Skip to content

v3.8.3

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 20 Oct 16:03
· 1 commit to main since this release
v3.8.3
0a66b44

Cbox Init v3.8.3

Production-grade PID 1 process manager for Docker containers with Laravel-first design.

Security rebuild — no behaviour change

This release is the same code as v3.8.2, rebuilt on a patched Go toolchain
and a patched golang.org/x/net. There are no functional changes. Upgrade if
you scan container images for vulnerabilities.

The v3.8.2 binaries were built by a floating go-version: '1.26', which
resolved to Go 1.26.8 and carried four fixable HIGH denial-of-service findings:

CVE Where Fixed by
CVE-2026-78667 stdlib net/http — DoS via crafted HTTP Range headers Go 1.26.10
CVE-2026-78669 stdlib net/http2 — DoS via excessive HTTP/2 SETTINGS frames Go 1.26.10
CVE-2026-97031 stdlib crypto/tls — DoS via multiple ECH outer extension references Go 1.26.10
CVE-2026-78669 golang.org/x/net HTTP/2 — the same advisory in x/net's own implementation x/net v0.60.0

cbox-init serves HTTP on the Prometheus metrics port, the readiness port and
the management API, so these were reachable rather than dead code.

These binaries report go1.26.10 and golang.org/x/net v0.60.0
(go version -m cbox-init), and scan clean:

trivy rootfs --severity CRITICAL,HIGH --ignore-unfixed cbox-init
=> cbox-init  gobinary  0

Every go-version in CI and in the release workflow is now pinned to the
toolchain patch recorded in go.mod, so a release is built by the toolchain
that was scanned rather than whatever the runner resolves that day.

Features

  • Multi-process orchestration with DAG-based dependencies
  • Health checks (TCP, HTTP, Exec) with configurable thresholds
  • Restart policies with exponential backoff
  • Prometheus metrics export
  • Management REST API with authentication
  • Framework detection (Laravel, Symfony, WordPress)
  • Graceful shutdown and zombie reaping
  • Process scaling support

Installation

Linux AMD64

wget https://github.com/cboxdk/init/releases/download/v3.8.3/cbox-init-linux-amd64
chmod +x cbox-init-linux-amd64
sudo mv cbox-init-linux-amd64 /usr/local/bin/cbox-init

Linux ARM64

wget https://github.com/cboxdk/init/releases/download/v3.8.3/cbox-init-linux-arm64
chmod +x cbox-init-linux-arm64
sudo mv cbox-init-linux-arm64 /usr/local/bin/cbox-init

macOS AMD64 (Intel)

wget https://github.com/cboxdk/init/releases/download/v3.8.3/cbox-init-darwin-amd64
chmod +x cbox-init-darwin-amd64
sudo mv cbox-init-darwin-amd64 /usr/local/bin/cbox-init

macOS ARM64 (Apple Silicon)

wget https://github.com/cboxdk/init/releases/download/v3.8.3/cbox-init-darwin-arm64
chmod +x cbox-init-darwin-arm64
sudo mv cbox-init-darwin-arm64 /usr/local/bin/cbox-init

Verification

Verify the checksums:

wget https://github.com/cboxdk/init/releases/download/v3.8.3/checksums.txt
sha256sum -c checksums.txt

Docker

Multi-arch images (linux/amd64, linux/arm64) on GitHub Container Registry,
tagged 3.8.3 — without a v. 3.8, 3
and latest always point to the newest matching release.

docker pull ghcr.io/cboxdk/init:3.8.3

The image is Alpine with cbox-init as its entrypoint, running as the non-root
user cbox (uid 1000). Use it as a base:

FROM ghcr.io/cboxdk/init:3.8.3
COPY cbox-init.yaml /etc/cbox-init/cbox-init.yaml

Or copy the binary into your own image — the right architecture is picked
for you:

FROM your-base-image
COPY --from=ghcr.io/cboxdk/init:3.8.3 /usr/local/bin/cbox-init /usr/local/bin/cbox-init
ENTRYPOINT ["/usr/local/bin/cbox-init"]

Documentation

Quick Start

Create a minimal configuration:

version: "1.0"
global:
  shutdown_timeout: 30
  log_level: info

processes:
  php-fpm:
    enabled: true
    command: ["php-fpm", "-F", "-R"]
    restart: always

Run:

cbox-init --config cbox-init.yaml
Assets 7
Loading