cloudfoundry/garden-runc-release v1.10.0

GRR v1.10.0: Peas Release Me

on GitHub

• Verified with grootfs-release v0.30.0

Major Changes:

• It is now possible to specify a ProcessSpec.Image. This causes a Process to have its own filesystem view (mount namespace) and base root filesystem. Processes with their own filesystem view share other namespaces (in particular, they share the same network) and resource limits (i.e. cgroups)
• A process can additionally request independent resource limits from the rest of the container by specifying ProcessSpec.OverrideContainerLimits{}.

Limitations:

• Currently it is only possible to use ProcessSpec.Image and ProcessSpec.OverrideContainerLimits with unprivileged containers. This will be fixed in future releases.
• The only currently meaningful values for ProcessSpec.OverrideContainerLimits are nil (share limits with sandbox container - i.e. current behaviour) and Limits{} (opt-out of resource limits for this process). Future releases will add the ability to specify specific, separate memory/cpu limits for processes using this API.
• APIs such as BulkMetrics and Process.Signal may not work immediately after container.Run(ProcessSpec) returns for processes with Image and/or OverrideContainerLimits specified. This will be fixed in future releases.

Other Changes:

• We've lessened the amount of logging we do in BulkMetrics to reduce log volume in large environments
• We're now masking some more places in /proc
• Garden now correctly declares that the bundles it creates are OCI Runtime Spec version 1.0.0 compliant.