Skip to content

v0.12.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 29 Aug 07:36
· 149 commits to master since this release
v0.12.1
2ce877b
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

This release improves Linux agent filesystem enforcement and runtime diagnostics.

Highlights

  • Added bubblewrap as a fallback filesystem-enforcement backend when systemd-run --user is unavailable.
  • Preserved systemd-run --user as the preferred Linux backend.
  • Added fail-closed behavior when neither backend is available or usable.
  • Improved filesystem backend reporting in:
    • agent validate
    • agent doctor
    • agent explain
  • Preserved existing deny_read and deny_write semantics.
  • Fixed Linux systemd probing and CI compatibility.
  • Added and improved backend-selection and bubblewrap mapping tests.
  • Updated Linux filesystem-enforcement documentation.

Linux backend order

systemd-run --user → bubblewrap → fail closed

Bubblewrap requires a working installation and usable unprivileged user/mount namespaces. Network sandboxing with --sandbox continues to require a working systemd user session.

Existing file descriptors and data already loaded into process memory remain outside filesystem enforcement.

Assets 6
Loading