runc

runc copied to clipboard

Seen on https://cirrus-ci.com/task/5467129087524864?logs=integration_systemd#L99. ``` not ok 76 kill detached busybox # (in test file tests/integration/kill.bats, line 27) # `[ "$status" -eq 0 ]' failed # runc spec (status=0): # #...

kolyshkin

fix set config back error for runc update

11

Now, if we use `runc update` to update the resources limit of a container, `runc` will set configs back when there is an error. But, we can't set the config...

lifubang

Minor cleanups in libcontainer and loadFactory

2

#### libct.IntelRdtFs(): simplify - remove unneeded wrapping func, as intelrdt.NewManager already has the correct signature. - reverse the if/else to be clearer that either "IsCATEnabled()" and/or "IsMBAEnabled()" need to be...

thaJeztah

RFC: Set arbitrary uid gid in user namespace

2

Currently in case of rootless scenario which implies usernamespace creation. The only one user inside user namespace which is allowed - it's root user. But for scenarios with higher level...

AlexeyPerevalov

Add CODEOWNERS

2

jdolitsky

Run gosec against runc

4

I extended the GitHub action to run gosec as part of a build. I mitigated the one finding: * In checkpoint.go there was a `Atoi` followed by a cast to...

SaschaSchwarze0

libct/capabilities: create capabilities map based on current environment

12

Relates to: - https://github.com/moby/moby/issues/42906 docker container is privileged tries to assume more capabilities than available - https://github.com/moby/buildkit/pull/2394 fix: provide only available capabilities to insecure environment - https://github.com/moby/moby/pull/42911 fix: don't attempt...

thaJeztah

Allow /proc/sys/net to be mounted read-write if container is in not-host netns

1

WIP: This branch has only been build-tested. Closes #2826

JonathonReinhart

libcontainer: add support for Landlock

4

This patch introduces Landlock Linux Security Module (LSM) support in runc, which was landed in Linux kernel 5.13. This allows unprivileged processes to create safe security sandboxes that can securely...

kailun-qin

Enabling perf_event support in runc #2240 Signed-off-by: Paweł Szulik

Creatone