v2.12.0
Cumulative feature release for the 2.11 and 2.12 work.
- Persistent application services can restore after boot. cpak uses systemd when it is available and keeps a portable startup path on other systems.
- Package manifests can define named service commands, arguments, dependencies, health checks and restart policies.
- Repeatable
--env,--env-fileand file-backed--secretoptions cover server configuration without storing secret contents. cpak ps,status,inspectandhealthreport container, process, listener and service state through one interface.- Private GitHub repositories can use device authentication. Registry credentials fall back to private files when Secret Service or D-Bus is unavailable.
- X11 applications run on a private Xwayland or Xephyr display. The built-in broker handles directional text, HTML and image clipboard access without exposing the host X11 socket.
- Nested JSON values work with
cpak override, includingsessionBus.ownand environment arrays.cpak override editopens the complete policy in the configured editor. - NixOS receives native flake and module support. Userspace networking refreshes its resolver after network changes without granting host networking.
- Go 1.26.7 and
x/crypto0.56.0 address CVE-2026-78662 and CVE-2026-56855 in SSH channel handling.
Full Changelog: v2.10.16...v2.12.0