v0.3.4

What's Changed

• Never narrow the host's tailnet isolation at start; release v0.3.4 by Moritz Mazetti (@Radiergummi) in #129

Full Changelog: v0.3.3...v0.3.4

Fixed

• A start without the saved list of Docker's bridges, as the first after an
  upgrade from v0.3.2 or earlier, keeps the bridges the host's tailnet
  isolation already covers. Before, it covered only Docker's default
  interface names until Docker listed its bridges, so containers on a bridge
  with its own name could reach the host's tailnet for that time.
• The list of Docker's bridges is synced to disk when saved, so it survives
  a host crash, and saved again at the next listing if saving it failed.
• While Docker cannot list its bridges at start, the plugin no longer
  reapplies its isolation and warns every second: it warns once, and
  applies the list once Docker answers. With TSLINK_ISOLATE_HOST_TAILNET
  off, it does not list them at all.

Release checks

On 7cb5042 (docs/releasing.md): CI green (34 checks); weekly fuzz run within 7 days (2026-10-12); red team on a fresh testbed (Docker 29.9.1, kernel 6.8) passed; test/security/report.sh reports nothing missing. No guarantee is marked Manual:.

Guarantees and their tests

• G1: pkg/docker/driver_test.go:792 pkg/docker/isolation_test.go:50 pkg/docker/isolation_test.go:78 pkg/docker/isolation_test.go:124 pkg/docker/isolation_test.go:157 pkg/docker/isolation_test.go:201 pkg/netutil/bypass_test.go:12 pkg/netutil/container_test.go:56 pkg/netutil/hoststate_test.go:59 pkg/netutil/isolate_test.go:91 pkg/netutil/isolate_test.go:179 pkg/netutil/isolate_test.go:198 pkg/netutil/isolate_traffic_test.go:256 pkg/netutil/procs_test.go:212 pkg/netutil/repair_traffic_test.go:132 pkg/netutil/tailnet_test.go:83 test/integration/run.sh:382 test/integration/run.sh:384 test/integration/run.sh:386 test/integration/run.sh:388 test/integration/run.sh:391
• G2: pkg/netutil/isolate_test.go:225 pkg/netutil/isolate_traffic_test.go:179 pkg/netutil/isolate_traffic_test.go:211 pkg/netutil/procs_test.go:212 pkg/netutil/repair_traffic_test.go:132 test/integration/run.sh:461 test/integration/run.sh:462 test/integration/run.sh:465
• G4: pkg/core/config_test.go:143 pkg/core/network_test.go:309 pkg/core/network_test.go:354 pkg/core/statedir_fuzz_test.go:86 pkg/core/statedir_fuzz_test.go:107
• G5: pkg/docker/credentials_test.go:41 pkg/tailscale/authkey_test.go:144 pkg/tailscale/authkey_test.go:163 pkg/tailscale/logout_test.go:262 pkg/tailscale/resolver_test.go:264 pkg/tailscale/up_test.go:66 pkg/tailscale/up_test.go:107 pkg/tailscale/up_test.go:131 test/integration/run.sh:588 test/integration/run.sh:589 test/integration/run.sh:590 test/integration/run.sh:591