Release 1.0.1

[kolyshkin]

We have seen a few small bugfixes and regressions that can and should be backported to release-1.0 branch. Once we have a few fixes, we need to make a release. This issue is a placeholder for fixes included into 1.0.1.

The PRs that needed to be backported to release-1.0 branch are marked with https://github.com/opencontainers/runc/labels/will-backport-to%2F1.0. The backport process is manual (I am using git cherry-pick -s -x), we want the original PR to be merged first, and then create a backport PR, which is to be subjected to the same review process as ones for the main branch.

The following info will be updated in place as we go along.

Backport PRs:

• [1.0] tests/int/no_pivot: fix for new kernels #3075
• [1.0] retry unix.EINTR for container init process #3074
• [1.0] libct/user: fix parsing long /etc/group lines #3079
• [1.0] Make cgroup freezer only care about current control group #3085
• [1.0] cgroupv2: ebpf: ignore inaccessible existing programs #3087
• [1.0] Don't freeze cgroup on update for systemd cgroup v2  #3092
• [1.0] cgroups: Set: fix freeze, avoid unnecessary freeze from systemd v1 #3093

Still need to be merged first:

• none

Candidates for backporting:

• none

Release notes draft:

This is a first stable release in 1.0 branch, fixing a few medium and high
priority issues with runc 1.0.0, including a few that affect Kubernetes
using runc libcontainer.

Bugfixes:
 - Fixed occasional runc exec/run failure ("interrupted system call") on an
   Azure volume. (#3074)
 - Fixed "unable to find groups ... token too long" error with /etc/group
   containing lines longer than 64K characters. (#3079)
 - cgroup/systemd/v1: fix leaving cgroup frozen after Set if a parent cgroup is
   frozen.  This is a regression in 1.0.0, not affecting runc itself but some
   of libcontainer users (e.g Kubernetes). (#3085)
 - cgroupv2: bpf: Ignore inaccessible existing programs in case of 
   permission error when handling replacement of existing bpf cgroup
   programs. This fixes a regression in 1.0.0, where some SELinux
   policies would block runc from being able to run entirely. (#3087)
 - cgroup/systemd/v2: don't freeze cgroup on Set. (#3092)
 - cgroup/systemd/v1: avoid unnecessary freeze on Set. (#3093)

[kolyshkin]

Hope to have a release this week, as this is a prerequisite to fixing kubernetes/kubernetes#102676 which is pretty nasty.

[cyphar]

Do you want me to prepare a release PR today, or is there anything else left to do?

[kolyshkin]

@cyphar I was pretty sure that is all that's needed to rectify the kubernetes situation until a few hours ago -- now I got some new info and am waiting for feedback from @odinuge on whether #3082 and #3067 are needed or not (for details, see kubernetes/kubernetes#102676 (comment) and earlier comments).

I am inclined to release 1.0.1 now and, if the above PRs (or anything else) need to be backported as well, release 1.0.2 a bit later.

[cyphar]

I only have minor comments on #3082 (mainly stylistic and a comment fixup), so we can probably merge that fairly quickly. And #3067 is something we can also reasonably backport to 1.0.1.

[kolyshkin]

OK, let's try that.

• [1.0] Don't freeze cgroup on update for systemd cgroup v2  #3092

[kolyshkin]

• [1.0] cgroups: Set: fix freeze, avoid unnecessary freeze from systemd v1 #3093

[kolyshkin]

@cyphar can you please cut a release (once #3093 is merged).

[cyphar]

Yup, I'll set up the release PR now. Thanks for writing the changelog for me. :D

[cyphar]

https://github.com/opencontainers/runc/releases/tag/v1.0.1