build(deps): Bump github.com/opencontainers/runc from 1.4.3 to 1.5.1

[dependabot]

Bumps github.com/opencontainers/runc from 1.4.3 to 1.5.1.

Release notes

Sourced from github.com/opencontainers/runc's releases.

runc v1.5.0 -- "Why do we even have that lever?!"

This is the somewhat-delayed^Wlong-awaited first stable release of the 1.5.z release branch of runc. It contains a handful of fixes for issues found in 1.5.0-rc.3 and an important dependency bump for libpathrs.

This is the third release of runc following our new release and support policy (see RELEASES.md for more details). This means that, as of this release:

• The runc 1.2.z (and earlier) release branches are now completely unsupported.
• The runc 1.3.z release branch will now only receive high severity CVE fixes, and will no longer be supported in less than 6 months (end of October 2026).
• The runc 1.4.z release branch will now only recieve security and "significant" bugfixes.
• Users are encouraged to plan migrating to runc 1.5.0 as soon as possible.
• Despite this release being delayed by over a month, users should still expect a runc 1.6.0 release in late October 2026.

Added

• runc version and runc features now provide version information about libpathrs (when runc is built with the libpathrs build tag). (#5291, #5328)

Fixed

• Since runc 1.3.0, the org.opencontainers.runc.version annotation included in runc features contained an extraneous \n, possibly causing issues with tools that parse the output. It is now properly stripped. (#5329, #5330, #5331, #5335)

Changed

• runc (when built with the libpathrs build tag) now depends on libpathrs v0.2.5 or later, and attempting to build with older versions will cause compilation errors. (#5291, #5328)
• Switched to go-criu v8.3.0, which reduces our binary size from ~16MB to ~14MB. (#5312, #5326)

Static Linking Notices

The runc binaries distributed with this release are statically linked with the following GNU LGPL-2.1 licensed libraries, with runc acting as a "work that uses the Library":

... (truncated)

Changelog

Sourced from github.com/opencontainers/runc's changelog.

[1.5.1] - 2026-07-14

El lujo es vulgaridad, dijo, y me conquistó.

Fixed

• There was a regression reported in with the maskPaths optimisation added in 1.5.0-rc.3 (#5275). On Ubuntu Focal (20.04), attempts to mount tmpfs with the nr_inodes=1 option will fail due to a downstream kernel patch (ironically originating from AUFS). We now have a fallback path using nr_inodes=2 instead if the operation fails. (#5348, #5358, #5359)
• Properly handle EINVAL for seccomp SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV when trying to rewrite the filter. This appears to only happen if you compile runc with libseccomp >= 2.6.0 and then run it with an < 2.6.0 libseccomp. (#5347, #5354)

[1.5.0] - 2026-06-19

Why do we even have that lever?!

Added

• runc version and runc features now provide version information about libpathrs (when runc is built with the libpathrs build tag). (#5291, #5328)

Fixed

• Since runc 1.3.0, the org.opencontainers.runc.version annotation included in runc features contained an extraneous \n, possibly causing issues with tools that parse the output. It is now properly stripped. (#5329, #5330, #5331, #5335)

Changed

• runc (when built with the libpathrs build tag) now depends on libpathrs v0.2.5 or later, and attempting to build with older versions will cause compilation errors. (#5291, #5328)
• Switched to go-criu v8.3.0, which reduces our binary size from ~16MB to ~14MB. (#5312, #5326)

[1.5.0-rc.3] - 2026-06-13

The best way to get a drink out of a Vogon is to stick your finger down his throat.

Security

This release includes a fix for the following low-severity security issue:

• [CVE-2026-41579][] allowed a malicious image with a /dev symlink to have limited write access to the host filesystem in ways that our analysis indicates was too limited to be problematic in practice. This bug was very

... (truncated)

Commits

• 8f2685a VERSION: release v1.5.1
• 1846115 Merge pull request #5357 from rata/1.5-fix-CI
• 62a3230 tests/integration: Simplify delete_netns()
• 0a4cc77 tests: Clarify the interface might not be on the host
• cc0c204 tests: Unset ns_path when deleting the netns
• 591db7d tests/checkpoint.bats: Move netdev code outside of setup()
• 5514481 tests: fix dummy0 flakes
• 3ba5ef1 Merge pull request #5359 from lifubang/backport-5358-to-release-1.5
• 6dc94f9 libct: retry with nr_inodes=2 to fix Focal mount errors
• 79cf0d6 Merge pull request #5354 from lifubang/backport-5347-to-release-1.5
• Additional commits viewable in compare view

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[cdesiniotis]

@dependabot rebase

[cdesiniotis]

@tariq1890 our builds are failing. There is a method that was removed in runc 1.5.0 that we use.

[tariq1890]

Is this a method that we can add directly to this project?

A cursory glance says yes, I suppose?

func WithProcfd(root, unsafePath string, fn func(procfd string) error) error {
	// Remove the root then forcefully resolve inside the root.
	unsafePath = pathrs.LexicallyStripRoot(root, unsafePath)
	fullPath, err := securejoin.SecureJoin(root, unsafePath)
	if err != nil {
		return fmt.Errorf("resolving path inside rootfs failed: %w", err)
	}

	procSelfFd, closer := ProcThreadSelf("fd/")
	defer closer()

	// Open the target path.
	fh, err := os.OpenFile(fullPath, unix.O_PATH|unix.O_CLOEXEC, 0)
	if err != nil {
		return fmt.Errorf("open o_path procfd: %w", err)
	}
	defer fh.Close()

	procfd := filepath.Join(procSelfFd, strconv.Itoa(int(fh.Fd())))
	// Double-check the path is the one we expected.
	if realpath, err := os.Readlink(procfd); err != nil {
		return fmt.Errorf("procfd verification failed: %w", err)
	} else if realpath != fullPath {
		return fmt.Errorf("possibly malicious path detected -- refusing to operate on %s", realpath)
	}

	return fn(procfd)
}