v2.8.0

2.8.0 (2026-10-22)

Features

• arc: copy capability payloads once per node into a capability store (d35960c)
• arc: prune capability store entries no scale set or pod uses (8da1713)

Bug Fixes

• arc: check the capability store's settings in validation as well as at render (543e66a)
• arc: choose the capability store settings inside each filter call (09ecadd)
• arc: copy a tool or version directory that is a link as the link in the pod's tool cache (1bb2b62)
• arc: copy an aliased tool-cache arch directory as the link instead of linking to the store's (2975f73)
• arc: copy an image shared by two capabilities once into the store (8b9c129)
• arc: flush capability store entries before publishing and rebuild a pod's partial copy on rerun (5872044)
• arc: keep a pod's cached tool trees writable when the capability store is on (ba28499)
• arc: keep capability store entries a departed profile's pods still use (6d523ee)
• arc: keep the pruner's capability store grants to the namespaces it reads (7445765)
• arc: make a pod's linked tool trees owner-writable whatever mode the store's directories have (523cf4c)
• arc: merge a system-library entry once when two capabilities share its image (5da86af)
• arc: mount only the store entries a pod uses on its runner container (345c629)
• arc: mount the store's externals entry in a dind native sidecar as well as a dind container (d7ec22f)
• arc: name capability store entries for their payload kind as well as the image digest (a048e89)
• arc: prepare the capability store before the dind externals copy (ff82dbd)
• arc: publish a payload whose root is read-only and say why a rename failed (63bb70e)
• arc: refuse a capability whose init container would take a store init container's name (b4c6a29)
• arc: refuse a node cache and capability store that share or contain a directory (fe8ba4e)
• arc: refuse to start the node cache pruner with a store root and no store namespaces (9630e65)
• arc: remove a pod's capability store copy even when it holds read-only directories (093428a)
• arc: replace a read-only completeness marker when the tool cache is linked again (99742c4)
• arc: validate the node label key when a node cache or the store needs the pruner (44ac928)

Code Refactoring

• arc: stop registering the capability store key function as a filter no task uses (55453d4)

Documentation

• arc: declare the capability store's profile key and settings in the argument specification (ef229ca)
• arc: describe the kind test in its own section and its store case in the store section (709c1df)
• arc: limit the store's dind externals copy to values that write the sidecar out (fe8420f)
• arc: list exactly the applets the capability store image's scripts use (126ec04)
• arc: name the init containers that write to the store and the one that only reads it (af05fa7)
• arc: state chmod in the capability image and store image contracts (60bb6d3)
• arc: state that a store switched off fleet-wide keeps its entries for the operator to delete (eccceb6)
• arc: state that the store's flush before publishing is host-wide and why that is accepted (03e3997)
• arc: state the capability store's copy cost on a cold node and its disk footprint exactly (d6fce81)
• arc: state the store's copy container, first-wave copying and burst nodes as the code has them (bd1746d)
• arc: state the store's pruner, grants and dind limit as the code has them (32a0341)
• tool-images: list chmod among the applets the init containers run from busybox (e610f49)

Tests

• arc: build the pruner image from the repository root (0dcb312)
• arc: count lines in the capabilities test without relying on wc's padding (ce282d0)
• arc: cover a tool alias that sorts before its target in the tool-cache link script (824bc07)
• arc: fail the log wait only when the pod has ended (1482d67)
• arc: name the pruner test's store entries as the role does (032fab6)
• arc: run two capability store pods and the pruner against real mounts in kind (53e3072)