LoginSign Up
← Back to all sparks
R

runc

INFRA · APIS
Velocity2.5

CLI tool for spawning and running containers per the OCI specification

github.com/opencontainers/runc ↗

runc 1.6.0-rc.1 lifts the 1024-CPU limit and refuses settings it used to quietly ignore

container runtimerelease candidatebreaking changeskernel workaroundsupport policy
◆Current state
The 1.6.0 cycle opened on October 6 with a first release candidate that is mostly cleanup: deprecated libcontainer APIs removed, Go 1.26 now required, urfave/cli moved from v1 to v3, and the binary about 15% smaller on amd64. The changes with operational weight are that cpuAffinity and NUMA memoryPolicy no longer stop at 1024 CPUs or nodes, and that a container asking for a read-only rootfs without its own mount namespace is now refused. Eleven days earlier 1.5.2 worked around a kernel bug, present since v6.17, that corrupted memory inside runc and caused random crashes on cgroup v2. It also stopped runc exec --cgroup from escaping into a sibling cgroup.
◆Where it's heading
The project keeps converting silent behaviour into explicit behaviour. Read-only requests that were ignored now fail, a umask that was dropped is now honoured, and poststart hooks moved to conform to the runtime spec. The same maintainers are shrinking the surface underneath, dropping the deprecated API and the high-level cilium/ebpf path, which took roughly 7.5% off the 1.5.2 binary. Stricter behaviour plus a smaller dependency set is what a component under every container host would be expected to do between majors.
◆Prediction
1.5.0's notes pointed to a 1.6.0 in late October 2026, and the feed so far shows only rc.1, so further release candidates or the final are the next entries to expect. The refused read-only configurations are the change most likely to surface as user reports during testing.

◆Recent moves

  1. 29d ago

    Release candidate lifts 1024-CPU limit, removes deprecated APIs

    The first 1.6.0 candidate lifts the 1024 CPU and NUMA node limit and refuses read-only configurations it cannot honour without a mount namespace. Most of the rest is cleanup of deprecated APIs and build changes.

    View source ↗
  2. 1mo ago

    Workaround for kernel bug that crashed runc on cgroup v2

    The second 1.5.z patch works around a kernel bug that wrote past a userspace structure and crashed runc at random on cgroup v2, and restores HOME for runc exec -p. Its cgroups library change also removed the call path affected by GO-2026-6238.

    View source ↗
  3. 3mo ago

    tmpfs regression on Ubuntu 20.04 kernels fixed

    The first patch on 1.5.z, fixing a regression that broke tmpfs mounts with nr_inodes=1 on Ubuntu 20.04 kernels — a fallback to nr_inodes=2 now covers the downstream kernel behaviour. Also handles EINVAL when a runc built against libseccomp 2.6.0 or newer runs with an older one.

    View source ↗
  4. 4mo ago

    runc 1.5.0 stable, with dated support windows for older branches

    The first stable 1.5.z release, and the point where runc's support policy bites: 1.2.z and earlier become unsupported, 1.3.z drops to high-severity CVE fixes only until end of October 2026, and 1.4.z narrows to security and significant bugfixes.

    View source ↗
  5. 4mo ago

    CVE-2026-41579: /dev symlink host write access fixed

    Fixes CVE-2026-41579, where a malicious image with a /dev symlink could gain limited write access to the host filesystem. Released without embargo because the severity was low and it had been reported independently by several people; a deeper audit found no further cases.

    View source ↗
  6. 4mo ago

    Release candidate carrying the CVE-2026-41579 fix

    The third 1.5.0 release candidate, carrying the same CVE-2026-41579 fix released across every branch that day. Superseded by 1.5.0 five days later.

    View source ↗