转载

联想手机彻底没救？员工吐槽都是内斗的结果_IT新闻_博客园

runC是一个轻量级的通用运行时容器，runC的目标是让用户随时随地使用标准化的容器，功能和特性：

完整支持Linux命名空间，包括用户命名空间。
原生支持Linux的所有安全功能，包括Selinux、Apparmor、seccomp、control groups、capability drop、pivot_root、uid/gid dropping等。
原生支持实时迁移和Windows 10容器。
计划为Arm、Power、Sparc等架构提供原生支持，并直接得到Arm、Intel、Qualcomm、IBM，以及整个硬件制造商生态系统的参与和支持。
计划为前沿硬件功能提供原生支持，例如DPDK、sr-iov、tpm、secure enclave等。
可移植的性能配置文件，以及成为正式标准的配置格式。

更新日志

Add slice management support to the systemd cgroup driver. Checks are
done to make sure that systemd supports the feature. #1084
Support for readonly mount labels. #1112
Add a tmpcopyup mount extension for tmpfs mounts that are mounted over
already existing directories, allowing for the contents of a volume to
be copied up transparently. #845

Switch our pivot_root usage to no longer require temporary
directories, improving the state of containters running in entirely
readonly contexts. #1125 #1148
Allow updating of rt_period_us and rt_runtime_us in cpuacct cgroup.
Reimplement console handling to use AF_UNIX sockets such that the
console is created inside the container's (namespaced) devpts
instance, solving a wide variety of historical pty bugs with runC.
#1018 #1356
Support overlayfs in mounts. #1314
Support creating devices with types 'p' and 'u'. #1321
Add --preserve-fds=N to create and run commands. #1320
Add pre-dump and parent-path to checkpoint. #1001
Update to runtime-spec v1.0.0-rc5. #1370
Remove check for binding to /. #1090
Ensure we log to logrus on command errors. #1089
Don't enable kmem limits if they're not specified in the config. #1095
Handle cases where specs.Resources.* members would cause null
dereferences. #1111 #1116
Fix bugs in the GetProcessStartTime implementation. #1136
Make sysctl config validation checks handle network namespaces more
gracefully. #1138 #1149
Guarantee correct namespace creation ordering. This is part of the
rootless container patchset, and is also required in certain SELinux
setups. #977
Stop screwing around with '/n' in console output. #1146
Fix cpuset.cpu_exclusive handling. #1194
Sync HookState with the OCI specification. #1201
Split remounting mountpoints and bindmounts, resolving issues with
mount options being dropped in certain cases. #1222
Fix leftover cgroup directory issue. #1196
Handle config.Devices and config.MaskPaths in checkpoint. #1110.
Don't create combined cgroup subsystem names. #1268
Ignore cgroupv2 mountpoints, fixing issues with systemd v232. #1266
Race condition when synchronising with children and grandchildren in
nsexec.c. #1237
Fix state checks to no longer depend on _LIBCONTAINER being present in
the environment, fixing both bugs as well as being part of the
rootless container patchset. #1317
Fix systemd-notify when using different PID namespaces, and allow
detach+notify socket. #1308
Don't fchown when inheriting stdio, which is necessary for rootless
containers in certain scenarios. #1354
Fix cpu.cfs_quota_us being changed when systemd is reloaded. #1344
Add devices to whitelist for LXD, to make runC under LXC/LXD work
better. #1327
Many improvements to testing. #1121 #1131 #1132 #1147