v0.8.0

0.8.0 (2026-09-30)

⚠ BREAKING CHANGES

• computer: the runtime stops naming an adapter, and the last two exceptions retire (#687)

Features

• agent: attach stdin and host control to piped machine exec (638a998)
• agent: drive the publish mirror from Docker container events (faab65d)
• agent: enter a container's namespaces for a debug shell (0759dc1)
• agent: export each running container's rootfs over NFS (f2bcd1a)
• agent: honour machine exec flow control (e001cde)
• agent: mirror host-address-pinned publishes for the inbound relay (465821e)
• agent: mount container rootfs with nfs-exportable overlay options (ec679cc)
• agent: pick a container domain's HTTP port from what it listens on (9676968)
• agent: read machine exec host frames beside the PTY output pump (6711d7e)
• agent: relay TCP connections from inside the machine (a3c8ea9)
• agent: relay the container ssh-auth socket over vsock (94687c2)
• agent: report the signal that ended a machine exec process (ccf20dc)
• agent: rescan a started container's listeners while its server binds (85a811e)
• agent: route a container domain's port 80 to its labelled HTTP port (5ee5073)
• agent: run k3s servicelb and list LoadBalancer Services (d5b441a)
• agent: run login machine exec requests as sshd-style sessions (99be9c5)
• agent: terminate TLS for container domains with the local CA (00c5b70)
• api: serve System VM resources over Connect and abctl (49cf273)
• cli: add abctl debug to open a shell in any container (de23c80)
• cli: add abctl ssh install to include ArcBox's SSH config (1822555)
• cli: add abctl tls trust/untrust for the local CA (8e7380a)
• computer: make a handover a lifecycle transition of its own (b424490)
• computer: SandboxEvent carries a monotonic sequence number (#695) (b38e943)
• computer: storage_bytes meters the retained footprint in every state (#692) (468ed81)
• computer: the startup sweep adopts a live sandbox instead of killing it (#674) (8e832e5)
• constants: reserve the ssh-auth socket path and relay port (960f9f7)
• core: forward Kubernetes LoadBalancer ports to the host (6a09b61)
• core: generate the local CA before the System VM boots (ab5fd1f)
• core: resize the System VM and persist the size to config.toml (89470a3)
• daemon: forward ssh-agent into containers over a vsock slot pool (70369dd)
• daemon: keep LoadBalancer listeners in step with the cluster (9d1df4f)
• daemon: reclaim freed disk space on idle and per machine (2323d4c)
• daemon: serve ssh <machine>@arcbox on a loopback port (10fd1eb)
• docker: let operators configure the guest dockerd (2b55f17)
• docker: let operators keep published ports off the LAN (514666c)
• engine: deliver signals through machine exec sessions (3ab1c7e)
• engine: flow-control machine exec sessions and always drain them (95021b0)
• engine: let the Kubernetes hold be observed (d92f6bc)
• engine: let the System VM's CPU and memory limits change at runtime (2a2d8ee)
• engine: open TCP connections inside machines as flow-controlled sessions (49919a6)
• engine: route debug-exec to a container over the agent session (7c75820)
• fc-driver: the Firecracker adapter for the VM driver port (R1, part 1) (#658) (4024577)
• local-ca: generate a name-constrained CA for container domains (b362ae5)
• local-ca: mint a certificate per server name from the CA (068e8cc)
• machine: drain machine consoles on pipe readiness, not a timer (a3ea863)
• net: make guest egress proxying an explicit policy (1f1d629), closes #315
• protocol: add flow-control windows to machine exec sessions (099f83a)
• protocol: add login, attached-stdin and signal fields to machine exec (82c73a5)
• protocol: add the debug-exec message type and target container (511d082)
• protocol: open TCP connections inside machines and mark output EOF (6e495ff)
• pty: carry an account's supplementary groups into the privilege drop (2897308)
• relay: window the Kubernetes and NFS vsock relays (protocol v6) (c091e84)
• rpc: add a LoadBalancer Service listing to the agent protocol (5aaabf6)
• sandbox: window the guest->host sandbox streams (#268) (0ba7975)
• snapshot: a live sandbox's CoW survives the startup sweep (#672) (2be3830)
• snapshot: add a util-linux BlockTools backend (6dfa93b)
• ssh: add the arcbox-ssh crate with its keys and login targets (01fda00)
• ssh: carry signals to session processes and report signal deaths (9e1b568)
• ssh: forward direct-tcpip channels to ports inside the machine (3cad4a3)
• ssh: honour pty-req, window-change and env in sessions (a9eb45c)
• ssh: run shell and exec sessions over the machine exec path (218262e)
• ssh: serve SSH connections that authenticate with the daemon's key (ece4247)
• ssh: serve the sftp subsystem with the machine's own sftp-server (264e96d)
• ssh: write the OpenSSH client config for the server (cb2c8a4)
• tap-net: add an nftables PacketFilter backend (fb8f4cd)
• transport: flow-control the half-close framed stream (#268) (49dd3b0)
• vm-driver: a guest network can adopt a lease whose guest still runs (#670) (8fbca3f)
• vm-driver: a prepared VM can stage its own files (R3, PR-G1) (#676) (e4d168a)
• vm-driver: add the VM port crate (R0 of the VM stack redesign) (#656) (1c2800c)
• vm-driver: close the three GuestNetwork gaps the manager conversion needs (R2, part 2) (#667) (e0b0c12)
• vm-driver: the process record names the jail its VMM runs in (595376f)
• vm: make the dmsetup search list configuration (#653) (ddf66b8)
• vmm: punch DISCARDed ranges on the HVC block fast path (7b0fa41)
• vmm: return reported guest pages to the host on the HV backend (8787141)
• vz: hand out non-blocking duplicates of a VM's console pipe readers (8415af5)
• xtask: check-layers, a cargo-metadata gate for the layer rules (#655) (97a4328)

Bug Fixes

• a startup read that cannot parse one record holds it instead of bricking the host (#684) (ce4f4e7)
• agent: close four gaps in the live-export watcher (663c94f)
• agent: give sysvinit machines a boot-completion hook (306da7d)
• agent: keep the boot-done hook out of systemd's preset policy (5317190)
• agent: put every busybox applet on a debug shell's PATH (3360507)
• agent: read machine addresses off the interfaces, not hostname (9613298)
• agent: report Kubernetes ready only once its kubeconfig exists (b992009)
• agent: serve only RPC inside distro machines (5305f47)
• agent: supervise the watcher without a check-then-act window (0a70beb)
• agent: trim data disks with FITRIM instead of a missing fstrim (d75ad0a)
• ci: finish the stable-1.98 clippy sweep the macOS job walks (ef12b7c)
• ci: let the fleet-agent release builds run to completion (#712) (d8f02a6)
• ci: master builds again under the current stable clippy (db671a9)
• clippy: appease stable 1.98 lints the macOS job reaches (35cfa59)
• computer: drop the guest agent before the handover, not after (005c5ba)
• computer: journal the jail so an adopted Computer stays jailed (cd0bdb5)
• computer: journal the socket on every path that holds a VMM (c46ad8b)
• computer: journal the VMM's socket so an adopt can reach it (b193d05)
• computer: keep a handed-over computer out of three paths that still reached it (38f3a6d)
• computer: let the handover answer for itself, and bound its port call (910bd1f)
• computer: make a refused handover legible in the failure it is reported through (732730c)
• computer: make one handover pass not cost the guests behind it (4ea4a9f)
• computer: refuse a sandbox id the jailer will not exec (#680) (b5bac73)
• computer: route detach_all through the per-computer actor (773f67c)
• config: read the documented ~/.config/arcbox/config.toml (f250bc4)
• daemon: boot on the HV backend without asking it for sandbox cleanup (b2b30f1)
• dns: follow the host resolver across network changes (e2a46f3), closes #714
• docker: carry attach half-close in-band over the vsock channel (1dad10e), closes #268
• e2e: assert both overlay options land on one mount (a8b08c3)
• e2e: preserve the data dir when readiness fails (c9d7874)
• engine: end a machine exec session when its consumer goes away (ab109d9)
• engine: keep kernel NIC names in distro machines (6684ecc)
• fc-driver: adopt yields a kill-able handle even when the orphan's API is dead (#666) (bb02640)
• machine: cap the machine kernel console at loglevel=4 (552e5c6)
• machine: drain every VM's console pipes, not only the System VM's (fb0c8ba)
• machine: keep the serial drain's fast poll while any bytes arrive (316564e)
• snapshot: attach loop devices the way busybox losetup actually works (#665) (59655de)
• snapshot: fail a CoW setup whose device has no node (507517e)
• snapshot: make the dm node exist where udev will not make it (522cc84)
• snapshot: reclaim the device when a setup fails before its node (7c96ce1)
• ssh: never hold the connection for input while output needs it (4d5fd38)
• tap-net: resolve the doc links off Linux, and tighten two test helpers (ce8a07f)
• transport: fail a writer whose peer left while it waited for window (5dfe5db)
• vm-driver: refuse path-shaped ids and make the restore contract check distinguishing (#661) (7f016f1)
• vsock: keep a host->guest packet inside one 4 KiB guest RX buffer (e2d8879)
• vsock: park a host->guest write while the guest's window is full (f10e904)
• vsock: size a host->guest packet to the guest's posted RX buffer (b103636)
• vz: ask for nested virtualization only on the System VM (e95a2b3)
• vz: close the console pipe ends handed to VZ once the VM runs (6e15b77)
• vz: decode a serial pipe read once, not per 4 KiB chunk (4369603)
• xtask: a dependency carrying the crate's own name is not a layer edge (#662) (fd9daec)

Performance Improvements

• daemon: poll LoadBalancers over one kept agent connection (6258585)
• hv: kick only the vCPU that services the vsock interrupt (e2b6d3a)
• vsock: drain a host→guest stream within one injection round (5de23af)

Code Refactoring

• agent: author the containerd config as TOML, not a Rust string (d2be452)
• agent: hold container rules as tagged per-container sets (0243dc5)
• agent: move machine exec exit frames and signalling into session.rs (a2e05cd)
• agent: move the tagged-rule iptables helpers into their own module (e846efa)
• agent: resolve machine exec requests into one process spec (09637e8)
• agent: run interactive machine exec sessions through the same loop (a0e4230)
• agent: run piped machine exec sessions through a channel-fed loop (5bf1363)
• balloon: release pages through a host-owned PageReleaser (8b8f2ac)
• computer: extract the GuestAgent port (R3, PR-D) (#673) (e7756d7)
• computer: move the sandbox runtime to computer/arcbox-computer-runtime (R3, part 2) (#671) (cdfcbc5)
• computer: refuse a handed-over computer at the door, not per command (18d8c53)
• computer: the computer lifecycle as a statig state machine (R3, PR-E) (#675) (c7b5d08)
• computer: the manager drives one actor per computer (R3, PR-F2) (#678) (ab5f401)
• computer: the per-computer lifecycle actor and its sub-tasks (R3, PR-F1) (#677) (d1c77ea)
• computer: the runtime stages through the port, and a jail goes with its grip (R3, PR-G2) (#681) (a2ba44f)
• computer: the runtime stops building its own VMM; the guest agent composes (#685) (80513be)
• computer: the runtime stops naming an adapter, and the last two exceptions retire (#687) (86ac9e1)
• computer: the sweep and pause reach a VM's area through the port (#686) (54c78f0)
• core: read host listener owners through one helper (b67588e)
• engine: give machine exec sessions an output type of their own (e86c0e2)
• engine: move machine exec sessions into their own module (85d0382)
• fc: a layout is built from a jail, not an isolation spec (f3b0788)
• snapshot: one file per BlockTools implementation (331db6e)
• snapshot: put block-device tooling behind a BlockTools seam (#650) (e9055a5)
• tap-net: make the packet-filter seam ready for a second backend (7c378f5)
• tap-net: move the sandbox TAP network into its own crate behind GuestNetwork (#663) (c1b16a8)
• vm: attach guest networks through the driver port's GuestNetwork (R2, part 3) (#669) (2e810aa)
• vm: extract the runtime's pure core (R3, part 1) (#668) (b4015b7)
• vm: move the sandbox rootfs builder into arcbox-vm with composer-supplied paths (#652) (054015f)
• vm: put the invariant translation's netfilter rendering behind a PacketFilter seam (#651) (25ab5a9)
• vm: reach the guest agent through the driver port's Vsock capability (#657) (e5c75d5)
• vm: split vm-agent and its wire vocabulary out of arcbox-vm (#649) (fda85db)
• vm: the sandbox manager owns its VMs through the driver port (R1, part 2) (#664) (86fb360)

Tests

• agent: adoption is exercised jailed, the mode the bug lived in (286fc55)
• agent: cover machine exec flow-control accounting (c220169)
• agent: give the host test build the toml its tests parse (4221445)
• agent: relay a TCP peer both ways through its half-closes (59674fa)
• api: ignore the dockerhub org icon lookup CI runners cannot resolve (55b384b)
• api: resolve the official-image icon fixture through redis, not nginx (1d63f6c)
• balloon: cover the release seam and host-page alignment (b8b43a6)
• computer: drive the manager real flows over the fakes (R3, PR-F3) (#682) (d5f69dc)
• computer: make the block-tools skips fail where both userlands exist (5c22782)
• core: cover the Kubernetes LoadBalancer reconcile (e87e351)
• e2e: cover Kubernetes LoadBalancer forwarding to the host (d4d54b6)
• e2e: cover stdin EOF in the smoke suite and serve with nc (beb2289)
• e2e: flood a machine's console and require exec to keep answering (06d8cd0)
• e2e: seed runtime-bin into the generation the daemon reads (dc5b48d)
• e2e: stage every runtime companion asset from the installed app (c025087)
• engine: drive machine exec flow control against a fake agent (1133e63)
• snapshot: cover the block-tools error paths nothing reached (07c345f)
• snapshot: wait out the ETXTBSY window for every stand-in binary (26955a1)
• ssh: drive exec sessions against a scripted machine (0e96b42)
• ssh: pin down when session input may hold the connection (b2b69b6)
• tap-net: prove the nftables rendering against a real kernel (9db4510)
• transport: make the window-overrun test race-free (dec0765)
• vm-driver: an adopted vm has to be usable, not merely alive (7de86bd)

Documentation

• agent: describe container domains served without a port (9604b03)
• agents: fold CLAUDE.md into AGENTS.md; land changes on master directly (d5bf9f3)
• agents: record DebugExecRequest as a codec bypass (6cd4df9)
• agents: record host-driven trim and the HVC data-disk path (6ebb73b)
• agents: record that a distro's console_loglevel fills the VZ pipe (3ee62e2)
• agents: record that an undrained VZ console pipe wedges the VM (6896d12)
• agents: record the agent rootfs's minimal busybox applet set (d42ddda)
• agents: record the console pipe's real capacity and the drain contract (3090ae2)
• agents: record the Docker and sandbox stream windows (3206c18)
• agents: record the nested-virtualization VM slot limit (c9e74d2)
• agents: record the seccomp-filter UAF machine Oops as a known kernel bug (3fac2e7)
• agents: record the vsock injection round and the targeted vCPU kick (5759226)
• agents: record what the distro tests and the parallel work taught (b122010)
• computer: describe the computer runtime crate and what binds only it (9de0396)
• describe HTTPS for container domains and abctl tls trust (f2ca88c)
• disk: add the post-change reclaim matrix and trim I/O numbers (0362bb2)
• disk: record the reclaim matrix and the HV fast-path gap (e8687e3)
• docker: correct two stale compatibility claims (#647) (876f70a)
• engine: say what the discovery probe prevents, not what it does (5497046)
• readme: list the machine distros that work today (8ca31a6)
• snapshot: name what losetup's " (lost)" marker actually means (4bbe07e)

Styles

• e2e: rustfmt the overlay options probe docker args (95b37f3)

Miscellaneous Chores

• assets: move host CLI and guest runtime to Docker 29.7.2 (#634) (a215d91)
• assets: pin boot bundle 0.8.6 (patched containerd) (#654) (db44b71)
• assets: pin boot bundle 0.8.7 (kernel v0.0.25, HVC block DISCARD) (9cbd7a7)
• master: release fleet-agent 0.1.5 (#707) (16be5eb)
• master: release fleet-agent 0.1.6 (#719) (a6d0dea)