This release addresses two security issues in the Containerization package:

• GHSA-4587-w9mm-xxvh - OCI image load follows symlinks for oci-layout and index.json outside the extraction directory
• GHSA-rgqp-277h-gcwj - UnixType.init(path:) uses a macOS length limit longer than the sockaddr_un.sun_path buffer it copies into

There was no 1.4.0 release, we had to discard that tag so this release contains every change since 1.3.1.

Highlights

⌨️ denotes breaking CLI changes.

👩‍💻 denotes breaking API changes.

• Core
  • New container clean command
  • 👩‍💻 container system status now reports host, client, paths, and resources
  • JSON output no longer escapes forward slashes
  • Updated Containerization to 0.45.0

What's Changed

• Avoid escaping slashes in JSON output by @taljeon in #2205
• Enhance container system status command output by @muk2 in #1769
• Updates containerization to 0.43.0. by @jglogan in #2208
• [container]: add clean command by @saehejkang in #1949
• fix: handle container clean failing on read-only named volume mounts by @zdk in #2228
• ci: bump softprops/action-gh-release from 3.0.2 to 3.0.3 in the github-actions group by @dependabot[bot] in #2226
• Fix a compilation error by @dkovba in #2234
• Remove security markdown in favor of inherited security guidelines by @katiewasnothere in #2249
• docs: remove broken troubleshooting.md link in technical overview by @zdk in #2227
• Fix compilation warnings by @dkovba in #2235
• docs: Add k8s plugin reference by @egernst in #2244
• Bump CZ to 0.45.0 by @realrajaryan in #2250

New Contributors

• @taljeon made their first contribution in #2205
• @muk2 made their first contribution in #1769

Full Changelog: 1.3.1...1.4.1

This patch release addresses a number of security issues in the Containerization package:

• GHSA-x7pf-2jmj-pgcq - Creating a container or executing a container process can delete files outside its bundle through an unchecked id
• GHSA-f689-h8m7-3jp2 - ContainerizationOCI accepts unvalidated OCI descriptor digests, enabling path traversal in the local content store
• GHSA-r3h2-rgqf-9hv9 - Loading an OCI image layout can read host files through a symlink
• GHSA-mx96-5vvg-x2mg - CVE-2026-65388 - RegistryClient follows the WWW-Authenticate realm without validating its host or scheme
• GHSA-697p-8837-37h3 - Unpacking a crafted image layer with a long(invalid) file name crashes the unpacking process
• GHSA-g3rx-2m58-rr63 - Unpacking a crafted image layer with an invalid length extended-attribute name crashes the unpacking process

What's Changed

• Add container skill by @crosbymichael in #2154
• Fix tmpfs mount source field left empty for --mount type=tmpfs by @sivasath16 in #2138
• Update to containerization 0.42.0 by @katiewasnothere in #2207

New Contributors

• @sivasath16 made their first contribution in #2138

Full Changelog: 1.3.0...1.3.1

Highlights

⌨️ denotes breaking CLI changes.

👩‍💻 denotes breaking API changes.

• Core
  • Default Kata kernel is now 3.32.0-debug
  • Documentation has been expanded and reorganized.
  • Relax maskedPaths and readonlyPaths for container machines
• Images
  • ⌨️ Removed --scheme auto for image operations, default is now https.

What's Changed

• Update sudoers file to not include dots by @tumd in #2080
• Refactor tmpfsMounts() to process tmpfs path correctly by @LevelVoid in #2103
• Remove auto registry scheme. by @jglogan in #2100
• Validate volume name in volume disk usage call by @katiewasnothere in #2107
• Topic/docs refactor by @egernst in #2032
• Integration test: fix k8s test with scoped domain. by @jglogan in #2104
• Extracts createPluginLoader() for use by container k8s. by @jglogan in #2115
• Fix a compilation error by @dkovba in #2119
• Split K8sHelper, add WorkerProvisioner protocol, and add LinuxWorker … by @jshi991 in #2110
• Do not set default maskedPaths and readonlyPaths for container machines by @katiewasnothere in #2137
• Remove AsyncParsableCommand conformance from ContainerCLI by @noah-thor in #2140
• Add identifier validation tests for the disk-usage routes by @realrajaryan in #2136
• Update default kernel to Kata Containers 3.32.0 debug build by @agamdua in #2143

New Contributors

• @tumd made their first contribution in #2080
• @LevelVoid made their first contribution in #2103
• @agamdua made their first contribution in #2143

Full Changelog: 1.2.2...1.3.0

This release fixes a glitch that prevented container k8s working when installed from the release package.

What's Changed

• Integration test: fix username/uid flake. by @jglogan in #2086
• refactor: extract K8s logic into ContainerK8s library target by @jshi991 in #2079
• Refactor container k8s to use plugin resource management. by @jglogan in #2097
• Migrate ProgressBarTests to Swift Testing by @VictorPuga in #2085

New Contributors

• @VictorPuga made their first contribution in #2085

Full Changelog: 1.2.1...1.2.2

Highlights

⌨️ denotes breaking CLI changes.

👩‍💻 denotes breaking API changes.

• Core
  • k8s plugin for turnkey local Kubernetes cluster
  • container export for live containers.
  • --ssh option for container build.
  • --read-only-path and --masked-path for container run for Kubernetes, Docker, and similar containers.

What's Changed

• [container]: add container export for live containers by @saehejkang in #1630
• Adjust overcommit and max_map_count vm defaults in guest VMs by @adityabagchi24 in #2055
• [package]: bump container-builder-shim to 0.13.1 by @saehejkang in #2056
• [builder]: enable ssh forwarding for container build by @saehejkang in #1508
• Move SSH builder test to Serialized tests by @JaewonHur in #2061
• Increase testExecDetachProcessRunning sleep margin to avoid CI flake by @jglogan in #2063
• Add readiness signal to DirectoryWatcher, fix DirectoryWatcherTest. by @jglogan in #2066
• Log core counts in CI for perf analysis. by @jglogan in #2070
• Add --read-only-path and --masked-path option to container run / create by @adityaramani in #2069
• Simplify correlation of test prefix to test ID. by @jglogan in #2071
• Integration test: cache warmup image tarfiles. by @jglogan in #2074
• K8s plugin by @jshi991 in #2044

New Contributors

• @jshi991 made their first contribution in #2044

Full Changelog: 1.2.0...1.2.1

Highlights

⌨️ denotes breaking CLI changes.

👩‍💻 denotes breaking API changes.

• SECURITY FIXES
  • GHSA-xwgf-4rc5-p4m4 - CVE-2026-64786 - bare-name image Config.Env entries should not inherit values from the launching process's environment
  • GHSA-wg28-286f-56v6 - CVE-2026-64773 - TCP port forwarder buffers unbounded pre-connect data from published container ports
  • GHSA-2v2q-4q35-h585 - CVE-2026-64777 - Build filesystem sync discloses host files outside the build context via symlinks
  • GHSA-g57j-434g-5xj2 - BuildFSSync.walk()'s JSON response mode reports the resolved host path of build-context symlinks that point outside the context.
  • GHSA-5h49-6pr7-9mv4 - reset special permission bits when extracting archives onto the host.
• Core
  • k8s plugin for turnkey local Kubernetes cluster
  • container export for live containers.
  • --ssh option for container build.
  • --read-only-path and --masked-path for container run for Kubernetes, Docker, and similar containers.

What's Changed

• Add TestCLISystemLogs and TestCLITermIO integration tests in new integration test suite by @katiewasnothere in #1879
• Restore reverted migrations, migrate last tests. by @jglogan in #1880
• Removes obsolete CLITests directory. by @jglogan in #1886
• Integration coverage xpc helpers by @noah-thor in #1551
• Upgrade grpc-swift-nio-transport to 2.9.0 and remove HTTP2ConnectBuff… by @adityabagchi24 in #1790
• Updates containerization to 0.36.0. by @jglogan in #1912
• Use containerization version 0.37.0 by @adityaramani in #1932
• Verify kernel archive integrity by @haoruilee in #1703
• Add commit/issue alert to PR template. by @jglogan in #1945
• Remove --skip-build from test Makefile target. by @jglogan in #1951
• Restore --skip-build, enable import testable for release builds. by @jglogan in #1955
• [package]: bump container-builder-shim to 0.13.0 by @saehejkang in #1953
• Validate container ID from XPC requests by @katiewasnothere in #1956
• Remove force unwraps on XPC error set/get by @katiewasnothere in #1958
• Do not follow destination symlink when copying user configuration by @katiewasnothere in #1957
• Fix machine ID length test. by @jglogan in #1971
• Address flaky TestCLIKernelSetSerial suite. by @jglogan in #1976
• [gitignore]: ignore vscode workspace files by @saehejkang in #1966
• Update containerization dependency with new EXT4Unpacker func definition by @katiewasnothere in #1973
• Periodic dependency updates. by @jglogan in #1981
• Use ordered journal mode for unpacked images. by @jglogan in #1974
• Reword DNS container name resolution doc information by @katiewasnothere in #1960
• ci: bump the github-actions group across 1 directory with 3 updates by @dependabot[bot] in #1983
• Pass build config in when building protoc dependencies by @katiewasnothere in #1972
• Container test fixture package by @katiewasnothere in #1887
• Downgrade swift-collections to 1.5.1. by @jglogan in #1984
• Use enum for warmup images. by @jglogan in #1990
• Add missing dependencies to new ContainerTestSupport package by @katiewasnothere in #1994
• Add OCI maskedPaths and readonlyPaths support to Container API. by @jglogan in #1996
• Integration test - miscellaneous fixture and test refinements. by @jglogan in #1993
• Use log instead of print for system start status messages by @adityabagchi24 in #1889
• Fix BuilderStart race, parallelize container build tests. by @jglogan in #2002
• Allow custom kernel boot args via --kernel-arg by @arirubinstein in #1744
• fix: Increase XPC timeout for Machine API operations by @dev-kvt in #2006
• Update containerization import to latest 0.40.0 by @katiewasnothere in #2028
• Fix image env vars, build context checks, TCP/UDP port forward buffer, and validate plugin name by @katiewasnothere in #2027
• Update containerization import to 0.40.1 by @katiewasnothere in #2038

New Contributors

• @haoruilee made their first contribution in #1703
• @arirubinstein made their first contribution in #1744
• @dev-kvt made their first contribution in #2006

Full Changelog: 1.1.0...1.2.0

Highlights

⌨️ denotes breaking CLI changes.

👩‍💻 denotes breaking API changes.

• Core
  • Unix domain socket mounts now work in non-root containers.
• Storage
  • Fix container cp failures with relative source paths

What's Changed

• Bump containerization to 0.33.4 by @dkovba in #1650
• add standalone container machine document by @crosbymichael in #1674
• Adds container machine example. by @jglogan in #1676
• Always update default network with system configuration values by @katiewasnothere in #1686
• ci: bump actions/checkout from 6.0.2 to 6.0.3 in the github-actions group across 1 directory by @dependabot[bot] in #1640
• Fix duplicate "(default: 3)" in --max-concurrent-downloads help text by @CharlieTLe in #1725
• add container machine nested virt by @crosbymichael in #1742
• Pin xcode swift version in CI to 6.3 by @katiewasnothere in #1746
• Propagate permissions for all host-to-container socket mounts. by @jglogan in #1751
• Fix CLITest when run in xcode by @mareksapota in #1775
• [package]: bump containerization to 0.34.0 by @saehejkang in #1774
• fix(cp): resolve relative host paths against current directory by @adityabagchi24 in #1741
• fix: replace try! with try? for stdout/stderr writes in ProcessIO by @SEPURI-SAI-KRISHNA in #1784
• fix: remove force-unwrap on session dictionary in DefaultNetworkService by @SEPURI-SAI-KRISHNA in #1787
• Log the graceful-stop error instead of silently discarding it in gracefulStopContainer by @radheradhe01 in #1782
• Disable flaky CLI test temporarily. by @jglogan in #1828
• Fix/exec empty arguments crash by @SEPURI-SAI-KRISHNA in #1783
• Remove network variant computation from API server. by @jglogan in #1814
• Remove duplicate release workflow that double-builds and races on every tag by @radheradhe01 in #1781
• perf(parser): add collection capacity hints to known-size loops by @hluaguo in #1791
• fix: propagate error from createDirectory in system start by @SEPURI-SAI-KRISHNA in #1785
• ci: bump the github-actions group across 1 directory with 2 updates by @dependabot[bot] in #1792
• Route container image save reference list to stderr in stdout mode by @costajohnt in #1804
• Enhanced test fixtures for integration tests. by @jglogan in #1834
• Migrate some container tests, remove concurrent demo tests. by @jglogan in #1840
• Update containerization import to 0.35.0 by @katiewasnothere in #1842
• Adds build fixture and migrates build CLI tests. by @jglogan in #1848
• Migrates container machine tests. by @jglogan in #1856
• Migrate basic system tests to new test support types. by @jglogan in #1841
• Migrates network integration tests. by @jglogan in #1858
• Migrate registry tests to new test support types. by @jglogan in #1845
• Add checksum validation to hawkeye installation by @katiewasnothere in #1869
• Migrate image, volume and miscellaneous system tests. by @jglogan in #1868
• Migrates container create, run-lifecycle, exec, remove, copy. by @jglogan in #1844
• Migrates container run integration tests. by @jglogan in #1857
• Ensure test filenames match test suite names and each file has a single suite defined by @katiewasnothere in #1877
• Finalize Makefile for integration test rework. by @jglogan in #1878

New Contributors

• @CharlieTLe made their first contribution in #1725
• @mareksapota made their first contribution in #1775
• @adityabagchi24 made their first contribution in #1741
• @SEPURI-SAI-KRISHNA made their first contribution in #1784
• @radheradhe01 made their first contribution in #1782
• @hluaguo made their first contribution in #1791
• @costajohnt made their first contribution in #1804

Full Changelog: 1.0.0...1.1.0

🎂 container is one year old!

Try out the new container machine feature and let us know what you think!

Highlights

⌨️ denotes breaking CLI changes.

👩‍💻 denotes breaking API changes.

• Core
  • container machine for long-lived Linux environments with tight host integration.
  • ⌨️ A TOML configuration file replaces UserDefault-backed system properties, removing the container system property get and set subcommands.
  • ⌨️ Cleaned up structured (JSON, YAML, TOML) output shape for container, image, network, and volume ls and inpect.
  • Fixed container help subcommand...
  • Fixed output formatting for several commands
  • Add --stop-signal option for container run
  • 👩‍💻 Removed compatibility with application major version 0 XPC APIs. A subsequent release will introduce a version on the API itself so that clients and server can check compatibility.
• Network
  • Use XPC-connection-as-lease to fix IP address leaks
• Storage
  • Add container cp command
  • Fixed accounting errors in system df

What's Changed

• Tests/CLITests: drain stdout/stderr concurrently in CLITest.run by @mvanhorn in #1471
• Build output should just be tags/paths. by @jglogan in #1478
• Use NetworkResource for network management in API server. by @jglogan in #1421
• Use SystemPath for HostDNSResolver. by @jglogan in #1480
• Update documents with note about container-to-host networking. by @jglogan in #1482
• Sort networks by ID in API server list(). by @jglogan in #1487
• CLI: Support --shm-size by @dcantah in #1488
• Improve integration test speed by @noah-thor in #1489
• Simplify the serial suite trait by @katiewasnothere in #1497
• Switch NetworksService, VolumesService, EntityStore to FilePath. by @jglogan in #1493
• [scripts]: add prompt for updating container with unsigned package by @saehejkang in #1468
• Change PR build to generate coverage and comment it by @noah-thor in #1474
• Deps: Bump CZ to 0.32.0 by @dcantah in #1498
• Move to TOML configuration for defaults by @noah-thor in #1425
• docs: fix typos and polish README wording by @12ya in #1499
• De-duplicate building during testing by @noah-thor in #1507
• Centralize utilities for configuration loading and path parsing by @noah-thor in #1448
• Use SystemPath for PacketFilter. by @chrisgeo in #1518
• swift-configuration decoder by @noah-thor in #1447
• Fix PR coverage comment never posting by @noah-thor in #1541
• Use SystemPath for DirectoryWatcher. by @chrisgeo in #1522
• Adds XPC sessions with disconnect handlers. by @jglogan in #1524
• Use allocate with session to automatically clean up IPs. by @jglogan in #1544
• Use SystemPath for ContainerResource.Filesystem. by @chrisgeo in #1523
• Add support for layered and plugin configurations by @noah-thor in #1543
• Bump containerization to 0.32.1 by @JaewonHur in #1549
• Remove IP allocation from API server. by @jglogan in #1545
• Add variant Support by @ajemory in #1548
• ci: bump actions/labeler from 6.0.1 to 6.1.0 in the github-actions group by @dependabot[bot] in #1550
• Relax host-only network test. by @jglogan in #1552
• Fix inconsistent volume createdAt JSON encoding by @realrajaryan in #1556
• Fix: image list align with other commands when use format should ignore quiet by @tico88612 in #1553
• Reject conflicting DNS flags by @LeSingh1 in #1559
• Reject conflicting volume delete flags by @realrajaryan in #1560
• Validate container system logs --last flag by @realrajaryan in #1561
• Ensure read-only user config removed on every startup. by @jglogan in #1567
• Rename config file to config.toml. by @jglogan in #1568
• Make inspect error handling for missing resources consistent by @realrajaryan in #1564
• Add container copy/cp command for host-container file transfer by @simone-panico in #1190
• [images]: convert save to use FilePath by @saehejkang in #1574
• [images]: fix image load error to write to stderr and use FilePath by @saehejkang in #1570
• Reorganize runtime targets for scalable plugin support by @ajemory in #1577
• Add more tests for container copy by @JaewonHur in #1579
• Update container copy to use FilePath by @JaewonHur in #1580
• Add notes regarding --log-root to the command reference. by @jglogan in #1582
• cli: Add support for --stop-signal by @dcantah in #1462
• fix: clamp ProgressBar barLength to non-negative value to avoid crash by @ErwanLegrand in #1525
• Adds vertical space between groups in help. by @jglogan in #1585
• Refine custom init how-to and BUILDING documentation. by @jglogan in #1586
• Improve readability of progress bar width computation. by @jglogan in #1584
• Bump containerization to 0.33.1 by @dkovba in #1601
• Use FilePath for app, install, and log roots. by @jglogan in #1558
• Support use of custom app root with system config in CLI commands by @katiewasnothere in #1600
• Add shmSize to management flag's init by @katiewasnothere in #1603
• cli: resolve subcommand path in container help by @0xMH in #1587
• Add ability to configure integration test list at command line by @katiewasnothere in #1608
• Align JSON output with shape for container resource. by @jglogan in #1611
• Use ManagedResource for volumes in CLI commands by @katiewasnothere in #1607
• Fix potential integer math crash on PublishPort. by @jglogan in #1612
• Reorganize Swift package targets for network plugin. by @jglogan in #1615
• [how-to]: fix documentation example by @saehejkang in #1596
• Remove XPC compatibility code, simplify network model. by @jglogan in #1616
• Use FilePath for PublishSocket by @chrisgeo in #1594
• Fix system df to count content blobs and deduplicate shared storage by @realrajaryan in #1555
• Create ImageResource conforming to ManagedResource by @katiewasnothere in #1619
• Use a consistent container CLI path in integration tests by @zdk in #1621
• Normalize JSON output for network and volume resources. by @jglogan in #1624
• Fix TestCLIVersion build-type check for release CI by @zdk in #1627
• Add NOTICE entry for swift-configuration-toml by @katiewasnothere in #1629
• kill: Wait for container to exit after sigkill by @dcantah in #1589
• Add an error message for dockerfile >= 16KB until #735 is resolved by @katiewasnothere in #1634
• Write log/e...

This patch release includes two security fixes:

• Prevent HTTP downgrade in registry-related commands
• Prevent path and rule injection in container system dns commands

What's Changed

• Fix RequestScheme formatting. by @jglogan in #1473
• ImagePush: print image reference to stdout on success by @mvanhorn in #1470
• ensure-container-stopped.sh: don't fail on launchctl errors by @p-linnane in #1461

Full Changelog: 0.12.2...0.12.3

This patch release addresses an API compatibility fix that only surfaces on Sequoia. There are no functional changes.

What's Changed

• Allow macOS 15 to list and delete networks by @katiewasnothere in #1464

Full Changelog: 0.12.0...0.12.1