Skip to content

Tags

Tags give the ability to mark specific points in history as being important

  • archive/debian/1.3.3+ds1-1

    098e8968 · Make fast forward from 1.3.0+ds1-2 · 
    runc release 1.3.3+ds1-1 for experimental (rc-buggy) [dgit]

[dgit distro=debian split --quilt=gbp]
[dgit split-maint-view-tag=04baeca4a0ee5b41408cdc5a649ecf54ef218d38]
    Unverified

  • debian/1.3.3+ds1-1

    da3c7997 · debian/changelog: udpate · 
    runc release 1.3.3+ds1-1 for experimental (rc-buggy)

(maintainer view tag generated by dgit --quilt=gbp)

[dgit distro=debian split --quilt=gbp]
    Unverified

  • upstream/1.3.3+ds1

    fa01a0dd · New upstream version 1.3.3+ds1 · 
    Upstream version 1.3.3+ds1

  • v1.4.0-rc.3

    6c7d8ad6 · VERSION: release v1.4.0-rc.3 · 
    runc v1.4.0-rc.3 -- "その日、人類は思い出した。"

This release contains fixes for three high-severity security
vulnerabilities in runc (CVE-2025-31133, CVE-2025-52565, and
CVE-2025-52881). All three vulnerabilities ultimately allow (through
different methods) for full container breakouts by bypassing runc's
restrictions for writing to arbitrary /proc files.

Security:

* CVE-2025-31133 exploits an issue with how masked paths are implemented
  in runc. When masking files, runc will bind-mount the container's
  /dev/null inode on top of the file. However, if an attacker can
  replace /dev/null with a symlink to some other procfs file, runc will
  instead bind-mount the symlink target read-write. This issue affected
  all known runc versions.

  <https://github.com/opencontainers/runc/security/advisories/GHSA-9493-h29p-rfm2>

* CVE-2025-52565 is very similar in concept and application to
  CVE-2025-31133, except that it exploits a flaw in /dev/console
  bind-mounts. When creating the /dev/console bind-mount (to
  /dev/pts/$n), if an attacker replaces /dev/pts/$n with a symlink then
  runc will bind-mount the symlink target over /dev/console. This issue
  affected all versions of runc >= 1.0.0-rc3.

  <https://github.com/opencontainers/runc/security/advisories/GHSA-qw9x-cqr3-wc7r>

* CVE-2025-52881 is a more sophisticated variant of CVE-2019-19921,
  which was a flaw that allowed an attacker to trick runc into writing
  the LSM process labels for a container process into a dummy tmpfs file
  and thus not apply the correct LSM labels to the container process.
  The mitigation we applied for CVE-2019-19921 was fairly limited and
  effectively only caused runc to verify that when we write LSM labels
  that those labels are actual procfs files. This issue affects all
  known runc versions.

  <https://github.com/opencontainers/runc/security/advisories/GHSA-cgrx-mc8f-2prm>

Fixed:

 * Switched to (*CPUSet).Fill rather than our hacky optimisation when
   resetting the CPU affinity of runc. (#4926, #4927)
 * Correctly close child fds during (*setns).start if an error occurs.
   (#4930, #4936)

Thanks to the following contributors for making this release possible:

 * Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 * Aleksa Sarai <cyphar@cyphar.com>
 * Kir Kolyshkin <kolyshkin@gmail.com>
 * Lei Wang <ssst0n3@gmail.com>
 * Li Fubang <lifubang@acmcoder.com>
 * Rodrigo Campos <rodrigoca@microsoft.com>
 * Tõnis Tiigi <tonistiigi@gmail.com>

Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
    Unverified

  • v1.3.3

    d842d771 · VERSION: release v1.3.3 · 
    runc v1.3.3 -- "奴らに支配されていた恐怖を"

  ====================================================================
  NOTE: Some vendors were given a pre-release version of this release.
  This public release includes two extra patches to fix regressions
  discovered very late during the embargo period and were thus not
  included in the pre-release versions. Please update to this version.
  ====================================================================

This release contains fixes for three high-severity security
vulnerabilities in runc (CVE-2025-31133, CVE-2025-52565, and
CVE-2025-52881). All three vulnerabilities ultimately allow (through
different methods) for full container breakouts by bypassing runc's
restrictions for writing to arbitrary /proc files.

Security:

* CVE-2025-31133 exploits an issue with how masked paths are implemented
  in runc. When masking files, runc will bind-mount the container's
  /dev/null inode on top of the file. However, if an attacker can
  replace /dev/null with a symlink to some other procfs file, runc will
  instead bind-mount the symlink target read-write. This issue affected
  all known runc versions.

  <https://github.com/opencontainers/runc/security/advisories/GHSA-9493-h29p-rfm2>

* CVE-2025-52565 is very similar in concept and application to
  CVE-2025-31133, except that it exploits a flaw in /dev/console
  bind-mounts. When creating the /dev/console bind-mount (to
  /dev/pts/$n), if an attacker replaces /dev/pts/$n with a symlink then
  runc will bind-mount the symlink target over /dev/console. This issue
  affected all versions of runc >= 1.0.0-rc3.

  <https://github.com/opencontainers/runc/security/advisories/GHSA-qw9x-cqr3-wc7r>

* CVE-2025-52881 is a more sophisticated variant of CVE-2019-19921,
  which was a flaw that allowed an attacker to trick runc into writing
  the LSM process labels for a container process into a dummy tmpfs file
  and thus not apply the correct LSM labels to the container process.
  The mitigation we applied for CVE-2019-19921 was fairly limited and
  effectively only caused runc to verify that when we write LSM labels
  that those labels are actual procfs files. This issue affects all
  known runc versions.

  <https://github.com/opencontainers/runc/security/advisories/GHSA-cgrx-mc8f-2prm>

Added:

* runc update now supports configuring per-device weights and iops.
  (#4775, #4807, #4825, #4931)

Thanks to the following contributors for making this release possible:

 * Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 * Aleksa Sarai <cyphar@cyphar.com>
 * Kir Kolyshkin <kolyshkin@gmail.com>
 * Lei Wang <ssst0n3@gmail.com>
 * Li Fubang <lifubang@acmcoder.com>
 * Rodrigo Campos <rodrigoca@microsoft.com>
 * Tõnis Tiigi <tonistiigi@gmail.com>

Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
    Unverified

  • v1.2.8

    eeb7e602 · VERSION: release v1.2.8 · 
    runc v1.2.8 -- "鳥籠の中に囚われた屈辱を"

  ====================================================================
  NOTE: Some vendors were given a pre-release version of this release.
  This public release includes two extra patches to fix regressions
  discovered very late during the embargo period and were thus not
  included in the pre-release versions. Please update to this version.
  ====================================================================

This release contains fixes for three high-severity security
vulnerabilities in runc (CVE-2025-31133, CVE-2025-52565, and
CVE-2025-52881). All three vulnerabilities ultimately allow (through
different methods) for full container breakouts by bypassing runc's
restrictions for writing to arbitrary /proc files.

Security:

* CVE-2025-31133 exploits an issue with how masked paths are implemented
  in runc. When masking files, runc will bind-mount the container's
  /dev/null inode on top of the file. However, if an attacker can
  replace /dev/null with a symlink to some other procfs file, runc will
  instead bind-mount the symlink target read-write. This issue affected
  all known runc versions.

  <https://github.com/opencontainers/runc/security/advisories/GHSA-9493-h29p-rfm2>

* CVE-2025-52565 is very similar in concept and application to
  CVE-2025-31133, except that it exploits a flaw in /dev/console
  bind-mounts. When creating the /dev/console bind-mount (to
  /dev/pts/$n), if an attacker replaces /dev/pts/$n with a symlink then
  runc will bind-mount the symlink target over /dev/console. This issue
  affected all versions of runc >= 1.0.0-rc3.

  <https://github.com/opencontainers/runc/security/advisories/GHSA-qw9x-cqr3-wc7r>

* CVE-2025-52881 is a more sophisticated variant of CVE-2019-19921,
  which was a flaw that allowed an attacker to trick runc into writing
  the LSM process labels for a container process into a dummy tmpfs file
  and thus not apply the correct LSM labels to the container process.
  The mitigation we applied for CVE-2019-19921 was fairly limited and
  effectively only caused runc to verify that when we write LSM labels
  that those labels are actual procfs files. This issue affects all
  known runc versions.

  <https://github.com/opencontainers/runc/security/advisories/GHSA-cgrx-mc8f-2prm>

Thanks to the following contributors for making this release possible:

 * Aleksa Sarai <cyphar@cyphar.com>
 * Kir Kolyshkin <kolyshkin@gmail.com>
 * Lei Wang <ssst0n3@gmail.com>
 * Li Fubang <lifubang@acmcoder.com>
 * Rodrigo Campos <rodrigoca@microsoft.com>
 * Tõnis Tiigi <tonistiigi@gmail.com>

Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
    Unverified

  • archive/debian/1.3.2+ds1-1

    2c72db54 · Make fast forward from 1.3.0+ds1-4 · 
    runc release 1.3.2+ds1-1 for unstable (sid) [dgit]

[dgit distro=debian split --quilt=gbp]
[dgit split-maint-view-tag=5a2cb3137f64b481fc86e94f307752aee5a0c58c]
    Unverified

  • debian/1.3.2+ds1-1

    4e3ee706 · debian/changelog: update · 
    runc release 1.3.2+ds1-1 for unstable (sid)

(maintainer view tag generated by dgit --quilt=gbp)

[dgit distro=debian split --quilt=gbp]
    Unverified

  • upstream/1.3.2+ds1

    8086446e · New upstream version 1.3.2+ds1 · 
    Upstream version 1.3.2+ds1

  • upstream/1.3.2

    8682ccbe · New upstream version 1.3.2 · 
    Upstream version 1.3.2

  • v1.4.0-rc.2

    8aeb2a4b · VERSION: release v1.4.0-rc.2 · 
    runc v1.4.0-rc.2 -- "私の役目は信じるかどうかではない。行うかどうかだ。"

This is the second release candidate of the runc 1.4.0 release. It
includes a few minor features that did not make the cut-off for
v1.4.0-rc.1 (namely CLONE_INTO_CGROUP support and some new Intel RDT
features).

Users are strongly encouraged to test our release candidates over the
next month so we can fix issues before the general release. You should
expect runc 1.4.0 to be released at the end of October 2025 (at which
point, runc 1.2.z will only receive high-severity security fixes for 6
months and users are thus very strongly encouraged to migrate to a newer
version).

libcontainer API:

 * The deprecated libcontainer/userns package has been removed; use
   github.com/moby/sys/userns instead. (#4910, #4911)

Added:

 * Allow setting user.* sysctls for user-namespaced containers, as they
   are namespaced and thus safe to configure. (#4889, #4892)
 * Add support for using clone3(2)'s CLONE_INTO_CGROUP flag when
   configuring the runc exec process. This also included some internal
   changes to how we add processes to containers. (#4822, #4812, #4920)
 * Add support for configuring the NUMA pmemory policy for a container
   with set_mempolicy(2). (opencontainers/runtime-spec#1282, #4726,
   #4915)
 * Add support for intelRdt.schemata to allow for configuration of all
   schemas in resctrl. (opencontainers/runtime-spec#1230, #4830, #4915)
 * Add support for intelRdt.enableMonitoring to allow for per-container
   resctrl monitoring. This replaces the old intelRdt.enableCMT and
   intelRdt.enableMBM options which were never implemented by runc and
   have been removed from the runtime-spec.
   (opencontainers/runtime-spec#1287, #4832, #4921)

Fixed:

 * Configure personality(2) before applying seccomp profiles. (#4900,
   #4903)
 * Fixed integration test failure on ppc64, caused by 64K page size so
   the kernel was rounding memory limit to 64K. (#4841, #4895, #4893)
 * seccompagent: fix fd close loop to prevent closing stdio in the error
   path. (#4913, #4923)

Thanks to the following contributors for making this release possible:

 * Aleksa Sarai <cyphar@cyphar.com>
 * Antti Kervinen <antti.kervinen@intel.com>
 * Donet Tom <donettom@linux.ibm.com>
 * Joshua Rogers <MegaManSec@users.noreply.github.com>
 * Kir Kolyshkin <kolyshkin@gmail.com>
 * Markus Lehtonen <markus.lehtonen@intel.com>
 * Rodrigo Campos <rodrigoca@microsoft.com>
 * Tycho Andersen <tycho@tycho.pizza>
 * Vishal Chourasia <vishalc@linux.ibm.com>
 * Li Fubang <lifubang@acmcoder.com>

Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
    Unverified

  • v1.3.2

    aeabe4e7 · VERSION: release v1.3.2 · 
    runc v1.3.2 -- "Ночь, улица, фонарь, аптека..."

This is the second patch release of the 1.3.z release series of runc.
It primarily includes some minor fixes for issues found in 1.3.0.

Changed:
 * The conversion from cgroup v1 CPU shares to cgroup v2 CPU weight is
   improved to better fit default v1 and v2 values. (#4772, #4785, #4897)
 * Dependency github.com/opencontainers/cgroups updated from v0.0.1 to
   v0.0.4. (#4897)

Fixed:
 * runc state: fix occasional "cgroup.freeze: no such device" error.
   (#4798, #4808, #4897)
 * Fixed integration test failure on ppc64, caused by 64K page size so the
   kernel was rounding memory limit to 64K. (#4841, #4895, #4893)

Thanks to the following contributors who made this release possible:
 * Aleksa Sarai <cyphar@cyphar.com>
 * Jared Ledvina <jared.ledvina@datadoghq.com>
 * Kir Kolyshkin <kolyshkin@gmail.com>
 * Rodrigo Campos <rodrigoca@microsoft.com>
    Unverified

  • debian/1.3.0+ds1-4

    d8e7181e · Update changelog for 1.3.0+ds1-4 release · 
    runc release 1.3.0+ds1-4 for unstable

[dgit distro=debian split --quilt=gbp]
[dgit please-upload source=runc version=1.3.0+ds1-4 upstream-tag=upstream/1.3.0+ds1 upstream=34e2709ed5c748c2801ed88ac57dd92a2e4315b5]
    Unverified

  • archive/debian/1.3.0+ds1-4

    eca7cbad · Declare fast forward from 1.3.0+ds1-3 · 
    runc release 1.3.0+ds1-4 for unstable (sid) [dgit]

[dgit distro=debian split --quilt=gbp]
    Unverified

  • debian/1.3.0+ds1-3

    085e6b86 · debian/changelog: update · 
    runc release 1.3.0+ds1-3 for unstable

[dgit distro=debian split --quilt=gbp]
[dgit please-upload source=runc version=1.3.0+ds1-3 upstream-tag=upstream/1.3.0+ds1 upstream=34e2709ed5c748c2801ed88ac57dd92a2e4315b5]
    Unverified

  • archive/debian/1.3.0+ds1-3

    786875a6 · Declare fast forward from 1.1.15+ds1-2 · 
    runc release 1.3.0+ds1-3 for unstable (sid) [dgit]

[dgit distro=debian split --quilt=gbp]
    Unverified

  • debian/1.3.0+ds1-2

    a78fe4b0 · update debian/changelog · 
    runc Debian release 1.3.0+ds1-2

  • archive/debian/1.3.0+ds1-2

    9eaefb4a · Make fast forward from 1.3.0+ds1-1 · 
    runc release 1.3.0+ds1-2 for experimental (rc-buggy) [dgit]

[dgit distro=debian split --quilt=gbp]
    Unverified

  • archive/debian/1.3.0+ds1-1

    0146cfb3 · Make fast forward from 1.1.12+ds1-4 · 
    runc release 1.3.0+ds1-1 for experimental (rc-buggy) [dgit]

[dgit distro=debian split --quilt=gbp]
[dgit split-maint-view-tag=f935659f143325787fa5ade2a92934f6f4b703b6]
    Unverified

  • debian/1.3.0+ds1-1

    a85afc46 · update debian/changelog · 
    runc release 1.3.0+ds1-1 for experimental (rc-buggy)

(maintainer view tag generated by dgit --quilt=gbp)

[dgit distro=debian split --quilt=gbp]
    Unverified