LoginSign Up
← Back to all sparks
R

runc

INFRA · APIS
Velocity5.0

CLI tool for spawning and running containers per the OCI specification

github.com/opencontainers/runc ↗

runc patches one restore bug across four release lines at once.

container runtimesecuritycheckpoint restorerelease candidatebreaking changessupport policy
◆Current state
runc shipped 1.5.3, 1.4.4, 1.3.7 and 1.6.0-rc.2 on the same day, all fixing CVE-2026-119101: a crafted image could make runc restore bind-mount any host directory into a restored container, read-write. Only people who checkpoint and later restore untrusted containers as root are exposed. The 1.6.0 candidate also changes how mount destinations that start with the rootfs path are read, following the runtime spec literally.
◆Where it's heading
The project now maintains four supported branches and backports security work to each one in lockstep, while 1.6.0 keeps trading quiet tolerance for strict spec behaviour: refused read-only configs in rc.1, literal mount paths in rc.2. Users relying on runc's old lenient handling will feel 1.6.0 more than any feature it adds.
◆Prediction
Expect 1.6.0 final after one more candidate, with 1.3.z ending since 1.3.7 is labelled the probable last patch.

◆Recent moves

  1. 2d ago

    CVE-2026-119101 fix for checkpoint/restore in the 1.5 line

    The current stable line gets the restore fix plus a stop to runc changing the host's mount propagation for containers without their own mount namespace. It is the update most production users should take now.

    View source ↗
  2. 2d ago

    Second 1.6.0 candidate: restore CVE fix, literal mount paths

    The second 1.6.0 candidate carries the same CVE fix and a breaking change: a mount destination starting with the rootfs path is no longer trimmed but used as written. It continues rc.1's pattern of refusing behaviour the spec never promised.

    View source ↗
  3. 2d ago

    1.4 line gets the restore CVE fix and cgroup v2 crash workaround

    The 1.4 branch receives the restore fix and the kernel-bug workaround that 1.5.2 shipped in September, so older deployments on cgroup v2 stop crashing at random. It shows the support windows set at 1.5.0 being honoured.

    View source ↗
  4. 2d ago

    Likely final 1.3 patch carries the restore CVE fix

    The 1.3 branch gets the same security fix in what the maintainers call probably its last release. Anyone still on 1.3 now has a clear signal to move up.

    View source ↗
  5. 1mo ago

    Release candidate lifts 1024-CPU limit, removes deprecated APIs

    The first 1.6.0 candidate lifts the 1024 CPU and NUMA node limit and refuses read-only configurations it cannot honour without a mount namespace. Most of the rest is cleanup of deprecated APIs and build changes.

    View source ↗
  6. 1mo ago

    Workaround for kernel bug that crashed runc on cgroup v2

    The second 1.5.z patch works around a kernel bug that wrote past a userspace structure and crashed runc at random on cgroup v2, and restores HOME for runc exec -p. Its cgroups library change also removed the call path affected by GO-2026-6238.

    View source ↗