v3.3.0

What's Changed

• feat(cli): SandboxViaOci host-rootfs commit without guest socket by @ZhiXiao-Lin in #471
• feat(cli): SandboxViaOci host-rootfs export and diff by @ZhiXiao-Lin in #473
• feat(cli): live Sandbox snapshot create via managed quiesce by @ZhiXiao-Lin in #474
• feat(cli): stopped Sandbox snapshots use save_managed by @ZhiXiao-Lin in #475
• feat(runtime): RW Sandbox bind aliases under private parents by @ZhiXiao-Lin in #476
• feat(runtime): allow paused OCI Sandbox cp and filesystem I/O by @ZhiXiao-Lin in #477
• feat(cli): paused Sandbox export and diff via host-rootfs capture by @ZhiXiao-Lin in #478
• feat(cli): paused Sandbox commit via host-rootfs capture by @ZhiXiao-Lin in #479
• docs(roadmap): note partial B3 quiesce progress for Sandbox product ops by @ZhiXiao-Lin in #480
• feat(cli): stopped Sandbox commit/export/diff via OCI-mapped host-rootfs by @ZhiXiao-Lin in #481
• feat(runtime): bind Box volumes into a3s.oci.attachments.v2 by @ZhiXiao-Lin in #482
• feat(runtime): classify Box workspace bind as a3s.oci.attachments.v2 by @ZhiXiao-Lin in #483
• feat(runtime): classify linux.netDevices as a3s.oci.attachments.v3 by @ZhiXiao-Lin in #484
• style(runtime): rustfmt oci_network_attachments tests by @ZhiXiao-Lin in #485
• feat(runtime): classify managed Secret mounts on SandboxViaOci prepare by @ZhiXiao-Lin in #486
• feat(cli): route Compose --isolation sandbox through SandboxViaOci by @ZhiXiao-Lin in #487
• feat(cli): probe OCI-managed health via session exec by @ZhiXiao-Lin in #488
• feat(runtime): opt-in keep Privileged network-device authority by @ZhiXiao-Lin in #489
• feat(runtime): stage SandboxViaOci Bridge host veth under keep-authority by @ZhiXiao-Lin in #490
• feat(runtime): attach SandboxViaOci Bridge veth peer to Box Linux bridge by @ZhiXiao-Lin in #491
• feat(runtime): install SandboxViaOci Bridge gateway and default route by @ZhiXiao-Lin in #492
• feat(cli): unlock Compose sandbox named bridges under keep-authority by @ZhiXiao-Lin in #493
• feat(runtime): add SandboxViaOci Bridge egress NAT under keep-authority by @ZhiXiao-Lin in #494
• feat(runtime): write NetworkStore peer hosts for SandboxViaOci Bridge by @ZhiXiao-Lin in #495
• feat(runtime): DNAT published TCP ports for keep-authority Bridge by @ZhiXiao-Lin in #496
• fix(runtime): omit false keep-authority in box-owner.json by @ZhiXiao-Lin in #500
• feat(cli): require guest metadata for Windows stopped snapshots by @ZhiXiao-Lin in #497
• feat(runtime): refuse symlink/reparse volume host sources by @ZhiXiao-Lin in #498
• fix(runtime): fail closed on passt host_port=0 publish by @ZhiXiao-Lin in #502
• feat(cli): require guest metadata for stopped export/diff by @ZhiXiao-Lin in #501
• fix(core): resolve host_port=0 at product admission by @ZhiXiao-Lin in #503
• fix(runtime): fail closed on missing rootfs diff baseline by @ZhiXiao-Lin in #506
• fix(cli): fail closed managed Sandbox snapshot restore by @ZhiXiao-Lin in #509
• fix(runtime): reject unclassified SandboxViaOci external binds by @ZhiXiao-Lin in #505
• fix(runtime): OCI-map SandboxViaOci diff baselines by @ZhiXiao-Lin in #504
• fix(runtime): host-enforce Linux MicroVM virtiofs :ro by @ZhiXiao-Lin in #507
• feat(cli): unlock Compose sandbox TCP publish under keep-authority by @ZhiXiao-Lin in #499
• fix(runtime): fail closed keep-authority DNAT teardown by @ZhiXiao-Lin in #510
• fix(runtime): fail closed MicroVM OCI VOLUME anonymous materialization by @ZhiXiao-Lin in #511
• fix(runtime): propagate keep-authority host-netdevice teardown errors by @ZhiXiao-Lin in #512
• fix(runtime): acknowledge ensure_bridge idle-teardown Result by @ZhiXiao-Lin in #513
• fix(runtime): tear down host-netdevice lease before boot-failure wipe by @ZhiXiao-Lin in #514
• fix(runtime): fail closed on present veth delete during lease teardown by @ZhiXiao-Lin in #515
• fix(cli): surface Compose sandbox start cleanup remove failures by @ZhiXiao-Lin in #516
• fix(runtime): tear down host-netdevice lease before orphan reap wipe by @ZhiXiao-Lin in #517
• fix(cli): tear down host-netdevice lease before legacy cleanup wipe by @ZhiXiao-Lin in #518
• fix(runtime): tear down host-netdevice lease on destroy and SDK/CLI wipe by @ZhiXiao-Lin in #519
• fix(runtime): fail closed when snapshot-lower marker target is missing by @ZhiXiao-Lin in #520
• fix(runtime): fail closed on snapshot CoW inventory I/O errors by @ZhiXiao-Lin in #521
• fix(cli): fail closed on volume detach and anonymous volume remove by @ZhiXiao-Lin in #522
• fix(runtime): surface host-netdevice staging rollback failures by @ZhiXiao-Lin in #523
• fix(runtime): fail closed VolumeStore prune on remove errors by @ZhiXiao-Lin in #524
• fix(runtime): fail closed MicroVM anonymous volume cleanup by @ZhiXiao-Lin in #525
• fix(runtime): refuse non-Linux MicroVM :ro without host denial by @ZhiXiao-Lin in #526
• fix(cli): fail closed on rootfs diff baseline creation by @ZhiXiao-Lin in #527
• fix(runtime): detach MicroVM :ro virtiofs aliases before wipe by @ZhiXiao-Lin in #528
• fix(runtime): detach MicroVM :ro virtiofs aliases in orphan reap by @ZhiXiao-Lin in #529
• fix(sdk): fail closed on remove/prune host detach and wipe by @ZhiXiao-Lin in #530
• fix(cli): fail closed Compose down network and volume remove by @ZhiXiao-Lin in #531
• fix(cli): fail closed Compose up network rollback by @ZhiXiao-Lin in #532
• fix(cli): fail closed Compose up service rollback by @ZhiXiao-Lin in #533
• fix(cli): fail closed Compose partial service wipe by @ZhiXiao-Lin in #534
• fix(runtime): fail closed managed resource rollback by @ZhiXiao-Lin in #535
• fix(cli): fail closed managed run startup rollback by @ZhiXiao-Lin in #536
• fix(cli): fail closed prune and system-prune wipe by @ZhiXiao-Lin in #537
• fix(cli): fail closed system-prune network reap by @ZhiXiao-Lin in #538
• fix(cli): fail closed system-prune image remove by @ZhiXiao-Lin in #539
• fix(cli): fail closed image-prune state load and remove by @ZhiXiao-Lin in #540
• fix(cli): fail closed rmi on box-state load by @ZhiXiao-Lin in #541
• fix(cli): fail closed rmi --force on non-missing remove by @ZhiXiao-Lin in #542
• fix(cli): fail closed NetworkStore open on disconnect by @ZhiXiao-Lin in #543
• fix(cli): fail closed info inventory and image store by @ZhiXiao-Lin in #544
• docs(evidence): green KVM Live tip v5 existing-host digest by @emigmo in #545
• fix(sdk): fail closed Sandbox runtime reap on stop/remove by @emigmo in #546
• fix(runtime): fail closed overlay unmount on stop/remove wipe by @emigmo in #547
• fix(sdk): route managed remove/stop through execution manager by @emigmo in #548
• fix(cli): fail closed inventory refresh by @emigmo in #549
• fix(runtime): fail closed orphan sandbox reap by @emigmo in #550
• fix(runtime): fail closed file-mount staging cleanup by @emigmo in #551
• fix(net): publish static UDP on passt and keep-authority DNAT by @emigmo in #552
• fix(cri): admit static UDP pod port mappings by @emigmo in #553
• fix(runtime): fail closed platform rootfs unmount on wipe by @emigmo in #554
• fix(runtime): fail closed orphan reap host claims before wipe by @emigmo in #555
• fix(cri): fail closed prepared rootfs wipe on remove by @emigmo in #556
• fix(cri): fail closed network disconnect on stop/remove by @emigmo in #557
• fix(runtime): fail closed orphan reap external socket cleanup by @emigmo in #558
• fix(runtime): fail closed overlay provider rootfs cleanup by @emigmo in #559
• fix(net): fail closed passt terminate on teardown by @emigmo in #564
• fix(runtime): fail closed destroy socket and box dir wipe by @emigmo in #565
• fix(runtime): host-enforce Windows MicroVM :ro via BindFlt by @ZhiXiao-Lin in #566
• fix(net): admit static UDP published ports in netproxy by @ZhiXiao-Lin in #567
• fix(runtime): admit UDP Runtime Service endpoints by @ZhiXiao-Lin in #568
• fix(runtime): keep /tmp/a3s-box-sockets sticky world-writable (#560) by @ZhiXiao-Lin in #569
• fix(runtime): fail closed unprivileged MicroVM foreign UIDs (#562) by @ZhiXiao-Lin in #570
• fix(pool): make snapshot-fork fall back to usable cold boot (#563) by @ZhiXiao-Lin in #571
• feat(netproxy): answer NetworkStore DNS A names before upstream by @ZhiXiao-Lin in #572
• feat(netproxy): Linux passt_bridge NetworkStore DNS A + own-alias hosts by @ZhiXiao-Lin in #573
• feat(netproxy): answer NetworkStore names on macOS TCP/53 by @ZhiXiao-Lin in #577
• fix(runtime): keep ephemeral box dir when guest exits before heartbeat (#576) by @ZhiXiao-Lin in #578
• docs: add first-principles architecture optimization plan by @ZhiXiao-Lin in #579
• feat(netproxy): default untrusted MicroVM egress deny (Axis C) by @emigmo in #580
• feat(netproxy): Linux passt_bridge TCP/53 NetworkStore answers by @emigmo in #581
• docs: host-held secret substitution spike (no MITM) by @emigmo in #582
• fix(runtime): fail closed on unknown OCI box-owned flags by @emigmo in #583
• fix(runtime): keep Sandbox off DedicatedVm qualification by @emigmo in #584
• fix(runtime): keep SandboxViaOci beside KVM qualification by @emigmo in #585
• feat(netproxy): enforce first-match IPv4 egress rules by @emigmo in #586
• fix(netproxy): drop IPv6 MicroVM egress by @emigmo in #587
• fix(runtime): refuse Sandbox Bridge when egress rules are unenforced by @ZhiXiao-Lin in #588
• fix(netproxy): classify egress behind one VLAN tag by @ZhiXiao-Lin in #589
• fix(compose): reject memory sizes that truncate to zero MiB by @ZhiXiao-Lin in #590
• fix(core): reject log max-size values that overflow by @ZhiXiao-Lin in #591
• fix(runtime): fail closed when passt stderr cannot be logged by @ZhiXiao-Lin in #592
• fix(compose): reject healthcheck durations that overflow by @ZhiXiao-Lin in #593
• fix(build): reject HEALTHCHECK durations that cannot fit by @ZhiXiao-Lin in #594
• fix(runtime): fail closed on unknown keep-authority flags by @ZhiXiao-Lin in #595
• fix(runtime): stop passt mapping the gateway to host loopback by @ZhiXiao-Lin in #597
• fix(shim): refuse virtio-net attach that skips the egress proxy by @ZhiXiao-Lin in #598
• fix(netproxy): apply operator deny before passt DNS divert by @ZhiXiao-Lin in #599
• fix(cri): fail closed on ExecSync timeouts that overflow u64 ns by @ZhiXiao-Lin in #601
• fix(dns): fail closed on garbage --dns; Bridge requires IPv4 by @ZhiXiao-Lin in #600
• fix(cli): fail closed on --timeout values that overflow u64 ns by @ZhiXiao-Lin in #602
• docs(changelog): remove conflict markers left by #602 squash by @ZhiXiao-Lin in #605
• fix(cli): fail closed on health-check timeouts that overflow u64 ns by @ZhiXiao-Lin in #603
• fix(compose): fail closed on non-IP dns in ACL by @ZhiXiao-Lin in #604
• fix(cri): fail closed on StopContainer timeouts that overflow u64 ms by @ZhiXiao-Lin in #610
• fix(scripts): chown before setuid on Sandbox OCI launcher by @ZhiXiao-Lin in #614
• fix(runtime): retry Service advertised-URL publish probe (#611) by @ZhiXiao-Lin in #615
• fix(sandbox): preflight honor delegated cgroup root (#616) by @ZhiXiao-Lin in #617
• fix(scripts): re-runnable prepare via depth-first cgroup rmdir (#613) by @ZhiXiao-Lin in #618
• fix(guest): apply A3S_SEC_* limits on CRI exec/PTY spawn (#606) by @ZhiXiao-Lin in #619
• fix(runtime): unwedge failed Sandbox create stuck in Starting (#623) by @ZhiXiao-Lin in #624
• fix(runtime): skip noisy mount CLI on unprivileged overlay probe (#609) by @ZhiXiao-Lin in #620
• fix(scripts): write soak fail exit_code before verifier (#608) by @ZhiXiao-Lin in #621
• fix(cri): default agent image to public alpine (#607) by @ZhiXiao-Lin in #622
• fix(runtime): reclaim OCI owner after device-policy helper death (#623) by @ZhiXiao-Lin in #625
• docs(cri): label 2.2.0 critest scoreboard as historical by @ZhiXiao-Lin in #626
• feat(runtime): Sandbox Outbound via host-netns by @ZhiXiao-Lin in #627
• fix(cli): keep Sandbox foreground OCI exit 0 by @ZhiXiao-Lin in #632
• fix(runtime): read MicroVM secret evidence from the boot path by @ZhiXiao-Lin in #633
• fix(registry): sign and verify on the same protocol as the image by @CharlieZiChen in #635
• fix(cli,runtime): fail closed before mutation on Windows and Sandbox by @ZhiXiao-Lin in #636
• fix(windows): align WHPX snapshot soak with clean-stop metadata by @ZhiXiao-Lin in #637
• fix(windows): stage stop.signal for unmanaged restore stop (#638) by @ZhiXiao-Lin in #639
• chore: pin OCI #347 virtiofs fchown + KVM Live v5 tip digest by @ZhiXiao-Lin in #640
• docs: Linux/KVM MicroVM OCI cutover evidence binder by @ZhiXiao-Lin in #642
• feat(kvm): packaged Host discovery for opt-in microvm|all (#641 gates 1-2) by @ZhiXiao-Lin in #643
• docs(kvm): packaged opt-in tip evidence + #644 stop/delete block by @ZhiXiao-Lin in #645
• fix(cli): trust OCI wait exit for DedicatedVm foreground runs by @ZhiXiao-Lin in #646
• fix(kvm): allow persistent in DedicatedVm OCI qualification by @ZhiXiao-Lin in #647
• chore(oci): pin OCI Runtime to f08555c9 (#348) by @ZhiXiao-Lin in #648
• feat(kvm): default absent OCI migration to packaged DedicatedVm (#641 gate 5) by @ZhiXiao-Lin in #649
• docs(whpx): add WHPX OCI cutover binder and sync Linux/KVM ROADMAP (#650) by @ZhiXiao-Lin in #651
• docs(whpx): record gate 1 packaging blocker for DedicatedVm cutover (#650) by @ZhiXiao-Lin in #652
• fix(whpx): pass system-image-manifest to Box-owned WHPX Host (#650) by @ZhiXiao-Lin in #653
• fix(whpx): reject flat Host package nesting system-image under bin (#650) by @ZhiXiao-Lin in #654
• release: prepare a3s-box 3.3.0 by @ZhiXiao-Lin in #655

New Contributors

• @CharlieZiChen made their first contribution in #635

Full Changelog: v3.2.7...v3.3.0