v0.4.0

New

• network = "localnet": a network mode that lets an app reach the local network but not the internet. It works through a TUN device and a userspace TCP/IP stack.
• climate check: validates app definitions without running them. Unknown keys in a definition are now reported as errors, so typos no longer pass silently.
• [image].install: an app can build its own image layer with a shell script on top of a base image, for tools that ship no pre-built image. climate pull -u -r (--rebuild) runs the install scripts again.
• App configuration overrides: a TOML file in ~/.config/climate/overrides/ changes only the keys it sets. Tables are merged and other values are replaced. climate show prints the definition with the override applied.
• Builds without systemd: cargo build --no-default-features makes a binary for distros without systemd (Alpine, Void, Gentoo with OpenRC, ...). Such a build ignores [limits] with a warning.

Fixed

• climate pull -u contacts the registry only once for apps that share an image, not once per app.
• When cgroup v2 isn't mounted at /sys/fs/cgroup, climate now says so and explains how to enable it on OpenRC. Before, youki failed with an unclear "failed to detect cgroup setup".
• Updated rustls to 0.23.45 for RUSTSEC-2026-0285 (TLS 1.3 handshake messages accepted across encryption levels).

Changed

• The seccomp filter is now built with seacomb, which is pure Rust, instead of libseccomp. Building climate no longer needs libseccomp-devel / libseccomp-dev.