Release v1.2.1

[rata]

I propose to release 1.2.1 early next week TODAY (see comment asking for it here: #4500 (review)). containerd needs the fixes here to properly update to the 1.2.x branch.

---

[1.2.1] - 2024-11-05

No existe una escuela que enseñe a vivir.

Fixed

• Became root after joining an existing user namespace. Otherwise, runc
  won't have permissions to configure some mounts when running under
  SELinux and runc is not creating the user namespace. (containerd's TestPodUserNS fails with runc v1.2 (succeeds with crun) on SELinux distro: setxattr /[...]/dev/mqueue: operation not permitted #4466, [1.2] libct/nsenter: become root after joining userns  #4477)

Changed

• Remove dependency on golang.org/x/sys/execabs from go.mod. ([1.2] libct: rm x/sys/execabs usage #4480)
• Remove runc-dmz, that had many limitations, and is mostly made obsolete by
  the new protection mechanism added in v1.2.0. Note that runc-dmz was only
  available only in the 1.2.0 release and required to set an environment variable
  to opt-in. ([1.2] drop runc-dmz solution according to overlay solution #4488)
• The script/check-config.sh script now checks for overlayfs support. ([1.2] Post overlay addition and dmz removal nits #4494)
• When using cgroups v2, allow to set memory to unlimited and swap to a
  specific value. ([1.2] runc update: fix updating swap for cgroup v2 #4501)

[rata]

Grrr, codespell is failing because it wants to correct spanish, that is written properly -.-. Changed it to another phrase now.

[rata]

Updated the release date for TODAY, as @AkihiroSuda asked

[rata]

Also, please feel free to push to this branch if you want to release today (maintainers can push). It's quite late here, I won't be online much longer.

[cyphar]

LGTM. I'll prep the release.

[cyphar]

You forgot to update VERSION in the release commit. Pushing a fix...

[cyphar]

https://github.com/opencontainers/runc/releases/tag/v1.2.1

[h-vetinari]

Congratulations on the release! Just two comments from reading the release notes

Fixed

• Became root after [...]

The release notes don't have the "Fixed" header, and so the sentence starting with "Became root" is pretty hard to make sense of.

Also, the current release notes say (my emphasis)

In addition, runc-dmz (added in 1.2.0) has been removed entirely. This was opt-out (due to the many limitations it had)

which should probably say "opt-in", c.f. the following from the OP

Note that runc-dmz was only available only in the 1.2.0 release and required to set an environment variable to opt-in.

[cyphar]

@h-vetinari Fixed. Turns out I can't proofread properly late at night... 😅