v0.9.4

What's Changed

• Compose build:, registry logins, rootless networking, safer pulls by @zrougamed in #11
• Installers and services for systemd, OpenRC, runit, SysV and Windows by @zrougamed in #12
• macOS: nyx machine runs nyxd in a vfkit VM by @zrougamed in #13
• nyx run: Ctrl+C after the container exited is quiet again by @zrougamed in #16
• Package repositories at pkgs.nyxd.io: apt, dnf/yum, zypper, apk, pacman by @zrougamed in #17

Full Changelog: v0.9.3...v0.9.4

v0.9.3

What's Changed

• feature/docusaurus-site by @SvenNellerz in #1
• Extract and create OCI layers in-process by @mdarguechi in #4
• Feat/rootless by @mdarguechi in #5
• Feat/build by @mdarguechi in #6
• Feat/windows by @mdarguechi in #7
• Windows release: CI artifacts, WSL harness, docs by @mdarguechi in #8
• Test coverage to 92% with a CI gate; fixes found along the way by @zrougamed in #9
• Release packaging: signed deb, rpm, apk, Arch, macOS and Windows builds by @zrougamed in #10

New Contributors

• @SvenNellerz made their first contribution in #1
• @mdarguechi made their first contribution in #4
• @zrougamed made their first contribution in #9

Full Changelog: v0.9.2...v0.9.3

v0.9.2

Summary

This release focuses on real-world networking (DNS, egress, compose “internal” semantics), more reliable compose and container lifecycle, stronger defaults around Linux isolation (cgroup v2 awareness, seccomp, capabilities), and better nyx UX (exec/TTY, errors, compose feedback).

Networking & DNS

• Embedded resolver can answer local names and forward other queries to the host’s resolvers (reads systemd/standard resolv.conf, with a public-DNS fallback when nothing usable is found).
• Native bridge: fixes container internet egress (proper SNAT / masquerade for traffic leaving the host, plus ip_forward where applicable).
• Compose networks.*.internal: true is now enforced on the native driver with nftables (IPv4 traffic to destinations outside the bridge CIDR is dropped; east–west on the bridge still works, including DNS to the bridge gateway).
• network.Backend.Setup accepts optional SetupOptions (e.g. Internal); the CNI path accepts the API but does not yet wire internal policy—configure CNI separately if you use -net-driver cni.

Compose & supervisor

• nyx compose up / POST /v1/compose/up reconciles like Compose: unchanged services stay up, changed specs are recreated (stable comparison over workload-relevant fields).
• Stale crun OCI state (daemon restarted, supervisor empty, but ID still exists in crun) is removed before crun run, avoiding “already exists” while nyx ps is empty.
• Deploy resources from compose deploy.resources are mapped into OCI cgroup limits where supported.
• Compose discovery and internal-network helpers expanded (incl. tests).

Runtime, bundle & isolation

• Cgroup v2 preflight / compatibility checks (Linux).
• Seccomp: stricter handling and profile wiring in the bundle path (with tests).
• Default capability set includes CAP_NET_RAW so common tools (e.g. BusyBox ping) behave as users expect in minimal containers .

Control API & resolution

• Exec requests can carry rows / cols for TTY sizing (OpenAPI + implementation).
• Container ID resolution improvements (“ID conformity” / display helpers) for CLI and API ergonomics.

nyx CLI

• Exec: PTY size from the real terminal, stream handling fixes , cleaner error output for exec failures.
• Compose: clearer progress / spinner messaging for up/stop/down; usage tweaks .
• Errors: more humanized messages in places.

Documentation

• USAGE, networking, and OpenAPI updated for the above.

Upgrade notes

• Rebuild / redeploy both nyxd and nyx; restart workloads if you rely on embedded DNS or native bridge rules so nft / resolver behavior is applied.
• After changing internal: or other workload-shaping fields, nyx compose up may recreate affected containers by design.
• Internal-only networks (native) block IPv4 egress outside the bridge CIDR; IPv6 egress is not filtered by the new rule set—treat that as a known limitation if you use IPv6.

Full Changelog: v0.9.1...v0.9.2

v0.9.1

nyxd v0.9.1

Minor release focused on Compose stacks, health-driven supervision, pull/auth/networking fixes, and docs/OpenAPI alignment.

Compose (nyx compose + HTTP API)

• nyx compose up|stop|down with -f / --file, --project, and down -v to remove declared named volume directories when nothing still mounts them.
• POST /v1/compose/up|stop|down — same behavior over the Unix socket; request body can use file (path on the daemon host) or yaml + context_dir.
• Compose pipeline: .env merge, ${VAR} / ${VAR:-default} / $$ substitution, depends_on topological start order (list or map form; map keys set order only), volumes → OCI bind mounts and {base-dir}/volumes/<project>/<name>/ for declared named volumes, per-service registry_username / registry_password for pulls.

Supervisor & health

• StartSequential so stacks start in dependency order; each service can wait for readiness before the next starts.
• health.WaitReady after crun run when a healthcheck is configured; background health.Checker continues probing.
• Unhealthy → restart: sustained failures trigger KillForRestart when the restart policy allows (e.g. not never).
• Re-adopted containers from disk restart the health monitor.
• ContainerSpec.ExtraMounts merged into generated bundles; IsBindSourceInUse guards volume dir deletion on compose down -v.

Image store & pulls

• Optional registry credentials on nyx pull (--username / --password) and on POST /v1/images/pull / POST /v1/containers/run / compose services.
• nyxd -pull-platform (e.g. linux/arm64) for multi-arch manifest indexes instead of a fixed platform.
• Resumable layer downloads via .partial files and HTTP Range when the registry supports it.
• Blob garbage collection after image remove / prune paths that drop references.

Native networking

• NYXD_CONTAINER_SUBNET and NYXD_GATEWAY_IP override the bridge + IPAM (real prefix length; gateway excluded from allocation).
• Port map teardown: nftables rules tagged per container are deleted on remove

Overlay

• Per-digest extraction cache under _cache/<sha256>/ shared across images; concurrent extraction serialized per digest.
• Safer whiteout handling (WalkDir, no symlink follow when scanning).

CLI & packaging

• Clearer nyx --help layout; friendlier error when no command is given.
• internal/runtime: documents crun-only use; Runtime.Binary() / RootDir() for health/exec wiring.
• Daemon entry consolidated under cmd/nyxd (legacy nyxd/main.go removed — update scripts that referenced the old path).

Docs

• docs/USAGE.md: compose workflow, private pull example, curl samples for compose endpoints.
• docs/openapi.yaml: compose routes and schemas; pull/run healthcheck and registry fields.
• docs/ROADMAP.md: brought in line with shipped behavior; expanded future sections (eBPF, gaps, hardening).
• README.md: compose package description updated.

---

Upgrade notes

• Rebuild/install nyxd and nyx together.
• no breaking changes

Full Changelog: v0.9.0...v0.9.1

Full Changelog: v0.9.0...v0.9.1

nyxd v0.9.0

nyxd is a minimal OCI container orchestrator for Linux: crun plus a small control plane — no Docker, Podman, or containerd. This release is aimed at early adopters who want a lightweight way to run containers on edge hosts, home labs, and small VPSes (including arm64 targets such as Raspberry Pi).

Highlights

• OCI images pulled over plain HTTP with digest verification (no heavyweight registry SDK in the hot path).
• overlayfs-based root filesystem assembly with atomic, safe writes to disk.
• Networking: in-process native bridge + veth + NAT by default; optional CNI driver when plugins are installed.
• Supervisor with restart policy, graceful daemon shutdown, and lightweight JSON persistence so supervised workloads can be reconciled after restarts and unclean stops (when metadata and crun state line up).
• HTTP control API over a Unix socket, documented in OpenAPI (docs/openapi.yaml).
• nyx CLI for day-to-day operations aligned with a small subset of familiar Docker-style commands.

Features (user-facing)

Area	What you get in v0.9.0
Runtime	OCI bundles and crun integration with hardened paths, state, and error handling.
Images	Pull, local store, listing; clearer registry/pull errors at the API and CLI.
Containers	Run, stop, remove; ps-style listing; port publish wiring through the run spec and bundle.
Logs	Stream logs over HTTP with tail/follow; nyx logs follow behavior improved at the edges.
Exec	Control-plane exec with streaming; full-duplex HTTP/1 for stdin with stdout; runtime fixes so interactive nyx exec -i does not hang; better surfacing of stream failures.
Compose	Parser for nyx-compose.yaml (see docs for compose and lifecycle flows).
Health	Exec / HTTP / TCP health checks (as described in the architecture overview).
Ops	Preflight checks on startup (crun, paths, optional capabilities); install/socket documentation and systemd-friendly layout.
Build	Standard Go module layout; Makefile targets for local and cross builds (e.g. static amd64, Linux arm64).
Platforms	Linux on amd64 and arm64 (and similar) where crun and kernel features used by overlay/native networking are available. Non-Linux: development-oriented stubs exist so the tree can build; the supported runtime target remains Linux.
Documentation	docs/README.md — index (install, usage, networking, OpenAPI, QEMU Alpine, kernel notes, roadmap). docs/networking.md — native vs CNI and client/daemon responsibilities.

License

Licensed under the PolyForm Noncommercial License 1.0.0 — see LICENSE in the repository for terms and commercial-use restrictions.

Install / Binaries

Follow docs/INSTALL.md. CI/Release workflows in this repo are set up to attach nyxd and nyx binaries for linux/amd64 and linux/arm64 (plus checksum sidecars) when you push a v* tag.

Full Changelog: https://github.com/zrougamed/nyxd/commits/v0.9.0

Full Changelog: https://github.com/zrougamed/nyxd/commits/v0.9.0