Skip to content

[v4.2.0-rhel] Backport: do not pass volume options as bind mounts options to runtime#28458

Open
cevich wants to merge 2 commits intocontainers:v4.2.0-rhelfrom
cevich:backport_runc_fix
Open

[v4.2.0-rhel] Backport: do not pass volume options as bind mounts options to runtime#28458
cevich wants to merge 2 commits intocontainers:v4.2.0-rhelfrom
cevich:backport_runc_fix

Conversation

@cevich
Copy link
Copy Markdown
Member

@cevich cevich commented Apr 7, 2026

Followup to #27933 - Neglected to backport for fixes: https://issues.redhat.com/browse/RHEL-132863 https://issues.redhat.com/browse/RHEL-132860

Checklist

Ensure you have completed the following checklist for your pull request to be reviewed:

  • Certify you wrote the patch or otherwise have the right to pass it on as an open-source patch by signing all
    commits. (git commit -s). (If needed, use git commit -s --amend). The author email must match
    the sign-off email address. See CONTRIBUTING.md
    for more information.
  • Referenced issues using Fixes: #00000 in commit message (if applicable)
  • Tests have been added/updated (or no tests are needed)
  • Documentation has been updated (or no documentation changes are needed)
  • All commits pass make validatepr (format/lint checks)
  • Release note entered in the section below (or None if no user-facing changes)

Does this PR introduce a user-facing change?

None

Luap99 added 2 commits April 7, 2026 14:37
Starting with runc 1.3.0 it errors when we pass unknown mount options to
the runtime, the volume-opt options are specifc to the volume we create
and should not be passed to the mount in the oci spec.

Fixes: containers#26938

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
(cherry picked from commit 7fda4df)
Signed-off-by: Chris Evich <cevich@redhat.com>
Starting with runc 1.3.0 it errors when we pass unknown mount options to
the runtime, the copy/nocopy options are specific to podman when we
mount the volume and are not valid mount options for the runtime.

Fixes: containers#26938
Fixes: https://issues.redhat.com/browse/RHEL-132532,
https://issues.redhat.com/browse/RHEL-132531

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
(cherry picked from commit 1e4a59d)
Signed-off-by: Chris Evich <cevich@redhat.com>
@cevich cevich marked this pull request as draft April 7, 2026 18:42
@cevich
Copy link
Copy Markdown
Member Author

cevich commented Apr 7, 2026

Running system tests...tests finished. No surprises, exactly the same results as #27933

@cevich
Copy link
Copy Markdown
Member Author

cevich commented Apr 8, 2026

@TomSweeneyRedHat @lsm5 PTAL when you have a chance.

@lsm5
Copy link
Copy Markdown
Member

lsm5 commented Apr 8, 2026

Running tests on internal ranch. Will update here.

Copy link
Copy Markdown
Member

@lsm5 lsm5 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Need to backport PodmanExitCleanly if we need to actually run integration tests.

copySession := podmanTest.Podman([]string{"run", "--rm", "-v", "testvol3:/etc/apk:copy", ALPINE, "stat", "-c", "%h", "/etc/apk/arch"})
copySession.WaitWithDefaultTimeout()
Expect(copySession).Should(Exit(0))
podmanTest.PodmanExitCleanly("run", "--name", "testctr", "-v", "testvol3:/etc/apk:copy", ALPINE, "stat", "-c", "%h", "/etc/apk/arch")
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks, will do. Note: Last time I tried to run integration tests on this branch, they wouldn't even compile. So I think there's likely many more changes needed.

@lsm5
Copy link
Copy Markdown
Member

lsm5 commented Apr 8, 2026

system and other tests are good though.

@TomSweeneyRedHat
Copy link
Copy Markdown
Member

@cevich what @lsm5 said. He caught the test issue on my PR, and I believe you need to pick a9ac512 to fix it.

As this truly closes the runc CVEs, I'd add a note to that PR pointing here if you have not already, and then list the Jira cards that will be fixed in the Description.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants