Blockers for v1.2.0

[AkihiroSuda]

Blockers for rc.1 (#3963):

• libcontainer: dmz: fix "go get" builds #4101
• libcontainer: remove all mount logic from nsexec #3985
• configs: validate: add validation for bind-mount fsflags #3990
• runc-dmz: Inheritable capabilities are dropped when they previously weren't #4125
• Fix runc-dmz error printing #4172
• never send procError after the socket closed #4173

Blockers for GA:

• Tests broken in debian due to PR: rootfs: remove --no-mount-fallback and finally fix MS_REMOUNT #4093
• Release runtime-spec v1.1.1 v1.2.0 Release v1.2.0 runtime-spec#1242
• runc doesn't work with go1.22  #4233
• Verify compatibility with well-known downstreams
  • Dockerfile: update to runc v1.2.0-rc.1 moby/moby#47666

@opencontainers/runc-maintainers Feel free to edit this issue

[AkihiroSuda]

We don't have timeline for v1.2.0, but we should try to release v1.2.0 by the end of the year.

[kolyshkin]

Well, we have the 1.2.0 milestone (which I am trying comb through regularly), and everything that's in there is kind of a blocker for 1.2.0.

Feel free to modify milestones for any issues/PRs, but at the very least we have one more blocker:

• regression: can't kill and delete the container with shared(host) pid ns when the init process has dead #4047 (which I'm actively working one, hope to come to a closure this week)
  (and I guess @cyphar can add more)

[AkihiroSuda]

Well, we have the 1.2.0 milestone (which I am trying comb through regularly), and everything that's in there is kind of a blocker for 1.2.0.

Not everything.
At least this one can be postponed to v1.3 or later

• Add mon groups for resctrl. #2523

[kolyshkin]

Not everything.

Well, strictly speaking, everything that is under that milestone needs to either be included into 1.2.0, or be reassigned to a different milestone. Whis is why I said

Feel free to modify milestones for any issues/PRs

[cyphar]

I still think #3985 is needed for 1.2.0. There are several issues with mount propagation (not to mention the serious restriction of idmapped mounts) that are fixed with #3985. We also need #3990 if we want to make sure people scream at us during the -rc1 if it breaks something.

Other than those, I don't have any strong opinions on any remaining PRs.

[h-vetinari]

Blockers for GA: Release runtime-spec v1.1.1

Given that it took well over 3 years to get 1.1.0 finished (incl. half a year from rc1 to GA), is it really necessary (resp. judicious) to block runc 1.2 on a spec-release?

[AkihiroSuda]

Blockers for GA: Release runtime-spec v1.1.1

Given that it took well over 3 years to get 1.1.0 finished (incl. half a year from rc1 to GA), is it really necessary (resp. judicious) to block runc 1.2 on a spec-release?

Necessary, because we have been depending on its main branch:

• features: Expose idmap support #3993

[utam0k]

This task has been done 👍

Release runtime-spec v1.1.1 v1.2.0 opencontainers/runtime-spec#1242