linux/meta-virtualization.git/recipes-containers/crun, branch whinlatter

crun: update to 1.24

2025-10-17T15:51:28+00:00

Along with the updates, there seems to be an interaction with our configuration that is causing generation issues for APIs. We do some tweaks to the script to work in our environment. Bumping crun to version 1.24-19-g64611d7a, which comprises the following commits: a9187097 Reset the inherited cpu affinity d41a45ce Add .editorconfig 1188a679 configure.ac: check if error function is available a569c2e7 cgroup, systemd: improved "same bpf" check ccbf0d96 tests: Replace sprintf with snprintf for security fc084fdf chroot_realpath: Replace sprintf with snprintf b2032647 tests: fix compiler error 7417ead6 Add tmt integration plan 54693209 NEWS: tag 1.24 676c2c12 linux: fix array bounds warning in libcrun_configure_network d8a88c06 criu: checkpoint correctly the shared empty directory path 6ead5130 linux: add support for numa set_mempolicy(2) 05b9f561 container: add missing crun_make_error 7f9447ec Revert "cgroup: do not create a sub-cgroup by default" 275305f8 intelrdt: honor default closID e9711231 intelrdt: factor common code in a new function dfdcf776 intelrdt: add support for EnableMonitoring 6c10fb5b intelrdt: check that schemata is not empty before failing a9affe5d status: fix error check a1119953 cgroup, systemd: validate ebpf is loaded 7160e31b libocispec: sync 4004e5be linux: optimize masked paths with shared empty directory 13d4770d contrib: format contrib files 8aa7545e krun: avoid failing if sev/nitro are not available 1556c13f src/libcrun: limit tmpfs memory usage for masked paths 28d60d87 krun: ensure spec->linux->resources->devices exists e486eeab linux: fix regression mounting within userns 146fdcfe tests: remove unused debug_on_error option 37f702b7 tests: add ability to set debug=True 2aac0f56 Fix BOF d417e0a4 Fixed BOF cfedf930 build(deps): bump actions/checkout from 4 to 5 eb9912e0 build: add check for static builds 262d6ac3 cgroup: do not create a sub-cgroup by default Bumping libocispec to latest, which comprises the following commits: 345279c runtime-spec: update from upstream c3e5101 image-spec: update from upstream 92656e9 runtime-spec: update from upstream 19d5aeb runtime-spec: update from upstream 3c98525 image-spec: update from upstream 9d1955f sources.py: fix unconditional return in map value clone Bumping runtime-spec to version v1.2.1-39-g5610abd, which comprises the following commits: d7de8c0 ci: bump golangci-lint to v2.5 9758011 ci: add codespell job, fix existing issues 9efd9f2 schema/defs-linux.json: fix max for FileMode 09ec668 config-linux,schema: fix FileMode description 87f15fb schema: fix json 869b2d5 linux: clarify pids cgroup settings a6c310a config-linux: clarify when the RDT sub-directory should be removed. b280c07 config-linux: clarify the "MB:"-line filtering in RDT. 84b6c2c docs: fix and elaborate the nodes field in Linux memory policy 0758679 features-linux: expose IntelRdt monitoring support e51a839 config-linux: define default clos for linux.intelRdt 642344a specs-go/features: add linux.intelRdt.schemata field 34a39b9 config-linux: add intelRdt.enableMonitoring (#1287) afd830f principles: fix typo 57c9495 Add support for Linux memory policy c6b3b08 runtime: fail when a poststart hook fails af0d16d config: Add Hardware description object to the VM configuration Bumping image-spec to version v1.1.1-22-g6519a62, which comprises the following commits: 02ba6e2 Descriptor size cannot be negative cee899b Fix: Add entry to schema/go.sum 558802d Docs: Update pandoc for rendering documentation 693d8d7 Update to github.com/russross/blackfriday/v2 cbb69e2 Update to github.com/santhosh-tekuri/jsonschema/v6 d0e1005 Split github.com/opencontainers/image-spec/schema into a separate Go module 84ee56d Fix: correct a broken link to "applying changesets" 0bb67c2 Update GitHub Actions configuration ab50866 Chore: Remove GOPATH from GitHub Actions 4fecf47 Add blake3 as a registered/supported hash algorithm Signed-off-by: Bruce Ashfield

crun: update to 1.23.1

2025-08-21T17:08:18+00:00

Bumping crun to version 1.23.1-9-gca8e5c74, which comprises the following commits: eb9912e0 build: add check for static builds bb04c555 libocispec: sync a9d12996 linux: never chown devices eecadda9 tests: fix test_mount return type 38c5795e tests: add capabilities to net test d20b23db NEWS: tag 1.23.1 f56fc445 utils: add bounds checking for Unix domain socket paths 59066cc9 ring_buffer: do not use the reserved byte abc42863 utils: write to ring buffer whenever there is space available 7d21fa1e tests, podman: skip auth test 3fc25616 NEWS: tag version 1.23 69c3ba16 krun: define KRUN_NITRO_IMG_TYPE_EIF if missing aa9e1c51 krun: drop unused variable 55d603f2 krun: enable virtio-gpu e76c7451 container: refactor container_init_setup 7acad117 container: refactor libcrun_container_run_internal e83abf35 linux: refactor do_mounts f9edd528 container: use xmalloc instead of malloc and OOM 2dbee366 criu: Add support for tcp-close 3040a07f cgroup-resources: extract common pattern d30d1512 linux: fix regression in libcrun_configure_network 220a39a6 krun: Give container access to nitro_enclaves device ac297b79 krun: Allow /dev/kvm to be unavailable with nitro 500f1c92 krun: Configure nitro enclave data if enabled d9ddb935 krun: Use nitro flavor when indicated 702d09b7 krun: Open libkrun-nitro handle during loading 54771724 krun: End loop traversal when SEV device found 72b35020 linux: add missing crun_make_error e2789c70 container: propagate error from exec setup 4e5375cb libcrun: inline can_skip into write_cgroup_resources_v2 ad9f90b7 tests: add test_bpf_devices 6f466dcc cgroup,systemd: do not install duplicated ebpf edf66788 cgroup,systemd: check for loaded bpf on update 227bd0f1 cgroup,systemd: use BPFProgram=device if supported 832db004 write_devices_resources_v2: refactor 1dae52ba cgroup,systemd: allow empty slice in cgroupsPath 5610c0cf RPM/Packit: wasmedge support Fedora-only 39bdaaef Packit: disable propose_downstream for CentOS Stream c6dfc871 RPM: placeholder check to silence rpmlint 8d61001d crun: print version even with invalid rundir 76805119 Remove dead code after exit 0b9aab09 handler: add NULL check to handler_manager_free a755e043 utils: Add NULL pointer check to cleanup_close_vecp 66d710ce linux: add NULL check to cleanup_free_init_statusp ce47a219 linux: Add NULL pointer checks to free_remount 54d4b042 string_map: ignore empty map f25352f9 linux: limit mounts creation outside of namespace d51df096 lua: clean up unused defines 4b7257d4 linux: fix regression with idmapped mounts 83f601d3 lua: fix build errors 4de19b63 NEWS: tag 1.22 aa082854 tests: install catatonit package 72e5468e tests: improve cpu_weight_systemd coverage 4998c928 cgroup: improve conversion from shares to weight aaeeefc3 tests: install gperf on alpine Signed-off-by: Bruce Ashfield

crun: update to 1.21

2025-07-07T15:42:27+00:00

Bumping crun to version 1.21-216-ge922e422, which comprises the following commits: aa082854 tests: install catatonit package 405d2a2c libcrun: setup /dev/console as a symlink to pty instead of bind mount 1203dadc Fix regression on Windows WSL 4db005a5 Fix incorrectly set cpu.max when quota is -1. f231b79a krun: check `kconf->handle{_sev}` exists before unloading 910eb16b utils: normalize S_ISDIR() result to 0 or 1 91732ac0 libcrun: add crun_error_get_errno 7d618b7a status: simplify libcrun_status_check_directories b34f613e status: add cleanup_free 7407bbc9 Revert "chroot_realpath: do not return non-existing paths" 1412f0a8 test: bump containerd version 82b75fa4 cfg.mk: prohibit usage of sprintf af163aa5 container: use snprintf instead of sprintf 07eef8ac container: use xasprintf instead of sprintf c3c19280 error: replace sprintf with snprintf 4666e880 cgroup: replace sprintf with snprintf c212049d seccomp: replace sprintf with snprintf 9bb4e901 linux, utils: use snprintf instead of sprintf 4353d55a status: use snprintf instead of sprintf 271f7f50 intelrdt: use snprintf instead of sprintf fd118c15 cgroup-setup: drop unused variable 4dbe7549 configure.ac: fix variable name a95034a4 linux: ensure fstype is not NULL d462c1cf tests: improve error messages in start tests f2ae65db tests: improve error messages in seccomp tests 6b3485f3 tests: improve error messages in rlimits tests dffbeadd tests: improve error messages in resources tests 8f518ee2 tests: improve error messages in oci_features tests 2bfc81bd tests: improve error messages in limits tests 9b164379 tests: improve error messages in hostname tests 39b374d5 tests: improve error messages in exec tests dbd25dcc tests: improve error messages in domainname tests 57769eee tests: improve error messages in devices tests 77fc894f tests: improve error messages in exec tests be391abb tests: improve error messages in mounts tests d212647d tests: improve error messages in capabilities tests c3bac03c tests: improve error reporting f62dcc21 tests: fix mount of tmpfs d318fa1a tests: recreate tests root for each test 21e860c7 fix rootless option parsing 7b825680 container: create missing errors 64fbacab python: reset pointer after asprintf failure cfcb839a run, create: deduplicate code 957a6518 linux: add `src-nofollow` & `dest-nofollow` options 044c89d2 run, create: align implementations 0479ae73 libcrun: prefer waitpid_ignore_stopped NULL argument 88f45286 criu: reject unsupported 'src-nofollow' option 602d0e14 linux: add argument nofollow to is_bind_mount ae0ecdd7 mountflags: add `dest-nofollow` and `src-nofollow` options af39d913 linux: refactor mount fd handling in do_mounts c77a1807 linux: add `nofollow` option to `get_bind_mount` c8d042b3 linux: remove duplicate close of rootfsfd 91d202a2 linux: drop unuseful variable c1671bd0 github: show the diff for the check job 6c24739d src: improve dlopen error message 33602a51 Packit/TMT: disable centos-stream-10-x86_64 tests b1133e95 TMT: include podman checkpoint system tests fddb3042 Revert "criu: rename a variable" 97fd76bf Fixup "criu: support mounts where dest is a symlink" 379524f0 krun: Determine flavor from VM config tree 7d1d15d7 krun: Configure VM with pre-parsed config tree 13fcca9e krun: Add function to parse krun VM config fbd8ea8f tests: add new tests to test_pid 3241e2c7 tests: add new test_uid_gid.py tests 4f173407 tests: add new test_devices.py tests 0b8455ea tests: add ischar, isblock, isfifo commands to init 9056ec3b tests: add openwronly command to init 42e5bc61 tests: report the correct exit status for ls 07374bb6 crun: expose net devices feature 006c7aa1 libcrun: advertise net devices support ba0ec5a7 linux: add support for network devices fe8f3277 tests: add ip command to init 64a2e0e1 linux: Update rootfsfd when rootfs is replaced 7de03e62 linux: safe_openat reopens root 2e210bdc linux: use rootfsfd directly from container data e9d159f7 linux: store rootfsfd under private data only 953a8c49 utils: crun_safe_ensure_at opens empty paths 372446d7 tests: fix unused variable 9ddddfb0 test: fix mount to test 040cb2e7 linux: include errno check in UNLIKELY macro b337c9d3 libocispec: update from upstream 37dacae3 linux: do_mount: simplify 0f74f03f linux: use ALL_PROPAGATIONS_NO_REC 7f686825 intelrdt: add support for generic schemata update ca40dac7 ci: show git status 2ad0b600 libocispec: sync from upstream 558419b2 utils: do not use stack for lens array 174963dc criu: avoid malloc in prepare_restore_mounts e0b01580 criu: support mounts where dest is a symlink 55498c1f criu: rename a variable 880b7ee3 criu: allow mount type to be NULL a9c1f024 criu: reuse is_bind_mount b4b29088 Fix python call to `libcrun_get_verbosity` c1e72c10 tests/test_checkpoint_restore.py: fixup e5d2489d criu restore: create --work-path 157a673d criu checkpoint: error message fixup 91aa3683 criu: validate --parent-path 0dceab0c tests: add --work-path to criu test 90ef9732 criu: create --work-path directory 1fa86492 nix: update nixpkgs b9796420 linux: improve cgroup2 mount error message b679e7f7 linux: move unified_cgroup_path to private_data ffbfb6f3 Fix getcwd error handling 8c0075b5 linux: use syscall getcwd return value to set error 99c7b959 crun: Fix the binary name in the Usage info 19b4c254 Revert "Packit: Disable osh_diff_scan" dd8e1af5 Packit: Disable osh_diff_scan 5ec1f2ab Revert "Disable criu support on riscv64" bdd62e17 krun.1: regenerate 739a2bff build-aux/release.sh: fix shellcheck warnings 5c14c0dc make shellcheck: add more files f1cf3b35 tests/run_all_tests.sh: fix shellcheck issues d084c9b5 ci: bump shellcheck to v0.10.0 10e312d5 ci: improve shellcheck job 1e518be6 crun.1: fix "CPU controller" table rendering e7f8dc33 github: use ubuntu-latest for shellcheck 10db1f7a utils: Mark base64 table as non-string data 245d2edf ci: Add awk dependency to test containers 51958b39 ci: Add awk dependency 9adca806 Packit/TMT: run shellcheck tests on fedora envs 6e1ef464 ShellCheck: resolve warnings in TMT test script 7b910ea2 TMT: Simplify plans 9b395e9a build(deps): bump uraimo/run-on-arch-action from 3.0.0 to 3.0.1 9f2604ac linux: remove unused preprocessor directives 21e0179b linux: fix definition of CLONE_NEWCGROUP 684b2540 linux: fix definition of CLONE_NEWTIME 3e9b1c4a linux: fix definition of CLONE_NEWTIME on Centos 9 fc3ae8e2 krun: stop using set_workdir dfb649b3 linux: fix error leak from sync fd 8cb44cd6 container: don't leak error 0d760a96 linux: fix error leak 3649947b linux: make error messages more uniform 75e74bf7 container: make error messages more uniform 9774d59a utils: make error messages more uniform b656f67f cgroup: fix quoting for file names in error messages 6d4f5387 tests: configure additional IDs for the containers user 3b2e2a13 tests, podman: fix ginkgo installation c359fbd8 krun: return dlerror string when library is not found 285574fe tests: add tests for "crun mounts" b5a566bf crun: expose mounts command 196ad5e4 container: add/rm mounts API for a running container 4a27212a linux: move prepare_mount to its only caller c1c5232d linux: split code to new function c7337717 linux: refactor code in a new function 9acf13d6 tests: fix function signature 05277835 status: report better error on ENOENT c6197431 libcrun, krun: use existing error e229c129 seccomp plugins and seccomp receivers cannot be declared at the same time 18af4515 src: remove unused variables 10269840 NEWS: tag 1.21 84828c65 krun: bump vcpu limit to 16 079f95d0 krun: implement support for external kernels a7a178a1 krun: consolidate configuration file definitions 059445af utils: getsubidrange returns negative value on errors ff054fe7 maybe_chown_std_streams: ignore EBADF 3adcc2c7 utils: set_home_env returns negative value on errors f4973d7a tests: move cwd tests to the correct file 53f1c0bc if the container main process and console socket do not need a terminal, the terminal fd is not created 2f7c9b88 console socket client is initialized only when the user declares terminal. 132c793a krun: fix error message 8675bafa krun: create context after loading the library a5cb511d cpuset: fix handling of absent subcgroup d2b824ca krun: stop using krun_set_exec b09aa67d krun: make krun config file world readable 459595b6 container: ignore SIGWINCH without tty c954b1b6 criu: use a process to initialize the cgroup 959cc6c4 cgroup: extend function e3866cc5 cgroup: fix ownership of dfd in read_pids_cgroup Bumping libocispec to latest, which comprises the following commits: 9d1955f sources.py: fix unconditional return in map value clone 9937df4 ocispec: rename judge_complex to is_compound_type 61b922d ocispec: add support for string->object maps abae290 ocispec: remove explicit inheritance from object d67f492 helpers: rename CombinateName to HierarchicalName 55a0a9c helpers: rename Unite class to SchemaNode 809b047 runtime-spec: update to latest upstream revision d455ad0 image-spec: update to latest upstream revision 30a27d7 github: update action ed23e6a runtime-spec: sync from upstream 412ce10 image-spec: sync from upstream Bumping runtime-spec to version v1.2.1-11-g82cca47, which comprises the following commits: afd830f principles: fix typo d2f4f90 config-linux: add schemata field to IntelRdt (#1230) 27cb002 docs: fix typo (#1285) 0ed7cf6 docs: add missing backticks for code formatting e935f99 Define Linux Network Devices (#1271) df100de add systemd-nspawn to implementations.md 95a651f Add back +dev 524fc0e Release v1.2.1 221c198 Fix description of errnoRet in Seccomp 9de64c0 config-linux: update for libseccomp v2.6.0 1df9fa9 zos updates - add zos namespaces, remove zos devices This PR proposes updates to the OCI runtime spec with z/OS platform-specific details, including adding namespaces, adding noNewPrivileges flag, and removing devices. These changes are currently in use by the IBM z/OS Container Platform (zOSCP) product - details can be found here: https://www.ibm.com/products/zos-container-platform. 131ae4c Correct `prestart` hook description in summary (#1275) b9e8fdb Add support for windows CPU affinity b37b687 ci: Add a github actions workflow for lint 8cfc407 specs-go: sync SCMP_ARCH_* constants with libseccomp main (#1229) 9ceba9f update http links to https Bumping image-spec to version v1.1.1-6-g64294bd, which comprises the following commits: aca17c0 Clarify that canonical JSON is not a requirement 1809845 Bump back to +dev 147f9c1 Release v1.1.1 4fecf47 Add blake3 as a registered/supported hash algorithm 81e457e Fix grammar nit 60acaac Document extensibility of the image layout 4dcf962 Document Go version policy 6a277dd Add `cache-dependency-path` to avoid setup-go warning 00584ff Reduce maintenance burden by letting setup-go track our Go versions 85abb94 Manifests may contain multiple digest algorithms aa533a0 Delete project documentation 03306ac Hard link limitations in union filesystems cee95e9 Ignore uname/gname where uid/gid are supported Signed-off-by: Bruce Ashfield

containers: adapt to UNPACKDIR changes

2025-06-26T02:40:08+00:00

This commit updates the container recipes to the OE core UNPACKDIR changes. - We drop references to WORKDIR - We adjust destsuffix fetches to use BB_GIT_DEFAULT_DESTSUFFIX instead of 'git' - Update our GOPATH references to use UNPACKDIR - Drop S = assignemnts where possible Signed-off-by: Bruce Ashfield

crun: update to 1.20

2025-03-06T17:17:59+00:00

Bumping crun to version 1.20-53-g4d6eae2e, which comprises the following commits: 107214b1 build(deps): bump uraimo/run-on-arch-action from 2.8.1 to 3.0.0 c954b1b6 criu: use a process to initialize the cgroup 959cc6c4 cgroup: extend function e3866cc5 cgroup: fix ownership of dfd in read_pids_cgroup 0f16ced1 linux: set subsystem_path before use in error 6ed12c63 linux: remove dead code 6c049b81 criu: hide feature if dlopen is not present 73d00079 tests: map all IDs into the user namespace 0037d567 ci: fail on "sudo make check" f82ead82 tests: fix test_resources_unified_invalid_controller() 37213555 utils: improve error message if path not executable 5f5454b5 utils: do not use hardcoded path buffer 4948e451 utils: check for eaccess existence 410f0d53 container: pass down executable path to custom handler bb56343c utils: move error handling inside find_executable() a77702c0 tests: do a shallow git clone for podman f941be48 error: silence compiler warning b8b25ea1 Prevent dlopen() for CRIU in static link'ed binary 990b5f68 krun: fix libkrun_unload 79b7e6b3 libcrun: use an hash map to lookup the key 51fa411b libcrun: move annotations handling to a separate struct 9abef0da linux: fix dup error 14d5baa4 README: add CentOS Stream 9 & 10, rm 8 e735b4bc krun: fix libkrun_exec return value 90a321c6 container, error: update error handling 620b91b5 utils: fix PATH lookup 48470009 Downstream Fedora: fix gating config 7949fbc6 tests: disable new test that does not use the runtime 7f76fcd4 utils: add missing crun_error_release() 6598c99b utils: add O_NOFOLLOW 9c9a76ac NEWS: tag 1.20 0aec82c2 krun: fix CVE-2025-24965 793188c2 krun: initialize bool ac956685 utils: add O_WRONLY to WRITE_FILE_DEFAULT_FLAGS dcf4f78b utils: drop rootfs_len from safe_openat function de33f0a8 utils: write_file_at_with_flags uses safe_write c460b253 utils: safe_write uses size_t for the buffer length 12778089 utils: drop function write_file_with_flags f1ef3bb4 utils: move write_file* wrappers to utils.h 3e2344b0 utils: fix partial writes with write_file_at_with_flags 7930c13d krun: drop unused variable f7987aa9 linux, mono: remove unneeded crun_error_release() b548479c utils: reduce memory consumption in safe_readlinkat 3b653170 chroot_realpath: remove dead code 17135c1b chroot_realpath: do not return non-existing paths 7ab1acd3 container: fix error after read 490d5502 linux, utils: remove dead code crun_ensure_file*() 432a66d9 status: validate container id 73bcfabb status: report errors from get_state_directory_status_file 30d22ba3 status: report errors from get_run_directory 873db607 status: report errors from libcrun_get_state_directory f5e7718c linux: improve error writing to net.ipv4.ping_group_range 5c35f278 tests: make python script executable 5b51cca8 github: disable aarch64, ppc64le and s390x build 84d50992 github: cat config.log on configure failures 7aa2cd85 github: add r/w permissions 4f823090 github: show apt-get output 2d08f586 exec: always call setsid b788f338 scheduler: ignore ENOSYS when resetting affinity mask e292c9e9 src/linux: handle EINVAL during pidfd_open gracefully 869804f4 TMT: account for environments on internal testing farm ranch 65484cb9 TMT: Replace `adjust` with `prepare` conditionals a4dcb9c6 cgroup: Show the absolute path to cgroup.controllers when a controller is not available 179686b7 Revert "cgroup: remove tun/tap from the default allow list" 68e8d9ab test: use wasm32-wasip1 instead of wasm32-wasi 3158e491 criu: improve error handling for CRIU function calls 3cd9c2c9 criu: do not set network_lock if not specified Signed-off-by: Bruce Ashfield

crun: update to 1.19.1

2025-01-17T19:17:09+00:00

Bumping crun to version 1.19.1-13-g6f010b5f, which comprises the following commits: 25efd10a Remove surplus ENOENT error check 99f2824f utils: return error from set_home_env() if the user was not found 3158e491 criu: improve error handling for CRIU function calls 3cd9c2c9 criu: do not set network_lock if not specified a542ecc7 github: enable unprivileged userns 38122ac9 test: fix compiler warnings ec5947ce TMT: Add sanity tests from c9s downstream d08e304a Packit: Remove RHEL jobs 3e32a70c NEWS: tag 1.19.1 8b972be9 linux: fix a hang if there are no reads from the tty e50e47ca libcrun: add ring buffer implementation 20ec0982 utils: extend epoll_helper to monitor writeable fds 77a72bdf utils: use bool for set_blocking_fd() 5f9ca9eb utils: skip copy_file_range if not usable e2380490 tests: adjust test to upstream code d7933486 build-aux: use an init process for the nix container 0ec1522b nix: update packages list 9b014718 Generated crun.1 d700d9db Add missing periods at the end of sentence 1832c170 linux: remove tmpmount workaround 9e3615a4 ci: build tests_libcrun_fuzzer before fuzzing 6b2e6193 build: use libtool to create libcrun_testing 3c5292b2 build: don't compile tests during normal build db31c42a NEWS: tag 1.19 c4f8c87a checkpoint/restore: allow passing network lock method to libcriu 1942efc9 Handle case where cgroup v1 freezer is disabled b366a785 wamr: revitalize wamr handler 21219504 cgroup, systemd: do not override devices on update d1531073 error: 'CHAR_BIT' undeclared. fix compile failure with musl libc 5d66b309 build: Don't build cloned_binary as part of crun fd69065d test: add new test for exec-cpu-affinity b941d6c5 linux: move reset cpu affinity to scheduler ef33259c linux: honor exec cpu affinity mask 047b7485 src: move cpuset_string_to_bitmask to utils 2c8088c4 libocispec: sync 42b959b5 container: initialize max caps before accessing process block 46bd62b1 cgroup: do not stop process on exec 19bbd8da utils: silence compiler warning Signed-off-by: Bruce Ashfield

crun: update to 1.18.2

2024-12-10T03:47:54+00:00

Bumping crun to version 1.18.2-17-g52ed5880, which comprises the following commits: fd69065d test: add new test for exec-cpu-affinity b941d6c5 linux: move reset cpu affinity to scheduler ef33259c linux: honor exec cpu affinity mask 047b7485 src: move cpuset_string_to_bitmask to utils 2c8088c4 libocispec: sync 42b959b5 container: initialize max caps before accessing process block 46bd62b1 cgroup: do not stop process on exec 19bbd8da utils: silence compiler warning 8a0ee4b5 src: use mount API to self-clone 85d4db3d crun: check for integer overflow 10b2146e linux: add check before deref 2525752d cgroup: drop unuseful check 1ae190b0 src: run make clang-format 00ab38af NEWS: tag 1.18.2 5bc6b50e cgroup, systemd: fix first rule selection for systemd c41f034f NEWS: tag 1.18.1 6628d7a3 utils: check for snprintf truncation 7c4a3f9c cgroup: skip DevicePolicy if all devices are allowed ef60ec90 libcrun: deprecate cgroup v1 77e4233a cgroup, systemd: ignore rules before a default deny one 8a30a57a cgroup: ignore redundant deny dev cgroup rules 369dd95b CONTRIBUTING.md: new file 3647ecab linux: copy map_file before tokenizing in uidgidmap_helper 8656b254 NEWS: tag 1.18 bf0a3516 rpm: use embedded yajl in RHEL builds 41461290 crun.1.md: add lsm-profile and lsm-mount-context ed642593 criu: load lsm functions ce89aa66 restore: add lsm-mount-context option 9efd6a87 restore: add lsm-profile option aee13711 github: update run-on-arch-action c4a65aad cgroup: split lines when writing raw unified files dd7adb22 cgroup: write_cgroup_file_or_alias uses write_cgroup_file 22b018d0 cgroup: convert block_io devices to IODeviceWeight c7745e9a cgroup, systemd: add support for IODeviceWeight 8e3e693e cgroup: refactor handling of io.weight 7d0e2cdb cgroup: report errors if value contains not parsed data efae52ab cgroup: add support for the misc controller d55194b2 cgroup systemd: ignore unsupported properties 500cf802 cgroup, systemd: honor cpu.idle 5f64da6a linux: pass down state_root to the cgroup handler 80d9677b cgroup, systemd: honor memory.zswap.max 01fa4993 cgroup: specify devices rules to systemd 667442e4 cgroup: move standard devs definition in a common place 335d8cfb cgroup: specify TasksMax to systemd f6d8373f cgroup: specify MemorySwapMax to systemd 1a04566d cgroup: specify MemoryLow|MemoryHigh|MemoryMin to systemd 8d90eb3a cgroup: use macro to refactor common pattern 34061ab5 add duplicate namespace detection b29ccd7e cgroup: rename function af034b91 cgroup: special handle value "max" 2825a579 cgroup: set io weight on systemd owned cgroup 6cf5324b Packit: constrain koji and bodhi jobs to the fedora package 7140aea1 nix: replace gitMinimal with git 27b5a2f6 Fix running on kernel without user namespaces b5ff44f2 nix: update list of packages 3b40d773 build: specify --extra-experimental-features to nix da616875 release.sh: update nix image dee824e6 Fix segfault in `crun features` 4ea62f25 Disable criu support on riscv64 Bumping libocispec to latest, which comprises the following commits: ed23e6a runtime-spec: sync from upstream 412ce10 image-spec: sync from upstream 4b8feed common: make sizeof the last argument for calloc Bumping image-spec to version v1.1.0-44-gc66e811, which comprises the following commits: 40d3096 add example using .wh. and move opaque example to its section cee95e9 Ignore uname/gname where uid/gid are supported d44515e Changes requested from review 5db69d9 Feat: Pin external references on a release 76b8bae README: update runtime-spec links to use main branch 716f83b Implementations should support zstd Bumping runtime-spec to version v1.2.0-23-g9505701, which comprises the following commits: 9ceba9f update http links to https faf82be doc: fix the invalid hyperlink naming-a-volume adaa517 config: simplify final CPU affinity rule 119ae42 Add CPU affinity to executed processes 2149fb5 config-linux: describe the format of cpus and mems c6af124 ci: remove redundunt actions d4aa6d8 chore: format JSON file `make -C schema fmt` b983fbf CODEOWNERS: remove vbatts bf698d0 MAINTAINERS: move vbatts to EMERITUS Signed-off-by: Bruce Ashfield

crun: conditionally offer runc binary via symlink

2024-11-15T19:50:00+00:00

When integrating into some container stacks (such as containerd), the detailed configuration toml changes to change the container runtime from runc to crun is not always trivial. To avoid (for now) carrying configuration snippets as part of the recipes, we can symlink runc to crun as crun is fully compatible with runc. Note: this means you can't have runc and crun installed on the same image if the symlinking is done. Hence why this symlinking is conditional. Signed-off-by: Bruce Ashfield

crun: update to 1.17

2024-10-03T01:28:52+00:00

Bumping crun to version 1.17-5-g4b75c7c, which comprises the following commits: 4ea62f2 Disable criu support on riscv64 969fd2e Packit: Create missing path components in files_to_sync 000fa0d NEWS: tag 1.17 e3b5a26 Packit: Reuse Fedora targets wherever possible 556b808 Packit: separate out ELN build jobs a5320ae Add debug logs for container creation 228ad7c container: remove manual dup operation 13ea475 libocispec: sync from upstream 3dbf152 error: do not write error twice to stderr 5e35dfe libcrun: vanity, color debug messages 2c4db99 linux: ignore EPIPE for hooks 7fcede6 RPM/Packit: Fix wasm conditionals, cleanup rpm spec, update packit config 0f556b7 build: force install symlinks 23d5e49 Fix warning around unused result on chdir("/") 6bf9e7c Report executable not found errors after tty has been setup a295e70 Only log to stderr if `--log` is not provided fb593fc fix getpwuid_r error handling d29fdae tests: bump containerd version f36c216 tests: bump ubuntu version d065a5a Revert "Add `--log-stderr` option" dc31069 src/libcrun: fix handling of device paths with trailing slashes ab64a5c linux: fix recvfrom error handling a32d433 Fix `additional_gids_size` on `process_user_dup` b98e0dd Add `--log-stderr` option 544fe3f Allow passing an ID to journald log driver 6d92b28 Log only after crun context has been setup 29259e4 Add log options documentation f72483a Fix double-free in crun exec e4b4a21 src/libcrun: fix error handling in libcrun_kill_linux 83c1355 src/libcrun: improve error handling for the mnt namespace restoration 6fb1f08 src/libcrun: added custom error message for ESRCH case 9f06d3c Add autoPatchelfHook to static build 19b9893 Add `--log-level` option fd7f50a tests: fix wasmedge build 0380369 Remove libcrun_setup_terminal_ptmx 1edf6d0 src/libcrun: ensure DefaultDependencies respects CRI-O annotation 42b0b99 configure.ac: fix condition for wasm detection afa829c NEWS: tag 1.16.1 c6ecb3b linux: attempt to make rootfs private too 109f1e9 container: fix comment f23aaa1 linux: fix error message 72b4eea Inherit user from original process on exec cf1ec33 cgroup-utils: check for open error a958fcd cgroup-systemd: fix comment 7112df4 cgroup: remove redundant check 3bcd26a Use write_file_at_with_flags in write_file_with_flags 2dc1598 NEWS: tag 1.16 bfa0640 Add more O_PATH flags 0613ec5 cgroup-systemd: check for sd_bus_message_append error fcfac99 Fix sd-bus error handling for cpu quota and period props update. 6682432 linux: make_parent_mount_private uses fds 5943335 container: use relative path for rootfs if possible 27d7dd3 README: update podman demo f916acf Enable systemd in s390x builds e6eab76 wasmedge: access container environment variables for WasmEdge configuration Bumping libocispec to latest, which comprises the following commits: 4b8feed common: make sizeof the last argument for calloc 2ba727a sources: silence compiler warning 3ec73ba generate: generate clone operations for deep-copy d371222 ocispec: fix style 2236d50 github: test with the embedded yajl library bed19ad configure.ac: --enable-embedded-yajl skips check for yajl b633f89 Makefile.am: distribute the src/yajl symlink Bumping image-spec to version v1.1.0-35-gda92727, which comprises the following commits: 716f83b Implementations should support zstd 7327da4 Add deprecation notices to nondistributable layers 1d3daab Update linter and Go releases 16101e2 Remove misleading "must" in `ref.name` requirements 65dea7a Remove IRC link a977bd3 Remove validation warnings to stdout 4bbdd7f Switch jsonschema validation libraries 89fee07 MAINTAINERS: move jonboulle to EMERITUS Signed-off-by: Bruce Ashfield

crun: Add PACKAGECONFIG options

2024-10-03T01:28:52+00:00

Neither systemd nor seccomp is hard required by crun. They can actually be disabled during configuration with --disable-systemd or --disable-seccomp. Introduce PACKAGECONFIG options for them and default them to presence of corresponding entries in DISTRO_FEATURES. Now REQUIRED_DISTRO_FEATURES and features_check can also be removed. Similarly dependency on libcap can be made optional. crun actually contains pregenerated manpages in the repository so dependency on go-md2man-native can be made optional as well. As there is a configuration option for embedding yajl I added an option for that as well. However, as PACKAGECONFIG can only specify dependencies when config is enabled I had to invert the options so the config is for external-yajl. I set default PACKAGECONFIG value to match previous state (except detecting if systemd and seccomp are in DISTRO_FEATURES). Signed-off-by: Michal Sieron Signed-off-by: Bruce Ashfield