Releases: SupremeCommanderHedgehog/containerizer
Releases · SupremeCommanderHedgehog/containerizer
Release list
v0.9.0
0.9.0 (2026-07-13)
Features
Bug Fixes
- analyze: filter tracer's /var/lib/containers from path classification (#119) (#120) (7bb7c49)
- analyze: seccomp allowlist = union(install, runtime) syscalls (#116) (#118) (fc5e04e)
- analyze: wire --start-cmd as entrypoint when no systemd (#110) (21694bc)
- trace: publish VERIFY_* env into the sandbox so verify mode works (#114) (#117) (c33e51c)
Documentation
v0.5.0
0.5.0 (2026-06-11)
Features
- analyze: parse strace fallback logs for bind/connect/accept (#93) (6f9e29d)
- runner: boot systemd as PID 1 for trace runner (#96) (46ad019)
Bug Fixes
- runner: force LF line endings on runner-image scripts (#88) (2671098)
- trace,build: allocate TTY for interactive installers + surface fallback gaps (#91) (e9719eb)
- trace: the example application Y/N prompt under systemd-PID-1 runner (#97) (8fea5e2)
Documentation
v0.8.0
v0.7.0
v0.6.0
v0.4.0
0.4.0 (2026-06-09)
Features
- analyze: M3 analyzer + policy derivation (#80) (7cfd1fa)
- build: M6 build subcommand end-to-end orchestrator (#86) (4ab3873)
- generate: M4 generators (Containerfile + Quadlet + seccomp + README) (#82) (44901b4)
- verify: M5 verify (diff-only) (#84) (8410197)
Bug Fixes
- sandbox/collectors: drop stray BEGIN printf opener from .bt files (#70) (78aecdd), closes #58
- sandbox/collectors: key bind.bt proto map by (pid<<32 | fd) instead of tid (#71) (664c594), closes #52
- sandbox: kernel-headers in runner image + 15s grace for bcc compile (#76) (87d05ee)
- sandbox: replace bcc tcpconnect/tcpaccept with bpftrace (#77) (#78) (0d11f14)
- trace: bind-mount kernel tracefs + headers + CI rootful podman (#74) (716740e)
Documentation
- m3: analyzer + policy derivation spec + implementation plan (#79) (122df45)
- m4: spec + implementation plan for generators (#81) (d1add90)
- m5: spec + implementation plan for verify (#83) (fff07d1)
- m6: spec + implementation plan for build subcommand (#85) (7f7dcc1)
- plan: add M2 sandbox + trace implementation plan (#46) (7ba3bd3)
- spec: add M2 sandbox + trace design spec (#45) (d540fc4)
v0.3.0
0.3.0 (2026-06-07)
Features
- sandbox/collectors: bind.bt bpftrace tracer for bind() syscalls (#51) (2eb5234)
- sandbox/collectors: capable bcc-tools wrapper to JSONL (#56) (d0ca290)
- sandbox/collectors: open.bt bpftrace tracer for file accesses (#50) (e6cde13)
- sandbox/collectors: syscalls.bt bpftrace tracer for syscall rollup (#53) (71d89b4)
- sandbox/collectors: tcpaccept bcc-tools wrapper to JSONL (#55) (4ee02af)
- sandbox/collectors: tcpconnect bcc-tools wrapper to JSONL (#54) (c3d2ceb)
- sandbox: bash trace-orchestrator skeleton with EOF-as-Enter finalize (#49) (76c2ac6)
- sandbox: runner image Containerfile and sandbox/ scaffolding (#48) (f280851)
- sandbox: strace fallback when bcc/bpftrace collector fails to attach (#59) (2f69a27)
- sandbox: wire trace-orchestrator to launch all six collectors (#57) (1d67384)
- trace: containerizer trace subcommand with pre-flight and summary (#62) (7adec2a)
- trace: RunnerImage with hash-based tag and lazy podman build (#60) (eda9c2e)
- trace: TraceRunner constructs podman-run argv and execs (#61) (eab0aef)