Bump github.com/opencontainers/runc from 1.3.3 to 1.4.0 #1504

dependabot · 2025-11-28T08:13:08Z

Bumps github.com/opencontainers/runc from 1.3.3 to 1.4.0.

Release notes

Sourced from github.com/opencontainers/runc's releases.

runc v1.4.0 -- "路漫漫其修远兮，吾将上下而求索！"

This is the first release of the 1.4.z release branch of runc. It contains a few fixes for issues found in 1.4.0-rc.3. This version of runc supports runtime-spec v1.3 (see [docs/spec-conformance.md][] for the few features that are still missing).

This is the second release of runc following our new release and support policy (see [RELEASES.md][] for more details). This means that, as of this release:

The runc 1.2.z release branch will now only receive high severity CVE fixes, and will no longer be supported in less than 6 months (end of April 2026).

The runc 1.3.z release branch will now only receive security and "significant" bugfixes.

Users are encouraged to plan migrating to runc 1.4.0 as soon as possible.

Despite this release being delayed by a month, users should still expect a runc 1.5.0 release in late April 2026.

Deprecated

Deprecate cgroup v1. (#4956)

Deprecate CleanPath, StripRoot, WithProcfd, and WithProcfdFile from libcontainer/utils. (#4985)

Breaking

The handling of pids.limit has been updated to match the newer guidance from the OCI runtime specification. In particular, now a maximum limit value of 0 will be treated as an actual limit (due to limitations with systemd, it will be treated the same as a limit value of 1). We only expect users that explicitly set pids.limit to 0 will see a behaviour change. opencontainers/cgroups#48#4949)

Fixed

opencontainers/cgroups#43

cgroups: retry DBus connection when it fails with EAGAIN. opencontainers/cgroups#45

cgroups: improve cpuacct.usage_all resilience when parsing data from opencontainers/cgroups#46 opencontainers/cgroups#50)

libct: close child fds on prepareCgroupFD error. (#4936)

libct: fix mips compilation. (#4962, #4967)

When configuring a tmpfs mount, only set the mode= argument if the target path already existed. This fixes a regression introduced in our [CVE-2025-52881][] mitigation patches. (#4971, #4976)

Fix various file descriptor leaks and add additional tests to detect them as comprehensively as possible. (#5007, #5021, #5034)

The "hallucination" helpers added as part of the [CVE-2025-52881][] mitigation have been made more generic and now apply to all of our pathrs helper functions, which should ensure we will not regress dangling symlink

... (truncated)

Changelog

Sourced from github.com/opencontainers/runc's changelog.

Changelog

This file documents all notable changes made to this project since runc 1.0.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[Unreleased]

libcontainer API

The deprecated libcontainer/userns package has been removed; use github.com/moby/sys/userns instead.

Breaking

The handling of pids.limit has been updated to match the newer guidance from the OCI runtime specification. In particular, now a maximum limit value of 0 will be treated as an actual limit (due to limitations with systemd, it will be treated the same as a limit value of 1). We only expect users that explicitly set pids.limit to 0 will see a behaviour change. opencontainers/cgroups#48#4949)

Fixed

opencontainers/cgroups#43

cgroups: retry DBus connection when it fails with EAGAIN. opencontainers/cgroups#45

cgroups: improve cpuacct.usage_all resilience when parsing data from opencontainers/cgroups#46 opencontainers/cgroups#50)

[1.4.0-rc.1] - 2025-09-05

おめェもボスになったんだろぉ？

This version of runc requires Go 1.24 to build.

libcontainer API

The deprecated libcontainer/user package has been removed; use github.com/moby/sys/user instead. (#3999, #4617)

libcontainer/apparmor variables containing public functions have been switched to wrapper functions. (#4725)

Breaking

runc update no longer allows --l3-cache-schema or --mem-bw-schema if linux.intelRdt was not present in the container’s original config.json.

Without linux.intelRdt no CLOS (resctrl group) is created at container creation, so it is not possible to apply the updated options with runc update.

Previously, this scenario did not work as expected. The runc update would create a new CLOS but fail to apply the schema, move only the init process

... (truncated)

Commits

8bd78a9 VERSION: release 1.4.0
7d84a12 Merge pull request #5005 from cyphar/1.4-hallucinated-paths
c362d6b Merge pull request #5040 from cyphar/1.4-better-init-errors-4928
f1d0dd8 runc create/run/exec: show fatal errors from init
4615662 libct/nsenter: better read/write errors
c4a61c0 libct/nsenter: sprinkle missing sane_kill
493f1b1 libct/nsenter: add and use bailx
7f9fc53 libct/nsenter: save errno in sane_kill
e18c06b Merge pull request #5041 from lifubang/backport-5014-fd-leaks-flake-1.4
5bb8987 libct/int: TestFdLeaks: deflake
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

copy-pr-bot · 2025-11-28T08:13:13Z

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

elezar · 2025-12-01T09:07:05Z

/ok-to-test 6e26bac

coveralls · 2025-12-01T09:09:36Z

Pull Request Test Coverage Report for Build 19888391543

Details

0 of 5 (0.0%) changed or added relevant lines in 2 files are covered.
No unchanged relevant lines lost coverage.
Overall coverage remained the same at 37.657%

Changes Missing Coverage	Covered Lines	Changed/Added Lines	%
internal/ldconfig/ldconfig_linux.go	0	2	0.0%
cmd/nvidia-cdi-hook/disable-device-node-modification/params_linux.go	0	3	0.0%

Totals
Change from base Build 19887236158:	0.0%
Covered Lines:	5179
Relevant Lines:	13753

💛 - Coveralls

ArangoGutierrez · 2025-12-01T12:43:55Z

/ok to test

copy-pr-bot · 2025-12-01T12:43:58Z

/ok to test

@ArangoGutierrez, there was an error processing your request: E1

See the following link for more information: https://docs.gha-runners.nvidia.com/cpr/e/1/

ArangoGutierrez · 2025-12-01T12:44:16Z

/ok to test 3a34c1a

ArangoGutierrez · 2025-12-01T12:59:55Z

/ok to test 7e69031

ArangoGutierrez · 2025-12-01T13:05:23Z

/ok to test 241edc9

elezar · 2025-12-02T15:46:13Z

internal/system/procfd_linux.go

+
+// WithProcfd opens a file descriptor to the specified path and invokes the
+// provided function with a /proc/self/fd path.
+func WithProcfd(root, unsafePath string, fn func(fdPath string) error) error {


Here we are copying code from the runc repo without properly attributing it.

What is the "correct" way to do this? While I agree that this is a valid way to handle breaking dependency changes in a patch release, I would like to consider what the scalable way to do this is for the next minor release.

Also, looking at the changes here, this is not actually required. Yes, I understand that this function is deprecated with the v1.4 release, but it is not being removed until v1.5. Why is it that we can't just add a //nolint check?

For reference: https://github.com/NVIDIA/nvidia-container-toolkit/actions/runs/19817146909/job/56770852753

Error: cmd/nvidia-cdi-hook/disable-device-node-modification/params_linux.go:40:9: SA1019: utils.WithProcfd is deprecated: This function is an internal implementation detail of runc and is no longer used. It will be removed in runc 1.5. (staticcheck) err := utils.WithProcfd(containerRootDirPath, hookScratchDirPath, func(hookScratchDirFdPath string) error { ^ Error: cmd/nvidia-cdi-hook/disable-device-node-modification/params_linux.go:52:8: SA1019: utils.WithProcfd is deprecated: This function is an internal implementation detail of runc and is no longer used. It will be removed in runc 1.5. (staticcheck) err = utils.WithProcfd(containerRootDirPath, modifiedParamsFilePath, func(modifiedParamsFileFdPath string) error { ^ Error: cmd/nvidia-cdi-hook/disable-device-node-modification/params_linux.go:63:9: SA1019: utils.WithProcfd is deprecated: This function is an internal implementation detail of runc and is no longer used. It will be removed in runc 1.5. (staticcheck) err = utils.WithProcfd(containerRootDirPath, nvidiaDriverParamsPath, func(nvidiaDriverParamsFdPath string) error { ^

What is the "correct" way to do this? While I agree that this is a valid way to handle breaking dependency changes in a patch release, I would like to consider what the scalable way to do this is for the next minor release.

Ack, will look into a better way

elezar

As mentioned in the comment, I don't think duplicating the runc functionality is something that we should do before we investigate other options.

elezar · 2025-12-02T15:59:13Z

internal/system/procfd_linux.go

+
+// WithProcfd opens a file descriptor to the specified path and invokes the
+// provided function with a /proc/self/fd path.
+func WithProcfd(root, unsafePath string, fn func(fdPath string) error) error {


Also, looking at the changes here, this is not actually required. Yes, I understand that this function is deprecated with the v1.4 release, but it is not being removed until v1.5. Why is it that we can't just add a //nolint check?

For reference: https://github.com/NVIDIA/nvidia-container-toolkit/actions/runs/19817146909/job/56770852753

Error: cmd/nvidia-cdi-hook/disable-device-node-modification/params_linux.go:40:9: SA1019: utils.WithProcfd is deprecated: This function is an internal implementation detail of runc and is no longer used. It will be removed in runc 1.5. (staticcheck) err := utils.WithProcfd(containerRootDirPath, hookScratchDirPath, func(hookScratchDirFdPath string) error { ^ Error: cmd/nvidia-cdi-hook/disable-device-node-modification/params_linux.go:52:8: SA1019: utils.WithProcfd is deprecated: This function is an internal implementation detail of runc and is no longer used. It will be removed in runc 1.5. (staticcheck) err = utils.WithProcfd(containerRootDirPath, modifiedParamsFilePath, func(modifiedParamsFileFdPath string) error { ^ Error: cmd/nvidia-cdi-hook/disable-device-node-modification/params_linux.go:63:9: SA1019: utils.WithProcfd is deprecated: This function is an internal implementation detail of runc and is no longer used. It will be removed in runc 1.5. (staticcheck) err = utils.WithProcfd(containerRootDirPath, nvidiaDriverParamsPath, func(nvidiaDriverParamsFdPath string) error { ^

ArangoGutierrez · 2025-12-02T16:17:10Z

As mentioned in the comment, I don't think duplicating the runc functionality is something that we should do before we investigate other options.

I have edited this PR to for now only ignore the deprecation lint, adding a TODO to work on it on our side

ArangoGutierrez · 2025-12-02T16:17:20Z

/ok to test c33efe8

Bumps [github.com/opencontainers/runc](https://github.com/opencontainers/runc) from 1.3.3 to 1.4.0. - [Release notes](https://github.com/opencontainers/runc/releases) - [Changelog](https://github.com/opencontainers/runc/blob/main/CHANGELOG.md) - [Commits](opencontainers/runc@v1.3.3...v1.4.0) --- updated-dependencies: - dependency-name: github.com/opencontainers/runc dependency-version: 1.4.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

Signed-off-by: Carlos Eduardo Arango Gutierrez <eduardoa@nvidia.com>

ArangoGutierrez · 2025-12-03T09:08:22Z

/ok to test 3705397

now we simply do a //nolint and add a TODO note

dependabot bot added the dependencies Issue/PR Pull about a dependency file label Nov 28, 2025

ArangoGutierrez requested a review from elezar December 1, 2025 12:40

ArangoGutierrez force-pushed the dependabot/go_modules/main/github.com/opencontainers/runc-1.4.0 branch 2 times, most recently from 04b8ed6 to 7e69031 Compare December 1, 2025 12:59

ArangoGutierrez force-pushed the dependabot/go_modules/main/github.com/opencontainers/runc-1.4.0 branch from 7e69031 to 241edc9 Compare December 1, 2025 13:05

ArangoGutierrez self-assigned this Dec 1, 2025

elezar reviewed Dec 2, 2025

View reviewed changes

elezar previously requested changes Dec 2, 2025

View reviewed changes

ArangoGutierrez force-pushed the dependabot/go_modules/main/github.com/opencontainers/runc-1.4.0 branch from 241edc9 to c33efe8 Compare December 2, 2025 16:16

dependabot bot and others added 2 commits December 3, 2025 09:41

[no-relnote] ignore deprecation warning of runc/utils/WithProcfd

3705397

Signed-off-by: Carlos Eduardo Arango Gutierrez <eduardoa@nvidia.com>

ArangoGutierrez force-pushed the dependabot/go_modules/main/github.com/opencontainers/runc-1.4.0 branch from c33efe8 to 3705397 Compare December 3, 2025 08:41

ArangoGutierrez requested a review from elezar December 3, 2025 09:38

Bump github.com/opencontainers/runc from 1.3.3 to 1.4.0 #1504

Are you sure you want to change the base?

Bump github.com/opencontainers/runc from 1.3.3 to 1.4.0 #1504

Uh oh!

Conversation

dependabot bot commented on behalf of github Nov 28, 2025

runc v1.4.0 -- "路漫漫其修远兮，吾将上下而求索！"

Deprecated

Breaking

Fixed

Changelog

[Unreleased]

libcontainer API

Breaking

Fixed

[1.4.0-rc.1] - 2025-09-05

libcontainer API

Breaking

Uh oh!

copy-pr-bot bot commented Nov 28, 2025

Uh oh!

elezar commented Dec 1, 2025

Uh oh!

coveralls commented Dec 1, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Pull Request Test Coverage Report for Build 19888391543

Details

💛 - Coveralls

Uh oh!

ArangoGutierrez commented Dec 1, 2025

Uh oh!

copy-pr-bot bot commented Dec 1, 2025

Uh oh!

ArangoGutierrez commented Dec 1, 2025

Uh oh!

ArangoGutierrez commented Dec 1, 2025

Uh oh!

ArangoGutierrez commented Dec 1, 2025

Uh oh!

elezar Dec 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

elezar Dec 2, 2025

Choose a reason for hiding this comment

Uh oh!

ArangoGutierrez Dec 2, 2025

Choose a reason for hiding this comment

Uh oh!

elezar left a comment

Choose a reason for hiding this comment

Uh oh!

elezar Dec 2, 2025

Choose a reason for hiding this comment

Uh oh!

ArangoGutierrez commented Dec 2, 2025

Uh oh!

ArangoGutierrez commented Dec 2, 2025

Uh oh!

ArangoGutierrez commented Dec 3, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

coveralls commented Dec 1, 2025 •

edited

Loading

elezar Dec 2, 2025 •

edited

Loading