This is the first patch release in the 1.5.z release series of runc, and
primarily includes a fix for a serious regression on Ubuntu 20.04
kernels.

Fixed

• There was a regression reported in with the maskPaths optimisation added in
  1.5.0-rc.3 (#5275). On Ubuntu Focal (20.04), attempts to mount tmpfs with
  the nr_inodes=1 option will fail due to a downstream kernel patch
  (ironically originating from AUFS). We now have a fallback path using
  nr_inodes=2 instead if the operation fails. (#5348, #5358, #5359)
• Properly handle EINVAL for seccomp SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV
  when trying to rewrite the filter. This appears to only happen if you compile
  runc with libseccomp >= 2.6.0 and then run it with an < 2.6.0 libseccomp.
  (#5347, #5354)

Static Linking Notices

The runc binaries distributed with this release are statically linked with
the following GNU LGPL-2.1 licensed libraries, with runc acting
as a "work that uses the Library":

• libseccomp

Similarly, the runc binaries distributed with this release are also
statically linked with the following MPLv2 licensed libraries,
with runc acting as a "Larger Work":

• libpathrs

The versions of these libraries were not modified from their upstream versions,
but in order to comply with their corresponding licenses, we have attached the
complete source code for those libraries which (when combined with the attached
runc source code) may be used to exercise your rights under their respective
licenses.

However, we strongly suggest that you make use of your distribution's packages
or download them from the authoritative upstream sources, especially since
these libraries are related to the security of your containers.

Thanks to the following contributors who made this release possible:

• Akihiro Suda [email protected]
• Aleksa Sarai [email protected]
• Kir Kolyshkin [email protected]
• Paco Xu [email protected]
• Rodrigo Campos Catelin [email protected]
• lifubang [email protected]

Signed-off-by: Aleksa Sarai [email protected]

runc v1.5.1 -- "El lujo es vulgaridad, dijo, y me conquistó." Latest

Latest

Compare

Choose a tag to compare

This is the somewhat-delayed^Wlong-awaited first stable release of the
1.5.z release branch of runc. It contains a handful of fixes for issues
found in 1.5.0-rc.3 and an important dependency bump for libpathrs.

This is the third release of runc following our new release and support
policy (see RELEASES.md for more details). This means that, as of this
release:

• The runc 1.2.z (and earlier) release branches are now completely
  unsupported.
• The runc 1.3.z release branch will now only receive high severity
  CVE fixes, and will no longer be supported in less than 6 months (end
  of October 2026).
• The runc 1.4.z release branch will now only recieve security and
  "significant" bugfixes.
• Users are encouraged to plan migrating to runc 1.5.0 as soon as
  possible.
• Despite this release being delayed by over a month, users should
  still expect a runc 1.6.0 release in late October 2026.

Added

• runc version and runc features now provide version information about
  libpathrs (when runc is built with the libpathrs build tag). (#5291, #5328)

Fixed

• Since runc 1.3.0, the org.opencontainers.runc.version annotation included
  in runc features contained an extraneous \n, possibly causing issues with
  tools that parse the output. It is now properly stripped. (#5329, #5330,
  #5331, #5335)

Changed

• runc (when built with the libpathrs build tag) now depends on libpathrs
  v0.2.5 or later, and attempting to build with older versions will cause
  compilation errors. (#5291, #5328)
• Switched to go-criu v8.3.0, which reduces our binary size from ~16MB to
  ~14MB. (#5312, #5326)

Static Linking Notices

The runc binaries distributed with this release are statically linked with
the following GNU LGPL-2.1 licensed libraries, with runc acting
as a "work that uses the Library":

• libseccomp

Similarly, the runc binaries distributed with this release are also
statically linked with the following MPLv2 licensed libraries,
with runc acting as a "Larger Work":

• libpathrs

The versions of these libraries were not modified from their upstream versions,
but in order to comply with their corresponding licenses, we have attached the
complete source code for those libraries which (when combined with the attached
runc source code) may be used to exercise your rights under their respective
licenses.

However, we strongly suggest that you make use of your distribution's packages
or download them from the authoritative upstream sources, especially since
these libraries are related to the security of your containers.

Thanks to the following contributors who made this release possible:

• Akihiro Suda [email protected]
• Aleksa Sarai [email protected]
• Kir Kolyshkin [email protected]
• Rodrigo Campos Catelin [email protected]

Signed-off-by: Aleksa Sarai [email protected]

Why do we even have that lever?!

Added

• runc version and runc features now provide version information about libpathrs (when runc is built with the libpathrs build tag). (#5291, #5328)

Fixed

• Since runc 1.3.0, the org.opencontainers.runc.version annotation included in runc features contained an extraneous \n, possibly causing issues with tools that parse the output. It is now properly stripped. (#5329, #5330, #5331, #5335)

Changed

• runc (when built with the libpathrs build tag) now depends on libpathrs v0.2.5 or later, and attempting to build with older versions will cause compilation errors. (#5291, #5328)
• Switched to go-criu v8.3.0, which reduces our binary size from ~16MB to ~14MB. (#5312, #5326)

runc v1.5.0 -- "Why do we even have that lever?!"

Compare

Choose a tag to compare

This is the third release candidate for the 1.5.z series of runc. Among
some performance improvements and bugfixes, it includes a fix for a
low-severity vulnerability (CVE-2026-41579) and users are encouraged to
update. As it was a low-severity vulnerability and it was reported by
multiple people, we decided to release it publicly with NO EMBARGO.

We plan to release 1.5.0 in the next two weeks.

Security

This release includes a fix for the following low-severity security issue:

• CVE-2026-41579 allowed a malicious image with a /dev symlink to have
  limited write access to the host filesystem in ways that our analysis
  indicates was too limited to be problematic in practice. This bug was very
  similar to those fixed in CVE-2025-31133, CVE-2025-52565,
  CVE-2025-31133 and was simply missed at the time when we hardened the
  rootfs preparation code. We have conducted a deeper audit and not found any
  other problematic cases.

libcontainer API

• The cmsg helpers from github.com/opencontainers/runc/libcontainer/utils
  have been moved to an internal package. We have included wrapper functions
  but they will be removed in runc 1.6. (#5227, #5231)
• Added //go:fix inline to ease migration for libcontainer/devices symbols
  that are deprecated and scheduled for removal in runc 1.6. (#5223, #5225)

Fixed

• runc list now correctly handles non-existant --root arguments. (#5297,
  #5301)
• Various integration test improvements. (#5222, #5226, #5232, #5239, #5230,
  #5236, #5246, #5248, #5279, #5283, #5269, #5286, #5295, #5303)

Changed

• When masking directories with maskPaths, runc will now re-use a single
  tmpfs instance (which is not writable) to reduce the number tmpfs
  superblocks that need to be reaped when containers die (in particular,
  Kubernetes applies masks to per-CPU sysfs directories which get expensive
  quickly). (#5275, #5280)

Static Linking Notices

The runc binaries distributed with this release are statically linked with
the following GNU LGPL-2.1 licensed libraries, with runc acting
as a "work that uses the Library":

• libseccomp

Similarly, the runc binaries distributed with this release are also
statically linked with the following MPLv2 licensed libraries,
with runc acting as a "Larger Work":

• libpathrs

The versions of these libraries were not modified from their upstream versions,
but in order to comply with their corresponding licenses, we have attached the
complete source code for those libraries which (when combined with the attached
runc source code) may be used to exercise your rights under their respective
licenses.

However, we strongly suggest that you make use of your distribution's packages
or download them from the authoritative upstream sources, especially since
these libraries are related to the security of your containers.

Thanks to the following contributors for making this release possible:

• Akihiro Suda [email protected]
• Aleksa Sarai [email protected]
• Davanum Srinivas [email protected]
• Kevin Berry [email protected]
• Kir Kolyshkin [email protected]
• Li Fubang [email protected]
• RedMakeUp [email protected]
• Ricardo Branco [email protected]
• Rodrigo Campos Catelin [email protected]
• Sebastiaan van Stijn [email protected]

Signed-off-by: Aleksa Sarai [email protected]

The best way to get a drink out of a Vogon is to stick your finger down his throat.

Security

This release includes a fix for the following low-severity security issue:

• CVE-2026-41579 allowed a malicious image with a /dev symlink to have limited write access to the host filesystem in ways that our analysis indicates was too limited to be problematic in practice. This bug was very similar to those fixed in [CVE-2025-31133][], [CVE-2025-52565][], [CVE-2025-31133][] and was simply missed at the time when we hardened the rootfs preparation code. We have conducted a deeper audit and not found any other problematic cases.

libcontainer API

• The cmsg helpers from github.com/opencontainers/runc/libcontainer/utils have been moved to an internal package. We have included wrapper functions but they will be removed in runc 1.6. (#5227, #5231)
• Added //go:fix inline to ease migration for libcontainer/devices symbols that are deprecated and scheduled for removal in runc 1.6. (#5223, #5225)

Fixed

• runc list now correctly handles non-existent --root arguments. (#5297, #5301)
• Various integration test improvements. (#5222, #5226, #5232, #5239, #5230, #5236, #5246, #5248, #5279, #5283, #5269, #5286, #5295, #5303)

Changed

• When masking directories with maskPaths, runc will now reuse a single tmpfs instance (which is not writeable) to reduce the number tmpfs superblocks that need to be reaped when containers die (in particular, Kubernetes applies masks to per-CPU sysfs directories which get expensive quickly). (#5275, #5280)

runc 1.5.0-rc.3 -- "The best way to get a drink out of a Vogon is to stick your finger down his throat." Pre-release

Pre-release

Compare

Choose a tag to compare

This is the second release candidate of the runc 1.5.0 release. It
mostly contains build fixes and improvements, but also includes
a new minor feature and some deprecations.
runc v1.5.0-rc.2 includes all of the patches backported to runc v1.4.2.

Users are strongly encouraged to test our release candidates over the
next few weeks so we can fix issues before the general release. You
should expect runc 1.5.0 to be released at the end of April 2026 (at
which point, runc 1.3.z will only receive high-severity security fixes
for 6 months and runc 1.2.z will become unmaintained -- users are thus
very strongly encouraged to migrate to a newer version).

Fixed

• Building with libpathrs for systems that use non-GNU awk, e.g. Debian.
  (#5196, #5194)

Added

• Installation notes for libpathrs. (#5199, #5195)
• Support for specs.LinuxSeccompFlagWaitKillableRecv. (#5183, #5172)
• When building runc, RUNC_BUILDTAGS make or shell environment variable can
  be used to add build tags and/or remove existing build tags (when a tag is
  prefixed with -). (#5198, #5171)

Changed

• runc now requires Go 1.25+ to build. (#5211, #5205)
• libcontainer now pre-opens container root filesystem and uses the file
  descriptor (rather than the path) for most operations related to container
  root during container start. (#5204, #5190)

Deprecated

• EXTRA_BUILDTAGS make variable is deprecated in favor of RUNC_BUILDTAGS
  and will be removed in runc 1.6. (#5171, #5198)
• libcontainer/devices has been deprecated in favour of
  github.com/moby/sys/devices (which is a carbon copy of the package). It
  will be removed in runc 1.6. (#5220, #5142)

Static Linking Notices

The runc binaries distributed with this release are statically linked with
the following GNU LGPL-2.1 licensed libraries, with runc acting
as a "work that uses the Library":

• libseccomp

Similarly, the runc binaries distributed with this release are also
statically linked with the following MPLv2 licensed libraries,
with runc acting as a "Larger Work":

• libpathrs

The versions of these libraries were not modified from their upstream versions,
but in order to comply with their corresponding licenses, we have attached the
complete source code for those libraries which (when combined with the attached
runc source code) may be used to exercise your rights under their respective
licenses.

However, we strongly suggest that you make use of your distribution's packages
or download them from the authoritative upstream sources, especially since
these libraries are related to the security of your containers.

Thanks to the following contributors for making this release possible:

• Akhil Mohan [email protected]
• Aleksa Sarai [email protected]
• Ayato Tokubi [email protected]
• Kir Kolyshkin [email protected]
• Li Fubang [email protected]
• Rodrigo Campos Catelin [email protected]

Signed-off-by: Kir Kolyshkin [email protected]

いざやいざや、見に行かん

[!NOTE] runc v1.5.0-rc.2 includes all of the patches backported to runc v1.4.2.

Fixed

• Building with libpathrs for systems that use non-GNU awk, e.g. Debian. (#5196, #5194)

Added

• Installation notes for libpathrs. (#5199, #5195)
• Support for specs.LinuxSeccompFlagWaitKillableRecv. (#5183, #5172)
• When building runc, RUNC_BUILDTAGS make or shell environment variable can be used to add build tags and/or remove existing build tags (when a tag is prefixed with -). (#5198, #5171)

Changed

• runc now requires Go 1.25+ to build. (#5211, #5205)
• libcontainer now pre-opens container root filesystem and uses the file descriptor (rather than the path) for most operations related to container root during container start. (#5204, #5190)

Deprecated

• EXTRA_BUILDTAGS make variable is deprecated in favor of RUNC_BUILDTAGS and will be removed in runc 1.6. (#5171, #5198)
• libcontainer/devices has been deprecated in favour of github.com/moby/sys/devices (which is a carbon copy of the package). It will be removed in runc 1.6. (#5220, #5142)

runc v1.5.0-rc.2 -- "いざやいざや、見に行かん" Pre-release

Pre-release

Compare

Choose a tag to compare

This is the first release candidate of the runc 1.5.0 release. It
contains a couple of new features, but is mostly made up of various
cleanups (such as the removal of many deprecated APIs) and improvements.
runc v1.5.0-rc.1 includes all of the patches backported to runc v1.4.1.

Users are strongly encouraged to test our release candidates over the
next two months so we can fix issues before the general release. You
should expect runc 1.5.0 to be released at the end of April 2026 (at
which point, runc 1.3.z will only receive high-severity security fixes
for 6 months and runc 1.2.z will become unmaintained -- users are thus
very strongly encouraged to migrate to a newer version).

libcontainer API

• The following deprecated Go APIs have been removed:
  • CleanPath, StripRoot, and WithProcfd from libcontainer/utils. Note
    that WithProcfdFile has not been removed (due to import cycle issues) but
    is instead marked as internal in its godoc comment. (#5051)
  • All of the cgroup-related types and functions from libcontainer/configs
    which are now maintained in github.com/opencontainers/cgroups (#5141):
    • libcontainer/configs.Cgroup
    • libcontainer/configs.Resources
    • libcontainer/configs.FreezerState
    • libcontainer/configs.LinuxRdma
    • libcontainer/configs.BlockIODevice
    • libcontainer/configs.WeightDevice
    • libcontainer/configs.ThrottleDevice
    • libcontainer/configs.HugepageLimit
    • libcontainer/configs.IfPrioMap
    • libcontainer/configs.Undefined
    • libcontainer/configs.Frozen
    • libcontainer/configs.Thawed
    • libcontainer/configs.NewWeightDevice
    • libcontainer/configs.NewThrottleDevice
  • libcontainer/configs.HookList.RunHooks. (#5141)
  • libcontainer/configs.MPOL_* (#5141)
  • All of the types in libcontainer/devices which are now maintained in
    github.com/opencontainers/cgroups/devices/config (#5141):
    • libcontainer/devices.Wildcard
    • libcontainer/devices.WildcardDevice
    • libcontainer/devices.BlockDevice
    • libcontainer/devices.CharDevice
    • libcontainer/devices.FifoDevice
    • libcontainer/devices.Device
    • libcontainer/devices.Permissions
    • libcontainer/devices.Type
    • libcontainer/devices.Rule
• libcontainer.Process methods (Wait, Pid, Signal) and
  libcontainer/configs.Config methods (HostUID, HostRootUID, HostGID,
  HostRootGID) now use pointer receivers. (#5088)
• The example code for libcontainer has been moved out of a README and into
  a proper Example* test file that will be compile-tested by our CI. As
  mentioned elsewhere, we still do not recommend users make use of the
  libcontainer API directly. (#5127)

Deprecated

• The libcontainer/configs.Mount.Relabel configuration field (used to relabel
  mounts with the z and Z "pseudo" mount options) was never accessible
  outside of the libcontainer API, and in practice the relabel logic has always
  lived in higher level runtimes. It has been made into a no-op and the field
  will be removed entirely in runc 1.7. (#5152, #5160)

Removed

• The memfd-bind helper binary has been removed, as it has never been
  particularly useful and was completely obsoleted by the changes to
  /proc/self/exe sealing we introduced in runc 1.2.0. (#5141)

Added

• User-namespaced containers can now configure user.* sysctls. (#4889)
• Intel RDT: the RDT subdirectory is now only removed if runc created it,
  matching the updated runtime-spec guidance. (#3832, #5155)

Changed

• Our release binaries and default build configuration now use libpathrs by
  default, providing better hardening against certain kinds of attacks. Users
  of runc should not see any changes as a result of this, but packagers will
  need to adjust their packaging accordingly. runc can still be built without
  libpathrs (by building without the libpathrs build tag), but we currently
  plan to make runc 1.6 require libpathrs. (#5103)
• runc exec will now request systemd to move the exec process into the
  container cgroup, making the procedure more rootless-friendly. (#4822)
• seccomp: minor documentation updates. (#4902)
• Errors from runc init have historically been quite painful to understand
  and debug, we have made several improvements to make them more comprehensive
  and thus useful when debugging issues. (#4951, #4928)
• Update spec conformance documentation for OCI runtime-spec v1.3.0. (#4948,
  #5150)
• Our release archives now have the name runc-$version.tar.xz to make distro
  packaging a little easier by matching the filename to the top-level directory
  name in the archive. (#5052)

Static Linking Notices

The runc binaries distributed with this release are statically linked with
the following GNU LGPL-2.1 licensed libraries, with runc acting
as a "work that uses the Library":

• libseccomp

Similarly, the runc binaries distributed with this release are also
statically linked with the following MPLv2 licensed libraries,
with runc acting as a "Larger Work":

• libpathrs

The versions of these libraries were not modified from their upstream versions,
but in order to comply with their corresponding licenses, we have attached the
complete source code for those libraries which (when combined with the attached
runc source code) may be used to exercise your rights under their respective
licenses.

However, we strongly suggest that you make use of your distribution's packages
or download them from the authoritative upstream sources, especially since
these libraries are related to the security of your containers.

Thanks to the following contributors for making this release possible:

• Akihiro Suda [email protected]
• Aleksa Sarai [email protected]
• Antti Kervinen [email protected]
• Ariel Otilibili [email protected]
• Arina Cherednik [email protected]
• Curd Becker [email protected]
• Dimitri John Ledkov [email protected]
• Donet Tom [email protected]
• Efim Verzakov [email protected]
• Ismo Puustinen [email protected]
• Joshua Rogers [email protected]
• Kir Kolyshkin [email protected]
• Lei Wang [email protected]
• Li Fubang [email protected]
• Luke Hinds [email protected]
• Markus Lehtonen [email protected]
• Osama Abdelkader [email protected]
• Phil Estes [email protected]
• Ricardo Branco [email protected]
• Rodrigo Campos Catelin [email protected]
• Tianon Gravi [email protected]
• Tycho Andersen [email protected]
• Tõnis Tiigi [email protected]
• Vishal Chourasia [email protected]
• zhaixiaojuan [email protected]

Signed-off-by: Aleksa Sarai [email protected]

憎しみを束ねてもそれは脆い！

[!NOTE] runc v1.5.0-rc.1 includes all of the patches backported to runc v1.4.1.

libcontainer API

• The following deprecated Go APIs have been removed:
  • CleanPath, StripRoot, and WithProcfd from libcontainer/utils. Note that WithProcfdFile has not been removed (due to import cycle issues) but is instead marked as internal in its godoc comment. (#5051)
  • All of the cgroup-related types and functions from libcontainer/configs which are now maintained in github.com/opencontainers/cgroups (#5141):
    • libcontainer/configs.Cgroup
    • libcontainer/configs.Resources
    • libcontainer/configs.FreezerState
    • libcontainer/configs.LinuxRdma
    • libcontainer/configs.BlockIODevice
    • libcontainer/configs.WeightDevice
    • libcontainer/configs.ThrottleDevice
    • libcontainer/configs.HugepageLimit
    • libcontainer/configs.IfPrioMap
    • libcontainer/configs.Undefined
    • libcontainer/configs.Frozen
    • libcontainer/configs.Thawed
    • libcontainer/configs.NewWeightDevice
    • libcontainer/configs.NewThrottleDevice
  • libcontainer/configs.HookList.RunHooks. (#5141)
  • libcontainer/configs.MPOL_* (#5141)
  • All of the types in libcontainer/devices which are now maintained in github.com/opencontainers/cgroups/devices/config (#5141):
    • libcontainer/devices.Wildcard
    • libcontainer/devices.WildcardDevice
    • libcontainer/devices.BlockDevice
    • libcontainer/devices.CharDevice
    • libcontainer/devices.FifoDevice
    • libcontainer/devices.Device
    • libcontainer/devices.Permissions
    • libcontainer/devices.Type
    • libcontainer/devices.Rule
• libcontainer.Process methods (Wait, Pid, Signal) and libcontainer/configs.Config methods (HostUID, HostRootUID, HostGID, HostRootGID) now use pointer receivers. (#5088)
• The example code for libcontainer has been moved out of a README and into a proper Example* test file that will be compile-tested by our CI. As mentioned elsewhere, we still do not recommend users make use of the libcontainer API directly. (#5127)

Deprecated

• The libcontainer/configs.Mount.Relabel configuration field (used to relabel mounts with the z and Z "pseudo" mount options) was never accessible outside of the libcontainer API, and in practice the relabel logic has always lived in higher level runtimes. It has been made into a no-op and the field will be removed entirely in runc 1.7. (#5152, #5160)

Removed

• The memfd-bind helper binary has been removed, as it has never been particularly useful and was completely obsoleted by the changes to /proc/self/exe sealing we introduced in runc [1.2.0][]. (#5141)

Added

• User-namespaced containers can now configure user.* sysctls. (#4889)
• Intel RDT: the RDT subdirectory is now only removed if runc created it, matching the updated runtime-spec guidance. (#3832, #5155)

Changed

• Our release binaries and default build configuration now use libpathrs by default, providing better hardening against certain kinds of attacks. Users of runc should not see any changes as a result of this, but packagers will need to adjust their packaging accordingly. runc can still be built without libpathrs (by building without the libpathrs build tag), but we currently plan to make runc 1.6 require libpathrs. (#5103)
• runc exec will now request systemd to move the exec process into the container cgroup, making the procedure more rootless-friendly. (#4822)
• seccomp: minor documentation updates. (#4902)
• Update spec conformance documentation for OCI runtime-spec v1.3.0. (#4948, #5150)
• Our release archives now have the name runc-$version.tar.xz to make distro packaging a little easier by matching the filename to the top-level directory name in the archive. (#5052)

runc v1.5.0-rc.1 -- "憎しみを束ねてもそれは脆い！" Pre-release

Pre-release

Compare

Choose a tag to compare

This is the third patch release of the 1.4.z series of runc. Among some
performance improvements and bugfixes, it includes a fix for a
low-severity vulnerability (CVE-2026-41579) and users are encouraged to
update. As it was a low-severity vulnerability and it was reported by
multiple people, we decided to release it publicly with NO EMBARGO.

Security

This release includes a fix for the following low-severity security issue:

• CVE-2026-41579 allowed a malicious image with a /dev symlink to have
  limited write access to the host filesystem in ways that our analysis
  indicates was too limited to be problematic in practice. This bug was very
  similar to those fixed in CVE-2025-31133, CVE-2025-52565,
  CVE-2025-31133 and was simply missed at the time when we hardened the
  rootfs preparation code. We have conducted a deeper audit and not found any
  other problematic cases.

Fixed

• Various integration test improvements. (#5222, #5237, #5226, #5229, #5239,
  #5249, #5269, #5287, #5295, #5304)

Changed

• When masking directories with maskPaths, runc will now re-use a single
  tmpfs instance (which is not writable) to reduce the number tmpfs
  superblocks that need to be reaped when containers die (in particular,
  Kubernetes applies masks to per-CPU sysfs directories which get expensive
  quickly). (#5275, #5281)

Static Linking Notices

The runc binary distributed with this release are statically linked with
the following GNU LGPL-2.1 licensed libraries, with runc acting
as a "work that uses the Library":

• libseccomp

The versions of these libraries were not modified from their upstream versions,
but in order to comply with the LGPL-2.1 (§6(a)), we have attached the
complete source code for those libraries which (when combined with the attached
runc source code) may be used to exercise your rights under the LGPL-2.1.

However we strongly suggest that you make use of your distribution's packages
or download them from the authoritative upstream sources, especially since
these libraries are related to the security of your containers.

Thanks to the following contributors for making this release possible:

• Akihiro Suda [email protected]
• Aleksa Sarai [email protected]
• Ayato Tokubi [email protected]
• Davanum Srinivas [email protected]
• Kevin Berry [email protected]
• Kir Kolyshkin [email protected]
• Li Fubang [email protected]
• Ricardo Branco [email protected]
• Rodrigo Campos Catelin [email protected]
• Tianon Gravi [email protected]

Signed-off-by: Aleksa Sarai [email protected]

The best way to irritate him is to feed his grandmother to the Ravenous Bugblatter Beast of Traal.

Security

This release includes a fix for the following low-severity security issue:

• CVE-2026-41579 allowed a malicious image with a /dev symlink to have limited write access to the host filesystem in ways that our analysis indicates was too limited to be problematic in practice. This bug was very similar to those fixed in [CVE-2025-31133][], [CVE-2025-52565][], [CVE-2025-31133][] and was simply missed at the time when we hardened the rootfs preparation code. We have conducted a deeper audit and not found any other problematic cases.

Fixed

• Various integration test improvements. (#5222, #5237, #5226, #5229, #5239, #5249, #5269, #5287, #5295, #5304)

Changed

• When masking directories with maskPaths, runc will now reuse a single tmpfs instance (which is not writable) to reduce the number tmpfs superblocks that need to be reaped when containers die (in particular, Kubernetes applies masks to per-CPU sysfs directories which get expensive quickly). (#5275, #5281)

runc 1.4.3 -- "The best way to irritate him is to feed his grandmother to the Ravenous Bugblatter Beast of Traal."

Compare

Choose a tag to compare

This is the second patch release of the 1.4.z release series of runc.

Fixed

• A regression in runc v1.3.0 which can result in a stuck runc exec or
  runc run when the container process runs for a short time. (#5208,
  #5210, #5216)

• Mount sources that need to be open on the host are now closed earlier during
  container start, reducing the total amount of used file descriptors and
  helping to avoid hitting the open files limit when handling many such mounts.
  (#5177, #5201)

Static Linking Notices

The runc binary distributed with this release are statically linked with
the following GNU LGPL-2.1 licensed libraries, with runc acting
as a "work that uses the Library":

• libseccomp

The versions of these libraries were not modified from their upstream versions,
but in order to comply with the LGPL-2.1 (§6(a)), we have attached the
complete source code for those libraries which (when combined with the attached
runc source code) may be used to exercise your rights under the LGPL-2.1.

However we strongly suggest that you make use of your distribution's packages
or download them from the authoritative upstream sources, especially since
these libraries are related to the security of your containers.

Thanks to the following contributors for making this release possible:

• Ayato Tokubi [email protected]
• Akihiro Suda [email protected]
• Aleksa Sarai [email protected]
• Kir Kolyshkin [email protected]
• Li Fubang [email protected]
• Rodrigo Campos Catelin [email protected]

Signed-off-by: Kir Kolyshkin [email protected]

Я — Земля! Я своих провожаю питомцев.

Fixed

• A regression in runc v1.3.0 which can result in a stuck runc exec or runc run when the container process runs for a short time. (#5208, #5210, #5216)
• Mount sources that need to be open on the host are now closed earlier during container start, reducing the total amount of used file descriptors and helping to avoid hitting the open files limit when handling many such mounts. (#5177, #5201)

runc v1.4.2 -- "Я — Земля! Я своих провожаю питомцев"

Compare

Choose a tag to compare

This is the first patch release of the 1.4.z release series of runc.
It primarily includes some fixes for issues found in 1.4.0.

Deprecated

• libcontainer/configs.MPOL_* constants added in runc 1.4.0. (#5110, #5055)

Added

• Preliminary loong64 support. (#5062, #4938)

Fixed

• libct: fix panic in initSystemdProps when processing certain systemd
  properties in the OCI spec. (#5161, #5133)
• libct: fix several file descriptor leaks on error paths. (#5168, #5009)
• Remove unnecessary crypto/tls dependency by open-coding the systemd socket
  activation logic, allowing us to more easily avoid false positive CVE
  warnings. (#5093, #5057)
• Remove legacy os.Is* error usage, improving error type detection to make
  our error fallback paths more robust. (#5162, #5061)
• Go 1.26 has started enforcing a restriction of os/exec.Cmd which caused
  issues with our usage of CLONE_INTO_CGROUP (on newer kernels). This has now
  been resolved. (#5116, #5091)
• Recursive atime-related mount flags (rrelatime et al.) are now applied
  properly. (#5114, #5098)
• Fix a regression in runc exec due to CLONE_INTO_CGROUP in the
  (inadvisable) scenario where a container is configured without cgroup
  namespaces and with /sys/fs/cgroup mounted rw. (#5117, #5101)
• On machines with more than 1024 CPU cores, our logic for resetting the CPU
  affinity will now correctly reset the affinity onto all available cores
  (not just the first 1024). (#5149, #5025)
• PR #4757 caused a regression that resulted in spurious
  cannot start a container that has stopped errors when running
  runc create and has thus been reverted. (#5157, #5153, #5151, #4645, #4757)

Changed

• Previously we made an attempt to make our runc.armhf release binaries work
  with ARMv6 (which would allow runc to work on the original Raspberry Pi).
  Unfortunately, this has effectively always been broken (because we
  cross-compile libseccomp within a Debian container and statically link to
  it) and so we are now officially matching the Debian definition of armhf
  (that is, ARMv7). (#5167, #5103)
• Minor signing keyring updates. (#5147, #5139, #5144, #5148)

Static Linking Notices

The runc binary distributed with this release are statically linked with
the following GNU LGPL-2.1 licensed libraries, with runc acting
as a "work that uses the Library":

• libseccomp

The versions of these libraries were not modified from their upstream versions,
but in order to comply with the LGPL-2.1 (§6(a)), we have attached the
complete source code for those libraries which (when combined with the attached
runc source code) may be used to exercise your rights under the LGPL-2.1.

However we strongly suggest that you make use of your distribution's packages
or download them from the authoritative upstream sources, especially since
these libraries are related to the security of your containers.

Thanks to the following contributors for making this release possible:

• Akihiro Suda [email protected]
• Aleksa Sarai [email protected]
• Antti Kervinen [email protected]
• Ariel Otilibili [email protected]
• Arina Cherednik [email protected]
• Curd Becker [email protected]
• Dimitri John Ledkov [email protected]
• Efim Verzakov [email protected]
• Kir Kolyshkin [email protected]
• Li Fu Bang [email protected]
• Luke Hinds [email protected]
• Ricardo Branco [email protected]
• Rodrigo Campos [email protected]
• Zhai Xiao Juan [email protected]

La guerre n'est pas une aventure. La guerre est une maladie. Comme le typhus.

Deprecated

• libcontainer/configs.MPOL_* constants added in runc [1.4.0][]. (#5110, #5055)

Added

• Preliminary loong64 support. (#5062, #4938)

Fixed

• libct: fix panic in initSystemdProps when processing certain systemd properties in the OCI spec. (#5161, #5133)
• libct: fix several file descriptor leaks on error paths. (#5168, #5009)
• Remove unnecessary crypto/tls dependency by open-coding the systemd socket activation logic, allowing us to more easily avoid false positive CVE warnings. (#5093, #5057)
• Remove legacy os.Is* error usage, improving error type detection to make our error fallback paths more robust. (#5162, #5061)
• Go 1.26 has started enforcing a restriction of os/exec.Cmd which caused issues with our usage of CLONE_INTO_CGROUP (on newer kernels). This has now been resolved. (#5116, #5091)
• Recursive atime-related mount flags (rrelatime et al.) are now applied properly. (#5114, #5098)
• Fix a regression in runc exec due to CLONE_INTO_CGROUP in the (inadvisable) scenario where a container is configured without cgroup namespaces and with /sys/fs/cgroup mounted rw. (#5117, #5101)
• On machines with more than 1024 CPU cores, our logic for resetting the CPU affinity will now correctly reset the affinity onto all available cores (not just the first 1024). (#5149, #5025)
• PR #4757 caused a regression that resulted in spurious cannot start a container that has stopped errors when running runc create and has thus been reverted. (#5157, #5153, #5151, #4645, #4757)

Changed

• Previously we made an attempt to make our runc.armhf release binaries work with ARMv6 (which would allow runc to work on the original Raspberry Pi). Unfortunately, this has effectively always been broken (because we cross-compile libseccomp within a Debian container and statically link to it) and so we are now officially matching the Debian definition of armhf (that is, ARMv7). (#5167, #5103)
• Minor signing keyring updates. (#5147, #5139, #5144, #5148)

runc v1.4.1 -- "La guerre n'est pas une aventure. La guerre est une maladie. Comme le typhus."

Compare

Choose a tag to compare

路漫漫其修远兮，吾将上下而求索！

Deprecated

• Deprecate cgroup v1. (#4956)
• Deprecate CleanPath, StripRoot, WithProcfd, and WithProcfdFile from libcontainer/utils. (#4985)

Breaking

• The handling of pids.limit has been updated to match the newer guidance from the OCI runtime specification. In particular, now a maximum limit value of 0 will be treated as an actual limit (due to limitations with systemd, it will be treated the same as a limit value of 1). We only expect users that explicitly set pids.limit to 0 will see a behaviour change. (opencontainers/cgroups#48, #4949)

Fixed

• cgroups: provide iocost statistics for cgroupv2. (opencontainers/cgroups#43)
• cgroups: retry DBus connection when it fails with EAGAIN. (opencontainers/cgroups#45)
• cgroups: improve cpuacct.usage_all resilience when parsing data from patched kernels (such as the Tencent kernels). (opencontainers/cgroups#46, opencontainers/cgroups#50)
• libct: close child fds on prepareCgroupFD error. (#4936)
• libct: fix mips compilation. (#4962, #4967)
• When configuring a tmpfs mount, only set the mode= argument if the target path already existed. This fixes a regression introduced in our CVE-2025-52881 mitigation patches. (#4971, #4973, #4976)
• Fix various file descriptor leaks and add additional tests to detect them as comprehensively as possible. (#5007, #5021, #5026, #5034)
• The "hallucination" helpers added as part of the CVE-2025-52881 mitigation have been made more generic and now apply to all of our pathrs helper functions, which should ensure we will not regress dangling symlink users. (#4985)

Changed

• libct: switch to (*CPUSet).Fill. (#4927)
• docs/spec-conformance.md: update for spec v1.3.0. (#4948)
• Errors from runc init have historically been quite painful to understand and debug, we have made several improvements to make them more comprehensive and thus useful when debugging issues. (#5040, #4951, #4928)

その日、人類は思い出した。

Security

This release includes fixes for the following high-severity security issues:

• CVE-2025-31133 exploits an issue with how masked paths are implemented in runc. When masking files, runc will bind-mount the container's /dev/null inode on top of the file. However, if an attacker can replace /dev/null with a symlink to some other procfs file, runc will instead bind-mount the symlink target read-write. This issue affected all known runc versions.

• CVE-2025-52565 is very similar in concept and application to CVE-2025-31133, except that it exploits a flaw in /dev/console bind-mounts. When creating the /dev/console bind-mount (to /dev/pts/$n), if an attacker replaces /dev/pts/$n with a symlink then runc will bind-mount the symlink target over /dev/console. This issue affected all versions of runc >= 1.0.0-rc3.

• CVE-2025-52881 is a more sophisticated variant of CVE-2019-19921, which was a flaw that allowed an attacker to trick runc into writing the LSM process labels for a container process into a dummy tmpfs file and thus not apply the correct LSM labels to the container process. The mitigation we applied for CVE-2019-19921 was fairly limited and effectively only caused runc to verify that when we write LSM labels that those labels are actual procfs files. This issue affects all known runc versions.

Fixed

• Switched to (*CPUSet).Fill rather than our hacky optimisation when resetting the CPU affinity of runc. (#4926, #4927)
• Correctly close child fds during (*setns).start if an error occurs. (#4930, #4936)

私の役目は信じるかどうかではない。行うかどうかだ。

libcontainer API

• The deprecated libcontainer/userns package has been removed; use github.com/moby/sys/userns instead. (#4910, #4911)

Added

• Allow setting user.* sysctls for user-namespaced containers, as they are namespaced and thus safe to configure. (#4889, #4892)
• Add support for using clone3(2)'s CLONE_INTO_CGROUP flag when configuring the runc exec process. This also included some internal changes to how we add processes to containers. (#4822, #4812, #4920)
• Add support for configuring the NUMA pmemory policy for a container with set_mempolicy(2). (opencontainers/runtime-spec#1282, #4726, #4915)
• Add support for intelRdt.schemata to allow for configuration of all schemas in resctrl. (opencontainers/runtime-spec#1230, #4830, #4915)
• Add support for intelRdt.enableMonitoring to allow for per-container resctrl monitoring. This replaces the old intelRdt.enableCMT and intelRdt.enableMBM options which were never implemented by runc and have been removed from the runtime-spec. (opencontainers/runtime-spec#1287, #4832, #4921)

Fixed

• Configure personality(2) before applying seccomp profiles. (#4900, #4903)
• Fixed integration test failure on ppc64, caused by 64K page size so the kernel was rounding memory limit to 64K. (#4841, #4895, #4893)
• seccompagent: fix fd close loop to prevent closing stdio in the error path. (#4913, #4923)