runc v1.3.0-rc.1 -- "No tengo miedo al invierno, con tu recuerdo lleno de sol." This is the first release candidate of the runc 1.3.0 release. It contains a couple of new features, but is mostly made up of some minor (but notable) API changes to libcontainer as well as a series of bug fixes. This is the first release series that will follow our new release policy, meaning that user should expect runc 1.3.0 to be released at the end of April 2025, at which point the support policy for the runc 1.2.z branch will change. Please see the new RELEASES.md document for more information. Users are strongly encouraged to test our release candidates over the next two months so we can fix issues before the general release. API Changes: * configs.CommandHook struct has changed, Command is now a pointer. Also, configs.NewCommandHook now accepts a *Command. (#4325) * The Process struct has User string field replaced with numeric UID and GID fields, and AdditionalGroups changed its type from []string to []int. Essentially, resolution of user and group names to IDs is no longer performed by libcontainer, so if a libcontainer user previously relied on this feature, now they have to convert names to IDs before calling libcontainer; it is recommended to use Go package github.com/moby/sys/user for that. (#3999) * Move libcontainer/cgroups to a separate repository. (#4618) Fixes: * runc exec -p no longer ignores specified ioPriority and scheduler settings. Similarly, libcontainer's Container.Start and Container.Run methods no longer ignore Process.IOPriority and Process.Scheduler settings. (#4585) * We no longer use F_SEAL_FUTURE_WRITE when sealing the runc binary, as it turns out this had some unfortunate bugs in older kernel versions and was never necessary in the first place. (#4641, #4640) * runc now uses a more flexible method of joining namespaces, which better matches the behaviour of nsenter(8). This is mainly useful for users that create a container with a runc-managed user namespace but want the container to join some externally-managed namespace as well. (#4492) * runc now properly handles joining time namespaces (such as with runc exec). Previously we would attempt to set the time offsets when joining, which would fail. (#4635, #4636) * Handle EINTR retries correctly for socket-related direct golang.org/x/sys/unix system calls. (#4637) * Handle close_range(2) errors more gracefully. (#4596) * Fix a stall issue that would happen if setting O_CLOEXEC with CloseExecFrom failed (#4599). * Handle errors on older kernels when resetting ambient capabilities more gracefully. (#4597) Changed: * runc now has an official release policy to help provide more consistency around our release schedules and better define our support policy for old release branches. See RELEASES.md for more details. (#4557) * Improved performance by switching to strings.Cut where appropriate. (#4470) * The minimum Go version of runc is now Go 1.23. (#4598) * Updated builds to libseccomp v2.5.6. (#4625) Added: + runc has been updated to support OCI runtime-spec 1.2.1. (#4653) + CPU affinity support for runc exec. (#4327) + CRIU support can be disabled using the build tag runc_nocriu. (#4547) + Support to get the pidfd of the container via CLI flag pidfd-socket. (#4045) + Support skip-in-flight and link-remap options for CRIU. (#4627) + Support cgroup v1 mounted with noprefix. (#4513) Thanks to the following contributors for making this release possible: * Adam Korczynski <adam@adalogics.com> * Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp> * Aleksa Sarai <cyphar@cyphar.com> * Brad Davidson <brad.davidson@rancher.com> * Daniel Levi-Minzi <dleviminzi@gmail.com> * Evan Phoenix <evan@phx.io> * Jian Wen <wenjianhn@gmail.com> * Kir Kolyshkin <kolyshkin@gmail.com> * Rin Arakaki <rnarkkx@gmail.com> * Rodrigo Campos <rodrigoca@microsoft.com> * Sebastiaan van Stijn <github@gone.nl> * Tomasz Duda <tomaszduda23@gmail.com> * Wei Fu <fuweid89@gmail.com> * Yangzhao Hjh <yangzhao.hjh@alibaba-inc.com> * lifubang <lifubang@acmcoder.com> Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>