This repository was archived by the owner on Sep 29, 2025. It is now read-only.
Tags: DataDog/runc
Tags
runc v1.4.0-rc.1 -- "おめェもボスになったんだろぉ？" This is the first release candidate of the runc 1.4.0 release. It contains a couple of new features, but is mostly made up of some minor bug fixes and some follow-ups for features deprecated in runc 1.3.0. Users are strongly encouraged to test our release candidates over the next two months so we can fix issues before the general release. You should expect runc 1.4.0 to be released at the end of October 2025 (at which point, runc 1.2.z will only receive high-severity security fixes for 6 months and users are thus very strongly encouraged to migrate to a newer version). This version of runc requires Go 1.24 to build. libcontainer API: - The deprecated libcontainer/user package has been removed; use github.com/moby/sys/user instead. (opencontainers#3999, opencontainers#4617) - libcontainer/apparmor variables containing public functions have been switched to wrapper functions. (opencontainers#4725) Breaking: - runc update no longer allows --l3-cache-schema or --mem-bw-schema if linux.intelRdt was not present in the container’s original config.json. Without linux.intelRdt no CLOS (resctrl group) is created at container creation, so it is not possible to apply the updated options with runc update. Previously, this scenario did not work as expected. The runc update would create a new CLOS but fail to apply the schema, move only the init process (omitting children) to the new group, and leave the CLOS orphaned after container exit. (opencontainers#4827) - The deprecated --criu flag has been removed entirely, instead the criu binary in $PATH will be used. (opencontainers#4722) Added: * runc now supports the linux.netDevices field to allow for devices to be moved into container network namespaces seamlessly. (opencontainers#4538) * runc update now supports per-device weight and iops cgroup limits. (opencontainers#4775) * intel rdt: allow explicit assignment to root CLOS. (opencontainers#4854) Fixed: * Container processes will no longer inherit the CPU affinity of runc by default. Instead, the default CPU affinity of container processes will be the largest set of CPUs permitted by the container's cpuset cgroup and any other system restrictions (such as isolated CPUs). (opencontainers#4041, opencontainers#4815, opencontainers#4858) * Use chown(uid, -1) when configuring the console inode, to avoid issues with unmapped GIDs. (opencontainers#4679) * Add logging for the cases where failed keyring operations are ignored during setup. (opencontainers#4676) * Optimise runc exec by avoiding calling into SELinux's Set.*Label when processLabel is not set. (opencontainers#4354) * Fix mips64 builds for remap-rootfs. (opencontainers#4723) * Setting linux.rootfsPropagation to shared or unbindable now functions properly. (opencontainers#1755, opencontainers#1815, opencontainers#4724) * runc delete and runc stop can now correctly handle cases where runc create was killed during setup. Previously it was possible for the container to be in such a state that neither runc stop nor runc delete would be unable to kill or delete the container. (opencontainers#4534, opencontainers#4645, opencontainers#4757) * Close seccomp agent connection to prevent resource leaks. (opencontainers#4796) * runc update will no longer clear intelRdt state information. (opencontainers#4828) * runc will now error out earlier if intelRdt is not enabled. (opencontainers#4829) * Improve filesystem operations within intelRdt manager. (opencontainers#4840, opencontainers#4831) * Resolve a certain race between runc create and runc delete that would previously result in spurious errors. (opencontainers#4735) * CI: skip bpf tests on misbehaving udev systems. (opencontainers#4825) Changes: * Use Go's built-in pidfd_send_signal(2) support when available. (opencontainers#4666) * Make state.json 25% smaller. (opencontainers#4685) * Migrate to Go 1.22+ features. (opencontainers#4687, opencontainers#4703) * Provide private wrappers around common syscalls to make -EINTR handling less cumbersome for the rest of runc. (opencontainers#4697) * Ignore the dmem controller in our cgroup tests, as systemd does not yet support it. (opencontainers#4806) * /proc/net/dev is no longer included in the permitted procfs overmount list. Its inclusion was almost certainly an error, and because /proc/net is a symlink to /proc/self/net, overmounting this was almost certainly never useful (and will be blocked by future kernel versions). (opencontainers#4817) * Simplify the prepareCriuRestoreMounts logic for checkpoint-restore. (opencontainers#4765) * Bump minimum Go version to 1.24. (opencontainers#4851) * CI: migrate virtualised Fedora tests from Vagrant + Cirrus to Lima + GHA. We still use Cirrus for the AlmaLinux tests, since they can be run without virtualisation. (opencontainers#4664) * CI: install fewer dependencies (opencontainers#4671), bump shellcheck and bats versions (opencontainers#4670). * CI: remove toolchain from go.mod and add a CI check to make sure it's never added accidentally. (opencontainers#4717, opencontainers#4721) * CI: do not allow exclude or replace directives in go.mod, to make sure that go install doesn't get accidentally broken. (opencontainers#4750) * CI: fix exclusion rules and allow us to run jobs manually. (opencontainers#4760) * CI: Switch to GitHub-hosted ARM runners. Thanks again to @alexellis for supporting runc's ARM CI up until now. (opencontainers#4844, opencontainers#4856) * Various dependency updates. (opencontainers#4659, opencontainers#4658, opencontainers#4662, opencontainers#4663, opencontainers#4689, opencontainers#4694, opencontainers#4702, opencontainers#4701, opencontainers#4707, opencontainers#4710, opencontainers#4746, opencontainers#4756, opencontainers#4751, opencontainers#4758, opencontainers#4764, opencontainers#4768, opencontainers#4779, opencontainers#4783, opencontainers#4785, opencontainers#4801, opencontainers#4808, opencontainers#4803, opencontainers#4839, opencontainers#4846, opencontainers#4847, opencontainers#4845, opencontainers#4850, opencontainers#4861, opencontainers#4860) Thanks to the following contributors for making this release possible: * Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp> * Aleksa Sarai <cyphar@cyphar.com> * Andrei Vagin <avagin@gmail.com> * Antonio Ojea <aojea@google.com> * Antti Kervinen <antti.kervinen@intel.com> * Henry Chen <henry.chen@oss.cipunited.com> * HirazawaUi <695097494plus@gmail.com> * Kir Kolyshkin <kolyshkin@gmail.com> * Markus Lehtonen <markus.lehtonen@intel.com> * Martin Sivak <msivak@redhat.com> * Mikhail Dmitrichenko <m.dmitrichenko222@gmail.com> * Pavel Liubimov <prlyubimov@gmail.com> * Peter Hunt <pehunt@redhat.com> * Prajwal S N <prajwalnadig21@gmail.com> * Rodrigo Campos <rodrigoca@microsoft.com> * Sebastiaan van Stijn <thaJeztah@users.noreply.github.com> * Tigran Sogomonian <tsogomonian@astralinux.ru> * Yusuke Sakurai <yusuke.sakurai@3-shake.com> * jokemanfire <hu.dingyang@zte.com.cn> * lifubang <lifubang@acmcoder.com> * ningmingxiao <ning.mingxiao@zte.com.cn> Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
runc v1.3.1 -- "この瓦礫の山でよぉ" This is the first patch release of the 1.3.z release series of runc. It primarily includes some minor fixes for issues found in 1.3.0. Fixed: * Container processes will no longer inherit the CPU affinity of runc by default. Instead, the default CPU affinity of container processes will be the largest set of CPUs permitted by the container's cpuset cgroup and any other system restrictions (such as isolated CPUs). (opencontainers#4041, opencontainers#4815, opencontainers#4858) * Setting linux.rootfsPropagation to shared or unbindable now functions properly. (opencontainers#1755, opencontainers#1815, opencontainers#4724, opencontainers#4789) * Close seccomp agent connection to prevent resource leaks. (opencontainers#4796, opencontainers#4799) * runc delete and runc stop can now correctly handle cases where runc create was killed during setup. Previously it was possible for the container to be in such a state that neither runc stop nor runc delete would be unable to kill or delete the container. (opencontainers#4534, opencontainers#4645, opencontainers#4757, opencontainers#4793) * runc update will no longer clear intelRdt state information. (opencontainers#4828, opencontainers#4833) * CI: Fix exclusion rules and allow us to run jobs manually. (opencontainers#4760, opencontainers#4763) Changed: * Improvements to the deprecation warnings as part of the github.com/opencontainers/cgroups split. (opencontainers#4784, opencontainers#4788) * Ignore the dmem controller in our cgroup tests, as systemd does not yet support it. (opencontainers#4806, opencontainers#4811) * /proc/net/dev is no longer included in the permitted procfs overmount list. Its inclusion was almost certainly an error, and because /proc/net is a symlink to /proc/self/net, overmounting this was almost certainly never useful (and will be blocked by future kernel versions). (opencontainers#4817, opencontainers#4820) * Simplify the prepareCriuRestoreMounts logic for checkpoint-restore. (opencontainers#4765, opencontainers#4871) * CI: Bump golangci-lint to v2.1. (opencontainers#4747, opencontainers#4754) * CI: Switch to GitHub-hosted ARM runners. Thanks again to @alexellis for supporting runc's ARM CI up until now. (opencontainers#4844, opencontainers#4856, opencontainers#4866) Thanks to the following contributors who made this release possible: * Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp> * Aleksa Sarai <cyphar@cyphar.com> * HirazawaUi <695097494plus@gmail.com> * Kir Kolyshkin <kolyshkin@gmail.com> * Markus Lehtonen <markus.lehtonen@intel.com> * Martin Sivak <msivak@redhat.com> * Pavel Liubimov <prlyubimov@gmail.com> * Peter Hunt <pehunt@redhat.com> * Rodrigo Campos <rata@users.noreply.github.com> * Yusuke Sakurai <yusuke.sakurai@3-shake.com> * lfbzhm <lifubang@acmcoder.com> * ningmingxiao <ning.mingxiao@zte.com.cn> Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
runc v1.2.7 -- "さんをつけろよデコ助野郎！" This is the seventh patch release of the 1.2.z release branch of runc. It contains some fixes for issues found in runc 1.3.z that were considered "significant" bugfixes (as per our new release and support policy) and thus be worth backporting. Fixed: * Removed preemptive "full access to cgroups" warning when calling runc pause or runc unpause as an unprivileged user without --systemd-cgroups. Now the warning is only emitted if an actual permission error was encountered. (opencontainers#4709, opencontainers#4720) * Add time namespace to container config after checkpoint/restore. CRIU since version 3.14 uses a time namespace for checkpoint/restore, however it was not joining the time namespace in runc. (opencontainers#4696, opencontainers#4714) * Container processes will no longer inherit the CPU affinity of runc by default. Instead, the default CPU affinity of container processes will be the largest set of CPUs permitted by the container's cpuset cgroup and any other system restrictions (such as isolated CPUs). (opencontainers#4041, opencontainers#4815, opencontainers#4858) * Close seccomp agent connection to prevent resource leaks. (opencontainers#4796, opencontainers#4800) * Several fixes to our CI, mainly related to AlmaLinux and CRIU. (opencontainers#4670, opencontainers#4728, opencontainers#4736, opencontainers#4742) * Setting linux.rootfsPropagation to shared or unbindable now functions properly. (opencontainers#1755, opencontainers#1815, opencontainers#4724, opencontainers#4791) * runc update will no longer clear intelRdt state information. (opencontainers#4828, opencontainers#4834) Changed: * In runc 1.2, we changed our mount behaviour to correctly handle clearing flags. However, the error messages we returned did not provide as much information to users about what clearing flags were conflicting with locked mount flags. We now provide more diagnostic information if there is an error when in the fallback path to handle locked mount flags. (opencontainers#4734, opencontainers#4740) * Ignore the dmem controller in our cgroup tests, as systemd does not yet support it. (opencontainers#4806, opencontainers#4811) * /proc/net/dev is no longer included in the permitted procfs overmount list. Its inclusion was almost certainly an error, and because /proc/net is a symlink to /proc/self/net, overmounting this was almost certainly never useful (and will be blocked by future kernel versions). (opencontainers#4817, opencontainers#4820) * CI: Switch to GitHub-hosted ARM runners. Thanks again to @alexellis for supporting runc's ARM CI up until now. (opencontainers#4844, opencontainers#4856, opencontainers#4867) * Simplify the prepareCriuRestoreMounts logic for checkpoint-restore. (opencontainers#4765, opencontainers#4872) Thanks to the following contributors for making this release possible: * Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp> * Aleksa Sarai <cyphar@cyphar.com> * Andrei Vagin <avagin@gmail.com> * Kir Kolyshkin <kolyshkin@gmail.com> * Markus Lehtonen <markus.lehtonen@intel.com> * Martin Sivak <msivak@redhat.com> * Pavel Liubimov <prlyubimov@gmail.com> * Peter Hunt <pehunt@redhat.com> * Rodrigo Campos <rodrigoca@microsoft.com> * Yusuke Sakurai <yusuke.sakurai@3-shake.com> * lfbzhm <lifubang@acmcoder.com> * ningmingxiao <ning.mingxiao@zte.com.cn> Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
runc v1.3.0 -- "Mr. President, we must not allow a mine shaft gap!" This is the first release of the 1.3.z release branch of runc. It contains a few minor fixes for issues found in 1.3.0-rc.2. This is the first release of runc that will follow our new release and support policy (see RELEASES.md for more details). This means that, as of this release: * As of this release, the runc 1.2.z release branch will now only recieve security and "significant" bugfixes. * Users are encouraged to plan migrating to runc 1.3.0 as soon as possible. * Due to its particular situation, runc 1.1.z is officially no longer supported and will no longer receieve any updates (not even for critical security issues). Users are urged (in the strongest possible terms) to upgrade to a supported version of runc. * Barring any future changes to our release policy, users should expect a runc 1.4.0 release in late October 2025. Fixed: * Removed pre-emptive "full access to cgroups" warning when calling runc pause or runc unpause as an unprivileged user without --systemd-cgroups. Now the warning is only emitted if an actual permission error was encountered. (opencontainers#4709) * Several fixes to our CI, mainly related to AlmaLinux and CRIU. (opencontainers#4670, opencontainers#4728, opencontainers#4736) Changed: * In runc 1.2, we changed our mount behaviour to correctly handle clearing flags. However, the error messages we returned did not provide as much information to users about what clearing flags were conflicting with locked mount flags. We now provide more diagnostic information if there is an error when in the fallback path to handle locked mount flags. (opencontainers#4734) * Upgrade our CI to use golangci-lint v2.0. (opencontainers#4692) * runc version information is now filled in using //go:embed rather than being set through Makefile. This allows go install or other non-make builds to contain the correct version information. Note that "make EXTRA_VERSION=..." still works. (opencontainers#418) * Remove exclude directives from our go.mod for broken cilium/ebpf versions. v0.17.3 resolved the issue we had, and exclude directives are incompatible with go install. (opencontainers#4748) Thanks to the following contributors for making this release possible: * Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp> * Aleksa Sarai <cyphar@cyphar.com> * Kir Kolyshkin <kolyshkin@gmail.com> * Rodrigo Campos <rodrigoca@microsoft.com> * lifubang <lifubang@acmcoder.com> Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
runc v1.3.0-rc.2 -- "Eppur si muove." This is the second release candidate of the runc 1.3.0 release. It contains a few fixes for issues found in rc.1. This is the first release series that will follow our new release policy, meaning that users should expect runc 1.3.0 to be released at the end of April 2025, at which point the support policy for the runc 1.2.z branch will change. Please see the new RELEASES.md document for more information. Users are strongly encouraged to test our release candidates so we can fix issues before the general release. Fixes: * Use the container's `/etc/passwd` to set the `HOME` env var. After a refactor for 1.3, we were setting it reading the host's `/etc/passwd` file instead. (opencontainers#4693, opencontainers#4688) * Override `HOME` env var if it's set to the empty string. This fixes a regression after the same refactor for 1.3 and aligns the behavior with older versions of runc. (opencontainers#4711) * Add time namespace to container config after checkpoint/restore. CRIU since version 3.14 uses a time namespace for checkpoint/restore, however it was not joining the time namespace in runc. (opencontainers#4705) Thanks to the following contributors for making this release possible: * Rodrigo Campos <rodrigoca@microsoft.com> * Rudi Heitbaum <rudi@heitbaum.com> * Kir Kolyshkin <kolyshkin@gmail.com> * lifubang <lifubang@acmcoder.com> * Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp> * Andrei Vagin <avagin@gmail.com> Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
runc v1.2.6 -- "Hasta la victoria, siempre." This is the sixth patch release in the 1.2.z series of runc. It primarily fixes an issue with runc exec vs time namespace, and a compatibility issue with older kernels. * Fix a stall issue that would happen if setting `O_CLOEXEC` with `CloseExecFrom` failed (opencontainers#4647). * `runc` now properly handles joining time namespaces (such as with `runc exec`). Previously we would attempt to set the time offsets when joining, which would fail. (opencontainers#4635, opencontainers#4649) * Handle `EINTR` retries correctly for socket-related direct `golang.org/x/sys/unix` system calls. (opencontainers#4650) * We no longer use `F_SEAL_FUTURE_WRITE` when sealing the runc binary, as it turns out this had some unfortunate bugs in older kernel versions and was never necessary in the first place. (opencontainers#4651, opencontainers#4640) * Remove `Fexecve` helper from `libcontainer/system`. Runc 1.2.1 removed runc-dmz, but we forgot to remove this helper added only for that. (opencontainers#4646) * Use Go 1.23 for official builds, run CI with Go 1.24 and drop Ubuntu 20.04 from CI. We need to drop Ubuntu 20.04 from CI because Github Actions announced it's already deprecated and it will be discontinued soon. (opencontainers#4648) Thanks to the following contributors who made this release possible: * Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp> * Aleksa Sarai <cyphar@cyphar.com> * Evan Phoenix <evan@phx.io> * Kir Kolyshkin <kolyshkin@gmail.com> * lifubang <lifubang@acmcoder.com> * Rodrigo Campos <rodrigoca@microsoft.com> * Tomasz Duda <tomaszduda23@gmail.com> Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
runc v1.3.0-rc.1 -- "No tengo miedo al invierno, con tu recuerdo llen… …o de sol." This is the first release candidate of the runc 1.3.0 release. It contains a couple of new features, but is mostly made up of some minor (but notable) API changes to libcontainer as well as a series of bug fixes. This is the first release series that will follow our new release policy, meaning that user should expect runc 1.3.0 to be released at the end of April 2025, at which point the support policy for the runc 1.2.z branch will change. Please see the new RELEASES.md document for more information. Users are strongly encouraged to test our release candidates over the next two months so we can fix issues before the general release. API Changes: * configs.CommandHook struct has changed, Command is now a pointer. Also, configs.NewCommandHook now accepts a *Command. (opencontainers#4325) * The Process struct has User string field replaced with numeric UID and GID fields, and AdditionalGroups changed its type from []string to []int. Essentially, resolution of user and group names to IDs is no longer performed by libcontainer, so if a libcontainer user previously relied on this feature, now they have to convert names to IDs before calling libcontainer; it is recommended to use Go package github.com/moby/sys/user for that. (opencontainers#3999) * Move libcontainer/cgroups to a separate repository. (opencontainers#4618) Fixes: * runc exec -p no longer ignores specified ioPriority and scheduler settings. Similarly, libcontainer's Container.Start and Container.Run methods no longer ignore Process.IOPriority and Process.Scheduler settings. (opencontainers#4585) * We no longer use F_SEAL_FUTURE_WRITE when sealing the runc binary, as it turns out this had some unfortunate bugs in older kernel versions and was never necessary in the first place. (opencontainers#4641, opencontainers#4640) * runc now uses a more flexible method of joining namespaces, which better matches the behaviour of nsenter(8). This is mainly useful for users that create a container with a runc-managed user namespace but want the container to join some externally-managed namespace as well. (opencontainers#4492) * runc now properly handles joining time namespaces (such as with runc exec). Previously we would attempt to set the time offsets when joining, which would fail. (opencontainers#4635, opencontainers#4636) * Handle EINTR retries correctly for socket-related direct golang.org/x/sys/unix system calls. (opencontainers#4637) * Handle close_range(2) errors more gracefully. (opencontainers#4596) * Fix a stall issue that would happen if setting O_CLOEXEC with CloseExecFrom failed (opencontainers#4599). * Handle errors on older kernels when resetting ambient capabilities more gracefully. (opencontainers#4597) Changed: * runc now has an official release policy to help provide more consistency around our release schedules and better define our support policy for old release branches. See RELEASES.md for more details. (opencontainers#4557) * Improved performance by switching to strings.Cut where appropriate. (opencontainers#4470) * The minimum Go version of runc is now Go 1.23. (opencontainers#4598) * Updated builds to libseccomp v2.5.6. (opencontainers#4625) Added: + runc has been updated to support OCI runtime-spec 1.2.1. (opencontainers#4653) + CPU affinity support for runc exec. (opencontainers#4327) + CRIU support can be disabled using the build tag runc_nocriu. (opencontainers#4547) + Support to get the pidfd of the container via CLI flag pidfd-socket. (opencontainers#4045) + Support skip-in-flight and link-remap options for CRIU. (opencontainers#4627) + Support cgroup v1 mounted with noprefix. (opencontainers#4513) Thanks to the following contributors for making this release possible: * Adam Korczynski <adam@adalogics.com> * Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp> * Aleksa Sarai <cyphar@cyphar.com> * Brad Davidson <brad.davidson@rancher.com> * Daniel Levi-Minzi <dleviminzi@gmail.com> * Evan Phoenix <evan@phx.io> * Jian Wen <wenjianhn@gmail.com> * Kir Kolyshkin <kolyshkin@gmail.com> * Rin Arakaki <rnarkkx@gmail.com> * Rodrigo Campos <rodrigoca@microsoft.com> * Sebastiaan van Stijn <github@gone.nl> * Tomasz Duda <tomaszduda23@gmail.com> * Wei Fu <fuweid89@gmail.com> * Yangzhao Hjh <yangzhao.hjh@alibaba-inc.com> * lifubang <lifubang@acmcoder.com> Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
runc v1.2.5 -- "Мороз и солнце; день чудесный!" This is the fifth patch release in the 1.2.z series of runc. It primarily fixes an issue caused by an upstream systemd bug. * There was a regression in systemd v230 which made the way we define device rule restrictions require a systemctl daemon-reload for our transient units. This caused issues for workloads using NVIDIA GPUs. Workaround the upstream regression by re-arranging how the unit properties are defined. (opencontainers#4568, opencontainers#4612, opencontainers#4615) * Dependency github.com/cyphar/filepath-securejoin is updated to v0.4.1, to allow projects that vendor runc to bump it as well. (opencontainers#4608) * CI: fixed criu-dev compilation. (opencontainers#4611) * Dependency golang.org/x/net is updated to 0.33.0. (opencontainers#4632) Thanks to the following contributors who made this release possible: * Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp> * Aleksa Sarai <cyphar@cyphar.com> * Brad Davidson <brad.davidson@rancher.com> * Jian Wen <wenjianhn@gmail.com> * Kir Kolyshkin <kolyshkin@gmail.com> * Rodrigo Campos <rata@users.noreply.github.com> * lifubang <lifubang@acmcoder.com> Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
runc v1.2.4 -- "Христос се роди!" This is the fourth patch release of the 1.2.z release branch of runc. It includes a fix for a regression introduced in 1.2.0 related to the default device list. * Re-add tun/tap devices to built-in allowed devices lists. In runc 1.2.0 we removed these devices from the default allow-list (which were added seemingly by accident early in Docker's history) as a precaution in order to try to reduce the attack surface of device inodes available to most containers (opencontainers#3468). At the time we thought that the vast majority of users using tun/tap would already be specifying what devices they need (such as by using `--device` with Docker/Podman) as opposed to doing the `mknod` manually, and thus there would've been no user-visible change. Unfortunately, it seems that this regressed a noticeable number of users (and not all higher-level tools provide easy ways to specify devices to allow) and so this change needed to be reverted. Users that do not need these devices are recommended to explicitly disable them by adding deny rules in their container configuration. (opencontainers#4555, opencontainers#4556) Thanks to all of the contributors who made this release possible: * Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp> * Aleksa Sarai <cyphar@cyphar.com> * Kir Kolyshkin <kolyshkin@gmail.com> * lifubang <lifubang@acmcoder.com> Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
PreviousNext