Blockers for v1.2.0

[AkihiroSuda]

Blockers for rc.1 (#3963):

• libcontainer: dmz: fix "go get" builds #4101
• libcontainer: remove all mount logic from nsexec #3985
• configs: validate: add validation for bind-mount fsflags #3990
• runc-dmz: Inheritable capabilities are dropped when they previously weren't #4125
• Fix runc-dmz error printing #4172
• never send procError after the socket closed #4173

Blockers for GA:

• Tests broken in debian due to PR: rootfs: remove --no-mount-fallback and finally fix MS_REMOUNT #4093
• Release runtime-spec v1.1.1 v1.2.0 Release v1.2.0 runtime-spec#1242
• runc doesn't work with go1.22  #4233
• Revert "Set temporary single CPU affinity before cgroup cpuset transition" #4283 (comment)
• Verify compatibility with well-known downstreams
  • Dockerfile: update to runc v1.2.2 moby/moby#47666
    • Fix failing moby tests in CI Moby CI is failing due to stdio issue introduced in f2f16213 init: close internal fds before execve #4384
  • update runc (1.2.0) containerd/nerdctl#3153
    • [v1.2 regression] SCMP_ACT_NOTIFY rule for fcntl causes runc to hang, before connecting to the seccomp listener agent #4328
    • [v1.2 regression] [cgroup v1 + rootless] nerdctl run -d --name=bar --pid=container:foo ; nerdctl rm -f bar hangs #4394
  • containerd works fine, CI scripts need fixes
    • PR to fix containerd's CI scripts: CI fixes for upcoming runc 1.2.0 containerd/containerd#10449
    • cri-tools PR backported for v1.30.1: [release-1.30] userns: Skip tests if the host doesn't support idmap mounts kubernetes-sigs/cri-tools#1492
• Fd resue race causes runc init can't start due to a go stdlib bug #4294

Needs discussion (probably deferrable to v1.2.1 or v1.3.0):

• Issue joining cgroups cpuset with kernel scheduler task "random" distribution #3922

@opencontainers/runc-maintainers Feel free to edit this issue

[AkihiroSuda]

We don't have timeline for v1.2.0, but we should try to release v1.2.0 by the end of the year.

[kolyshkin]

Well, we have the 1.2.0 milestone (which I am trying comb through regularly), and everything that's in there is kind of a blocker for 1.2.0.

Feel free to modify milestones for any issues/PRs, but at the very least we have one more blocker:

• regression: can't kill and delete the container with shared(host) pid ns when the init process has dead #4047 (which I'm actively working one, hope to come to a closure this week)
  (and I guess @cyphar can add more)

[AkihiroSuda]

Well, we have the 1.2.0 milestone (which I am trying comb through regularly), and everything that's in there is kind of a blocker for 1.2.0.

Not everything.
At least this one can be postponed to v1.3 or later

• Add mon groups for resctrl. #2523

[kolyshkin]

Not everything.

Well, strictly speaking, everything that is under that milestone needs to either be included into 1.2.0, or be reassigned to a different milestone. Whis is why I said

Feel free to modify milestones for any issues/PRs

[cyphar]

I still think #3985 is needed for 1.2.0. There are several issues with mount propagation (not to mention the serious restriction of idmapped mounts) that are fixed with #3985. We also need #3990 if we want to make sure people scream at us during the -rc1 if it breaks something.

Other than those, I don't have any strong opinions on any remaining PRs.

[h-vetinari]

Blockers for GA: Release runtime-spec v1.1.1

Given that it took well over 3 years to get 1.1.0 finished (incl. half a year from rc1 to GA), is it really necessary (resp. judicious) to block runc 1.2 on a spec-release?

[AkihiroSuda]

Blockers for GA: Release runtime-spec v1.1.1

Given that it took well over 3 years to get 1.1.0 finished (incl. half a year from rc1 to GA), is it really necessary (resp. judicious) to block runc 1.2 on a spec-release?

Necessary, because we have been depending on its main branch:

• features: Expose idmap support #3993

[utam0k]

This task has been done 👍

Release runtime-spec v1.1.1 v1.2.0 opencontainers/runtime-spec#1242