mirror of
https://github.com/moby/moby.git
synced 2026-01-11 18:51:37 +00:00
aad7bcedd2
This is the fourth patch release of the 1.2.z release branch of runc. It includes a fix for a regression introduced in 1.2.0 related to the default device list. - Re-add tun/tap devices to built-in allowed devices lists. In runc 1.2.0 we removed these devices from the default allow-list (which were added seemingly by accident early in Docker's history) as a precaution in order to try to reduce the attack surface of device inodes available to most containers. At the time we thought that the vast majority of users using tun/tap would already be specifying what devices they need (such as by using --device with Docker/Podman) as opposed to doing the mknod manually, and thus there would've been no user-visible change. Unfortunately, it seems that this regressed a noticeable number of users (and not all higher-level tools provide easy ways to specify devices to allow) and so this change needed to be reverted. Users that do not need these devices are recommended to explicitly disable them by adding deny rules in their container configuration. full diff: https://github.com/opencontainers/runc/compare/v1.2.3...v1.2.4 release notes: https://github.com/opencontainers/runc/releases/tag/v1.2.4 Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
30 lines
946 B
Bash
Executable File
30 lines
946 B
Bash
Executable File
#!/bin/sh
|
|
set -e
|
|
|
|
# RUNC_VERSION specifies the version of runc to install from the
|
|
# https://github.com/opencontainers/runc repository.
|
|
#
|
|
# The version of runc should match the version that is used by the containerd
|
|
# version that is used. If you need to update runc, open a pull request in
|
|
# the containerd project first, and update both after that is merged.
|
|
#
|
|
# When updating RUNC_VERSION, consider updating runc in vendor.mod accordingly
|
|
: "${RUNC_VERSION:=v1.2.4}"
|
|
|
|
install_runc() {
|
|
RUNC_BUILDTAGS="${RUNC_BUILDTAGS:-"seccomp"}"
|
|
|
|
echo "Install runc version $RUNC_VERSION (build tags: $RUNC_BUILDTAGS)"
|
|
git clone https://github.com/opencontainers/runc.git "$GOPATH/src/github.com/opencontainers/runc"
|
|
cd "$GOPATH/src/github.com/opencontainers/runc"
|
|
git checkout -q "$RUNC_VERSION"
|
|
if [ -z "$1" ]; then
|
|
target=static
|
|
else
|
|
target="$1"
|
|
fi
|
|
make BUILDTAGS="$RUNC_BUILDTAGS" "$target"
|
|
mkdir -p "${PREFIX}"
|
|
cp runc "${PREFIX}/runc"
|
|
}
|