IrisBox / 虹膜空间 0.1.3 Preview

虹膜空间 / IrisBox 0.1.3 Preview · User namespace isolation

每个实例现在必须使用独立 User namespace，Guest root 映射到专属的宿主普通 UID 范围，缺失映射时拒绝启动。移植旧 Iris 实现，并适配私有产品目录、网络、显示、音频、Magisk、资源组和闹钟；宿主 Magisk 仍由用户自行安装。

• 双实例隔离、普通 UID 网络/GPU/音视频、全屏键鼠、文件交换、音频故障恢复、App/后台恢复及335项中英文资源通过实测。
• 原实例2账号、GSF ID、应用标识及数据保留；旧项目配置/数据不改，旧实例按授权保持停止。
• 中英文 README 附使用流程示意图，并提供隔离、迁移、维护、对比与验收文档；未发布原始截图或账号。
• 现有0.1.2/e13必须先正常停机、独立备份并迁移；仅覆盖APK不够。 映射后不能仅回退旧引擎。见 迁移说明。
• 已知限制：实例2登记并正常check-in后，Google商店仍显示Play Protect未认证，目录/下载未通过；用户已暂缓继续排查。 未清除Google数据，未伪造认证。

Each guest now requires its own User namespace, with root mapped to a dedicated unprivileged Host UID range and no Host-UID0 fallback. Both retained guests passed namespace/credential checks, fullscreen input, ordinary-UID network/GPU/audio/video, file isolation and recovery tests. All 49 engine payloads match an independent full build of the sanitized public source.

Existing e13 data requires a stopped-state backup and migration before starting this release. See the English migration guide. Google account/device IDs were retained, but the Store remains blocked by device certification after owner-confirmed registration and a successful check-in; further investigation was deferred. This is not a Play Integrity or manufacturer-certification claim.

Matched Raspberry Pi 4 / ARM64 / AOSP 13 / Permissive only. Shared-kernel/GPU risks remain. A fresh physical flash and a Host reboot with this mapped version were not tested. The public ROM excludes Google. The host image contains fresh empty userdata and no host Magisk.

APK, SHA256SUMS and release-manifest.json are attached. Unchanged guest Root/BusyBox sources remain at the v0.1.2-preview release. Large ROM, USB host image and upstream/kernel sources await real Google Drive/Quark share links from the owner; see Downloads / 中文下载. Missing links are explicitly marked.