v0.145.116

• Let a networked container ping: the mount helper, as U1's root in the container's network namespace before the mounts, writes its net.ipv4.ping_group_range from the lowest host gid U1 maps to the highest (ns.pingGroups), so iputils' plain ping opens an ICMP echo socket for IPv4 and IPv6 instead of a raw one it has no CAP_NET_RAW for, as on a NixOS host whose range is "0 2147483647" -- which U1 cannot write, the kernel refusing an id its writer's namespace does not map; a failure ends the launch as every helper step does, and basic-a pings 127.0.0.1 and ::1 from a networked session and is refused without a network (7a2f328)