lengrongfu
095131abf9
add use systemd cgroup e2e
...
Signed-off-by: lengrongfu <lenronfu@gmail.com>
Signed-off-by: rongfu.leng <lenronfu@gmail.com>
2024-10-03 00:37:29 +08:00
Derek McGowan
06dfa0c2f1
Merge pull request #10754 from containerd/dependabot/go_modules/github.com/intel/goresctrl-0.8.0
...
build(deps): bump github.com/intel/goresctrl from 0.7.0 to 0.8.0
2024-10-02 13:53:44 +00:00
Derek McGowan
4d65025d92
Merge pull request #10725 from kiashok/update-hcsshim-0.12.7
...
Update hcsshim to v0.12.7
2024-10-02 13:52:16 +00:00
Derek McGowan
05ee43a5fd
Merge pull request #10752 from dmcgowan/prepare-v2.0.0-rc.5
...
Prepare release notes for v2.0.0-rc.5
2024-10-01 15:20:19 +00:00
Kirtana Ashok
0d4e606bbc
Update hcsshim to v0.12.7
...
Signed-off-by: Kirtana Ashok <kiashok@microsoft.com>
2024-09-30 17:38:28 -07:00
dependabot[bot]
78e39f7c5b
build(deps): bump github.com/intel/goresctrl from 0.7.0 to 0.8.0
...
Bumps [github.com/intel/goresctrl](https://github.com/intel/goresctrl ) from 0.7.0 to 0.8.0.
- [Release notes](https://github.com/intel/goresctrl/releases )
- [Commits](https://github.com/intel/goresctrl/compare/v0.7.0...v0.8.0 )
---
updated-dependencies:
- dependency-name: github.com/intel/goresctrl
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
2024-09-30 23:56:42 +00:00
Maksym Pavlenko
03e0e4c02f
Merge pull request #10186 from cpuguy83/propagate_traces_to_shim
...
Propagate trace contexts to shims
2024-09-30 23:21:57 +00:00
Brian Goff
17d4a1357e
Propagate trace contexts to shims
...
This adds trace context propagation over the grpc/ttrpc calls to a shim.
It also adds the otlp plugin to the runc shim so that it will send
traces to the configured tracer (which is inherited from containerd's
config).
It doesn't look like this is adding any real overhead to the runc shim's
memory usage, however it does add 2MB to the binary size.
As such this is gated by a build tag `shim_tracing`
Signed-off-by: Brian Goff <cpuguy83@gmail.com>
2024-09-30 21:44:16 +00:00
Maksym Pavlenko
03db11c3f2
Merge pull request #10744 from sameersaeed/sandbox-cni-plugins
...
Add check for CNI plugins before tearing down pod network
2024-09-30 15:23:58 +00:00
Derek McGowan
bc4646067d
Prepare release notes for v2.0.0-rc.5
...
Signed-off-by: Derek McGowan <derek@mcg.dev>
2024-09-30 07:13:14 -07:00
Fu Wei
363e50bee0
Merge pull request #10747 from lujinda/anno-image-user-specified
...
[cri] use 'UserSpecifiedImage' to set the image-name annotation
2024-09-30 04:47:30 +00:00
jinda.ljd
ccb2a8d747
[cri] use 'UserSpecifiedImage' to set the image-name annotation
...
However, when an image has multiple tags, the image originally obtained may not be the one actually specified by the user.
Starting from cri-api v0.28.0, a UserSpecifiedImage field is added to ImageSpec.
It is more appropriate to use UserSpecifiedImage.
Signed-off-by: jinda.ljd <jinda.ljd@alibaba-inc.com>
2024-09-30 08:38:17 +08:00
Maksym Pavlenko
86e0f52e17
Merge pull request #10740 from zouyee/event
...
Add timestamp to PodSandboxStatusResponse for kubernetes Evented PLEG
2024-09-28 00:11:16 +00:00
Sameer
b7b6b324b8
Add check for CNI plugins before tearing down pod network
...
Signed-off-by: Sameer <sameer.saeed@live.ca>
2024-09-27 16:12:03 -04:00
Maksym Pavlenko
db97449598
Merge pull request #10730 from mxpv/features
...
Move features section to a separate file
2024-09-27 14:42:50 +00:00
zouyee
b5290726d2
Add timestamp to PodSandboxStatusResponse for kubernetes Evented PLEG
...
Signed-off-by: zouyee <zouyee1989@gmail.com>
2024-09-27 16:50:00 +08:00
Maksym Pavlenko
3df2cc1a6b
Merge pull request #10717 from containerd/dependabot/go_modules/github.com/klauspost/compress-1.17.10
...
build(deps): bump github.com/klauspost/compress from 1.17.9 to 1.17.10
2024-09-26 22:33:43 +00:00
Maksym Pavlenko
146a977f92
Move features section to a separate file
...
Signed-off-by: Maksym Pavlenko <pavlenko.maksym@gmail.com>
2024-09-26 15:32:16 -07:00
Maksym Pavlenko
0dc66dab71
Merge pull request #10718 from containerd/dependabot/go_modules/google.golang.org/grpc-1.67.0
...
build(deps): bump google.golang.org/grpc from 1.66.2 to 1.67.0
2024-09-26 20:06:54 +00:00
Maksym Pavlenko
83fe5264e7
Merge pull request #10719 from containerd/dependabot/go_modules/github.com/prometheus/client_golang-1.20.4
...
build(deps): bump github.com/prometheus/client_golang from 1.20.3 to 1.20.4
2024-09-26 20:06:39 +00:00
dependabot[bot]
f7ca91fa39
build(deps): bump github.com/prometheus/client_golang
...
Bumps [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang ) from 1.20.3 to 1.20.4.
- [Release notes](https://github.com/prometheus/client_golang/releases )
- [Changelog](https://github.com/prometheus/client_golang/blob/main/CHANGELOG.md )
- [Commits](https://github.com/prometheus/client_golang/compare/v1.20.3...v1.20.4 )
---
updated-dependencies:
- dependency-name: github.com/prometheus/client_golang
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
2024-09-23 23:18:45 +00:00
dependabot[bot]
c75178d931
build(deps): bump google.golang.org/grpc from 1.66.2 to 1.67.0
...
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go ) from 1.66.2 to 1.67.0.
- [Release notes](https://github.com/grpc/grpc-go/releases )
- [Commits](https://github.com/grpc/grpc-go/compare/v1.66.2...v1.67.0 )
---
updated-dependencies:
- dependency-name: google.golang.org/grpc
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
2024-09-23 23:18:36 +00:00
dependabot[bot]
519cbda1d8
build(deps): bump github.com/klauspost/compress from 1.17.9 to 1.17.10
...
Bumps [github.com/klauspost/compress](https://github.com/klauspost/compress ) from 1.17.9 to 1.17.10.
- [Release notes](https://github.com/klauspost/compress/releases )
- [Changelog](https://github.com/klauspost/compress/blob/master/.goreleaser.yml )
- [Commits](https://github.com/klauspost/compress/compare/v1.17.9...v1.17.10 )
---
updated-dependencies:
- dependency-name: github.com/klauspost/compress
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
2024-09-23 23:18:27 +00:00
Samuel Karp
2ca3ff8725
Merge pull request #10713 from wzshiming/enable-selinux-on-cri-test
...
Enable the selinux on cri test
2024-09-23 17:44:05 +00:00
Fu Wei
906c23218c
Merge pull request #10307 from henry118/uidmap
...
Support multiple uid/gid mappings [1/2]
2024-09-23 12:25:05 +00:00
Shiming Zhang
d72051036a
Enable the selinux on cri test
...
Signed-off-by: Shiming Zhang <wzshiming@hotmail.com>
2024-09-21 16:22:25 +08:00
Akihiro Suda
a448047386
Merge pull request #10699 from containerd/dependabot/go_modules/k8s-82433053af
...
build(deps): bump the k8s group with 4 updates
2024-09-19 22:57:49 +00:00
dependabot[bot]
b03a3c5a21
build(deps): bump the k8s group with 4 updates
...
Bumps the k8s group with 4 updates: [k8s.io/apimachinery](https://github.com/kubernetes/apimachinery ), [k8s.io/client-go](https://github.com/kubernetes/client-go ), [k8s.io/component-base](https://github.com/kubernetes/component-base ) and [k8s.io/kubelet](https://github.com/kubernetes/kubelet ).
Updates `k8s.io/apimachinery` from 0.31.0 to 0.31.1
- [Commits](https://github.com/kubernetes/apimachinery/compare/v0.31.0...v0.31.1 )
Updates `k8s.io/client-go` from 0.31.0 to 0.31.1
- [Changelog](https://github.com/kubernetes/client-go/blob/master/CHANGELOG.md )
- [Commits](https://github.com/kubernetes/client-go/compare/v0.31.0...v0.31.1 )
Updates `k8s.io/component-base` from 0.31.0 to 0.31.1
- [Commits](https://github.com/kubernetes/component-base/compare/v0.31.0...v0.31.1 )
Updates `k8s.io/kubelet` from 0.31.0 to 0.31.1
- [Commits](https://github.com/kubernetes/kubelet/compare/v0.31.0...v0.31.1 )
---
updated-dependencies:
- dependency-name: k8s.io/apimachinery
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: k8s
- dependency-name: k8s.io/client-go
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: k8s
- dependency-name: k8s.io/component-base
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: k8s
- dependency-name: k8s.io/kubelet
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: k8s
...
Signed-off-by: dependabot[bot] <support@github.com>
2024-09-19 17:25:38 +00:00
Maksym Pavlenko
ff67a67d72
Merge pull request #10700 from containerd/dependabot/go_modules/otel-910e354cca
...
build(deps): bump the otel group with 8 updates
2024-09-19 16:45:26 +00:00
Akihiro Suda
8c64a2f6a1
Merge pull request #10607 from fuweid/pin-userns
...
internal/cri: simplify netns setup with pinned userns
2024-09-19 01:05:41 +00:00
dependabot[bot]
017efe05a2
build(deps): bump the otel group with 8 updates
...
Bumps the otel group with 8 updates:
| Package | From | To |
| --- | --- | --- |
| [go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc](https://github.com/open-telemetry/opentelemetry-go-contrib ) | `0.54.0` | `0.55.0` |
| [go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp](https://github.com/open-telemetry/opentelemetry-go-contrib ) | `0.54.0` | `0.55.0` |
| [go.opentelemetry.io/otel](https://github.com/open-telemetry/opentelemetry-go ) | `1.29.0` | `1.30.0` |
| [go.opentelemetry.io/otel/exporters/otlp/otlptrace](https://github.com/open-telemetry/opentelemetry-go ) | `1.29.0` | `1.30.0` |
| [go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc](https://github.com/open-telemetry/opentelemetry-go ) | `1.29.0` | `1.30.0` |
| [go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp](https://github.com/open-telemetry/opentelemetry-go ) | `1.29.0` | `1.30.0` |
| [go.opentelemetry.io/otel/sdk](https://github.com/open-telemetry/opentelemetry-go ) | `1.29.0` | `1.30.0` |
| [go.opentelemetry.io/otel/trace](https://github.com/open-telemetry/opentelemetry-go ) | `1.29.0` | `1.30.0` |
Updates `go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc` from 0.54.0 to 0.55.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go-contrib/releases )
- [Changelog](https://github.com/open-telemetry/opentelemetry-go-contrib/blob/main/CHANGELOG.md )
- [Commits](https://github.com/open-telemetry/opentelemetry-go-contrib/compare/zpages/v0.54.0...zpages/v0.55.0 )
Updates `go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp` from 0.54.0 to 0.55.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go-contrib/releases )
- [Changelog](https://github.com/open-telemetry/opentelemetry-go-contrib/blob/main/CHANGELOG.md )
- [Commits](https://github.com/open-telemetry/opentelemetry-go-contrib/compare/zpages/v0.54.0...zpages/v0.55.0 )
Updates `go.opentelemetry.io/otel` from 1.29.0 to 1.30.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases )
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md )
- [Commits](https://github.com/open-telemetry/opentelemetry-go/compare/v1.29.0...v1.30.0 )
Updates `go.opentelemetry.io/otel/exporters/otlp/otlptrace` from 1.29.0 to 1.30.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases )
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md )
- [Commits](https://github.com/open-telemetry/opentelemetry-go/compare/v1.29.0...v1.30.0 )
Updates `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc` from 1.29.0 to 1.30.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases )
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md )
- [Commits](https://github.com/open-telemetry/opentelemetry-go/compare/v1.29.0...v1.30.0 )
Updates `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp` from 1.29.0 to 1.30.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases )
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md )
- [Commits](https://github.com/open-telemetry/opentelemetry-go/compare/v1.29.0...v1.30.0 )
Updates `go.opentelemetry.io/otel/sdk` from 1.29.0 to 1.30.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases )
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md )
- [Commits](https://github.com/open-telemetry/opentelemetry-go/compare/v1.29.0...v1.30.0 )
Updates `go.opentelemetry.io/otel/trace` from 1.29.0 to 1.30.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases )
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md )
- [Commits](https://github.com/open-telemetry/opentelemetry-go/compare/v1.29.0...v1.30.0 )
---
updated-dependencies:
- dependency-name: go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: otel
- dependency-name: go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: otel
- dependency-name: go.opentelemetry.io/otel
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: otel
- dependency-name: go.opentelemetry.io/otel/exporters/otlp/otlptrace
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: otel
- dependency-name: go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: otel
- dependency-name: go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: otel
- dependency-name: go.opentelemetry.io/otel/sdk
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: otel
- dependency-name: go.opentelemetry.io/otel/trace
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: otel
...
Signed-off-by: dependabot[bot] <support@github.com>
2024-09-18 08:30:25 +00:00
Akihiro Suda
67b06872e7
Merge pull request #10695 from containerd/dependabot/go_modules/golang-x-cf6e4563c3
...
build(deps): bump golang.org/x/mod from 0.20.0 to 0.21.0 in the golang-x group across 1 directory
2024-09-18 07:48:38 +00:00
Maksym Pavlenko
4bdaebb9c8
Merge pull request #10701 from containerd/dependabot/go_modules/google.golang.org/grpc-1.66.2
...
build(deps): bump google.golang.org/grpc from 1.65.0 to 1.66.2
2024-09-17 22:38:13 +00:00
dependabot[bot]
7c89148a1c
build(deps): bump google.golang.org/grpc from 1.65.0 to 1.66.2
...
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go ) from 1.65.0 to 1.66.2.
- [Release notes](https://github.com/grpc/grpc-go/releases )
- [Commits](https://github.com/grpc/grpc-go/compare/v1.65.0...v1.66.2 )
---
updated-dependencies:
- dependency-name: google.golang.org/grpc
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
2024-09-16 23:16:37 +00:00
dependabot[bot]
6e2c4d00dc
build(deps): bump golang.org/x/mod
...
Bumps the golang-x group with 1 update in the / directory: [golang.org/x/mod](https://github.com/golang/mod ).
Updates `golang.org/x/mod` from 0.20.0 to 0.21.0
- [Commits](https://github.com/golang/mod/compare/v0.20.0...v0.21.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/mod
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: golang-x
...
Signed-off-by: dependabot[bot] <support@github.com>
2024-09-12 20:12:29 +00:00
Maksym Pavlenko
15dd956915
Merge pull request #10687 from containerd/dependabot/go_modules/github.com/prometheus/client_golang-1.20.3
...
build(deps): bump github.com/prometheus/client_golang from 1.20.2 to 1.20.3
2024-09-12 19:34:57 +00:00
Phil Estes
ee9d950bdc
Merge pull request #10688 from containerd/dependabot/go_modules/github.com/checkpoint-restore/go-criu/v7-7.2.0
...
build(deps): bump github.com/checkpoint-restore/go-criu/v7 from 7.1.0 to 7.2.0
2024-09-12 19:05:37 +00:00
Wei Fu
ee0ed75d64
internal/cri: simplify netns setup with pinned userns
...
Motivation:
For pod-level user namespaces, it's impossible to force the container runtime
to join an existing network namespace after creating a new user namespace.
According to the capabilities section in [user_namespaces(7)][1], a network
namespace created by containerd is owned by the root user namespace. When the
container runtime (like runc or crun) creates a new user namespace, it becomes
a child of the root user namespace. Processes within this child user namespace
are not permitted to access resources owned by the parent user namespace.
If the network namespace is not owned by the new user namespace, the container
runtime will fail to mount /sys due to the [sysfs: Restrict mounting sysfs][2]
patch.
Referencing the [cap_capable][3] function in Linux, a process can access a
resource if:
* The resource is owned by the process's user namespace, and the process has
the required capability.
* The resource is owned by a child of the process's user namespace, and the
owner's user namespace was created by the process's UID.
In the context of pod-level user namespaces, the CRI plugin delegates the
creation of the network namespace to the container runtime when running the
pause container. After the pause container is initialized, the CRI plugin pins
the pause container's network namespace into `/run/netns` and then executes
the `CNI_ADD` command over it.
However, if the pause container is terminated during the pinning process, the
CRI plugin might encounter a PID cycle, leading to the `CNI_ADD` command
operating on an incorrect network namespace.
Moreover, rolling back the `RunPodSandbox` API is complex due to the delegation
of network namespace creation. As highlighted in issue #10363 , the CRI plugin
can lose IP information after a containerd restart, making it challenging to
maintain robustness in the RunPodSandbox API.
Solution:
Allow containerd to create a new user namespace and then create the network
namespace within that user namespace. This way, the CRI plugin can force the
container runtime to join both the user namespace and the network namespace.
Since the network namespace is owned by the newly created user namespace,
the container runtime will have the necessary permissions to mount `/sys` on
the container's root filesystem. As a result, delegation of network namespace
creation is no longer needed.
NOTE:
* The CRI plugin does not need to pin the newly created user namespace as it
does with the network namespace, because the kernel allows retrieving a user
namespace reference via [ioctl_ns(2)][4]. As a result, the podsandbox
implementation can obtain the user namespace using the `netnsPath` parameter.
[1]: <https://man7.org/linux/man-pages/man7/user_namespaces.7.html >
[2]: <7dc5dbc879
>
[3]: <2c85ebc57b/security/commoncap.c (L65)
>
[4]: <https://man7.org/linux/man-pages/man2/ioctl_ns.2.html >
Signed-off-by: Wei Fu <fuweid89@gmail.com>
2024-09-11 07:21:43 +08:00
Wei Fu
fd3f3d5a13
pkg/sys: add GetUsernsForNamespace interface
...
Signed-off-by: Wei Fu <fuweid89@gmail.com>
2024-09-11 07:21:43 +08:00
Wei Fu
490e45a08a
pkg/sys: Add UnshareAfterEnterUserns function
...
It allows to disassociate parts of its execution context within a user
namespace.
Signed-off-by: Wei Fu <fuweid89@gmail.com>
2024-09-11 07:21:39 +08:00
Henry Wang
83aaa89b61
update ctr run to support multiple uid/gid mappings
...
Signed-off-by: Henry Wang <henwang@amazon.com>
2024-09-10 17:06:27 +00:00
dependabot[bot]
1dedcb7841
build(deps): bump github.com/checkpoint-restore/go-criu/v7
...
Bumps [github.com/checkpoint-restore/go-criu/v7](https://github.com/checkpoint-restore/go-criu ) from 7.1.0 to 7.2.0.
- [Release notes](https://github.com/checkpoint-restore/go-criu/releases )
- [Commits](https://github.com/checkpoint-restore/go-criu/compare/v7.1.0...v7.2.0 )
---
updated-dependencies:
- dependency-name: github.com/checkpoint-restore/go-criu/v7
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
2024-09-09 23:33:48 +00:00
dependabot[bot]
7599d4df27
build(deps): bump github.com/prometheus/client_golang
...
Bumps [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang ) from 1.20.2 to 1.20.3.
- [Release notes](https://github.com/prometheus/client_golang/releases )
- [Changelog](https://github.com/prometheus/client_golang/blob/v1.20.3/CHANGELOG.md )
- [Commits](https://github.com/prometheus/client_golang/compare/v1.20.2...v1.20.3 )
---
updated-dependencies:
- dependency-name: github.com/prometheus/client_golang
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
2024-09-09 23:33:36 +00:00
Maksym Pavlenko
19430264c1
Merge pull request #10678 from thaJeztah/update_go_1.23.1
...
update to go1.23.1, go1.22.7
2024-09-08 01:27:56 +00:00
Sebastiaan van Stijn
9037069da8
update to go1.23.1, go1.22.7
...
- https://github.com/golang/go/issues?q=milestone%3AGo1.23.1+label%3ACherryPickApproved
- full diff: https://github.com/golang/go/compare/go1.23.0...go1.23.1
These minor releases include 3 security fixes following the security policy:
- go/parser: stack exhaustion in all Parse* functions
Calling any of the Parse functions on Go source code which contains
deeply nested literals can cause a panic due to stack exhaustion.
This is CVE-2024-34155 and Go issue https://go.dev/issue/69138 .
- encoding/gob: stack exhaustion in Decoder.Decode
Calling Decoder.Decode on a message which contains deeply nested
structures can cause a panic due to stack exhaustion.
This is a follow-up to CVE-2022-30635.
Thanks to Md Sakib Anwar of The Ohio State University for reporting
this issue.
This is CVE-2024-34156 and Go issue https://go.dev/issue/69139 .
- go/build/constraint: stack exhaustion in Parse
Calling Parse on a "// +build" build tag line with deeply nested
expressions can cause a panic due to stack exhaustion.
This is CVE-2024-34158 and Go issue https://go.dev/issue/69141 .
View the release notes for more information:
https://go.dev/doc/devel/release#go1.23.1
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2024-09-06 16:12:28 +02:00
Davanum Srinivas
e013322eed
Merge pull request #10649 from samuelkarp/shim-exec-fp-test
...
integration: regression test for issue 10589
2024-09-06 11:29:27 +00:00
Samuel Karp
18725f010b
integration: regression test for issue 10589
...
This issue was caused by a race between init exits and new exec process
tracking inside the shim. The test operates by controlling the time
between when the shim invokes "runc exec" and when the actual "runc
exec" is triggered. This allows validating that races for shim state
tracking between pre- and post-start of the exec process do not exist.
Relates to https://github.com/containerd/containerd/issues/10589
Signed-off-by: Samuel Karp <samuelkarp@google.com>
2024-09-05 16:17:09 -07:00
Samuel Karp
5f37a2c205
fifosync: cross-process synchronization
...
Signed-off-by: Samuel Karp <samuelkarp@google.com>
2024-09-05 12:48:28 -07:00
Samuel Karp
c8b095f3c2
Merge pull request #10651 from laurazard/shim-refactor-without-pending
...
runc-shim: fix races/prevent init exits from being dropped
2024-09-05 19:10:42 +00:00
Phil Estes
192679b059
Merge pull request #10659 from djdongjin/remove-duplicated-sandbox-conversion
...
Remove duplicated sandbox <-> proto conversion functions
2024-09-05 14:57:17 +00:00