make install

make uninstall

--- a/libcontainer/init_linux.go
+++ b/libcontainer/init_linux.go
@@ -7,6 +7,7 @@ import (
       "net"
       "os"
       +    "path/filepath"
       "runtime"
       "runtime/debug"
       "strconv"
       @@ -268,6 +272,32 @@ func populateProcessEnvironment(env []string) error {
       return nil
       }

       +// verifyCwd ensures that the current working directory is still inside
       +// the container’s mount-namespace root. If getcwd(2) returns ENOENT,
        // it indicates the cwd is outside the container.
        // See CVE-2024-21626.
       +func verifyCwd() error {
       +   if wd, err := unix.Getwd(); errors.Is(err, unix.ENOENT) {
       +       return errors.New("current working directory is outside of container mount namespace root -- possible container breakout detected")
       +   } else if err != nil {
       +       return fmt.Errorf("failed to verify if current working directory is safe: %w", err)
       +   } else if !filepath.IsAbs(wd) {
           +       // Sanity check: cwd should always be absolute
               +       return fmt.Errorf("current working directory is not absolute -- possible container breakout detected: cwd is %q", wd)
               +   }
       +   return nil
           +}

           @@ -326,6 +353,10 @@ func finalizeNamespace(config *initConfig) error {
               if err := system.ClearKeepCaps(); err != nil {
                   return fmt.Errorf("unable to clear keep caps: %w", err)
               }
               +    // After chdir to config.Cwd, ensure it’s still inside the container
                   +    if err := verifyCwd(); err != nil {
                       +        return err
                           +    }
               return nil
           }