Release 1.6.0-rc.1

[kolyshkin]

Release runc v1.6.0-rc.1.

• forward-port the changelog entries from the release-1.5 branch;
• remove the [Unreleased] items which were already released in 1.5.2 (as they were backported);
• add CHANGELOG entries for the already merged PRs which were missing them (#5184, #5271, #4661, #5441).

TODO

PRs on the 1.6.0-rc.1 milestone to be merged before the release:

• Remove APIs deprecated for removal in runc 1.6 #5495
• libct: do not hang on a half-dead "runc init" #5431
• libct: use os.Process.WithHandle #5414

Also:

• Rebase, and move the CHANGELOG entries added by the above PRs from
  [Unreleased] to [1.6.0-rc.1] (or add them if missing).
• Add a quote to the release section.

Copy-paste from the relevant CHANGELOG portion below:

[1.6.0-rc.1] - 2026-09-30

Note

runc v1.6.0-rc.1 includes all of the patches backported to runc v1.5.2.

libcontainer API

• configs.ToCPUSet now returns a unix.CPUSetDynamic instead of a
  *unix.CPUSet, and the Initial/Final fields of configs.CPUAffinity and
  the Nodes field of configs.LinuxMemoryPolicy have changed type
  accordingly. This lifts the previous 1024 CPUs/nodes limit. (#5343)

Fixed

• The poststart hooks are now executed after starting the user-specified
  process, fixing a runtime-spec conformance issue. (#4347, #5186)
• When an AppArmor profile is not loaded, runc now says so explicitly and
  names the profile, instead of returning a confusing
  no such file or directory error about a procfs file. (#5438, #5441)

Changed

• runc now requires Go 1.26+ to build. (#5413)
• The cpuAffinity and NUMA memoryPolicy settings are no longer limited
  to 1024 CPUs/nodes, as runc now uses a dynamically-sized CPU mask. (#5343)
• Switched from urfave/cli v1 (which is in maintenance mode) to v3. The
  command-line syntax is intended to remain the same, but the help output
  looks different. Please report any regressions in command-line parsing.
  The urfave_cli_no_docs build tag is no longer used. (#5184)
• runc start now waits for the container's init process using poll(2) and
  pidfd (where available), instead of a goroutine with a 100ms polling
  timeout. (#5251, #5271)
• runc no longer sets up a signal forwarder for detached containers, as
  there is nothing to forward the signals to. (#4661)

[kolyshkin]

@opencontainers/runc-maintainers if you're not ready to review the big ones like #5431, let's at least merge #5495 and cut a release, and leave others for rc2.