Hi All,

We released Kata 1.12.0 this week. This release brings in several exciting features including:

• Support for getOOMEvent GRPC agent API so OOM events can be retrieved from the agent.
• We now detect and support static ARP entries that may be created by a network plugin.
• Added support to hotplug block and vfio devices in cloud hypervisor.
• Fixes were made to make sure systemd cgroups are detected and handled correctly.
• OpenShift CI enabled on runtime repository.
• A debug-only capability was added to allow a debug container to run in the agent PID namespace.
• Host cpuset support added for cpuset.cpus and cpuset.mems

Kata 1.12.0 release also includes following security fixes. Users are highly encouraged to upgrade.

• Readonly bind-mounts are now mounted read-only on the host. With this fix, mounts are protected at VM boundary not just the guest kernel. If a container escape were to occur, one would be able to write to a directory or file that was mounted read-only prior to this fix.
• Certain annotations in kata can be used to execute pre-exiting binaries. This could be used to execute arbitrary binaries with the onus of validating these paths left to the stack about Kata. In this release, we added appropriate validations so that an admin can configure a list of file system paths that can be used to filter annotations that represent valid file names.

Additionally, we made a patch release 1.11.5 with the above security fixes included with additional bug fixes. Please refer to the release notes for more details: https://github.com/kata-containers/runtime/releases

Thanks,

Archana Shinde