Cherry pick 3717 3718 fixes to release-4.3

CHANGELOG.md

@@ -1,8 +1,15 @@
 # SingularityCE Changelog
 
+## Changes Since Last Release
+
+### Bug fixes
+
+- Don't set ineffective `mode=777` on workdir bind. Fixes error in OCI-mode with
+  `--workdir` and runc >= 1.2.0.
+
 ## 4.3.2 \[2025-06-18\]
 
-## Requirements / Packaging
+### Requirements / Packaging
 
 - Ubuntu 20.04 packages dropped - end-of-life.
 - EL 10 (RHEL/AlmaLinux/Rocky Linux 10) packages introduced.

e2e/actions/actions.go

@@ -340,7 +340,7 @@ func (c actionTests) actionExecMultiProfile(t *testing.T) {
 					argv: []string{"--home", "/tmp", c.env.ImagePath, "cat", "/etc/passwd"},
 					exit: 0,
 					wantOutputs: []e2e.SingularityCmdResultOp{
-						e2e.ExpectOutput(e2e.RegexMatch, `^root:x:0:0:\w*:[^:]*:/bin/ash\n`),
+						e2e.ExpectOutput(e2e.RegexMatch, `^root:x:0:0:[^:]*:[^:]*:/bin/ash\n`),
 					},
 				},
 			}

e2e/actions/oci.go

@@ -308,7 +308,7 @@ func (c actionTests) actionOciExec(t *testing.T) {
 			argv: []string{"--home", "/tmp", imageRef, "cat", "/etc/passwd"},
 			exit: 0,
 			wantOutputs: []e2e.SingularityCmdResultOp{
-				e2e.ExpectOutput(e2e.RegexMatch, `^root:x:0:0:\w*:[^:]*:/bin/ash\n`),
+				e2e.ExpectOutput(e2e.RegexMatch, `^root:x:0:0:[^:]*:[^:]*:/bin/ash\n`),
 			},
 		},
 		{

internal/pkg/runtime/launcher/oci/mounts_linux.go

@@ -140,7 +140,6 @@ func (l *Launcher) addTmpMounts(mounts *[]specs.Mount) error {
 		opts := []string{
 			"rbind",
 			"relatime",
-			"mode=777",
 		}
 		if !l.cfg.AllowSUID {
 			opts = append(opts, "nosuid")