VeriRun v0.3.0 — Isolated Execution

VeriRun v0.3.0 — Isolated Execution

v0.3.0 delivers M2's explicit execution tiers and its strongest published evidence:
an attack/replay matrix on one recorded local Linux Kubernetes environment using
kind and gVisor RuntimeClass(handler: runsc).

Included

• A digest-pinned Docker development-container tier with no network, read-only
  filesystem, non-root execution, removed Linux capabilities, resource limits, and
  bounded cleanup.
• A restricted Kubernetes Job tier with explicit context, namespace and RuntimeClass;
  default-deny-egress preflight; bounded logs; zero retry backoff; and mandatory Job
  cleanup.
• container-smoke and kubernetes-smoke CLI workflows for controlled baseline and
  replay exercises.
• Automated regressions and a local Kubernetes/gVisor attack matrix covering timeout,
  output flood, memory pressure, denied egress, root filesystem write, privilege
  escalation, invalid source, and artifact tampering.

Evidence

The release assets include the final clean-revision Kubernetes/gVisor report and its
full artifact bundle. The checked-in runtime report
documents the same matrix, environment identity, and replay semantics. The release
CI run validates formatting, typing, schema export, unit tests, build, and trusted
smoke workflows.

Supported boundary

The Kubernetes/gVisor claim is limited to the recorded local, single-node kind
environment with RuntimeClass(handler: runsc), a restricted namespace, and an
enforced default-deny-egress policy. The development-container tier is for local
development and regression work only.

Known limitations

• This is not a production-security certification or an absolute containment claim.
• Other Kubernetes distributions, CNI implementations, container runtimes, default
  Docker/Colima profiles, and cluster configurations have not been declared
  compatible by this release.
• Kernel, gVisor, container image, Kubernetes control-plane, and operator-managed
  network-policy vulnerabilities remain outside the verifier's trust boundary.
• A portable per-Pod PID limit is unavailable in the Kubernetes contract, so live
  fork-bomb validation is intentionally excluded.
• Durable result idempotency across failures belongs to v0.4/M3's control plane.

Upgrade notes

The public Python package version changes from 0.2.0 to 0.3.0. Existing local
and gateway workflows are retained. To use Kubernetes execution, provide all
explicit runtime inputs described in the isolation contract;
VeriRun does not provision cluster security boundaries on an operator's behalf.