Sourced from github.com/opencontainers/runc's releases.

runc v1.3.1 -- "この瓦礫の山でよぉ"

This is the first patch release of the 1.3.z release series of runc. It primarily includes some minor fixes for issues found in 1.3.0.

Fixed

• Container processes will no longer inherit the CPU affinity of runc by default. Instead, the default CPU affinity of container processes will be the largest set of CPUs permitted by the container's cpuset cgroup and any other system restrictions (such as isolated CPUs). (#4041, #4815, #4858)
• Setting linux.rootfsPropagation to shared or unbindable now functions properly. (#1755, #1815, #4724, #4789)
• Close seccomp agent connection to prevent resource leaks. (#4796, #4799)
• runc delete and runc stop can now correctly handle cases where runc create was killed during setup. Previously it was possible for the container to be in such a state that neither runc stop nor runc delete would be unable to kill or delete the container. (#4534, #4645, #4757, #4788)
• runc update will no longer clear intelRdt state information. (#4828, #4833)
• CI: Fix exclusion rules and allow us to run jobs manually. (#4760, #4763)

Changed

• Improvements to the deprecation warnings as part of the github.com/opencontainers/cgroups split. (#4784, #4788)
• Disable the dmem controller in our cgroup tests, as systemd does not yet support it. (#4806, #4811)
• /proc/net/dev is no longer included in the permitted procfs overmount list. Its inclusion was almost certainly an error, and because /proc/net is a symlink to /proc/self/net, overmounting this was almost certainly never useful (and will be blocked by future kernel versions). (#4817, #4820)
• Simplify the prepareCriuRestoreMounts logic for checkpoint-restore. (#4765, #4871)
• CI: Bump golangci-lint to v2.1. (#4747, #4754)
• CI: Switch to GitHub-hosted ARM runners. Thanks again to @​alexellis for supporting runc's ARM CI up until now. (#4844, #4856, #4867)

Static Linking Notices

The runc binary distributed with this release are statically linked with the following GNU LGPL-2.1 licensed libraries, with runc acting as a "work that uses the Library":

• libseccomp

The versions of these libraries were not modified from their upstream versions, but in order to comply with the LGPL-2.1 (§6(a)), we have attached the complete source code for those libraries which (when combined with the attached runc source code) may be used to exercise your rights under the LGPL-2.1.

... (truncated)

Sourced from github.com/opencontainers/runc's changelog.

[1.3.1] - 2025-09-05

この瓦礫の山でよぉ

Fixed

• Container processes will no longer inherit the CPU affinity of runc by default. Instead, the default CPU affinity of container processes will be the largest set of CPUs permitted by the container's cpuset cgroup and any other system restrictions (such as isolated CPUs). (#4041, #4815, #4858)
• Setting linux.rootfsPropagation to shared or unbindable now functions properly. (#1755, #1815, #4724, #4789)
• Close seccomp agent connection to prevent resource leaks. (#4796, #4799)
• runc delete and runc stop can now correctly handle cases where runc create was killed during setup. Previously it was possible for the container to be in such a state that neither runc stop nor runc delete would be unable to kill or delete the container. (#4534, #4645, #4757, #4793)
• runc update will no longer clear intelRdt state information. (#4828, #4833)
• CI: Fix exclusion rules and allow us to run jobs manually. (#4760, #4763)

Changed

• Improvements to the deprecation warnings as part of the github.com/opencontainers/cgroups split. (#4784, #4788)
• Ignore the dmem controller in our cgroup tests, as systemd does not yet support it. (#4806, #4811)
• /proc/net/dev is no longer included in the permitted procfs overmount list. Its inclusion was almost certainly an error, and because /proc/net is a symlink to /proc/self/net, overmounting this was almost certainly never useful (and will be blocked by future kernel versions). (#4817, #4820)
• Simplify the prepareCriuRestoreMounts logic for checkpoint-restore. (#4765, #4871)
• CI: Bump golangci-lint to v2.1. (#4747, #4754)
• CI: Switch to GitHub-hosted ARM runners. Thanks again to @​alexellis for supporting runc's ARM CI up until now. (#4844, #4856, #4866)

[1.3.0] - 2025-04-30

Mr. President, we must not allow a mine shaft gap!

Fixed

• Removed preemptive "full access to cgroups" warning when calling runc pause or runc unpause as an unprivileged user without --systemd-cgroups. Now the warning is only emitted if an actual permission error was encountered. (#4709)
• Several fixes to our CI, mainly related to AlmaLinux and CRIU. (#4670, #4728, #4736)

Changed

• In runc 1.2, we changed our mount behaviour to correctly handle clearing

... (truncated)

• e6457af VERSION: release v1.3.1
• 21fbc47 Merge pull request #4871 from kolyshkin/1.3-4765
• 02c4128 criu: simplify isOnTmpfs check in prepareCriuRestoreMounts
• 69a3439 criu: inline makeCriuRestoreMountpoints
• a97c49f criu: ignore cgroup early in prepareCriuRestoreMounts
• 017d6b6 criu: improve prepareCriuRestoreMounts
• efcfc5d Merge pull request #4865 from cyphar/1.3-reset-cpu-affinity
• 9a79ff4 [1.3] libct: reset CPU affinity by default
• ae7eefd [1.3] tests: add RUNC_CMDLINE for tests incompatible with functions
• c0ba3d6 [1.3] tests: add sane_run helper
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)