Unclaimed project
Are you a maintainer of runc? Claim this project to take control of your public changelog and roadmap.
Changelog
CLI tool for spawning and running containers according to the OCI specification
This is the first release of the 1.4.z release branch of runc. It
contains a few fixes for issues found in 1.4.0-rc.3. This version of
runc supports runtime-spec v1.3 (see docs/spec-conformance.md for the
few features that are still missing).
This is the second release of runc following our new release and support
policy (see RELEASES.md for more details). This means that, as of this
release:
CleanPath, StripRoot, WithProcfd, and WithProcfdFile from
libcontainer/utils. (#4985)pids.limit has been updated to match the newer guidance
from the OCI runtime specification. In particular, now a maximum limit value
of 0 will be treated as an actual limit (due to limitations with systemd,
it will be treated the same as a limit value of 1). We only expect users
that explicitly set pids.limit to 0 will see a behaviour change.
(opencontainers/cgroups#48, #4949)cpuacct.usage_all resilience when parsing data from
patched kernels (such as the Tencent kernels). (opencontainers/cgroups#46,
opencontainers/cgroups#50)prepareCgroupFD error. (#4936)tmpfs mount, only set the mode= argument if the target
path already existed. This fixes a regression introduced in our
CVE-2025-52881 mitigation patches. (#4971, #4976)pathrs
helper functions, which should ensure we will not regress dangling symlink
users. (#4985)(*CPUSet).Fill. (#4927)The runc binary distributed with this release are statically linked with
the following GNU LGPL-2.1 licensed libraries, with runc acting
as a "work that uses the Library":
The versions of these libraries were not modified from their upstream versions, but in order to comply with the LGPL-2.1 (§6(a)), we have attached the complete source code for those libraries which (when combined with the attached runc source code) may be used to exercise your rights under the LGPL-2.1.
However we strongly suggest that you make use of your distribution's packages or download them from the authoritative upstream sources, especially since these libraries are related to the security of your containers.
Thanks to the following contributors for making this release possible:
Get up and running with Kimi-K2.5, GLM-4.7, DeepSeek, gpt-oss, Qwen, Gemma and other models.
Production-Grade Container Scheduling and Management
A fast reverse proxy to help you expose a local server behind a NAT or firewall to the internet.
The world’s fastest framework for building websites.