Skip to content

Stop depending on github.com/opencontainers/runc #785

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mtrmac merged 1 commit into from
Apr 24, 2026
Merged

Stop depending on github.com/opencontainers/runc #785

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 0 additions & 1 deletion common/go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,6 @@ require (
github.com/opencontainers/cgroups v0.0.6
github.com/opencontainers/go-digest v1.0.0
github.com/opencontainers/image-spec v1.1.1
github.com/opencontainers/runc v1.4.2
github.com/opencontainers/runtime-spec v1.3.0
github.com/opencontainers/runtime-tools v0.9.1-0.20260316125833-8a4db579f5c8
github.com/opencontainers/selinux v1.13.1
Expand Down
2 changes: 0 additions & 2 deletions common/go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -200,8 +200,6 @@ github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8
github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040=
github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M=
github.com/opencontainers/runc v1.4.2 h1:/AEjjXuVH9lTRl9ZyUFQj7oWBM7Xv00qFV6Vx9q5N3o=
github.com/opencontainers/runc v1.4.2/go.mod h1:ufk5PTTsy5pnGBAvTh50e+eqGk01pYH2YcVxh557Qlk=
github.com/opencontainers/runtime-spec v1.3.0 h1:YZupQUdctfhpZy3TM39nN9Ika5CBWT5diQ8ibYCRkxg=
github.com/opencontainers/runtime-spec v1.3.0/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
github.com/opencontainers/runtime-tools v0.9.1-0.20260316125833-8a4db579f5c8 h1:2NAWFjN0PmdIe3XojVL9wf3lJ1//VqAgc7MOSYHQslE=
Expand Down
3 changes: 1 addition & 2 deletions common/pkg/apparmor/apparmor_linux.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,6 @@ import (
"strings"
"text/template"

runcaa "github.com/opencontainers/runc/libcontainer/apparmor"
"github.com/sirupsen/logrus"
"go.podman.io/common/pkg/apparmor/internal/supported"
"go.podman.io/storage/pkg/fileutils"
Expand Down Expand Up @@ -271,7 +270,7 @@ func CheckProfileAndLoadDefault(name string) (string, error) {
}

// Check if AppArmor is disabled and error out if a profile is to be set.
if !runcaa.IsEnabled() {
if !supported.IsEnabledOnHost() {
if name == "" {
return "", nil
}
Expand Down
22 changes: 20 additions & 2 deletions common/pkg/apparmor/internal/supported/supported.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,5 @@
//go:build linux

package supported

import (
Expand All @@ -8,8 +10,8 @@ import (
"path/filepath"
"sync"

runcaa "github.com/opencontainers/runc/libcontainer/apparmor"
"github.com/sirupsen/logrus"
"go.podman.io/storage/pkg/fileutils"
"go.podman.io/storage/pkg/unshare"
)

Expand Down Expand Up @@ -102,7 +104,7 @@ func (d *defaultVerifier) UnshareIsRootless() bool {
}

func (d *defaultVerifier) RuncIsEnabled() bool {
return runcaa.IsEnabled()
return IsEnabledOnHost()
}

func (d *defaultVerifier) OsStat(name string) (os.FileInfo, error) {
Expand All @@ -112,3 +114,19 @@ func (d *defaultVerifier) OsStat(name string) (os.FileInfo, error) {
func (d *defaultVerifier) ExecLookPath(file string) (string, error) {
return exec.LookPath(file)
}

var isEnabledOnHost = sync.OnceValue(func() bool {
if err := fileutils.Exists("/sys/kernel/security/apparmor"); err != nil {
return false
}
buf, err := os.ReadFile("/sys/module/apparmor/parameters/enabled")
if err != nil {
return false
}
return len(buf) >= 1 && buf[0] == 'Y'
Copy link
Copy Markdown
Contributor

@kolyshkin kolyshkin Apr 24, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: I'd simplify that to len(buf) > 0.

Copy link
Copy Markdown
Contributor Author

@mtrmac mtrmac Apr 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

FWIW compilers routinely make these kinds of optimizations nowadays: https://godbolt.org/z/Yv1GrKEYE .

})

// IsEnabled returns true if apparmor is enabled for the host.
func IsEnabledOnHost() bool {
return isEnabledOnHost()
}
191 changes: 0 additions & 191 deletions vendor/github.com/opencontainers/runc/LICENSE
View file
Open in desktop

This file was deleted.

17 changes: 0 additions & 17 deletions vendor/github.com/opencontainers/runc/NOTICE
View file
Open in desktop

This file was deleted.

3 changes: 0 additions & 3 deletions vendor/github.com/opencontainers/runc/internal/linux/doc.go
View file
Open in desktop

This file was deleted.

28 changes: 0 additions & 28 deletions vendor/github.com/opencontainers/runc/internal/linux/eintr.go
View file
Open in desktop

This file was deleted.

Loading
Loading