OwnTransit 0.1.6 — Podman and orphan-container fixes (signed patch)

Signed development patch — Podman compatibility and container lifecycle

0.1.6 fixes the real Podman upgrade failures encountered in 0.1.5. Previous release assets remain immutable. This is a signed development candidate, not a stable or independently assessed release.

Fixed

• Accept Docker's entrypoint arrays and Podman 4.9's entrypoint strings without shell splitting. Normalize valid bare SHA-256 image IDs before exact running-image and rollback checks.
• Remove stopped managed containers explicitly instead of relying on engine auto-removal alone. Systemd pre/post hooks cover normal restart; upgrades and rollback also handle orphaned instances left by older units.
• Cleanup verifies the exact managed name, image, executable and state bind. It never force-removes a running container, touches unrelated containers, or deletes volumes/images. Old images can remain deliberately available for rollback.
• Preserve the exact previous unit template in the upgrade journal and recover earlier journal formats.
• Align the SSH integration test's shutdown plumbing with the production broker and bounded WebSocket adapter.

Actual checks

The patched code was exercised against an explicitly authorized real Podman 4.9.3 relay, not just Docker-shaped fixture JSON. Testing included public protocol verification, an intentionally failed cutover with restoration of the old image/unit/configuration, successful upgrade, same-version rerun and normal systemd restart. Key-file and nginx-configuration hashes were checked unchanged; the site continued returning HTTP 200. Exactly one managed running container remained, with no stopped orphan. An initial trial exposed the orphan-container defect; that was corrected and the live checks repeated before publication.

Both Go race/vet profiles, security/publication checks, Docker/Podman representation and cleanup-negative tests, both native Linux CI jobs, CodeQL and artifact checks passed. Linux AMD64 and ARM64 packages and the Apple-silicon macOS executable are included. No fresh-machine, reboot, independent security-review or new SSH-account qualification is claimed.

Upgrade the relay

Use the existing public relay URL, replacing the example:

curl -fsSL https://github.com/sentrybottale/OwnTransit/releases/download/v0.1.6/install-preview-linux.sh | sudo sh -s -- relay wss://relay.example/connects

Existing endpoint pairing and SSH keys remain unchanged. This correction is in relay installation/lifecycle code; clients and connectors already on 0.1.5 do not need re-pairing. If updating the connector package too, restart its service rather than rerunning receiver setup.