v0.1.0-rc1

What's Changed

• Durable enforcement, doctor, windowed Explain, guest UDP, and a live guest test by @zyvorai in #1
• Return [] for empty lists; fixes the live guest workflow by @zyvorai in #2
• Doctor names a VM whose tap it cannot see by @zyvorai in #3
• Update the docs for what shipped; add the alpine-quay-fix fixture (redacted) by @zyvorai in #4
• Live guest test: boot a peer and check two guests reach each other by @zyvorai in #5
• Wait for /dev/kvm to become writable (fixes the red guest run) by @zyvorai in #6
• Phase 2: what became of every TCP handshake on a VM tap, and who connects into a VM by @zyvorai in #8
• Phase 1: a drops program (what the kernel dropped on each VM tap, and whether it was Shukra) by @zyvorai in #7
• Preempt by @zyvorai in #11
• Fix drops attribution after a restart (red rig on main) and update the docs in detail by @zyvorai in #9
• Document vCPU preemption and check it in the live guest test by @zyvorai in #12
• Docs audit: doctor reference, extension checklists, and current text by @zyvorai in #13
• Console: real VM defaults, the real daemon address, and current text by @zyvorai in #14
• Events: a share of the list for each kind, so a flood of one cannot evict the others by @zyvorai in #16
• Console: paged, filterable connection tables (VM filter, search, row cap) by @zyvorai in #15
• Land #15 and #16: filterable connection tables and per-kind event shares by @zyvorai in #17
• Explain a past time from stored snapshots, and incident bundles (plan #1) by @zyvorai in #18
• Noisy-neighbour map: trace contention, a Contention page, and a noisy_neighbour finding (plan #2) by @zyvorai in #19
• Docs pass: investigate after the fact, console tests, new-view checklist and PR policy by @zyvorai in #20
• Product brochure, a regenerable social image, richer fixtures and a README refresh by @zyvorai in #22
• Right-sizing advisor: shukractl advise, /api/v1/advice and a Right-size page (plan #3) by @zyvorai in #21
• Learned baselines: what is new for a VM, with no rule to write (plan #4) by @zyvorai in #23
• Refresh the brochure for the advisor and learned baselines by @zyvorai in #24
• Name the TLS server a guest connects to, and close the open CodeQL fi… by @zyvorai in #25
• Cut the daemon's own CPU on a busy host from about 55% of a core to 5… by @zyvorai in #27
• Fix the rig's check that a dns rule does not judge a TLS name by @zyvorai in #26
• Per-VM egress policy: learn, audit, then enforce with a timer that reverts by @zyvorai in #28
• VMM tripwires: what a QEMU process should never open or call by @zyvorai in #29
• Live guest test: a real QEMU opening /etc/shadow raises the tripwire by @zyvorai in #30
• Bump the console's dev tooling to clear the Dependabot alerts by @zyvorai in #31
• Build with Go 1.27 by @zyvorai in #32
• Fix empty lists, VM-name escaping and three CLI and doctor messages by @zyvorai in #34
• Docs: every guide checked against the code, and two new tutorials by @zyvorai in #33
• Fix three wrong texts, and run the guest job when the tripwire code changes by @zyvorai in #35
• Refresh the brochure (22 pages) and the social card; fix the policy badge overlap by @zyvorai in #36

Full Changelog: https://github.com/zyvorai/shukra/commits/v0.1.0-rc1

v0.1.0

First packaged release. v0.1.0-rc1 was the candidate.

Guest traffic, isolation and egress policy attach with TCX and need Linux 6.6 or newer. There is no classic tc datapath. Host probes (kvm, sched, block, mem, net, vmm, drops) still run on older kernels. The unit listens on 127.0.0.1:30970. systemd on the hypervisor is the install; the container image is not a way to load eBPF.

Since the rc:

• Direct reclaim and OOM kills of the VMM process are measured (mem). That is not the guest's own memory.
• Block queue time (insert to issue) is separate from device service time (issue to complete), and a non-zero completion status is counted.

Artifacts are amd64 and arm64 tarballs, .deb packages, container images, checksums and a CycloneDX SBOM. Signatures were not published: COSIGN_PRIVATE_KEY is unset. scripts/verify-release.sh checks a downloaded directory.

Notes: docs/releases/v0.1.0.md

Full Changelog: v0.1.0-rc1...v0.1.0