oci

Nov 29, 2023 GO-2023-2412

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

Nov 16, 2023 GO-2023-2412

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

Oct 26, 2023 GO-2023-2412

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

Oct 9, 2023 GO-2023-2412

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

Sep 12, 2023 GO-2023-2412

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

Aug 25, 2023 GO-2023-2412

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

Aug 24, 2023 GO-2023-2412

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

Jul 27, 2023 GO-2023-2412

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

Jun 2, 2023 GO-2023-2412

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

May 10, 2023 GO-2023-2412

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

Mar 10, 2023 GO-2023-2412

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

Changes in this version

+ func WithoutRunMount(ctx context.Context, client Client, c *containers.Container, s *Spec) error — darwin/amd64, js/wasm, windows/amd64

type SpecOpts

+ func WithBlockIO(blockio *specs.LinuxBlockIO) SpecOpts

+ func WithCPUCFS(quota int64, period uint64) SpecOpts

+ func WithCPURT(runtime int64, period uint64) SpecOpts

+ func WithCPUs(cpus string) SpecOpts

+ func WithCPUsMems(mems string) SpecOpts

+ func WithDevices(devicePath, containerPath, permissions string) SpecOpts

+ func WithDomainname(name string) SpecOpts

+ func WithLinuxDeviceFollowSymlinks(path, permissions string) SpecOpts

+ func WithMemorySwap(swap int64) SpecOpts

+ func WithPidsLimit(limit int64) SpecOpts

+ func WithWindowNetworksAllowUnqualifiedDNSQuery() SpecOpts

+ func WithWindowsCPUCount(count uint64) SpecOpts

+ func WithWindowsCPUMaximum(max uint16) SpecOpts

+ func WithWindowsCPUShares(shares uint16) SpecOpts

+ func WithWindowsDevice(idType, id string) SpecOpts

+ func WithWindowsIgnoreFlushesDuringBoot() SpecOpts

+ func WithWindowsNetworkNamespace(ns string) SpecOpts

Nov 20, 2023 GO-2023-2412

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

Changes in this version

+ const ConfigFilename

type Spec

+ func ReadSpec(path string) (*Spec, error)

Sep 13, 2023 GO-2023-2412

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

Aug 14, 2023 GO-2023-2412

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

Jul 27, 2023 GO-2023-2412

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

May 5, 2023 GO-2023-2412

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

Changes in this version

type SpecOpts — windows/amd64

+ func WithProcessCommandLine(cmdLine string) SpecOpts

Mar 30, 2023 GO-2023-2412

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

Feb 27, 2023 GO-2023-2412

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

Feb 15, 2023 GO-2023-2412

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

Feb 10, 2023 GO-2023-1573 +2 more

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

Jan 28, 2023 GO-2023-1573 +2 more

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

Jan 5, 2023 GO-2023-1573 +2 more

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

Dec 19, 2022 GO-2023-1573 +2 more

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

Dec 15, 2022 GO-2023-1573 +2 more

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

Dec 7, 2022 GO-2023-1573 +2 more

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

Dec 6, 2022 GO-2022-1147 +3 more

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

Nov 14, 2022 GO-2022-1147 +3 more

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

Oct 24, 2022 GO-2022-1147 +3 more

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

Aug 8, 2022 GO-2022-1147 +3 more

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

Aug 4, 2022 GO-2022-1147 +3 more

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

Jun 6, 2022 GO-2022-1147 +3 more

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

Jun 3, 2022 GO-2022-0482 +4 more

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

May 3, 2022 GO-2022-0482 +4 more

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

Apr 25, 2022 GO-2022-0482 +4 more

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

Mar 24, 2022 GO-2022-0482 +4 more

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

Mar 2, 2022 GO-2022-0482 +5 more

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Feb 16, 2022 GO-2022-0344 +6 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Changes in this version

+ func DeviceFromPath(path string) (*specs.LinuxDevice, error)

type SpecOpts — darwin/amd64, js/wasm, windows/amd64

+ func WithCPUShares(shares uint64) SpecOpts

+ func WithRdt(closID, l3CacheSchema, memBwSchema string) SpecOpts

+ func WithWindowsNetworkNamespace(ns string) SpecOpts

Feb 10, 2022 GO-2023-2412

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

Feb 8, 2022 GO-2023-2412

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

Feb 3, 2022 GO-2023-2412

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

Jan 20, 2022 GO-2023-2412

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

Jan 12, 2022 GO-2023-2412

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

Jan 6, 2022 GO-2023-2412

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

Dec 14, 2021 GO-2023-2412

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

Nov 19, 2021 GO-2023-2412

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

Nov 11, 2021 GO-2023-2412

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

Oct 22, 2021 GO-2023-2412

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

Oct 11, 2021 GO-2023-2412

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

Feb 15, 2023 GO-2023-2412

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

Changes in this version

type SpecOpts

+ func WithAppendAdditionalGroups(groups ...string) SpecOpts

Jan 28, 2023 GO-2023-1573 +2 more

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

Dec 7, 2022 GO-2023-1573 +2 more

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

Dec 6, 2022 GO-2022-1147 +3 more

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

Oct 24, 2022 GO-2022-1147 +3 more

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

Jun 6, 2022 GO-2022-1147 +3 more

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

Jun 3, 2022 GO-2022-0482 +4 more

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

Mar 24, 2022 GO-2022-0482 +4 more

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

Mar 2, 2022 GO-2022-0482 +5 more

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Jan 5, 2022 GO-2022-0344 +6 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Nov 17, 2021 GO-2022-0278 +7 more

  GO-2022-0278: Unprivileged pod using `hostPath` can side-step active LSM when it is SELinux in github.com/containerd/containerd

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Oct 4, 2021 GO-2022-0278 +8 more

  GO-2022-0278: Unprivileged pod using `hostPath` can side-step active LSM when it is SELinux in github.com/containerd/containerd

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Sep 29, 2021 GO-2022-0278 +9 more

  GO-2022-0278: Unprivileged pod using `hostPath` can side-step active LSM when it is SELinux in github.com/containerd/containerd

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Jul 29, 2021 GO-2022-0278 +9 more

  GO-2022-0278: Unprivileged pod using `hostPath` can side-step active LSM when it is SELinux in github.com/containerd/containerd

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Jul 19, 2021 GO-2022-0278 +9 more

  GO-2022-0278: Unprivileged pod using `hostPath` can side-step active LSM when it is SELinux in github.com/containerd/containerd

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Jul 13, 2021 GO-2022-0278 +10 more

  GO-2022-0278: Unprivileged pod using `hostPath` can side-step active LSM when it is SELinux in github.com/containerd/containerd

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0921: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

May 19, 2021 GO-2022-0278 +10 more

  GO-2022-0278: Unprivileged pod using `hostPath` can side-step active LSM when it is SELinux in github.com/containerd/containerd

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0921: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

May 13, 2021 GO-2022-0278 +10 more

  GO-2022-0278: Unprivileged pod using `hostPath` can side-step active LSM when it is SELinux in github.com/containerd/containerd

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0921: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

May 3, 2021 GO-2022-0278 +10 more

  GO-2022-0278: Unprivileged pod using `hostPath` can side-step active LSM when it is SELinux in github.com/containerd/containerd

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0921: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Changes in this version

+ var ErrNoGroupsFound = errors.New("no groups found")

+ var ErrNoUsersFound = errors.New("no users found")

+ var WithAllCurrentCapabilities = func(ctx context.Context, client Client, c *containers.Container, s *Spec) error

+ var WithAllKnownCapabilities = func(ctx context.Context, client Client, c *containers.Container, s *Spec) error

+ func GIDFromPath(root string, filter func(user.Group) bool) (gid uint32, err error)

+ func HostDevices() ([]specs.LinuxDevice, error) — darwin/amd64, js/wasm, linux/amd64

+ func UserFromPath(root string, filter func(user.User) bool) (user.User, error)

+ func WithoutRunMount(ctx context.Context, client Client, c *containers.Container, s *Spec) error — linux/amd64

type SpecOpts

+ func WithDevices(devicePath, containerPath, permissions string) SpecOpts

+ func WithoutMounts(dests ...string) SpecOpts

Apr 26, 2021 GO-2022-0482 +5 more

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Apr 20, 2021 GO-2022-0482 +5 more

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Apr 13, 2021 GO-2022-0482 +5 more

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Apr 9, 2021 GO-2022-0482 +5 more

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Mar 16, 2021 GO-2022-0482 +5 more

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Mar 5, 2021 GO-2022-0482 +5 more

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Feb 26, 2021 GO-2022-0482 +5 more

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Feb 5, 2021 GO-2022-0482 +5 more

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Jan 21, 2021 GO-2022-0482 +5 more

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Mar 2, 2022 GO-2022-0482 +5 more

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Nov 17, 2021 GO-2022-0344 +6 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Oct 4, 2021 GO-2022-0344 +7 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Sep 29, 2021 GO-2022-0344 +8 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Jul 29, 2021 GO-2022-0344 +8 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Jul 19, 2021 GO-2022-0344 +8 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Jul 13, 2021 GO-2022-0344 +9 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0921: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

May 19, 2021 GO-2022-0344 +9 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0921: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

May 12, 2021 GO-2022-0344 +9 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0921: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Mar 5, 2021 GO-2022-0344 +9 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0921: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Nov 30, 2020 GO-2022-0344 +9 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0921: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Nov 26, 2020 GO-2022-0344 +10 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0784: containerd-shim API Exposed to Host Network Containers in github.com/containerd/containerd

  GO-2022-0921: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Sep 16, 2020 GO-2022-0344 +10 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0784: containerd-shim API Exposed to Host Network Containers in github.com/containerd/containerd

  GO-2022-0921: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Aug 17, 2020 GO-2022-0344 +10 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0784: containerd-shim API Exposed to Host Network Containers in github.com/containerd/containerd

  GO-2022-0921: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Changes in this version

+ func WithAllDevicesAllowed(_ context.Context, _ Client, _ *containers.Container, s *Spec) error

+ func WithHostDevices(_ context.Context, _ Client, _ *containers.Container, s *Spec) error

type SpecOpts — linux/amd64

+ func WithCPUCFS(quota int64, period uint64) SpecOpts

+ func WithCPUShares(shares uint64) SpecOpts

+ func WithCPUs(cpus string) SpecOpts

+ func WithCPUsMems(mems string) SpecOpts

+ func WithMemorySwap(swap int64) SpecOpts

+ func WithPidsLimit(limit int64) SpecOpts

Aug 11, 2020 GO-2022-0344 +9 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0921: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Aug 4, 2020 GO-2022-0344 +9 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0921: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Jul 13, 2020 GO-2022-0344 +9 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0921: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

May 28, 2020 GO-2022-0344 +9 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0921: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

May 14, 2020 GO-2022-0344 +9 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0921: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Mar 5, 2021 GO-2022-0344 +9 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0921: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Nov 30, 2020 GO-2022-0344 +9 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0921: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Nov 30, 2020 GO-2022-0344 +10 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0784: containerd-shim API Exposed to Host Network Containers in github.com/containerd/containerd

  GO-2022-0921: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Aug 4, 2020 GO-2022-0344 +10 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0784: containerd-shim API Exposed to Host Network Containers in github.com/containerd/containerd

  GO-2022-0921: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Jun 30, 2020 GO-2022-0344 +10 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0784: containerd-shim API Exposed to Host Network Containers in github.com/containerd/containerd

  GO-2022-0921: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Jun 26, 2020 GO-2022-0344 +10 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0784: containerd-shim API Exposed to Host Network Containers in github.com/containerd/containerd

  GO-2022-0921: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Apr 16, 2020 GO-2022-0344 +10 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0784: containerd-shim API Exposed to Host Network Containers in github.com/containerd/containerd

  GO-2022-0921: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Feb 7, 2020 GO-2022-0344 +10 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0784: containerd-shim API Exposed to Host Network Containers in github.com/containerd/containerd

  GO-2022-0921: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Dec 3, 2019 GO-2022-0344 +10 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0784: containerd-shim API Exposed to Host Network Containers in github.com/containerd/containerd

  GO-2022-0921: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Nov 20, 2019 GO-2022-0344 +10 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0784: containerd-shim API Exposed to Host Network Containers in github.com/containerd/containerd

  GO-2022-0921: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Sep 27, 2019 GO-2022-0344 +10 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0784: containerd-shim API Exposed to Host Network Containers in github.com/containerd/containerd

  GO-2022-0921: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Changes in this version

+ var ErrNoShmMount = errors.New("no /dev/shm mount specified")

+ var ErrNotADevice = errors.New("not a device node")

+ func GetAllCapabilities() []string

type SpecOpts

+ func WithAddedCapabilities(caps []string) SpecOpts

+ func WithAnnotations(annotations map[string]string) SpecOpts

+ func WithDevShmSize(kb int64) SpecOpts

+ func WithDroppedCapabilities(caps []string) SpecOpts

+ func WithEnvFile(path string) SpecOpts

+ func WithLinuxDevice(path, permissions string) SpecOpts

+ func WithLinuxDevices(devices []specs.LinuxDevice) SpecOpts

+ func WithMemoryLimit(limit uint64) SpecOpts

+ func WithWindowNetworksAllowUnqualifiedDNSQuery() SpecOpts

+ func WithWindowsCPUCount(count uint64) SpecOpts

+ func WithWindowsIgnoreFlushesDuringBoot() SpecOpts

Sep 25, 2019 GO-2022-0344 +10 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0784: containerd-shim API Exposed to Host Network Containers in github.com/containerd/containerd

  GO-2022-0921: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Sep 20, 2019 GO-2022-0344 +10 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0784: containerd-shim API Exposed to Host Network Containers in github.com/containerd/containerd

  GO-2022-0921: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Sep 12, 2019 GO-2022-0344 +10 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0784: containerd-shim API Exposed to Host Network Containers in github.com/containerd/containerd

  GO-2022-0921: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Sep 4, 2019 GO-2022-0344 +10 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0784: containerd-shim API Exposed to Host Network Containers in github.com/containerd/containerd

  GO-2022-0921: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Aug 20, 2019 GO-2022-0344 +10 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0784: containerd-shim API Exposed to Host Network Containers in github.com/containerd/containerd

  GO-2022-0921: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Aug 9, 2019 GO-2022-0344 +10 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0784: containerd-shim API Exposed to Host Network Containers in github.com/containerd/containerd

  GO-2022-0921: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Jul 31, 2019 GO-2022-0344 +10 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0784: containerd-shim API Exposed to Host Network Containers in github.com/containerd/containerd

  GO-2022-0921: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Oct 15, 2020 GO-2022-0344 +10 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0784: containerd-shim API Exposed to Host Network Containers in github.com/containerd/containerd

  GO-2022-0921: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Feb 18, 2020 GO-2022-0344 +11 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0784: containerd-shim API Exposed to Host Network Containers in github.com/containerd/containerd

  GO-2022-0803: containerd v1.2.x can be coerced into leaking credentials during image pull in github.com/containerd/containerd

  GO-2022-0921: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Feb 4, 2020 GO-2022-0344 +11 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0784: containerd-shim API Exposed to Host Network Containers in github.com/containerd/containerd

  GO-2022-0803: containerd v1.2.x can be coerced into leaking credentials during image pull in github.com/containerd/containerd

  GO-2022-0921: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Nov 26, 2019 GO-2022-0344 +11 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0784: containerd-shim API Exposed to Host Network Containers in github.com/containerd/containerd

  GO-2022-0803: containerd v1.2.x can be coerced into leaking credentials during image pull in github.com/containerd/containerd

  GO-2022-0921: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Sep 26, 2019 GO-2022-0344 +11 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0784: containerd-shim API Exposed to Host Network Containers in github.com/containerd/containerd

  GO-2022-0803: containerd v1.2.x can be coerced into leaking credentials during image pull in github.com/containerd/containerd

  GO-2022-0921: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Sep 6, 2019 GO-2022-0344 +11 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0784: containerd-shim API Exposed to Host Network Containers in github.com/containerd/containerd

  GO-2022-0803: containerd v1.2.x can be coerced into leaking credentials during image pull in github.com/containerd/containerd

  GO-2022-0921: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Aug 22, 2019 GO-2022-0344 +11 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0784: containerd-shim API Exposed to Host Network Containers in github.com/containerd/containerd

  GO-2022-0803: containerd v1.2.x can be coerced into leaking credentials during image pull in github.com/containerd/containerd

  GO-2022-0921: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Changes in this version

+ func WithDefaultPathEnv(_ context.Context, _ Client, _ *containers.Container, s *Spec) error

Jun 14, 2019 GO-2022-0344 +11 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0784: containerd-shim API Exposed to Host Network Containers in github.com/containerd/containerd

  GO-2022-0803: containerd v1.2.x can be coerced into leaking credentials during image pull in github.com/containerd/containerd

  GO-2022-0921: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Apr 5, 2019 GO-2022-0344 +11 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0784: containerd-shim API Exposed to Host Network Containers in github.com/containerd/containerd

  GO-2022-0803: containerd v1.2.x can be coerced into leaking credentials during image pull in github.com/containerd/containerd

  GO-2022-0921: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Mar 13, 2019 GO-2022-0344 +11 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0784: containerd-shim API Exposed to Host Network Containers in github.com/containerd/containerd

  GO-2022-0803: containerd v1.2.x can be coerced into leaking credentials during image pull in github.com/containerd/containerd

  GO-2022-0921: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Feb 14, 2019 GO-2022-0344 +11 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0784: containerd-shim API Exposed to Host Network Containers in github.com/containerd/containerd

  GO-2022-0803: containerd v1.2.x can be coerced into leaking credentials during image pull in github.com/containerd/containerd

  GO-2022-0921: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Feb 6, 2019 GO-2022-0344 +11 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0784: containerd-shim API Exposed to Host Network Containers in github.com/containerd/containerd

  GO-2022-0803: containerd v1.2.x can be coerced into leaking credentials during image pull in github.com/containerd/containerd

  GO-2022-0921: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Jan 8, 2019 GO-2022-0344 +11 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0784: containerd-shim API Exposed to Host Network Containers in github.com/containerd/containerd

  GO-2022-0803: containerd v1.2.x can be coerced into leaking credentials during image pull in github.com/containerd/containerd

  GO-2022-0921: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Dec 5, 2018 GO-2022-0344 +11 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0784: containerd-shim API Exposed to Host Network Containers in github.com/containerd/containerd

  GO-2022-0803: containerd v1.2.x can be coerced into leaking credentials during image pull in github.com/containerd/containerd

  GO-2022-0921: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Nov 21, 2018 GO-2022-0344 +11 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0784: containerd-shim API Exposed to Host Network Containers in github.com/containerd/containerd

  GO-2022-0803: containerd v1.2.x can be coerced into leaking credentials during image pull in github.com/containerd/containerd

  GO-2022-0921: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Oct 24, 2018 GO-2022-0344 +11 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0784: containerd-shim API Exposed to Host Network Containers in github.com/containerd/containerd

  GO-2022-0803: containerd v1.2.x can be coerced into leaking credentials during image pull in github.com/containerd/containerd

  GO-2022-0921: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Changes in this version

+ var WithAllCapabilities = WithCapabilities(getAllCapabilities()) — windows/amd64

+ var WithPrivileged = Compose(WithAllCapabilities, WithMaskedPaths(nil), WithReadonlyPaths(nil), ...) — windows/amd64

+ func ApplyOpts(ctx context.Context, client Client, c *containers.Container, s *Spec, ...) error

+ func WithDefaultUnixDevices(_ context.Context, _ Client, _ *containers.Container, s *Spec) error

+ func WithHostHostsFile(_ context.Context, _ Client, _ *containers.Container, s *Spec) error — windows/amd64

+ func WithHostLocaltime(_ context.Context, _ Client, _ *containers.Container, s *Spec) error — windows/amd64

+ func WithHostResolvconf(_ context.Context, _ Client, _ *containers.Container, s *Spec) error — windows/amd64

+ func WithNewPrivileges(_ context.Context, _ Client, _ *containers.Container, s *Spec) error — windows/amd64

+ func WithNoNewPrivileges(_ context.Context, _ Client, _ *containers.Container, s *Spec) error — windows/amd64

+ func WithParentCgroupDevices(_ context.Context, _ Client, _ *containers.Container, s *Spec) error

+ func WithSeccompUnconfined(_ context.Context, _ Client, _ *containers.Container, s *Spec) error — windows/amd64

+ func WithWindowsHyperV(_ context.Context, _ Client, _ *containers.Container, s *Spec) error

+ func WithWriteableCgroupfs(_ context.Context, _ Client, _ *containers.Container, s *Spec) error — windows/amd64

+ func WithWriteableSysfs(_ context.Context, _ Client, _ *containers.Container, s *Spec) error — windows/amd64

+ type Spec = specs.Spec

+ func GenerateSpecWithPlatform(ctx context.Context, client Client, platform string, c *containers.Container, ...) (*Spec, error)

type SpecOpts

+ func WithAdditionalGIDs(userstr string) SpecOpts

+ func WithAmbientCapabilities(caps []string) SpecOpts

+ func WithApparmorProfile(profile string) SpecOpts

+ func WithCapabilities(caps []string) SpecOpts

+ func WithCgroup(path string) SpecOpts

+ func WithDefaultSpec() SpecOpts

+ func WithDefaultSpecForPlatform(platform string) SpecOpts

+ func WithHostNamespace(ns specs.LinuxNamespaceType) SpecOpts

+ func WithImageConfigArgs(image Image, args []string) SpecOpts

+ func WithLinuxNamespace(ns specs.LinuxNamespace) SpecOpts

+ func WithMaskedPaths(paths []string) SpecOpts

+ func WithNamespacedCgroup() SpecOpts

+ func WithReadonlyPaths(paths []string) SpecOpts

+ func WithRootFSPath(path string) SpecOpts

+ func WithRootFSReadonly() SpecOpts

+ func WithSelinuxLabel(label string) SpecOpts

+ func WithSpecFromBytes(p []byte) SpecOpts

+ func WithSpecFromFile(filename string) SpecOpts

+ func WithTTYSize(width, height int) SpecOpts

+ func WithUIDGID(uid, gid uint32) SpecOpts

+ func WithUser(userstr string) SpecOpts

+ func WithUserID(uid uint32) SpecOpts

+ func WithUserNamespace(container, host, size uint32) SpecOpts

Oct 16, 2018 GO-2022-0344 +11 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0784: containerd-shim API Exposed to Host Network Containers in github.com/containerd/containerd

  GO-2022-0803: containerd v1.2.x can be coerced into leaking credentials during image pull in github.com/containerd/containerd

  GO-2022-0921: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Oct 3, 2018 GO-2022-0344 +11 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0784: containerd-shim API Exposed to Host Network Containers in github.com/containerd/containerd

  GO-2022-0803: containerd v1.2.x can be coerced into leaking credentials during image pull in github.com/containerd/containerd

  GO-2022-0921: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Sep 20, 2018 GO-2022-0344 +11 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0784: containerd-shim API Exposed to Host Network Containers in github.com/containerd/containerd

  GO-2022-0803: containerd v1.2.x can be coerced into leaking credentials during image pull in github.com/containerd/containerd

  GO-2022-0921: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Aug 28, 2018 GO-2022-0344 +11 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0784: containerd-shim API Exposed to Host Network Containers in github.com/containerd/containerd

  GO-2022-0803: containerd v1.2.x can be coerced into leaking credentials during image pull in github.com/containerd/containerd

  GO-2022-0921: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Aug 23, 2018 GO-2022-0344 +11 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0784: containerd-shim API Exposed to Host Network Containers in github.com/containerd/containerd

  GO-2022-0803: containerd v1.2.x can be coerced into leaking credentials during image pull in github.com/containerd/containerd

  GO-2022-0921: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Aug 16, 2018 GO-2022-0344 +11 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0784: containerd-shim API Exposed to Host Network Containers in github.com/containerd/containerd

  GO-2022-0803: containerd v1.2.x can be coerced into leaking credentials during image pull in github.com/containerd/containerd

  GO-2022-0921: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Sep 26, 2019 GO-2022-0344 +11 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0784: containerd-shim API Exposed to Host Network Containers in github.com/containerd/containerd

  GO-2022-0803: containerd v1.2.x can be coerced into leaking credentials during image pull in github.com/containerd/containerd

  GO-2022-0921: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Apr 5, 2019 GO-2022-0344 +11 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0784: containerd-shim API Exposed to Host Network Containers in github.com/containerd/containerd

  GO-2022-0803: containerd v1.2.x can be coerced into leaking credentials during image pull in github.com/containerd/containerd

  GO-2022-0921: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Feb 14, 2019 GO-2022-0344 +11 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0784: containerd-shim API Exposed to Host Network Containers in github.com/containerd/containerd

  GO-2022-0803: containerd v1.2.x can be coerced into leaking credentials during image pull in github.com/containerd/containerd

  GO-2022-0921: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Nov 21, 2018 GO-2022-0344 +11 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0784: containerd-shim API Exposed to Host Network Containers in github.com/containerd/containerd

  GO-2022-0803: containerd v1.2.x can be coerced into leaking credentials during image pull in github.com/containerd/containerd

  GO-2022-0921: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Sep 25, 2018 GO-2022-0344 +11 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0784: containerd-shim API Exposed to Host Network Containers in github.com/containerd/containerd

  GO-2022-0803: containerd v1.2.x can be coerced into leaking credentials during image pull in github.com/containerd/containerd

  GO-2022-0921: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Changes in this version

+ func WithNewPrivileges(_ context.Context, _ Client, _ *containers.Container, s *specs.Spec) error — darwin/amd64, js/wasm, linux/amd64

type SpecOpts — darwin/amd64, js/wasm, linux/amd64

+ func WithAdditionalGIDs(userstr string) SpecOpts

Aug 22, 2018 GO-2022-0344 +11 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0784: containerd-shim API Exposed to Host Network Containers in github.com/containerd/containerd

  GO-2022-0803: containerd v1.2.x can be coerced into leaking credentials during image pull in github.com/containerd/containerd

  GO-2022-0921: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Jul 13, 2018 GO-2022-0344 +11 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0784: containerd-shim API Exposed to Host Network Containers in github.com/containerd/containerd

  GO-2022-0803: containerd v1.2.x can be coerced into leaking credentials during image pull in github.com/containerd/containerd

  GO-2022-0921: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Jul 9, 2018 GO-2022-0344 +11 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0784: containerd-shim API Exposed to Host Network Containers in github.com/containerd/containerd

  GO-2022-0803: containerd v1.2.x can be coerced into leaking credentials during image pull in github.com/containerd/containerd

  GO-2022-0921: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Jun 27, 2018 GO-2022-0344 +11 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0784: containerd-shim API Exposed to Host Network Containers in github.com/containerd/containerd

  GO-2022-0803: containerd v1.2.x can be coerced into leaking credentials during image pull in github.com/containerd/containerd

  GO-2022-0921: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Jun 18, 2018 GO-2022-0344 +11 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0784: containerd-shim API Exposed to Host Network Containers in github.com/containerd/containerd

  GO-2022-0803: containerd v1.2.x can be coerced into leaking credentials during image pull in github.com/containerd/containerd

  GO-2022-0921: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

May 31, 2018 GO-2022-0344 +11 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0784: containerd-shim API Exposed to Host Network Containers in github.com/containerd/containerd

  GO-2022-0803: containerd v1.2.x can be coerced into leaking credentials during image pull in github.com/containerd/containerd

  GO-2022-0921: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Apr 24, 2018 GO-2022-0344 +11 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0784: containerd-shim API Exposed to Host Network Containers in github.com/containerd/containerd

  GO-2022-0803: containerd v1.2.x can be coerced into leaking credentials during image pull in github.com/containerd/containerd

  GO-2022-0921: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Changes in this version

+ var WithAllCapabilities = WithCapabilities(getAllCapabilities()) — darwin/amd64, js/wasm, linux/amd64

+ var WithPrivileged = Compose(WithAllCapabilities, WithMaskedPaths(nil), WithReadonlyPaths(nil), ...) — darwin/amd64, js/wasm, linux/amd64

+ func WithSeccompUnconfined(_ context.Context, _ Client, _ *containers.Container, s *specs.Spec) error — darwin/amd64, js/wasm, linux/amd64

+ func WithWriteableCgroupfs(_ context.Context, _ Client, _ *containers.Container, s *specs.Spec) error — darwin/amd64, js/wasm, linux/amd64

+ func WithWriteableSysfs(_ context.Context, _ Client, _ *containers.Container, s *specs.Spec) error — darwin/amd64, js/wasm, linux/amd64

type SpecOpts

+ func Compose(opts ...SpecOpts) SpecOpts

+ func WithApparmorProfile(profile string) SpecOpts

+ func WithCapabilities(caps []string) SpecOpts

+ func WithEnv(environmentVariables []string) SpecOpts

+ func WithMaskedPaths(paths []string) SpecOpts

+ func WithMounts(mounts []specs.Mount) SpecOpts

+ func WithReadonlyPaths(paths []string) SpecOpts

+ func WithSelinuxLabel(label string) SpecOpts

+ func WithUser(userstr string) SpecOpts

Apr 13, 2018 GO-2022-0344 +11 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0784: containerd-shim API Exposed to Host Network Containers in github.com/containerd/containerd

  GO-2022-0803: containerd v1.2.x can be coerced into leaking credentials during image pull in github.com/containerd/containerd

  GO-2022-0921: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Apr 5, 2018 GO-2022-0344 +11 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0784: containerd-shim API Exposed to Host Network Containers in github.com/containerd/containerd

  GO-2022-0803: containerd v1.2.x can be coerced into leaking credentials during image pull in github.com/containerd/containerd

  GO-2022-0921: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Mar 27, 2018 GO-2022-0344 +11 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0784: containerd-shim API Exposed to Host Network Containers in github.com/containerd/containerd

  GO-2022-0803: containerd v1.2.x can be coerced into leaking credentials during image pull in github.com/containerd/containerd

  GO-2022-0921: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Apr 2, 2018 GO-2022-0344 +11 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0784: containerd-shim API Exposed to Host Network Containers in github.com/containerd/containerd

  GO-2022-0803: containerd v1.2.x can be coerced into leaking credentials during image pull in github.com/containerd/containerd

  GO-2022-0921: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Mar 29, 2018 GO-2022-0344 +11 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0784: containerd-shim API Exposed to Host Network Containers in github.com/containerd/containerd

  GO-2022-0803: containerd v1.2.x can be coerced into leaking credentials during image pull in github.com/containerd/containerd

  GO-2022-0921: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Feb 13, 2018 GO-2022-0344 +11 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0784: containerd-shim API Exposed to Host Network Containers in github.com/containerd/containerd

  GO-2022-0803: containerd v1.2.x can be coerced into leaking credentials during image pull in github.com/containerd/containerd

  GO-2022-0921: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Feb 6, 2018 GO-2022-0344 +11 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0784: containerd-shim API Exposed to Host Network Containers in github.com/containerd/containerd

  GO-2022-0803: containerd v1.2.x can be coerced into leaking credentials during image pull in github.com/containerd/containerd

  GO-2022-0921: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Jan 30, 2018 GO-2022-0344 +11 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0784: containerd-shim API Exposed to Host Network Containers in github.com/containerd/containerd

  GO-2022-0803: containerd v1.2.x can be coerced into leaking credentials during image pull in github.com/containerd/containerd

  GO-2022-0921: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Jan 17, 2018 GO-2022-0344 +11 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0784: containerd-shim API Exposed to Host Network Containers in github.com/containerd/containerd

  GO-2022-0803: containerd v1.2.x can be coerced into leaking credentials during image pull in github.com/containerd/containerd

  GO-2022-0921: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Jan 11, 2018 GO-2022-0344 +11 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0784: containerd-shim API Exposed to Host Network Containers in github.com/containerd/containerd

  GO-2022-0803: containerd v1.2.x can be coerced into leaking credentials during image pull in github.com/containerd/containerd

  GO-2022-0921: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Dec 5, 2017 GO-2022-0344 +11 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0784: containerd-shim API Exposed to Host Network Containers in github.com/containerd/containerd

  GO-2022-0803: containerd v1.2.x can be coerced into leaking credentials during image pull in github.com/containerd/containerd

  GO-2022-0921: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Changes in this version

+ func GenerateSpec(ctx context.Context, client Client, c *containers.Container, opts ...SpecOpts) (*specs.Spec, error)

+ func WithHostHostsFile(_ context.Context, _ Client, _ *containers.Container, s *specs.Spec) error — darwin/amd64, js/wasm, linux/amd64

+ func WithHostLocaltime(_ context.Context, _ Client, _ *containers.Container, s *specs.Spec) error — darwin/amd64, js/wasm, linux/amd64

+ func WithHostResolvconf(_ context.Context, _ Client, _ *containers.Container, s *specs.Spec) error — darwin/amd64, js/wasm, linux/amd64

+ func WithNoNewPrivileges(_ context.Context, _ Client, _ *containers.Container, s *specs.Spec) error — darwin/amd64, js/wasm, linux/amd64

+ func WithTTY(_ context.Context, _ Client, _ *containers.Container, s *specs.Spec) error — darwin/amd64, js/wasm, linux/amd64

+ type Client interface

+ SnapshotService func(snapshotterName string) snapshots.Snapshotter

+ type Image interface

+ Config func(ctx context.Context) (ocispec.Descriptor, error)

+ ContentStore func() content.Store

+ type SpecOpts func(context.Context, Client, *containers.Container, *specs.Spec) error

+ func WithCgroup(path string) SpecOpts

+ func WithHostNamespace(ns specs.LinuxNamespaceType) SpecOpts

+ func WithHostname(name string) SpecOpts

+ func WithImageConfig(image Image) SpecOpts

+ func WithLinuxNamespace(ns specs.LinuxNamespace) SpecOpts

+ func WithNamespacedCgroup() SpecOpts

+ func WithProcessArgs(args ...string) SpecOpts

+ func WithProcessCwd(cwd string) SpecOpts

+ func WithRootFSPath(path string) SpecOpts

+ func WithRootFSReadonly() SpecOpts

+ func WithTTY(width, height int) SpecOpts

+ func WithUIDGID(uid, gid uint32) SpecOpts

+ func WithUserID(uid uint32) SpecOpts

+ func WithUserNamespace(container, host, size uint32) SpecOpts

+ func WithUsername(username string) SpecOpts

Dec 1, 2017 GO-2022-0344 +11 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0784: containerd-shim API Exposed to Host Network Containers in github.com/containerd/containerd

  GO-2022-0803: containerd v1.2.x can be coerced into leaking credentials during image pull in github.com/containerd/containerd

  GO-2022-0921: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Aug 10, 2017 GO-2022-0344 +11 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0784: containerd-shim API Exposed to Host Network Containers in github.com/containerd/containerd

  GO-2022-0803: containerd v1.2.x can be coerced into leaking credentials during image pull in github.com/containerd/containerd

  GO-2022-0921: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Aug 2, 2017 GO-2022-0344 +11 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0784: containerd-shim API Exposed to Host Network Containers in github.com/containerd/containerd

  GO-2022-0803: containerd v1.2.x can be coerced into leaking credentials during image pull in github.com/containerd/containerd

  GO-2022-0921: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Jul 26, 2017 GO-2022-0344 +11 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0784: containerd-shim API Exposed to Host Network Containers in github.com/containerd/containerd

  GO-2022-0803: containerd v1.2.x can be coerced into leaking credentials during image pull in github.com/containerd/containerd

  GO-2022-0921: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Jul 19, 2017 GO-2022-0344 +11 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0784: containerd-shim API Exposed to Host Network Containers in github.com/containerd/containerd

  GO-2022-0803: containerd v1.2.x can be coerced into leaking credentials during image pull in github.com/containerd/containerd

  GO-2022-0921: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Jul 13, 2017 GO-2022-0344 +11 more

  GO-2022-0344: containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

  GO-2022-0360: Ambiguous OCI manifest parsing in github.com/containerd/containerd

  GO-2022-0482: containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd

  GO-2022-0784: containerd-shim API Exposed to Host Network Containers in github.com/containerd/containerd

  GO-2022-0803: containerd v1.2.x can be coerced into leaking credentials during image pull in github.com/containerd/containerd

  GO-2022-0921: Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

  GO-2022-0938: Insufficiently restricted permissions on plugin directories in github.com/containerd/containerd

  GO-2022-1147: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

  GO-2023-1573: Memory exhaustion via OCI image importer in github.com/containerd/containerd

  GO-2023-1574: Privilege escalation via supplementary groups in github.com/containerd/containerd

  GO-2023-2412: RAPL accessibility in github.com/containerd/containerd

  GO-2024-2846: Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd