Dockerfile: update runc binary to v1.3.4#51633
Conversation
| # that is used. If you need to update runc, open a pull request in the containerd | ||
| # project first, and update both after that is merged. | ||
| ARG RUNC_VERSION=v1.3.3 | ||
| ARG RUNC_VERSION=v1.3.4 |
There was a problem hiding this comment.
I think we tried to align this one ~ with the containerd.io packages; we can update it to 1.4 later probably, or did containerd already move to 1.4 now?
There was a problem hiding this comment.
It has been bumped to 1.4.0 just a few hours ago: containerd/containerd@fbb42c2 . I rebased both commit and PR description to match v1.4.0 instead of v1.3.4!
There was a problem hiding this comment.
Ah, right, that's the main branch, so currently targeting containerd v2.3.0 (May 2026), but perhaps it's OK to backport
c2653d2 to
b9ceb7d
Compare
b9ceb7d to
fd7fadc
Compare
There was a problem hiding this comment.
Let's go with v1.3.4 for now. It also has the patch for the regression introduced by the CVE fix.
We want to be able to release minor/patch releases from master for now, and runc 1.4.0 has been out only for a few days, so I'd like to give it a little bit more baking time.
- release notes: https://github.com/opencontainers/runc/releases/tag/v1.4.0 - full diff: opencontainers/runc@v1.3.3...v1.4.0 This version bump aims to fix a regression in runc v1.3.3, which caused /dev/shm to have inappropriate permissions exposed to containers: * opencontainers/runc#4971 * opencontainers/runc#4976 Signed-off-by: Luciano Ciccariello <xeeynamo@hotmail.com>
fd7fadc to
f97f234
Compare
thaJeztah
left a comment
There was a problem hiding this comment.
LGTM, thanks!
let’s open a follow-up with 1.4; we can keep that one in draft (at least to have CI run), then decide when the right moment is to merge.
|
Do you have any plans to backport it to the |
|
This only impacts the static binaries; if you have installed docker through the deb or rpm packages you should be able to get the update by updating the containerd.io package to the latest version. |
This version bump aims to fix a regression in runc v1.3.3, which caused
/dev/shmto have inappropriate permissions exposed to containers:Fixes docker/for-mac#7804