rpm/runc
SHA256
1
0
Fork 0
forked from pool/runc
Code Pull Requests Activity

Accepting request 940368 from home:cyphar:docker

Browse Source 
- Update to runc v1.1.0~rc1. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.1.0-rc.1.

  + Add support for RDMA cgroup added in Linux 4.11.
  * runc exec now produces exit code of 255 when the exec failed.
    This may help in distinguishing between runc exec failures
    (such as invalid options, non-running container or non-existent
    binary etc.) and failures of the command being executed.
  + runc run: new --keep option to skip removal exited containers artefacts.
    This might be useful to check the state (e.g. of cgroup controllers) after
    the container hasexited.
  + seccomp: add support for SCMP_ACT_KILL_PROCESS and SCMP_ACT_KILL_THREAD
    (the latter is just an alias for SCMP_ACT_KILL).
  + seccomp: add support for SCMP_ACT_NOTIFY (seccomp actions). This allows
    users to create sophisticated seccomp filters where syscalls can be
    efficiently emulated by privileged processes on the host.
  + checkpoint/restore: add an option (--lsm-mount-context) to set
    a different LSM mount context on restore.
  + intelrdt: support ClosID parameter.
  + runc exec --cgroup: an option to specify a (non-top) in-container cgroup
    to use for the process being executed.
  + cgroup v1 controllers now support hybrid hierarchy (i.e. when on a cgroup v1
    machine a cgroup2 filesystem is mounted to /sys/fs/cgroup/unified, runc
    run/exec now adds the container to the appropriate cgroup under it).
  + sysctl: allow slashes in sysctl names, to better match sysctl(8)'s
    behaviour.
  + mounts: add support for bind-mounts which are inaccessible after switching
    the user namespace. Note that this does not permit the container any
    additional access to the host filesystem, it simply allows containers to
    have bind-mounts configured for paths the user can access but have
    restrictive access control settings for other users.
  + Add support for recursive mount attributes using mount_setattr(2). These
    have the same names as the proposed mount(8) options -- just prepend r
    to the option name (such as rro).
  + Add runc features subcommand to allow runc users to detect what features
    runc has been built with. This includes critical information such as
    supported mount flags, hook names, and so on. Note that the output of this
    command is subject to change and will not be considered stable until runc
    1.2 at the earliest. The runtime-spec specification for this feature is
    being developed in opencontainers/runtime-spec#1130.
  * system: improve performance of /proc/$pid/stat parsing.
  * cgroup2: when /sys/fs/cgroup is configured as a read-write mount, change
    the ownership of certain cgroup control files (as per
    /sys/kernel/cgroup/delegate) to allow for proper deferral to the container
    process.
  * runc checkpoint/restore: fixed for containers with an external bind mount
    which destination is a symlink.
  * cgroup: improve openat2 handling for cgroup directory handle hardening.
    runc delete -f now succeeds (rather than timing out) on a paused
    container.
  * runc run/start/exec now refuses a frozen cgroup (paused container in case of
    exec). Users can disable this using --ignore-paused.
- Update version data embedded in binary to correctly include the git commit of
  the release.
- Drop runc-rpmlintrc because we don't have runc-test anymore.

OBS-URL: https://build.opensuse.org/request/show/940368
OBS-URL: https://build.opensuse.org/package/show/Virtualization:containers/runc?expand=0&rev=119
This commit is contained in:
Aleksa Sarai 2021-12-14 05:24:53 +00:00 committed by Git OBS Bridge
parent f76f27fb03
commit 81f99db1b9
7 changed files with 90 additions and 30 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
runc-1.0.3.tar.xz
View File

@ -1,3 +0,0 @@
version https://git-lfs.github.com/spec/v1
oid sha256:e9297b338f3b382cc3a40d4c4a3bfbe8ff8db9761028691a67ea68e612d21ab6
size 1415820

17
runc-1.0.3.tar.xz.asc
View File

@ -1,17 +0,0 @@
-----BEGIN PGP SIGNATURE-----
iQJDBAABCAAtFiEEXzbGxhtUYBJKdfWmnhiqJn3bjbQFAmGtjaEPHGFzYXJhaUBz
dXNlLmRlAAoJEJ4YqiZ92420Wv8QALHxw0muAoTPwFNkh3KLbGtiCiniFEJsaWCq
+abTJKOURbRzM2GuTu78cu305PC7KJcy33jgUK7g9AeuJkGj08OqqqIZeQNHThIq
LQfZOBKjX6PoXSFGSAQzwEehp+Nx8zc09e4u6yspr3GqKgxAlag0aq+qgiwvay/I
7sfFu54ooEw2zom+EHfYOOuMpmRSP38zw77USpqR6OUQQAm/UX1fGJdEi15qqS2U
31oUiSRkxwttvJTxXXpcGf71oB8iBLfM4BhFCkHLX0+uQUFh22Nmr8D4d8JE3ur+
xOJRXfF28o8lNV/ixQ+8c2YvxObF2hqine5ScZ1g8D0/d3oLZDKxuWb7lvSxXnRy
Ij1Jkw6Lg8RMjvPjjGn+P+l4N74fnPB1oUQIkpBg5YEufUph9NMiURdcbr28w4Is
alV37DgQno+QxGCou4os7XFlapeLUkc44FN3FNIlCUMew69X8e+QnBo3X4nkm1cl
rDr+HjmjgZi1vyry/klVfaYy8g8hMmplU0TKRI4wAwElNW0qQZZIvuh+EbLxbVfE
1Xi1xZM4P2P9vpIYsem9fBQtHexV9j9NnBoZQnF874rUgLFadYHg84IK1lmiEcTr
0JNUU1l+dLTXGzt9qpOFnVSzQy7fECagEXNLPWBOQzL0esdvZpu+dx3aosKyKDNv
eJJjGgZy
=jAoe
-----END PGP SIGNATURE-----

3
runc-1.1.0~rc1.tar.xz Normal file
View File

@ -0,0 +1,3 @@
version https://git-lfs.github.com/spec/v1
oid sha256:b4e1cd313a7b72fd79f922de7126060d4a3dbd0f1039f0d129cd1b6f66e2e762
size 1411376

17
runc-1.1.0~rc1.tar.xz.asc Normal file
View File

@ -0,0 +1,17 @@
-----BEGIN PGP SIGNATURE-----
iQJDBAABCAAtFiEEXzbGxhtUYBJKdfWmnhiqJn3bjbQFAmG4EMgPHGFzYXJhaUBz
dXNlLmRlAAoJEJ4YqiZ92420wrsP/R6kQcEZgvTt9ArztN6KVI+sB0nikg5NHKQH
vs9/ETwph0Ur2AdCyjXaV/88Cvr5UB4QaSxyz2xEzXSdc2K7tUkn8VrR2mYzviR7
4sM8cgGRDcHECTwPXJ1STJhSWbSUCIUqhS+u83RmUsoxUWpdm5fah5AzgN6V8qkD
gflRUz22kmmoDhnAPvdEtoq6KKL8Kcd/GYXCtmeND1FspYe7eTBeLRiHP+8fEh3U
keE+J2/mKnJFqL3K9TztTks/nLiiFsfWvfiloRed6FS+T0a85ITxJm+Lc7TBIKAP
krcb9Vg0V76GCkel+BTtbXdIXZEpT4zkqGALb457yD0f6gtSGarKRdHOPQCUYCWV
RiiihAKFX0ab9BrITLedj8K2QcwrE/m3KS5TRCYUkBrsR0LEfAEvLcO0Y/FGzjIw
zg93yWXFLlqPKZsdLjpxOwBHJlTSt45DcdAFjV7itQHnm7i6aXaCpFrJUB0cX+oz
BmgDFPNFw6cV4FcWioZGww66XzySus7Hxq2oE9sehAuybFUA2cETZ6TnsPRfFIEz
tV9rnzOjumafgBUml5ZcHVT0G85hgb5X0M7UzEHI97hrwfK1zjLXrvlqqq0Ct0Ch
ZsVGGGO6+rum97DjhgH5gSKd24nhDHC0r6WurF4i97/du5lfINEeoGaLp9TqH03s
5cKlVYVv
=orVI
-----END PGP SIGNATURE-----

2
runc-rpmlintrc
View File

@ -1,2 +0,0 @@
# -test is something that is used internally and isn't actually shipped -- it's a pseudo-source package.
addFilter ("^runc(-kubic)?-test.*")

59
runc.changes
View File

@ -1,3 +1,62 @@
-------------------------------------------------------------------
Tue Dec 14 05:04:21 UTC 2021 - Aleksa Sarai <asarai@suse.com>
- Update to runc v1.1.0~rc1. Upstream changelog is available from
https://github.com/opencontainers/runc/releases/tag/v1.1.0-rc.1.
+ Add support for RDMA cgroup added in Linux 4.11.
* runc exec now produces exit code of 255 when the exec failed.
This may help in distinguishing between runc exec failures
(such as invalid options, non-running container or non-existent
binary etc.) and failures of the command being executed.
+ runc run: new --keep option to skip removal exited containers artefacts.
This might be useful to check the state (e.g. of cgroup controllers) after
the container hasexited.
+ seccomp: add support for SCMP_ACT_KILL_PROCESS and SCMP_ACT_KILL_THREAD
(the latter is just an alias for SCMP_ACT_KILL).
+ seccomp: add support for SCMP_ACT_NOTIFY (seccomp actions). This allows
users to create sophisticated seccomp filters where syscalls can be
efficiently emulated by privileged processes on the host.
+ checkpoint/restore: add an option (--lsm-mount-context) to set
a different LSM mount context on restore.
+ intelrdt: support ClosID parameter.
+ runc exec --cgroup: an option to specify a (non-top) in-container cgroup
to use for the process being executed.
+ cgroup v1 controllers now support hybrid hierarchy (i.e. when on a cgroup v1
machine a cgroup2 filesystem is mounted to /sys/fs/cgroup/unified, runc
run/exec now adds the container to the appropriate cgroup under it).
+ sysctl: allow slashes in sysctl names, to better match sysctl(8)'s
behaviour.
+ mounts: add support for bind-mounts which are inaccessible after switching
the user namespace. Note that this does not permit the container any
additional access to the host filesystem, it simply allows containers to
have bind-mounts configured for paths the user can access but have
restrictive access control settings for other users.
+ Add support for recursive mount attributes using mount_setattr(2). These
have the same names as the proposed mount(8) options -- just prepend r
to the option name (such as rro).
+ Add runc features subcommand to allow runc users to detect what features
runc has been built with. This includes critical information such as
supported mount flags, hook names, and so on. Note that the output of this
command is subject to change and will not be considered stable until runc
1.2 at the earliest. The runtime-spec specification for this feature is
being developed in opencontainers/runtime-spec#1130.
* system: improve performance of /proc/$pid/stat parsing.
* cgroup2: when /sys/fs/cgroup is configured as a read-write mount, change
the ownership of certain cgroup control files (as per
/sys/kernel/cgroup/delegate) to allow for proper deferral to the container
process.
* runc checkpoint/restore: fixed for containers with an external bind mount
which destination is a symlink.
* cgroup: improve openat2 handling for cgroup directory handle hardening.
runc delete -f now succeeds (rather than timing out) on a paused
container.
* runc run/start/exec now refuses a frozen cgroup (paused container in case of
exec). Users can disable this using --ignore-paused.
- Update version data embedded in binary to correctly include the git commit of
the release.
- Drop runc-rpmlintrc because we don't have runc-test anymore.
-------------------------------------------------------------------
Mon Dec 6 04:38:25 UTC 2021 - Aleksa Sarai <asarai@suse.com>

19
runc.spec
View File

@ -18,24 +18,24 @@
# MANUAL: Make sure you update this each time you update runc.
%define git_version 4144b63817ebcc5b358fc2c8ef95f7cddd709aa7
%define git_version 55df1fc4c8b048118cd30a17b50f96a15ab0f3ea
%define git_short 55df1fc4c8b0
# Package-wide golang version
%define go_version 1.16
%define go_version 1.17
%define project github.com/opencontainers/runc
Name: runc
Version: 1.0.3
%define _version 1.0.3
Version: 1.1.0~rc1
%define _version 1.1.0-rc.1
Release: 0
Summary: Tool for spawning and running OCI containers
License: Apache-2.0
Group: System/Management
URL: https://github.com/opencontainers/runc
Source0: https://github.com/opencontainers/runc/releases/download/v%{_version}/runc.tar.xz#/runc-%{_version}.tar.xz
Source1: https://github.com/opencontainers/runc/releases/download/v%{_version}/runc.tar.xz.asc#/runc-%{_version}.tar.xz.asc
Source0: https://github.com/opencontainers/runc/releases/download/v%{_version}/runc.tar.xz#/runc-%{version}.tar.xz
Source1: https://github.com/opencontainers/runc/releases/download/v%{_version}/runc.tar.xz.asc#/runc-%{version}.tar.xz.asc
Source2: runc.keyring
Source3: runc-rpmlintrc
BuildRequires: fdupes
BuildRequires: go-go-md2man
# Due to a limitation in openSUSE's Go packaging we cannot have a BuildRequires
@ -56,6 +56,9 @@ Provides: docker-runc-kubic = %{version}
Obsoletes: docker-runc = 0.1.1+gitr2819_50a19c6
Obsoletes: docker-runc_50a19c6
# Construct "git describe --dirty --long --always".
%define git_describe v%{_version}-0-g%{git_short}
%description
runc is a CLI tool for spawning and running containers according to the OCI
specification. It is designed to be as minimal as possible, and is the workhorse
@ -67,7 +70,7 @@ and has grown to become a separate project entirely.
%build
# build runc
make BUILDTAGS="seccomp" COMMIT_NO="%{git_version}" runc
make BUILDTAGS="seccomp" COMMIT="%{git_describe}" runc
# build man pages
man/md2man-all.sh