chore: update version

builds/debian-dind/.env.example

@@ -4,8 +4,8 @@
 # GLOBAL_REGISTRY=
 
 # Image versions
-DEBIAN_DIND_VERSION=0.1.1
-DEBIAN_DIND_GPU_VERSION=0.1.1-gpu
+DEBIAN_DIND_VERSION=0.1.2
+DEBIAN_DIND_GPU_VERSION=0.1.2-gpu
 
 # Timezone (default: UTC)
 TZ=UTC

builds/debian-dind/Dockerfile

@@ -16,6 +16,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     xfsprogs \
     xz-utils \
     pigz \
+    crun \
     && rm -rf /var/lib/apt/lists/*
 
 # Install Docker
@@ -36,13 +37,17 @@ RUN install -m 0755 -d /etc/apt/keyrings \
     docker-compose-plugin \
     && rm -rf /var/lib/apt/lists/*
 
+# Configure Docker to use crun as the default runtime
+RUN mkdir -p /etc/docker && \
+    echo '{\n  "default-runtime": "crun",\n  "runtimes": {\n    "crun": {\n      "path": "/usr/bin/crun"\n    }\n  }\n}' > /etc/docker/daemon.json
+
 # Install NVIDIA Container Toolkit (Optional)
 ARG INSTALL_NVIDIA_TOOLKIT=false
 RUN if [ "$INSTALL_NVIDIA_TOOLKIT" = "true" ]; then \
     curl -fsSL https://nvidia.github.io/libnvidia-container/gpgkey | gpg --dearmor -o /usr/share/keyrings/nvidia-container-toolkit-keyring.gpg \
     && curl -s -L https://nvidia.github.io/libnvidia-container/stable/deb/nvidia-container-toolkit.list | \
-      sed 's#deb https://#deb [signed-by=/usr/share/keyrings/nvidia-container-toolkit-keyring.gpg] https://#g' | \
-      tee /etc/apt/sources.list.d/nvidia-container-toolkit.list \
+    sed 's#deb https://#deb [signed-by=/usr/share/keyrings/nvidia-container-toolkit-keyring.gpg] https://#g' | \
+    tee /etc/apt/sources.list.d/nvidia-container-toolkit.list \
     && apt-get update \
     && apt-get install -y nvidia-container-toolkit \
     && nvidia-ctk runtime configure --runtime=docker \

builds/debian-dind/README.md

@@ -6,6 +6,7 @@ A Docker-in-Docker (DinD) service based on Debian, allowing you to run Docker in
 
 - Based on latest stable Debian (13.2-slim)
 - Out-of-the-box Docker daemon
+- Uses `crun` as the default runtime for better performance and lower memory footprint
 - Optional NVIDIA Container Toolkit for GPU support
 - Resource limits configured
 - Healthcheck included
@@ -39,8 +40,8 @@ Key environment variables (see `.env.example` for all options):
 | Variable                  | Description                         | Default              |
 | ------------------------- | ----------------------------------- | -------------------- |
 | `GLOBAL_REGISTRY`         | Global registry prefix (optional)   | -                    |
-| `DEBIAN_DIND_VERSION`     | Main DinD image version             | `0.1.1`              |
-| `DEBIAN_DIND_GPU_VERSION` | GPU-enabled DinD image version      | `0.1.1-gpu`          |
+| `DEBIAN_DIND_VERSION`     | Main DinD image version             | `0.1.2`              |
+| `DEBIAN_DIND_GPU_VERSION` | GPU-enabled DinD image version      | `0.1.2-gpu`          |
 | `DEBIAN_VERSION`          | Debian base image version           | `13.2-slim`          |
 | `DIND_PORT_OVERRIDE`      | Host port for Docker daemon         | `2375`               |
 | `INSTALL_NVIDIA_TOOLKIT`  | Install NVIDIA toolkit during build | `false`              |

builds/debian-dind/README.zh.md

@@ -6,6 +6,7 @@
 
 - 基于最新稳定版 Debian（13.2-slim）
 - 开箱即用的 Docker 守护进程
+- 使用 `crun` 作为默认运行时，提供更好的性能和更低的内存占用
 - 可选的 NVIDIA Container Toolkit，支持 GPU
 - 配置了资源限制
 - 包含健康检查
@@ -39,8 +40,8 @@
 | 变量                      | 说明                      | 默认值           |
 | ------------------------- | ------------------------- | ---------------- |
 | `GLOBAL_REGISTRY`         | 全局镜像仓库前缀（可选）  | -                |
-| `DEBIAN_DIND_VERSION`     | 主 DinD 镜像版本          | `0.1.1`          |
-| `DEBIAN_DIND_GPU_VERSION` | GPU 版本 DinD 镜像版本    | `0.1.1-gpu`      |
+| `DEBIAN_DIND_VERSION`     | 主 DinD 镜像版本          | `0.1.2`          |
+| `DEBIAN_DIND_GPU_VERSION` | GPU 版本 DinD 镜像版本    | `0.1.2-gpu`      |
 | `DEBIAN_VERSION`          | Debian 基础镜像版本       | `13.2-slim`      |
 | `DIND_PORT_OVERRIDE`      | Docker 守护进程的主机端口 | `2375`           |
 | `INSTALL_NVIDIA_TOOLKIT`  | 构建时安装 NVIDIA 工具包  | `false`          |

builds/debian-dind/docker-compose.yaml

@@ -12,7 +12,7 @@ x-defaults: &defaults
 services:
   dind:
     <<: *defaults
-    image: ${GLOBAL_REGISTRY:-}alexsuntop/debian-dind:${DEBIAN_DIND_VERSION:-0.1.1}
+    image: ${GLOBAL_REGISTRY:-}alexsuntop/debian-dind:${DEBIAN_DIND_VERSION:-0.1.2}
     profiles:
       - ${COMPOSE_PROFILES:-}
     build:
@@ -50,7 +50,7 @@ services:
   # GPU-enabled DinD (optional)
   dind-gpu:
     <<: *defaults
-    image: ${GLOBAL_REGISTRY:-}alexsuntop/debian-dind:${DEBIAN_DIND_GPU_VERSION:-0.1.1-gpu}
+    image: ${GLOBAL_REGISTRY:-}alexsuntop/debian-dind:${DEBIAN_DIND_GPU_VERSION:-0.1.2-gpu}
     profiles:
       - gpu
     build:

builds/debian-dind/dockerd-entrypoint.sh

@@ -25,7 +25,7 @@ if [ -z "$DOCKER_HOST" ]; then
         if [ -d /sys/fs/cgroup/cgroup.controllers ]; then
           # It is cgroup2 but maybe not mounted as such?
           # Actually if it exists, it's likely v2.
-          :
+          mount -t cgroup2 -o nsdelegate cgroup2 /sys/fs/cgroup || true
         else
           # cgroup v1
           for subsystem in $(awk '/^[^#]/ { print $1 }' /proc/cgroups); do
@@ -36,6 +36,19 @@ if [ -z "$DOCKER_HOST" ]; then
           done
         fi
       fi
+
+      # Cgroup v2 delegation: move current process to a child cgroup and enable controllers
+      if [ -f /sys/fs/cgroup/cgroup.controllers ]; then
+        # Move current shell and future processes to a child cgroup
+        # this is required for cgroup v2 "no processes in internal nodes" rule
+        mkdir -p /sys/fs/cgroup/init
+        echo 0 > /sys/fs/cgroup/init/cgroup.procs 2>/dev/null || true
+
+        # Enable all available controllers for child cgroups
+        for controller in $(cat /sys/fs/cgroup/cgroup.controllers); do
+          echo "+$controller" > /sys/fs/cgroup/cgroup.subtree_control 2>/dev/null || true
+        done
+      fi
       ;;
   esac
 fi

builds/microsandbox/docker-compose.yaml

@@ -27,11 +27,6 @@ services:
     ports:
       - ${MICROSANDBOX_PORT_OVERRIDE:-5555}:${MICROSANDBOX_PORT:-5555}
     privileged: true
-    cap_add:
-      - SYS_ADMIN
-      - NET_ADMIN
-      - SYS_PTRACE
-      - SYS_RESOURCE
     security_opt:
       - apparmor=unconfined
       - seccomp=unconfined