Dockerfile: update runc binary to 1.2.1

[AkihiroSuda]

https://github.com/opencontainers/runc/releases/tag/v1.2.0
https://github.com/opencontainers/runc/releases/tag/v1.2.1

[tonistiigi]

This seems to be more complicated. See #5157

[AkihiroSuda]

This seems to be more complicated. See #5157

The dmz stuff is opt-in and is likely going to be removed in v1.2.1

• drop runc-dmz solution according to overlay solution opencontainers/runc#4482 (comment)

[tonistiigi]

Is there a writeup for the dmz/overlay/vanilla solutions? What do they mean and what is the difference security and performance wise? The PR adding dmz to Moby seems to still be open.

[AkihiroSuda]

Is there a writeup for the dmz/overlay/vanilla solutions? What do they mean and what is the difference security and performance wise?

Some benchmark results are available in
opencontainers/runc@515f09f

[cyphar]

The tl;dr is that overlay has almost no overhead (1-2% on startup time compared to no protection applied to /proc/self/exe at all, and >70% faster than memfd). The only downside is that it doesn't work for rootless containers (the container runtime needs privileges to do fsopen(2)) but runc-dmz had a bunch of limitations that meant you couldn't practically use it for most containers (which is why we made it opt-in, and now that we have overlay the need for it is greatly diminished).

Security-wise, all of the options provide the same level of protection in practice (except for the pre-1.2 bindfds, which were not really secure). In theory a DirtyCow-like attack would be able to overwrite the binary with overlay but not memfd, however such an attack would allow you to attack the host in other ways (as evidenced by the actual DirtyCow attacks) so the benefits far outweigh this theoretical downside that relies on a different (more severe) future kernel bug.

[AkihiroSuda]

The only downside is that it doesn't work for rootless containers (the container runtime needs privileges to do fsopen(2))

Rootless BuildKit (as well as Docker, contained, etc.) executes runc in an existing UserNS, so it should just work?

[cyphar]

Yeah that should work fine on >=5.11 kernels when overlayfs was enabled inside user namespaces.

[AkihiroSuda]

Updated for v1.2.1