v0.20.0

Added

• Under a memory limit (a pod's or a container's, or a systemd slice's), --scratch-mb max, or scratch_mb = "max" in a manifest, gives the guest what the limit leaves once hluk has 64 MiB for itself, with a note, so a pod that runs hluk run in its image names the size once, as its limit; a manifest's max falls back to the tested size where there is no limit, with a note, as hluk build does. The limit is read from the memory cgroup (v2 or v1), the tightest in sight. Every other size stands as before, with a note when the limit cannot hold it, or holds the guest but may not hold the snapshot a --warm run or hluk snapshot save will take. A snapshot records its guest's size (snapshot_scratch_mb), and hluk snapshot run says when the limit cannot hold it. Zero is refused as a size. The library has cgroup_memory_limit_mb, scratch_mb_within and CONTAINER_SCRATCH_HEADROOM_MB; a SandboxBuilder is sized as before.
• The library exports cpio::from_tar behind the default cpio feature: the pure-Rust tar-to-newc converter hluk build uses, so embedders can build an initrd without a host cpio. It writes its own etc/hosts, etc/nsswitch.conf and etc/resolv.conf over the tar's.
• openai-agents-hyperlight (integrations/openai-agents/): a sandbox provider for the OpenAI Agents SDK, built to the SDK's provider guide, that runs each shell command of a sandbox agent in a fresh micro-VM through hluk run, from a warm snapshot (SandboxRunConfig(client=HyperlightSandboxClient())). The workspace is a host directory shared into each guest at its own path, so the SDK's file operations, snapshots and resume work as for its local backend; the guest sees nothing else of the host but directory grants, and has no network unless hosts are allowed (net_allow). PTY sessions, exposed ports, sandbox users, manifest mounts and Git repository entries are refused. Linux only, with hluk v0.19.0 or later and openai-agents 0.24. Published to PyPI on its own version by pypi-publish.yml; CI tests it on Linux with each commit's hluk and agent image, in micro-VMs and through the SDK's Runner.

Changed

• Snapshots saved by v0.19.1 and earlier releases are refused (the kernel changed); save them again.

Fixed

• Memory the guest kernel allocated for itself was not given back: a deleted file's memory (a 200 MB file kept about 635 MiB), a process's signal descriptors and the ELF loader's record of every exec, and an exited thread's or process's stacks until the guest went idle (3000 commands run back to back ran a 256 MiB guest out of memory, and CPython's test_gc crashed it, #157). The kernel now gives them back, and when the guest runs out of memory the command that ran out fails, or is killed (exit 137), instead of the guest's kernel crashing: the kernel keeps the last 1 MiB for itself, so a program is killed once less than that is free. A program killing a child that held the guest's memory (kill -9) could not, and waited for it for good. Warm snapshots are about 3% larger, as the kernel's buffers are now backed when allocated.
• A write or truncate in the guest's in-memory filesystem that could not get memory failed with EIO, and a create, mkdir() or rename() with ENOMEM; they now fail with ENOSPC, as on a full tmpfs. A symlink made then had no target, and reading it crashed the guest.
• Releasing a reference to a file other than its last could drop it from the epoll sets watching it, and an epoll instance could be added to itself, which crashed the guest when it was closed (now EINVAL, as on Linux).
• Memory a program mapped with mmap() stayed mapped after its process ended, so a guest that ran child processes again and again (Azure CLI running Bicep) ran out of memory. The kernel now unmaps what a process mapped when it exits, is killed or execs; memory shared with CLONE_VM stays until the last process sharing it ends. In the java image, a JVM started after System.exit() gets the heap the first had, and restarts are no longer refused once the old JVMs' memory runs out.
• munmap() and mprotect() of a range that began in a 2 MiB block with nothing mapped yet missed pages past the block's end: they stayed mapped, with their memory, which a mapping made there later read, or kept their protection.
• mremap() failed with ENOSYS, so musl took the main thread's stack for a single page (pthread_getattr_np()), and .NET's EnsureSufficientExecutionStack failed. A mapping now shrinks, or grows into free space after it, in place; MREMAP_MAYMOVE resizes in place too and fails with ENOMEM where only a move would do, and realloc() then copies.
• Static programs linked against a glibc built for x86-64-v3, as Ubuntu 26.04's is, died with SIGILL before main(): the guest never turned AVX on, and that glibc uses AVX2 without checking. The kernel now enables AVX the first time a program uses it, and AVX-512 the first time one uses that, and turns them back on after restoring a snapshot taken since. Until then CPUID reports OSXSAVE clear, so programs that check for AVX properly keep to SSE: with AVX on, every VM exit costs more on nested AMD hosts (agent cold-snap ~33 → ~48 ms on GitHub's runners). Restoring a snapshot taken before turns AVX off again.

Pull requests

• CI tiers: path-filtered x86 on every PR, macOS/Windows arm64 on ci/arm64, Linux arm64 nightly by @danbugs in #191
• justfile: a module the conformance skip list names is always skipped by @danbugs in #192
• Reseed userspace RNGs after snapshot restore, plus kernel fixes by @danbugs in #195
• Add a PHP runtime (tier 2) by @danbugs in #197
• Add a PHP RCE containment demo by @danbugs in #199
• Release v0.19.1 by @danbugs in #201
• Clear the arm64 nightly failures from v0.19.1 by @danbugs in #208
• Release a process's memory when it ends, and support mremap() by @danbugs in #209
• integrations/openai-agents: a Hyperlight sandbox provider for the OpenAI Agents SDK by @danbugs in #210
• build(deps): bump rust-toolchain from 1.99.0 to 1.99.1 by @dependabot[bot] in #212
• build(deps): bump the wasmtime group across 1 directory with 2 updates by @dependabot[bot] in #213
• build(deps): bump the images group across 3 directories with 1 update by @dependabot[bot] in #214
• build(deps): bump the actions group across 1 directory with 2 updates by @dependabot[bot] in #216
• build(deps): bump libc from 0.2.190 to 0.2.191 in the cargo group across 1 directory by @dependabot[bot] in #215
• feat(cpio): expose tar converter from library by @jsturtevant in #219
• kernel: give guest memory back, and fail commands instead of the guest when it runs out by @danbugs in #222
• integrations/openai-agents: give micro-VM starts room on the arm64 runner by @danbugs in #223
• Size the guest by the memory limit hluk runs under with --scratch-mb max by @danbugs in #224
• Release v0.20.0 by @danbugs in #225

Full Changelog: verl-hyperlight-v0.1.0...v0.20.0