This is the first release candidate of the upcoming runc 1.6.0 release.
It contains a couple of new features, but is mostly made up of various
cleanups (such as the removal of many deprecated APIs) and improvements.

This version includes all of the patches backported to runc v1.5.2.

Users are strongly encouraged to test our release candidates so we can
fix issues before the general release.

libcontainer API

• configs.ToCPUSet now returns a unix.CPUSetDynamic instead of a
  *unix.CPUSet, and the Initial/Final fields of configs.CPUAffinity and
  the Nodes field of configs.LinuxMemoryPolicy have changed type
  accordingly. This lifts the previous 1024 CPUs/nodes limit. (#5343)
• The deprecated libcontainer/devices package has been removed. Use
  github.com/moby/sys/devices instead. (#5142, #5223, #5495)
• The deprecated RecvFile, SendFile, and SendRawFd functions have been
  removed from libcontainer/utils. (#5227, #5231, #5495)

Removed

• The deprecated EXTRA_BUILDTAGS make variable has been removed, and setting
  it is now an error. Use RUNC_BUILDTAGS instead. (#5171, #5198, #5511)

Fixed

• The poststart hooks are now executed after starting the user-specified
  process, fixing a runtime-spec conformance issue. (#4347, #5186)
• process.user.umask is now honored for a container which does not have its
  own mount namespace. Previously it was silently ignored, and not even the
  default umask of 022 was set. (#5479)
• When an AppArmor profile is not loaded, runc now says so explicitly and
  names the profile, instead of returning a confusing no such file or directory error about a procfs file. (#5438, #5441)

Changed

• runc now requires Go 1.26+ to build. (#5413)
• The runc binary is now built with the urfave_cli_no_template build tag,
  which, together with removing the reflect-based logging of CRIU options,
  re-enables the linker's dead code elimination of exported methods. As a
  result, the runc binary shrunk by about 2 MB (15%) on amd64. (#5486, #5506)
• The cpuAffinity and NUMA memoryPolicy settings are no longer limited
  to 1024 CPUs/nodes, as runc now uses a dynamically-sized CPU mask. (#5343)
• A container configuration which asks for a read-only rootfs
  (root.readonly), a read-only tmpfs mount, or a read-only /dev, but does
  not have its own mount namespace, is now refused. Previously such a
  container was silently started with those filesystems left writable, since
  making them read-only requires a remount, which is only possible in a
  private mount namespace. This is consistent with how maskedPaths and
  readonlyPaths, which have the same requirement, were already treated.
  (#5371, #5479)
• Switched from urfave/cli v1 (which is in maintenance mode) to v3. The
  command-line syntax is intended to remain the same, but the help output
  looks different. Please report any regressions in command-line parsing.
  The urfave_cli_no_docs build tag is no longer used. (#5184)
• runc start now waits for the container's init process using poll(2) and
  pidfd (where available), instead of a goroutine with a 100ms polling
  timeout. (#5251, #5271)
• runc no longer sets up a signal forwarder for detached containers, as
  there is nothing to forward the signals to. (#4661)

Static Linking Notices

The runc binaries distributed with this release are statically linked with
the following GNU LGPL-2.1 licensed libraries, with runc acting
as a "work that uses the Library":

• libseccomp

Similarly, the runc binaries distributed with this release are also
statically linked with the following MPLv2 licensed libraries,
with runc acting as a "Larger Work":

• libpathrs

The versions of these libraries were not modified from their upstream versions,
but in order to comply with their corresponding licenses, we have attached the
complete source code for those libraries which (when combined with the attached
runc source code) may be used to exercise your rights under their respective
licenses.

However, we strongly suggest that you make use of your distribution's packages
or download them from the authoritative upstream sources, especially since
these libraries are related to the security of your containers.

Thanks to the following contributors who made this release possible:

• Akihiro Suda akihiro.suda.cz@hco.ntt.co.jp
• Aleksa Sarai cyphar@cyphar.com
• Erik Sjölund erik.sjolund@gmail.com
• Kir Kolyshkin kolyshkin@gmail.com
• Li Fu Bang lifubang@acmcoder.com
• Mohammed Aminu Futa mohammedfuta2000@gmail.com
• ningmingxiao ning.mingxiao@zte.com.cn
• Patrick Stoeckle patrick.stoeckle@siemens.com
• RedMakeUp girafeeblue@gmail.com
• Ricardo Branco rbranco@suse.de
• Rodrigo Campos rodrigo@sdfg.com.ar
• sean xujihui1985@gmail.com
• Sebastiaan van Stijn github@gone.nl
• Timothy Durward timothy.a.durward@gmail.com

Signed-off-by: Kir Kolyshkin kolyshkin@gmail.com

This is the second patch release in the 1.5.z release series of runc,
which primarily includes a workaround for a Linux kernel bug causing
random runc crashes when using cgroup v2, and other fixes.

Fixed

• runc exec -p with a process.json lacking env now sets HOME again
  (a regression in runc 1.3.0). (#5265, #5266, #5459)
• Worked around a Linux kernel bug (present since kernel v6.17, fixed in v7.2)
  which caused the kernel to write past the end of the structure
  provided by userspace (runc). This resulted in memory corruption inside runc
  (manifesting as random crashes) when configuring device rules on cgroup v2
  systems. (#5403, #5428)
• runc exec --cgroup (and the equivalent libcontainer Process.SubCgroupPaths
  API) no longer accepts a sub-cgroup path that escapes the container's cgroup
  into a sibling cgroup sharing the same name prefix. Note that using
  --cgroup requires the same privileges as running runc exec itself, so
  this is a correctness rather than a security fix. (#5403, #5457)
• Fixed a missing O_CLOEXEC when opening the cgroup v2 directory to set up
  device rules. (#5403, #5428)
• Some long-standing file-descriptor leaks on the eBPF devices cgroups were
  fixed. (#5403, #5428)
• When rootfsPropagation is set to rslave, the rootfs parent mount is no
  longer made private before pivoting into the rootfs, so unmount/remount
  events on host mountpoints under the rootfs are now propagated to the
  running container. (#5192, #5200, #5458)
• runc no longer misdetects a non-initial user namespace as the initial one
  when that namespace has a full identity ID mapping (0 0 4294967295), as
  used by systemd >= 260 units with PrivateUsers=full. Previously this made
  runc skip its user namespace code paths, so starting a container in such a
  unit failed with bpf_prog_query(BPF_CGROUP_DEVICE) failed: operation not permitted.
  (#5396, #5411, #5451, moby/sys#239)
• Fixed a runc init panic (SIGABRT) on the error path, caused by SELinux
  labels being reset after the cached libpathrs procfs handle was already
  closed. This is fixed both by not resetting the labels on the init error
  path, and by updating to libpathrs v0.2.6, which now handles a closed
  procfs handle gracefully. (#5438, #5439, #5442, #5448, #5449, #5467,
  #5469)
• Fixed various issues when the libseccomp version runc is run with differs
  from the one it was compiled against (e.g. built with libseccomp >= 2.6.0 and
  run with an older one), by updating to libseccomp-golang v0.12.0. This also
  supersedes the SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV workaround added in
  runc 1.5.1. (#5436, #5461)
• The libseccomp library statically linked into release binaries is now built
  with optimizations enabled (the default -g -O2 CFLAGS); previously it was
  built unoptimized. (#5464, #5465)

Changed

• Switched to opencontainers/cgroups v0.1.0, which no longer uses the
  high-level cilium/ebpf API to manage cgroup v2 device rules. As a result,
  the runc binary shrunk by about 1 MiB (7.5%) on amd64. This also means runc
  no longer calls the cilium/ebpf code affected by GO-2026-6238. (#5403, #5428)
• Updated golang.org/x/net to v0.55.0. (#5379, #5381)
• Updated builds to libseccomp v2.6.1. (#5376, #5460)

Static Linking Notices

The runc binaries distributed with this release are statically linked with
the following GNU LGPL-2.1 licensed libraries, with runc acting
as a "work that uses the Library":

• libseccomp

Similarly, the runc binaries distributed with this release are also
statically linked with the following MPLv2 licensed libraries,
with runc acting as a "Larger Work":

• libpathrs

The versions of these libraries were not modified from their upstream versions,
but in order to comply with their corresponding licenses, we have attached the
complete source code for those libraries which (when combined with the attached
runc source code) may be used to exercise your rights under their respective
licenses.

However, we strongly suggest that you make use of your distribution's packages
or download them from the authoritative upstream sources, especially since
these libraries are related to the security of your containers.

Thanks to the following contributors who made this release possible:

• Aleksa Sarai cyphar@cyphar.com
• Ali alliasgher123@gmail.com
• Alvaro Leiva Geisse aleivag@gmail.com
• Ciprian Hacman ciprian@hakman.dev
• Kir Kolyshkin kolyshkin@gmail.com
• Li Fu Bang lifubang@acmcoder.com
• Matthew Dabit mdabit@x.ai
• Rodrigo Campos rodrigo@amutable.com
• sean xujihui1985@gmail.com
• Sebastiaan van Stijn github@gone.nl
• xingyaner longfor2025@gmail.com

Signed-off-by: Kir Kolyshkin kolyshkin@gmail.com

This is the first patch release in the 1.5.z release series of runc, and
primarily includes a fix for a serious regression on Ubuntu 20.04
kernels.

Fixed

• There was a regression reported in with the maskPaths optimisation added in
  1.5.0-rc.3 (#5275). On Ubuntu Focal (20.04), attempts to mount tmpfs with
  the nr_inodes=1 option will fail due to a downstream kernel patch
  (ironically originating from AUFS). We now have a fallback path using
  nr_inodes=2 instead if the operation fails. (#5348, #5358, #5359)
• Properly handle EINVAL for seccomp SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV
  when trying to rewrite the filter. This appears to only happen if you compile
  runc with libseccomp >= 2.6.0 and then run it with an < 2.6.0 libseccomp.
  (#5347, #5354)

Static Linking Notices

The runc binaries distributed with this release are statically linked with
the following GNU LGPL-2.1 licensed libraries, with runc acting
as a "work that uses the Library":

• libseccomp

Similarly, the runc binaries distributed with this release are also
statically linked with the following MPLv2 licensed libraries,
with runc acting as a "Larger Work":

• libpathrs

The versions of these libraries were not modified from their upstream versions,
but in order to comply with their corresponding licenses, we have attached the
complete source code for those libraries which (when combined with the attached
runc source code) may be used to exercise your rights under their respective
licenses.

However, we strongly suggest that you make use of your distribution's packages
or download them from the authoritative upstream sources, especially since
these libraries are related to the security of your containers.

Thanks to the following contributors who made this release possible:

• Akihiro Suda akihiro.suda.cz@hco.ntt.co.jp
• Aleksa Sarai cyphar@cyphar.com
• Kir Kolyshkin kolyshkin@gmail.com
• Paco Xu roollingstone@gmail.com
• Rodrigo Campos Catelin rodrigo@amutable.com
• lifubang lifubang@acmcoder.com

Signed-off-by: Aleksa Sarai cyphar@cyphar.com

This is the somewhat-delayed^Wlong-awaited first stable release of the
1.5.z release branch of runc. It contains a handful of fixes for issues
found in 1.5.0-rc.3 and an important dependency bump for libpathrs.

This is the third release of runc following our new release and support
policy (see RELEASES.md for more details). This means that, as of this
release:

• The runc 1.2.z (and earlier) release branches are now completely
  unsupported.
• The runc 1.3.z release branch will now only receive high severity
  CVE fixes, and will no longer be supported in less than 6 months (end
  of October 2026).
• The runc 1.4.z release branch will now only recieve security and
  "significant" bugfixes.
• Users are encouraged to plan migrating to runc 1.5.0 as soon as
  possible.
• Despite this release being delayed by over a month, users should
  still expect a runc 1.6.0 release in late October 2026.

Added

• runc version and runc features now provide version information about
  libpathrs (when runc is built with the libpathrs build tag). (#5291, #5328)

Fixed

• Since runc 1.3.0, the org.opencontainers.runc.version annotation included
  in runc features contained an extraneous \n, possibly causing issues with
  tools that parse the output. It is now properly stripped. (#5329, #5330,
  #5331, #5335)

Changed

• runc (when built with the libpathrs build tag) now depends on libpathrs
  v0.2.5 or later, and attempting to build with older versions will cause
  compilation errors. (#5291, #5328)
• Switched to go-criu v8.3.0, which reduces our binary size from ~16MB to
  ~14MB. (#5312, #5326)

Static Linking Notices

The runc binaries distributed with this release are statically linked with
the following GNU LGPL-2.1 licensed libraries, with runc acting
as a "work that uses the Library":

• libseccomp

Similarly, the runc binaries distributed with this release are also
statically linked with the following MPLv2 licensed libraries,
with runc acting as a "Larger Work":

• libpathrs

The versions of these libraries were not modified from their upstream versions,
but in order to comply with their corresponding licenses, we have attached the
complete source code for those libraries which (when combined with the attached
runc source code) may be used to exercise your rights under their respective
licenses.

However, we strongly suggest that you make use of your distribution's packages
or download them from the authoritative upstream sources, especially since
these libraries are related to the security of your containers.

Thanks to the following contributors who made this release possible:

• Akihiro Suda akihiro.suda.cz@hco.ntt.co.jp
• Aleksa Sarai cyphar@cyphar.com
• Kir Kolyshkin kolyshkin@gmail.com
• Rodrigo Campos Catelin rodrigo@amutable.com

Signed-off-by: Aleksa Sarai cyphar@cyphar.com

This is the third release candidate for the 1.5.z series of runc. Among
some performance improvements and bugfixes, it includes a fix for a
low-severity vulnerability (CVE-2026-41579) and users are encouraged to
update. As it was a low-severity vulnerability and it was reported by
multiple people, we decided to release it publicly with NO EMBARGO.

We plan to release 1.5.0 in the next two weeks.

Security

This release includes a fix for the following low-severity security issue:

• CVE-2026-41579 allowed a malicious image with a /dev symlink to have
  limited write access to the host filesystem in ways that our analysis
  indicates was too limited to be problematic in practice. This bug was very
  similar to those fixed in CVE-2025-31133, CVE-2025-52565,
  CVE-2025-31133 and was simply missed at the time when we hardened the
  rootfs preparation code. We have conducted a deeper audit and not found any
  other problematic cases.

libcontainer API

• The cmsg helpers from github.com/opencontainers/runc/libcontainer/utils
  have been moved to an internal package. We have included wrapper functions
  but they will be removed in runc 1.6. (#5227, #5231)
• Added //go:fix inline to ease migration for libcontainer/devices symbols
  that are deprecated and scheduled for removal in runc 1.6. (#5223, #5225)

Fixed

• runc list now correctly handles non-existant --root arguments. (#5297,
  #5301)
• Various integration test improvements. (#5222, #5226, #5232, #5239, #5230,
  #5236, #5246, #5248, #5279, #5283, #5269, #5286, #5295, #5303)

Changed

• When masking directories with maskPaths, runc will now re-use a single
  tmpfs instance (which is not writable) to reduce the number tmpfs
  superblocks that need to be reaped when containers die (in particular,
  Kubernetes applies masks to per-CPU sysfs directories which get expensive
  quickly). (#5275, #5280)

Static Linking Notices

The runc binaries distributed with this release are statically linked with
the following GNU LGPL-2.1 licensed libraries, with runc acting
as a "work that uses the Library":

• libseccomp

Similarly, the runc binaries distributed with this release are also
statically linked with the following MPLv2 licensed libraries,
with runc acting as a "Larger Work":

• libpathrs

The versions of these libraries were not modified from their upstream versions,
but in order to comply with their corresponding licenses, we have attached the
complete source code for those libraries which (when combined with the attached
runc source code) may be used to exercise your rights under their respective
licenses.

However, we strongly suggest that you make use of your distribution's packages
or download them from the authoritative upstream sources, especially since
these libraries are related to the security of your containers.

Thanks to the following contributors for making this release possible:

• Akihiro Suda akihiro.suda.cz@hco.ntt.co.jp
• Aleksa Sarai cyphar@cyphar.com
• Davanum Srinivas davanum@gmail.com
• Kevin Berry kpberry11@gmail.com
• Kir Kolyshkin kolyshkin@gmail.com
• Li Fubang lifubang@acmcoder.com
• RedMakeUp girafeeblue@gmail.com
• Ricardo Branco rbranco@suse.de
• Rodrigo Campos Catelin rodrigo@amutable.com
• Sebastiaan van Stijn github@gone.nl

Signed-off-by: Aleksa Sarai cyphar@cyphar.com

This is the third patch release of the 1.4.z series of runc. Among some
performance improvements and bugfixes, it includes a fix for a
low-severity vulnerability (CVE-2026-41579) and users are encouraged to
update. As it was a low-severity vulnerability and it was reported by
multiple people, we decided to release it publicly with NO EMBARGO.

Security

This release includes a fix for the following low-severity security issue:

• CVE-2026-41579 allowed a malicious image with a /dev symlink to have
  limited write access to the host filesystem in ways that our analysis
  indicates was too limited to be problematic in practice. This bug was very
  similar to those fixed in CVE-2025-31133, CVE-2025-52565,
  CVE-2025-31133 and was simply missed at the time when we hardened the
  rootfs preparation code. We have conducted a deeper audit and not found any
  other problematic cases.

Fixed

• Various integration test improvements. (#5222, #5237, #5226, #5229, #5239,
  #5249, #5269, #5287, #5295, #5304)

Changed

• When masking directories with maskPaths, runc will now re-use a single
  tmpfs instance (which is not writable) to reduce the number tmpfs
  superblocks that need to be reaped when containers die (in particular,
  Kubernetes applies masks to per-CPU sysfs directories which get expensive
  quickly). (#5275, #5281)

Static Linking Notices

The runc binary distributed with this release are statically linked with
the following GNU LGPL-2.1 licensed libraries, with runc acting
as a "work that uses the Library":

• libseccomp

The versions of these libraries were not modified from their upstream versions,
but in order to comply with the LGPL-2.1 (§6(a)), we have attached the
complete source code for those libraries which (when combined with the attached
runc source code) may be used to exercise your rights under the LGPL-2.1.

However we strongly suggest that you make use of your distribution's packages
or download them from the authoritative upstream sources, especially since
these libraries are related to the security of your containers.

Thanks to the following contributors for making this release possible:

• Akihiro Suda akihiro.suda.cz@hco.ntt.co.jp
• Aleksa Sarai cyphar@cyphar.com
• Ayato Tokubi atokubi@redhat.com
• Davanum Srinivas davanum@gmail.com
• Kevin Berry kpberry11@gmail.com
• Kir Kolyshkin kolyshkin@gmail.com
• Li Fubang lifubang@acmcoder.com
• Ricardo Branco rbranco@suse.de
• Rodrigo Campos Catelin rodrigo@amutable.com
• Tianon Gravi admwiggin@gmail.com

Signed-off-by: Aleksa Sarai cyphar@cyphar.com

This is the sixth patch release of the 1.3.z series of runc. Among some
performance improvements and bugfixes, it includes a fix for a
low-severity vulnerability (CVE-2026-41579) and users are encouraged to
update. As it was a low-severity vulnerability and it was reported by
multiple people, we decided to release it publicly with NO EMBARGO.

Security

This release includes a fix for the following low-severity security issue:

• CVE-2026-41579 allowed a malicious image with a /dev symlink to have
  limited write access to the host filesystem in ways that our analysis
  indicates was too limited to be problematic in practice. This bug was very
  similar to those fixed in CVE-2025-31133, CVE-2025-52565,
  CVE-2025-31133 and was simply missed at the time when we hardened the
  rootfs preparation code. We have conducted a deeper audit and not found any
  other problematic cases.

  This patchset required backports for #5190 and #5285, which were primarily
  code reorganisations that were already backported to runc 1.4 and 1.5.

Fixed

• A regression in runc v1.3.0 which can result in a stuck runc exec or
  runc run when the container process runs for a short time. (#5208,
  #5210, #5215)
• Various integration test improvements. (#5159, #5188, #5226, #5228, #5239,
  #5253, #5269, #5288)

Changed

• When masking directories with maskPaths, runc will now re-use a single
  tmpfs instance (which is not writable) to reduce the number tmpfs
  superblocks that need to be reaped when containers die (in particular,
  Kubernetes applies masks to per-CPU sysfs directories which get expensive
  quickly). (#5275, #5281)

Static Linking Notices

The runc binary distributed with this release are statically linked with
the following GNU LGPL-2.1 licensed libraries, with runc acting
as a "work that uses the Library":

• libseccomp

The versions of these libraries were not modified from their upstream versions,
but in order to comply with the LGPL-2.1 (§6(a)), we have attached the
complete source code for those libraries which (when combined with the attached
runc source code) may be used to exercise your rights under the LGPL-2.1.

However we strongly suggest that you make use of your distribution's packages
or download them from the authoritative upstream sources, especially since
these libraries are related to the security of your containers.

Thanks to the following contributors for making this release possible:

• Aleksa Sarai cyphar@cyphar.com
• Ayato Tokubi atokubi@redhat.com
• Davanum Srinivas davanum@gmail.com
• Kevin Berry kpberry11@gmail.com
• Kir Kolyshkin kolyshkin@gmail.com
• Ricardo Branco rbranco@suse.de
• Rodrigo Campos Catelin rodrigo@amutable.com
• Li Fubang lifubang@acmcoder.com

Signed-off-by: Aleksa Sarai cyphar@cyphar.com

This is the second release candidate of the runc 1.5.0 release. It
mostly contains build fixes and improvements, but also includes
a new minor feature and some deprecations.
runc v1.5.0-rc.2 includes all of the patches backported to runc v1.4.2.

Users are strongly encouraged to test our release candidates over the
next few weeks so we can fix issues before the general release. You
should expect runc 1.5.0 to be released at the end of April 2026 (at
which point, runc 1.3.z will only receive high-severity security fixes
for 6 months and runc 1.2.z will become unmaintained -- users are thus
very strongly encouraged to migrate to a newer version).

Fixed

• Building with libpathrs for systems that use non-GNU awk, e.g. Debian.
  (#5196, #5194)

Added

• Installation notes for libpathrs. (#5199, #5195)
• Support for specs.LinuxSeccompFlagWaitKillableRecv. (#5183, #5172)
• When building runc, RUNC_BUILDTAGS make or shell environment variable can
  be used to add build tags and/or remove existing build tags (when a tag is
  prefixed with -). (#5198, #5171)

Changed

• runc now requires Go 1.25+ to build. (#5211, #5205)
• libcontainer now pre-opens container root filesystem and uses the file
  descriptor (rather than the path) for most operations related to container
  root during container start. (#5204, #5190)

Deprecated

• EXTRA_BUILDTAGS make variable is deprecated in favor of RUNC_BUILDTAGS
  and will be removed in runc 1.6. (#5171, #5198)
• libcontainer/devices has been deprecated in favour of
  github.com/moby/sys/devices (which is a carbon copy of the package). It
  will be removed in runc 1.6. (#5220, #5142)

Static Linking Notices

The runc binaries distributed with this release are statically linked with
the following GNU LGPL-2.1 licensed libraries, with runc acting
as a "work that uses the Library":

• libseccomp

Similarly, the runc binaries distributed with this release are also
statically linked with the following MPLv2 licensed libraries,
with runc acting as a "Larger Work":

• libpathrs

The versions of these libraries were not modified from their upstream versions,
but in order to comply with their corresponding licenses, we have attached the
complete source code for those libraries which (when combined with the attached
runc source code) may be used to exercise your rights under their respective
licenses.

However, we strongly suggest that you make use of your distribution's packages
or download them from the authoritative upstream sources, especially since
these libraries are related to the security of your containers.

Thanks to the following contributors for making this release possible:

• Akhil Mohan akhilerm@gmail.com
• Aleksa Sarai cyphar@cyphar.com
• Ayato Tokubi atokubi@redhat.com
• Kir Kolyshkin kolyshkin@gmail.com
• Li Fubang lifubang@acmcoder.com
• Rodrigo Campos Catelin rodrigo@amutable.com

Signed-off-by: Kir Kolyshkin kolyshkin@gmail.com

This is the second patch release of the 1.4.z release series of runc.

Fixed

• A regression in runc v1.3.0 which can result in a stuck runc exec or
  runc run when the container process runs for a short time. (#5208,
  #5210, #5216)

• Mount sources that need to be open on the host are now closed earlier during
  container start, reducing the total amount of used file descriptors and
  helping to avoid hitting the open files limit when handling many such mounts.
  (#5177, #5201)

Static Linking Notices

The runc binary distributed with this release are statically linked with
the following GNU LGPL-2.1 licensed libraries, with runc acting
as a "work that uses the Library":

• libseccomp

The versions of these libraries were not modified from their upstream versions,
but in order to comply with the LGPL-2.1 (§6(a)), we have attached the
complete source code for those libraries which (when combined with the attached
runc source code) may be used to exercise your rights under the LGPL-2.1.

However we strongly suggest that you make use of your distribution's packages
or download them from the authoritative upstream sources, especially since
these libraries are related to the security of your containers.

Thanks to the following contributors for making this release possible:

• Ayato Tokubi atokubi@redhat.com
• Akihiro Suda akihiro.suda.cz@hco.ntt.co.jp
• Aleksa Sarai cyphar@cyphar.com
• Kir Kolyshkin kolyshkin@gmail.com
• Li Fubang lifubang@acmcoder.com
• Rodrigo Campos Catelin rodrigo@amutable.com

Signed-off-by: Kir Kolyshkin kolyshkin@gmail.com

This is the fifth patch release of the 1.3.z release series of runc,
and primarily contains a few fixes for issues found in 1.3.4.

Fixed

• Recursive atime-related mount flags (rrelatime et al.) are now applied
  properly. (#5115, #5098)
• PR #4757 caused a regression that resulted in spurious
  cannot start a container that has stopped errors when
  running runc create and has thus been reverted. (#5158,
  #5153, #5151, #4645, #4757)

Changed

• Updated builds to Go 1.25, libseccomp v2.6.0. (#5111, #5053)
• Minor signing keyring updates. (#5146, #5139, #5144, #5148)

Static Linking Notices

The runc binary distributed with this release are statically linked with
the following GNU LGPL-2.1 licensed libraries, with runc acting
as a "work that uses the Library":

• libseccomp

The versions of these libraries were not modified from their upstream versions,
but in order to comply with the LGPL-2.1 (§6(a)), we have attached the
complete source code for those libraries which (when combined with the attached
runc source code) may be used to exercise your rights under the LGPL-2.1.

However we strongly suggest that you make use of your distribution's packages
or download them from the authoritative upstream sources, especially since
these libraries are related to the security of your containers.

Thanks to the following contributors for making this release possible:

• Aleksa Sarai cyphar@cyphar.com
• Kir Kolyshkin kolyshkin@gmail.com
• Li Fu Bang lifubang@acmcoder.com
• Ricardo Branco rbranco@suse.de