[DO NOT MERGE] vendor: bump opencontainers/cgroups to v0.0.9 - #5398
Closed
kolyshkin wants to merge 3 commits into
Closed
[DO NOT MERGE] vendor: bump opencontainers/cgroups to v0.0.9#5398kolyshkin wants to merge 3 commits into
kolyshkin wants to merge 3 commits into
Conversation
kolyshkin
force-pushed
the
cgroups-head
branch
2 times, most recently
from
August 13, 2026 22:32
593b90e to
e45deb9
Compare
kolyshkin
changed the title
On Ubuntu 24.04 runners, kernel.apparmor_restrict_unprivileged_userns is set to 1, so an unconfined process that creates a user namespace is transitioned to the unprivileged_userns AppArmor profile, which denies CAP_SYS_ADMIN. As a result, rootless runc creates and maps the user namespace fine and then fails to unshare the remaining ones: runc create failed: unable to start container process: can't get final child's PID from pipe: EOF; runc init error(s): nsexec-1: failed to unshare remaining namespaces: Operation not permitted and dmesg shows: apparmor="AUDIT" operation="userns_create" info="Userns create - transitioning profile" profile="unconfined" comm="runc:[1:CHILD]" target="unprivileged_userns" apparmor="DENIED" operation="capable" profile="unprivileged_userns" comm="runc:[1:CHILD]" capability=21 capname="sys_admin" Use the same workaround as in test.yml: load an AppArmor profile for the runc binary being tested. This went unnoticed because the conmon tests skip when the test image can't be pulled, so the job was green whenever the pull failed, and only red when the tests actually ran. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
conmon's test suite skips its container tests when the test image can't be pulled, and reports the run as successful, so the conmon job here was green whenever the pull failed and red only when the tests actually ran. Bump to conmon main, which contains containers/conmon#668 turning that into a hard failure, so that this job tests what it is supposed to test. To be replaced with a conmon tag once one is released (> v2.2.1). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
The previously vendored pseudo-version (974f3a5079fe) is the commit v0.0.9 is tagged at, so no vendored code changes here. Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com> Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
kolyshkin
force-pushed
the
cgroups-head
branch
from
August 14, 2026 22:04
e45deb9 to
b44be23
Compare
Contributor
Author
|
closing in favor of #5403 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bump github.com/opencontainers/cgroups to HEAD (
v0.0.9-0.20260813001401-974f3a5079fe) to test the upcoming v0.0.9 release against runc CI.Once cgroups v0.0.9 is tagged, this will be redone with the release tag.