Release Notes for Alpine 3.14.0 - Revision history

Lmarz: Add to category

2023-02-19T14:12:23Z

Add to category

← Older revision		Revision as of 14:12, 19 February 2023
Line 30:		Line 30:

	There was already an OpenSSH flavor with PAM support, but now there has been added a new flavor for krb5 (openssh-server-krb5, openssh-client-krb5). Note that this new flavor includes PAM support, in case you need both.		There was already an OpenSSH flavor with PAM support, but now there has been added a new flavor for krb5 (openssh-server-krb5, openssh-client-krb5). Note that this new flavor includes PAM support, in case you need both.

			[[Category:News]]

Ikke: /* ClamAV moved to community */

2021-09-15T16:40:26Z

ClamAV moved to community

← Older revision		Revision as of 16:40, 15 September 2021
Line 25:		Line 25:
	=== ClamAV moved to community ===		=== ClamAV moved to community ===

	The [https://pkgs.alpinelinux.org/package/edge/~~main~~/x86_64/clamav clamav] package has been moved from main to community. We cannot support releases for 2 years, which we do for packages in main, and clamav warns that the version is too old. If you need clamav, make sure that you have the community repository enabled in <tt>/etc/apk/repositories</tt>, but do note that packages in community are only supported for one release (6 months).		The [https://pkgs.alpinelinux.org/package/edge/community/x86_64/clamav clamav] package has been moved from main to community. We cannot support releases for 2 years, which we do for packages in main, and clamav warns that the version is too old. If you need clamav, make sure that you have the community repository enabled in <tt>/etc/apk/repositories</tt>, but do note that packages in community are only supported for one release (6 months).

	=== openssh flavors ===		=== openssh flavors ===

	There was already an OpenSSH flavor with PAM support, but now there has been added a new flavor for krb5 (openssh-server-krb5, openssh-client-krb5). Note that this new flavor includes PAM support, in case you need both.		There was already an OpenSSH flavor with PAM support, but now there has been added a new flavor for krb5 (openssh-server-krb5, openssh-client-krb5). Note that this new flavor includes PAM support, in case you need both.

Hello71: /* faccessat2 */

2021-08-05T23:25:53Z

faccessat2

← Older revision		Revision as of 23:25, 5 August 2021
Line 2:		Line 2:

	=== faccessat2 ===		=== faccessat2 ===
	Use of the faccessat2 syscall has been enabled in musl. Due to [https://github.com/opencontainers/runc/issues/2151 runc issue 2151], new system calls incorrectly returned EPERM instead of ENOSYS when invoked under a Docker with libseccomp predating their release. Therefore, Alpine Linux 3.14 requires one of the following:		Use of the faccessat2 syscall has been enabled in musl. Due to [https://github.com/opencontainers/runc/issues/2151 runc issue 2151], new system calls incorrectly returned EPERM instead of ENOSYS when invoked under a Docker with libseccomp predating their release. Therefore, Alpine Linux 3.14 requires '''at least one''' of the following:

	# runc v1.0.0-rc93		# runc v1.0.0-rc93

Hello71 at 23:14, 5 August 2021

2021-08-05T23:14:46Z

← Older revision		Revision as of 23:14, 5 August 2021
Line 7:		Line 7:
	## if using Docker's Debian repositories, this is part of containerd.io 1.4.3-2		## if using Docker's Debian repositories, this is part of containerd.io 1.4.3-2
	## if using Docker Desktop for Windows or Mac, this is part of Docker Desktop 3.3.0		## if using Docker Desktop for Windows or Mac, this is part of Docker Desktop 3.3.0
	# Docker 20.10.0 (which contains [https://github.com/moby/moby/commit/a18139111d8a203bd211b0861c281ebe77daccd9 moby commit a181391]) or greater, AND libseccomp 2.4.4 (which contains backported [https://github.com/seccomp/libseccomp/commit/5696c896409c1feb37eb502df33cf36efb2e8e01 libseccomp commit 5696c89]) or greater. In this case, to check if your host libseccomp is faccessat2-compatible, invoke <code>scmp_sys_resolver faccessat2</code>. If 439 is returned, faccessat2 is supported. If -1 is returned, faccessat2 is not supported. Note that if runc is older than v1.0.0-rc93, Docker must still be at least version 20.10.0, regardless of the result of this command.		# Docker 20.10.0 (which contains [https://github.com/moby/moby/commit/a18139111d8a203bd211b0861c281ebe77daccd9 moby commit a181391]) or greater, '''''AND''''' libseccomp 2.4.4 (which contains backported [https://github.com/seccomp/libseccomp/commit/5696c896409c1feb37eb502df33cf36efb2e8e01 libseccomp commit 5696c89]) or greater. In this case, to check if your host libseccomp is faccessat2-compatible, invoke <code>scmp_sys_resolver faccessat2</code>. If 439 is returned, faccessat2 is supported. If -1 is returned, faccessat2 is not supported. Note that if runc is older than v1.0.0-rc93, Docker must still be at least version 20.10.0, regardless of the result of this command.
	# As a workaround, in order to run under old Docker or libseccomp versions, [https://github.com/moby/moby/blob/master/profiles/seccomp/default.json the moby default seccomp profile] should be downloaded and on line 2, <code>defaultAction</code> changed to <code>SCMP_ACT_TRACE</code>, then <code>--seccomp-profile=default.json</code> can be passed to dockerd, or <code>--security-opt=seccomp=default.json</code> passed to <code>docker create</code> or <code>docker run</code>. This will cause the system calls to return ENOSYS instead of EPERM, allowing the container to fall back to faccessat.		# As a workaround, in order to run under old Docker or libseccomp versions, [https://github.com/moby/moby/blob/master/profiles/seccomp/default.json the moby default seccomp profile] should be downloaded and on line 2, <code>defaultAction</code> changed to <code>SCMP_ACT_TRACE</code>, then <code>--seccomp-profile=default.json</code> can be passed to dockerd, or <code>--security-opt=seccomp=default.json</code> passed to <code>docker create</code> or <code>docker run</code>. This will cause the system calls to return ENOSYS instead of EPERM, allowing the container to fall back to faccessat.

Hello71: /* aports */

2021-07-11T15:53:02Z

aports

← Older revision		Revision as of 15:53, 11 July 2021
Line 15:		Line 15:
	xf86-input-{mouse,keyboard} have been removed, as upstream maintainers have explicitly declared that they are for non-Linux platforms only. Users should have already switched to xf86-input-evdev or xf86-input-libinput.		xf86-input-{mouse,keyboard} have been removed, as upstream maintainers have explicitly declared that they are for non-Linux platforms only. Users should have already switched to xf86-input-evdev or xf86-input-libinput.

	~~/usr/libexec/~~Xorg~~.wrap and the suid bit on /usr/bin/Xorg have been removed~~. X now requires udev or mdev, and either elogind must be enabled or X users must be in the video and input groups.		Rootless support has been enabled for Xorg. X now requires udev or mdev, and either elogind must be enabled or X users must be in the video and input groups.

	The Xorg sysconfdir has been changed from /etc/X11 to /etc. In the unlikely event that you have configuration files in /etc/X11/X11, those must be moved to /etc/X11.		The Xorg sysconfdir has been changed from /etc/X11 to /etc. In the unlikely event that you have configuration files in /etc/X11/X11, those must be moved to /etc/X11.

Hello71: /* faccessat2 */ add note regarding dind

2021-07-01T12:35:54Z

faccessat2: add note regarding dind

← Older revision		Revision as of 12:35, 1 July 2021
Line 2:		Line 2:

	=== faccessat2 ===		=== faccessat2 ===
	Use of the faccessat2 syscall has been enabled in musl. Due to [https://github.com/opencontainers/runc/issues/2151 runc issue 2151], new system calls incorrectly returned EPERM instead of ENOSYS when invoked under a Docker with libseccomp predating their release. Therefore, Alpine Linux 3.14.0 requires one of the following:		Use of the faccessat2 syscall has been enabled in musl. Due to [https://github.com/opencontainers/runc/issues/2151 runc issue 2151], new system calls incorrectly returned EPERM instead of ENOSYS when invoked under a Docker with libseccomp predating their release. Therefore, Alpine Linux 3.14 requires one of the following:

	# runc v1.0.0-rc93		# runc v1.0.0-rc93
Line 8:		Line 8:
	## if using Docker Desktop for Windows or Mac, this is part of Docker Desktop 3.3.0		## if using Docker Desktop for Windows or Mac, this is part of Docker Desktop 3.3.0
	# Docker 20.10.0 (which contains [https://github.com/moby/moby/commit/a18139111d8a203bd211b0861c281ebe77daccd9 moby commit a181391]) or greater, AND libseccomp 2.4.4 (which contains backported [https://github.com/seccomp/libseccomp/commit/5696c896409c1feb37eb502df33cf36efb2e8e01 libseccomp commit 5696c89]) or greater. In this case, to check if your host libseccomp is faccessat2-compatible, invoke <code>scmp_sys_resolver faccessat2</code>. If 439 is returned, faccessat2 is supported. If -1 is returned, faccessat2 is not supported. Note that if runc is older than v1.0.0-rc93, Docker must still be at least version 20.10.0, regardless of the result of this command.		# Docker 20.10.0 (which contains [https://github.com/moby/moby/commit/a18139111d8a203bd211b0861c281ebe77daccd9 moby commit a181391]) or greater, AND libseccomp 2.4.4 (which contains backported [https://github.com/seccomp/libseccomp/commit/5696c896409c1feb37eb502df33cf36efb2e8e01 libseccomp commit 5696c89]) or greater. In this case, to check if your host libseccomp is faccessat2-compatible, invoke <code>scmp_sys_resolver faccessat2</code>. If 439 is returned, faccessat2 is supported. If -1 is returned, faccessat2 is not supported. Note that if runc is older than v1.0.0-rc93, Docker must still be at least version 20.10.0, regardless of the result of this command.
			# As a workaround, in order to run under old Docker or libseccomp versions, [https://github.com/moby/moby/blob/master/profiles/seccomp/default.json the moby default seccomp profile] should be downloaded and on line 2, <code>defaultAction</code> changed to <code>SCMP_ACT_TRACE</code>, then <code>--seccomp-profile=default.json</code> can be passed to dockerd, or <code>--security-opt=seccomp=default.json</code> passed to <code>docker create</code> or <code>docker run</code>. This will cause the system calls to return ENOSYS instead of EPERM, allowing the container to fall back to faccessat.

	~~As a workaround, in order to run under old~~ Docker ~~or libseccomp versions~~, ~~[https://github.com/moby/moby/blob/master/profiles/seccomp/default.json~~ the ~~moby default seccomp profile] should be downloaded and on line 2~~, ~~<code>defaultAction</code> changed to <code>SCMP_ACT_TRACE</code>~~, ~~then <code>--seccomp-profile=default~~.~~json</code> can be passed to dockerd, or <code>--security-opt=seccomp=default.json</code> passed to <code>docker create</code> or <code>docker run</code>. This~~ will ~~cause the system calls to return ENOSYS instead of EPERM, allowing the container to fall back to faccessat~~.		Note also that when using nested Docker, '''every layer''' must meet one of the above requirements, since if '''any layer''' improperly denies the use of faccessat2, Alpine Linux 3.14 will not function correctly.

	=== Xorg ===		=== Xorg ===

Hello71 at 19:20, 19 June 2021

2021-06-19T19:20:08Z

← Older revision		Revision as of 19:20, 19 June 2021
Line 2:		Line 2:

	=== faccessat2 ===		=== faccessat2 ===
	Use of the faccessat2 syscall has been enabled in musl. Due to [https://github.com/opencontainers/runc/issues/2151 runc issue 2151], new system calls incorrectly ~~return~~ EPERM instead of ENOSYS when invoked under a Docker or libseccomp ~~version~~ predating their release. Therefore, Alpine Linux 3.14.0 ~~officially~~ requires the host Docker to be version 20.10.0 (which contains [https://github.com/moby/moby/commit/a18139111d8a203bd211b0861c281ebe77daccd9 moby commit a181391]) or greater and the host libseccomp to be version 2.4.4 (which contains backported [https://github.com/seccomp/libseccomp/commit/5696c896409c1feb37eb502df33cf36efb2e8e01 libseccomp commit 5696c89]) or greater. [https://github.com/docker/for-win/issues/8326 Docker for Windows issue 8326] tracks the process of updating libseccomp in Docker for Windows.		Use of the faccessat2 syscall has been enabled in musl. Due to [https://github.com/opencontainers/runc/issues/2151 runc issue 2151], new system calls incorrectly returned EPERM instead of ENOSYS when invoked under a Docker with libseccomp predating their release. Therefore, Alpine Linux 3.14.0 requires one of the following:

	~~Therefore, as of writing, the following platforms are not suitable as Docker hosts for Alpine Linux 3~~.14.0, ~~due to containing out-~~of~~-date libseccomp: Alpine Linux 3~~.~~12 and earlier, Amazon Linux~~ 1 or 2~~, CentOS 7~~ or 8, ~~Debian~~ 10 ~~or earlier without backports enabled, Raspbian stable or earlier, openSUSE Leap~~ (~~any release~~), ~~Ubuntu~~ (~~any release~~)~~, and Windows~~. ~~This applies regardless of whether the Linux distribution Docker packages or separate Docker package repositories are used~~, ~~as the Docker package repositories do not include libseccomp.~~		# runc v1.0.0-rc93
			## if using Docker's Debian repositories, this is part of containerd.io 1.4.3-2
	To check if your host libseccomp is faccessat2-compatible, invoke <code>scmp_sys_resolver faccessat2</code>. If 439 is returned, faccessat2 is supported. If -1 is returned, faccessat2 is not supported. Note that Docker must still be at least version 20.10.0, regardless of the result of this command.		## if using Docker Desktop for Windows or Mac, this is part of Docker Desktop 3.3.0
			# Docker 20.10.0 (which contains [https://github.com/moby/moby/commit/a18139111d8a203bd211b0861c281ebe77daccd9 moby commit a181391]) or greater, AND libseccomp 2.4.4 (which contains backported [https://github.com/seccomp/libseccomp/commit/5696c896409c1feb37eb502df33cf36efb2e8e01 libseccomp commit 5696c89]) or greater. In this case, to check if your host libseccomp is faccessat2-compatible, invoke <code>scmp_sys_resolver faccessat2</code>. If 439 is returned, faccessat2 is supported. If -1 is returned, faccessat2 is not supported. Note that if runc is older than v1.0.0-rc93, Docker must still be at least version 20.10.0, regardless of the result of this command.

	As a workaround, in order to run under old Docker or libseccomp versions, [https://github.com/moby/moby/blob/master/profiles/seccomp/default.json the moby default seccomp profile] should be downloaded and on line 2, <code>defaultAction</code> changed to <code>SCMP_ACT_TRACE</code>, then <code>--seccomp-profile=default.json</code> can be passed to dockerd, or <code>--security-opt=seccomp=default.json</code> passed to <code>docker create</code> or <code>docker run</code>. This will cause the system calls to return ENOSYS instead of EPERM, allowing the container to fall back to faccessat.		As a workaround, in order to run under old Docker or libseccomp versions, [https://github.com/moby/moby/blob/master/profiles/seccomp/default.json the moby default seccomp profile] should be downloaded and on line 2, <code>defaultAction</code> changed to <code>SCMP_ACT_TRACE</code>, then <code>--seccomp-profile=default.json</code> can be passed to dockerd, or <code>--security-opt=seccomp=default.json</code> passed to <code>docker create</code> or <code>docker run</code>. This will cause the system calls to return ENOSYS instead of EPERM, allowing the container to fall back to faccessat.

Ikke: Ikke moved page Draft Release Notes for Alpine 3.14.0 to Release Notes for Alpine 3.14.0: 3.14.0 has been released

2021-06-15T16:06:13Z

Ikke moved page Draft Release Notes for Alpine 3.14.0 to Release Notes for Alpine 3.14.0: 3.14.0 has been released

← Older revision	Revision as of 16:06, 15 June 2021
(No difference)

Ikke at 05:34, 15 June 2021

2021-06-15T05:34:00Z

← Older revision		Revision as of 05:34, 15 June 2021
Line 24:		Line 24:

	The [https://pkgs.alpinelinux.org/package/edge/main/x86_64/clamav clamav] package has been moved from main to community. We cannot support releases for 2 years, which we do for packages in main, and clamav warns that the version is too old. If you need clamav, make sure that you have the community repository enabled in <tt>/etc/apk/repositories</tt>, but do note that packages in community are only supported for one release (6 months).		The [https://pkgs.alpinelinux.org/package/edge/main/x86_64/clamav clamav] package has been moved from main to community. We cannot support releases for 2 years, which we do for packages in main, and clamav warns that the version is too old. If you need clamav, make sure that you have the community repository enabled in <tt>/etc/apk/repositories</tt>, but do note that packages in community are only supported for one release (6 months).

			=== openssh flavors ===

			There was already an OpenSSH flavor with PAM support, but now there has been added a new flavor for krb5 (openssh-server-krb5, openssh-client-krb5). Note that this new flavor includes PAM support, in case you need both.

Ikke at 05:22, 15 June 2021

2021-06-15T05:22:49Z

← Older revision		Revision as of 05:22, 15 June 2021
Line 19:		Line 19:
	=== Python upgraded to 3.9 ===		=== Python upgraded to 3.9 ===

	Python has been upgraded to version 3.9, and all python modules have been rebuilt against python 3.9.		Python has been upgraded to version 3.9, and all python modules have been rebuilt against python 3.9. Make sure that all custom python3 modules are built against python3.9

	=== ClamAV moved to community ===		=== ClamAV moved to community ===

	The [https://pkgs.alpinelinux.org/package/edge/main/x86_64/clamav clamav] package has been moved from main to community. We cannot support releases for 2 years, which we do for packages in main, and clamav warns that the version is too old. If you need clamav, make sure that you have the community repository enabled in <tt>/etc/apk/repositories</tt>, but do note that packages in community are only supported for one release (6 months).		The [https://pkgs.alpinelinux.org/package/edge/main/x86_64/clamav clamav] package has been moved from main to community. We cannot support releases for 2 years, which we do for packages in main, and clamav warns that the version is too old. If you need clamav, make sure that you have the community repository enabled in <tt>/etc/apk/repositories</tt>, but do note that packages in community are only supported for one release (6 months).