Breaking changes

IdentityMapping.ToHost no longer special-cases the remapped root

ToHost used to skip the ID-map lookup when the ID passed in was equal to the
host remapped-root ID (as returned by RootPair). This was wrong: the arguments
are container IDs, and comparing them against a host value made no sense.

With a subuid/subgid base below 65536 (for example rootless:1000:65536, used
to align dind-rootless container UIDs), a non-root container UID equal to the
base (1000 in this example) was returned unmapped, so it appeared as root
inside the container.

ToHost now always translates both UID and GID through the mappings.
Container root (0) still maps to the host remapped-root base, same as
RootPair returns. An empty (nil) mapping is treated as identity.

What this means for callers:

• Pass container IDs only. Code that passes the host remapped-root pair (for
  example, the result of RootPair) to ToHost and expects it back unchanged
  gets a different result or an error now. Pass 0, 0 instead, or use
  RootPair directly.
• If ToHost returns an error, both returned IDs are now -1. Previously
  they could hold a partially translated value.

The only known caller that was relying on old behavior was moby/moby;
it was fixed by moby/moby#53859.

See #242 and #241.

Windows: MkdirAndChown no longer creates parent directories

On Windows, MkdirAndChown used to call os.MkdirAll, so it also created any
missing parent directories, unlike on Unix. It now uses os.Mkdir, as
documented. Use MkdirAllAndChown if you need parent directories created. See
#236.

Changes

• user: GetExecUser: use strings.Cut to split user:group (#228)
• user: GetExecUser: always clone default Sgids (#229)
• user: GetExecUser: rewrite with parseUserArg, parseGroupArg (#231, #232)
• user: parseNumeric: require non-empty values (#235)
• user: MkdirAllAndChown, MkdirAndChown: DRY (#244)
• user: GoDoc fixes (#233, #237)
• user: test fixes and cleanups (#227, #234)
• user: require Go 1.24 (#272)

New Contributors

• @sueun-dev made their first contribution in #233
• @okhowang made their first contribution in #242

Full Changelog: user/v0.4.1...user/v0.5.0

What's Changed

• mountinfo: fix ParentsFilter() being too greedy (#271)
• mountinfo: fix PrefixFilter("/") (#271)
• mountinfo: simplify/speedup unescape (#144)
• mountinfo: GetMountsFromReader: use strings.Cut (#142)
• update minimum supported go version to go1.18 (#142)
• remove old build tags (#148)

Full Changelog: mountinfo/v0.7.2...mountinfo/v0.7.3

What's Changed

• devices: skip .incus-mounts when listing devices (#261).

  GetDevices walks every directory under the path it is given. On hosts running
  Incus, there is a /dev/.incus-mounts
  directory with mode 0700. If the caller cannot read it, GetDevices("/dev")
  failed with "permission denied" and returned no devices at all.

  .incus-mounts is now skipped, as .lxc, .lxd-mounts and .udev already
  were. An unreadable directory with any other name still returns an error.
  Fixes #260.

New Contributors

• @SashaMIT made their first contribution in #261

Full Changelog: devices/v0.1.0...devices/v0.1.1

Breaking changes

• Go 1.24 or later is now required. (#264)

Fixed

• LastCap no longer reads /proc/sys/kernel/cap_last_cap, querying the
  kernel via prctl(PR_CAPBSET_READ) instead. This makes the package work
  when /proc is not mounted, and fixes a possible panic or infinite loop
  when /proc/sys/kernel/cap_last_cap contains a bogus value (for example,
  if something is mounted over /proc). (#265, #269)

Changed

• Minor code cleanups. (#187)

For the complete list of changes, see capability/CHANGELOG.md.

Thanks to all of the contributors who made this release possible:

• Adam Korczynski (@AdamKorcz)
• Akihiro Suda (@AkihiroSuda)
• Austin Vazquez (@austinvazquez)
• Kir Kolyshkin (@kolyshkin)
• Paweł Gronowski (@vvoland)
• Sebastiaan van Stijn (@thaJeztah)
• @74suiko

What's Changed

userns: fix user-namespace detection on OpenVZ, where namespace inode numbers are virtualized.

Full Changelog: userns/v0.2.0...userns/v0.2.1

What's Changed

• userns: detect initial namespace by inode by @aleivag in #240

New Contributors

• @aleivag made their first contribution in #240

Full Changelog: userns/v0.1.0...userns/v0.2.0

What's Changed

• user: prevent possible DoS via unbounded parsing of user and group database files in CVE-2026-61801 / GHSA-mjcv-p78q-w5fw. This fixes a similar issue as CVE-2026-47262 in containerd.
• user: prevent falling back to looking up numeric usernames and improve handling of numeric user/group to prevent looking up numeric values as usernames. This fixes a similar issue as CVE-2026-46680 in containerd. #221
• user: bump Go to 1.18, modernize #198
• user: make code a bit more DRY #225
• user: test cleanups #226

Full Changelog: user/v0.4.0...user/v0.4.1

What's Changed

• update minimum go version to go1.18
• mount: MergeTmpfsOptions: use strings.Cut
• remove legacy build tags
• adjust build-tags for darwin

Full Changelog: mount/v0.3.4...mount/v0.3.5

What's Changed

• update minimum go version to 1.24
• use os.OpenFile with O_FILE_FLAG_SEQUENTIAL_SCAN on Go 1.26+

Full Changelog: sequential/v0.6.0...sequential/v0.7.0

This is the initial release of the github.com/moby/sys/devices
module. The code is taken from the
github.com/opencontainers/runc/libcontainer/devices package as
of runc v1.4.0, with a few commits on top to adapt to the new
location.

The functionality here is not used by runc itself, but is used
by higher-level runtimes to generate device configurations for
runc. See issue 181 for more details.

Most of the git history is migrated, except for some of the
pre-2015 commits. Commit runc@8f97d39 moved libcontainer
into a subdirectory, meaning the libcontainer/devices glob is
missing commits before then, but this should be sufficient.