v0.8.0

sluice v0.8.0

A security-hardening release. Opt-in sandbox lockdown, a copy-on-write workspace mode, and tighter egress that closes DNS-based exfil tunnels - all on top of the same default-deny egress firewall, non-root box, and project-dir-only mount.

Added

• Hardened seccomp profile (opt-in) - SLUICE_SECCOMP=hardened runs the box under a tightened syscall filter.
• Read-only rootfs (opt-in) - SLUICE_READONLY_ROOT=1 makes the container filesystem immutable.
• Workspace overlay (opt-in) - SLUICE_WORKSPACE=overlay runs against a throwaway copy of the repo; the agent's edits land in a scratch layer you review and apply.
• Tighter default privileges - drop ALL Linux capabilities and add back only the boot-needed set, plus no-new-privileges, resource bounds, and removal of in-box sudo.
• DoH/DoT exfil block - DNS-over-HTTPS and DNS-over-TLS resolvers are refused even when their host is allowlisted, closing a covert egress tunnel.
• No-op run hint - sluice run warns when SLUICE_RUN_CMD is a no-op so a silent success isn't mistaken for a hang.

Changed

• Test suite migrated to bats-core with a container-structure-test gate (asserts base-image invariants: no sudo, uid 1000, firewall packages). CI runs the gate on Docker and rootless Podman.

Verify

Every release ships a deterministic source tarball, SHA256SUMS, and a cosign keyless signature bundle. Verification steps are in SECURITY.md.

Full changelog: v0.7.0...v0.8.0