v0.9.2

Summary

This release focuses on real-world networking (DNS, egress, compose “internal” semantics), more reliable compose and container lifecycle, stronger defaults around Linux isolation (cgroup v2 awareness, seccomp, capabilities), and better nyx UX (exec/TTY, errors, compose feedback).

Networking & DNS

• Embedded resolver can answer local names and forward other queries to the host’s resolvers (reads systemd/standard resolv.conf, with a public-DNS fallback when nothing usable is found).
• Native bridge: fixes container internet egress (proper SNAT / masquerade for traffic leaving the host, plus ip_forward where applicable).
• Compose networks.*.internal: true is now enforced on the native driver with nftables (IPv4 traffic to destinations outside the bridge CIDR is dropped; east–west on the bridge still works, including DNS to the bridge gateway).
• network.Backend.Setup accepts optional SetupOptions (e.g. Internal); the CNI path accepts the API but does not yet wire internal policy—configure CNI separately if you use -net-driver cni.

Compose & supervisor

• nyx compose up / POST /v1/compose/up reconciles like Compose: unchanged services stay up, changed specs are recreated (stable comparison over workload-relevant fields).
• Stale crun OCI state (daemon restarted, supervisor empty, but ID still exists in crun) is removed before crun run, avoiding “already exists” while nyx ps is empty.
• Deploy resources from compose deploy.resources are mapped into OCI cgroup limits where supported.
• Compose discovery and internal-network helpers expanded (incl. tests).

Runtime, bundle & isolation

• Cgroup v2 preflight / compatibility checks (Linux).
• Seccomp: stricter handling and profile wiring in the bundle path (with tests).
• Default capability set includes CAP_NET_RAW so common tools (e.g. BusyBox ping) behave as users expect in minimal containers .

Control API & resolution

• Exec requests can carry rows / cols for TTY sizing (OpenAPI + implementation).
• Container ID resolution improvements (“ID conformity” / display helpers) for CLI and API ergonomics.

nyx CLI

• Exec: PTY size from the real terminal, stream handling fixes , cleaner error output for exec failures.
• Compose: clearer progress / spinner messaging for up/stop/down; usage tweaks .
• Errors: more humanized messages in places.

Documentation

• USAGE, networking, and OpenAPI updated for the above.

Upgrade notes

• Rebuild / redeploy both nyxd and nyx; restart workloads if you rely on embedded DNS or native bridge rules so nft / resolver behavior is applied.
• After changing internal: or other workload-shaping fields, nyx compose up may recreate affected containers by design.
• Internal-only networks (native) block IPv4 egress outside the bridge CIDR; IPv6 egress is not filtered by the new rule set—treat that as a known limitation if you use IPv6.

Full Changelog: v0.9.1...v0.9.2