github.com/urunc-dev/urunc

What's Changed

Security

This release includes fixes for the following security issues (both pending
identification numbers):

• GHSA-crxr-jm9v-349c: Argument injection into the Sandbox monitor command line via unverified image/Pod annotations
• GHSA-3385-hmpj-4678: Path traversal of arbitrary host files through annotations

New features

• Support for vhost in Qemu's virtio networking
• Honor XDG_RUNTIME_DIR for the default runtime root when running rootless
• Add support for Cloud Hypervisor as a sandbox monitor
• Bind-mount devices instead of creating device nodes when running inside a user namespace
• Set the MTU of the tap device based on the respective value of the veth interface
• Initial support for Hermit unikernels over QEMU on amd64 (simple execution only; no network and mounts support)
• Initial support for hyperlight-unikraft (simple execution only; networking and host directory mounts are not supported yet)
• Add ps --format json command
• Support signal handling in urunc kill
• Shim: add a containerd access session
• shim: read OCI manifest annotations through the containerd API
• Use annotation values for the MirageOS network and block device names
• Set the urunc configuration file through URUNC_CONFIG_FILE environment variable
• Add support for creating the monitor's execution environment with libcontainer

Breaking changes

• urunc-deploy installs all artifacts under /opt/urunc and sets the respective urunc configuration under /etc/urunc/config.toml.
• Write the PID of the monitor process in the runtime-provided --pid-file after container creation
• The com.urunc.unikernel.cmdline annotations got deprecated
• Separate the container rootfs from the monitor rootfs
• Set vAccel disabled by default and it should be enabled from urunc configuration

Internals

• Fix Firecracker configuration for invocations without network devices
• Discover the veth interface instead of assuming eth0 in the monitor's network namespace
• Verify that the monitor command can be built before reporting a container as running and replace per-monitor Execve with a PreExec hook
• Improve error reporting and reliability in the test suite
• Update Go version, urunc dependencies and linter
• Prevent panics in hooks execution
• Fix chmod destination path for mounts
• Fix swallowed json.Marshal error i nFirecracker configuration
• Fix Qemu cli options to prevent terminal output corruption
• Scan for urunc tap devices in cleanup instead of using hardcoded values
• Fix error reporting from nsenter failures
• Set the correct netmask in MirageOS unikernels replacing hardcoded values
• Fall back to the mock metrics writer when the metrics file cannot be opened
• Validate container ID values
• Fix block device handling in case of block-based mounts
• Choose the rootfs based on annotations in the create step instead of urunc reexec
• Ensure default values for monitor and virtiofsd configuration
• Centralize the gathering of mounts and devices and move them to the create phase
• Only pivot_root when a mount namespace actually exists
• Replace the manual handling of mounts with the containerd's mount package
• Fix initrd update based on bind mounts for Unikraft unikernels
• Fix name of qemu binary in urunc-deploy generated urunc configuration, to cover aarch64 cases
• Replace string concatenation in the monitor cli argument construction
• Validate all user-defined annotations

CI/CD

• Move image pulling for e2e tests to the setup phase and add retry logic
• Enable urunc debug logging in e2e and kind workflows
• Increase unit tests coverage
• Migrate e2e testing to ginkgo framework
• Set the tag of urunc-deploy based on the commit sha
• Remove the KVM setup step
• Capture container logs when a test fails
• Fix CNI configuration in the e2e tests setup

Documentation

• Fix the urunc configuration options in the installation page
• Update copyright message in the website
• Add LLM policy, PR template and update contribution guide
• Fix and update the running existing Linux containers tutorial
• fix binary name in urunc installation from latest release
• Fix typos
• Remove shell prompt prefixes from README code blocks.
• Clarify the devmapper thinpool reload setup
• Update the urunc-deploy instructions to specify how a specific urunc-deploy image version can be used
• Enable and style the code block copy-to-clipboard feature

Contributors

The urunc project would like to thank Sergey Kanibor (@r0binak) from Luntry. who independently discovered and responsibly disclosed the security issues above in accordance with the urunc security policy.

In addition, the urunc project is grateful to everyone who contributed to this release:

New faces:

• Ikeh Akinyemi - @0xull
• Anand Prakash Srivastava - @Anand-240
• Anamika Aggarwal - @Anamika1608
• Ayush Srivastava - @AyushSriv06
• Chennamma Hotkar - @Chennamma-Hotkar
• Irving Mondragón - @IrvingMg
• Anuj Kumar Singh - @MUFFANUJ
• Mradul Tiwari - @Mysterio-17
• Odysseas Kalaitsidis - @OdysseasKalaitsidis
• AbhayGoudannavar - @abhaygoudannavar
• aman21-droid - @aman21-droid
• Palak Goyal - @goyalpalak18
• Hemang Sharrma - @hemang1404
• Aashish Pandit - @imshubham22apr-gif
• Ishaan Gupta - @ishaanxgupta
• Beingana Jim Junior - @jim-junior
• Jiwoo Ahn - @jiwahn
• Karthik Balasubramanian - @kaizakin
• Kostiantyn Astakhov - @kastakhov
• Akanksha Trehun - @magic-peach
• Md Raiyan - @mdryaan
• Hrishikesh Gohain - @neo-0007
• Parth Dagia - @parthdagia05
• Viju Sanjai - @pocopepe
• Prafful - @praffq-dev
• Prashant Pandey - @prashantpandeygit
• Rishi Jat - @rishi-jat
• Xuedong Zhang - @sidneychang
• Shresth Singh - @singhshresth26
• spline2hg - @spline2hg
• Uchechukwu (Uche) Obasi - @thisisobate
• vinayakjeet - @vinayakjeet

Familiar faces:

• Sankalp - @codesmith25103

Maintainers:

• Charalampos Mainas - @cmainas
• Anastassios Nanos - @ananos
• Georgios Ntoutsos - @gntouts

Full Changelog: v0.7.0...v0.8.0

What's Changed

New features

• Copy the files defined in the mount list of the container inside the block rootfs of the guest
• Add support for urunc configuration file
• Add support for virtiofs
• Copy the files defined in the mount list of the container inside the initrd rootfs of the guest
• Improve debugging of urunc created containers in the host side
• Add support for attaching block-based mounts as block devices in the sandbox
• add vAccel support to urunc

Breaking changes

• Use an initrd file to pass information from urunc to urunit for the execution environment of the Linux guest

Internals

• Fix json construction for rumprun unikernels adding support for environment variables
• Update Go and dependencies
• Use the MAC address of veth as the guest's interface MAC address
• Improve network error logging and propagation
• Fail early in invalid unikernel configuration
• Set/Unset a urunit specific environment variable to instruct urunit to set the default route to eth0
• Ensure monitor process is killed in force deleting containers
• Slightly refactor the Exec monolith in unikontainers to improve guest's rootfs type selection and handling.
• Fix crictl configuration generation in crictl testing
• Fix container and snapshot deletion for ctr tests
• Increase tests' timeout due to slow image pulling
• Fix console parameter for Linux over Firecracker in aarch64 and update the seccomp filter of Solo5-hvt in aarch64
• Small refactor of the container delete path and fix entering the container's namespace
• Refactor and fix hook's execution context
• Improve metrics handling in urunc
• Fix handling of failures during the creation of the monitor's containerized environment

CI/CD

• Complete the transition to the new urunc repository
• Add scorecard workflow
• Use specific versions for tools and services
• Fix the commit and repo spell checker
• Add arm64 tests over Solo5-spt
• Add automated release action
• Add dependabot
• Prefetch Go packages before running end-to-end tests
• Add end-to-end Kubernetes tests using kind
• Harden workflows
• Apply security best practices
• Refactor the handling of Go version for CI jobs
• Set the correct image digest for Go alpine in urunc-deploy image building
• Cancel rest of tests in case of an error
• Introduce nightly tests
• Remove dependency on self-hosted runners
• Add testing for urunc-deploy

Documentation

• Update Kubernetes tutorial
• Update Linux tutorial with the role of urunit
• Update instructions for installing Go and remove obsolete image references
• Add tutorial for using urunc with kind
• Centralize the version definition of the tools mentioned in docs
• Add instructions fo using blockfile snapshotter with urunc
• Provide documentation for using the new monitors-build repository

Contributors

Big thanks to all contributors in urunc:

New: 🎉 Maintainers: 🛠️

• 🎉Anastasia Mallikopoulou - @amallikopoulou
• 🎉sankalp - @codesmith25103
• 🎉Dionisia Koronellou - @DionisiaK4
• 🎉Medfouni Khitem - @KhitemMed
• 🎉Maria Gkeka - @mgkeka-nbfc
• 🎉Panagiotis Mavrikos - @panosmaurikos
• 🎉Vasilis Liaskovitis - @vliaskov
• 🎉zyfy29 - @zyfy29
• 🛠️Charalampos Mainas - @cmainas
• 🛠️Georgios Ntoutsos - @gntouts
• 🛠️Anastassios Nanos - @ananos

Full Changelog: v0.6.0...v0.7.0