Oh Dear
Oh Dear's weekly changelogs have carried a security section five weeks running.
Comparison · Infra & APIs
runc vs TestingBot
A side-by-side editorial comparison of runc and TestingBot — release velocity, themes, recent moves, and the top alternatives to consider.
runc vs TestingBot: at a glance
What is runc?
runc 1.6.0-rc.1 lifts the 1024-CPU limit and refuses settings it used to quietly ignore
The 1.6.0 cycle opened on October 6 with a first release candidate that is mostly cleanup: deprecated libcontainer APIs removed, Go 1.26 now required, urfave/cli moved from v1 to v3, and the binary about 15% smaller on amd64. The changes with operational weight are that cpuAffinity and NUMA memoryPolicy no longer stop at 1024 CPUs or nodes, and that a container asking for a read-only rootfs without its own mount namespace is now refused. Eleven days earlier 1.5.2 worked around a kernel bug, present since v6.17, that corrupted memory inside runc and caused random crashes on cgroup v2. It also stopped runc exec --cgroup from escaping into a sibling cgroup.
What is TestingBot?
TestingBot's autumn work is plumbing: a rebuilt tunnel and another bug-tracker link.
TestingBot runs a cross-browser and real-device cloud. October brought Tunnel v5, a rewrite of its local-testing tunnel with host allowlists, SSH host key checks, SOCKS5, Kerberos and PAC proxy support, self-contained builds without Java, and health endpoints with JSON logs. A Linear integration files bugs from manual sessions, and an iPhone Duo simulator lets teams test a foldable iPhone before Apple ships it. Vibium's agent-driven automation joined the grid in August and Mobilewright tests in October.
runc vs TestingBot: editorial side-by-side
runc
2.5INFRA · APIS
runc 1.6.0-rc.1 lifts the 1024-CPU limit and refuses settings it used to quietly ignore
◆ Current state
The 1.6.0 cycle opened on October 6 with a first release candidate that is mostly cleanup: deprecated libcontainer APIs removed, Go 1.26 now required, urfave/cli moved from v1 to v3, and the binary about 15% smaller on amd64. The changes with operational weight are that cpuAffinity and NUMA memoryPolicy no longer stop at 1024 CPUs or nodes, and that a container asking for a read-only rootfs without its own mount namespace is now refused. Eleven days earlier 1.5.2 worked around a kernel bug, present since v6.17, that corrupted memory inside runc and caused random crashes on cgroup v2. It also stopped runc exec --cgroup from escaping into a sibling cgroup.
◆ Where it's heading
The project keeps converting silent behaviour into explicit behaviour. Read-only requests that were ignored now fail, a umask that was dropped is now honoured, and poststart hooks moved to conform to the runtime spec. The same maintainers are shrinking the surface underneath, dropping the deprecated API and the high-level cilium/ebpf path, which took roughly 7.5% off the 1.5.2 binary. Stricter behaviour plus a smaller dependency set is what a component under every container host would be expected to do between majors.
◆ Prediction
1.5.0's notes pointed to a 1.6.0 in late October 2026, and the feed so far shows only rc.1, so further release candidates or the final are the next entries to expect. The refused read-only configurations are the change most likely to surface as user reports during testing.
TestingBot
5.0INFRA · APIS
TestingBot's autumn work is plumbing: a rebuilt tunnel and another bug-tracker link.
◆ Current state
TestingBot runs a cross-browser and real-device cloud. October brought Tunnel v5, a rewrite of its local-testing tunnel with host allowlists, SSH host key checks, SOCKS5, Kerberos and PAC proxy support, self-contained builds without Java, and health endpoints with JSON logs. A Linear integration files bugs from manual sessions, and an iPhone Duo simulator lets teams test a foldable iPhone before Apple ships it. Vibium's agent-driven automation joined the grid in August and Mobilewright tests in October.
◆ Where it's heading
The summer made the platform fit for teams; the autumn makes it fit for corporate networks and CI. Tunnel v5 targets the place enterprise trials usually stall, behind proxies and security reviews, and its config-file and environment-variable setup suits pipelines and Docker. The integration list keeps growing one tracker at a time, while the device catalogue continues its usual rotation.
◆ Prediction
Expect further CI-oriented tunnel and reporting work, and more automation frameworks on the grid alongside Mobilewright and Vibium. The Vibium MCP path has had no follow-up in these entries.
Alternatives to runc and TestingBot
Other Infra & APIs products tracked by Sparkpulse, ranked by recent ship velocity. Each card links to a full editorial trajectory and lets you pivot into a head-to-head comparison with either runc or TestingBot.
Apache ShenYu
ShenYu's AI gateway plugins are back in motion, with 2.7.2 candidate tags in October.
KubeArmor
KubeArmor ships fixes as release-candidate tags, and its feed misses the finals.
All Quiet
All Quiet moves from enterprise integrations to the on-call engineer's own day.
Robusta
Robusta's recent releases patch its runner image rather than add features.
Uptrends
Uptrends spent October on account plumbing: vault credentials, bulk edits and a free trial path.
See all runc alternatives → · See all TestingBot alternatives →
Recent activity from runc and TestingBot
Latest ship moves from both products, interleaved chronologically. ⚡ = editorial spark.
- 11d agoTestingBotLinear Integration
- 19d agoTestingBotNew TestingBot Tunnel 5.0
- 26d agoruncRelease candidate lifts 1024-CPU limit, removes deprecated APIs
- 26d agoTestingBotMobilewright tests on the TestingBot device cloud
- 1mo agoTestingBotTest on the iPhone Duo simulator before it ships
- 1mo agoruncWorkaround for kernel bug that crashed runc on cgroup v2
- 2mo agoTestingBotVibium browser automation
- 2mo agoTestingBotSamsung Galaxy Tab S11 in the real device cloud
- 3mo agorunctmpfs regression on Ubuntu 20.04 kernels fixed
- 4mo agoruncrunc 1.5.0 stable, with dated support windows for older branches
- 4mo agoruncCVE-2026-41579: /dev symlink host write access fixed
- 4mo agoruncRelease candidate carrying the CVE-2026-41579 fix
Frequently asked questions
What is the difference between runc and TestingBot?
They serve adjacent needs but don't currently overlap on shipped themes. TestingBot is currently shipping more aggressively (velocity 5.0 vs 2.5), with 0 editorial sparks in the last 30 days against 0. See the at-a-glance table above for a side-by-side breakdown of velocity, recent sparks, and editorial themes.
Is runc better than TestingBot?
Sparkpulse doesn't pick a winner — we score release velocity, not feature parity. TestingBot is currently shipping more aggressively (velocity 5.0 vs 2.5), with 0 editorial sparks in the last 30 days against 0. For your specific use case, the alternatives sections above list other Infra & APIs products to evaluate alongside.
What are the best alternatives to runc?
Top runc alternatives in Infra & APIs are ranked by recent ship velocity. Browse the "runc alternatives" section above for the current picks, or visit /alternatives/runc for the full list with editorial commentary on each.
What are the best alternatives to TestingBot?
Top TestingBot alternatives in Infra & APIs are ranked by recent ship velocity. Browse the "TestingBot alternatives" section above for the current picks, or visit /alternatives/testingbot for the full list with editorial commentary on each.