Update github.com/cyphar/filepath-securejoin to v0.6.0 and github.com/opencontainers/runc to v1.3.3#448
Conversation
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
|
✅ A new PR has been created in buildah to vendor these changes: podman-container-tools/buildah#6487 |
|
Looks like you need to bump runc here at the same time, really annoying that the 0.6.0 update introduces breaking changes which means every users must be updates in the right dependency order first. This will be gigantic PITA if the selinux chnage (podman-container-tools/podman#27466) must be backported. Looking at it closer I doubt we use the selinux code to write labels in untrusted namespaces so maybe we are good without it. |
|
Yes
|
This is necessary to allow the update to github.com/cyphar/filepath-securejoin v0.6.0 . Signed-off-by: Miloslav Trmač <mitr@redhat.com>
All of this is making me wonder whether there shouldn’t be some way to solve the overmounts within |
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
|
LGTM once tests are green |
|
LGTM |
Testing a storage bump in container-libs, most notably the securejoin bump it drags in. Those changes are part of: podman-container-tools/container-libs#448 Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
|
Can we backport this to |
What do you need this for? This branch is used for our podman releases and backporting these fixes through all projects is additional work for us. |
|
It's not as important, nevermind. We can wait for Podman 6 libs. Thanks for looking into it. |
This is a replacement for #432 , also updating the users of removed functions.
Do note the licensing conversation in #432 — and how #446 needs an updated
filepath-securejoin(does not matter for container-libs, but needed e.g. in podman-container-tools/podman#27466 ).Cc: @TomSweeneyRedHat . FYI @mheon