Runc: Question: runc 1.0.0 release plan

[Ace-Tang]

Hi, maintainers

I want to ask if runc project has plan to make a new release, since I recognize that runc always make a new release almost every six months, do the next new release come out soon? Thanks.

[cyphar]

We were planning to make a 1.0.0 release immediately after 1.0.0-rc5 but that didn't happen. I think that just cutting a release now is as good a choice as any -- though we currently have a pretty bad regression (#1862) that I wouldn't want to include in a release.

[Ace-Tang]

Thanks for the reply soon. I also follow the the discussion about #1862 on the mail list. Wait for your conclusion.

[mikebrow]

1709

[jameshartig]

Now that the regression has been merged, can a 1.0.0 release be made?

[Ace-Tang]

The 1.0.0 release plan has been discussed in mail list https://groups.google.com/a/opencontainers.org/forum/#!topic/dev/pWEp_UK6aAk

[cyphar]

1.0-rc6 was just released, and we have a plan for 1.0 release. The main blocker is spec-compliance and it's something we're working on.

[AkihiroSuda]

maintainers: any chance to set labels to the issues & PRs that are blocking v1.0.0 ?

[cyphar]

https://github.com/opencontainers/runc/milestone/7 is the set of blocking issues. There's only two of them, and it's the hooks issues.

[caniszczyk]

Any thoughts on v1.0 planning for runc? cc: @opencontainers/runc-maintainers

[mrueg]

Can we get a new rc or a proper 1.0 for the recent CVE please?

[cyphar]

I will send around a vote for 1.0.0-rc7 tomorrow morning but I need to go to bed first.

[pigmej]

Hey @cyphar any progress on this?

[cyphar]

It's unclear to me whether #1979 should be handled first. I am working on a patch for it, but I can just send out the vote...

[allencloud]

It's unclear to me whether #1979 should be handled first

I think that #1979 should be handled first before releasing official runc 1.0.0. @cyphar

[cyphar]

I will wait until we merge #1984 before doing a release.

[AkihiroSuda]

Any blocker for rc7?

[mrueg]

Since runc provides core functionality and is widely used in the container ecosystem, the current situation without an actual release, that fixes the vulnerability, is a bit unsatisfying to me as a downstream (maybe too traditional) packager. I don't feel comfortable picking an (to me arbitrary) commit and provide that snapshot to users of the distribution. Is anyone able to provide some guidance here on well-tested commits?

[cyphar]

I don't feel comfortable picking an (to me arbitrary) commit and provide that snapshot to users of the distribution.

While I completely agree in principle (and I will send out a vote for rc7 today), if you package Docker then you are already packaging specific commits -- Docker hasn't used an actual release of runc for at least 3-4 years and if you stayed on the "newest release" then your systems would've been very unstable (and probably insecure). Same goes with containerd. cri-o used to use our releases (back when rc5 and rc6 happened close together) but I think they've also switched to using commits.

I'm hoping that after 1.0 we will have more frequent releases -- but the current process of releasing runc (having a 2-week voting process) is absolutely ludicrous and is one of the major reasons we aren't having more frequent releases. We should have a release manager and require only 2 additional LGTMs to do a release (maybe with a mandatory cooling-off period). The spec style of doing releases doesn't make sense for us and never has IMHO.

I will bring that up on the ML with the release vote.

[MarkusTeufelberger]

I will send out a vote for rc7 today

I don't see this vote in https://groups.google.com/a/opencontainers.org/forum/#!forum/dev - am I looking in the wrong place? The rc6 vote seems to have happened there: https://groups.google.com/a/opencontainers.org/forum/#!topic/dev/LCDa1rDyiec

[cyphar]

That is the right mailing list -- I only just got around to sending it just now. Check the list again and you should see the vote announcement.

[MarkusTeufelberger]

Great, here it is: https://groups.google.com/a/opencontainers.org/forum/#!topic/dev/TioIOoxJydk :+1:

[cyphar]

See #2026. 1.0.0-rc7 has been released.

[AkihiroSuda]

https://github.com/opencontainers/runc/pull/2031 seems merged.
Any plan for rc8?

[cyphar]

Currently waiting on opencontainers/selinux#51 which fixes the regression we see in rc7 but for SELinux-enabled systems (the other patch only fixes it for non-SELinux systems).

[Ace-Tang]

How long we release a new runc version, 3 months as discussed in mail list before ?

[cyphar]

Post 1.0, we will do regular releases (using a release-manager model where you don't need quorum votes on the mailing list to get releases out).

But right now for the 1.0, we still have an issue with post-start hooks and at the moment it looks like we might need a runtime-spec 1.1 in order to fix some of the incompatibility issues (this was discussed in the last OCI call).

[odinuge]

Hi @cyphar! Is there a plan to release a new rc version any time? The issue fixed in https://github.com/opencontainers/runc/pull/2065 is ~blocking for most aarch64 users (with hugetlb) running linux 5.0+, together with those pre 5.0 running with custom huge page sizes below 1MiB. It would also be nice to be able to pin a version with the fix, so we can avoid using a shasum when using it as a dependency. :smile:

[odinuge]

Ref. https://github.com/opencontainers/runc/pull/2074#issuecomment-505405745 cc @thaJeztah

I think it may be about time for a new release 😄

[thaJeztah]

https://github.com/opencontainers/runc/pull/2074#issuecomment-505500232

Looks like the fix for the CVE was already merged in https://github.com/opencontainers/runc/commit/03a5a7476e93a7fc3726b6e83c558404db664590#diff-c1eca12d097b318b217f891966083c8e as part of https://github.com/opencontainers/runc/pull/1424

The "diff" posted in this PR looks to be between the wrong commits; this is the right link/diff:

https://github.com/seccomp/libseccomp-golang/compare/84e90a91acea0f4e51e62bc1a75de18b1fc0790f...v0.9.1

[AkihiroSuda]

ping @cyphar

[AkihiroSuda]

@cyphar What do we need for v1.0.0 GA?

[cyphar]

I think we are basically ready for 1.0 GA. I think one final RC wouldn't be a bad idea, but on the other hand I don't really care if we have to do a 1.0.1 in the near future. I can send out the vote for 1.0 GA now if you like.

[dims]

+1 to 1.0.0 GA thanks for all your hard work!

[AkihiroSuda]

I'd like to see the current open PRs in https://github.com/opencontainers/runc/milestone/7 to be merged before v1.0.0.
The open issues in the milestone can be postponed to post-1.0 .