Skip to content

stable-4757.2.0

Latest
Latest

Choose a tag to compare

View all tags
@tormath1 tormath1 released this 14 Sep 12:19
· 880 commits to main since this release
stable-4757.2.0
This tag was signed with the committer’s verified signature. The key has expired.
tormath1 Mathieu Tortuyaux
GPG key ID: AC5CCFB52545D9B8
Expired
Verified
Learn about vigilant mode.
8ac53ad
This commit was signed with the committer’s verified signature. The key has expired.
tormath1 Mathieu Tortuyaux
GPG key ID: AC5CCFB52545D9B8
Expired
Verified
Learn about vigilant mode.

Changes since Stable 4593.2.5

Security fixes:

Bug fixes:

  • Added full terminfo database to support modern terminals like foot and Alacritty.
  • Fixed booting the VirtualBox image, which was broken since upstream Ignition changed how their VirtualBox support works. The Vagrant VirtualBox image was unaffected.
  • Fixed using Ignition to create new partitions with number 0 to get the next available slot. (ignition#2234)
  • Updated the GCE udev disk rules to include NVMe disks. (scripts#3606)

Changes:

  • Exoscale: images are now built as 10G .qcow2 so they can be directly used with Exoscale Custom Templates (scripts#4075)
  • Add EROFS tools for containerd (Flatcar#2047)
  • Added Oracle Cloud Infrastructure images (flatcar/scripts#3846)
  • Added kernel config options to support HuC firmware authentication which is required for Intel Arc (DG2) hardware offloading for video. (scripts#4019)
  • All the legacy OEMs (CloudSigma, CloudStack, Exoscale, Vagrant, VirtualBox) have been converted to sysexts. The transition should be seamless, but the Flatcar team was only able to test VirtualBox with and without Vagrant, so please report any issues.
  • Build AMD GPU driver as module (#3461)
  • Dropped support for Equinix Metal (Packet). The servers are due to be switched off on June 30th 2026.
  • Dropped support for Rackspace, including OnMetal. Rackspace-specific images are no longer built or published. Flatcar only had community level support for Rackspace, and the Flatcar team is no longer confident that this support actually works. Rackspace themselves have pivoted from being an independent cloud provider to being a management platform for other clouds.
  • Dropped the "Oklo" release codename as it was never updated in a meaningful way.
  • Dropped the VMware "insecure" image. This was added a long time ago, and it is not clear to the current Flatcar team what purpose it served. It included the Vagrant insecure SSH key but without the other Vagrant files. If you want to use Vagrant, then do so with VirtualBox or Parallels. If you want to deploy onto VMware quickly, then use the OVA image.
  • Dropped the Vagrant VirtualBox image because the regular Vagrant image also targets VirtualBox. The only difference between them was that the former was geared for provisioning with Ignition and Afterburn rather than cloud-config and Vagrant itself. The Ignition support was broken when it was dropped by upstream. A single image can handle Ignition, cloud-config, and Vagrant. The Afterburn support has been dropped entirely.
  • Enable VNC console serial logs on ARM64 QEMU/KVM instances (flatcar/scripts#2359)
  • Moved systemd-sysext image mounting into the initrd, so that system extensions can better define the behavior of the final system at boot without workarounds to apply settings late at boot. This means .wants symlinks for systemd units work as expected now and, therefore, we dropped the ensure-sysext.service workaround. We still recommend extensions to keep their workarounds, e.g., using .upholds instead of .wants, to better support live reloading. A skipping logic prevents an extension refresh late at boot but only if no changes were found. For extensions that are not stored on a custom filesystem, such as a separate /var partition, the new extension mounting from the initrd won't be able to load them early but they will be picked up late at boot through the extension refresh. This is another case where it's good if extensions keep workarounds for late loading.
  • OS-dependent sysexts (e.g., docker-flatcar, containerd-flatcar, podman, zfs, nvidia) are now cryptographically signed using dm-verity roothash signatures. This enables stricter sysext policies via systemd-sysext and provides a foundation for verifying user-provided extensions in future releases. The format changed from squashfs to erofs-based Discoverable Disk Images (DDI). OEM sysexts (e.g., oem-azure, oem-gce) are now also signed and built during the image phase to ensure consistent signing with the same ephemeral key. (scripts#3162)
  • Refreshed the Vagrant and Vagrant Parallels images for use with recent Vagrant releases, adding implicit support for provisioning with Ignition (VirtualBox only) or cloud-config. Vagrant 2.2.5 is now required. See the revised documentation for further details.
  • Refreshed the VirtualBox OVF (which is also used by the Vagrant image) so that VMs are configured with modern hardware, including a VirtIO storage controller and UEFI. The clock is configured for UTC rather than local time.
  • Reworked how the OEM partition is mounted at boot time so that Ignition no longer has to handle this by itself, thereby requiring less patching. This should not affect any existing usage, but it is a significant underlying change, so it needs to be called out. Please report any unexpected issues. (flatcar/script#3934)
  • Switched /etc/ from a custom overlayfs for A/B updates to using a systemd-confext extension providing the default contents by using systemd-confext in the mutable mode where /etc/ gets used as upperdir scripts#3555
  • enable /dev/kfd/ in amdgpu driver on AMD64

Updates:

Changes since Beta 4757.1.0

Security fixes:

Updates:

Assets 2
Loading