expensive
  quickly). (#5275, #5280)

Static Linking Notices

The runc binaries distributed with this release are statically linked with
the following GNU LGPL-2.1 licensed libraries, with runc acting
as a "work that uses the Library":

• libseccomp

Similarly, the runc binaries distributed with this release are also
statically linked with the following MPLv2 licensed libraries,
with runc acting as a "Larger Work":

• libpathrs

The versions of these libraries were not modified from their upstream versions,
but in order to comply with their corresponding licenses, we have attached the
complete source code for those libraries which (when combined with the attached
runc source code) may be used to exercise your rights under their respective
licenses.

However, we strongly suggest that you make use of your distribution's packages
or download them from the authoritative upstream sources, especially since
these libraries are related to the security of your containers.

Thanks to the following contributors for making this release possible:

• Akihiro Suda akihiro.suda.cz@hco.ntt.co.jp
• Aleksa Sarai cyphar@cyphar.com
• Davanum Srinivas davanum@gmail.com
• Kevin Berry kpberry11@gmail.com
• Kir Kolyshkin kolyshkin@gmail.com
• Li Fubang lifubang@acmcoder.com
• RedMakeUp girafeeblue@gmail.com
• Ricardo Branco rbranco@suse.de
• Rodrigo Campos Catelin rodrigo@amutable.com
• Sebastiaan van Stijn github@gone.nl

Signed-off-by: Aleksa Sarai cyphar@cyphar.com

This is the second release candidate of the runc 1.5.0 release. It
mostly contains build fixes and improvements, but also includes
a new minor feature and some deprecations.
runc v1.5.0-rc.2 includes all of the patches backported to runc v1.4.2.

Users are strongly encouraged to test our release candidates over the
next few weeks so we can fix issues before the general release. You
should expect runc 1.5.0 to be released at the end of April 2026 (at
which point, runc 1.3.z will only receive high-severity security fixes
for 6 months and runc 1.2.z will become unmaintained -- users are thus
very strongly encouraged to migrate to a newer version).

Fixed

• Building with libpathrs for systems that use non-GNU awk, e.g. Debian.
  (#5196, #5194)

Added

• Installation notes for libpathrs. (#5199, #5195)
• Support for specs.LinuxSeccompFlagWaitKillableRecv. (#5183, #5172)
• When building runc, RUNC_BUILDTAGS make or shell environment variable can
  be used to add build tags and/or remove existing build tags (when a tag is
  prefixed with -). (#5198, #5171)

Changed

• runc now requires Go 1.25+ to build. (#5211, #5205)
• libcontainer now pre-opens container root filesystem and uses the file
  descriptor (rather than the path) for most operations related to container
  root during container start. (#5204, #5190)

Deprecated

• EXTRA_BUILDTAGS make variable is deprecated in favor of RUNC_BUILDTAGS
  and will be removed in runc 1.6. (#5171, #5198)
• libcontainer/devices has been deprecated in favour of
  github.com/moby/sys/devices (which is a carbon copy of the package). It
  will be removed in runc 1.6. (#5220, #5142)

Static Linking Notices

The runc binaries distributed with this release are statically linked with
the following GNU LGPL-2.1 licensed libraries, with runc acting
as a "work that uses the Library":

• libseccomp

Similarly, the runc binaries distributed with this release are also
statically linked with the following MPLv2 licensed libraries,
with runc acting as a "Larger Work":

• libpathrs

The versions of these libraries were not modified from their upstream versions,
but in order to comply with their corresponding licenses, we have attached the
complete source code for those libraries which (when combined with the attached
runc source code) may be used to exercise your rights under their respective
licenses.

However, we strongly suggest that you make use of your distribution's packages
or download them from the authoritative upstream sources, especially since
these libraries are related to the security of your containers.

Thanks to the following contributors for making this release possible:

• Akhil Mohan akhilerm@gmail.com
• Aleksa Sarai cyphar@cyphar.com
• Ayato Tokubi atokubi@redhat.com
• Kir Kolyshkin kolyshkin@gmail.com
• Li Fubang lifubang@acmcoder.com
• Rodrigo Campos Catelin rodrigo@amutable.com

Signed-off-by: Kir Kolyshkin kolyshkin@gmail.com