v0.3.0

Stops the interceptor leaking containerd shims, and makes read-only networking mounts unconditional.

Changed

• The OCI runtime is now exec'd rather than spawned. containerd cancels a runtime call by SIGKILLing its direct child, so the interceptor died and left runc — and the shim above it — orphaned at roughly 5 MiB each until the host rebooted.
• /etc/hosts, /etc/hostname and /etc/resolv.conf are always made read-only. --oi-readonly-networking-mounts is retained as an accepted no-op so an existing daemon.json keeps working. Mount options are normalised, so a mount arriving with no options, or with rw after ro, ends up read-only too.
• A signal-killed runtime is reported as signal death instead of exit 255.

⚠️ Deployment change required. Upgrading the binary alone does not stop the leak. Docker generates its own non-exec /bin/sh wrapper for any runtime with a non-empty runtimeArgs, which recreates the process layer this release removes. Move flags into your own execing wrapper script, point the runtime's path at it, and leave runtimeArgs unset.

Full rationale and verification: #188

v0.2.3

v0.2.3

v0.2.2

v0.2.2

v0.2.1

• Reverted to upstream OCI spec parsing library.

v0.2.0

• All options are now prefixed with --oi in order to avoid name conflicts with underlying runtime options. For example, --readonly-networking-mounts is now called --oi-readonly-networking-mounts.
• Fixed an issue where rewriting a container's config resulted in clone3 syscalls failing. This was due to an issue in the OCI spec parsing dependency. This release uses a forked version of the library, pending acceptance of an upstream PR to resolve the issue.
• Added the ability to override environment variables (--oi-env, --oi-env-force).
• Added optional debug output when modifying container configs (--oi-write-debug-output).

v0.1.0

Initial release. The --readonly-networking-mounts flag is supported, which causes /etc/hosts, /etc/hostname, and /etc/resolv.conf to be mounted as readonly. Typically, Docker will mount these files as read-write, which can be problematic for containers with a writable layer size quota.