Skip to content

Commit 06f3ae5

Browse files
krnowakkrnowak
authored
Merge pull request #3472 from flatcar/krnowak/main-runc-containerd
Bump runc to 1.3.3 and containerd to 2.1.5 in main
2 parents 6923d75 + d50f08e commit 06f3ae5

File tree

7 files changed

+243
-1
lines changed

7 files changed

+243
-1
lines changed

‎changelog/security/2025-11-07-runc-containerd.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
- containerd ([CVE-2024-25621](https://www.cve.org/CVERecord?id=CVE-2024-25621), [CVE-2025-64329](https://www.cve.org/CVERecord?id=CVE-2025-64329))
2+
- runc ([CVE-2025-31133](https://www.cve.org/CVERecord?id=CVE-2025-31133), [CVE-2025-52565](https://www.cve.org/CVERecord?id=CVE-2025-52565), [CVE-2025-52881](https://www.cve.org/CVERecord?id=CVE-2025-52881))

‎changelog/updates/2025-11-07-runc-containerd.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
- runc ([1.3.3](https://github.com/opencontainers/runc/releases/tag/v1.3.3) (includes [1.3.2](https://github.com/opencontainers/runc/releases/tag/v1.3.2)))
2+
- containerd ([2.1.5](https://github.com/containerd/containerd/releases/tag/v2.1.5))

‎sdk_container/src/third_party/portage-stable/app-containers/containerd/Manifest‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,4 +4,4 @@ DIST containerd-2.0.4.tar.gz 10450939 BLAKE2B f82ed40eab0f1d186f4fb04217b8f75a9d
44
DIST containerd-2.0.5.tar.gz 10452563 BLAKE2B bf03316c9211eaa17a3b40b1fc9f9aca42fe3e621e086e612eb07c286c6b62bc7a0a2426ce7b6742dce2924d570ab599aefb43463c4fa6be277e562bad79668f SHA512 af89a5c9ad5f931c5fee33c75c13c296fc9ec966f2c64ec244897695eebb365bcb542f6b431e60d4ef7213f0ea11d3a8896d1b7f033ed445e6b521b7ddbffe6f
55
DIST containerd-2.1.0.tar.gz 10610618 BLAKE2B 147c21b4650543af9b0e533e381a0505ba927d6e9270b9b03a09016eb3ccf29875db7fa274944fea2ff7b029b6a05a17d14c61e24b5f3426b31f320831eeb46a SHA512 e9bb128917bb6b2e21a8e05344af3fdcdda8620be20e54407bc2c73046278a88a77bcbed6ef7a59099c9ee3303283db46b90b71afdd45236d3c534749ba844e0
66
DIST containerd-2.1.1.tar.gz 10610787 BLAKE2B acc2d769752c783643795d228c0d267b0802e09166dc783e84087da0029a822a64688f5e59c047c47b25f50ca2a1ccb7f5b6216ad6beeb4489df308e525e9716 SHA512 542f7cae61e1ef2e1b529b0bea66d7ad9016d4605de73de9c9c8a738e50ec6f470b939d1546482320515b77424bffe1cf24b721173ac0c0ecd0100c92817cfb1
7-
DIST containerd-2.1.4.tar.gz 10614131 BLAKE2B b8f4007b4bb368a1fa04c913d606f65d2ea4a17a6419ce12f2b6112eee2574d7a09fb8e2500d1c2f21bef8792dc047df4d63446211ae006662e616facda91f24 SHA512 a9f84784e917621ee5ea38ad20b8106e642fbf463a00d319b73a1a8e4d1fdd5be2fba0789b6a5d31107ef239d3713eced99ce979d4b2764714271a63c0936c15
7+
DIST containerd-2.1.5.tar.gz 10622156 BLAKE2B b612e9606554d492f59d4665dcbd85b0fdfa3316ecff3a2122357f8d8ef68991a2b77c367e3a7143efb768e9a78ee82ace9ffdc0832a9eb4ec37e98b0f827840 SHA512 6376228edf615b1ff3d40287622d4f72793be091d59d5d7e97f7bdc4f265aa4412f4a5dd1937ef795e54aa5ee8a87d785e859d7c6525a25fa86631b878cefc59

‎sdk_container/src/third_party/portage-stable/app-containers/containerd/containerd-2.1.5.ebuild‎

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
# Copyright 2022-2025 Gentoo Authors
2+
# Distributed under the terms of the GNU General Public License v2
3+
4+
EAPI=8
5+
inherit go-env go-module systemd toolchain-funcs
6+
GIT_REVISION=fcd43222d6b07379a4be9786bda52438f0dd16a1
7+
8+
DESCRIPTION="A daemon to control runC"
9+
HOMEPAGE="https://containerd.io/"
10+
SRC_URI="https://github.com/containerd/containerd/archive/v${PV}.tar.gz -> ${P}.tar.gz"
11+
12+
LICENSE="Apache-2.0"
13+
SLOT="0"
14+
KEYWORDS="~amd64 ~arm ~arm64 ~ppc64 ~riscv ~x86"
15+
IUSE="apparmor btrfs device-mapper +cri hardened +seccomp selinux test"
16+
17+
COMMON_DEPEND="
18+
btrfs? ( sys-fs/btrfs-progs )
19+
seccomp? ( sys-libs/libseccomp )
20+
"
21+
22+
DEPEND="
23+
${COMMON_DEPEND}
24+
"
25+
26+
# recommended minimum version of runc is found in script/setup/runc-version
27+
RDEPEND="
28+
${COMMON_DEPEND}
29+
>=app-containers/runc-1.3.3[apparmor?,seccomp?]
30+
"
31+
32+
BDEPEND="
33+
dev-go/go-md2man
34+
virtual/pkgconfig
35+
"
36+
37+
# tests require root or docker
38+
RESTRICT+="test"
39+
40+
src_prepare() {
41+
default
42+
sed -i \
43+
-e "s/-s -w//" \
44+
Makefile || die
45+
sed -i \
46+
-e "s:/usr/local:/usr:" \
47+
containerd.service || die
48+
}
49+
50+
src_compile() {
51+
local options=(
52+
$(usev apparmor)
53+
$(usex btrfs "" "no_btrfs")
54+
$(usex cri "" "no_cri")
55+
$(usex device-mapper "" "no_devmapper")
56+
$(usev seccomp)
57+
$(usev selinux)
58+
)
59+
60+
myemakeargs=(
61+
BUILDTAGS="${options[*]}"
62+
LDFLAGS="$(usex hardened '-extldflags -fno-PIC' '')"
63+
REVISION="${GIT_REVISION}"
64+
VERSION=v${PV}
65+
)
66+
67+
# The Go env is already set, but reset it for CBUILD in a subshell to allow
68+
# building the man pages when cross-compiling.
69+
(
70+
CHOST="${CBUILD}" go-env_set_compile_environment
71+
# race condition in man target https://bugs.gentoo.org/765100
72+
tc-env_build emake "${myemakeargs[@]}" man -j1 #nowarn
73+
)
74+
75+
emake "${myemakeargs[@]}" all
76+
77+
}
78+
79+
src_install() {
80+
rm bin/gen-manpages || die
81+
dobin bin/*
82+
doman man/*
83+
newconfd "${FILESDIR}"/${PN}.confd "${PN}"
84+
newinitd "${FILESDIR}"/${PN}.initd "${PN}"
85+
systemd_dounit containerd.service
86+
keepdir /var/lib/containerd
87+
88+
# we already installed manpages, remove markdown source
89+
# before installing docs directory
90+
rm -r docs/man || die
91+
92+
local DOCS=( ADOPTERS.md README.md RELEASES.md ROADMAP.md SCOPE.md docs/. )
93+
einstalldocs
94+
}

‎sdk_container/src/third_party/portage-stable/app-containers/runc/Manifest‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,7 @@
11
DIST runc-1.2.4.tar.gz 2759394 BLAKE2B 02b282c9fbe7f82ad1d4297b9d2576ee99db7f4db193aa6b08b595d1a18f4a0cb41c5fddb8184ca389e77726c71f4b64b686b2ee1b8e8df97179669362c17ff7 SHA512 2a14bfe7759e0cefcf88fac9d756eb2cbed8a9ebf7b6eacb96855467ea151c278ae0d58735d2a5a2d3335fc54eae4625dfcdb641065df58ba10fd1faafbd3119
22
DIST runc-1.2.5.tar.gz 2763738 BLAKE2B 446dd633d94f41957ba205b944320734ddf505e1bdc8f6f9d1002de8ecdd46368af19d788b8812cee87aaab1f8583d01e0c4d6fd0a56590a819588814bfb1841 SHA512 67dd870a24cfe896ead01f156eda6076b14bf287781734c2c4ab0e313d66f49bbf8d51705c5f0c24a604df311439c769a95cbfda12c7fa87ab2e6a31801a6984
33
DIST runc-1.2.6.tar.gz 2763135 BLAKE2B d5e40e95f8c0069073d0010d120aca1828e585b103ecd671fca072138ef3528a316414cfac5ca725f45cb84f23ab4216d9e6f466beb118fb2813ab4be3a18e92 SHA512 9a89295e001914726dfc1040729301f62ad6b630943c65f7ade6ed460ef4a2f5f35cf40662730a9e8a6c6d0301a3c9959a85973097ceb8db05c043f9c1a86248
4+
DIST runc-1.2.8.tar.gz 2834651 BLAKE2B 5f76e40ee8bda4668758dce318625af1dbb13c0d33a17c9c872bc68aefd6311cac570ed934a69b92b4a327c6084ff6d6d55f8914b105513f9484bbc903107a4d SHA512 8d29a2ca179320f9a01c37383506f10aea1764e18b3321c507787556e3a531e23221f8369696d8caaf30124a523a68d0ad3609bae5ab06aa6c519e644d54d4ef
45
DIST runc-1.3.0.tar.gz 2858199 BLAKE2B c9402a074b816b9452763267a7ffdc69af6c0cd4cf54fbdfdc91ccbd8bbc5daa783259176775e90f6266fa6a02bf0bad7fbb8eb879b5764309f7f9cd2f246086 SHA512 63422501f6189d0d47f6b2f59565de572bc68b138a65c7dbcc8b5ad42dbc37245ee66e2683ab61971a84c076a15f54f484c37fde4a30815ee19edc9a0d97e9f4
56
DIST runc-1.3.1.tar.gz 2860795 BLAKE2B 5711881488dc3d52182377dc09690436aff142552d35728b10c221874a1dafc3b1fe78972891ebfc53e232465aec97eacc78318a453b030c052ca2218c61438d SHA512 0a3007d046fe9711541e29ca07fd72515f19b220c8c79b9df9164f7b88a6b9077ba7a11607593b641823b9e99c0f2e96500a57e2a16e11501bbb7c4690870183
7+
DIST runc-1.3.3.tar.gz 2929410 BLAKE2B 1feddc154836eff606a685a0c0d606c1bbcd5a1a1ec8a288233581a88e0b3b6a95f446125688a8dca5efd5a275bf22931553cb9ab894f6aa0826d5a1274b6f91 SHA512 9ce0af1b79163c44913979c0483322247b154109871a113726163f64c6354141e7cefb5fb6e1225eaa4bb48a1e33ba9a6049cb45cb2af8793134647dad18c8dc

‎sdk_container/src/third_party/portage-stable/app-containers/runc/runc-1.2.8.ebuild‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
# Copyright 1999-2025 Gentoo Authors
2+
# Distributed under the terms of the GNU General Public License v2
3+
4+
EAPI=8
5+
6+
inherit go-module linux-info
7+
8+
# update on bump, look for commit ID on release tag.
9+
# https://github.com/opencontainers/runc
10+
RUNC_COMMIT=eeb7e6024f9ee43876301b1d23c353384fa6dcdd
11+
12+
CONFIG_CHECK="~USER_NS"
13+
14+
DESCRIPTION="runc container cli tools"
15+
HOMEPAGE="https://github.com/opencontainers/runc/"
16+
MY_PV="${PV/_/-}"
17+
SRC_URI="https://github.com/opencontainers/${PN}/archive/v${MY_PV}.tar.gz -> ${P}.tar.gz"
18+
S="${WORKDIR}/${PN}-${MY_PV}"
19+
20+
LICENSE="Apache-2.0 BSD-2 BSD MIT"
21+
SLOT="0"
22+
KEYWORDS="~amd64 ~arm ~arm64 ~ppc64 ~riscv ~x86"
23+
IUSE="apparmor hardened +kmem +seccomp selinux test"
24+
25+
COMMON_DEPEND="
26+
apparmor? ( sys-libs/libapparmor )
27+
seccomp? ( sys-libs/libseccomp )"
28+
DEPEND="${COMMON_DEPEND}"
29+
RDEPEND="${COMMON_DEPEND}
30+
!app-emulation/docker-runc
31+
selinux? ( sec-policy/selinux-container )"
32+
BDEPEND="
33+
dev-go/go-md2man
34+
test? ( "${RDEPEND}" )"
35+
36+
# tests need busybox binary, and portage namespace
37+
# sandboxing disabled: mount-sandbox pid-sandbox ipc-sandbox
38+
# majority of tests pass
39+
RESTRICT+=" test"
40+
41+
src_compile() {
42+
# build up optional flags
43+
local options=(
44+
$(usev apparmor)
45+
$(usev seccomp)
46+
$(usex kmem '' 'nokmem')
47+
)
48+
49+
myemakeargs=(
50+
BUILDTAGS="${options[*]}"
51+
COMMIT="${RUNC_COMMIT}"
52+
)
53+
54+
emake "${myemakeargs[@]}" runc man
55+
}
56+
57+
src_install() {
58+
myemakeargs+=(
59+
PREFIX="${ED}/usr"
60+
BINDIR="${ED}/usr/bin"
61+
MANDIR="${ED}/usr/share/man"
62+
)
63+
emake "${myemakeargs[@]}" install install-man install-bash
64+
65+
local DOCS=( README.md PRINCIPLES.md docs/. )
66+
einstalldocs
67+
}
68+
69+
src_test() {
70+
emake "${myemakeargs[@]}" localunittest
71+
}

‎sdk_container/src/third_party/portage-stable/app-containers/runc/runc-1.3.3.ebuild‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
# Copyright 1999-2025 Gentoo Authors
2+
# Distributed under the terms of the GNU General Public License v2
3+
4+
EAPI=8
5+
6+
inherit go-module linux-info
7+
8+
# update on bump, look for commit ID on release tag.
9+
# https://github.com/opencontainers/runc
10+
RUNC_COMMIT=d842d7719497cc3b774fd71620278ac9e17710e0
11+
12+
CONFIG_CHECK="~USER_NS"
13+
14+
DESCRIPTION="runc container cli tools"
15+
HOMEPAGE="https://github.com/opencontainers/runc/"
16+
MY_PV="${PV/_/-}"
17+
SRC_URI="https://github.com/opencontainers/${PN}/archive/v${MY_PV}.tar.gz -> ${P}.tar.gz"
18+
S="${WORKDIR}/${PN}-${MY_PV}"
19+
20+
LICENSE="Apache-2.0 BSD-2 BSD MIT"
21+
SLOT="0"
22+
KEYWORDS="~amd64 ~arm ~arm64 ~ppc64 ~riscv ~x86"
23+
IUSE="apparmor hardened +kmem +seccomp selinux test"
24+
25+
COMMON_DEPEND="
26+
apparmor? ( sys-libs/libapparmor )
27+
seccomp? ( sys-libs/libseccomp )"
28+
DEPEND="${COMMON_DEPEND}"
29+
RDEPEND="${COMMON_DEPEND}
30+
!app-emulation/docker-runc
31+
selinux? ( sec-policy/selinux-container )"
32+
BDEPEND="
33+
dev-go/go-md2man
34+
test? ( "${RDEPEND}" )"
35+
36+
# tests need busybox binary, and portage namespace
37+
# sandboxing disabled: mount-sandbox pid-sandbox ipc-sandbox
38+
# majority of tests pass
39+
RESTRICT+=" test"
40+
41+
src_compile() {
42+
# build up optional flags
43+
local options=(
44+
$(usev apparmor)
45+
$(usev seccomp)
46+
$(usex kmem '' 'nokmem')
47+
)
48+
49+
myemakeargs=(
50+
BUILDTAGS="${options[*]}"
51+
COMMIT="${RUNC_COMMIT}"
52+
)
53+
54+
emake "${myemakeargs[@]}" runc man
55+
}
56+
57+
src_install() {
58+
myemakeargs+=(
59+
PREFIX="${ED}/usr"
60+
BINDIR="${ED}/usr/bin"
61+
MANDIR="${ED}/usr/share/man"
62+
)
63+
emake "${myemakeargs[@]}" install install-man install-bash
64+
65+
local DOCS=( README.md PRINCIPLES.md docs/. )
66+
einstalldocs
67+
}
68+
69+
src_test() {
70+
emake "${myemakeargs[@]}" localunittest
71+
}

0 commit comments

Comments
 (0)