最新のセキュリティ情報
10月7日(水)
runc v1.6.0-rc.1 -- "Lo bueno, si breve, dos veces bueno."
This is the first release candidate of the upcoming runc 1.6.0 release. It contains a couple of new features, but is mostly made up of various cleanups (such as the removal of many deprecated APIs) and improvements. This version includes all of the patches backported to runc v1.5.2. Users are strongly encouraged to test our release candidates so we can fix issues before the general release. libcontainer API configs.ToCPUSet now returns a unix.CPUSetDynamic instead of a *unix.CPUSet , and the Initial / Final fields of configs.CPUAffinity and the Nodes field of configs.LinuxMemoryPolicy have ch…
9月26日(土)
runc v1.5.2 -- "Всё сбудется, стоит только расхотеть!"
This is the second patch release in the 1.5.z release series of runc, which primarily includes a workaround for a Linux kernel bug causing random runc crashes when using cgroup v2, and other fixes. Fixed runc exec -p with a process.json lacking env now sets HOME again (a regression in runc 1.3.0). ( #5265 , #5266 , #5459 ) Worked around a Linux kernel bug (present since kernel v6.17, fixed in v7.2) which caused the kernel to write past the end of the structure provided by userspace (runc). This resulted in memory corruption inside runc (manifesting as random crashes) when configuring device r…
7月14日(火)
runc v1.5.1 -- "El lujo es vulgaridad, dijo, y me conquistó."
This is the first patch release in the 1.5.z release series of runc, and primarily includes a fix for a serious regression on Ubuntu 20.04 kernels. Fixed There was a regression reported in with the maskPaths optimisation added in 1.5.0-rc.3 ( #5275 ). On Ubuntu Focal (20.04), attempts to mount tmpfs with the nr_inodes=1 option will fail due to a downstream kernel patch (ironically originating from AUFS). We now have a fallback path using nr_inodes=2 instead if the operation fails. ( #5348 , #5358 , #5359 ) Properly handle EINVAL for seccomp SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV when trying t…
6月19日(金)
runc v1.5.0 -- "Why do we even have that lever?!"
This is the somewhat-delayed^Wlong-awaited first stable release of the 1.5.z release branch of runc. It contains a handful of fixes for issues found in 1.5.0-rc.3 and an important dependency bump for libpathrs. This is the third release of runc following our new release and support policy (see RELEASES.md for more details). This means that, as of this release: The runc 1.2.z (and earlier) release branches are now completely unsupported. The runc 1.3.z release branch will now only receive high severity CVE fixes, and will no longer be supported in less than 6 months (end of October 2026). The…
6月14日(日)
runc 1.3.6 -- "On no account should you allow a Vogon to read poetry at you."
This is the sixth patch release of the 1.3.z series of runc. Among some performance improvements and bugfixes, it includes a fix for a low-severity vulnerability ( CVE-2026-41579 ) and users are encouraged to update. As it was a low-severity vulnerability and it was reported by multiple people, we decided to release it publicly with NO EMBARGO. Security This release includes a fix for the following low-severity security issue: CVE-2026-41579 allowed a malicious image with a /dev symlink to have limited write access to the host filesystem in ways that our analysis indicates was too limited to…
runc 1.5.0-rc.3 -- "The best way to get a drink out of a Vogon is to stick your finger down his throat."
This is the third release candidate for the 1.5.z series of runc. Among some performance improvements and bugfixes, it includes a fix for a low-severity vulnerability ( CVE-2026-41579 ) and users are encouraged to update. As it was a low-severity vulnerability and it was reported by multiple people, we decided to release it publicly with NO EMBARGO. We plan to release 1.5.0 in the next two weeks. Security This release includes a fix for the following low-severity security issue: CVE-2026-41579 allowed a malicious image with a /dev symlink to have limited write access to the host filesystem in…
runc 1.4.3 -- "The best way to irritate him is to feed his grandmother to the Ravenous Bugblatter Beast of Traal."
This is the third patch release of the 1.4.z series of runc. Among some performance improvements and bugfixes, it includes a fix for a low-severity vulnerability ( CVE-2026-41579 ) and users are encouraged to update. As it was a low-severity vulnerability and it was reported by multiple people, we decided to release it publicly with NO EMBARGO. Security This release includes a fix for the following low-severity security issue: CVE-2026-41579 allowed a malicious image with a /dev symlink to have limited write access to the host filesystem in ways that our analysis indicates was too limited to…
4月3日(金)
runc v1.5.0-rc.2 -- "いざやいざや、見に行かん"
This is the second release candidate of the runc 1.5.0 release. It mostly contains build fixes and improvements, but also includes a new minor feature and some deprecations. runc v1.5.0-rc.2 includes all of the patches backported to runc v1.4.2 . Users are strongly encouraged to test our release candidates over the next few weeks so we can fix issues before the general release. You should expect runc 1.5.0 to be released at the end of April 2026 (at which point, runc 1.3.z will only receive high-severity security fixes for 6 months and runc 1.2.z will become unmaintained -- users are thus ver…
runc v1.4.2 -- "Я — Земля! Я своих провожаю питомцев"
This is the second patch release of the 1.4.z release series of runc. Fixed A regression in runc v1.3.0 which can result in a stuck runc exec or runc run when the container process runs for a short time. ( #5208 , #5210 , #5216 ) Mount sources that need to be open on the host are now closed earlier during container start, reducing the total amount of used file descriptors and helping to avoid hitting the open files limit when handling many such mounts. ( #5177 , #5201 ) Static Linking Notices The runc binary distributed with this release are statically linked with the following GNU LGPL-2.1 l…
3月18日(水)
runc v1.3.5 -- "Lo viejo funciona!"
This is the fifth patch release of the 1.3.z release series of runc, and primarily contains a few fixes for issues found in 1.3.4. Fixed Recursive atime-related mount flags (rrelatime et al.) are now applied properly. ( #5115 , #5098 ) PR #4757 caused a regression that resulted in spurious cannot start a container that has stopped errors when running runc create and has thus been reverted. ( #5158 , #5153 , #5151 , #4645 , #4757 ) Changed Updated builds to Go 1.25, libseccomp v2.6.0. ( #5111 , #5053 ) Minor signing keyring updates. ( #5146 , #5139 , #5144 , #5148 ) Static Linking Notices The…