Release runc 1.1.6

[kolyshkin]

[1.1.6] - 2023-04-11

In this world nothing is certain but death and taxes.

Compatibility

• This release can no longer be built from sources using Go 1.16. Using a
  latest maintained Go 1.20.x or Go 1.19.x release is recommended.
  Go 1.17 can still be used.

Fixed

• systemd cgroup v1 and v2 drivers were deliberately ignoring UnitExist error
  from systemd while trying to create a systemd unit, which in some scenarios
  may result in a container not being added to the proper systemd unit and
  cgroup. (runc systemd cgroup driver logic is wrong #3780, [1.1] Fix systemd cgroup driver's Apply (and make CI green again) #3806)
• systemd cgroup v2 driver was incorrectly translating cpuset range from spec's
  resources.cpu.cpus to systemd unit property (AllowedCPUs) in case of more
  than 8 CPUs, resulting in the wrong AllowedCPUs setting. ([1.1] cgroups: cpuset: fix byte order while parsing cpuset range to bits #3808)
• systemd cgroup v1 driver was prefixing container's cgroup path with the path
  of PID 1 cgroup, resulting in inability to place PID 1 in a non-root cgroup. ([1.1] libctr/cgroups: don't take init's cgroup into account #3811)
• runc run/start may return "permission denied" error when starting a rootless
  container when the file to be executed does not have executable bit set for
  the user, not taking the CAP_DAC_OVERRIDE capability into account. This is
  a regression in runc 1.1.4, as well as in Go 1.20 and 1.20.1 (Runc 1.1.4 container fails with permission denied: unknown when relying on capabilities #3715, [1.1] Fix runc run "permission denied" when rootless #3817)
• Various CI fixes and improvements, mostly to ensure Go 1.19.x and Go 1.20.x
  compatibility.

[thaJeztah]

LGTM

[mrunalp]

LGTM

[hqhq]

LGTM

[cyphar]

LGTM. I'll do the release after the long weekend. (I've also written a script and am working on a CI setup for us to be able to have more than one person sign releases.)

[kolyshkin]

@cyphar if we can include this last-minute fix to 1.1.6 that'd be great: #3823

[cyphar]

@kolyshkin Done. I've rebased it here, but I wonder if you'd also want to update the changelog in the release commit? I can prep the release as soon as you've fixed it up.

[thaJeztah]

still LGTM

[kolyshkin]

@kolyshkin Done. I've rebased it here, but I wonder if you'd also want to update the changelog in the release commit? I can prep the release as soon as you've fixed it up.

Done

[cyphar]

LGTM.