github.com/opencontainers/runc

No tengo miedo al invierno, con tu recuerdo lleno de sol.

libcontainer API

• configs.CommandHook struct has changed, Command is now a pointer. Also, configs.NewCommandHook now accepts a *Command. (#4325)
• The Process struct has User string field replaced with numeric UID and GID fields, and AdditionalGroups changed its type from []string to []int. Essentially, resolution of user and group names to IDs is no longer performed by libcontainer, so if a libcontainer user previously relied on this feature, now they have to convert names to IDs before calling libcontainer; it is recommended to use Go package github.com/moby/sys/user for that. (#3999)
• Move libcontainer/cgroups to a separate repository. (#4618)

Fixed

• runc exec -p no longer ignores specified ioPriority and scheduler settings. Similarly, libcontainer's Container.Start and Container.Run methods no longer ignore Process.IOPriority and Process.Scheduler settings. (#4585)
• We no longer use F_SEAL_FUTURE_WRITE when sealing the runc binary, as it turns out this had some unfortunate bugs in older kernel versions and was never necessary in the first place. (#4641, #4640)
• runc now uses a more flexible method of joining namespaces, which better matches the behaviour of nsenter(8). This is mainly useful for users that create a container with a runc-managed user namespace but want the container to join some externally-managed namespace as well. (#4492)
• runc now properly handles joining time namespaces (such as with runc exec). Previously we would attempt to set the time offsets when joining, which would fail. (#4635, #4636)
• Handle EINTR retries correctly for socket-related direct golang.org/x/sys/unix system calls. (#4637)
• Handle close_range(2) errors more gracefully. (#4596)
• Fix a stall issue that would happen if setting O_CLOEXEC with CloseExecFrom failed (#4599).
• Handle errors on older kernels when resetting ambient capabilities more gracefully. (#4597)

Changed

• runc now has an official release policy to help provide more consistency around our release schedules and better define our support policy for old release branches. See RELEASES.md for more details. (#4557)
• Improved performance by switching to strings.Cut where appropriate. (#4470)
• The minimum Go version of runc is now Go 1.23. (#4598)
• Updated builds to libseccomp v2.5.6. (#4625)

Added

• runc has been updated to support OCI runtime-spec 1.2.1. (#4653)
• CPU affinity support for runc exec. (#4327)
• CRIU support can be disabled using the build tag runc_nocriu. (#4546)
• Support to get the pidfd of the container via CLI flag pidfd-socket. (#4045)
• Support skip-in-flight and link-remap options for CRIU. (#4627)
• Support cgroup v1 mounted with noprefix. (#4513)

Stars hide your fires, let me rest tonight.

Fixed

• libct: fix mips compilation. (#4962, #4965)
• When configuring a tmpfs mount, only set the mode= argument if the target path already existed. This fixes a regression introduced in our CVE-2025-52881 mitigation patches. (#4971, #4974)
• Fix various file descriptor leaks and add additional tests to detect them as comprehensively as possible. (#5007, #5021, #5026, #5027)

Changed

• Downgrade github.com/cyphar/filepath-securejoin dependency to v0.5.2, which should make it easier for some downstreams to import runc without pulling in too many extra packages. (#5027)

鳥籠の中に囚われた屈辱を

Security

This release includes fixes for the following high-severity security issues:

• CVE-2025-31133 exploits an issue with how masked paths are implemented in runc. When masking files, runc will bind-mount the container's /dev/null inode on top of the file. However, if an attacker can replace /dev/null with a symlink to some other procfs file, runc will instead bind-mount the symlink target read-write. This issue affected all known runc versions.

• CVE-2025-52565 is very similar in concept and application to CVE-2025-31133, except that it exploits a flaw in /dev/console bind-mounts. When creating the /dev/console bind-mount (to /dev/pts/$n), if an attacker replaces /dev/pts/$n with a symlink then runc will bind-mount the symlink target over /dev/console. This issue affected all versions of runc >= 1.0.0-rc3.

• CVE-2025-52881 is a more sophisticated variant of CVE-2019-19921, which was a flaw that allowed an attacker to trick runc into writing the LSM process labels for a container process into a dummy tmpfs file and thus not apply the correct LSM labels to the container process. The mitigation we applied for CVE-2019-19921 was fairly limited and effectively only caused runc to verify that when we write LSM labels that those labels are actual procfs files. This issue affects all known runc versions.

さんをつけろよデコ助野郎！

Fixed

• Removed preemptive "full access to cgroups" warning when calling runc pause or runc unpause as an unprivileged user without --systemd-cgroups. Now the warning is only emitted if an actual permission error was encountered. (#4709, #4720)
• Add time namespace to container config after checkpoint/restore. CRIU since version 3.14 uses a time namespace for checkpoint/restore, however it was not joining the time namespace in runc. (#4696, #4714)
• Container processes will no longer inherit the CPU affinity of runc by default. Instead, the default CPU affinity of container processes will be the largest set of CPUs permitted by the container's cpuset cgroup and any other system restrictions (such as isolated CPUs). (#4041, #4815, #4858)
• Close seccomp agent connection to prevent resource leaks. (#4796, #4800)
• Several fixes to our CI, mainly related to AlmaLinux and CRIU. (#4670, #4728, #4736, #4742)
• Setting linux.rootfsPropagation to shared or unbindable now functions properly. (#1755, #1815, #4724, #4791)
• runc update will no longer clear intelRdt state information. (#4828, #4834)

Changed

• In runc 1.2, we changed our mount behaviour to correctly handle clearing flags. However, the error messages we returned did not provide as much information to users about what clearing flags were conflicting with locked mount flags. We now provide more diagnostic information if there is an error when in the fallback path to handle locked mount flags. (#4734, #4740)
• Ignore the dmem controller in our cgroup tests, as systemd does not yet support it. (#4806, #4811)
• /proc/net/dev is no longer included in the permitted procfs overmount list. Its inclusion was almost certainly an error, and because /proc/net is a symlink to /proc/self/net, overmounting this was almost certainly never useful (and will be blocked by future kernel versions). (#4817, #4820)
• CI: Switch to GitHub-hosted ARM runners. Thanks again to @alexellis for supporting runc's ARM CI up until now. (#4844, #4856, #4867)
• Simplify the prepareCriuRestoreMounts logic for checkpoint-restore. (#4765, #4872)

Hasta la victoria, siempre.

Fixed

• Fix a stall issue that would happen if setting O_CLOEXEC with CloseExecFrom failed (#4647).
• runc now properly handles joining time namespaces (such as with runc exec). Previously we would attempt to set the time offsets when joining, which would fail. (#4635, #4649)
• Handle EINTR retries correctly for socket-related direct golang.org/x/sys/unix system calls. (#4650)
• We no longer use F_SEAL_FUTURE_WRITE when sealing the runc binary, as it turns out this had some unfortunate bugs in older kernel versions and was never necessary in the first place. (#4651, #4640)

Removed

• Remove Fexecve helper from libcontainer/system. Runc 1.2.1 removed runc-dmz, but we forgot to remove this helper added only for that. (#4646)

Changed

• Use Go 1.23 for official builds, run CI with Go 1.24 and drop Ubuntu 20.04 from CI. We need to drop Ubuntu 20.04 from CI because Github Actions announced it's already deprecated and it will be discontinued soon. (#4648)

Мороз и солнце; день чудесный!

Fixed

• There was a regression in systemd v230 which made the way we define device rule restrictions require a systemctl daemon-reload for our transient units. This caused issues for workloads using NVIDIA GPUs. Workaround the upstream regression by re-arranging how the unit properties are defined. (#4568, #4612, #4615)
• Dependency github.com/cyphar/filepath-securejoin is updated to v0.4.1, allowing projects that vendor runc to bump it as well. (#4608)
• CI: fixed criu-dev compilation. (#4611)

Changed

• Dependency golang.org/x/net is updated to 0.33.0. (#4632)

Христос се роди!

Fixed

• Re-add tun/tap devices to built-in allowed devices lists.

  In runc 1.2.0 we removed these devices from the default allow-list (which were added seemingly by accident early in Docker's history) as a precaution in order to try to reduce the attack surface of device inodes available to most containers (#3468). At the time we thought that the vast majority of users using tun/tap would already be specifying what devices they need (such as by using --device with Docker/Podman) as opposed to doing the mknod manually, and thus there would've been no user-visible change.

  Unfortunately, it seems that this regressed a noticeable number of users (and not all higher-level tools provide easy ways to specify devices to allow) and so this change needed to be reverted. Users that do not need these devices are recommended to explicitly disable them by adding deny rules in their container configuration. (#4555, #4556)

Winter is not a season, it's a celebration.

Fixed

• Fixed a regression in use of securejoin.MkdirAll, where multiple runc processes racing to create the same mountpoint in a shared rootfs would result in spurious EEXIST errors. In particular, this regression caused issues with BuildKit. (#4543, #4550)
• Fixed a regression in eBPF support for pre-5.6 kernels after upgrading Cilium's eBPF library version to 0.16 in runc. (#3008, #4548, #4551)

Specialization is for insects.

Fixed

• Fixed the failure of runc delete on a rootless container with no dedicated cgroup on a system with read-only /sys/fs/cgroup mount. This is a regression in runc 1.2.0, causing a failure when using rootless buildkit. (#4518, #4531)
• Using runc on a system where /run/runc and /usr/bin are on different filesystems no longer results in harmless but annoying messages ("overlayfs: "xino" feature enabled using 3 upper inode bits") appearing in the kernel log. (#4508, #4530)

Changed

• Better memfd-bind documentation. (#4530)
• CI: bump Fedora 40 -> 41. (#4528)

No existe una escuela que enseñe a vivir.

Fixed

• Became root after joining an existing user namespace. Otherwise, runc won't have permissions to configure some mounts when running under SELinux and runc is not creating the user namespace. (#4466, #4477)

Removed

• Remove dependency on golang.org/x/sys/execabs from go.mod. (#4480)
• Remove runc-dmz, that had many limitations, and is mostly made obsolete by the new protection mechanism added in v1.2.0. Note that runc-dmz was only available only in the 1.2.0 release and required to set an environment variable to opt-in. (#4488)

Added

• The script/check-config.sh script now checks for overlayfs support. (#4494)
• When using cgroups v2, allow to set or update memory limit to "unlimited" and swap limit to a specific value. (#4501)