- linux: use the new mount API for more mount operations.
- linux: use OPEN_TREE_NAMESPACE when possible. It improves container startup performance.
- linux: use a trusted /proc file descriptor for more operations to harden accesses under /proc.
- linux: reject invalid capabilities in config.json.
- utils: detect the initial user namespace by the inode of /proc/self/ns/user instead of the uid_map layout, so an identity uid_map created by systemd 260 is no longer mistaken for the initial user namespace.
- utils: honor O_NOFOLLOW in the safe_openat fallback used on kernels without openat2(2), so a "dest-nofollow" bind mount whose destination is a symlink is created on the symlink itself.
- cgroup: reject a sub-cgroup that escapes the container cgroup.
- status: check the unlinkat result when removing the state directory.
- status: fix double-close.
- hooks: restore the JSON configuration passed to OCI hooks to the formatting used with YAJL (slashes not escaped, not prettified), avoiding breakages introduced by the switch to json-c.
- krun: require the virgl render server only when GPU support is requested.
- krun: passt, do not map the gateway address.
Other Useful Business Software
$300 Free Credits to Build on Google Cloud
Put your $300 in credit toward real workloads, then keep building with free monthly usage for 20+ products. No commitment and no charge until you upgrade.
Go from Code to Production URL in Seconds
Skip the Kubernetes configs. Cloud Run handles HTTPS, scaling, and infrastructure automatically. Two million requests free per month.
