Weekly status for the weeks of the 4th to the 10th of February.
This week we released LXD 3.10 which should now be rolling out to users.
This release got delayed a bit and happened at the end of the week so we could fit in a few last minute bugfixes and minor improvements.
On the LXC side, we’ve kept working on improving code quality and hardening.
alloca() was eradicated from the code base, we’ve started making use of cleanup macros, tweaked our compiler flags some more and added some initial coccinelle scripts.
And lastly, ArchLinux has now been moved over to
distrobuilder for image building and we’re making good progress towards moving Gentoo and Sabayon next.
As always, switching to
distrobuilder comes with more images being made available for more architectures.
We also dealt with CVE-2019-5736 in liblxc and wrote about its affect on LXD users. The short version of this is that users of unprivileged containers (default) are perfectly safe, users of privileged containers may be at risk in some specific environments. This does not include snap users which are all safe thanks to the snap package being read-only.
This issue has been fixed in all maintained branches of LXC (2.0, 3.0 and master).
In line with our security policy, this issue isn’t treated as critical for LXC due to only affecting privileged containers which are already deemed to not be root safe.
This means that we will not be issuing emergency security releases for this and the workaround for this issue will be included in our next regular bugfix releases.
Upcoming conferences and events
- GTC 2019 - San Jose, CA (March 17-21)
The list below is feature or refactoring work which will span several weeks/months and can’t be tied directly to a single Github issue or pull request.
- Rework of internal LXD storage handling
- Dqlite 1.0
- Switching distribution building over to distrobuilder
- Various kernel work
- Stable release work for LXC, LXCFS and LXD
The items listed below are highlights of the work which happened upstream over the past week and which will be included in the next release.
- Added progress information for import and export operations
- Added support for overriding storage pool during backup import
- Tweaked structure of progress metadata
- Fixed some bad tests hiding return values
- Fixed some CEPH rbd unmap issues
- Optimized image packing by doing tar and compress in a combined stream
- Fixed hangs on migration failure
lxc profile listto have consistent yaml/json output
- Added Gentoo armhf variant to architecture list
- Fixed empty return value for GetCertificateFingerprints in Go client
- Fixed snapshot expiry for scheduled snapshots
- Updated database tests for current go-sqlite3
- Wiped alloca() from the codebase
- Fixed RPM packaging for bash completion
- Hardened our compiler flags
- Added LGTM to README
- Partially switched cgroups handling to cleanup macros
- Added uid/euid checks in caps handling
- Added initial coccinelle support
- Fixed some recent regressions
- Fixed regression in cgroups creation
- Added handling for \r in list parsing
- Added a copy of fexecve() for Android’s Bionic
- Fixed some licensing headers
- Fixed some more licensing headers
- Added logic to skip mounting lxcfs cgroup tree on CentOS 7 hosts
This section is used to track the work done in downstream Linux distributions to ship the latest LXC, LXD and LXCFS as well as work to get various software to work properly inside containers.
- Nothing to report this week
- Bumped compiler to Go 1.11.5
- Updated to LXD 3.10
- Cherry-picked bugfixes