v0.9.0

What's Changed

• python: add prompt guard with pipeline integration by @congwang-mk in #262
• image: pull OCI images without a Docker daemon by @congwang-mk in #266
• sdk: pull container images from Go and Python by @congwang-mk in #267
• fix(tls): generate MITM certificates accepted by strict X509 clients by @jamesboyzj-design in #264
• Read-only mounts in the SDKs; profiles parsed by the core by @congwang-mk in #268
• procfs: stat through a task's root or cwd link by @congwang-mk in #269
• checkpoint: embed the restore stub instead of exec'ing its build path by @congwang-mk in #270
• release: build .deb and .rpm packages by @congwang-mk in #271
• Fail closed on an unknown BranchAction by @congwang-mk in #272
• Let the core own the size and timestamp grammar; bindings forward text by @congwang-mk in #276
• procfs: return EINVAL from readlink on non-symlinks by @AlbertSanoe in #280
• Make HTTP support optional at compile time by @congwang-mk in #281
• seccomp: authorize prepared network operations before executing them by @congwang-mk in #283
• docs: compile-check examples instead of ignoring them by @congwang-mk in #285
• seccomp: reject x32 syscalls before evaluating policy rules by @congwang-mk in #284
• core: make checkpoint, image, profiles and COW optional by @congwang-mk in #297

New Contributors

• @jamesboyzj-design made their first contribution in #264
• @AlbertSanoe made their first contribution in #280

Full Changelog: v0.8.9...v0.9.0