v0.8.8

What's Changed

• cow: leave kernel objects to the kernel by @congwang-mk in #210
• seccomp: intercept fchmodat2 by @congwang-mk in #211
• Fix thread-id misuse in the execve freeze and per-pid network overrides by @congwang-mk in #213
• fix(learn): agent workload bug fixes by @ghazariann in #209
• learn: follow-ups from the #209 review by @congwang-mk in #220
• deps: move to rustls 0.23 by @congwang-mk in #216
• Defer the COW branch decision past process exit by @congwang-mk in #219
• Describe a change by what the run saw on both sides by @congwang-mk in #221
• resource: make max_memory usable for Go and close reservation bypasses by @congwang-mk in #222
• tests: make the named socket and restore tests self-contained by @congwang-mk in #223
• core: build and run on musl targets by @congwang-mk in #224
• python: judge the CPU throttle by duty cycle instead of wall-clock ratio by @congwang-mk in #226
• seccomp: enforce the TCP bind allowlist on the on-behalf bind path by @congwang-mk in #227

Full Changelog: v0.8.7...v0.8.8