[19.03] Update containerd to v1.2.11, runc v1.0.0-rc9

[thaJeztah]

[19.03] Update to runc v1.0.0-rc9

full diff: opencontainers/runc@3e425f8...v1.0.0-rc9

• Add SCMP_ACT_LOG as a valid Seccomp action opencontainers/runc#1951 Add SCMP_ACT_LOG as a valid Seccomp action

• *: verify operations on /proc/... are on procfs opencontainers/runc#2130 *: verify operations on /proc/... are on procfs
  This is an additional mitigation for CVE-2019-16884. The primary problem
  is that Docker can be coerced into bind-mounting a file system on top of
  /proc (resulting in label-related writes to /proc no longer happening).

  While we are working on mitigations against permitting the mounts, this
  helps avoid our code from being tricked into writing to non-procfs
  files. This is not a perfect solution (after all, there might be a
  bind-mount of a different procfs file over the target) but in order to
  exploit that you would need to be able to tweak a config.json pretty
  specifically (which thankfully Docker doesn't allow).

  Specifically this stops AppArmor from not labeling a process silently
  due to /proc/self/attr/... being incorrectly set, and stops any
  accidental fd leaks because /proc/self/fd/... is not real.

[19.03] Update containerd binary to v1.2.11

full diff: containerd/containerd@v1.2.10...v1.2.11

The eleventh patch release for containerd 1.2 includes an updated runc with
an additional fix for CVE-2019-16884 and a Golang update.

Notable Updates

• Update the runc vendor to v1.0.0-rc9 which includes an additional mitigation
  for CVE-2019-16884.
  More details on the runc CVE in CVE-2019-16884: AppArmor can be bypassed by a malicious image that specifies a volume at /proc opencontainers/runc#2128, and the additional
  mitigations in *: verify operations on /proc/... are on procfs opencontainers/runc#2130.
• Add local-fs.target to service file to fix corrupt image after unexpected host
  reboot. Reported in Unable to recover corrupt image after unexpected host reboot containerd/containerd#3671, and fixed by [release/1.2] Add local-fs.target to service file containerd/containerd#3746.
• Update Golang runtime to 1.12.13, which includes security fixes to the crypto/dsa
  package made in Go 1.12.11 (CVE-2019-17596), and fixes to the go command, runtime,
  syscall and net packages (Go 1.12.12).

CRI fixes:

• Fix shim delete error code to avoid unnecessary retries in the CRI plugin. Discovered
  in Update containerd to a6a0c8b6e36415a151d93d096c1c0af9e0bd7977. containerd/cri#1309, and fixed by [release/1.2] Fix shim delete error code. containerd/containerd#3732 and [release/1.2] backport: Fix delete error code on the containerd daemon side. containerd/containerd#3739.

[kervin521]

apt install docker-ce docker-ce-cli containerd.io

error info:

Reading package lists... Done
Building dependency tree       
Reading state information... Done
Package docker-ce is not available, but is referred to by another package.
This may mean that the package is missing, has been obsoleted, or
is only available from another source

E: Package 'docker-ce' has no installation candidate
E: Unable to locate package docker-ce-cli
E: Unable to locate package containerd.io
E: Couldn't find any package by glob 'containerd.io'
E: Couldn't find any package by regex 'containerd.io'

[cpuguy83]

LGTM

[kolyshkin]

LGTM