[v0.11 backport] Dockerfile: RUNC_VERSION=v1.1.5

[AkihiroSuda]

Cherry-pick:

• Dockerfile: RUNC_VERSION=v1.1.5 #3762

[thaJeztah]

LGTM do we want this in the 0.10 branch as well, or not worth the effort?

[tonistiigi]

@thaJeztah Did you find out more about the error with container not starting in new runc because of mount validation(and possible fd switch)? Is this safe to pick?

[thaJeztah]

@tonistiigi you mean the rootless errors on the other PR? No.

Must admit that I didn't dig into it, and was slightly hoping it would ring a bell for @AkihiroSuda

[tonistiigi]

@thaJeztah This one(copy from your message):

runc run failed: unable to start container process: error during container init: error mounting "/var/lib/docker/buildkit/executor/resolv.conf" to rootfs at "/etc/resolv.conf": possibly malicious path detected -- refusing to operate on /var/lib/docker/buildkit/executor/0lohmsr4ts1xojesl2zn2lboj/rootfs/etc/resolv.conf (deleted)

That's an error from runc; https://github.com/opencontainers/runc/blame/1b4cf1d2aeb425d20e1de48af8e8a916ca4185e4/libcontainer/utils/utils.go#L128

And could be if there's some weird mounts / symlinks involved; https://github.com/opencontainers/runc/blame/1b4cf1d2aeb425d20e1de48af8e8a916ca4185e4/libcontainer/utils/utils.go#L123-L129

// Double-check the path is the one we expected.
procfd := "/proc/self/fd/" + strconv.Itoa(int(fh.Fd()))
if realpath, err := os.Readlink(procfd); err != nil {
	return fmt.Errorf("procfd verification failed: %w", err)
} else if realpath != path {
	return fmt.Errorf("possibly malicious path detected -- refusing to operate on %s", realpath)
}

Which was opencontainers/runc@0ca91f4, and a mitigation for CVE-2021-30465

[thaJeztah]

Oh! Nope, didn't find yet; but a colleague mentioned that they encountered that error occasionally in CI on that repo (we should probably look if we can track those failures as well)

[AkihiroSuda]

Rebased

[thaJeztah]

LGTM

[thaJeztah]

Per the other thread; do we need containerd v1.6.20 as well, or best to do separately? (maybe separately is okay to not mix backports)

[AkihiroSuda]

Can be done separately