drop runc-dmz solution according to overlay solution#4482
drop runc-dmz solution according to overlay solution#4482cyphar merged 1 commit intoopencontainers:mainfrom
Conversation
| `runc` normally has to make a binary copy of itself when constructing a | ||
| container process in order to defend against certain container runtime attacks | ||
| such as CVE-2019-5736. |
There was a problem hiding this comment.
Ah, I forgot to document how the new overlay mode works in #4448. I'll open a separate PR for that.
There was a problem hiding this comment.
this is more of a discussion, so with the overlay change i guess memfd-bind is no longer needed? 🤔
There was a problem hiding this comment.
This is being discussed in #4450 (comment). Short answer: it has fewer upsides now and there is a fairly strong case for removing it.
lifubang
force-pushed
the
drop-dmz-binary
branch
4 times, most recently
from
fad48fe to
330755c
Compare
| | `!runc_nodmz` | Reduce memory usage for CVE-2019-5736 protection by using a small C binary, [see `memfd-bind` for more details][contrib-memfd-bind]. `runc_nodmz` disables this **experimental feature** and causes runc to use a different protection mechanism which will further increases memory usage temporarily during container startup. To enable this feature you also need to set the `RUNC_DMZ=true` environment variable. | yes || | ||
|
|
||
| The following build tags were used earlier, but are now obsoleted: | ||
| - **runc_nodmz** (since runc v1.2.1 runc dmz binary is dropped) |
There was a problem hiding this comment.
(Considering the amount of the changes I was wondering if this is going to be v1.3.0, but probably safe to cherrypick to v1.2.1, as dmz was experimental and opt-in)
There was a problem hiding this comment.
Probably https://github.com/opencontainers/runc/blob/main/docs/experimental.md should be updated to reflect the history
There was a problem hiding this comment.
I think it makes sense to drop runc-dmz now since no one is using runc_dmz (yet). Adding a backport label.
Because we have the overlay solution, we can drop runc-dmz binary solution since it has too many limitations. Signed-off-by: lifubang <lifubang@acmcoder.com>
lifubang
force-pushed
the
drop-dmz-binary
branch
from
330755c to
871057d
Compare
kolyshkin
added
the
backport/1.2-todo
lifubang
added
backport/1.2-done
5 participants
Because we have the overlay solution, we can drop runc-dmz binary solution since it has too many limitations.
The original post is here: #4450 (comment)
Because of there are many commits about runc-dmz binary solution, so doing git revert action is very hard, let's drop these code line by line.