Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

vendor: bump runc/libcontainer to v1.2.1 #128276

Merged
merged 1 commit into from
Nov 2, 2024

Conversation

kolyshkin
Copy link
Contributor

@kolyshkin kolyshkin commented Oct 22, 2024

What type of PR is this?

/kind cleanup

What this PR does / why we need it:

Bump runc/libcontainer to v1.2.0.

For one thing, this release decouples device management from libcontainer/cgroups. You can see the result of this in a dropped cilium/ebpf dependency (which is only needed for device management).

Which issue(s) this PR fixes:

Special notes for your reviewer:

  1. I'm also including pkg/kubelet/userns/inuserns: use moby/sys/userns #128237 here; will rebase once it's merged. Rebased.

  2. It looks like a bug in hack/lint-dependencies.sh script -- it insists golang.org/x/exp is a dependency of github.com/opencontainers/runc, while in fact it is only used by github.com/cilium/ebpf which is being removed here. Because of this bug, I had to add opencontainers/runc to hack/unwanted-dependencies.json under x/exp.

  3. A new dependency golang.org/x/execabs is being removed in the next patch release (libct: rm x/sys/execabs usage opencontainers/runc#4465)

  4. The issue with containerd and userns in runc v1.2.0 is fixed in v1.2.1.

Does this PR introduce a user-facing change?

NONE

Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

@k8s-ci-robot
Copy link
Contributor

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

@k8s-ci-robot k8s-ci-robot added release-note-none Denotes a PR that doesn't merit a release note. do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. kind/cleanup Categorizes issue or PR as related to cleaning up code, process, or technical debt. size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. do-not-merge/needs-sig Indicates an issue or PR lacks a `sig/foo` label and requires one. labels Oct 22, 2024
@k8s-ci-robot
Copy link
Contributor

This issue is currently awaiting triage.

If a SIG or subproject determines this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@k8s-ci-robot k8s-ci-robot added needs-triage Indicates an issue or PR lacks a `triage/foo` label and requires one. needs-priority Indicates a PR lacks a `priority/foo` label and requires one. labels Oct 22, 2024
@k8s-ci-robot k8s-ci-robot requested review from endocrimes, gnufied and a team October 22, 2024 21:44
@k8s-ci-robot k8s-ci-robot added area/dependency Issues or PRs related to dependency changes area/kubelet sig/node Categorizes an issue or PR as relevant to SIG Node. sig/storage Categorizes an issue or PR as relevant to SIG Storage. and removed do-not-merge/needs-sig Indicates an issue or PR lacks a `sig/foo` label and requires one. labels Oct 22, 2024
@dims
Copy link
Member

dims commented Oct 22, 2024

@kolyshkin Are you ok with folks running Containerd 1.6/1.7 with older runc versions with 1.2.0 runc vendored into kubelet? ( Want to make sure we don't end up with something like opencontainers/runc#3849 )

@kolyshkin
Copy link
Contributor Author

@kolyshkin Are you ok with folks running Containerd 1.6/1.7 with older runc versions with 1.2.0 runc vendored into kubelet? ( Want to make sure we don't end up with something like opencontainers/runc#3849 )

As of now we're not aware of any issues similar to opencontainers/runc#3849.

@kolyshkin kolyshkin marked this pull request as ready for review October 22, 2024 23:47
@k8s-ci-robot k8s-ci-robot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Oct 22, 2024
@k8s-ci-robot k8s-ci-robot requested review from bart0sh and dims October 22, 2024 23:48
@dims
Copy link
Member

dims commented Oct 23, 2024

/retest

/assign @mrunalp @derekwaynecarr @dchen1107 @SergeyKanzhelev

@SergeyKanzhelev
Copy link
Member

/hold

@k8s-ci-robot k8s-ci-robot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Oct 23, 2024
@SergeyKanzhelev
Copy link
Member

@samuelkarp mentioned offline there may be a bug with 1.2.0. @samuelkarp can you please link it here?

@samuelkarp
Copy link
Member

opencontainers/runc#4466

@dims
Copy link
Member

dims commented Oct 23, 2024

@SergeyKanzhelev
Copy link
Member

@SergeyKanzhelev please see containerd/containerd#10877 and discussion on slack https://cloud-native.slack.com/archives/CGEQHPYF4/p1729607023643899

@dims I think it will be best to wait for containerd to confirm it is ok to update. It will be best to have reference in k/k matching the actual binary we are testing in e2e. Do you agree or I am missing something?

@dims
Copy link
Member

dims commented Oct 23, 2024

@SergeyKanzhelev i agree with you!

@dims
Copy link
Member

dims commented Oct 25, 2024

xref: opencontainers/runc#4475

@k8s-ci-robot k8s-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Oct 29, 2024
@kolyshkin kolyshkin changed the title vendor: bump runc/libcontainer to v1.2.0 vendor: bump runc/libcontainer to v1.2.1 Nov 2, 2024
For one thing, this release decouples device management from
libcontainer/cgroups. You can see the result of this in a dropped
cilium/ebpf dependency (which is only needed for device management).

NOTE that due to an issue with go mod / go list,
github.com/opencontainers/runc had to be added to
hack/unwanted-dependencies.json under x/exp. This is bogus because
opencontainers/runc does not use x/exp directly, only via cilium/ebpf
dependency (which is not vendored here).

Signed-off-by: Kir Kolyshkin <[email protected]>
@k8s-ci-robot k8s-ci-robot added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. and removed size/L Denotes a PR that changes 100-499 lines, ignoring generated files. needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. labels Nov 2, 2024
@dims
Copy link
Member

dims commented Nov 2, 2024

@SergeyKanzhelev containerd to confirm it is ok to update is done now. containerd/containerd#10877 is landing

@SergeyKanzhelev
Copy link
Member

/lgtm
/approve

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Nov 2, 2024
@k8s-ci-robot
Copy link
Contributor

LGTM label has been added.

Git tree hash: 89b1d408879013871e3bb3612770e552200f7964

@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: kolyshkin, liggitt, SergeyKanzhelev

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@SergeyKanzhelev
Copy link
Member

I guess there is not much reason to hold - let's get more soak time by merging on weekend.

/unhold

@k8s-ci-robot k8s-ci-robot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Nov 2, 2024
@k8s-ci-robot k8s-ci-robot merged commit dfd456c into kubernetes:master Nov 2, 2024
16 checks passed
@k8s-ci-robot k8s-ci-robot added this to the v1.32 milestone Nov 2, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. area/dependency Issues or PRs related to dependency changes area/kubelet cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. kind/cleanup Categorizes issue or PR as related to cleaning up code, process, or technical debt. lgtm "Looks good to me", indicates that a PR is ready to be merged. needs-priority Indicates a PR lacks a `priority/foo` label and requires one. needs-triage Indicates an issue or PR lacks a `triage/foo` label and requires one. release-note-none Denotes a PR that doesn't merit a release note. sig/node Categorizes an issue or PR as relevant to SIG Node. sig/storage Categorizes an issue or PR as relevant to SIG Storage. size/M Denotes a PR that changes 30-99 lines, ignoring generated files.
Development

Successfully merging this pull request may close these issues.

9 participants