v0.2.4

What's Changed

• Fix supervisor backoff, ephemeral parsing, tailscaled stop and output, readiness leak by Moritz Mazetti (@Radiergummi) in #84
• Repair isolation chains atomically; restore forwarding and MASQUERADE by Moritz Mazetti (@Radiergummi) in #85
• Bound the event loop's Docker calls; list networks once per watchdog scan by Moritz Mazetti (@Radiergummi) in #86
• Stop endpoints concurrently; cancellable start path; drain without waiting for serve by Moritz Mazetti (@Radiergummi) in #87
• Configure the container's veth through one netlink handle; safe netns switching by Moritz Mazetti (@Radiergummi) in #88
• One iptables-save per table; port-map cache; conntrack flushed once outside the lock by Moritz Mazetti (@Radiergummi) in #90
• Release v0.2.4 by Moritz Mazetti (@Radiergummi) in #91

Full Changelog: v0.2.3...v0.2.4

Security guarantees

The guarantees published in SECURITY.md and the tests that guard them on this commit. CI, the end-to-end test with its probes and the weekly fuzz run (2026-10-12) passed. The red-team run of docs/releasing.md step 3 is still to follow; the last one ran on e0061b2.

G1: pkg/docker/driver_test.go:788 pkg/docker/isolation_test.go:48 pkg/docker/isolation_test.go:76 pkg/netutil/bypass_test.go:12 pkg/netutil/container_test.go:55 pkg/netutil/isolate_test.go:91 pkg/netutil/isolate_test.go:178 pkg/netutil/isolate_traffic_test.go:256 pkg/netutil/procs_test.go:212 pkg/netutil/repair_traffic_test.go:132 pkg/netutil/tailnet_test.go:83 test/integration/run.sh:382 test/integration/run.sh:384 test/integration/run.sh:386 test/integration/run.sh:388 test/integration/run.sh:391
G2: pkg/netutil/isolate_test.go:205 pkg/netutil/isolate_traffic_test.go:179 pkg/netutil/isolate_traffic_test.go:211 pkg/netutil/procs_test.go:212 pkg/netutil/repair_traffic_test.go:132 test/integration/run.sh:459 test/integration/run.sh:460 test/integration/run.sh:463
G4: pkg/core/config_test.go:138 pkg/core/network_test.go:309 pkg/core/network_test.go:354 pkg/core/statedir_fuzz_test.go:86 pkg/core/statedir_fuzz_test.go:107
G5: pkg/docker/credentials_test.go:40 pkg/tailscale/authkey_test.go:144 pkg/tailscale/authkey_test.go:163 pkg/tailscale/logout_test.go:262 pkg/tailscale/resolver_test.go:264 pkg/tailscale/up_test.go:67 pkg/tailscale/up_test.go:111 pkg/tailscale/up_test.go:138 test/integration/run.sh:586 test/integration/run.sh:587 test/integration/run.sh:588 test/integration/run.sh:589