Signed-off-by: Rodrigo Campos <[email protected]>

Rodrigo Campos (2):
  VERSION: back to development
  VERSION: release v1.2.1

LGTMs: AkihiroSuda kolyshkin cyphar

Remove prompt symbols (`$`, `%`) for ease of copy-pasting

Signed-off-by: Akihiro Suda <[email protected]>
(cherry picked from commit c8f5d03)
Signed-off-by: Austin Vazquez <[email protected]>

Akihiro Suda (1):
  docs: remove prompt symbols from shell snippets

LGTMs: AkihiroSuda cyphar

Signed-off-by: Akihiro Suda <[email protected]>
(cherry picked from commit 9ce7392)
Signed-off-by: lfbzhm <[email protected]>

In Fedora 41, dnf5 is used and it does not have dnf shell. Let's use
old dnf update; dnf install instead. It is two transactions instead
of one, but dnf5 is faster.

While at it:
 - add `--setopt=tsflags=nodocs` as we don't need docs in CI;
 - change golang-go to golang as this is a new rpm name;
 - remove gcc as it is now required by golang-bin;
 - remove container-selinux, criu, fuse-sshfs, iptables from rpms
   as they are already installed.

Signed-off-by: Kir Kolyshkin <[email protected]>
(cherry picked from commit 609e9a5)
Signed-off-by: lfbzhm <[email protected]>

An issue with runc 1.2.0 was reported to buildkit, in which
runc delete returns with an error, with the log saying:

> unable to destroy container: unable to remove container's cgroup: open /sys/fs/cgroup/snschvixiy3s74w74fjantrdg: no such file or directory

Apparently, what happens is runc is running with no cgroup access
(because /sys/fs/cgroup is mounted read-only). In this case error to
create a cgroup path (in runc create/run) is ignored, but cgroup removal
(in runc delete) is not.

This is caused by commit d3d7f7d, which changes the cgroup removal
logic in RemovePath. In the current code, if the initial rmdir has
failed (in this case with EROFS), but the subsequent os.ReadDir returns
ENOENT, it is returned (instead of being ignored -- as the path does not
exist and so there is nothing to remove).

Here is the minimal fix for the issue.

Signed-off-by: Kir Kolyshkin <[email protected]>
(cherry picked from commit db59489)
Signed-off-by: lfbzhm <[email protected]>

If the sub-cgroup RemovePath has failed for any reason, return the
error right away. This way, we don't have to check for err != nil
before retrying rmdir.

This is a cosmetic change and should not change any functionality.

Signed-off-by: Kir Kolyshkin <[email protected]>
(cherry picked from commit 12e06a7)
Signed-off-by: lfbzhm <[email protected]>

Let's explain in greater details what's happening here and why.

Signed-off-by: Kir Kolyshkin <[email protected]>
(cherry picked from commit ba3d026)
Signed-off-by: lfbzhm <[email protected]>

[1.2] CI: bump Fedora 40 -> 41

Signed-off-by: lfbzhm <[email protected]>
(cherry picked from commit 119111a)
Signed-off-by: lfbzhm <[email protected]>

[1.2] runc delete: fix for rootless cgroup + ro cgroupfs

If /run/runc and /usr/bin are on different filesystems, overlayfs may
enable the xino feature which results in the following log message:

  kernel: overlayfs: "xino" feature enabled using 3 upper inode bits.

Each time we have to protect /proc/self/exe. So disable xino to remove
the log message (we don't care about the inode numbers of the files
anyway).

Signed-off-by: Aleksa Sarai <[email protected]>
(cherry picked from commit 9bc42d6)
Signed-off-by: lfbzhm <[email protected]>

Signed-off-by: Aleksa Sarai <[email protected]>
(cherry picked from commit aa505bf)
Signed-off-by: lfbzhm <[email protected]>

Fixes: 871057d ("drop runc-dmz solution according to overlay solution")
Signed-off-by: Aleksa Sarai <[email protected]>
(cherry picked from commit b9dfb22)
Signed-off-by: lfbzhm <[email protected]>

Arguably these docs should live elsewhere (especially if we plan to
remove memfd-bind in the future), but for now this is the only place
that fully explains this issue.

Suggested-by: Rodrigo Campos <[email protected]>
Signed-off-by: Aleksa Sarai <[email protected]>
(cherry picked from commit ac43589)
Signed-off-by: lfbzhm <[email protected]>

[1.2] dmz: overlay: minor fixups

Signed-off-by: Kir Kolyshkin <[email protected]>