Immutable
release. Only release title and notes can be modified.
Security
- The isolated public process now accepts the image's no-dump marker and preload only as an exact, atomic runtime-owned pair tied to its current PID. Partial, altered, or operator-injected loader configuration still fails closed without logging the supplied values.
- Dedicated and shared VPS audits now reject application containers whose sealed no-dump entrypoint or command was overridden.
Fixed
- The split landing/docs container now starts correctly through the production image entrypoint. Release verification runs the real public process and health check on both amd64 and arm64 so this container/runtime mismatch cannot ship again.
Imagem OCI multiarch por digest: ghcr.io/resolvicomai/kassinao@sha256:7ef7e03803bb4eb4f5daf5f8c78683edaeeb242e00a7d3de12dcf5be5b064333.
O kit operacional não contém checkout Git, código-fonte da aplicação nem credenciais; ele contém controles operacionais públicos selados, templates sem segredos e runtimes nativos. Verifique checksum e attestations antes do deploy. A imagem final passou pelo gate Trivy atual em amd64 e arm64.