linux/meta-virtualization.git/recipes-containers/crun, branch master-next

crun: update to 1.28-tip

2026-05-28T16:03:10+00:00

Crosses both the 1.27 and 1.28 release tags. Adds json-c (>= 0.14) to DEPENDS — upstream crun's configure.ac now does an unconditional PKG_CHECK_MODULES([JSON_C], [json-c >= 0.14]) and won't configure without it. The dep is satisfied by oe-core's json-c_0.18.bb. Bumping crun to version 1.28-1-g7e45b26b, which comprises the following commits: 54f16ffb NEWS: tag 1.28 c6f338ac Do not follow rootfs /dev symlinks (CVE-2026-47766) 535e114b krun: request enabling DHCP client e521de6a krun: check krun_add_net_unixstream dlsym bd939e69 tests: add libzstd-devel to fuzzing Dockerfile 1edb6cc7 tests, system-blake3: drop libyajl-dev 21c96879 krun: document microVM configuration options in man page a6151b6a krun: add support for nested virtualization 9f67d80b Build: Use system libblake if available b62cfdda Replace YAJL with json-c for JSON parsing and generation b1cf0328 status: restrict valid container ID names 7771192e cgroup: reject ".." in delegate-cgroup annotation a773c6bb tests: set executable bit for python test files 5fc99f02 tests: drop centos8-build CI job a8deee3b chroot_realpath: fix potential buffer overflows in destination buffer db1be9b2 .clang-format: fixup for v22.1.4 d914b7d8 exec: use default env with --env d85bf0e8 crun exec: more verbose exec error message 8fab8854 build(deps): bump uraimo/run-on-arch-action from 3.0.1 to 3.1.0 ac46d9a0 krun: allow configuring the virtiofs device 3212b444 fix: correct UID/GID mapping buffer offset for multi-line mappings d328b172 krun: fix parsing optional fields from krun_vm.json 738f7ad7 krun: reopen config file d0277ef8 libcrun: use O_PATH where applicable 3ec076b3 NEWS: tag 1.27.1 60b2e8f8 tests, podman: pin to 5.8 3010d29d tests: fix failure in user namespace d6ffa244 krun: remove unused variable 1c5c2f7d linux: pass correct propagation to get_bind_mount d97461f0 tests: add regression test for idmapped mount leak 59cfa8b8 Revert "linux: skip redundant MS_PRIVATE propagation mounts" f1b70c0b tests: add subcgroup cleanup test 6177dd86 cgroup: fix recursive cgroup cleanup consuming caller's fd 6c58b0c6 fix -Wdiscarded-qualifiers warnings acb904c6 krun: Build passt argv based on nitro variant 8199cbb2 krun: implement support for passt networking 7c2500df krun: ignore RAM configurations below 128MB 23f7d9f0 krun: consolidate configuration in configure_vm 04c19ac6 krun: process the vm configuration earlier 81c21e0d handlers: add new hook to close fds d8813f3d .codespellrc: ignore passt 94d7f641 utils: fix apparmor profile not applied in user namespaces 805e6a44 libcrun: skip cgroup filesystem type check when cgroups are disabled 4c530d43 libcrun: fall back to bind mount for /dev/console on read-only file systems a718a92c NEWS: tag 1.27 6220914d nix: generate git-version.h in buildPhase 9553f8b8 exec: strengthen -u value validation 1bd7f424 exec: fix CVE-2026-30892 5699da29 nix: fix zlib cross-compilation for s390x 237f8100 nix: remove global overlay to eliminate rebuild cascade b37594dc release: use path: flake ref to avoid libgit2 safe.directory aaa6056c release: seed /nix from container image when empty c4e3fd22 linux: set MS_PRIVATE on detached mounts from get_bind_mount() 360621a3 Revert "container: skip sigaction reset in unblock_signals for the run path" 5d1b0284 nix: migrate to flakes 246a3367 nix: generate git-version.h in buildPhase 3e9986bc nix: bump nixos/nix image from 2.24.9 to 2.34.2 094c97f3 nix: update 195f664f seccomp_notify: tighten crun_make_error input 1d76be72 seccomp: tighten crun_make_error input 62d3e852 container: tighten crun_make_error input 254a8a75 linux: use open_tree+mount_setattr for device mounts 2d6f4c0e linux: use open_tree+move_mount for masked paths 45e62ce5 linux: use open_tree+mount_setattr for readonly paths f53aa376 linux: use mount_setattr for readonly remounts in finalize_mounts 2dae2238 linux: skip redundant MS_PRIVATE propagation mounts 38e17199 container: skip sigaction reset in unblock_signals for the run path 4b66d8f0 cgroup: skip enable_controllers when joined via CLONE_INTO_CGROUP a59b186b linux: validate run.oci.mount_context_type annotation value 16bd4e48 utils: do not use errno after success 63ce25da container: delete the container on poststart hooks failures crun/ocispec: update to latest fb6b69f src: replace YAJL with json-c for JSON parsing and generation eb7489b fuzzing: add multi-mode round-trip fuzzer and CI job e6cba25 tests: add test-15 for int64 and uint64 value parsing f6f93b0 validate: fix LibFuzzer build by removing HF_ITER and guarding main() f310714 tests: fix memory leak of error string in test-2 1315777 ci: update GitHub Actions to non-deprecated versions 7e13990 ci: pin to ubuntu 24.04 015bb87 sources: extract compound field generate pattern into emit_compound_gen() 37bba6c sources: extract pointer clone pattern into emit_pointer_clone() be6fbb4 sources: use free_and_null() in pointer type emit_free methods 92f2b1d sources: extract common array generate preamble into helper 790d3a6 sources: extract common array parse preamble into helper 689ac4b sources: centralize JSON library references into json_api.py 5a0e037 source: fix ByteArrayHandler nested array parsing 03bae1d source: add missing emit_clone() to BasicMapArrayHandler dbb5155 source: fix invalid else() syntax in byte array generation 692b0b6 source: fix typo in ByteArrayHandler nested array parsing 2acd6dc source: fix mapStringObject clone to copy len and keys crun/rspec: update to v1.3.0-tip 63c1dd6 Blank line before table Fixes #1134 c668b01 config-linux: allow empty strings in memory policy nodes field 0ef13af Add step to update website after a release crun/imagespec: update to v1.1.1-tip 751ed12 Fix one-sentence-per-line violations b9060a3 Clarify that whiteout filenames require a non-empty basename fccd049 Fix: Make the config field optional Signed-off-by: Bruce Ashfield

crun: update to 1.26

2026-03-18T05:07:38+00:00

Bumping crun to version 1.26-160-g393509db, which comprises the following commits: 0a3e929f utils: fix memory leak and missing cache in libcrun_initialize_apparmor() 63ce25da container: delete the container on poststart hooks failures b0847b3e Document error handling cf27a14b fix(utils): use parent dir fd for bind on long socket paths aca98960 fix(hooks): log warning when poststop hooks fail 115ac2e6 cgroup: preserve errno on errors in rmdir_all_fd 4db1709f libcrun: check setenv failure 8feac6b9 fix(utils): retry fgetpwent_r() on EINTR 52b7016f pass cgroup2 mount options to the kernel 30426104 tests/podman: exclude --tls-details tests 6e43ff33 tests/podman/run-tests.sh: fix ginkgo args fa7a5561 tests/podman/run-tests.sh: untangle -skip arg 3a1addc7 fix(python): initialize error variable to NULL in Python bindings 00206a80 channel_fd_pair: fix CPU busy loop when output pipe is blocked dbd02baa criu: show excerpt from log file on c/r error 34143735 hooks: allow ignoring chdir permission errors for container hooks 11af5b2d crui: simplify criu_check_mem_track error message. 8d0ef603 container: remove dead code in setup_terminal_socketpair 6c5c957e container: fix createRuntime hooks not receiving bundle path d24d0283 criu: check for criu_check_version error 3ade23f4 plans: install iptables-legacy on CS9 3e41e53b Packit/TMT: re-enable centos-stream-10-x86_64 tests c46a44a8 restore: fix memory leak 7cec3cb2 build(deps): bump actions/upload-artifact from 6 to 7 4e0e2679 mounts: fix error message argument be231d3c ci: bump shellcheck to v0.11.0 b36ec403 ci: fix go-md2man installation 35648b9b tests: switch from docker hub to quay for Fedora 5002665f tests/clang-check: install clang-analyzer bdf9c902 status: drop unnecessary strtoll 11701f43 criu: fix missing umount() in error path 314c2efa utils: refactor set_home_env aecd620a libcrun: document vfork shared error 04d7a341 cloned_binary: do not close file descriptor twice 3f72f325 ci: simplify codespell job 47c36ca5 linux: do not use errno after success a278c6d1 linux: drop unnecessary xasprintf result check 3e313388 linux: do not leak error 434d77cb cgroup-systemd: do not use errno after success 335792b1 scheduler: add diagnostic messages for SCHED_DEADLINE 4db170c5 criu: do not ignore errors with ret != -1 036132e2 cgroup: do not clobber errno 1649a4d3 container: do not use bogus errno 2e527065 linux: do not use errno without failure a0be577a tests/podman: exclude ever failing test case e38674bc linux: fix copy_from_fd ownership 8fa73419 linux: drop unnecessary code 60d8a60e linux: do not leak error 9a232317 utils: do not use errno after success d5b20987 container: do not use errno after success e2c09bfd ci: use git diff --exit-code f1c6ca6a ci: fix test (check) flake 69d39045 linux: create error from uidgidmap_helper 1492e83c cgroup: fix read_pids_cgroup skipping child cgroups c5879bab container: make return clearer a154b398 container: return the error from cgroup_killall 899b9faa seccomp: fix n_plugins calculation 463e277a krun: Rename nitro module to awsnitro b32f895b container: fix exit code return a6023b10 container: add missing crun_make_error 52294f84 libcrun: standardize error code after yajl_gen_alloc 59da15f3 container: add missing yajl cleanup 5082e02d container: do not leak error a83a4cf9 container: improve error handling after libcrun_copy_config_file call 6733e20c linux: use crun_error_wrap 0f367791 container: do not use errno after successful calls 29bb32d8 linux: do not use errno after successful calls e7ffed11 krun: fix error arguments 34c1e098 krun: avoid redundant crun_error_release() call dedcdd67 krun: do not release error when *err is uninitialized 671740dd krun: fix error code 1644fb0e container: fix error leak 649d568a krun: fix error return 41a14fe8 krun: Propagate crun log level to libkrun 2bff1297 libcrun: add `krun.` as a potentially unsafe annotation 41941f2c krun: parse annotations for krun.{cpus, ram_mib} 625226de krun: parse annotations for krun.variant f311dc07 Add handler phase HANDLER_CONFIGURE_BEFORE_USERNS, and move krun setup to it 488f301d linux: check for def->linux b1a71725 linux: check for [ug]id_mappings before accessing them df771204 krun: Set exec args when running nitro variant b78e9868 krun/nitro: Redirect enclave VM output to stdout bf288342 krun: Remove specific function for nitro config 8e8186b3 hooks: exit immediately if poststart hooks fail 88f55126 AGENTS.md: new file 71077a22 utils: flush gcov data before closing files 3241e671 NEWS: tag 1.26 5bee6a06 utils: handle NULL container passed to libcrun_open_proc_file() 4df0d339 cgroup: rename enter_cgroup_subsystem 6c98db0b tests: add tests for crun custom annotations 29a39ebf tests: add cgroup unit tests for coverage 3ef2a77f tests: add more utils unit tests for coverage 87997df0 tests: add seccomp_notify unit tests for coverage 890fff10 tests: add chroot_realpath unit tests for coverage 440e3b09 tests: add mount_flags.perf unit tests for coverage 869343fb tests: add signals.perf unit tests for coverage 2a3193ab tests: add logger info to checkpoint_restore 72793562 tests: add linux.c integration tests for coverage 1407bb39 tests: add linux.c unit tests for coverage 638266c7 tests: add error handling coverage tests for linux.c b18734b5 tests: add namespace coverage tests for linux.c 8a26d6ba tests: add comprehensive tests for custom-handler.c a968a262 tests: add more unit tests for error.c coverage 935eb0c7 tests: improve error logging and add more coverage tests 035f2a07 tests: ignore profiling output in test_simple_delete b9781954 tests: fix memory-high test to use unified resources 1bbe7e22 tests: add more seccomp tests for coverage 07d6400b tests: add error handling tests for coverage 422f4b87 tests: skip mount-bind-to-rootfs in rootless mode 5cad31a4 tests: improve sd-notify-proxy test error handling bc91dd35 tests: fix checkpoint/restore tests for stability f5e6c330 tests: add Linux features tests 58e00a52 tests: add I/O priority tests ae06b46c tests: add create command tests 1e5f7ec5 tests: add cgroup setup tests 89b124e0 tests: add namespace isolation tests 14dcfea1 tests: add scheduler policy tests 7543b013 tests: add comprehensive OCI lifecycle hook tests 1404ccaa tests: add terminal tests for coverage 5ce5ad6d tests: add comprehensive update command tests 6a3fdc16 tests: add command tests for pause, unpause, kill, list, ps, spec 2959911b tests: skip resources-cpu-weight-systemd when systemd cgroup fails 90d6390c tests: skip bpf-devices-systemd when eBPF installation fails cfe9a063 tests: fix variable names in test_bpf_devices logger calls 3f73b0f2 tests: add more seccomp tests for coverage ec0f5cf8 tests: add network device tests for coverage 24f2491c tests: add more BPF device filter tests for coverage 360406d7 tests: add cgroup resources tests for coverage ba669d8e tests: add cgroup manager env var support 06541b69 tests: add multi-environment coverage script f9385a6c tests: remove unused Makefile bab81968 tests: add exit command to init 49e080a1 coverage: add _safe_exit macro to flush gcov data before _exit 26900326 criu: fix error release 2805abde container: fix error release 1b8e2a39 crun.1: add documentation for criu config files ec7325a3 tests: add tests for criu config set via rpc 17f23ac2 criu: enable setting of RPC config file de8d3288 krun: do not leak handles on error 0b3c673f build(deps): bump actions/cache from 4 to 5 456dd8e2 build(deps): bump actions/upload-artifact from 5 to 6 d833dac0 libocispec: sync 4798015e build: add tests coverage b4db5d32 tests: use hide_stderr=True to avoid coverage output interference bfbb68eb tests: do not call function twice a1d5168d tests: replace all sys.stderr.write calls with proper logging 11a43732 tests: improve TAP skip reason reporting with specific explanations 0be79fe8 tests: add slow test detection and warnings to TAP output 8e9ef557 tests: enhance TAP error reporting with more diagnostic information 6d4cd432 tests: add writable /tmp tmpfs mount to base test configuration 7ca36e36 tests: remove debug print statements in test_hooks 6607eb2f linux: run createContainer hooks before making root RO baec9675 libocispec: sync from upstream c5d5f185 tests: install honggfuzz from sources d2b00600 linux: handle openat error b106e250 container: fix error release 156ae065 NEWS: tag 1.25.1 60a9183e build(deps): bump actions/checkout from 5 to 6 332c2188 utils: invalidate proc_fd on open_proc_file 50e9898f utils: use fsopen to open reference to proc 2e86c95a src: move syscall wrappers to new file c2fa3c6a cgroup-systemd: use open_proc_file to get cgroup path 8e9ae3d4 cgroup: use open_proc_file to get cgroup path 1aeac1e8 linux: use open_proc_file to setup namespaces 0f200e55 linux: use open_proc_file to setup net devices 4be73c6d linux: use open_proc_file to initialize security 30c575e5 utils: use open_proc_file for mark_or_close_fds_ge_than da40063a linux: use open_proc_file to open current mountns 7172631e linux: use open_proc_file to setup oom score 8822a5e6 linux: use open_proc_file to setup sysctls b66a8990 linux: use open_proc_file to setup timens_offsets 3f5258a0 linux: use open_proc_file to setup userns mappings 064bbfe4 container: use open_proc_file in resolve_rootfs_path 58856b56 utils: add functions to open files under /proc d9a0adce NEWS: tag 1.25 d94659a3 podman: disable artifact test 0fc276cc cgroup-systemd: enable all accounting properties to ensure stats are readable 9feec597 libcrun/cgroup: always enable TasksAccounting for systemd 078e2d6d build(deps): bump actions/upload-artifact from 4 to 5 6b12c6a8 Libcrun/container: Fix double allocation of 'err' b718483c Libcrun/seccomp: fix double allocation of 'err' 65532fc5 build(deps): bump github/codeql-action from 3 to 4 a9187097 Reset the inherited cpu affinity crun/ocispec: update to 5a0e037 source: fix ByteArrayHandler nested array parsing 03bae1d source: add missing emit_clone() to BasicMapArrayHandler dbb5155 source: fix invalid else() syntax in byte array generation 692b0b6 source: fix typo in ByteArrayHandler nested array parsing 2acd6dc source: fix mapStringObject clone to copy len and keys c7ce09d ci: print test-suite.log on test failure 8cff3b9 tests: add test-12 and test-13 for better coverage 16a30ff source: add NULL check to generated clone functions 507cf52 source: fix BasicMapType.emit_clone() to handle NULL maps 2c8d0f8 gitignore: update a425a84 source: rename doublearray to nested_array 7d7e02c source: add struct-level methods to TypeHandler classes dc24f9a source: refactor ArrayType using ArraySubtypeHandler classes fed6acc source: add BooleanPointerType.emit_generate() and emit_json_value() 81ff1fa source: document ObjectType.emit_clone() design decision d91d34a source: add emit_gen_key_with_check() helper 11b951f source: extract get_compound_children() helper 4ff4117 source: inline c_file_map_str() into make_c_free() e59b696 source: inline c_file_str() into ArrayType.emit_free() 337925c source: inline trivial wrapper functions 73e8f9e source: inline array functions into ArrayType handler df11b0a helpers: rename judge_* functions to clearer names 45a1b35 source: skip handler for object type in make_clone() 31824dc source: remove dead code in read_val_generator() b49928d source: remove dead code in make_c_free() 20de7a4 source: add emit_clone() to MapStringObjectType and BasicMapType 971a65b source: add ArrayType handler for array operations 633c0b5 source: add ObjectType, MapStringObjectType, and BasicMapType handlers 141fa50 source: use TypeHandler in make_c_free() and make_clone() 2fc8679 source: use TypeHandler.emit_parse() in parse_obj_type() c3686db source: add TypeHandler classes for type-specific C code generation c174b06 source: remove superfluous else after return 858f199 source: remove dead code in make_clone() 6ae8e2d source: consolidate numeric type conversion with helper function a23b40c source: apply emit_gen_key() helper to get_obj_arr_obj() 717d035 source: apply YAJL helpers to get_c_epilog_for_array_make_gen() 6dcd043 source: apply YAJL helpers to get_c_json() a2cc69b source: apply YAJL helpers to get_obj_arr_obj_array() 7f5fcb5 source: apply YAJL helpers to get_map_string_obj() aa9271c source: add YAJL generation helper functions 3366b93 source: add emit_invalid_type_check() helper for YAJL validation 05ee4de source: add emit_value_error() helper for error wrapping 7a62656 source: add emit_asprintf_error() helper to reduce boilerplate 4d2f6e5 source: add do_read_value() helper to reduce boilerplate d37383d source: convert parse_obj_type() to multi-line f-strings 39fa66d source: convert make_c_free() to multi-line f-strings d62a55f source: convert make_c_array_free() to multi-line f-strings 112ab7f source: convert c_file_str() to multi-line f-strings 41596b9 source: convert c_file_map_str() to multi-line f-strings a2fd73f source: complete get_obj_arr_obj_array() conversion to f-strings 66e333d source: convert get_obj_arr_obj_array() to f-strings (object branch) 47e7dc5 source: convert get_map_string_obj() to multi-line f-strings ae23175 source: convert parse_obj_type_array() to multi-line f-strings 002af18 source: convert parse_map_string_obj() to multi-line f-strings e80d362 source: extract check_gen_status() helper pattern 46ce297 source: extract calloc_with_check() helper pattern cc817ed source: continue null_check_return() pattern extraction 419526a source: extract null_check_return() helper pattern (partial) 064fcbb source: extract free_and_null() helper pattern 7579c03 source: add emit() helper function for code generation c8a5437 gitignore: update b355817 runtime-spec: update 819972d image-spec: update ea4906b Check 'src' before dereferencing 345279c runtime-spec: update from upstream Bumping runtime-spec to version v1.3.0-11-g6f7b71c, which comprises the following commits: 53abf18 ci: bump golangci-lint to v2.10 90a6479 Fix an error in the docs 4361740 schema: fix definition for array type 04836b1 schema: fix path for uint32 type c668b01 config-linux: allow empty strings in memory policy nodes field 9d0d4bc version: v1.3.0+dev 9224913 version: release v1.3.0 4df3d11 Mention FreeBSD platform a257beb Add minimum supported Go version to CI (#1303) afdbcb8 Add FreeBSD as a platform 75d79ee ci: use oldstable and stable Go versions 9efd9f2 schema/defs-linux.json: fix max for FileMode 09ec668 config-linux,schema: fix FileMode description Bumping image-spec to version v1.1.1-28-ga4c6ade, which comprises the following commits: fccd049 Fix: Make the config field optional b71c0df Add missing backtick 431b3be Update OCI Image Implementations list 02ba6e2 Descriptor size cannot be negative Signed-off-by: Bruce Ashfield

crun: set CLEANBROKEN to fix configure on rebuild

2026-03-12T22:44:31+00:00

crun ships a GNUmakefile that aborts with "You must run ./autogen.sh && ./configure" when make clean is invoked before configure has run. The autotools_preconfigure prefunc triggers this when rebuilding (e.g. via multiconfig where sstate hash changes cause reconfiguration). Set CLEANBROKEN = "1" to skip the make clean in autotools_preconfigure. Signed-off-by: Bruce Ashfield

crun: inherit features_check for REQUIRED_DISTRO_FEATURES

2026-02-25T23:10:14+00:00

The recipe sets REQUIRED_DISTRO_FEATURES:class-native but never inherits features_check, so the requirement was silently ignored. OE-core now has an unhandled-features-check QA test that catches this and fails the build. Signed-off-by: Bruce Ashfield

crun: add RCONFLICTS to prevent runc package conflict

2026-02-09T03:34:08+00:00

When CRUN_AS_RUNC is enabled (default), crun creates a /usr/bin/runc symlink that conflicts with the runc package's /usr/bin/runc binary. Add RCONFLICTS to declare this conflict so package managers prevent both from being installed simultaneously. Signed-off-by: Bruce Ashfield

crun: update to 1.24

2025-10-17T15:51:28+00:00

Along with the updates, there seems to be an interaction with our configuration that is causing generation issues for APIs. We do some tweaks to the script to work in our environment. Bumping crun to version 1.24-19-g64611d7a, which comprises the following commits: a9187097 Reset the inherited cpu affinity d41a45ce Add .editorconfig 1188a679 configure.ac: check if error function is available a569c2e7 cgroup, systemd: improved "same bpf" check ccbf0d96 tests: Replace sprintf with snprintf for security fc084fdf chroot_realpath: Replace sprintf with snprintf b2032647 tests: fix compiler error 7417ead6 Add tmt integration plan 54693209 NEWS: tag 1.24 676c2c12 linux: fix array bounds warning in libcrun_configure_network d8a88c06 criu: checkpoint correctly the shared empty directory path 6ead5130 linux: add support for numa set_mempolicy(2) 05b9f561 container: add missing crun_make_error 7f9447ec Revert "cgroup: do not create a sub-cgroup by default" 275305f8 intelrdt: honor default closID e9711231 intelrdt: factor common code in a new function dfdcf776 intelrdt: add support for EnableMonitoring 6c10fb5b intelrdt: check that schemata is not empty before failing a9affe5d status: fix error check a1119953 cgroup, systemd: validate ebpf is loaded 7160e31b libocispec: sync 4004e5be linux: optimize masked paths with shared empty directory 13d4770d contrib: format contrib files 8aa7545e krun: avoid failing if sev/nitro are not available 1556c13f src/libcrun: limit tmpfs memory usage for masked paths 28d60d87 krun: ensure spec->linux->resources->devices exists e486eeab linux: fix regression mounting within userns 146fdcfe tests: remove unused debug_on_error option 37f702b7 tests: add ability to set debug=True 2aac0f56 Fix BOF d417e0a4 Fixed BOF cfedf930 build(deps): bump actions/checkout from 4 to 5 eb9912e0 build: add check for static builds 262d6ac3 cgroup: do not create a sub-cgroup by default Bumping libocispec to latest, which comprises the following commits: 345279c runtime-spec: update from upstream c3e5101 image-spec: update from upstream 92656e9 runtime-spec: update from upstream 19d5aeb runtime-spec: update from upstream 3c98525 image-spec: update from upstream 9d1955f sources.py: fix unconditional return in map value clone Bumping runtime-spec to version v1.2.1-39-g5610abd, which comprises the following commits: d7de8c0 ci: bump golangci-lint to v2.5 9758011 ci: add codespell job, fix existing issues 9efd9f2 schema/defs-linux.json: fix max for FileMode 09ec668 config-linux,schema: fix FileMode description 87f15fb schema: fix json 869b2d5 linux: clarify pids cgroup settings a6c310a config-linux: clarify when the RDT sub-directory should be removed. b280c07 config-linux: clarify the "MB:"-line filtering in RDT. 84b6c2c docs: fix and elaborate the nodes field in Linux memory policy 0758679 features-linux: expose IntelRdt monitoring support e51a839 config-linux: define default clos for linux.intelRdt 642344a specs-go/features: add linux.intelRdt.schemata field 34a39b9 config-linux: add intelRdt.enableMonitoring (#1287) afd830f principles: fix typo 57c9495 Add support for Linux memory policy c6b3b08 runtime: fail when a poststart hook fails af0d16d config: Add Hardware description object to the VM configuration Bumping image-spec to version v1.1.1-22-g6519a62, which comprises the following commits: 02ba6e2 Descriptor size cannot be negative cee899b Fix: Add entry to schema/go.sum 558802d Docs: Update pandoc for rendering documentation 693d8d7 Update to github.com/russross/blackfriday/v2 cbb69e2 Update to github.com/santhosh-tekuri/jsonschema/v6 d0e1005 Split github.com/opencontainers/image-spec/schema into a separate Go module 84ee56d Fix: correct a broken link to "applying changesets" 0bb67c2 Update GitHub Actions configuration ab50866 Chore: Remove GOPATH from GitHub Actions 4fecf47 Add blake3 as a registered/supported hash algorithm Signed-off-by: Bruce Ashfield

crun: update to 1.23.1

2025-08-21T17:08:18+00:00

Bumping crun to version 1.23.1-9-gca8e5c74, which comprises the following commits: eb9912e0 build: add check for static builds bb04c555 libocispec: sync a9d12996 linux: never chown devices eecadda9 tests: fix test_mount return type 38c5795e tests: add capabilities to net test d20b23db NEWS: tag 1.23.1 f56fc445 utils: add bounds checking for Unix domain socket paths 59066cc9 ring_buffer: do not use the reserved byte abc42863 utils: write to ring buffer whenever there is space available 7d21fa1e tests, podman: skip auth test 3fc25616 NEWS: tag version 1.23 69c3ba16 krun: define KRUN_NITRO_IMG_TYPE_EIF if missing aa9e1c51 krun: drop unused variable 55d603f2 krun: enable virtio-gpu e76c7451 container: refactor container_init_setup 7acad117 container: refactor libcrun_container_run_internal e83abf35 linux: refactor do_mounts f9edd528 container: use xmalloc instead of malloc and OOM 2dbee366 criu: Add support for tcp-close 3040a07f cgroup-resources: extract common pattern d30d1512 linux: fix regression in libcrun_configure_network 220a39a6 krun: Give container access to nitro_enclaves device ac297b79 krun: Allow /dev/kvm to be unavailable with nitro 500f1c92 krun: Configure nitro enclave data if enabled d9ddb935 krun: Use nitro flavor when indicated 702d09b7 krun: Open libkrun-nitro handle during loading 54771724 krun: End loop traversal when SEV device found 72b35020 linux: add missing crun_make_error e2789c70 container: propagate error from exec setup 4e5375cb libcrun: inline can_skip into write_cgroup_resources_v2 ad9f90b7 tests: add test_bpf_devices 6f466dcc cgroup,systemd: do not install duplicated ebpf edf66788 cgroup,systemd: check for loaded bpf on update 227bd0f1 cgroup,systemd: use BPFProgram=device if supported 832db004 write_devices_resources_v2: refactor 1dae52ba cgroup,systemd: allow empty slice in cgroupsPath 5610c0cf RPM/Packit: wasmedge support Fedora-only 39bdaaef Packit: disable propose_downstream for CentOS Stream c6dfc871 RPM: placeholder check to silence rpmlint 8d61001d crun: print version even with invalid rundir 76805119 Remove dead code after exit 0b9aab09 handler: add NULL check to handler_manager_free a755e043 utils: Add NULL pointer check to cleanup_close_vecp 66d710ce linux: add NULL check to cleanup_free_init_statusp ce47a219 linux: Add NULL pointer checks to free_remount 54d4b042 string_map: ignore empty map f25352f9 linux: limit mounts creation outside of namespace d51df096 lua: clean up unused defines 4b7257d4 linux: fix regression with idmapped mounts 83f601d3 lua: fix build errors 4de19b63 NEWS: tag 1.22 aa082854 tests: install catatonit package 72e5468e tests: improve cpu_weight_systemd coverage 4998c928 cgroup: improve conversion from shares to weight aaeeefc3 tests: install gperf on alpine Signed-off-by: Bruce Ashfield

crun: update to 1.21

2025-07-07T15:42:27+00:00

Bumping crun to version 1.21-216-ge922e422, which comprises the following commits: aa082854 tests: install catatonit package 405d2a2c libcrun: setup /dev/console as a symlink to pty instead of bind mount 1203dadc Fix regression on Windows WSL 4db005a5 Fix incorrectly set cpu.max when quota is -1. f231b79a krun: check `kconf->handle{_sev}` exists before unloading 910eb16b utils: normalize S_ISDIR() result to 0 or 1 91732ac0 libcrun: add crun_error_get_errno 7d618b7a status: simplify libcrun_status_check_directories b34f613e status: add cleanup_free 7407bbc9 Revert "chroot_realpath: do not return non-existing paths" 1412f0a8 test: bump containerd version 82b75fa4 cfg.mk: prohibit usage of sprintf af163aa5 container: use snprintf instead of sprintf 07eef8ac container: use xasprintf instead of sprintf c3c19280 error: replace sprintf with snprintf 4666e880 cgroup: replace sprintf with snprintf c212049d seccomp: replace sprintf with snprintf 9bb4e901 linux, utils: use snprintf instead of sprintf 4353d55a status: use snprintf instead of sprintf 271f7f50 intelrdt: use snprintf instead of sprintf fd118c15 cgroup-setup: drop unused variable 4dbe7549 configure.ac: fix variable name a95034a4 linux: ensure fstype is not NULL d462c1cf tests: improve error messages in start tests f2ae65db tests: improve error messages in seccomp tests 6b3485f3 tests: improve error messages in rlimits tests dffbeadd tests: improve error messages in resources tests 8f518ee2 tests: improve error messages in oci_features tests 2bfc81bd tests: improve error messages in limits tests 9b164379 tests: improve error messages in hostname tests 39b374d5 tests: improve error messages in exec tests dbd25dcc tests: improve error messages in domainname tests 57769eee tests: improve error messages in devices tests 77fc894f tests: improve error messages in exec tests be391abb tests: improve error messages in mounts tests d212647d tests: improve error messages in capabilities tests c3bac03c tests: improve error reporting f62dcc21 tests: fix mount of tmpfs d318fa1a tests: recreate tests root for each test 21e860c7 fix rootless option parsing 7b825680 container: create missing errors 64fbacab python: reset pointer after asprintf failure cfcb839a run, create: deduplicate code 957a6518 linux: add `src-nofollow` & `dest-nofollow` options 044c89d2 run, create: align implementations 0479ae73 libcrun: prefer waitpid_ignore_stopped NULL argument 88f45286 criu: reject unsupported 'src-nofollow' option 602d0e14 linux: add argument nofollow to is_bind_mount ae0ecdd7 mountflags: add `dest-nofollow` and `src-nofollow` options af39d913 linux: refactor mount fd handling in do_mounts c77a1807 linux: add `nofollow` option to `get_bind_mount` c8d042b3 linux: remove duplicate close of rootfsfd 91d202a2 linux: drop unuseful variable c1671bd0 github: show the diff for the check job 6c24739d src: improve dlopen error message 33602a51 Packit/TMT: disable centos-stream-10-x86_64 tests b1133e95 TMT: include podman checkpoint system tests fddb3042 Revert "criu: rename a variable" 97fd76bf Fixup "criu: support mounts where dest is a symlink" 379524f0 krun: Determine flavor from VM config tree 7d1d15d7 krun: Configure VM with pre-parsed config tree 13fcca9e krun: Add function to parse krun VM config fbd8ea8f tests: add new tests to test_pid 3241e2c7 tests: add new test_uid_gid.py tests 4f173407 tests: add new test_devices.py tests 0b8455ea tests: add ischar, isblock, isfifo commands to init 9056ec3b tests: add openwronly command to init 42e5bc61 tests: report the correct exit status for ls 07374bb6 crun: expose net devices feature 006c7aa1 libcrun: advertise net devices support ba0ec5a7 linux: add support for network devices fe8f3277 tests: add ip command to init 64a2e0e1 linux: Update rootfsfd when rootfs is replaced 7de03e62 linux: safe_openat reopens root 2e210bdc linux: use rootfsfd directly from container data e9d159f7 linux: store rootfsfd under private data only 953a8c49 utils: crun_safe_ensure_at opens empty paths 372446d7 tests: fix unused variable 9ddddfb0 test: fix mount to test 040cb2e7 linux: include errno check in UNLIKELY macro b337c9d3 libocispec: update from upstream 37dacae3 linux: do_mount: simplify 0f74f03f linux: use ALL_PROPAGATIONS_NO_REC 7f686825 intelrdt: add support for generic schemata update ca40dac7 ci: show git status 2ad0b600 libocispec: sync from upstream 558419b2 utils: do not use stack for lens array 174963dc criu: avoid malloc in prepare_restore_mounts e0b01580 criu: support mounts where dest is a symlink 55498c1f criu: rename a variable 880b7ee3 criu: allow mount type to be NULL a9c1f024 criu: reuse is_bind_mount b4b29088 Fix python call to `libcrun_get_verbosity` c1e72c10 tests/test_checkpoint_restore.py: fixup e5d2489d criu restore: create --work-path 157a673d criu checkpoint: error message fixup 91aa3683 criu: validate --parent-path 0dceab0c tests: add --work-path to criu test 90ef9732 criu: create --work-path directory 1fa86492 nix: update nixpkgs b9796420 linux: improve cgroup2 mount error message b679e7f7 linux: move unified_cgroup_path to private_data ffbfb6f3 Fix getcwd error handling 8c0075b5 linux: use syscall getcwd return value to set error 99c7b959 crun: Fix the binary name in the Usage info 19b4c254 Revert "Packit: Disable osh_diff_scan" dd8e1af5 Packit: Disable osh_diff_scan 5ec1f2ab Revert "Disable criu support on riscv64" bdd62e17 krun.1: regenerate 739a2bff build-aux/release.sh: fix shellcheck warnings 5c14c0dc make shellcheck: add more files f1cf3b35 tests/run_all_tests.sh: fix shellcheck issues d084c9b5 ci: bump shellcheck to v0.10.0 10e312d5 ci: improve shellcheck job 1e518be6 crun.1: fix "CPU controller" table rendering e7f8dc33 github: use ubuntu-latest for shellcheck 10db1f7a utils: Mark base64 table as non-string data 245d2edf ci: Add awk dependency to test containers 51958b39 ci: Add awk dependency 9adca806 Packit/TMT: run shellcheck tests on fedora envs 6e1ef464 ShellCheck: resolve warnings in TMT test script 7b910ea2 TMT: Simplify plans 9b395e9a build(deps): bump uraimo/run-on-arch-action from 3.0.0 to 3.0.1 9f2604ac linux: remove unused preprocessor directives 21e0179b linux: fix definition of CLONE_NEWCGROUP 684b2540 linux: fix definition of CLONE_NEWTIME 3e9b1c4a linux: fix definition of CLONE_NEWTIME on Centos 9 fc3ae8e2 krun: stop using set_workdir dfb649b3 linux: fix error leak from sync fd 8cb44cd6 container: don't leak error 0d760a96 linux: fix error leak 3649947b linux: make error messages more uniform 75e74bf7 container: make error messages more uniform 9774d59a utils: make error messages more uniform b656f67f cgroup: fix quoting for file names in error messages 6d4f5387 tests: configure additional IDs for the containers user 3b2e2a13 tests, podman: fix ginkgo installation c359fbd8 krun: return dlerror string when library is not found 285574fe tests: add tests for "crun mounts" b5a566bf crun: expose mounts command 196ad5e4 container: add/rm mounts API for a running container 4a27212a linux: move prepare_mount to its only caller c1c5232d linux: split code to new function c7337717 linux: refactor code in a new function 9acf13d6 tests: fix function signature 05277835 status: report better error on ENOENT c6197431 libcrun, krun: use existing error e229c129 seccomp plugins and seccomp receivers cannot be declared at the same time 18af4515 src: remove unused variables 10269840 NEWS: tag 1.21 84828c65 krun: bump vcpu limit to 16 079f95d0 krun: implement support for external kernels a7a178a1 krun: consolidate configuration file definitions 059445af utils: getsubidrange returns negative value on errors ff054fe7 maybe_chown_std_streams: ignore EBADF 3adcc2c7 utils: set_home_env returns negative value on errors f4973d7a tests: move cwd tests to the correct file 53f1c0bc if the container main process and console socket do not need a terminal, the terminal fd is not created 2f7c9b88 console socket client is initialized only when the user declares terminal. 132c793a krun: fix error message 8675bafa krun: create context after loading the library a5cb511d cpuset: fix handling of absent subcgroup d2b824ca krun: stop using krun_set_exec b09aa67d krun: make krun config file world readable 459595b6 container: ignore SIGWINCH without tty c954b1b6 criu: use a process to initialize the cgroup 959cc6c4 cgroup: extend function e3866cc5 cgroup: fix ownership of dfd in read_pids_cgroup Bumping libocispec to latest, which comprises the following commits: 9d1955f sources.py: fix unconditional return in map value clone 9937df4 ocispec: rename judge_complex to is_compound_type 61b922d ocispec: add support for string->object maps abae290 ocispec: remove explicit inheritance from object d67f492 helpers: rename CombinateName to HierarchicalName 55a0a9c helpers: rename Unite class to SchemaNode 809b047 runtime-spec: update to latest upstream revision d455ad0 image-spec: update to latest upstream revision 30a27d7 github: update action ed23e6a runtime-spec: sync from upstream 412ce10 image-spec: sync from upstream Bumping runtime-spec to version v1.2.1-11-g82cca47, which comprises the following commits: afd830f principles: fix typo d2f4f90 config-linux: add schemata field to IntelRdt (#1230) 27cb002 docs: fix typo (#1285) 0ed7cf6 docs: add missing backticks for code formatting e935f99 Define Linux Network Devices (#1271) df100de add systemd-nspawn to implementations.md 95a651f Add back +dev 524fc0e Release v1.2.1 221c198 Fix description of errnoRet in Seccomp 9de64c0 config-linux: update for libseccomp v2.6.0 1df9fa9 zos updates - add zos namespaces, remove zos devices This PR proposes updates to the OCI runtime spec with z/OS platform-specific details, including adding namespaces, adding noNewPrivileges flag, and removing devices. These changes are currently in use by the IBM z/OS Container Platform (zOSCP) product - details can be found here: https://www.ibm.com/products/zos-container-platform. 131ae4c Correct `prestart` hook description in summary (#1275) b9e8fdb Add support for windows CPU affinity b37b687 ci: Add a github actions workflow for lint 8cfc407 specs-go: sync SCMP_ARCH_* constants with libseccomp main (#1229) 9ceba9f update http links to https Bumping image-spec to version v1.1.1-6-g64294bd, which comprises the following commits: aca17c0 Clarify that canonical JSON is not a requirement 1809845 Bump back to +dev 147f9c1 Release v1.1.1 4fecf47 Add blake3 as a registered/supported hash algorithm 81e457e Fix grammar nit 60acaac Document extensibility of the image layout 4dcf962 Document Go version policy 6a277dd Add `cache-dependency-path` to avoid setup-go warning 00584ff Reduce maintenance burden by letting setup-go track our Go versions 85abb94 Manifests may contain multiple digest algorithms aa533a0 Delete project documentation 03306ac Hard link limitations in union filesystems cee95e9 Ignore uname/gname where uid/gid are supported Signed-off-by: Bruce Ashfield

containers: adapt to UNPACKDIR changes

2025-06-26T02:40:08+00:00

This commit updates the container recipes to the OE core UNPACKDIR changes. - We drop references to WORKDIR - We adjust destsuffix fetches to use BB_GIT_DEFAULT_DESTSUFFIX instead of 'git' - Update our GOPATH references to use UNPACKDIR - Drop S = assignemnts where possible Signed-off-by: Bruce Ashfield

crun: update to 1.20

2025-03-06T17:17:59+00:00

Bumping crun to version 1.20-53-g4d6eae2e, which comprises the following commits: 107214b1 build(deps): bump uraimo/run-on-arch-action from 2.8.1 to 3.0.0 c954b1b6 criu: use a process to initialize the cgroup 959cc6c4 cgroup: extend function e3866cc5 cgroup: fix ownership of dfd in read_pids_cgroup 0f16ced1 linux: set subsystem_path before use in error 6ed12c63 linux: remove dead code 6c049b81 criu: hide feature if dlopen is not present 73d00079 tests: map all IDs into the user namespace 0037d567 ci: fail on "sudo make check" f82ead82 tests: fix test_resources_unified_invalid_controller() 37213555 utils: improve error message if path not executable 5f5454b5 utils: do not use hardcoded path buffer 4948e451 utils: check for eaccess existence 410f0d53 container: pass down executable path to custom handler bb56343c utils: move error handling inside find_executable() a77702c0 tests: do a shallow git clone for podman f941be48 error: silence compiler warning b8b25ea1 Prevent dlopen() for CRIU in static link'ed binary 990b5f68 krun: fix libkrun_unload 79b7e6b3 libcrun: use an hash map to lookup the key 51fa411b libcrun: move annotations handling to a separate struct 9abef0da linux: fix dup error 14d5baa4 README: add CentOS Stream 9 & 10, rm 8 e735b4bc krun: fix libkrun_exec return value 90a321c6 container, error: update error handling 620b91b5 utils: fix PATH lookup 48470009 Downstream Fedora: fix gating config 7949fbc6 tests: disable new test that does not use the runtime 7f76fcd4 utils: add missing crun_error_release() 6598c99b utils: add O_NOFOLLOW 9c9a76ac NEWS: tag 1.20 0aec82c2 krun: fix CVE-2025-24965 793188c2 krun: initialize bool ac956685 utils: add O_WRONLY to WRITE_FILE_DEFAULT_FLAGS dcf4f78b utils: drop rootfs_len from safe_openat function de33f0a8 utils: write_file_at_with_flags uses safe_write c460b253 utils: safe_write uses size_t for the buffer length 12778089 utils: drop function write_file_with_flags f1ef3bb4 utils: move write_file* wrappers to utils.h 3e2344b0 utils: fix partial writes with write_file_at_with_flags 7930c13d krun: drop unused variable f7987aa9 linux, mono: remove unneeded crun_error_release() b548479c utils: reduce memory consumption in safe_readlinkat 3b653170 chroot_realpath: remove dead code 17135c1b chroot_realpath: do not return non-existing paths 7ab1acd3 container: fix error after read 490d5502 linux, utils: remove dead code crun_ensure_file*() 432a66d9 status: validate container id 73bcfabb status: report errors from get_state_directory_status_file 30d22ba3 status: report errors from get_run_directory 873db607 status: report errors from libcrun_get_state_directory f5e7718c linux: improve error writing to net.ipv4.ping_group_range 5c35f278 tests: make python script executable 5b51cca8 github: disable aarch64, ppc64le and s390x build 84d50992 github: cat config.log on configure failures 7aa2cd85 github: add r/w permissions 4f823090 github: show apt-get output 2d08f586 exec: always call setsid b788f338 scheduler: ignore ENOSYS when resetting affinity mask e292c9e9 src/linux: handle EINVAL during pidfd_open gracefully 869804f4 TMT: account for environments on internal testing farm ranch 65484cb9 TMT: Replace `adjust` with `prepare` conditionals a4dcb9c6 cgroup: Show the absolute path to cgroup.controllers when a controller is not available 179686b7 Revert "cgroup: remove tun/tap from the default allow list" 68e8d9ab test: use wasm32-wasip1 instead of wasm32-wasi 3158e491 criu: improve error handling for CRIU function calls 3cd9c2c9 criu: do not set network_lock if not specified Signed-off-by: Bruce Ashfield