Skip to content

Unroot 1.0.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 07 Aug 03:37
· 25 commits to main since this release
1.0.1
7b7a7a0

Maintenance Release — August 8, 2026

Unroot 1.0.1 incorporates the first round of real-world feedback after the
initial release.

This release strengthens robustness, streamlines the user experience, improves
the CLI interface, and enhances diagnostics and archive safety.

Highlights include removing the standalone single command while adding
enter --single for unmanaged rootfs trees, adding essential device nodes to
/dev for better tool compatibility, fixing a setgroups issue affecting
Gentoo (Gentoo users should still set FEATURES="-pid-sandbox" due to a
QEMU/Portage incompatibility), providing a sensible default PATH to simplify
command invocation, and making --map-ro more convenient for common use cases.
Full details below:

Rootfs Compatibility

  • /dev now includes /dev/full, standard stream links, and proper PTY
    support. Shell process substitution and interactive tools work correctly
    without exposing the entire host /dev tree.
    (#2)

  • Commands now receive a sensible default PATH focused on the rootfs. You can
    still customize it explicitly, or use --no-default-env for a completely
    empty environment when needed.
    (#3)

  • Rich roots now preserve supplementary group memberships, allowing tools like
    Portage to drop privileges correctly. The safety restriction on setgroups
    remains in place for single-ID mappings only.
    (#6)

  • When namespace setup fails, error messages now clearly explain what went
    wrong and why, including helpful context for AppArmor, seccomp, SELinux, or
    container-related issues.
    (#7)

Ownership And CLI

  • unroot enter --single ROOT lets you enter unmanaged, single-owner rootfs
    trees without needing subordinate UID/GID allocations.
    (#4)

  • --map-ro SOURCE is now shorthand for --map-ro SOURCE:SOURCE — simpler
    when the host and container paths match.
    (#5)

  • The standalone unroot single command has been removed to reduce confusion.
    Single-ID namespace root is now available through unroot enter --single
    when entering a specific rootfs.
    (#12,
    #14)

  • Native mode is now described more clearly as Unroot's conventional privileged
    chroot workflow for host-owned and mounted filesystems.
    (#11)

Archive Safety And Ownership Conversion

  • pack and unpack now check whether your tar installation supports ACLs,
    extended attributes, and SELinux labels. Unroot refuses to silently lose
    metadata by default; use --force if you accept reduced fidelity.
    (#8)

  • Documentation now explains how to convert between rich and native roots:
    pack followed by unpack --native creates a native tree from a rich root,
    while the reverse flow creates a managed rich copy without manual ownership
    changes.
    (#10)

Known QEMU Compatibility Boundary

Foreign Portage builds may need FEATURES="-pid-sandbox" because QEMU
linux-user cannot create a host thread after Portage enters another PID
namespace. Native-architecture builds are unaffected. Unroot documents this
upstream limitation but does not silently alter distribution policy.
(#13,
QEMU #172)

Assets 16
Loading