v0.3.1

Images

• The node_modules layer no longer has a dir twice: a package with nested dependencies (node_modules/debug/node_modules/ms, @mastra/core, @types/pg in a bun app) was written as its own dir and again as the ancestor of the nested one. docker load and the containerd image store accept that, but docker pull on overlay2 fails with duplicates of file paths not supported.
• bun packages marked bundled (shipped inside their parent's tarball, like napi-wasm in @parcel/watcher-wasm) are no longer extracted a second time: every one of their files was in the layer twice. The new layer check caught it in Railpack's node-tanstack-start.
• A package tarball that names a file twice (package/./dist/cjs/index.js and package/dist/cjs/index.js in @rollup/plugin-alias 5.1.1, a dependency of nitropack) puts it once in the layer, with the contents of the last entry, as extracting it would.
• Every layer is checked while it is written: a path that appears twice (file, dir or link) fails the build with exit 70 instead of producing an image overlay2 refuses. Layers cached by 0.3.0 are not reused (the layer cache is keyed by the release).

Security

• rustls 0.23.46 (RUSTSEC-2026-0346, RUSTSEC-2026-0347 and the Brotli certificate decompression advisory against 0.23.45).

Tests

• The e2e checks every layer of every image (base layers too) for duplicate paths, the check docker pull makes on overlay2, since the local Docker uses the containerd image store. tests/suites/layers builds a bun and an npm app with a nested dependency.

v0.3.0

Builds

• Workspace members get the devDependencies of the members they depend on at build time (bun installed only their dependencies: a tsconfig extends of a devDependency member failed in Vite and Astro). The runtime image still gets only dependencies.
• yarn berry workspace members keep the root node_modules (or the PnP files) in the image; they were left out and the app could not import its workspace dependencies.
• A node toolchain that a plan asking for fewer parts installed first (yarn berry only takes the headers) no longer serves a plan that needs npm: install scripts failed with node-gyp: not found on a shared --home.
• The reused node_modules of an app cache and the cached node_modules layers are keyed by the Acropolis release too: a newer install plan does not reuse what an older release built from the same lockfile.
• Without a lockfile, glibc images no longer get the musl builds of native packages (@next/swc-linux-x64-musl, @img/sharp-libvips-linuxmusl-x64): the registry's abbreviated metadata has no libc, so the package name decides, as it already did with a lockfile.
• Without a lockfile, the package.json files take the lockfile's place in the step hashes: two such apps on one --home (or one app after changing its dependencies) reused each other's cached node_modules layer, and ran with the wrong packages.

Output

• info.json has watchPaths: the repo paths, relative to the workspace root, whose changes can change the image (the member, the workspace members it depends on, devDependencies included, and the root's lockfile, package.json and install/toolchain files). ["."] when Acropolis cannot narrow it down.

Tests

• New suites: workspace members with a devDependency member (bun, pnpm, npm, yarn 1 and berry), the Next.js deploy tests (NEXT_TEST_MODE=deploy, Next 15.5.27 and 16.4.0), TechEmpower FrameworkBenchmarks without their Dockerfiles, and the Heroku getting-started apps and Paketo samples. e2e cases can build a subdirectory (directory) and run several HTTP checks against one container.

Security

• YAML (pnpm-lock.yaml, pnpm-workspace.yaml, package.yaml) is parsed with serde_norway instead of serde_yaml, whose unsafe-libyaml is unmaintained (RUSTSEC-2024-0449).

v0.2.1

Packaging

• Builder image ~30 % smaller to pull (573 → ~400 MB compressed for amd64): the toolchain archives that acropolis prewarm leaves in the store are removed; builds only use the extracted toolchains.

v0.2.0

Security

• Build steps run under a seccomp filter (no new namespaces, mounts, ptrace, keyring or BPF), image steps use pivot_root, and host steps see the filesystem read-only except their work dir, their app cache, /tmp and /var/tmp.
• Redirects to private hosts and https→http downgrades are refused; archive unpacking is capped (32 GiB per archive, 1 GiB per npm package).
• The store detects blobs truncated by a machine crash.

Builds

• Provider precedence matches Railpack (Go, Rust, Python, Java, ... win over a package.json).
• Rust: an unpinned toolchain is raised to the highest rust-version of the locked crates; sqlx apps build on the host instead of inside the rust image.
• Node: pinned versions of built servers run on distroless/cc with the build toolchain's node (olimpia-cloud's web image: 84.5 → 57.1 MB).
• pnpm 10 build-script rules, bun workspace member dependencies, yarn 2.x checksums, single-copy node_modules layers.
• --info includes errorClass and exitCode; non-UTF-8 file names fail early with exit 78.

Packaging

• Release binary 25 MB (ring instead of aws-lc, codegen-units = 1); multi-arch builder image (amd64 and arm64).
• Docs in English.

v0.1.0

Primera versión pública. Detalle en CHANGELOG.md; integración en un PaaS en deploy/builder.