** Description changed: [Impact] In order to follow our policy [1,2] on keeping the container stack (docker.io-app, containerd-app, runc-app, docker-buildx, docker- compose-v2, containerd-stable, and runc-stable) up-to-date in our supported releases, let's backport packages from the devel release to all stable releases. Special cases: - containerd-stable and runc-stable are only present from resolute and on. Therefore, these packages will only be backported to later releases. - containerd-stable will receive a one time minor upgrade in resolute (bumping from 2.2 to 2.3) so it can track the current upstream LTS version. This decision was discussed last cycle, when we decided not to package the beta release for resolute as suggested by the upstream project. - docker-compose-v2 is no longer receiving upstream releases under v2. Upstream is now v5. We will introduce v5 later as an update to this bug or as a new one-time SRU. For now, we will SRU our packaging changes introduced to drop some non-free headers. - runc-app will be upgraded to 1.3.x upstream releases in jammy and noble to avoid major disruptions in those series, as covered by our policy [1]. Note that runc-stable is not available in these series. Bumping away from 1.3 may be re-assessed in the future. CVEs - the following packages have fixes for CVEs and should be released through the security pocket: - runc-app in resolute, noble and jammy has a fix for CVE-2026-41579. - runc-stable in resolute has a fix for CVE-2026-41579. - containerd-app in resolute, noble, and jammy has a fix for CVE-2026-46680. - containerd-stable in resolute has a fix for CVE-2026-46680. + - docker.io-app in resolute, noble, and jammy fixes multiple CVEs (see https://github.com/moby/moby/security/advisories) [Test Plan] As described in [1], our test case is the autopkgtests. All packages were built in https://launchpad.net/~athos/+archive/ubuntu/ubuntu-container- stack/+packages. TODO: All DEP8 tests pass either for all architectures in the PPA, or for amd64 locally. [Where problems could occur] As usual, we deliver most benefit to our users by delivering an upstream experience. A risk of regressions is part of that. [Past MREs] - https://bugs.launchpad.net/ubuntu/+source/docker.io-app/+bug/2040461 - https://bugs.launchpad.net/ubuntu/+source/docker.io-app/+bug/2040460 - https://bugs.launchpad.net/ubuntu/+source/docker.io-app/+bug/2085187 - https://bugs.launchpad.net/ubuntu/+source/docker.io-app/+bug/2112523 - https://bugs.launchpad.net/ubuntu/+source/docker.io-app/+bug/2127661 [ References ] [1] https://documentation.ubuntu.com/sru/en/latest/reference/exception-Docker-Updates/ [2] https://discourse.ubuntu.com/t/ubuntu-server-gazette-issue-8-containers-steady-paths-for-agile-stacks/68680
** Description changed: [Impact] In order to follow our policy [1,2] on keeping the container stack (docker.io-app, containerd-app, runc-app, docker-buildx, docker- compose-v2, containerd-stable, and runc-stable) up-to-date in our supported releases, let's backport packages from the devel release to all stable releases. Special cases: - containerd-stable and runc-stable are only present from resolute and on. Therefore, these packages will only be backported to later releases. - containerd-stable will receive a one time minor upgrade in resolute (bumping from 2.2 to 2.3) so it can track the current upstream LTS version. This decision was discussed last cycle, when we decided not to package the beta release for resolute as suggested by the upstream project. - docker-compose-v2 is no longer receiving upstream releases under v2. Upstream is now v5. We will introduce v5 later as an update to this bug or as a new one-time SRU. For now, we will SRU our packaging changes introduced to drop some non-free headers. - runc-app will be upgraded to 1.3.x upstream releases in jammy and noble to avoid major disruptions in those series, as covered by our policy [1]. Note that runc-stable is not available in these series. Bumping away from 1.3 may be re-assessed in the future. CVEs - the following packages have fixes for CVEs and should be released through the security pocket: - runc-app in resolute, noble and jammy has a fix for CVE-2026-41579. - runc-stable in resolute has a fix for CVE-2026-41579. - containerd-app in resolute, noble, and jammy has a fix for CVE-2026-46680. - containerd-stable in resolute has a fix for CVE-2026-46680. - docker.io-app in resolute, noble, and jammy fixes multiple CVEs (see https://github.com/moby/moby/security/advisories) + + This means that only docker-buildx and docker-compose-v2 should follow + the regular SRU process here. [Test Plan] As described in [1], our test case is the autopkgtests. All packages were built in https://launchpad.net/~athos/+archive/ubuntu/ubuntu-container- stack/+packages. TODO: All DEP8 tests pass either for all architectures in the PPA, or for amd64 locally. [Where problems could occur] As usual, we deliver most benefit to our users by delivering an upstream experience. A risk of regressions is part of that. [Past MREs] - https://bugs.launchpad.net/ubuntu/+source/docker.io-app/+bug/2040461 - https://bugs.launchpad.net/ubuntu/+source/docker.io-app/+bug/2040460 - https://bugs.launchpad.net/ubuntu/+source/docker.io-app/+bug/2085187 - https://bugs.launchpad.net/ubuntu/+source/docker.io-app/+bug/2112523 - https://bugs.launchpad.net/ubuntu/+source/docker.io-app/+bug/2127661 [ References ] [1] https://documentation.ubuntu.com/sru/en/latest/reference/exception-Docker-Updates/ [2] https://discourse.ubuntu.com/t/ubuntu-server-gazette-issue-8-containers-steady-paths-for-agile-stacks/68680 -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2153483 Title: Backport container stack for stonking cycle To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/containerd-app/+bug/2153483/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
