Bastille Day 2026 - v1.4.4

New Features

• bastille stop now supports an experimental -f|--force option for when a jail just doesn't want to stop. It will forcibly tear down the jail and run all exex.*stop commands
• bastille rdr is secured by splitting the rdr and filtering into two separate anchors. This allows the use of additional firewall rules below the new anchor bastille/* to allow and disallow traffic. The previous implementation was flawed in that filtering rules would not apply to any of the redirects. Make sure to update your /etc/pf.conf by placing anchor bastille/* at the beginning of the filtering section. See https://bastille.readthedocs.io/en/latest/chapters/networking.html#etc-pf-conf for an example.

What's Changed

• fix: Correctly handle 'osrelease' in jail.conf when release is not validated by @frikilax in #1545
• bootstrap: error if touch .hushlogin fails by @tschettervictor in #1551
• docs: template. Document the usage of --arg-file by @yaazkal in #1547
• Documentation formatting fixes by @djberg96 in #1554
• upgrade: fix fetching pkg keys by @tschettervictor in #1562
• common: fix jail target when using JID by @tschettervictor in #1563
• network: allow adding same interface for standard non-VNET jails by @tschettervictor in #1566
• clone: fix cloning for encrypted datasets by @tschettervictor in #1572
• upgrade: fix fstab update for jails with ports by @tschettervictor in #1571
• Secure RDR by splitting the dynamic rules into rdr+filter by @tschettervictor in #1565
• stop: add -f flag by @tschettervictor in #1574
• destroy: fix for midnightbsd by @tschettervictor in #1576

New Contributors

• @cstdenis made their first contribution in #1549
• @djberg96 made their first contribution in #1554

Full Changelog: 1.4.3.260429...1.4.4