| Index | index by Group | index by Distribution | index by Vendor | index by creation date | index by Name | Mirrors | Help | Search |
| Name: crun | Distribution: openSUSE Tumbleweed |
| Version: 1.30.1 | Vendor: openSUSE |
| Release: 1.1 | Build date: Thu Oct 15 06:48:54 2026 |
| Group: Unspecified | Build host: reproducible |
| Size: 1295297 | Source RPM: crun-1.30.1-1.1.src.rpm |
| Packager: http://bugs.opensuse.org | |
| Url: https://github.com/containers/crun | |
| Summary: OCI runtime written in C | |
crun is a runtime for running OCI containers.
GPL-2.0-or-later
* Thu Oct 15 2026 Kyle Scheuing <kyle@kylescheuing.com>
- Update to version 1.30.1:
* CVE-2026-84042: add a proper fix for it. The old version didn't
include the correct patches. (bsc#1279949)
- Update to version 1.30:
* CVE-2026-84042: prevent that rootful krun with passt can execute
payload from container without proper confinement. (bsc#1279949)
* CVE-2026-88264: do not follow symlinks when creating /dev/console.
A rootfs providing /dev/console as a symlink made crun create a root
owned file on the host at a path chosen by the container image, since
the devices are created before the pivot_root. (bsc#1279950)
* CVE-2026-88265: validate /dev/null before reopening the std streams.
A rootfs providing /dev/null as a symlink to a host file bind mounted
into the container made crun replace the pipe- or socketpair-based
std streams with a writable descriptor for that file, and chown it to
the container user. Refuse to continue unless /dev/null is the
character device 1:3, and only consider std streams that are
character devices themselves. (bsc#1279951)
* linux: skip OPEN_TREE_NAMESPACE when a bind source holds a pinned
namespace. A recursive clone of such a source picks one up, so the
bind mount cannot be attached from inside the namespace created by
OPEN_TREE_NAMESPACE, and by then there is no way to mount it at all.
* krun: use absolute path for passt binary.
* krun: support TAP-backed networking.
* krun: start render server if required.
* linux: convert sysctl keys to /proc/sys paths as described in
sysctl.d(5), fixing sysctls for interface names containing dots
(e.g. VLAN interfaces such as "eth0.100").
* criu: fix --network-lock, which did not take the method argument.
* criu: block signals as soon as the container is restored, so that
a signal arriving before crun starts forwarding them is delivered to
the container init instead of killing crun.
* criu: block signals across the vfork used for a detached restore, so
that a signal handler of a program embedding libcrun no longer runs
in the child and corrupts the state of the suspended caller.
* build: add --enable-werror and --enable-sanitizers configure options.
* release: add crun.keyring with the release signing keys
* linux: apply recursive propagation flags recursively. A 1.29
regression dropped MS_REC when mount_setattr() is available, so an
"rslave" mount only had its top level mount converted and a mount
created by the container under it propagated back to the host,
clobbering the devpts of the host for a container bind mounting /dev.
* linux: clear the flags which are not requested on a read-only
remount, so that a "bind,ro" mount of a nosuid,nodev,noexec source
only gets the requested flag, as it was before 1.27.
* linux: honor options which only clear flags (e.g. "dev", "suid",
"exec", "rw") for bind mounts instead of silently keeping the flags
of the source.
* linux: clear nosymfollow on remount unless it is requested.
* linux: set the atime flags the way mount(2) does, so that e.g. a
"bind,relatime" mount of a noatime source is no longer left with
noatime.
* linux: fix idmapped bind mounts with a relative source.
* linux: do not crash on a mount without a type. This is reproducible
with podman by running a container with a CDI device in a pod that
has a user namespace, as the mounts in a CDI specification usually
have no type.
* linux: do not crash on a mount without a source, or on a null entry
in maskedPaths or readonlyPaths; reject them with EINVAL.
* libcrun: cope with a JSON null where the configuration expects a
string, instead of dereferencing it.
* cgroup: refuse to run in a frozen cgroup, like runc does, instead of
hanging forever with no indication of what is going on.
* cgroup: destroy the cgroup if its setup fails, so that an invalid
resource limit no longer leaves an empty cgroup behind.
* cgroup: treat an empty cgroup path in the status file as no cgroup,
fixing "crun update" on a container started with
- -cgroup-manager=disabled.
* cgroup: handle a device entry with no "access" in the cgroup v1
writer, which wrote "c 1:3 (null)" to devices.allow.
* exec: use the systemd AttachProcessesToUnit method as a fallback when
writing to cgroup.procs is denied, fixing "crun exec" for a rootless
user in a login session when the container uses the systemd cgroup
manager.
* exec: use exit code 255 for "crun exec" failures, like runc does, so
that they can be told apart from the executed process exiting with 1.
* exec: use the same error as runc for a paused container.
* seccomp: apply all the argument conditions, removing the arbitrary
limit of 6 conditions.
* seccomp: validate the argument indices once per syscall entry, so an
out of range index is no longer accepted when every name of the entry
is unknown to libseccomp.
* seccomp: checksum every field that affects the generated filter, so a
cached filter is not reused for a different configuration.
* restore: forward signals to the container init on a foreground
restore, so that a ^C no longer kills crun and leaves the container
running.
* restore: use a throw-away process to drive a detached restore, so
that a program embedding libcrun is no longer moved in and out of the
container cgroup and left with the container init as a child.
* restore: put CRIU into the container cgroup, so that the restored
tasks are created there.
* restore: fix --manage-cgroups-mode, which was always overridden with
the default "soft" mode.
* restore: fix bind mounts with a relative source, and create the
missing mountpoints inside the bind mount sources.
* checkpoint: fix masked directories with a non-default --root.
* criu: only relocate the unified hierarchy on restore with cgroup v2,
so that named v1 hierarchies are no longer duplicated on every
checkpoint and restore.
* criu: fix stripping the rootfs prefix from the mount destination when
the rootfs is "/" or not set.
* container: report the bundle path consistently, and pass it to the
createRuntime and poststart hooks instead of the working directory of
crun.
* container: tell the hook type and its number when a hook fails.
* scheduler: reject a SCHED_DEADLINE value equal to 2^63.
* scheduler: fix the CPU affinity reset on systems with more than 1024
CPUs, and fix the CPU_ALLOC argument, which allocated a set about 8
times smaller than needed.
* ring_buffer: fix an off-by-one in the wrapped regions, which could
truncate or garble the pty output once the ring buffer wrapped and
was drained partially.
* intelrdt: fix a signed overflow in the schemata comparator, which
could misorder the qsort() and send the bsearch() down the wrong
branch.
* status: fix a NULL dereference on the optional "owner" and
"external_descriptors" fields, which crashed "crun list --format=json"
and the checkpoint path on a status file without them.
* utils: fall back to the uid_map heuristic to detect the initial user
namespace on OpenVZ, and on kernels without /proc/self/ns/user.
* utils: say that the AppArmor profile is not loaded instead of
reporting a confusing ENOENT on the procfs file.
* wamr: resolve the wasi socket pool functions via dlsym, fixing the
undefined references at link time.
* python, lua: fix the bindings, which were missing the "start" method,
had a duplicate "spec" entry and a broken context capsule destructor.
- Update to version 1.29.1:
* linux: do not clobber the mount root mode for proc, sysfs and mqueue.
A 1.29 regression copied the mountpoint directory mode onto the root
inode of freshly created typed mounts, breaking the /proc/<pid>/fd
magic-symlink path (e.g. rpm-ostree failing with "Operation not
supported") and a tmpfs /dev/shm created with mode=1777 ("could not
open shared memory segment: Permission denied").
* linux: fix read-only /sys regression in the userns sysfs fallback. A
spec asking for a read-only /sys silently got a writable one when the
container has a user namespace. It is not a security issue since the
user namespace has no write access to /sys anyway.
* linux: restore nosuid,noexec on precreated devices in a user namespace.
* linux: refresh the mount target after reopening it, fixing a
"set propagation: Invalid argument" failure of the mount(2) fallback
on kernels without mount_setattr() (< 5.12).
* linux: report the real reason when moving the masked directory mount
fails instead of always logging "unknown error".
* cgroup: always thaw the cgroup on error paths in kill and pid
migration, so a failed teardown can no longer leave the container
permanently frozen and unresponsive.
* cgroup: tolerate a cgroup removed concurrently while killing or
migrating its processes instead of failing the whole enumeration.
* utils: harden the AppArmor confined check so a short read, a profile
named like "unconfined_foo", or an interrupted read no longer
mis-report the process as unconfined.
* mempolicy: handle an empty memoryPolicy.nodes string, avoiding an
undefined memcpy() from a NULL pointer.
- Update to version 1.29:
* linux: use the new mount API for more mount operations.
* linux: use OPEN_TREE_NAMESPACE when possible. It improves container
startup performance.
* linux: use a trusted /proc file descriptor for more operations to
harden accesses under /proc.
* linux: reject invalid capabilities in config.json.
* utils: detect the initial user namespace by the inode of
/proc/self/ns/user instead of the uid_map layout, so an identity
uid_map created by systemd 260 is no longer mistaken for the initial
user namespace.
* utils: honor O_NOFOLLOW in the safe_openat fallback used on kernels
without openat2(2), so a "dest-nofollow" bind mount whose destination
is a symlink is created on the symlink itself.
* cgroup: reject a sub-cgroup that escapes the container cgroup.
* status: check the unlinkat result when removing the state directory.
* status: fix double-close.
* hooks: restore the JSON configuration passed to OCI hooks to the
formatting used with YAJL (slashes not escaped, not prettified),
avoiding breakages introduced by the switch to json-c.
* krun: require the virgl render server only when GPU support is
requested.
* krun: passt, do not map the gateway address.
* Mon Jul 06 2026 Bharti Gautam <bharti.gautam@suse.com>
- Add crun-krun subpackage with libkrun support (bsc#1255648)
- Move libkrun1 dependency from main package to crun-krun subpackage
- crun-krun provides a /usr/bin/krun symlink to usr/bin/crun
* Fri Jun 12 2026 Dario Faggioli <dfaggioli@suse.com>
- Update to version 1.28:
* NEWS: tag 1.28
* Do not follow rootfs /dev symlinks (bsc#1268302, CVE-2026-47766)
* krun: request enabling DHCP client
* krun: check krun_add_net_unixstream dlsym
* tests: add libzstd-devel to fuzzing Dockerfile
* tests, system-blake3: drop libyajl-dev
* Mon May 04 2026 Madhankumar Chellamuthu <madhankumar.chellamuthu@suse.com>
- update to 1.27.1:
* linux: fix bind mount propagation regression. Mounts hot-plugged
after container start (e.g. USB drives) were invisible or owned
by nobody inside the container because propagation peer groups
were destroyed.
* utils: fix AppArmor profile inside a user namespace.
* cgroup: fix recursive cgroup cleanup failure that could cause
EBADF errors when deleting containers with sub-cgroups.
* libcrun: do not check the cgroup file system type when cgroups are
disabled with --cgroup-manager=disabled, fixing startup failures on
systems where /sys/fs/cgroup is not a standard mount
(e.g. Android with Linux Deploy).
* libcrun: fix "unlink /dev/console: Read-only file system" error when
running containers with --read-only.
* krun: add support for passt-based networking in microVMs via the
krun.use_passt annotation.
* krun: ignore RAM configurations below 128MB.
* Fri Apr 10 2026 Dario Faggioli <dfaggioli@suse.com>
- update to 1.27
* CVE-2026-30892: fix parsing in crun exec -u that could lead to the process
running with the wrong user. (bsc#1260608)
* linux: use open_tree+mount_setattr and open_tree+move_mount for device
mounts, masked paths, and readonly paths.
* linux: use mount_setattr for readonly remounts in finalize_mounts.
* linux: skip redundant MS_PRIVATE propagation mounts.
* linux: validate run.oci.mount_context_type annotation value.
* container: skip sigaction reset in unblock_signals for the run path.
* container: delete the container on poststart hooks failures.
* container: fix createRuntime hooks not receiving bundle path.
* container: fix exit code return.
* cgroup: skip enable_controllers when joined via CLONE_INTO_CGROUP.
* cgroup: pass cgroup2 mount options to the kernel.
* cgroup: fix read_pids_cgroup skipping child cgroups.
* hooks: allow ignoring chdir permission errors for container hooks.
* hooks: exit immediately if poststart hooks fail.
* krun: parse annotations for krun.cpus, krun.ram_mib, and krun.variant.
* krun: propagate crun log level to libkrun.
* krun: rename nitro module to awsnitro.
* criu: show excerpt from log file on checkpoint/restore error.
* criu: fix missing umount() in error path.
* scheduler: add diagnostic messages for SCHED_DEADLINE.
* utils: fix memory leak and missing cache in libcrun_initialize_apparmor().
* utils: use parent dir fd for bind on long socket paths.
* utils: retry fgetpwent_r() on EINTR.
* python: initialize error variable to NULL in Python bindings.
* container: fix CPU busy loop when output pipe is blocked.
* seccomp: fix n_plugins calculation.
* restore: fix memory leak.
* numerous fixes for error handling, errno usage, and resource leaks.
* Sat Jan 17 2026 Andrea Manzini <andrea.manzini@suse.com>
- update to 1.26:
* criu: enable setting of RPC config file via annotation org.criu.config
crun also reads /etc/criu/crun.conf or /etc/criu/runc.conf for CRIU
configuration.
* linux: run createContainer hooks before making root read-only
* utils: handle NULL container passed to libcrun_open_proc_file()
* container: fix error release on failure paths.
- update to 1.25.1:
* linux: harden opens under /proc. Use fsopen, when available, to get
a trusted reference to the proc file system and use it for all subsequent
accesses instead of relying on the /proc path directly
- update to 1.25:
* cgroup: enable all accounting properties to ensure stats are readable
* intelrdt: honor default closID
* src: fix some double allocations on errors
* Thu Sep 11 2025 Dirk Müller <dmueller@suse.com>
- update to 1.24:
* linux: add support for NUMA set_mempolicy.
* intelrdt: add support for EnableMonitoring
* linux: optimize masked paths with shared empty directory.
* cgroup, systemd: validate the specified ebpf program is
loaded by systemd.
* krun: avoid failing if sev/nitro are not available.
* linux: limit tmpfs memory usage for masked paths.
* linux: fix regression mounting within userns. Detect when
running inside a user namespace and treat the mounts in the
same way as they would be treated with a new user namespace.
* linux: never chown devices.
* Thu Aug 21 2025 Madhankumar Chellamuthu <madhankumar.chellamuthu@suse.com>
- Update to 1.23.1
* krun: enable virtio-gpu. Enable and configure a virtio-gpu device if /dev/dri and /usr/libexec/virgl_render_server are present within the container.
* krun: add support for nitro enclaves.
* criu: Add support for tcp-close.
* linux: fix issue when RestrictAddressFamilies="AF_UNIX AF_NETLINK" is in place in the systemd unit. Regression introduced in crun 1.17.
* cgroup,systemd: use BPFProgram=device on systemd to install the device controller eBPF.
* cgroup,systemd: allow empty slice in cgroupsPath.
* crun: print the program version even with an invalid rundir.
* linux: fix regression with idmapped mounts. Support idmapped mounts also when there is no user namespace specified for the container. crun 1.22 introduced the regression.
* cgroup: change formula to convert from cpu shares to cpu weight. The OCI CPU shares (range [2-262144]) to cgroup v2 cpu.weight (range [1-10000]) conversion formula has been updated to use a quadratic function so that min, max and default values match.
* exec: fix a bug where the terminal could lose some bytes when reading from the exec'ed process.
* utils: add bounds checking for Unix domain socket paths.
* Tue Jul 01 2025 Madhankumar Chellamuthu <madhankumar.chellamuthu@suse.com>
- Update to 1.22
* crun: add a new command crun mounts to dynamically add or remove mounts from a running container.
* linux: add support for moving existing network devices into the container namespace as defined in the OCI specification.
* linux: add src-nofollow and dest-nofollow mount options for more precise control over how symbolic links are handled.
* krun: implement support for external kernels, allowing users to bundle a kernel image with the container.
* krun: the vCPU limit has been increased to 16.
* krun: add support for specifying the libkrun flavor via the KRUN_VM_FILE.
* criu: fix checkpoint and restore for containers that have a bind mount where the destination is a symbolic link.
* criu: automatically create the directory specified by --work-path if it does not exist, improving compatibility with other runtimes.
* criu: re-enable support on the riscv64 architecture.
* cgroup: fix incorrect setting of cpu.max when the OCI quota is -1.
* hardening: replace all uses of the insecure sprintf function with safer alternatives like snprintf to prevent buffer overflows.
* fix a regression that caused issues when dealing with paths that do not exist and openat2 is not available.
* fix an issue where the file descriptor for the rootfs would become stale if the rootfs was replaced by a mount.
* fix parsing of rootless options.
* fix a potential crash in krun by checking if library handles exist before being unloaded.
* improve error messages for dlopen failures, making them more descriptive.
* cgroup: fix a regression on WSL when running with cgroup v1.
* libcrun: setup /dev/console as a symlink to pty instead of bind mount when possible.
* Tue Apr 01 2025 Dan Čermák <dcermak@suse.com>
- New upstream release 1.21
* criu: when running under systemd, use a proxy process to initialize the cgroup so that all the container processes are restored in the correct cgroup.
* set HOME to "/" if the specified user is not present in the /etc/passwd file.
* do not fail if any of stdin/stdout/stderr is closed.
* cgroup: fix handling of absent subcgroup when configuring cpuset on cgroup v1.
* ignore SIGWINCH when a tty is not used.
* utils: improve error message if the specified command is not executable.
* fix PATH lookup. Support filenames starting with a dot.
* krun: create context after loading the library.
* krun: stop using krun_set_exec but use the command line directly from the OCI configuration file.
* Tue Feb 11 2025 Madhankumar Chellamuthu <madhankumar.chellamuthu@suse.com>
- Update to 1.20
* krun: fix CVE-2025-24965. The .krun_config.json file could be created outside of the container rootfs.
* cgroup: reverted the removal of tun/tap from the default allow list, this was done in crun-1.5. The tun/tap device is now added by default again.
* CRIU: do not set network_lock unless explicitly specified.
* status: disallow container names containing slashes in their name.
* linux: Improved error message when failing to set the net.ipv4.ping_group_range sysctl.
* scheduler: Ignore ENOSYS errors when resetting the CPU affinity mask.
* linux: return a better error message when pidfd_open fails with EINVAL.
* cgroup: display the absolute path to cgroup.controllers when a controller is unavailable.
* exec: always call setsid. Now processes created through exec get the correct process group id.
* Tue Jan 07 2025 Madhankumar Chellamuthu <madhankumar.chellamuthu@suse.com>
- Update to 1.19.1
* linux: fix a hang if there are no reads from the tty. Use non blocking sockets to read and write from the tty so that the "crun exec" process doesn't hang when the terminal is not consuming any data.
* linux: remove the workaround needed to mount a cgroup on top of another cgroup mount. The workaround had the disadvantage to temporarily leak a mount on the host. The alternative that is currently used is to mount a temporary tmpfs between the twoo cgroup mounts.
- Update to 1.19
* wasm: add new handler wamr.
* criu: allow passing network lock method to libcriu.
* linux: honor exec cpu affinity mask.
* build: fix build with musl libc.
* crun: use mount API to self-clone.
* cgroup, systemd: do not override devices on update. If the "update" request has no device block configured, do not reset the previously configuration.
* cgroup: handle case where cgroup v1 freezer is disabled. On systems without the freezer controller, containers were mistakenly reported as paused.
* cgroup: do not stop process on exec. The cpu mask is configured on the systemd scope, the previous workaround to stop the container until the cgroup is fully configured is no longer needed.
* Tue Dec 10 2024 Aleksa Sarai <asarai@suse.com>
- Update crun.keyring to point to primary key. The original packaging of
crun.keyring used the subkey 0xAF60FCA3CDAA6DEAD157EA3A67E38F7A8BA21772 as
the key to verify against, rather than the primary key
0xAC404C1C0BF735C63FF4D562263D6DF2E163E1EA. If/when upstream rotates their
signing keys, the old key verification would start to fail.
* Tue Nov 05 2024 Madhankumar Chellamuthu <madhankumar.chellamuthu@suse.com>
- Update to crun v1.18.2 Upstream changelog is available from
<https://github.com/containers/crun/releases/tag/1.18.2>
* Mon Oct 28 2024 Aleksa Sarai <asarai@suse.com>
- Update to crun v1.18. Upstream changelog is available from
<https://github.com/containers/crun/releases/tag/1.18>
- Remove URL from crun.keyring source declaration. If the Ubuntu keyservers
update their server software or some other minor change causes the output of
the key to change (such as the maintainer updating their key expiry), we will
end up with build failures despite the key still being a totally valid key to
do verifications with. This also matches how keyring files are managed for
most packages.
* Wed Sep 11 2024 Richard Rahl <rrahl0@opensuse.org>
- update to 1.17:
* Add --log-level option. It accepts error, warning and error.
* Add debug logs for container creation.
* Fix double-free in crun exec code that could lead to a crash.
* Allow passing an ID to the journald log driver.
* Report "executable not found" errors after tty has been setup.
* Do not treat EPIPE from hooks as an error.
* Make sure DefaultDependencies is correctly set in the systemd scope.
* Improve the error message when the container process is not found.
* Improve error handling for the mnt namespace restoration.
* Fix error handling for getpwuid_r, recvfrom and libcrun_kill_linux.
* Fix handling of device paths with trailing slashes.
- add url for keyring
- enable leap by disabling wasmedge (not packaged for leap)
* Thu Sep 05 2024 Dan Čermák <dcermak@suse.com>
- new upstream release 1.16.1
1.16.1:
- fix a regression introduced by 1.16 where using 'rshared' rootfs mount propagation and the rootfs itself is a mountpoint.
- inherit user from original process on exec, if not overridden.
1.16:
- build: fix build for s390x.
- linux: fix mount of special files with rro. Open the mount target with O_PATH to prevent open(2) failures with special files like FIFOs or UNIX sockets.
- Fix sd-bus error handling for cpu quota and period props update.
- container: use relative path for rootfs if possible. If the rootfs cannot be resolved and it is below the current working directory, only use its relative path.
- wasmedge: access container environment variables for the WasmEdge configuration.
- cgroup, systemd: use MemoryMax instead of MemoryLimit. Fixes a warning for using an old configuration name.
- cgroup, systemd: improve checks for sd_bus_message_append errors
* Thu May 30 2024 Dario Faggioli <dfaggioli@suse.com>
- New upstream release 1.15
* fix a mount point leak under /run/crun, add a retry mechanism to unmount the directory if the removal failed with EBUSY.
* linux: cgroups: fix potential mount leak when /sys/fs/cgroup is already mounted, causing the posthooks to not run.
* release: build s390x binaries using musl libc.
* features: add support for potentiallyUnsafeConfigAnnotations.
* handlers: add option to load wasi-nn plugin for wasmedge.
* linux: fix "harden chdir()" security measure. The previous check was not correct.
* crun: add option --keep to the run command. When specified the container is not automatically deleted when it exits.
* Wed Mar 06 2024 Dan Čermák <dcermak@suse.com>
- New upstream release 1.14.4
* crun-1.14.4
- linux: fix mount of file with recursive flags. Do not assume it is
a directory, but check the source type.
* crun-1.14.3
- follow up for 1.14.2. Drop the version check for each command.
* crun-1.14.2
- crun: drop check for OCI version. A recent bump in the OCI runtime
specs caused crun to fail with every config file. Just drop the
check since it doesn't add any value.
* crun-1.14.1
- there was recently a security vulnerability (CVE-2024-21626) in runc
that allowed a malicious user to chdir(2) to a /proc/*/fd entry that is
outside the container rootfs. While crun is not affected directly,
harden chdir by validating that we are still inside the container
rootfs.
- container: attempt to close all the files before execv(2).
if we leak any fd, it prevents execv to gain access to files outside
the container rootfs through /proc/self/fd/$fd.
- fix a regression caused by 1.14 when installing the ebpf filter on a
kernel older than 5.11.
- cgroup, systemd: fix segfault if the resources block is not specified.
* Sat Jan 27 2024 Andrea Manzini <andrea.manzini@suse.com>
- update to 1.14:
* build: drop dependency on libgcrypt. Use blake3 to compute the cache key.
* cpuset: don't clobber parent cgroup value when writing the cpuset value.
* linux: force umask(0). It ensures that the mknodat syscall is not affected by the umask of the calling process,
allowing file permissions to be set as specified in the OCI configuration.
* ebpf: do not require MEMLOCK for eBPF programs. This requirement was relaxed in Linux 5.11.
- update to 1.13:
* src: use O_CLOEXEC for all open/openat calls
* cgroup v1: use "max" when pids limit < 0.
* improve error message when idmap mount fails because the underlying file system has no support for it.
* libcrun: fix compilation when building without libseccomp and libcap.
* fix relative idmapped mount when using the custom annotation.
* Fri Dec 01 2023 Dan Čermák <dcermak@suse.com>
- New upstream release 1.12:
* add new WebAssembly handler: spin.
* systemd: fallback to system bus if session bus is not available.
* configure the cpu rt and cpuset controllers before joining them to
avoid running temporarily the workload on the wrong cpus.
* preconfigure the cpuset with required resources instead of using the
parent's set. This prevents needless churn in the kernel as it
tracks which CPUs have load balancing disabled.
* try attr/<lsm>/* before the attr/* files. Writes to the attr/*
files may fail if apparmor is not the first "major" LSM in the list
of loaded LSMs (e.g. lsm=apparmor,bpf vs lsm=bpf,apparmor).
- New upstream release 1.11.2:
* fix a regression caused by 1.11.1 where the process crashes if there
are no CPU limits configured on cgroup v1. (bsc#1217590)
* fix error code check for the ptsname_r function.
* Mon Nov 06 2023 Dirk Müller <dmueller@suse.com>
- update to 1.11.1:
* force a remount operation with bind mounts from the host to
correctly set all the mount flags.
* cgroup: honor cpu burst.
* systemd: set CPUQuota and CPUPeriod on the scope cgroup.
* linux: append tmpfs mode if missing for mounts. This is the
same behavior of runc.
* cgroup: always use the user session for rootless.
* support for Intel Resource Director Technology (RDT).
* new mount option "copy-symlink". When provided for a mount,
if the source is a symlink, then it is copied in the container
instead of attempting a mount.
* linux: open mounts before setgroups if in a userns. This
solves a problem where a directory that was previously
accessible to the user, become inaccessible after setgroups
causing the bind mount to fail.
* Thu Oct 12 2023 Dan Čermák <dcermak@suse.com>
- New upstream release 1.9.2:
* cgroup: reset the inherited cpu affinity after moving to cgroup. Old kernels
do that automatically, but new kernels remember the affinity that was set
before the cgroup move, so we need to reset it in order to honor the cpuset
configuration.
- New upstream release 1.9.1:
* utils: ignore ENOTSUP when chmod a symlink. It fixes a problem on Linux 6.6
that always refuses chmod on a symlink.
* build: fix build on CentOS 7
* linux: add new fallback when mount fails with EBUSY, so that there is not an
additional tmpfs mount if not needed.
* utils: improve error message when a directory cannot be created as a
component of the path is already existing as a non directory.
- Only build with wasmedge on x86_64 & aarch64
* Wed Oct 11 2023 Alexandre Vicenzi <alexandre.vicenzi@suse.com>
- Add crun-wasm symlink for platform 'wasi/wasm'
* Wed Sep 13 2023 Danish Prakash <danish.prakash@suse.com>
- Update to 1.9:
* linux: support arbitrary idmapped mounts.
* linux: add support for "ridmap" mount option to support recursive
idmapped mounts.
* crun delete: call systemd's reset-failed.
* linux: fix check for oom_score_adj.
* features: Support mountExtensions.
* linux: correctly handle unknown signal string when it doesn't start with
a digit.
* linux: do not attempt to join again already joined namespace.
* wasmer: use latest wasix API.
* Tue Sep 05 2023 Alexandre Vicenzi <alexandre.vicenzi@suse.com>
- Enable WasmEdge support to run Wasm compat containers.
* Mon Aug 14 2023 Danish Prakash <danish.prakash@suse.com>
- Update to 1.8.6:
* crun: new command "crun features".
* linux: fix handling of idmapped mounts when the container joins an
existing PID namespace.
* linux: support io_priority from the OCI specs.
* linux: handle correctly the case where the status file is not written
yet for a container.
* crun: fix segfault for "ps" when the container is not using cgroups.
* cgroup: allow setting swap to 0.
* Wed Jun 14 2023 Frederic Crozat <fcrozat@suse.com>
- Update to 1.8.5:
* scheduler: use definition from the OCI configuration file
instead of the custom label that is now dropped and not
supported anymore.
* cgroup: fix creating cgroup under "domain threaded".
* cgroup, systemd: set the memory limit on the system scope.
* restore tty settings from the correct file descriptor. It was
previously restoring the settings from the wrong file
descriptor causing the tty settings to be changed on the
calling terminal.
* criu: check if the criu_join_ns_add function exists.
Fix a segfault with new versions of CRIU.
* linux: do not precreate devs with euid > 0. Fix creating
devices when running the OCI runtime as non root user.
* linux: improve PID detection on systems that lack pidfd.
While there is still a window of time that the PID could be
recycled, now it is now reduced to a minimum.
* criu: fix memory leak.
* logging: improve error message when dlopen fails.
- Changes from 1.8.4:
* drop custom annotation to set the time namespace and use
the OCI specs instead.
* cgroup: workaround cpu quota/period issue with v1. Sometimes
setting CPU quota period fails when a new period is lower,
and a parent cgroup has CPU quota limit set.
* cgroup: fix set quota to -1 on cgroup v1.
* criu: drop loading unused functions.
* Tue Mar 28 2023 Dirk Müller <dmueller@suse.com>
- update to 1.8.3:
* update: initialize the rt limits only on cgroup v1.
* lua bindings for libcrun.
* wasmedge: add current directory to preopen paths.
* linux: inherit parent mount flags when making a path masked.
* libcrun: custom annotation to set the scheduler for the
container process.
* cgroup: fallback to blkio.bfq files if blkio is not available
on cgroup v1.
* cgroup: initialize rt limits when using systemd.
* tty: chown the tty to the exec user instead of the user
specified to create the container.
* cgroup: fallback to create cgroupfs as sibling of the current
cgroup if there is none specified and it cannot be created in
the root cgroup.
- add keyring for GPG validation
* Tue Feb 28 2023 Niels Abspoel <aboe76@gmail.com>
- Update to 1.8.1
* linux: idmapped mounts expect the same configuration as
the user namespace mappings. Before they were expecting the inverted
mapping. It is a breaking change, but the behavior was aligned
to what runc will do as well.
* krun: always allow /dev/kvm in the cgroup configuration.
* handlers: disable exec for handlers that do not support it.
* selinux: allow setting fscontext using a custom annotation.
* cgroup: reset systemd unit if start fails.
* cgroup: rmdir the entire systemd scope. It fixes a leak on cgroupv1.
* cgroup: always delete the cgroup on errors.
On some errors it could have been leaked before.
- changes from 1.8
* linux: precreate devices on the host.
* cgroup: support cpuset mounted with noprefix.
* linux: mount the source cgroup if cgroupns=host.
* libcrun: don't clone self from read-only mount.
* build: fix build without dlfcn.h.
* linux: set PR_SET_DUMPABLE.
* utils: fix applying AppArmor profile.
* linux: write setgroups=deny when mapping a single uid/gid.
* cgroup: fix enter cgroupv1 mount on RHEL 7.
/usr/bin/crun /usr/share/doc/packages/crun /usr/share/doc/packages/crun/README.md /usr/share/doc/packages/crun/SECURITY.md /usr/share/licenses/crun /usr/share/licenses/crun/COPYING /usr/share/man/man1/crun.1.gz
Generated by rpm2html 1.8.1
Fabrice Bellet, Wed Oct 21 00:39:05 2026