おめェもボスになったんだろぉ？

This version of runc requires Go 1.24 to build.

libcontainer API

• The deprecated libcontainer/user package has been removed; use github.com/moby/sys/user instead. (#3999, #4617)
• libcontainer/apparmor variables containing public functions have been switched to wrapper functions. (#4725)

Breaking

• runc update no longer allows --l3-cache-schema or --mem-bw-schema if linux.intelRdt was not present in the container’s original config.json.

  Without linux.intelRdt no CLOS (resctrl group) is created at container creation, so it is not possible to apply the updated options with runc update.

  Previously, this scenario did not work as expected. The runc update would create a new CLOS but fail to apply the schema, move only the init process (omitting children) to the new group, and leave the CLOS orphaned after container exit. (#4827)

• The deprecated --criu flag has been removed entirely, instead the criu binary in $PATH will be used. (#4722)

Added

• runc now supports the linux.netDevices field to allow for devices to be moved into container network namespaces seamlessly. (#4538)
• runc update now supports per-device weight and iops cgroup limits. (#4775)
• intel rdt: allow explicit assignment to root CLOS. (#4854)

Fixed

• Container processes will no longer inherit the CPU affinity of runc by default. Instead, the default CPU affinity of container processes will be the largest set of CPUs permitted by the container's cpuset cgroup and any other system restrictions (such as isolated CPUs). (#4041, #4815, #4858)
• Use chown(uid, -1) when configuring the console inode, to avoid issues with unmapped GIDs. (#4679)
• Add logging for the cases where failed keyring operations are ignored during setup. (#4676)
• Optimise runc exec by avoiding calling into SELinux's Set.*Label when processLabel is not set. (#4354)
• Fix mips64 builds for remap-rootfs. (#4723)
• Setting linux.rootfsPropagation to shared or unbindable now functions properly. (#1755, #1815, #4724)
• runc delete and runc stop can now correctly handle cases where runc create was killed during setup. Previously it was possible for the container to be in such a state that neither runc stop nor runc delete would be unable to kill or delete the container. (#4534, #4645, #4757)
• Close seccomp agent connection to prevent resource leaks. (#4796)
• runc update will no longer clear intelRdt state information. (#4828)
• runc will now error out earlier if intelRdt is not enabled. (#4829)
• Improve filesystem operations within intelRdt manager. (#4840, #4831)
• Resolve a certain race between runc create and runc delete that would previously result in spurious errors. (#4735)
• CI: skip bpf tests on misbehaving udev systems. (#4825)

Changes

• Use Go's built-in pidfd_send_signal(2) support when available. (#4666)
• Make state.json 25% smaller. (#4685)
• Migrate to Go 1.22+ features. (#4687, #4703)
• Provide private wrappers around common syscalls to make -EINTR handling less cumbersome for the rest of runc. (#4697)
• Ignore the dmem controller in our cgroup tests, as systemd does not yet support it. (#4806)
• /proc/net/dev is no longer included in the permitted procfs overmount list. Its inclusion was almost certainly an error, and because /proc/net is a symlink to /proc/self/net, overmounting this was almost certainly never useful (and will be blocked by future kernel versions). (#4817)
• Simplify the prepareCriuRestoreMounts logic for checkpoint-restore. (#4765)
• Bump minimum Go version to 1.24. (#4851)
• CI: migrate virtualised Fedora tests from Vagrant + Cirrus to Lima + GHA. We still use Cirrus for the AlmaLinux tests, since they can be run without virtualisation. (#4664)
• CI: install fewer dependencies (#4671), bump shellcheck and bats versions (#4670).
• CI: remove toolchain from go.mod and add a CI check to make sure it's never added accidentally. (#4717, #4721)
• CI: do not allow exclude or replace directives in go.mod, to make sure that go install doesn't get accidentally broken. (#4750)
• CI: fix exclusion rules and allow us to run jobs manually. (#4760)
• CI: Switch to GitHub-hosted ARM runners. Thanks again to @alexellis for supporting runc's ARM CI up until now. (#4844, #4856)
• Various dependency updates. (#4659, #4658, #4662, #4663, #4689, #4694, #4702, #4701, #4707, #4710, #4746, #4756, #4751, #4758, #4764, #4768, #4779, #4783, #4785, #4801, #4808, #4803, #4839, #4846, #4847, #4845, #4850, #4861, #4860)

This is the sixth patch release of the 1.3.z series of runc. Among some
performance improvements and bugfixes, it includes a fix for a
low-severity vulnerability (CVE-2026-41579) and users are encouraged to
update. As it was a low-severity vulnerability and it was reported by
multiple people, we decided to release it publicly with NO EMBARGO.

Security

This release includes a fix for the following low-severity security issue:

• CVE-2026-41579 allowed a malicious image with a /dev symlink to have
  limited write access to the host filesystem in ways that our analysis
  indicates was too limited to be problematic in practice. This bug was very
  similar to those fixed in CVE-2025-31133, CVE-2025-52565,
  CVE-2025-31133 and was simply missed at the time when we hardened the
  rootfs preparation code. We have conducted a deeper audit and not found any
  other problematic cases.

  This patchset required backports for #5190 and #5285, which were primarily
  code reorganisations that were already backported to runc 1.4 and 1.5.

Fixed

• A regression in runc v1.3.0 which can result in a stuck runc exec or
  runc run when the container process runs for a short time. (#5208,
  #5210, #5215)
• Various integration test improvements. (#5159, #5188, #5226, #5228, #5239,
  #5253, #5269, #5288)

Changed

• When masking directories with maskPaths, runc will now re-use a single
  tmpfs instance (which is not writable) to reduce the number tmpfs
  superblocks that need to be reaped when containers die (in particular,
  Kubernetes applies masks to per-CPU sysfs directories which get expensive
  quickly). (#5275, #5281)

Static Linking Notices

The runc binary distributed with this release are statically linked with
the following GNU LGPL-2.1 licensed libraries, with runc acting
as a "work that uses the Library":

• libseccomp

The versions of these libraries were not modified from their upstream versions,
but in order to comply with the LGPL-2.1 (§6(a)), we have attached the
complete source code for those libraries which (when combined with the attached
runc source code) may be used to exercise your rights under the LGPL-2.1.

However we strongly suggest that you make use of your distribution's packages
or download them from the authoritative upstream sources, especially since
these libraries are related to the security of your containers.

---

Thanks to the following contributors for making this release possible:

• Aleksa Sarai cyphar@cyphar.com
• Ayato Tokubi atokubi@redhat.com
• Davanum Srinivas davanum@gmail.com
• Kevin Berry kpberry11@gmail.com
• Kir Kolyshkin kolyshkin@gmail.com
• Ricardo Branco rbranco@suse.de
• Rodrigo Campos Catelin rodrigo@amutable.com
• Li Fubang lifubang@acmcoder.com

Signed-off-by: Aleksa Sarai cyphar@cyphar.com

This is the fifth patch release of the 1.3.z release series of runc,
and primarily contains a few fixes for issues found in 1.3.4.

Fixed

• Recursive atime-related mount flags (rrelatime et al.) are now applied
  properly. (#5115, #5098)
• PR #4757 caused a regression that resulted in spurious
  cannot start a container that has stopped errors when
  running runc create and has thus been reverted. (#5158,
  #5153, #5151, #4645, #4757)

Changed

• Updated builds to Go 1.25, libseccomp v2.6.0. (#5111, #5053)
• Minor signing keyring updates. (#5146, #5139, #5144, #5148)

Static Linking Notices

The runc binary distributed with this release are statically linked with
the following GNU LGPL-2.1 licensed libraries, with runc acting
as a "work that uses the Library":

• libseccomp

The versions of these libraries were not modified from their upstream versions,
but in order to comply with the LGPL-2.1 (§6(a)), we have attached the
complete source code for those libraries which (when combined with the attached
runc source code) may be used to exercise your rights under the LGPL-2.1.

However we strongly suggest that you make use of your distribution's packages
or download them from the authoritative upstream sources, especially since
these libraries are related to the security of your containers.

---

Thanks to the following contributors for making this release possible:

• Aleksa Sarai cyphar@cyphar.com
• Kir Kolyshkin kolyshkin@gmail.com
• Li Fu Bang lifubang@acmcoder.com
• Ricardo Branco rbranco@suse.de

Take me to your heart, take me to your soul.

Fixed

• libct: fix mips compilation. (#4962, #4966)
• When configuring a tmpfs mount, only set the mode= argument if the target path already existed. This fixes a regression introduced in our CVE-2025-52881 mitigation patches. (#4971, #4973, #4976)
• Fix various file descriptor leaks and add additional tests to detect them as comprehensively as possible. (#5007, #5021, #5026, #5034)

Changed

• Downgrade github.com/cyphar/filepath-securejoin dependency to v0.5.2, which should make it easier for some downstreams to import runc without pulling in too many extra packages. (#5028)

奴らに支配されていた恐怖を

Security

This release includes fixes for the following high-severity security issues:

• CVE-2025-31133 exploits an issue with how masked paths are implemented in runc. When masking files, runc will bind-mount the container's /dev/null inode on top of the file. However, if an attacker can replace /dev/null with a symlink to some other procfs file, runc will instead bind-mount the symlink target read-write. This issue affected all known runc versions.

• CVE-2025-52565 is very similar in concept and application to CVE-2025-31133, except that it exploits a flaw in /dev/console bind-mounts. When creating the /dev/console bind-mount (to /dev/pts/$n), if an attacker replaces /dev/pts/$n with a symlink then runc will bind-mount the symlink target over /dev/console. This issue affected all versions of runc >= 1.0.0-rc3.

• CVE-2025-52881 is a more sophisticated variant of CVE-2019-19921, which was a flaw that allowed an attacker to trick runc into writing the LSM process labels for a container process into a dummy tmpfs file and thus not apply the correct LSM labels to the container process. The mitigation we applied for CVE-2019-19921 was fairly limited and effectively only caused runc to verify that when we write LSM labels that those labels are actual procfs files. This issue affects all known runc versions.

Added

• runc update now supports configuring per-device weights and iops. (#4775, #4807, #4825, #4931)

Ночь, улица, фонарь, аптека...

Changed

• The conversion from cgroup v1 CPU shares to cgroup v2 CPU weight is improved to better fit default v1 and v2 values. (#4772, #4785, #4897)
• Dependency github.com/opencontainers/cgroups updated from v0.0.1 to v0.0.4. (#4897)

Fixed

• runc state: fix occasional "cgroup.freeze: no such device" error. (#4798, #4808, #4897)
• Fixed integration test failure on ppc64, caused by 64K page size so the kernel was rounding memory limit to 64K. (#4841, #4895, #4893)

この瓦礫の山でよぉ

Fixed

• Container processes will no longer inherit the CPU affinity of runc by default. Instead, the default CPU affinity of container processes will be the largest set of CPUs permitted by the container's cpuset cgroup and any other system restrictions (such as isolated CPUs). (#4041, #4815, #4858)
• Setting linux.rootfsPropagation to shared or unbindable now functions properly. (#1755, #1815, #4724, #4789)
• Close seccomp agent connection to prevent resource leaks. (#4796, #4799)
• runc delete and runc stop can now correctly handle cases where runc create was killed during setup. Previously it was possible for the container to be in such a state that neither runc stop nor runc delete would be unable to kill or delete the container. (#4534, #4645, #4757, #4793)
• runc update will no longer clear intelRdt state information. (#4828, #4833)
• CI: Fix exclusion rules and allow us to run jobs manually. (#4760, #4763)

Changed

• Improvements to the deprecation warnings as part of the github.com/opencontainers/cgroups split. (#4784, #4788)
• Ignore the dmem controller in our cgroup tests, as systemd does not yet support it. (#4806, #4811)
• /proc/net/dev is no longer included in the permitted procfs overmount list. Its inclusion was almost certainly an error, and because /proc/net is a symlink to /proc/self/net, overmounting this was almost certainly never useful (and will be blocked by future kernel versions). (#4817, #4820)
• Simplify the prepareCriuRestoreMounts logic for checkpoint-restore. (#4765, #4871)
• CI: Bump golangci-lint to v2.1. (#4747, #4754)
• CI: Switch to GitHub-hosted ARM runners. Thanks again to @alexellis for supporting runc's ARM CI up until now. (#4844, #4856, #4866)

Mr. President, we must not allow a mine shaft gap!

Fixed

• Removed preemptive "full access to cgroups" warning when calling runc pause or runc unpause as an unprivileged user without --systemd-cgroups. Now the warning is only emitted if an actual permission error was encountered. (#4709)
• Several fixes to our CI, mainly related to AlmaLinux and CRIU. (#4670, #4728, #4736)

Changed

• In runc 1.2, we changed our mount behaviour to correctly handle clearing flags. However, the error messages we returned did not provide as much information to users about what clearing flags were conflicting with locked mount flags. We now provide more diagnostic information if there is an error when in the fallback path to handle locked mount flags. (#4734)
• Upgrade our CI to use golangci-lint v2.0. (#4692)
• runc version information is now filled in using //go:embed rather than being set through Makefile. This allows go install or other non-make builds to contain the correct version information. Note that make EXTRA_VERSION=... still works. (#418)
• Remove exclude directives from our go.mod for broken cilium/ebpf versions. v0.17.3 resolved the issue we had, and exclude directives are incompatible with go install. (#4748)

Eppur si muove.

Fixed

• Use the container's /etc/passwd to set the HOME env var. After a refactor for 1.3, we were setting it reading the host's /etc/passwd file instead. (#4693, #4688)
• Override HOME env var if it's set to the empty string. This fixes a regression after the same refactor for 1.3 and aligns the behavior with older versions of runc. (#4711)
• Add time namespace to container config after checkpoint/restore. CRIU since version 3.14 uses a time namespace for checkpoint/restore, however it was not joining the time namespace in runc. (#4705)