libcontainer

Oct 21, 2024

Changes in this version

+ const TimeOffsetsAttr — linux/amd64

+ var ErrCgroupNotExist = errors.New("cgroup not exist")

+ var ErrCriuMissingFeatures = errors.New("criu is missing features") — linux/amd64

+ func Init() — linux/amd64

type Container — linux/amd64

+ func Create(root, id string, config *configs.Config) (*Container, error)

+ func Load(root, id string) (*Container, error)

+ func (c *Container) Exec() error

+ func (c *Container) OCIState() (*specs.State, error)

+ func (c *Container) Run(process *Process) error

type Process

+ IOPriority *configs.IOPriority

+ PidfdSocket *os.File

+ Scheduler *configs.Scheduler

Jun 26, 2024 GO-2024-3110

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Apr 3, 2024 GO-2024-3110

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Jun 13, 2024 GO-2024-3110

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Jan 23, 2024 GO-2024-3110

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Jan 2, 2024 GO-2024-2491 +1 more

  GO-2024-2491: Container breakout through process.cwd trickery and leaked fds in github.com/opencontainers/runc

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Nov 1, 2023 GO-2024-2491 +1 more

  GO-2024-2491: Container breakout through process.cwd trickery and leaked fds in github.com/opencontainers/runc

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Aug 10, 2023 GO-2024-2491 +1 more

  GO-2024-2491: Container breakout through process.cwd trickery and leaked fds in github.com/opencontainers/runc

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Jul 19, 2023 GO-2024-2491 +1 more

  GO-2024-2491: Container breakout through process.cwd trickery and leaked fds in github.com/opencontainers/runc

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Apr 26, 2023 GO-2024-2491 +1 more

  GO-2024-2491: Container breakout through process.cwd trickery and leaked fds in github.com/opencontainers/runc

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Apr 11, 2023 GO-2024-2491 +1 more

  GO-2024-2491: Container breakout through process.cwd trickery and leaked fds in github.com/opencontainers/runc

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Mar 29, 2023 GO-2024-2491 +1 more

  GO-2024-2491: Container breakout through process.cwd trickery and leaked fds in github.com/opencontainers/runc

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Aug 24, 2022 GO-2023-1627 +4 more

  GO-2023-1627: Opencontainers runc Incorrect Authorization vulnerability in github.com/opencontainers/runc

  GO-2023-1682: rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc in github.com/opencontainers/runc

  GO-2023-1683: runc AppArmor bypass with symlinked /proc in github.com/opencontainers/runc

  GO-2024-2491: Container breakout through process.cwd trickery and leaked fds in github.com/opencontainers/runc

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Jun 8, 2022 GO-2023-1627 +4 more

  GO-2023-1627: Opencontainers runc Incorrect Authorization vulnerability in github.com/opencontainers/runc

  GO-2023-1682: rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc in github.com/opencontainers/runc

  GO-2023-1683: runc AppArmor bypass with symlinked /proc in github.com/opencontainers/runc

  GO-2024-2491: Container breakout through process.cwd trickery and leaked fds in github.com/opencontainers/runc

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

May 5, 2022 GO-2023-1627 +4 more

  GO-2023-1627: Opencontainers runc Incorrect Authorization vulnerability in github.com/opencontainers/runc

  GO-2023-1682: rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc in github.com/opencontainers/runc

  GO-2023-1683: runc AppArmor bypass with symlinked /proc in github.com/opencontainers/runc

  GO-2024-2491: Container breakout through process.cwd trickery and leaked fds in github.com/opencontainers/runc

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Mar 28, 2022 GO-2022-0452 +5 more

  GO-2022-0452: Default inheritable capabilities for linux container should be empty in github.com/opencontainers/runc

  GO-2023-1627: Opencontainers runc Incorrect Authorization vulnerability in github.com/opencontainers/runc

  GO-2023-1682: rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc in github.com/opencontainers/runc

  GO-2023-1683: runc AppArmor bypass with symlinked /proc in github.com/opencontainers/runc

  GO-2024-2491: Container breakout through process.cwd trickery and leaked fds in github.com/opencontainers/runc

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Jan 17, 2022 GO-2022-0452 +5 more

  GO-2022-0452: Default inheritable capabilities for linux container should be empty in github.com/opencontainers/runc

  GO-2023-1627: Opencontainers runc Incorrect Authorization vulnerability in github.com/opencontainers/runc

  GO-2023-1682: rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc in github.com/opencontainers/runc

  GO-2023-1683: runc AppArmor bypass with symlinked /proc in github.com/opencontainers/runc

  GO-2024-2491: Container breakout through process.cwd trickery and leaked fds in github.com/opencontainers/runc

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Changes in this version

+ const MountSourcesAttr — linux/amd64

+ var ErrExist = errors.New("container with given ID already exists")

+ var ErrInvalidID = errors.New("invalid container ID format")

+ var ErrNotExist = errors.New("container does not exist")

+ var ErrNotPaused = errors.New("container not paused")

+ var ErrNotRunning = errors.New("container not running")

+ var ErrPaused = errors.New("container paused")

+ var ErrRunning = errors.New("container still running")

type CriuOpts — linux/amd64

+ LsmMountContext string

type Process

+ SubCgroupPaths map[string]string

Dec 14, 2021 GO-2022-0274 +6 more

  GO-2022-0274: Namespace restriction bypass in github.com/opencontainers/runc

  GO-2022-0452: Default inheritable capabilities for linux container should be empty in github.com/opencontainers/runc

  GO-2023-1627: Opencontainers runc Incorrect Authorization vulnerability in github.com/opencontainers/runc

  GO-2023-1682: rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc in github.com/opencontainers/runc

  GO-2023-1683: runc AppArmor bypass with symlinked /proc in github.com/opencontainers/runc

  GO-2024-2491: Container breakout through process.cwd trickery and leaked fds in github.com/opencontainers/runc

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Dec 3, 2021 GO-2022-0274 +6 more

  GO-2022-0274: Namespace restriction bypass in github.com/opencontainers/runc

  GO-2022-0452: Default inheritable capabilities for linux container should be empty in github.com/opencontainers/runc

  GO-2023-1627: Opencontainers runc Incorrect Authorization vulnerability in github.com/opencontainers/runc

  GO-2023-1682: rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc in github.com/opencontainers/runc

  GO-2023-1683: runc AppArmor bypass with symlinked /proc in github.com/opencontainers/runc

  GO-2024-2491: Container breakout through process.cwd trickery and leaked fds in github.com/opencontainers/runc

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Aug 20, 2021 GO-2022-0274 +6 more

  GO-2022-0274: Namespace restriction bypass in github.com/opencontainers/runc

  GO-2022-0452: Default inheritable capabilities for linux container should be empty in github.com/opencontainers/runc

  GO-2023-1627: Opencontainers runc Incorrect Authorization vulnerability in github.com/opencontainers/runc

  GO-2023-1682: rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc in github.com/opencontainers/runc

  GO-2023-1683: runc AppArmor bypass with symlinked /proc in github.com/opencontainers/runc

  GO-2024-2491: Container breakout through process.cwd trickery and leaked fds in github.com/opencontainers/runc

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Jul 16, 2021 GO-2022-0274 +6 more

  GO-2022-0274: Namespace restriction bypass in github.com/opencontainers/runc

  GO-2022-0452: Default inheritable capabilities for linux container should be empty in github.com/opencontainers/runc

  GO-2023-1627: Opencontainers runc Incorrect Authorization vulnerability in github.com/opencontainers/runc

  GO-2023-1682: rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc in github.com/opencontainers/runc

  GO-2023-1683: runc AppArmor bypass with symlinked /proc in github.com/opencontainers/runc

  GO-2024-2491: Container breakout through process.cwd trickery and leaked fds in github.com/opencontainers/runc

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Jun 17, 2021 GO-2022-0452 +5 more

  GO-2022-0452: Default inheritable capabilities for linux container should be empty in github.com/opencontainers/runc

  GO-2023-1627: Opencontainers runc Incorrect Authorization vulnerability in github.com/opencontainers/runc

  GO-2023-1682: rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc in github.com/opencontainers/runc

  GO-2023-1683: runc AppArmor bypass with symlinked /proc in github.com/opencontainers/runc

  GO-2024-2491: Container breakout through process.cwd trickery and leaked fds in github.com/opencontainers/runc

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Changes in this version

+ const GidmapPathAttr — linux/amd64

+ const OomScoreAdjAttr — linux/amd64

+ const RootlessEUIDAttr — linux/amd64

+ const UidmapPathAttr — linux/amd64

+ func CriuPath(criupath string) func(*LinuxFactory) error — linux/amd64

+ func IntelRdtFs(l *LinuxFactory) error — linux/amd64

+ func NewgidmapPath(newgidmapPath string) func(*LinuxFactory) error — linux/amd64

+ func NewuidmapPath(newuidmapPath string) func(*LinuxFactory) error — linux/amd64

+ func RootlessCgroupfs(l *LinuxFactory) error — linux/amd64

+ func RootlessSystemdCgroups(l *LinuxFactory) error — linux/amd64

type BaseContainer

+ Exec func() error

+ OCIState func() (*specs.State, error)

+ Run func(process *Process) (err error)

type CriuOpts — linux/amd64

+ AutoDedup bool

+ LazyPages bool

+ LsmProfile string

+ ParentImage string

+ PreDump bool

+ StatusFd int

type LinuxFactory — linux/amd64

+ NewIntelRdtManager func(config *configs.Config, id string, path string) intelrdt.Manager

+ NewgidmapPath string

+ NewuidmapPath string

type Process

+ AdditionalGroups []string

+ ConsoleHeight uint16

+ ConsoleSocket *os.File

+ ConsoleWidth uint16

+ Init bool

+ LogLevel string

type State — linux/amd64

+ IntelRdtPath string

+ Rootless bool

type Stats — linux/amd64

+ IntelRdtStats *intelrdt.Stats

type Status

+ const Stopped

May 19, 2021 GO-2022-0452 +5 more

  GO-2022-0452: Default inheritable capabilities for linux container should be empty in github.com/opencontainers/runc

  GO-2023-1627: Opencontainers runc Incorrect Authorization vulnerability in github.com/opencontainers/runc

  GO-2023-1682: rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc in github.com/opencontainers/runc

  GO-2023-1683: runc AppArmor bypass with symlinked /proc in github.com/opencontainers/runc

  GO-2024-2491: Container breakout through process.cwd trickery and leaked fds in github.com/opencontainers/runc

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

May 10, 2021 GO-2022-0452 +5 more

  GO-2022-0452: Default inheritable capabilities for linux container should be empty in github.com/opencontainers/runc

  GO-2022-0914: mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs in github.com/opencontainers/runc

  GO-2023-1682: rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc in github.com/opencontainers/runc

  GO-2023-1683: runc AppArmor bypass with symlinked /proc in github.com/opencontainers/runc

  GO-2024-2491: Container breakout through process.cwd trickery and leaked fds in github.com/opencontainers/runc

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Feb 3, 2021 GO-2022-0452 +5 more

  GO-2022-0452: Default inheritable capabilities for linux container should be empty in github.com/opencontainers/runc

  GO-2022-0914: mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs in github.com/opencontainers/runc

  GO-2023-1682: rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc in github.com/opencontainers/runc

  GO-2023-1683: runc AppArmor bypass with symlinked /proc in github.com/opencontainers/runc

  GO-2024-2491: Container breakout through process.cwd trickery and leaked fds in github.com/opencontainers/runc

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Aug 5, 2020 GO-2022-0452 +4 more

  GO-2022-0452: Default inheritable capabilities for linux container should be empty in github.com/opencontainers/runc

  GO-2022-0914: mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs in github.com/opencontainers/runc

  GO-2023-1682: rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc in github.com/opencontainers/runc

  GO-2023-1683: runc AppArmor bypass with symlinked /proc in github.com/opencontainers/runc

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Jun 30, 2020 GO-2022-0452 +4 more

  GO-2022-0452: Default inheritable capabilities for linux container should be empty in github.com/opencontainers/runc

  GO-2022-0914: mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs in github.com/opencontainers/runc

  GO-2023-1682: rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc in github.com/opencontainers/runc

  GO-2023-1683: runc AppArmor bypass with symlinked /proc in github.com/opencontainers/runc

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Jan 22, 2020 GO-2022-0396 +5 more

  GO-2022-0396: devices resource list treated as a blacklist by default in github.com/opencontainers/runc

  GO-2022-0452: Default inheritable capabilities for linux container should be empty in github.com/opencontainers/runc

  GO-2022-0914: mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs in github.com/opencontainers/runc

  GO-2023-1682: rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc in github.com/opencontainers/runc

  GO-2023-1683: runc AppArmor bypass with symlinked /proc in github.com/opencontainers/runc

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Sep 30, 2019 GO-2021-0087 +6 more

  GO-2021-0087: Race condition in github.com/opencontainers/runc

  GO-2022-0396: devices resource list treated as a blacklist by default in github.com/opencontainers/runc

  GO-2022-0452: Default inheritable capabilities for linux container should be empty in github.com/opencontainers/runc

  GO-2022-0914: mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs in github.com/opencontainers/runc

  GO-2023-1682: rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc in github.com/opencontainers/runc

  GO-2023-1683: runc AppArmor bypass with symlinked /proc in github.com/opencontainers/runc

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Apr 24, 2019 GO-2021-0085 +7 more

  GO-2021-0085: Authorization bypass in github.com/opencontainers/runc

  GO-2021-0087: Race condition in github.com/opencontainers/runc

  GO-2022-0396: devices resource list treated as a blacklist by default in github.com/opencontainers/runc

  GO-2022-0452: Default inheritable capabilities for linux container should be empty in github.com/opencontainers/runc

  GO-2022-0914: mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs in github.com/opencontainers/runc

  GO-2023-1682: rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc in github.com/opencontainers/runc

  GO-2023-1683: runc AppArmor bypass with symlinked /proc in github.com/opencontainers/runc

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Mar 28, 2019 GO-2021-0085 +7 more

  GO-2021-0085: Authorization bypass in github.com/opencontainers/runc

  GO-2021-0087: Race condition in github.com/opencontainers/runc

  GO-2022-0396: devices resource list treated as a blacklist by default in github.com/opencontainers/runc

  GO-2022-0452: Default inheritable capabilities for linux container should be empty in github.com/opencontainers/runc

  GO-2022-0914: mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs in github.com/opencontainers/runc

  GO-2023-1682: rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc in github.com/opencontainers/runc

  GO-2023-1683: runc AppArmor bypass with symlinked /proc in github.com/opencontainers/runc

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Nov 21, 2018 GO-2021-0085 +7 more

  GO-2021-0085: Authorization bypass in github.com/opencontainers/runc

  GO-2021-0087: Race condition in github.com/opencontainers/runc

  GO-2022-0396: devices resource list treated as a blacklist by default in github.com/opencontainers/runc

  GO-2022-0452: Default inheritable capabilities for linux container should be empty in github.com/opencontainers/runc

  GO-2022-0914: mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs in github.com/opencontainers/runc

  GO-2023-1682: rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc in github.com/opencontainers/runc

  GO-2023-1683: runc AppArmor bypass with symlinked /proc in github.com/opencontainers/runc

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Feb 27, 2018 GO-2021-0085 +7 more

  GO-2021-0085: Authorization bypass in github.com/opencontainers/runc

  GO-2021-0087: Race condition in github.com/opencontainers/runc

  GO-2022-0396: devices resource list treated as a blacklist by default in github.com/opencontainers/runc

  GO-2022-0452: Default inheritable capabilities for linux container should be empty in github.com/opencontainers/runc

  GO-2022-0914: mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs in github.com/opencontainers/runc

  GO-2023-1682: rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc in github.com/opencontainers/runc

  GO-2023-1683: runc AppArmor bypass with symlinked /proc in github.com/opencontainers/runc

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Aug 2, 2017 GO-2021-0085 +7 more

  GO-2021-0085: Authorization bypass in github.com/opencontainers/runc

  GO-2021-0087: Race condition in github.com/opencontainers/runc

  GO-2022-0396: devices resource list treated as a blacklist by default in github.com/opencontainers/runc

  GO-2022-0452: Default inheritable capabilities for linux container should be empty in github.com/opencontainers/runc

  GO-2022-0914: mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs in github.com/opencontainers/runc

  GO-2023-1682: rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc in github.com/opencontainers/runc

  GO-2023-1683: runc AppArmor bypass with symlinked /proc in github.com/opencontainers/runc

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Mar 21, 2017 GO-2021-0085 +7 more

  GO-2021-0085: Authorization bypass in github.com/opencontainers/runc

  GO-2021-0087: Race condition in github.com/opencontainers/runc

  GO-2022-0396: devices resource list treated as a blacklist by default in github.com/opencontainers/runc

  GO-2022-0452: Default inheritable capabilities for linux container should be empty in github.com/opencontainers/runc

  GO-2022-0914: mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs in github.com/opencontainers/runc

  GO-2023-1682: rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc in github.com/opencontainers/runc

  GO-2023-1683: runc AppArmor bypass with symlinked /proc in github.com/opencontainers/runc

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Sep 29, 2016 GO-2021-0085 +8 more

  GO-2021-0085: Authorization bypass in github.com/opencontainers/runc

  GO-2021-0087: Race condition in github.com/opencontainers/runc

  GO-2022-0396: devices resource list treated as a blacklist by default in github.com/opencontainers/runc

  GO-2022-0452: Default inheritable capabilities for linux container should be empty in github.com/opencontainers/runc

  GO-2022-0835: Information Exposure in RunC in github.com/opencontainers/runc

  GO-2022-0914: mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs in github.com/opencontainers/runc

  GO-2023-1682: rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc in github.com/opencontainers/runc

  GO-2023-1683: runc AppArmor bypass with symlinked /proc in github.com/opencontainers/runc

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Jan 22, 2020 GO-2021-0085 +8 more

  GO-2021-0085: Authorization bypass in github.com/opencontainers/runc

  GO-2021-0087: Race condition in github.com/opencontainers/runc

  GO-2022-0396: devices resource list treated as a blacklist by default in github.com/opencontainers/runc

  GO-2022-0452: Default inheritable capabilities for linux container should be empty in github.com/opencontainers/runc

  GO-2022-0835: Information Exposure in RunC in github.com/opencontainers/runc

  GO-2022-0914: mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs in github.com/opencontainers/runc

  GO-2023-1682: rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc in github.com/opencontainers/runc

  GO-2023-1683: runc AppArmor bypass with symlinked /proc in github.com/opencontainers/runc

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Jun 3, 2016 GO-2021-0085 +8 more

  GO-2021-0085: Authorization bypass in github.com/opencontainers/runc

  GO-2021-0087: Race condition in github.com/opencontainers/runc

  GO-2022-0396: devices resource list treated as a blacklist by default in github.com/opencontainers/runc

  GO-2022-0452: Default inheritable capabilities for linux container should be empty in github.com/opencontainers/runc

  GO-2022-0835: Information Exposure in RunC in github.com/opencontainers/runc

  GO-2022-0914: mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs in github.com/opencontainers/runc

  GO-2023-1682: rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc in github.com/opencontainers/runc

  GO-2023-1683: runc AppArmor bypass with symlinked /proc in github.com/opencontainers/runc

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Apr 25, 2016 GO-2021-0085 +8 more

  GO-2021-0085: Authorization bypass in github.com/opencontainers/runc

  GO-2021-0087: Race condition in github.com/opencontainers/runc

  GO-2022-0396: devices resource list treated as a blacklist by default in github.com/opencontainers/runc

  GO-2022-0452: Default inheritable capabilities for linux container should be empty in github.com/opencontainers/runc

  GO-2022-0835: Information Exposure in RunC in github.com/opencontainers/runc

  GO-2022-0914: mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs in github.com/opencontainers/runc

  GO-2023-1682: rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc in github.com/opencontainers/runc

  GO-2023-1683: runc AppArmor bypass with symlinked /proc in github.com/opencontainers/runc

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Apr 12, 2016 GO-2021-0085 +8 more

  GO-2021-0085: Authorization bypass in github.com/opencontainers/runc

  GO-2021-0087: Race condition in github.com/opencontainers/runc

  GO-2022-0396: devices resource list treated as a blacklist by default in github.com/opencontainers/runc

  GO-2022-0452: Default inheritable capabilities for linux container should be empty in github.com/opencontainers/runc

  GO-2022-0835: Information Exposure in RunC in github.com/opencontainers/runc

  GO-2022-0914: mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs in github.com/opencontainers/runc

  GO-2023-1682: rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc in github.com/opencontainers/runc

  GO-2023-1683: runc AppArmor bypass with symlinked /proc in github.com/opencontainers/runc

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Changes in this version

type CriuOpts — linux/amd64

+ EmptyNs uint32

Mar 10, 2016 GO-2021-0070 +9 more

  GO-2021-0070: Privilege escalation in github.com/opencontainers/runc

  GO-2021-0085: Authorization bypass in github.com/opencontainers/runc

  GO-2021-0087: Race condition in github.com/opencontainers/runc

  GO-2022-0396: devices resource list treated as a blacklist by default in github.com/opencontainers/runc

  GO-2022-0452: Default inheritable capabilities for linux container should be empty in github.com/opencontainers/runc

  GO-2022-0835: Information Exposure in RunC in github.com/opencontainers/runc

  GO-2022-0914: mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs in github.com/opencontainers/runc

  GO-2023-1682: rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc in github.com/opencontainers/runc

  GO-2023-1683: runc AppArmor bypass with symlinked /proc in github.com/opencontainers/runc

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Changes in this version

+ const CloneFlagsAttr — linux/amd64

+ const GidmapAttr — linux/amd64

+ const NsPathsAttr — linux/amd64

+ const PR_SET_NO_NEW_PRIVS — linux/amd64

+ const SetgroupAttr — linux/amd64

+ const UidmapAttr — linux/amd64

+ type Boolmsg struct — linux/amd64

+ Type uint16

+ Value bool

+ func (msg *Boolmsg) Len() int

+ func (msg *Boolmsg) Serialize() []byte

type Process

+ AppArmorProfile string

+ Label string

+ NoNewPrivileges *bool

+ Rlimits []configs.Rlimit

Feb 10, 2016 GO-2021-0070 +9 more

  GO-2021-0070: Privilege escalation in github.com/opencontainers/runc

  GO-2021-0085: Authorization bypass in github.com/opencontainers/runc

  GO-2021-0087: Race condition in github.com/opencontainers/runc

  GO-2022-0396: devices resource list treated as a blacklist by default in github.com/opencontainers/runc

  GO-2022-0452: Default inheritable capabilities for linux container should be empty in github.com/opencontainers/runc

  GO-2022-0835: Information Exposure in RunC in github.com/opencontainers/runc

  GO-2022-0914: mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs in github.com/opencontainers/runc

  GO-2023-1682: rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc in github.com/opencontainers/runc

  GO-2023-1683: runc AppArmor bypass with symlinked /proc in github.com/opencontainers/runc

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Changes in this version

type BaseState

+ Created time.Time

type ErrorCode

+ const NoProcessOps

Jan 26, 2016 GO-2021-0070 +9 more

  GO-2021-0070: Privilege escalation in github.com/opencontainers/runc

  GO-2021-0085: Authorization bypass in github.com/opencontainers/runc

  GO-2021-0087: Race condition in github.com/opencontainers/runc

  GO-2022-0396: devices resource list treated as a blacklist by default in github.com/opencontainers/runc

  GO-2022-0452: Default inheritable capabilities for linux container should be empty in github.com/opencontainers/runc

  GO-2022-0835: Information Exposure in RunC in github.com/opencontainers/runc

  GO-2022-0914: mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs in github.com/opencontainers/runc

  GO-2023-1682: rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc in github.com/opencontainers/runc

  GO-2023-1683: runc AppArmor bypass with symlinked /proc in github.com/opencontainers/runc

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Changes in this version

type Container — linux/amd64

+ NotifyMemoryPressure func(level PressureLevel) (<-chan struct{}, error)

type ErrorCode

+ const ContainerNotPaused

+ type IO struct

+ Stderr io.ReadCloser

+ Stdin io.WriteCloser

+ Stdout io.ReadCloser

+ type PressureLevel uint — linux/amd64

+ const CriticalPressure

+ const LowPressure

+ const MediumPressure

type Process — linux/amd64

+ func (p *Process) InitializeIO(rootuid int) (i *IO, err error)

type Status

+ const Created

+ func (s Status) String() string

Dec 11, 2015 GO-2021-0070 +9 more

  GO-2021-0070: Privilege escalation in github.com/opencontainers/runc

  GO-2021-0085: Authorization bypass in github.com/opencontainers/runc

  GO-2021-0087: Race condition in github.com/opencontainers/runc

  GO-2022-0396: devices resource list treated as a blacklist by default in github.com/opencontainers/runc

  GO-2022-0452: Default inheritable capabilities for linux container should be empty in github.com/opencontainers/runc

  GO-2022-0835: Information Exposure in RunC in github.com/opencontainers/runc

  GO-2022-0914: mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs in github.com/opencontainers/runc

  GO-2023-1682: rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc in github.com/opencontainers/runc

  GO-2023-1683: runc AppArmor bypass with symlinked /proc in github.com/opencontainers/runc

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Changes in this version

+ const ConsolePathAttr — linux/amd64

+ const InitMsg — linux/amd64

+ const PidAttr — linux/amd64

+ type Bytemsg struct — linux/amd64

+ Type uint16

+ Value []byte

+ func (msg *Bytemsg) Len() int

+ func (msg *Bytemsg) Serialize() []byte

type Console — linux/amd64, windows/amd64

+ func NewConsole(uid, gid int) (Console, error)

type ErrorCode

+ const ConsoleExists

+ type Int32msg struct — linux/amd64

+ Type uint16

+ Value uint32

+ func (msg *Int32msg) Len() int

+ func (msg *Int32msg) Serialize() []byte

type Process

+ func (p *Process) ConsoleFromPath(path string) error

Nov 20, 2015 GO-2021-0070 +9 more

  GO-2021-0070: Privilege escalation in github.com/opencontainers/runc

  GO-2021-0085: Authorization bypass in github.com/opencontainers/runc

  GO-2021-0087: Race condition in github.com/opencontainers/runc

  GO-2022-0396: devices resource list treated as a blacklist by default in github.com/opencontainers/runc

  GO-2022-0452: Default inheritable capabilities for linux container should be empty in github.com/opencontainers/runc

  GO-2022-0835: Information Exposure in RunC in github.com/opencontainers/runc

  GO-2022-0914: mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs in github.com/opencontainers/runc

  GO-2023-1682: rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc in github.com/opencontainers/runc

  GO-2023-1683: runc AppArmor bypass with symlinked /proc in github.com/opencontainers/runc

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Changes in this version

+ const CRIU_CG_MODE_DEFAULT — linux/amd64

+ const CRIU_CG_MODE_FULL — linux/amd64

+ const CRIU_CG_MODE_SOFT — linux/amd64

+ const CRIU_CG_MODE_STRICT — linux/amd64

+ type BaseContainer interface

+ Config func() configs.Config

+ Destroy func() error

+ ID func() string

+ Processes func() ([]int, error)

+ Set func(config configs.Config) error

+ Signal func(s os.Signal) error

+ Start func(process *Process) (err error)

+ State func() (*State, error)

+ Stats func() (*Stats, error)

+ Status func() (Status, error)

+ type BaseState struct

+ Config configs.Config

+ ID string

+ InitProcessPid int

+ InitProcessStartTime string

type CriuOpts — linux/amd64

+ ManageCgroupsMode cg_mode

Sep 11, 2015 GO-2021-0070 +9 more

  GO-2021-0070: Privilege escalation in github.com/opencontainers/runc

  GO-2021-0085: Authorization bypass in github.com/opencontainers/runc

  GO-2021-0087: Race condition in github.com/opencontainers/runc

  GO-2022-0396: devices resource list treated as a blacklist by default in github.com/opencontainers/runc

  GO-2022-0452: Default inheritable capabilities for linux container should be empty in github.com/opencontainers/runc

  GO-2022-0835: Information Exposure in RunC in github.com/opencontainers/runc

  GO-2022-0914: mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs in github.com/opencontainers/runc

  GO-2023-1682: rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc in github.com/opencontainers/runc

  GO-2023-1683: runc AppArmor bypass with symlinked /proc in github.com/opencontainers/runc

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Changes in this version

type CriuOpts

+ VethPairs []VethPairName

+ type VethPairName struct

+ ContainerInterfaceName string

+ HostInterfaceName string

Aug 4, 2015 GO-2021-0070 +9 more

  GO-2021-0070: Privilege escalation in github.com/opencontainers/runc

  GO-2021-0085: Authorization bypass in github.com/opencontainers/runc

  GO-2021-0087: Race condition in github.com/opencontainers/runc

  GO-2022-0396: devices resource list treated as a blacklist by default in github.com/opencontainers/runc

  GO-2022-0452: Default inheritable capabilities for linux container should be empty in github.com/opencontainers/runc

  GO-2022-0835: Information Exposure in RunC in github.com/opencontainers/runc

  GO-2022-0914: mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs in github.com/opencontainers/runc

  GO-2023-1682: rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc in github.com/opencontainers/runc

  GO-2023-1683: runc AppArmor bypass with symlinked /proc in github.com/opencontainers/runc

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Changes in this version

type Container

+ Signal func(s os.Signal) error

Jul 17, 2015 GO-2021-0070 +9 more

  GO-2021-0070: Privilege escalation in github.com/opencontainers/runc

  GO-2021-0085: Authorization bypass in github.com/opencontainers/runc

  GO-2021-0087: Race condition in github.com/opencontainers/runc

  GO-2022-0396: devices resource list treated as a blacklist by default in github.com/opencontainers/runc

  GO-2022-0452: Default inheritable capabilities for linux container should be empty in github.com/opencontainers/runc

  GO-2022-0835: Information Exposure in RunC in github.com/opencontainers/runc

  GO-2022-0914: mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs in github.com/opencontainers/runc

  GO-2023-1682: rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc in github.com/opencontainers/runc

  GO-2023-1683: runc AppArmor bypass with symlinked /proc in github.com/opencontainers/runc

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Jul 16, 2015 GO-2021-0070 +9 more

  GO-2021-0070: Privilege escalation in github.com/opencontainers/runc

  GO-2021-0085: Authorization bypass in github.com/opencontainers/runc

  GO-2021-0087: Race condition in github.com/opencontainers/runc

  GO-2022-0396: devices resource list treated as a blacklist by default in github.com/opencontainers/runc

  GO-2022-0452: Default inheritable capabilities for linux container should be empty in github.com/opencontainers/runc

  GO-2022-0835: Information Exposure in RunC in github.com/opencontainers/runc

  GO-2022-0914: mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs in github.com/opencontainers/runc

  GO-2023-1682: rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc in github.com/opencontainers/runc

  GO-2023-1683: runc AppArmor bypass with symlinked /proc in github.com/opencontainers/runc

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Changes in this version

+ func Cgroupfs(l *LinuxFactory) error — linux/amd64

+ func InitArgs(args ...string) func(*LinuxFactory) error — linux/amd64

+ func InitPath(path string, args ...string) func(*LinuxFactory) error — linux/amd64

+ func SystemdCgroups(l *LinuxFactory) error — linux/amd64

+ func TmpfsRoot(l *LinuxFactory) error — linux/amd64

+ type Console interface

+ Fd func() uintptr

+ Path func() string

+ type Container interface

+ Checkpoint func(criuOpts *CriuOpts) error

+ Config func() configs.Config

+ Destroy func() error

+ ID func() string

+ NotifyOOM func() (<-chan struct{}, error)

+ Pause func() error

+ Processes func() ([]int, error)

+ Restore func(process *Process, criuOpts *CriuOpts) error

+ Resume func() error

+ Set func(config configs.Config) error

+ Start func(process *Process) (err error)

+ State func() (*State, error)

+ Stats func() (*Stats, error)

+ Status func() (Status, error)

+ type CriuOpts struct

+ ExternalUnixConnections bool

+ FileLocks bool

+ ImagesDirectory string

+ LeaveRunning bool

+ PageServer CriuPageServerInfo

+ ShellJob bool

+ TcpEstablished bool

+ WorkDirectory string

+ type CriuPageServerInfo struct

+ Address string

+ Port int32

+ type Error interface

+ Code func() ErrorCode

+ Detail func(w io.Writer) error

+ type ErrorCode int

+ const ConfigInvalid

+ const ContainerNotExists

+ const ContainerNotRunning

+ const ContainerNotStopped

+ const ContainerPaused

+ const IdInUse

+ const InvalidIdFormat

+ const ProcessNotExecuted

+ const SystemError

+ func (c ErrorCode) String() string

+ type Factory interface

+ Create func(id string, config *configs.Config) (Container, error)

+ Load func(id string) (Container, error)

+ StartInitialization func() error

+ Type func() string

+ func New(root string, options ...func(*LinuxFactory) error) (Factory, error)

+ type LinuxFactory struct — linux/amd64

+ CriuPath string

+ InitArgs []string

+ InitPath string

+ NewCgroupsManager func(config *configs.Cgroup, paths map[string]string) cgroups.Manager

+ Root string

+ Validator validate.Validator

+ func (l *LinuxFactory) Create(id string, config *configs.Config) (Container, error)

+ func (l *LinuxFactory) Load(id string) (Container, error)

+ func (l *LinuxFactory) StartInitialization() (err error)

+ func (l *LinuxFactory) Type() string

+ type NetworkInterface struct

+ Name string

+ RxBytes uint64

+ RxDropped uint64

+ RxErrors uint64

+ RxPackets uint64

+ TxBytes uint64

+ TxDropped uint64

+ TxErrors uint64

+ TxPackets uint64

+ type Process struct

+ Args []string

+ Capabilities []string

+ Cwd string

+ Env []string

+ ExtraFiles []*os.File

+ Stderr io.Writer

+ Stdin io.Reader

+ Stdout io.Writer

+ User string

+ func (p *Process) NewConsole(rootuid int) (Console, error)

+ func (p Process) Pid() (int, error)

+ func (p Process) Signal(sig os.Signal) error

+ func (p Process) Wait() (*os.ProcessState, error)

+ type State struct

+ CgroupPaths map[string]string

+ Config configs.Config

+ ExternalDescriptors []string

+ ID string

+ InitProcessPid int

+ InitProcessStartTime string

+ NamespacePaths map[configs.NamespaceType]string

+ type Stats struct — linux/amd64, windows/amd64

+ CgroupStats *cgroups.Stats

+ Interfaces []*NetworkInterface

+ type Status int

+ const Checkpointed

+ const Destroyed

+ const Paused

+ const Pausing

+ const Running