configs

Oct 21, 2024

Changes in this version

+ const PerLinux — linux/amd64

+ const PerLinux32 — linux/amd64

+ var IOPrioClassMapping = map[specs.IOPriorityClass]int

+ func ToSchedAttr(scheduler *Scheduler) (*unix.SchedAttr, error)

+ type BlockIODevice struct

+ Major int64

+ Minor int64

type Config

+ Domainname string

+ GIDMappings []IDMap

+ IOPriority *IOPriority

+ Personality *LinuxPersonality

+ Scheduler *Scheduler

+ TimeOffsets map[string]specs.LinuxTimeOffset

+ UIDMappings []IDMap

type Hooks

+ func (hooks Hooks) Run(name HookName, state *specs.State) error

+ type IOPriority = specs.LinuxIOPriority

+ type LinuxPersonality struct — linux/amd64

+ Domain int

type Mount — linux/amd64

+ ClearedFlags int

+ IDMapping *MountIDMapping

+ func (m *Mount) IsIDMapped() bool

+ type MountIDMapping struct — linux/amd64

+ GIDMappings []IDMap

+ Recursive bool

+ UIDMappings []IDMap

+ UserNSPath string

type NamespaceType — linux/amd64

+ const NEWTIME

type Namespaces — linux/amd64

+ func (n Namespaces) IsPrivate(t NamespaceType) bool

type Resources — linux/amd64

+ CPUIdle *int64

+ CpuBurst *uint64

+ MemoryCheckBeforeUpdate bool

+ type Scheduler = specs.Scheduler

type Seccomp

+ Flags []specs.LinuxSeccompFlag

Jun 26, 2024 GO-2024-3110

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Apr 3, 2024 GO-2024-3110

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Jun 13, 2024 GO-2024-3110

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Jan 23, 2024 GO-2024-3110

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Jan 2, 2024 GO-2024-2491 +1 more

  GO-2024-2491: Container breakout through process.cwd trickery and leaked fds in github.com/opencontainers/runc

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Nov 1, 2023 GO-2024-2491 +1 more

  GO-2024-2491: Container breakout through process.cwd trickery and leaked fds in github.com/opencontainers/runc

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Aug 10, 2023 GO-2024-2491 +1 more

  GO-2024-2491: Container breakout through process.cwd trickery and leaked fds in github.com/opencontainers/runc

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Jul 19, 2023 GO-2024-2491 +1 more

  GO-2024-2491: Container breakout through process.cwd trickery and leaked fds in github.com/opencontainers/runc

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Apr 26, 2023 GO-2024-2491 +1 more

  GO-2024-2491: Container breakout through process.cwd trickery and leaked fds in github.com/opencontainers/runc

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Apr 11, 2023 GO-2024-2491 +1 more

  GO-2024-2491: Container breakout through process.cwd trickery and leaked fds in github.com/opencontainers/runc

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Mar 29, 2023 GO-2024-2491 +1 more

  GO-2024-2491: Container breakout through process.cwd trickery and leaked fds in github.com/opencontainers/runc

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Aug 24, 2022 GO-2023-1627 +4 more

  GO-2023-1627: Opencontainers runc Incorrect Authorization vulnerability in github.com/opencontainers/runc

  GO-2023-1682: rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc in github.com/opencontainers/runc

  GO-2023-1683: runc AppArmor bypass with symlinked /proc in github.com/opencontainers/runc

  GO-2024-2491: Container breakout through process.cwd trickery and leaked fds in github.com/opencontainers/runc

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Jun 8, 2022 GO-2023-1627 +4 more

  GO-2023-1627: Opencontainers runc Incorrect Authorization vulnerability in github.com/opencontainers/runc

  GO-2023-1682: rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc in github.com/opencontainers/runc

  GO-2023-1683: runc AppArmor bypass with symlinked /proc in github.com/opencontainers/runc

  GO-2024-2491: Container breakout through process.cwd trickery and leaked fds in github.com/opencontainers/runc

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

May 5, 2022 GO-2023-1627 +4 more

  GO-2023-1627: Opencontainers runc Incorrect Authorization vulnerability in github.com/opencontainers/runc

  GO-2023-1682: rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc in github.com/opencontainers/runc

  GO-2023-1683: runc AppArmor bypass with symlinked /proc in github.com/opencontainers/runc

  GO-2024-2491: Container breakout through process.cwd trickery and leaked fds in github.com/opencontainers/runc

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Mar 28, 2022 GO-2022-0452 +5 more

  GO-2022-0452: Default inheritable capabilities for linux container should be empty in github.com/opencontainers/runc

  GO-2023-1627: Opencontainers runc Incorrect Authorization vulnerability in github.com/opencontainers/runc

  GO-2023-1682: rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc in github.com/opencontainers/runc

  GO-2023-1683: runc AppArmor bypass with symlinked /proc in github.com/opencontainers/runc

  GO-2024-2491: Container breakout through process.cwd trickery and leaked fds in github.com/opencontainers/runc

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Jan 17, 2022 GO-2022-0452 +5 more

  GO-2022-0452: Default inheritable capabilities for linux container should be empty in github.com/opencontainers/runc

  GO-2023-1627: Opencontainers runc Incorrect Authorization vulnerability in github.com/opencontainers/runc

  GO-2023-1682: rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc in github.com/opencontainers/runc

  GO-2023-1683: runc AppArmor bypass with symlinked /proc in github.com/opencontainers/runc

  GO-2024-2491: Container breakout through process.cwd trickery and leaked fds in github.com/opencontainers/runc

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Changes in this version

+ func KnownHookNames() []string

type Action

+ const KillProcess

+ const KillThread

+ const Notify

type Cgroup — linux/amd64

+ OwnerUID *int

+ Rootless bool

+ Systemd bool

type IntelRdt

+ ClosID string

+ type LinuxRdma struct

+ HcaHandles *uint32

+ HcaObjects *uint32

type Mount

+ RecAttr *unix.MountAttr

+ func (m *Mount) IsBind() bool

type Resources — linux/amd64

+ Rdma map[string]LinuxRdma

type Seccomp

+ ListenerMetadata string

+ ListenerPath string

Dec 14, 2021 GO-2022-0274 +6 more

  GO-2022-0274: Namespace restriction bypass in github.com/opencontainers/runc

  GO-2022-0452: Default inheritable capabilities for linux container should be empty in github.com/opencontainers/runc

  GO-2023-1627: Opencontainers runc Incorrect Authorization vulnerability in github.com/opencontainers/runc

  GO-2023-1682: rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc in github.com/opencontainers/runc

  GO-2023-1683: runc AppArmor bypass with symlinked /proc in github.com/opencontainers/runc

  GO-2024-2491: Container breakout through process.cwd trickery and leaked fds in github.com/opencontainers/runc

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Dec 3, 2021 GO-2022-0274 +6 more

  GO-2022-0274: Namespace restriction bypass in github.com/opencontainers/runc

  GO-2022-0452: Default inheritable capabilities for linux container should be empty in github.com/opencontainers/runc

  GO-2023-1627: Opencontainers runc Incorrect Authorization vulnerability in github.com/opencontainers/runc

  GO-2023-1682: rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc in github.com/opencontainers/runc

  GO-2023-1683: runc AppArmor bypass with symlinked /proc in github.com/opencontainers/runc

  GO-2024-2491: Container breakout through process.cwd trickery and leaked fds in github.com/opencontainers/runc

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Aug 20, 2021 GO-2022-0274 +6 more

  GO-2022-0274: Namespace restriction bypass in github.com/opencontainers/runc

  GO-2022-0452: Default inheritable capabilities for linux container should be empty in github.com/opencontainers/runc

  GO-2023-1627: Opencontainers runc Incorrect Authorization vulnerability in github.com/opencontainers/runc

  GO-2023-1682: rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc in github.com/opencontainers/runc

  GO-2023-1683: runc AppArmor bypass with symlinked /proc in github.com/opencontainers/runc

  GO-2024-2491: Container breakout through process.cwd trickery and leaked fds in github.com/opencontainers/runc

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Changes in this version

type Resources — linux/amd64

+ SkipFreezeOnSet bool

Jul 16, 2021 GO-2022-0274 +6 more

  GO-2022-0274: Namespace restriction bypass in github.com/opencontainers/runc

  GO-2022-0452: Default inheritable capabilities for linux container should be empty in github.com/opencontainers/runc

  GO-2023-1627: Opencontainers runc Incorrect Authorization vulnerability in github.com/opencontainers/runc

  GO-2023-1682: rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc in github.com/opencontainers/runc

  GO-2023-1683: runc AppArmor bypass with symlinked /proc in github.com/opencontainers/runc

  GO-2024-2491: Container breakout through process.cwd trickery and leaked fds in github.com/opencontainers/runc

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Jun 17, 2021 GO-2022-0452 +5 more

  GO-2022-0452: Default inheritable capabilities for linux container should be empty in github.com/opencontainers/runc

  GO-2023-1627: Opencontainers runc Incorrect Authorization vulnerability in github.com/opencontainers/runc

  GO-2023-1682: rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc in github.com/opencontainers/runc

  GO-2023-1683: runc AppArmor bypass with symlinked /proc in github.com/opencontainers/runc

  GO-2024-2491: Container breakout through process.cwd trickery and leaked fds in github.com/opencontainers/runc

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Changes in this version

+ const EXT_COPYUP

+ func NsName(ns NamespaceType) string — linux/amd64

type Action

+ const Log

+ type Capabilities struct

+ Ambient []string

+ Bounding []string

+ Effective []string

+ Inheritable []string

+ Permitted []string

type Cgroup — linux/amd64

+ SystemdProps []systemdDbus.Property

type Config — linux/amd64

+ IntelRdt *IntelRdt

+ NoNewKeyring bool

+ RootlessCgroups bool

+ RootlessEUID bool

+ Umask *uint32

+ func (c Config) HostRootGID() (int, error)

+ func (c Config) HostRootUID() (int, error)

+ type HookList []Hook

+ func (hooks HookList) RunHooks(state *specs.State) error

+ type HookName string

+ const CreateContainer

+ const CreateRuntime

+ const Poststart

+ const Poststop

+ const Prestart

+ const StartContainer

+ type IntelRdt struct

+ L3CacheSchema string

+ MemBwSchema string

type Mount

+ Extensions int

type NamespaceType — linux/amd64

+ const NEWCGROUP

type Resources — linux/amd64

+ CpuWeight uint64

+ SkipDevices bool

+ Unified map[string]string

type Seccomp

+ DefaultErrnoRet *uint

type Syscall

+ ErrnoRet *uint

type ThrottleDevice

+ func (td *ThrottleDevice) StringName(name string) string

May 19, 2021 GO-2022-0452 +5 more

  GO-2022-0452: Default inheritable capabilities for linux container should be empty in github.com/opencontainers/runc

  GO-2023-1627: Opencontainers runc Incorrect Authorization vulnerability in github.com/opencontainers/runc

  GO-2023-1682: rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc in github.com/opencontainers/runc

  GO-2023-1683: runc AppArmor bypass with symlinked /proc in github.com/opencontainers/runc

  GO-2024-2491: Container breakout through process.cwd trickery and leaked fds in github.com/opencontainers/runc

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

May 10, 2021 GO-2022-0452 +5 more

  GO-2022-0452: Default inheritable capabilities for linux container should be empty in github.com/opencontainers/runc

  GO-2022-0914: mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs in github.com/opencontainers/runc

  GO-2023-1682: rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc in github.com/opencontainers/runc

  GO-2023-1683: runc AppArmor bypass with symlinked /proc in github.com/opencontainers/runc

  GO-2024-2491: Container breakout through process.cwd trickery and leaked fds in github.com/opencontainers/runc

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Feb 3, 2021 GO-2022-0452 +5 more

  GO-2022-0452: Default inheritable capabilities for linux container should be empty in github.com/opencontainers/runc

  GO-2022-0914: mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs in github.com/opencontainers/runc

  GO-2023-1682: rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc in github.com/opencontainers/runc

  GO-2023-1683: runc AppArmor bypass with symlinked /proc in github.com/opencontainers/runc

  GO-2024-2491: Container breakout through process.cwd trickery and leaked fds in github.com/opencontainers/runc

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Aug 5, 2020 GO-2022-0452 +4 more

  GO-2022-0452: Default inheritable capabilities for linux container should be empty in github.com/opencontainers/runc

  GO-2022-0914: mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs in github.com/opencontainers/runc

  GO-2023-1682: rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc in github.com/opencontainers/runc

  GO-2023-1683: runc AppArmor bypass with symlinked /proc in github.com/opencontainers/runc

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Jun 30, 2020 GO-2022-0452 +4 more

  GO-2022-0452: Default inheritable capabilities for linux container should be empty in github.com/opencontainers/runc

  GO-2022-0914: mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs in github.com/opencontainers/runc

  GO-2023-1682: rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc in github.com/opencontainers/runc

  GO-2023-1683: runc AppArmor bypass with symlinked /proc in github.com/opencontainers/runc

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Jan 22, 2020 GO-2022-0396 +5 more

  GO-2022-0396: devices resource list treated as a blacklist by default in github.com/opencontainers/runc

  GO-2022-0452: Default inheritable capabilities for linux container should be empty in github.com/opencontainers/runc

  GO-2022-0914: mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs in github.com/opencontainers/runc

  GO-2023-1682: rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc in github.com/opencontainers/runc

  GO-2023-1683: runc AppArmor bypass with symlinked /proc in github.com/opencontainers/runc

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Sep 30, 2019 GO-2021-0087 +6 more

  GO-2021-0087: Race condition in github.com/opencontainers/runc

  GO-2022-0396: devices resource list treated as a blacklist by default in github.com/opencontainers/runc

  GO-2022-0452: Default inheritable capabilities for linux container should be empty in github.com/opencontainers/runc

  GO-2022-0914: mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs in github.com/opencontainers/runc

  GO-2023-1682: rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc in github.com/opencontainers/runc

  GO-2023-1683: runc AppArmor bypass with symlinked /proc in github.com/opencontainers/runc

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Apr 24, 2019 GO-2021-0085 +7 more

  GO-2021-0085: Authorization bypass in github.com/opencontainers/runc

  GO-2021-0087: Race condition in github.com/opencontainers/runc

  GO-2022-0396: devices resource list treated as a blacklist by default in github.com/opencontainers/runc

  GO-2022-0452: Default inheritable capabilities for linux container should be empty in github.com/opencontainers/runc

  GO-2022-0914: mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs in github.com/opencontainers/runc

  GO-2023-1682: rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc in github.com/opencontainers/runc

  GO-2023-1683: runc AppArmor bypass with symlinked /proc in github.com/opencontainers/runc

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Mar 28, 2019 GO-2021-0085 +7 more

  GO-2021-0085: Authorization bypass in github.com/opencontainers/runc

  GO-2021-0087: Race condition in github.com/opencontainers/runc

  GO-2022-0396: devices resource list treated as a blacklist by default in github.com/opencontainers/runc

  GO-2022-0452: Default inheritable capabilities for linux container should be empty in github.com/opencontainers/runc

  GO-2022-0914: mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs in github.com/opencontainers/runc

  GO-2023-1682: rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc in github.com/opencontainers/runc

  GO-2023-1683: runc AppArmor bypass with symlinked /proc in github.com/opencontainers/runc

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Nov 21, 2018 GO-2021-0085 +7 more

  GO-2021-0085: Authorization bypass in github.com/opencontainers/runc

  GO-2021-0087: Race condition in github.com/opencontainers/runc

  GO-2022-0396: devices resource list treated as a blacklist by default in github.com/opencontainers/runc

  GO-2022-0452: Default inheritable capabilities for linux container should be empty in github.com/opencontainers/runc

  GO-2022-0914: mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs in github.com/opencontainers/runc

  GO-2023-1682: rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc in github.com/opencontainers/runc

  GO-2023-1683: runc AppArmor bypass with symlinked /proc in github.com/opencontainers/runc

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Feb 27, 2018 GO-2021-0085 +7 more

  GO-2021-0085: Authorization bypass in github.com/opencontainers/runc

  GO-2021-0087: Race condition in github.com/opencontainers/runc

  GO-2022-0396: devices resource list treated as a blacklist by default in github.com/opencontainers/runc

  GO-2022-0452: Default inheritable capabilities for linux container should be empty in github.com/opencontainers/runc

  GO-2022-0914: mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs in github.com/opencontainers/runc

  GO-2023-1682: rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc in github.com/opencontainers/runc

  GO-2023-1683: runc AppArmor bypass with symlinked /proc in github.com/opencontainers/runc

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Aug 2, 2017 GO-2021-0085 +7 more

  GO-2021-0085: Authorization bypass in github.com/opencontainers/runc

  GO-2021-0087: Race condition in github.com/opencontainers/runc

  GO-2022-0396: devices resource list treated as a blacklist by default in github.com/opencontainers/runc

  GO-2022-0452: Default inheritable capabilities for linux container should be empty in github.com/opencontainers/runc

  GO-2022-0914: mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs in github.com/opencontainers/runc

  GO-2023-1682: rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc in github.com/opencontainers/runc

  GO-2023-1683: runc AppArmor bypass with symlinked /proc in github.com/opencontainers/runc

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Mar 21, 2017 GO-2021-0085 +7 more

  GO-2021-0085: Authorization bypass in github.com/opencontainers/runc

  GO-2021-0087: Race condition in github.com/opencontainers/runc

  GO-2022-0396: devices resource list treated as a blacklist by default in github.com/opencontainers/runc

  GO-2022-0452: Default inheritable capabilities for linux container should be empty in github.com/opencontainers/runc

  GO-2022-0914: mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs in github.com/opencontainers/runc

  GO-2023-1682: rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc in github.com/opencontainers/runc

  GO-2023-1683: runc AppArmor bypass with symlinked /proc in github.com/opencontainers/runc

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Sep 29, 2016 GO-2021-0085 +8 more

  GO-2021-0085: Authorization bypass in github.com/opencontainers/runc

  GO-2021-0087: Race condition in github.com/opencontainers/runc

  GO-2022-0396: devices resource list treated as a blacklist by default in github.com/opencontainers/runc

  GO-2022-0452: Default inheritable capabilities for linux container should be empty in github.com/opencontainers/runc

  GO-2022-0835: Information Exposure in RunC in github.com/opencontainers/runc

  GO-2022-0914: mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs in github.com/opencontainers/runc

  GO-2023-1682: rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc in github.com/opencontainers/runc

  GO-2023-1683: runc AppArmor bypass with symlinked /proc in github.com/opencontainers/runc

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Jan 22, 2020 GO-2021-0085 +8 more

  GO-2021-0085: Authorization bypass in github.com/opencontainers/runc

  GO-2021-0087: Race condition in github.com/opencontainers/runc

  GO-2022-0396: devices resource list treated as a blacklist by default in github.com/opencontainers/runc

  GO-2022-0452: Default inheritable capabilities for linux container should be empty in github.com/opencontainers/runc

  GO-2022-0835: Information Exposure in RunC in github.com/opencontainers/runc

  GO-2022-0914: mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs in github.com/opencontainers/runc

  GO-2023-1682: rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc in github.com/opencontainers/runc

  GO-2023-1683: runc AppArmor bypass with symlinked /proc in github.com/opencontainers/runc

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Jun 3, 2016 GO-2021-0085 +8 more

  GO-2021-0085: Authorization bypass in github.com/opencontainers/runc

  GO-2021-0087: Race condition in github.com/opencontainers/runc

  GO-2022-0396: devices resource list treated as a blacklist by default in github.com/opencontainers/runc

  GO-2022-0452: Default inheritable capabilities for linux container should be empty in github.com/opencontainers/runc

  GO-2022-0835: Information Exposure in RunC in github.com/opencontainers/runc

  GO-2022-0914: mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs in github.com/opencontainers/runc

  GO-2023-1682: rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc in github.com/opencontainers/runc

  GO-2023-1683: runc AppArmor bypass with symlinked /proc in github.com/opencontainers/runc

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Apr 25, 2016 GO-2021-0085 +8 more

  GO-2021-0085: Authorization bypass in github.com/opencontainers/runc

  GO-2021-0087: Race condition in github.com/opencontainers/runc

  GO-2022-0396: devices resource list treated as a blacklist by default in github.com/opencontainers/runc

  GO-2022-0452: Default inheritable capabilities for linux container should be empty in github.com/opencontainers/runc

  GO-2022-0835: Information Exposure in RunC in github.com/opencontainers/runc

  GO-2022-0914: mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs in github.com/opencontainers/runc

  GO-2023-1682: rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc in github.com/opencontainers/runc

  GO-2023-1683: runc AppArmor bypass with symlinked /proc in github.com/opencontainers/runc

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Apr 12, 2016 GO-2021-0085 +8 more

  GO-2021-0085: Authorization bypass in github.com/opencontainers/runc

  GO-2021-0087: Race condition in github.com/opencontainers/runc

  GO-2022-0396: devices resource list treated as a blacklist by default in github.com/opencontainers/runc

  GO-2022-0452: Default inheritable capabilities for linux container should be empty in github.com/opencontainers/runc

  GO-2022-0835: Information Exposure in RunC in github.com/opencontainers/runc

  GO-2022-0914: mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs in github.com/opencontainers/runc

  GO-2023-1682: rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc in github.com/opencontainers/runc

  GO-2023-1683: runc AppArmor bypass with symlinked /proc in github.com/opencontainers/runc

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Changes in this version

type Command

+ Timeout *time.Duration

type HookState

+ BundlePath string

type Resources — linux/amd64

+ KernelMemoryTCP int64

Mar 10, 2016 GO-2021-0070 +9 more

  GO-2021-0070: Privilege escalation in github.com/opencontainers/runc

  GO-2021-0085: Authorization bypass in github.com/opencontainers/runc

  GO-2021-0087: Race condition in github.com/opencontainers/runc

  GO-2022-0396: devices resource list treated as a blacklist by default in github.com/opencontainers/runc

  GO-2022-0452: Default inheritable capabilities for linux container should be empty in github.com/opencontainers/runc

  GO-2022-0835: Information Exposure in RunC in github.com/opencontainers/runc

  GO-2022-0914: mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs in github.com/opencontainers/runc

  GO-2023-1682: rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc in github.com/opencontainers/runc

  GO-2023-1683: runc AppArmor bypass with symlinked /proc in github.com/opencontainers/runc

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Changes in this version

+ func IsNamespaceSupported(ns NamespaceType) bool — linux/amd64

type Config

+ Labels []string

+ NoNewPrivileges bool

type Hooks

+ func (hooks *Hooks) UnmarshalJSON(b []byte) error

+ func (hooks Hooks) MarshalJSON() ([]byte, error)

type Namespaces — linux/amd64

+ func (n *Namespaces) PathOf(t NamespaceType) string

Feb 10, 2016 GO-2021-0070 +9 more

  GO-2021-0070: Privilege escalation in github.com/opencontainers/runc

  GO-2021-0085: Authorization bypass in github.com/opencontainers/runc

  GO-2021-0087: Race condition in github.com/opencontainers/runc

  GO-2022-0396: devices resource list treated as a blacklist by default in github.com/opencontainers/runc

  GO-2022-0452: Default inheritable capabilities for linux container should be empty in github.com/opencontainers/runc

  GO-2022-0835: Information Exposure in RunC in github.com/opencontainers/runc

  GO-2022-0914: mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs in github.com/opencontainers/runc

  GO-2023-1682: rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc in github.com/opencontainers/runc

  GO-2023-1683: runc AppArmor bypass with symlinked /proc in github.com/opencontainers/runc

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Changes in this version

type Cgroup — linux/amd64

+ Path string

type Device

+ Allow bool

type Resources — linux/amd64

+ Devices []*Device

Jan 26, 2016 GO-2021-0070 +9 more

  GO-2021-0070: Privilege escalation in github.com/opencontainers/runc

  GO-2021-0085: Authorization bypass in github.com/opencontainers/runc

  GO-2021-0087: Race condition in github.com/opencontainers/runc

  GO-2022-0396: devices resource list treated as a blacklist by default in github.com/opencontainers/runc

  GO-2022-0452: Default inheritable capabilities for linux container should be empty in github.com/opencontainers/runc

  GO-2022-0835: Information Exposure in RunC in github.com/opencontainers/runc

  GO-2022-0914: mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs in github.com/opencontainers/runc

  GO-2023-1682: rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc in github.com/opencontainers/runc

  GO-2023-1683: runc AppArmor bypass with symlinked /proc in github.com/opencontainers/runc

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Changes in this version

type Cgroup — linux/amd64

+ Paths map[string]string

+ type Resources struct — linux/amd64

+ AllowAllDevices bool

+ AllowedDevices []*Device

+ BlkioLeafWeight uint16

+ BlkioThrottleReadBpsDevice []*ThrottleDevice

+ BlkioThrottleReadIOPSDevice []*ThrottleDevice

+ BlkioThrottleWriteBpsDevice []*ThrottleDevice

+ BlkioThrottleWriteIOPSDevice []*ThrottleDevice

+ BlkioWeight uint16

+ BlkioWeightDevice []*WeightDevice

+ CpuPeriod int64

+ CpuQuota int64

+ CpuRtPeriod int64

+ CpuRtRuntime int64

+ CpuShares int64

+ CpusetCpus string

+ CpusetMems string

+ DeniedDevices []*Device

+ Freezer FreezerState

+ HugetlbLimit []*HugepageLimit

+ KernelMemory int64

+ Memory int64

+ MemoryReservation int64

+ MemorySwap int64

+ MemorySwappiness int64

+ NetClsClassid string

+ NetPrioIfpriomap []*IfPrioMap

+ OomKillDisable bool

+ PidsLimit int64

Dec 11, 2015 GO-2021-0070 +9 more

  GO-2021-0070: Privilege escalation in github.com/opencontainers/runc

  GO-2021-0085: Authorization bypass in github.com/opencontainers/runc

  GO-2021-0087: Race condition in github.com/opencontainers/runc

  GO-2022-0396: devices resource list treated as a blacklist by default in github.com/opencontainers/runc

  GO-2022-0452: Default inheritable capabilities for linux container should be empty in github.com/opencontainers/runc

  GO-2022-0835: Information Exposure in RunC in github.com/opencontainers/runc

  GO-2022-0914: mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs in github.com/opencontainers/runc

  GO-2023-1682: rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc in github.com/opencontainers/runc

  GO-2023-1683: runc AppArmor bypass with symlinked /proc in github.com/opencontainers/runc

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Changes in this version

type Cgroup — linux/amd64

+ ScopePrefix string

Nov 20, 2015 GO-2021-0070 +9 more

  GO-2021-0070: Privilege escalation in github.com/opencontainers/runc

  GO-2021-0085: Authorization bypass in github.com/opencontainers/runc

  GO-2021-0087: Race condition in github.com/opencontainers/runc

  GO-2022-0396: devices resource list treated as a blacklist by default in github.com/opencontainers/runc

  GO-2022-0452: Default inheritable capabilities for linux container should be empty in github.com/opencontainers/runc

  GO-2022-0835: Information Exposure in RunC in github.com/opencontainers/runc

  GO-2022-0914: mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs in github.com/opencontainers/runc

  GO-2023-1682: rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc in github.com/opencontainers/runc

  GO-2023-1683: runc AppArmor bypass with symlinked /proc in github.com/opencontainers/runc

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Changes in this version

type Action

+ const Trace

type Cgroup — linux/amd64

+ BlkioLeafWeight uint16

+ BlkioThrottleReadIOPSDevice []*ThrottleDevice

+ BlkioThrottleWriteIOPSDevice []*ThrottleDevice

type Config

+ RootPropagation int

+ Version string

type HookState

+ Version string

type Hooks

+ Poststart []Hook

type Mount

+ PropagationFlags []int

+ type Namespace struct — darwin/amd64, js/wasm

+ func (n *Namespace) Syscall() int

type Seccomp

+ Architectures []string

+ type ThrottleDevice struct

+ Rate uint64

+ func NewThrottleDevice(major, minor int64, rate uint64) *ThrottleDevice

+ func (td *ThrottleDevice) String() string

+ type WeightDevice struct

+ LeafWeight uint16

+ Weight uint16

+ func NewWeightDevice(major, minor int64, weight, leafWeight uint16) *WeightDevice

+ func (wd *WeightDevice) LeafWeightString() string

+ func (wd *WeightDevice) WeightString() string

Sep 11, 2015 GO-2021-0070 +9 more

  GO-2021-0070: Privilege escalation in github.com/opencontainers/runc

  GO-2021-0085: Authorization bypass in github.com/opencontainers/runc

  GO-2021-0087: Race condition in github.com/opencontainers/runc

  GO-2022-0396: devices resource list treated as a blacklist by default in github.com/opencontainers/runc

  GO-2022-0452: Default inheritable capabilities for linux container should be empty in github.com/opencontainers/runc

  GO-2022-0835: Information Exposure in RunC in github.com/opencontainers/runc

  GO-2022-0914: mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs in github.com/opencontainers/runc

  GO-2023-1682: rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc in github.com/opencontainers/runc

  GO-2023-1683: runc AppArmor bypass with symlinked /proc in github.com/opencontainers/runc

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Changes in this version

type Action

+ const Errno

type Arg

+ ValueTwo uint64

type Command

+ func (c Command) Run(s HookState) error

+ type CommandHook struct

+ func NewCommandHook(cmd Command) CommandHook

type Config

+ Hooks *Hooks

+ OomScoreAdj int

+ type FuncHook struct

+ func NewFunctionHook(f func(HookState) error) FuncHook

+ func (f FuncHook) Run(s HookState) error

+ type Hook interface

+ Run func(HookState) error

+ type HookState struct

+ ID string

+ Pid int

+ Root string

+ type Hooks struct

+ Poststop []Hook

+ Prestart []Hook

type Operator

+ const GreaterThan

+ const GreaterThanOrEqualTo

+ const LessThanOrEqualTo

type Seccomp

+ DefaultAction Action

type Syscall

+ Name string

Aug 4, 2015 GO-2021-0070 +9 more

  GO-2021-0070: Privilege escalation in github.com/opencontainers/runc

  GO-2021-0085: Authorization bypass in github.com/opencontainers/runc

  GO-2021-0087: Race condition in github.com/opencontainers/runc

  GO-2022-0396: devices resource list treated as a blacklist by default in github.com/opencontainers/runc

  GO-2022-0452: Default inheritable capabilities for linux container should be empty in github.com/opencontainers/runc

  GO-2022-0835: Information Exposure in RunC in github.com/opencontainers/runc

  GO-2022-0914: mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs in github.com/opencontainers/runc

  GO-2023-1682: rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc in github.com/opencontainers/runc

  GO-2023-1683: runc AppArmor bypass with symlinked /proc in github.com/opencontainers/runc

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Jul 17, 2015 GO-2021-0070 +9 more

  GO-2021-0070: Privilege escalation in github.com/opencontainers/runc

  GO-2021-0085: Authorization bypass in github.com/opencontainers/runc

  GO-2021-0087: Race condition in github.com/opencontainers/runc

  GO-2022-0396: devices resource list treated as a blacklist by default in github.com/opencontainers/runc

  GO-2022-0452: Default inheritable capabilities for linux container should be empty in github.com/opencontainers/runc

  GO-2022-0835: Information Exposure in RunC in github.com/opencontainers/runc

  GO-2022-0914: mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs in github.com/opencontainers/runc

  GO-2023-1682: rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc in github.com/opencontainers/runc

  GO-2023-1683: runc AppArmor bypass with symlinked /proc in github.com/opencontainers/runc

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Jul 16, 2015 GO-2021-0070 +9 more

  GO-2021-0070: Privilege escalation in github.com/opencontainers/runc

  GO-2021-0085: Authorization bypass in github.com/opencontainers/runc

  GO-2021-0087: Race condition in github.com/opencontainers/runc

  GO-2022-0396: devices resource list treated as a blacklist by default in github.com/opencontainers/runc

  GO-2022-0452: Default inheritable capabilities for linux container should be empty in github.com/opencontainers/runc

  GO-2022-0835: Information Exposure in RunC in github.com/opencontainers/runc

  GO-2022-0914: mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs in github.com/opencontainers/runc

  GO-2023-1682: rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc in github.com/opencontainers/runc

  GO-2023-1683: runc AppArmor bypass with symlinked /proc in github.com/opencontainers/runc

  GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Changes in this version

+ const Wildcard

+ var DefaultAllowedDevices = append([]*Device{ ... }, DefaultSimpleDevices) — linux/amd64

+ var DefaultAutoCreatedDevices = append([]*Device{ ... }, DefaultSimpleDevices) — linux/amd64

+ var DefaultSimpleDevices = []*Device — linux/amd64

+ type Action int

+ const Allow

+ const Kill

+ const Trap

+ type Arg struct

+ Index int

+ Op Operator

+ Value uint32

+ type Cgroup struct

+ AllowAllDevices bool

+ AllowedDevices []*Device

+ BlkioThrottleReadBpsDevice string

+ BlkioThrottleReadIOpsDevice string

+ BlkioThrottleWriteBpsDevice string

+ BlkioThrottleWriteIOpsDevice string

+ BlkioWeight int64

+ BlkioWeightDevice string

+ CpuPeriod int64

+ CpuQuota int64

+ CpuRtPeriod int64

+ CpuRtRuntime int64

+ CpuShares int64

+ CpusetCpus string

+ CpusetMems string

+ DeniedDevices []*Device

+ Freezer FreezerState

+ HugetlbLimit []*HugepageLimit

+ KernelMemory int64

+ Memory int64

+ MemoryReservation int64

+ MemorySwap int64

+ MemorySwappiness int64

+ Name string

+ NetClsClassid string

+ NetPrioIfpriomap []*IfPrioMap

+ OomKillDisable bool

+ Parent string

+ Slice string

+ type Command struct

+ Args []string

+ Dir string

+ Env []string

+ Path string

+ type Config struct

+ AdditionalGroups []string

+ AppArmorProfile string

+ Capabilities []string

+ Cgroups *Cgroup

+ Devices []*Device

+ GidMappings []IDMap

+ Hostname string

+ MaskPaths []string

+ MountLabel string

+ Mounts []*Mount

+ Namespaces Namespaces

+ Networks []*Network

+ NoPivotRoot bool

+ ParentDeathSignal int

+ PivotDir string

+ Privatefs bool

+ ProcessLabel string

+ ReadonlyPaths []string

+ Readonlyfs bool

+ Rlimits []Rlimit

+ Rootfs string

+ Routes []*Route

+ Seccomp *Seccomp

+ Sysctl map[string]string

+ UidMappings []IDMap

+ func (c Config) HostGID() (int, error)

+ func (c Config) HostUID() (int, error)

+ type Device struct

+ FileMode os.FileMode

+ Gid uint32

+ Major int64

+ Minor int64

+ Path string

+ Permissions string

+ Type rune

+ Uid uint32

+ func (d *Device) CgroupString() string

+ func (d *Device) Mkdev() int

+ type FreezerState string

+ const Frozen

+ const Thawed

+ const Undefined

+ type HugepageLimit struct

+ Limit int

+ Pagesize string

+ type IDMap struct

+ ContainerID int

+ HostID int

+ Size int

+ type IfPrioMap struct

+ Interface string

+ Priority int64

+ func (i *IfPrioMap) CgroupString() string

+ type Mount struct

+ Data string

+ Destination string

+ Device string

+ Flags int

+ PostmountCmds []Command

+ PremountCmds []Command

+ Relabel string

+ Source string

+ type Namespace struct — linux/amd64, windows/amd64

+ Path string

+ Type NamespaceType

+ func (n *Namespace) GetPath(pid int) string

+ func (n *Namespace) Syscall() int

+ type NamespaceType string

+ const NEWIPC

+ const NEWNET

+ const NEWNS

+ const NEWPID

+ const NEWUSER

+ const NEWUTS

+ func NamespaceTypes() []NamespaceType

+ type Namespaces []Namespace

+ func (n *Namespaces) Add(t NamespaceType, path string)

+ func (n *Namespaces) CloneFlags() uintptr

+ func (n *Namespaces) Contains(t NamespaceType) bool

+ func (n *Namespaces) Remove(t NamespaceType) bool

+ type Network struct

+ Address string

+ Bridge string

+ Gateway string

+ HairpinMode bool

+ HostInterfaceName string

+ IPv6Address string

+ IPv6Gateway string

+ MacAddress string

+ Mtu int

+ Name string

+ TxQueueLen int

+ Type string

+ type Operator int

+ const EqualTo

+ const GreatherThan

+ const LessThan

+ const MaskEqualTo

+ const NotEqualTo

+ type Rlimit struct

+ Hard uint64

+ Soft uint64

+ Type int

+ type Route struct

+ Destination string

+ Gateway string

+ InterfaceName string

+ Source string

+ type Seccomp struct

+ Syscalls []*Syscall

+ type Syscall struct

+ Action Action

+ Args []*Arg

+ Value int