Skip to content

Conversation

@dmcgowan
Copy link
Member

@theopenlab-ci
Copy link

theopenlab-ci bot commented Sep 14, 2020

Build succeeded.

@dmcgowan dmcgowan added this to the 1.4.1 milestone Sep 14, 2020
@AkihiroSuda
Copy link
Member

Can we cherry-pick Go 1.15 #4050 ?

@thaJeztah
Copy link
Member

@AkihiroSuda any specific reason? I'd be more comfortable holding off for a bit. The bump to Go 1.15 was just merged and I think we should give it some time there to see if there are no regressions (if possible). I realise go1.13 is now EOL, but there's not yet been security issues that affect containerd (that I'm aware of)

@AkihiroSuda
Copy link
Member

I realise go1.13 is now EOL, but there's not yet been security issues that affect containerd (that I'm aware of)

👍

I'm ok to move #4050 to 1.4.2

Copy link
Member

@thaJeztah thaJeztah left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Left some suggestions

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This one reads a bit odd; perhaps

Suggested change
* Add and update profile [containerd/containerd#4492](https://github.com/containerd/containerd/pull/4492)
* Update profile to match the Docker default profile [containerd/containerd#4492](https://github.com/containerd/containerd/pull/4492)

Or list the individual changes;

Suggested change
* Add and update profile [containerd/containerd#4492](https://github.com/containerd/containerd/pull/4492)
* Allow `preadv2` and `pwritev2` syscalls [containerd/containerd#4492](https://github.com/containerd/containerd/pull/4492)
* Allow `membarrier` syscall [containerd/containerd#4492](https://github.com/containerd/containerd/pull/4492)
* Allow `personality` syscall with `UNAME26` bit set [containerd/containerd#4492](https://github.com/containerd/containerd/pull/4492)
* Allow `sync_file_range2` sys call on supported architectures [containerd/containerd#4492](https://github.com/containerd/containerd/pull/4492)
* Allow `quotactl` syscall with `CAP_SYS_ADMIN` [containerd/containerd#4492](https://github.com/containerd/containerd/pull/4492)
* Allow `clock_settime` syscall with `CAP_SYS_TIME` [containerd/containerd#4492](https://github.com/containerd/containerd/pull/4492)

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This section is already bordering lining on too much information, was thinking maybe collapsing even more and just mentioning seccomp default profile updates and having multiple links

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, that probably works as well

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: perhaps rephrase this as a Fix ... @fuweid (suggestions?)

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Would s/Add/Allow/ be more clear?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
* Move the syslog syscall to be gated by CAP_SYS_ADMIN or CAP_SYSLOG [containerd/containerd#4491](https://github.com/containerd/containerd/pull/4491)
* Move the `syslog` syscall to be gated by `CAP_SYS_ADMIN` or `CAP_SYSLOG` [containerd/containerd#4491](https://github.com/containerd/containerd/pull/4491)

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
* Add `io_uring_` syscalls [containerd/containerd#4493](https://github.com/containerd/containerd/pull/4493)
* Allow `io_uring_` syscalls [containerd/containerd#4493](https://github.com/containerd/containerd/pull/4493)

Copy link
Member

@estesp estesp left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Agree with some of the suggested wording changes in comments.

Overall LGTM

@thaJeztah
Copy link
Member

do we need #4538 for v1.4.1? @fuweid ?

Copy link
Member

@mikebrow mikebrow Sep 15, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit add blurb: CNI v0.8.0 and CNI plugins v0.8.6 are included and have been tested to work with this service update.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actually probably just remove this section as I don't see a specific reason it was backported in the first place. Just didn't quite make the cutoff. The dependencies changes should show up at the bottom, I'll see if I can get that fixed.

Signed-off-by: Derek McGowan <[email protected]>
@dmcgowan
Copy link
Member Author

Updated, simplified the notable updates

Can we cherry-pick Go 1.15

Let's wait a bit on this on, I think we should be very cautious about updating the major go version in our stable releases. We will need to in 1.4.x at some point though.

@theopenlab-ci
Copy link

theopenlab-ci bot commented Sep 15, 2020

Build succeeded.

Copy link
Member

@thaJeztah thaJeztah left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

Copy link
Member

@cpuguy83 cpuguy83 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

Copy link
Member

@estesp estesp left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@dmcgowan dmcgowan merged commit c623d1b into containerd:release/1.4 Sep 16, 2020
@fuweid
Copy link
Member

fuweid commented Sep 16, 2020

@thaJeztah

do we need #4538 for v1.4.1? @fuweid ?

sorry for late reply. just wait for next point release ~

kevpar added a commit to kevpar/containerd that referenced this pull request Oct 26, 2020
containerd 1.4.1

Welcome to the v1.4.1 release of containerd!

The first patch release for `containerd` 1.4 includes a fix for v1 shims hanging
on exit and exec when the log pipe fills up along with other minor changes.

* Always consume shim logs to prevent logs in the shim from blocking [containerd#4546](containerd#4546)
* Fix error deleting v2 bundle directory when removing rootfs returns `ErrNotExist` [containerd#4472](containerd#4472)
* Fix metrics monitoring of v2 runtime tasks [containerd#4486](containerd#4486)
* Fix incorrect stat for Windows containers [containerd#4468](containerd#4468)
* Fix devmapper device deletion on rollback [containerd#4437](containerd#4437)
* Update seccomp default profile [containerd#4481](containerd#4481) [containerd#4491](containerd#4491) [containerd#4492](containerd#4492) [containerd#4493](containerd#4493)

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

* Sebastiaan van Stijn
* Derek McGowan
* Wei Fu
* Brian Goff
* Akihiro Suda
* Antonio Ojea
* Jintao Zhang
* Phil Estes
* Kazuyoshi Kato
* Li Yuxuan
* Mike Brown
* Prashant Bhutani
<details><summary>36 commits</summary>
<p>

* [`c623d1b3`](containerd@c623d1b) Merge pull request  [containerd#4564](containerd#4564) from dmcgowan/prepare-1.4.1
* [`97d690d2`](containerd@97d690d) Prepare v1.4.1 release
* [`910da2fb`](containerd@910da2f) Merge pull request  [containerd#4555](containerd#4555) from thaJeztah/1.4_backport_bumpcni
* [`ca3b91d8`](containerd@ca3b91d) Merge pull request  [containerd#4560](containerd#4560) from dmcgowan/backport-4546
* [`42f38718`](containerd@42f3871) Always consume shim logs
* [`ea29a60a`](containerd@ea29a60) Merge pull request  [containerd#4558](containerd#4558) from thaJeztah/1.4_backport_winstats
* [`db931948`](containerd@db93194) Merge pull request  [containerd#4557](containerd#4557) from thaJeztah/1.4_backport_makefile_test_tags
* [`9b5066aa`](containerd@9b5066a) Merge pull request  [containerd#4556](containerd#4556) from thaJeztah/1.4_backport_fix_static_plugin
* [`3bcce819`](containerd@3bcce81) Merge pull request  [containerd#4554](containerd#4554) from thaJeztah/1.4_backport_add_openat2_syscall
* [`98a733e0`](containerd@98a733e) Merge pull request  [containerd#4552](containerd#4552) from thaJeztah/1.4_backport_shim_exec_p_debug
* [`f247618a`](containerd@f247618) Report correct stats for windows containers
* [`cc5d1518`](containerd@cc5d151) Update go list to respect build tags
* [`086e859d`](containerd@086e859) BUILDING.md: fix description about static builds
* [`16712ae4`](containerd@16712ae) bump cni version to v0.8.0
* [`1575c88c`](containerd@1575c88) seccomp: add `faccessat2` syscall.
* [`8bd2bece`](containerd@8bd2bec) seccomp: add `openat2` syscall.
* [`4e3397e0`](containerd@4e3397e) shimv1: downgrade poroccess missing log to debug
* [`6b5fc7f2`](containerd@6b5fc7f) Merge pull request  [containerd#4542](containerd#4542) from thaJeztah/1.4_backport_forward_signal_not_found
* [`d118c90d`](containerd@d118c90) Ignore SIGURG signals in signal forwarder
* [`3ee6189f`](containerd@3ee6189) Exit signal forward if process not found
* [`1a367762`](containerd@1a36776) Merge pull request  [containerd#4512](containerd#4512) from fuweid/14-cherry-pick-4486
* [`a1289d6b`](containerd@a1289d6) tasks: Monitor v2 tasks in initFunc as well
* [`12f20c99`](containerd@12f20c9) Merge pull request  [containerd#4503](containerd#4503) from thaJeztah/1.4_backport_seccomp_updates
* [`1f823f76`](containerd@1f823f7) seccomp: allow io-uring related system calls
* [`3d28944b`](containerd@3d28944) seccomp: allow clock_settime when CAP_SYS_TIME is added
* [`e5cc7d52`](containerd@e5cc7d5) seccomp: allow quotactl with CAP_SYS_ADMIN
* [`20273a80`](containerd@20273a8) seccomp: allow sync_file_range2 on supported architectures.
* [`357d1002`](containerd@357d100) seccomp: allow personality with UNAME26 bit set
* [`0c9de662`](containerd@0c9de66) seccomp: allow syscall membarrier
* [`caa46116`](containerd@caa4611) seccomp: allow adjtimex get time operation
* [`2b80b7dc`](containerd@2b80b7d) seccomp: allow add preadv2 and pwritev2 syscalls
* [`e71eccbc`](containerd@e71eccb) seccomp: move the syslog syscall to be gated by CAP_SYS_ADMIN or CAP_SYSLOG
* [`881db9b5`](containerd@881db9b) Merge pull request  [containerd#4499](containerd#4499) from fuweid/cherry-pick-4472
* [`feff914a`](containerd@feff914) runtime: ignore ErrNotExist when remove rootfs
* [`94c8bd94`](containerd@94c8bd9) Merge pull request  [containerd#4496](containerd#4496) from kzys/backport-1.4-4437
* [`23e0ea27`](containerd@23e0ea2) snapshots/devmapper: fix rollback
</p>
</details>
<details><summary>4 commits</summary>
<p>

* [`8fbf363`](containerd/go-cni@8fbf363) Merge pull request  [containerd#56](containerd/go-cni#56) from aojea/bumpcni
* [`49657db`](containerd/go-cni@49657db) bump containernetworking/cni dependency to 0.8.0
* [`1582593`](containerd/go-cni@1582593) Merge pull request  [containerd#58](containerd/go-cni#58) from fuweid/update-readme-usage
* [`8ffba88`](containerd/go-cni@8ffba88) README.md: update Usage case
</p>
</details>

* **github.com/containerd/go-cni**            v1.0.0 -> v1.0.1
* **github.com/containernetworking/cni**      v0.7.1 -> v0.8.0
* **github.com/containernetworking/plugins**  v0.7.6 -> v0.8.6

Previous release can be found at [v1.4.0](https://github.com/containerd/containerd/releases/tag/v1.4.0)
@dmcgowan dmcgowan deleted the prepare-1.4.1 branch March 23, 2022 22:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

7 participants