runc: bump to newest version

[christoph-zededa]

This version includes a fix for CVE-2024-21626 which allowed an attacker in bad circumstances to
"escape containerized environments".

See also https://access.redhat.com/security/cve/cve-2024-21626

- What I did

Bumped runc version

- How I did it
Changed variable in dockerfile

- How to verify it

1. Remove in runc/Dockerfile everything from '#FROM scratch' (including itself)
2. Run 'docker build -t runc . && docker run -it runc runc --version"
3. Check that the version if 1.1.12

- Description for the changelog
Bumping runc to fix CVE-2024-21626

- A picture of a cute animal (not mandatory but encouraged)

https://en.wikipedia.org/wiki/Punxsutawney_Phil#/media/File:Punxsutawney_Phil_2018_(cropped).jpg

[deitch]

@christoph-zededa this looks good. You need to update the downstream dependencies as well. CI will pick up on all of the changes and push them out, but you need to tell downstream to use the updated linuxkit/runc package.

I cannot find the docs on it now - no idea why - but all you need to do is run the update:

./scripts/update-component-sha.sh --pkg ./pkg/runc

That will calculate the tag for pkg/runc and then update any yml in any subdir. You will need to create a new commit for it.

Once that is in, CI will catch everything.

[christoph-zededa]

@christoph-zededa this looks good. You need to update the downstream dependencies as well. CI will pick up on all of the changes and push them out, but you need to tell downstream to use the updated linuxkit/runc package.

I cannot find the docs on it now - no idea why - but all you need to do is run the update:

./scripts/update-component-sha.sh --pkg ./pkg/runc

That will calculate the tag for pkg/runc and then update any yml in any subdir. You will need to create a new commit for it.

Once that is in, CI will catch everything.

Done that, but now I see it has appended "-dirty" to the tags.

[christoph-zededa]

@christoph-zededa this looks good. You need to update the downstream dependencies as well. CI will pick up on all of the changes and push them out, but you need to tell downstream to use the updated linuxkit/runc package.
I cannot find the docs on it now - no idea why - but all you need to do is run the update:

./scripts/update-component-sha.sh --pkg ./pkg/runc

That will calculate the tag for pkg/runc and then update any yml in any subdir. You will need to create a new commit for it.
Once that is in, CI will catch everything.

Done that, but now I see it has appended "-dirty" to the tags.

Resolved - seems the issue was that I had to rebase on latest master.

[deitch]

Likely there were uncommitted changes in pkg/runc/ (it does a tree hash), but if you got it, then all is good. Letting CI run

[deitch]

Yeah, I pulled your branch down and run update-component-sha.sh, and it generated no changes, which means it already go everything. Once CI is green (usually takes ~20 mins) we can merge it in.