Skip to content

Commit 33874e0

Browse files
committed
v3.9.0 release
1 parent 0315737 commit 33874e0

File tree

6 files changed

+41
-15
lines changed

6 files changed

+41
-15
lines changed

ChangeLog

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,8 @@
77
* Fix binfmt_misc for rootless container.
88
* Support mount flags as prefix of source.
99
* Support tmpfs and overlayfs as mount source.
10+
* Unset all environment variables before running container.
11+
* Fix: drop CAP_SYS_CHROOT to avoid escape.
1012
# v3.8:
1113
* Support more platforms, currently supports: arm64, armv7, armhf, riscv64, i386, loong64, s390x, ppc64le and x86_64.
1214
* Improve rootless container support.

README.md

Lines changed: 0 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -12,17 +12,6 @@ It's fully recommended to drop CAP_SYS_CHROOT or enable unshare, chroot containe
1212
*Update: Considering the security issues of chroot, ruri will drop CAP_SYS_CHROOT by default now
1313
If you got any issues with this, please report.
1414

15-
# The upcoming v3.9:
16-
The feature is stable now, but we are still working on the documentation and code stabilization.
17-
18-
This version will be released with a complete behavior specification, all future versions will not introduce any breaking changes, the backward compatibility will be guaranteed.
19-
20-
v3.9 will be the last development version of ruri, we are planning to fully freeze the features in v4.x, so there will not be any new features after v4.x, but only bug fixes and security updates.
21-
22-
Although ruri is not a fully tested and trusted tool, we will try to make it as stable as possible, we will always revamp, until reach ideal.
23-
24-
If you have any feature requests, please open an issue, we will consider adding it after v3.9 is released.
25-
2615
# WARNING
2716

2817
For production, I fully recommand you to use tools like [crun](https://github.com/containers/crun), [youki](https://github.com/youki-dev/youki), [containerd](https://containerd.io/), [docker](https://www.docker.com/), [podman](https://podman.io/), [LXC](https://linuxcontainers.org/), [bubblewrap](https://github.com/containers/bubblewrap), they are more secure and stable. This is a non-OCI tool and, you take your own risk using it when you really need. The whole project is experimental!

doc/init.md

Lines changed: 31 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,45 @@
11
# Initialization of container:
2+
The design of ruri is very simple, just init the environment and then call exec() to run the command in the container. For unshare container, ruri will fork() into namwspace, so there will be a process called `ruri` on host, but chroot container will not have this behavior.
3+
24
## Signal:
35
ruri will ignore SIGTTIN and SIGTTOU signals, so that the container can run in the background without being killed by these signals. This behavior cannot be overridden (#TODO: Maybe we can use environment variable to control this behavior in the future).
46

57
## The runtime files:
8+
### Mounts:
69
- /sys will be mounted as sysfs.
710
- /proc will be mounted as procfs.
811
- /dev will be mounted as tmpfs.
912
- /dev/pts will be mounted as devpts.
1013
- /dev/shm will be mounted as tmpfs.
11-
14+
### Devices:
15+
ruri will automatically create these devices in the container:
16+
```console
17+
/ # tree /dev
18+
/dev
19+
├── console
20+
├── fd -> /proc/self/fd
21+
├── net
22+
│ └── tun
23+
├── null
24+
├── ptmx
25+
├── pts
26+
│ └── ptmx
27+
├── random
28+
├── shm
29+
├── stderr -> /proc/self/fd/2
30+
├── stdin -> /proc/self/fd/0
31+
├── stdout -> /proc/self/fd/1
32+
├── tty
33+
├── tty0 -> /dev/null
34+
├── urandom
35+
└── zero
36+
```
37+
### Masked paths:
1238
And, some path will be masked by ruri, unless `--unmask-dirs` is set, for details, see init_container() in src/chroot.c and init_rootless_container() in src/rootless.c.
39+
### Customizable behavior:
40+
You can use `-j` option to disable mounting/creating these files.
41+
You can use `-I` option to create a custom character device in /dev. #Note: rootless container will not support this option.
42+
You can use `-m` option to mount custom source from host.
1343
## Noteable file changes:
1444
- /.rurienv is managed by ruri, you should not try to edit or remove it.
1545
- /qemu-ruri will be created by ruri if `-q` option is set, and the path of qemu binary is on host but not in container.

src/chroot.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -641,6 +641,7 @@ void ruri_run_chroot_container(struct RURI_CONTAINER *_Nonnull container)
641641
// Ignore SIGTTIN, if we are running in the background, SIGTTIN may kill this process.
642642
// This code is wrote when ruri had a daemon process,
643643
// now even the daemon mode is removed, I still keep this code here.
644+
// TODO: Add a way to disable this behavior.
644645
sigset_t sigs;
645646
sigemptyset(&sigs);
646647
sigaddset(&sigs, SIGTTIN);
@@ -786,6 +787,7 @@ void ruri_run_rootless_chroot_container(struct RURI_CONTAINER *_Nonnull containe
786787
* This function is modified from ruri_run_chroot_container().
787788
*/
788789
// Ignore SIGTTIN, if we are running in the background, SIGTTIN may kill this process.
790+
// TODO: Add a way to disable this behavior.
789791
sigset_t sigs;
790792
sigemptyset(&sigs);
791793
sigaddset(&sigs, SIGTTIN);

src/include/version.h

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,4 +29,7 @@
2929
*
3030
*/
3131
// Version info.
32-
#define RURI_VERSION "3.9-beta1"
32+
#define RURI_VERSION "3.9"
33+
#define RURI_VERSION_MAJOR 3
34+
#define RURI_VERSION_MINOR 9
35+
#define RURI_VERSION_PATCH 0

src/info.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,7 @@ void ruri_show_version_info(void)
5151
cprintf("{base} Licensed under the MIT License\n");
5252
cprintf("{base} <https://mit-license.org>\n");
5353
cprintf("{base} Copyright (C) 2022-2024 Moe-hacker\n\n");
54-
cprintf("{base}%s%s%s", "ruri version .....: ", RURI_VERSION, "\n");
54+
cprintf("{base}%s%d.%d.%d%s", "ruri version .....: ", RURI_VERSION_MAJOR, RURI_VERSION_MINOR, RURI_VERSION_PATCH, "\n");
5555
#if defined(RURI_COMMIT_ID)
5656
cprintf("{base}%s%s%s", "ruri commit id ...: ", RURI_COMMIT_ID, "\n");
5757
#endif
@@ -81,7 +81,7 @@ void ruri_show_version_code(void)
8181
* so in fact it's very useless.
8282
* Maybe it can be useful one day...
8383
*/
84-
cprintf("%s\n", RURI_VERSION);
84+
printf("%d.%d.%d\n", RURI_VERSION_MAJOR, RURI_VERSION_MINOR, RURI_VERSION_PATCH);
8585
}
8686
// For `ruri -h`.
8787
void ruri_show_helps(void)

0 commit comments

Comments
 (0)