Skip to content

Rootfs 29.7.2-3

Pre-release
Pre-release

Choose a tag to compare

View all tags
@zcsizmadia zcsizmadia released this 06 Sep 03:18
rootfs-v29.7.2-3
bfa5347

Engine rootfs, packaging revision 3 of engine 29.7.2. Engine components are unchanged from 29.7.2-2 (dockerd 29.7.2, containerd 2.1.4, runc 1.3.0, buildkit 0.27.0, Alpine 3.24); this revision rebuilds the in-distro hawser-agent with the v0.2.0 security-review hardening:

  • Mutual authentication (#81) — the agent (now hawser-agent/2) proves a per-install secret in the vsock handshake, so a sibling distro cannot impersonate it while the engine is idle-stopped. Backward compatible: a host without the secret still connects.
  • fd-race fix (#84) — CloseWrite pins the fd via SyscallConn, so a concurrent close can't half-close a stranger's connection under load.
  • Hardening (#92) — a handshake read deadline and EMFILE-tolerant accept loop.

Also, the build now verifies each engine component's commit SHA and pins the Alpine base by digest (#88).

Assets (attached by the rootfs workflow): hawser-rootfs-29.7.2-3.tar.gz, its .sha256, and an SPDX SBOM. Becomes the default once the manifest PR lands.

Assets 5
Loading