All pull requests

Pull requests

• kafel: update submodule to include the 64-bit argument word order fix

  #377·Arielpoghon opened Oct 26, 2026·

  ·
  1

• configs: block io_uring in remaining seccomp denylist examples

  #376·czuba92-pixel opened Oct 25, 2026·

  ·
  1

• mnt: apply readonly recursively to new-api bind mounts

  #371·mcc0nnell opened Oct 23, 2026·

  ·
  1

• nstun: reject unspecified IPv4 guest sources

  #368·AdemVessell opened Oct 22, 2026·

  ·

• cgroup: cap RAM when only cgroup_mem_memsw_max is set

  #367·ilyas-mallah opened Oct 21, 2026·

  ·

• nstun: add a bounds-checked reader for IP parsing

  #366·agusgarcia3007 opened Oct 19, 2026·

  ·
  1

• net, contain: run under gVisor (skip an unused link cache, tolerate a no-op RLIMIT_MSGQUEUE EPERM)

  #365·rubenfiszel opened Oct 18, 2026·

  ·
  2

• nstun: drain TCP listener at flow capacity

  #364·elnadym165 opened Oct 13, 2026·

  ·
  1

• pid: fail closed when dummy init setup fails

  #363·ikeago opened Oct 12, 2026·

  ·
  1

• nstun: enforce REDIRECT selectors on inbound traffic

  #362·paulchum opened Oct 11, 2026·

  ·
  1

• Open seccomp policy file with O_NOFOLLOW

  #361·kalt2212 opened Oct 10, 2026Contributor·

  ·

• mnt: ignore non-mandatory and nested submount remount failures in legacy backend (fixes #355)

  #359·jdymitarai opened Oct 8, 2026·

  ·

• security: ensure ro mounts are propagated to submounts

  #358·Matir opened Oct 7, 2026Member·

  ·

• nstun: reject direct guest flows destined to parent host-local routes (fixes #356)

  #357·jdymitarai opened Oct 4, 2026·

  ·

• nstun: drop IPv4 multicast destinations

  #354·g0w6y opened Oct 1, 2026Contributor·

  ·
  1

• subproc: mark supervisor fds CLOEXEC before helper exec

  #351·ManoharPaturi opened Sep 27, 2026·

  ·
  3

• [logs] finish writing log messages on short writes

  #350·ManoharPaturi opened Sep 27, 2026·

  ·
  2

• [net] close the listening socket on setup failure and open sockets CLOEXEC

  #349·ManoharPaturi opened Sep 27, 2026·

  ·
  2

• [cgroup] fix uint32 overflow in CPU quota computation

  #348·ManoharPaturi opened Sep 27, 2026·

  ·
  3

• mnt: retry read-only remounts on EBUSY

  #347·HanziJiang opened Sep 23, 2026·

  ·

• cgroup2: harden subtree controller detection and add O_CLOEXEC

  #346·filtede98 opened Sep 23, 2026·

  ·

• logs: add --log_stderr_level for an independent stderr log threshold

  #345·HanziJiang opened Sep 21, 2026·

  ·
  2

• mnt: fail closed when applying mount flags or final remount fails

  #344·Yudis-bit opened Sep 20, 2026·

  ·
  1

• ci: attest published container images

  #343·mcc0nnell opened Sep 18, 2026·

  ·

• cgroup2: enforce memsw-only limits when memory.max is unset

  #342·TUYU-42 opened Sep 16, 2026·

  ·
  1