RHBA-2019:2389 - Bug Fix Advisory

Topic

Updated docker, skopeo, runc, buildah, containernetworking-plugins, oci-umount, and container-selinux packages that fix several bugs and add a number of enhancements are now available for Red Hat Enterprise Linux 7 Extras.

Description

Docker is an open-source engine that automates the deployment of any application as a lightweight, portable, self-sufficient container that runs virtually anywhere.

The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files.

The runc tool is a lightweight, portable implementation of the Open Container Format (OCF) that provides container runtime.

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to:

• Create a working container, either from scratch or using an image as a starting point.
• Create an image, either from a working container or using the instructions in a Dockerfile.
• Build both Docker and OCI images.

The Container Network Interface (CNI) project consists of a specification and libraries for writing plug-ins for configuring network interfaces in Linux containers, along with a number of supported plug-ins. CNI concerns itself only with network connectivity of containers and removing allocated resources when the container is deleted.

The oci-umount package provides an OCI hook program that unmounts any file systems listed in /etc/oci-umount.conf file before starting a container. The goal of this tool is to help prevent container mount space leaking into other containers.

The container-selinux package provides SELinux policies for container runtimes.

Users of docker, skopeo, runc, buildah, containernetworking-plugins, oci-umount, and container-selinux are advised to upgrade to these updated packages, which fix several bugs and add a number of enhancements.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 7 x86_64
• Red Hat Enterprise Linux Workstation 7 x86_64
• Red Hat Enterprise Linux for IBM z Systems 7 s390x
• Red Hat Enterprise Linux for Power, little endian 7 ppc64le

Fixes

• BZ - 1693961 - Unable to install packages in non-root podman container
• BZ - 1719452 - rootless fail: container create failed: cannot specify gid= mount options for unmapped gid in rootless containers

CVEs

(none)

References

(none)