v0.28.0

Ofelia v0.28.0 — the first release since v0.27.1 (2026-07-27). Ofelia now talks to Docker through the maintained moby/moby SDK instead of the frozen docker/docker module, which clears every outstanding vulnerability finding in this codebase. Upgrading requires Docker Engine 19.03 or newer. See the full changelog for the complete entry.

🛡️ Security

• govulncheck now reports zero findings, down from four. The Docker SDK moved from the frozen github.com/docker/docker v28.5.2+incompatible to the maintained split modules github.com/moby/moby/client and github.com/moby/moby/api. The four moby advisories — GO-2026-5668 and GO-2026-5617 (docker cp race conditions), GO-2026-4887 (AuthZ plugin bypass) and GO-2026-4883 (plugin-privilege off-by-one) — had no fix on the old import path, because upstream ended releases there. Leaving that path was the only remedy. All four were reachable only through init() chains and were assessed as not exploitable in Ofelia's deployment shape, which is why this waited until docker/cli completed its own move and made the migration clean. Closes #667.

🔄 Changed

• Docker Engine 19.03 or newer (API v1.40+) is now required. The new client enforces a minimum API version and refuses to negotiate below it; the previous client had no floor and clamped to whatever the daemon reported. Ofelia never documented a minimum before, and several features already needed v1.42 (Engine 20.10, 2020-12) in practice, so only daemons older than 2019 are affected.
• An invalid API version now fails at startup instead of later. DOCKER_API_VERSION and [docker] version are validated when the client is built, so a typo reports invalid API version (…) immediately rather than surfacing as a confusing request failure. A leading v (v1.44) is now accepted, where it previously produced an unusable value.
• Network.Containers is no longer filled in when listing networks. The Docker list endpoint does not return per-network endpoints, and the new API types reflect that. Inspecting a single network still returns them. No Ofelia feature reads the field from list results.

Upgrade notes

Nothing to change in your configuration. If you run a Docker Engine older than 19.03, stay on v0.27.1 until you can upgrade the daemon.

The SDK rewrote every client call, so the migration was audited for behavior drift rather than assumed equivalent — including a review pass dedicated to changes that compile and pass tests while still behaving differently. Two such cases were found and corrected before release, so job-exec jobs using console-height / console-width and daemons with a pinned API version behave exactly as they did in v0.27.1.

Container image

ghcr.io/netresearch/ofelia:0.28.0
ghcr.io/netresearch/ofelia:0.28
ghcr.io/netresearch/ofelia:0

Verify your download

Per-asset signatures are bundled. Verify any single file:

cosign verify-blob \
  --bundle ofelia-linux-amd64.sigstore.json \
  --certificate-identity-regexp "^https://github\.com/netresearch/\.github/\.github/workflows/release-go-app\.yml@" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  ofelia-linux-amd64

Verify checksums against the signed manifest:

cosign verify-blob \
  --bundle checksums.txt.sigstore.json \
  --certificate-identity-regexp "^https://github\.com/netresearch/\.github/\.github/workflows/release-go-app\.yml@" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  checksums.txt
sha256sum -c checksums.txt --ignore-missing

Verify build provenance. Releases are built by a reusable
workflow, so the signing identity is that workflow rather than
this repository -- --signer-workflow is required and
verification fails without it:

gh attestation verify <artifact> \
  --repo netresearch/ofelia \
  --signer-workflow netresearch/.github/.github/workflows/release-go-app.yml

Verify container image:

cosign verify ghcr.io/netresearch/ofelia:0.28.0 \
  --certificate-identity-regexp "^https://github\.com/netresearch/\.github/\.github/workflows/release-go-app\.yml@" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com"
gh attestation verify oci://ghcr.io/netresearch/ofelia:0.28.0 \
  --repo netresearch/ofelia \
  --signer-workflow netresearch/.github/.github/workflows/release-go-app.yml

👥 Contributors

Thanks to everyone who made this release — code and reports alike:

• Code: @CybotTM