LoginSign Up
← Back to all sparks
R

runc

INFRA · APIS
Velocity2.5

CLI tool for spawning and running containers per the OCI specification

github.com/opencontainers/runc ↗

runc now publishes an end-of-life calendar, and three branches shipped the same CVE fix in two days.

container runtimesupport policycve coordinationmulti-branch
◆Current state
1.5.0 in June was the first stable release of the 1.5.z series and the third under runc's formal release and support policy: 1.2.z and earlier are unsupported, 1.3.z receives only high-severity CVE fixes until the end of October 2026, and 1.4.z is limited to security and significant bugfixes. A month later 1.5.1 fixed a real-world regression — the maskPaths optimisation from 1.5.0-rc.3 broke tmpfs mounts with nr_inodes=1 on Ubuntu 20.04 kernels. In mid-June, CVE-2026-41579 was fixed simultaneously across 1.3.6, 1.4.3 and 1.5.0-rc.3 and released with no embargo.
◆Where it's heading
The project is behaving like infrastructure with a contract. Publishing dated support windows and shipping a coordinated fix across every live branch on the same day is the operating posture of a component that sits under every container on a host, where operators need to know what they are still entitled to. The CVE itself is instructive: a /dev symlink escape in the same family as three earlier CVEs, found by re-auditing the rootfs preparation code that had been hardened before.
◆Prediction
1.5.0's notes state that a 1.6.0 is expected in late October 2026, which is also when 1.3.z support ends — so the next milestone is that pairing. Expect 1.5.z patches until then.

◆Recent moves

  1. 24d ago

    tmpfs regression on Ubuntu 20.04 kernels fixed

    The first patch on 1.5.z, fixing a regression that broke tmpfs mounts with nr_inodes=1 on Ubuntu 20.04 kernels — a fallback to nr_inodes=2 now covers the downstream kernel behaviour. Also handles EINVAL when a runc built against libseccomp 2.6.0 or newer runs with an older one.

    View source ↗
  2. 1mo ago

    runc 1.5.0 stable, with dated support windows for older branches

    The first stable 1.5.z release, and the point where runc's support policy bites: 1.2.z and earlier become unsupported, 1.3.z drops to high-severity CVE fixes only until end of October 2026, and 1.4.z narrows to security and significant bugfixes.

    View source ↗
  3. 1mo ago

    CVE-2026-41579: /dev symlink host write access fixed

    Fixes CVE-2026-41579, where a malicious image with a /dev symlink could gain limited write access to the host filesystem. Released without embargo because the severity was low and it had been reported independently by several people; a deeper audit found no further cases.

    View source ↗
  4. 1mo ago

    Release candidate carrying the CVE-2026-41579 fix

    The third 1.5.0 release candidate, carrying the same CVE-2026-41579 fix released across every branch that day. Superseded by 1.5.0 five days later.

    View source ↗
  5. 1mo ago

    CVE-2026-41579 fix backported to the 1.4 branch

    The 1.4.z branch's copy of the CVE-2026-41579 fix, cut alongside 1.3.6 and 1.5.0-rc.3. Same change, different branch.

    View source ↗
  6. 4mo ago

    Build fixes and seccomp WaitKillableRecv support

    The second 1.5.0 release candidate: build fixes for non-GNU awk systems, libpathrs installation notes, and seccomp WaitKillableRecv support.

    View source ↗