[19.03] update containerd 1.12.12, runc v1.0.0-rc10

[thaJeztah]

Includes back ports of:

• update runc to v1.0.0-rc10 (CVE-2019-19921) #40404 update runc to v1.0.0-rc10 (CVE-2019-19921)
  • revendoring opencontainers/runc, because Update buildkit to containerd leases #40122 (f632e2d) was not backported (and we probably don't want to update the containerd vendoring

[19.03] Update containerd binary to v1.2.12

full diff: containerd/containerd@v1.2.11...v1.2.12

Welcome to the v1.2.12 release of containerd!

The twelfth patch release for containerd 1.2 includes an updated runc with
a fix for CVE-2019-19921, an updated version of the opencontainers/selinux
dependency, which includes a fix for CVE-2019-16884, an updated version of the
gopkg.in/yaml.v2 dependency to address CVE-2019-11253, and a Golang update.

Notable Updates

• Update the runc vendor to v1.0.0-rc10 which includes a mitigation for CVE-2019-19921.
• Update the opencontainers/selinux which includes a mitigation for CVE-2019-16884.
• Update Golang runtime to 1.12.16, mitigating the CVE-2020-0601 certificate verification
  bypass on Windows, and CVE-2020-7919, which only affects 32-bit architectures.
• Update Golang runtime to 1.12.15, which includes a fix to the runtime (Go 1.12.14,
  Go 1.12.15) and and the net/http package (Go 1.12.15)
• A fix to prevent SIGSEGV when starting containerd-shim [backport release/1.2] runtime: only check killall for init process containerd/containerd#3960
• Fixes to exec [release/1.2 backport] backport exec fixes containerd/containerd#3755
  • Prevent docker exec hanging if an earlier docker exec left a zombie process
  • Prevent High system load/CPU utilization with liveness and readiness probes
  • Prevent Docker healthcheck causing high CPU utilization

CRI fixes:

• Update the gopkg.in/yaml.v2 vendor to v2.2.8 with a mitigation for CVE-2019-11253

API

• Fix API filters to properly handle and return parse errors Fix filter errors containerd/containerd#3950

update runc binary to v1.0.0-rc10 (CVE-2019-19921)

Notable changes:

• Fix CVE-2019-19921 (Volume mount race condition with shared mounts): rootfs: do not permit /proc mounts to non-directories opencontainers/runc#2207
• Fix exec FIFO race: Fix race checking for process exit and waiting for exec fifo opencontainers/runc#2185
• Basic support for cgroup v2. Almost feature-complete, but still missing support for systemd mode in rootless.
  See also cgroup2: TODO list opencontainers/runc#2209 for the known issues.

Full changes: opencontainers/runc@v1.0.0-rc9...v1.0.0-rc10

update runc library to v1.0.0-rc10 (CVE-2019-19921)

Notable changes:

• Fix CVE-2019-19921 (Volume mount race condition with shared mounts): rootfs: do not permit /proc mounts to non-directories opencontainers/runc#2207
• Fix exec FIFO race: Fix race checking for process exit and waiting for exec fifo opencontainers/runc#2185
• Basic support for cgroup v2. Almost feature-complete, but still missing support for systemd mode in rootless.
  See also cgroup2: TODO list opencontainers/runc#2209 for the known issues.

Full changes: opencontainers/runc@84373aa...v1.0.0-rc10

Also updates go-selinux: opencontainers/selinux@3a1f366...5215b18
(See containerd/cri#1383 (comment))

[thaJeztah]

@tonistiigi @tiborvass @AkihiroSuda @cpuguy83 @arkodg PTAL

please double-check the updated vendoring of runc and selinux

[thaJeztah]

rebased

[tiborvass]

@thaJeztah where does this change come from?

[thaJeztah]

This comes from #40404

[tiborvass]

Ok, so it's more like when we vendored runc v1.0.0-rc9 we forgot to bump selinux, because there is no difference between v1.0.0-rc9 and v1.0.0-rc10 wrt selinux.

[cpuguy83]

LGTM

[thaJeztah]

Flaky test; kicked CI again;

=== RUN TestInspect
--- FAIL: TestInspect (12.18s)
inspect_test.go:23: Creating a new daemon at: /go/src/github.com/docker/docker/bundles/test-integration/TestInspect
daemon.go:325: [dfb1ceebc0eb4] waiting for daemon to start
daemon.go:325: [dfb1ceebc0eb4] waiting for daemon to start
daemon.go:353: [dfb1ceebc0eb4] daemon started
inspect_test.go:39: timeout hit after 10s: waiting for tasks to enter run state. task failed with error: task: non-zero exit (1)
daemon.go:461: [dfb1ceebc0eb4] Stopping daemon
daemon.go:296: [dfb1ceebc0eb4] exiting daemon
daemon.go:448: [dfb1ceebc0eb4] Daemon stopped