jailer 0.5.4

Full Changelog: v0.5.3...v0.5.4

jailer 0.5.3

Full Changelog: v0.5.2...v0.5.3

jailer 0.5.2

Tarballs for FreeBSD amd64 and aarch64, built on FreeBSD 15.1 and needing its libc, so for 15.1 and later; on 15.0, build from source or the port in ports/sysutils/jailer.

t=jailer-0.5.2-freebsd15-$(uname -p)
fetch https://github.com/grepjava/jailer/releases/download/v0.5.2/$t.tar.gz
tar xzf $t.tar.gz
install -s $t/bin/jailer /usr/local/bin/
install -m 444 $t/man/man1/jailer.1 /usr/local/share/man/man1/

Fixes

• ADD follows a link to an archive inside the context, as COPY does; a link that leads elsewhere is an archive that is not found.
• login changes only its registry's entry. credsStore, credHelpers and other registries in the auth file are kept, and a file that is not JSON is left alone.
• WORKDIR follows links inside the image, so WORKDIR /home/app works on FreeBSD, where /home is a link, and the RUN steps after it run there. A directory it makes is now in the image's layers.
• A directory COPY makes has its source's mode.
• A run that fails after its pod is on the bridge takes it off again: its pf rules and address lease go.
• Linking or unlinking alike files is a change in a layer, so hard links come out as built.
• check finds relative commands and PATH entries from the working directory, taking .. and links as the jail does.
• A file mounted into RUN is cached by its mode too, so a chmod on it reruns the step.

Full Changelog: v0.5.1...v0.5.2

jailer 0.5.1

Tarballs for FreeBSD amd64 and aarch64, built on FreeBSD 15.1 and needing its libc, so for 15.1 and later; on 15.0, build from source or the port in ports/sysutils/jailer.

t=jailer-0.5.1-freebsd15-$(uname -p)
fetch https://github.com/grepjava/jailer/releases/download/v0.5.1/$t.tar.gz
tar xzf $t.tar.gz
install -s $t/bin/jailer /usr/local/bin/
install -m 444 $t/man/man1/jailer.1 /usr/local/share/man/man1/

Fixes

• Links in COPY and RUN --mount=type=bind stay inside the root. A build runs as root on the host, and links on the way to a copy's source or destination were followed as the host sees them: a base image with a link to /etc could have a COPY write into the host's /etc, and COPY --from=<image> could read the host's files. Links are now followed as in a jail on that root: an absolute link starts from the image's (or the context's) root, and .. stops there. Cached layers and ADD archives were not affected; bsdtar already refuses to extract through links. Upgrade if you build from images you do not control.
• build pulls a base image or a COPY --from image with its own registry's credentials; before, it used those saved for Docker Hub, so a private image on another registry did not pull.
• ENV and LABEL keep quotes inside a quoted value: ENV A="\"x\"" sets "x".
• init takes the app name from [package] in Cargo.toml only.

Full Changelog: v0.5.0...v0.5.1

jailer 0.5.0

Tarballs for FreeBSD amd64 and aarch64, built on FreeBSD 15.1 and needing its libc, so for 15.1 and later; on 15.0, build from source or the port in ports/sysutils/jailer.

t=jailer-0.5.0-freebsd15-$(uname -p)
fetch https://github.com/grepjava/jailer/releases/download/v0.5.0/$t.tar.gz
tar xzf $t.tar.gz
install -s $t/bin/jailer /usr/local/bin/
install -m 444 $t/man/man1/jailer.1 /usr/local/share/man/man1/

Changes

• Pods move to 10.77.0.0/16. 10.88.0.0/16 is Podman's default network, and with both on one host, pods' traffic went to Podman's bridge. run --vnet now also refuses to start while another interface routes jailer's subnet. The bridge jailer0 takes its new address on the next --vnet run.
• login checks credentials with the registry before saving them, as docker login does, and takes the password on standard input with --password-stdin.
• Legion v0.1.7: a gzip and a zstd build of one Containerfile are two images, each with its own layers.
• build and export name the image as it was asked for; before, a second tag of the same image could be printed or written into the archive's RepoTags.
• JAILER_NO_ZFS takes 1 and yes as well as true.
• Checked: podman load takes export's archives, and a multi-architecture index pushed with manifest push --sign-key to GHCR verifies and pulls on both amd64 and arm64.

Full Changelog: v0.4.0...v0.5.0

jailer 0.4.0

Tarballs for FreeBSD amd64 and aarch64. They are built on FreeBSD 15.1 and need its libc (symbol version FBSD_1.9), so they run on 15.1 and later; on 15.0, build from source or the port in ports/sysutils/jailer.

t=jailer-0.4.0-freebsd15-$(uname -p)
fetch https://github.com/grepjava/jailer/releases/download/v0.4.0/$t.tar.gz
tar xzf $t.tar.gz
install -s $t/bin/jailer /usr/local/bin/
install -m 444 $t/man/man1/jailer.1 /usr/local/share/man/man1/

Full Changelog: v0.3.0...v0.4.0

jailer 0.3.0

Full Changelog: v0.2.0...v0.3.0

jailer 0.2.0

Full Changelog: v0.1.0...v0.2.0

jailer 0.1.0

Full Changelog: https://github.com/grepjava/jailer/commits/v0.1.0