v1.4.1

Only mask host surfaces that exist on the host; skip missing proc/sys paths when building --security-opt mask= and /sys tmpfs mount masks.