Release 1.6.0-rc.1

[kolyshkin]

Release runc v1.6.0-rc.1.

• forward-port the changelog entries from the release-1.5 branch;
• remove the [Unreleased] items which were already released in 1.5.2 (as they were backported);
• add CHANGELOG entries for the already merged PRs which were missing them (#5184, #5271, #4661, #5441).

Copy-paste from the relevant CHANGELOG portion below:

[1.6.0-rc.1] - 2026-10-06

Lo bueno, si breve, dos veces bueno.

Note

runc v1.6.0-rc.1 includes all of the patches backported to runc v1.5.2.

libcontainer API

• configs.ToCPUSet now returns a unix.CPUSetDynamic instead of a
  *unix.CPUSet, and the Initial/Final fields of configs.CPUAffinity and
  the Nodes field of configs.LinuxMemoryPolicy have changed type
  accordingly. This lifts the previous 1024 CPUs/nodes limit. (#5343)
• The deprecated libcontainer/devices package has been removed. Use
  github.com/moby/sys/devices instead. (#5142, #5223, #5495)
• The deprecated RecvFile, SendFile, and SendRawFd functions have been
  removed from libcontainer/utils. (#5227, #5231, #5495)

Removed

• The deprecated EXTRA_BUILDTAGS make variable has been removed, and setting
  it is now an error. Use RUNC_BUILDTAGS instead. (#5171, #5198, #5511)

Fixed

• The poststart hooks are now executed after starting the user-specified
  process, fixing a runtime-spec conformance issue. (#4347, #5186)
• process.user.umask is now honored for a container which does not have its
  own mount namespace. Previously it was silently ignored, and not even the
  default umask of 022 was set. (#5479)
• When an AppArmor profile is not loaded, runc now says so explicitly and
  names the profile, instead of returning a confusing no such file or directory error about a procfs file. (#5438, #5441)

Changed

• runc now requires Go 1.26+ to build. (#5413)
• The runc binary is now built with the urfave_cli_no_template build tag,
  which, together with removing the reflect-based logging of CRIU options,
  re-enables the linker's dead code elimination of exported methods. As a
  result, the runc binary shrunk by about 2 MB (15%) on amd64. (#5486, #5506)
• The cpuAffinity and NUMA memoryPolicy settings are no longer limited
  to 1024 CPUs/nodes, as runc now uses a dynamically-sized CPU mask. (#5343)
• A container configuration which asks for a read-only rootfs
  (root.readonly), a read-only tmpfs mount, or a read-only /dev, but does
  not have its own mount namespace, is now refused. Previously such a
  container was silently started with those filesystems left writable, since
  making them read-only requires a remount, which is only possible in a
  private mount namespace. This is consistent with how maskedPaths and
  readonlyPaths, which have the same requirement, were already treated.
  (#5371, #5479)
• Switched from urfave/cli v1 (which is in maintenance mode) to v3. The
  command-line syntax is intended to remain the same, but the help output
  looks different. Please report any regressions in command-line parsing.
  The urfave_cli_no_docs build tag is no longer used. (#5184)
• runc start now waits for the container's init process using poll(2) and
  pidfd (where available), instead of a goroutine with a 100ms polling
  timeout. (#5251, #5271)
• runc no longer sets up a signal forwarder for detached containers, as
  there is nothing to forward the signals to. (#4661)

[kolyshkin]

@opencontainers/runc-maintainers if you're not ready to review the big ones like #5431, let's at least merge #5495 and cut a release, and leave others for rc2.

[rata]

Seems good to do the rc release without waiting for those, IMHO. Thanks again!

[kolyshkin]

@opencontainers/runc-maintainers this is missing the release quote (feel free to suggest one) and the date (I hope for next Tuesday), so PTAL

[rata]

LGTM, thanks a lot!

[kolyshkin]

Aiming to release this tomorrow, PTAL @opencontainers/runc-maintainers