From e395abdf9bdff8d7cc3a1875eacfae18e5282069 Mon Sep 17 00:00:00 2001 From: scttbnsn <80784472+scttbnsn@users.noreply.github.com> Date: Sun, 25 Oct 2026 20:21:02 -0400 Subject: [PATCH 1/2] chore(release): prepare v2.3.0-rc.9 Carries v2.2.11 into the v2.3 candidate. Metadata only. --- CHANGELOG.md | 10 ++++++++++ README.md | 2 +- docs/content/docs/roadmap.mdx | 6 ++++-- website/src/lib/site-content.ts | 2 +- 4 files changed, 16 insertions(+), 4 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index a9ffadd7..3b67abc0 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] +## [2.3.0-rc.9] - 2026-10-25 + +### Security + +- **The 2.2.11 fixes are now on the v2.3 line.** Native Podman container create's `base_hosts_file` and pod create's `hostsFile` are limited to the exact empty, `image` and `none` selectors, so a caller can no longer name a host file for the daemon to read into the container's `/etc/hosts`. `BUILDKIT_SYNTAX` frontend overrides are refused while RUN instructions are restricted. The mediated BuildKit Solve guard was already on v2.3; the classic Docker/Podman build-argument guard is new here, and it also refuses ambiguous query spellings, repeated values and malformed JSON. Release binaries and images are rebuilt with Go 1.27.3 for GO-2026-6809. The 2.2.11 entry below describes the source and test evidence; no live-daemon reproduction is claimed. + +### Changed + +- Carries the stable line's dependency, GitHub Actions and Gosec pin updates, and the docs build adapter isolation. The BuildKit frontend mediation, companion runner and `/v2` module path behave as they did in rc.8. This candidate only carries changes already released on 2.2.x, so the GA floor stays 2026-10-23. GA follows a fresh four-hour soak, TLS scan and published-image conformance run on the rc.9 head. + ## [2.2.11] - 2026-10-24 ### Fixed diff --git a/README.md b/README.md index 9a83edd2..85cf7bb2 100644 --- a/README.md +++ b/README.md @@ -505,7 +505,7 @@ Added in 2.2.11: native Podman container and pod creates refuse caller-selected | **v2.1.0** ✅ | Native libpod Write Inspection & Owner Isolation | Copy-into-container, update, restore, checkpoint and mount inspected on the libpod routes, owner isolation fails closed with `404` / `403` / `502` across the prune family, commit and image export/removal, process-list reads need the read-exfiltration acknowledgment, read-side redaction reaches libpod inspect, volume reads and network topology | | **v2.2.x** ✅ | Volume-Mount Containment & Read-Side Redaction | `local` volume driver `type`/`o`/`device` options held to `allowed_bind_mounts` on container create and Swarm mounts, `PUT /volumes/{name}` inspection, request-target guard, redaction that survives gzip, `HEAD`, `304` and image inspect, `sockguard verify`, `server.shutdown_grace`, rootless `match.path` rejected, fewer per-request allocations. Security patches 2.2.1 to 2.2.10 cover Podman/libpod create and body-key hardening, compat create host paths, Dockerfile directive, line-assembly and heredoc forms, a Go toolchain rebuild, owner-isolation image naming, form-body refusal and pod infra PID-file refusal The 2.2.11 patch also closes `BUILDKIT_SYNTAX` argument overrides on restricted classic and mediated builds. | | **v2.2.11** | Maintenance | Security fixes for native Podman hosts files and restricted frontend overrides, Go 1.27.3 certificate-verification remediation, dependency/CI updates, a compatible Gosec action and isolated static docs builds | -| **v2.3.0** | BuildKit Frontend Mediation & Go Module v2 | **v2.3.0-rc.8 carries the 2.2.10 patch; fresh candidate validation is pending. GA remains no earlier than 2026-10-23.** Raw LLB ExecOps are approved individually through `request_body.buildkit.control.solve.allowed_exec_digests`, and with `control.solve.allow_frontend_gateway` on, each iterative LLB Solve from a third-party frontend is mediated under the root build's policy while the `sockguard frontend` companion runner executes a pinned compiler image in an isolated Docker container ([frontend runner guide](https://getsockguard.com/docs/frontend-runner)). Interactive container/process RPCs and daemon-resolved nested gateway builds stay denied, and BuildKit job refs and callback session IDs are scoped by client and profile. The module declares `github.com/codeswhat/sockguard/v2`, so Go users can pin a candidate by tag and `@latest` resolves to v2.3 once v2.3.0 is published; Docker, Homebrew, deb and rpm installs are unchanged. Also on the line: legacy `HostConfig.Tmpfs` held to `allow_tmpfs_privileged_options`, the remote-context grant required for raw LLB remote sources, the reserved `BUILDKIT_SYNTAX` frontend override rejected on restricted Dockerfile builds, OCI image loads bounded by cumulative logical blob size, and object-shaped secret `Driver` selection behind `allow_custom_drivers` | +| **v2.3.0** | BuildKit Frontend Mediation & Go Module v2 | **v2.3.0-rc.9 is the next candidate and carries the 2.2.11 fixes; [v2.3.0-rc.8](https://github.com/CodesWhat/sockguard/releases/tag/v2.3.0-rc.8) stays the latest published candidate until it is cut. GA remains no earlier than 2026-10-23 and follows fresh soak, TLS and published-image conformance on rc.9.** Raw LLB ExecOps are approved individually through `request_body.buildkit.control.solve.allowed_exec_digests`, and with `control.solve.allow_frontend_gateway` on, each iterative LLB Solve from a third-party frontend is mediated under the root build's policy while the `sockguard frontend` companion runner executes a pinned compiler image in an isolated Docker container ([frontend runner guide](https://getsockguard.com/docs/frontend-runner)). Interactive container/process RPCs and daemon-resolved nested gateway builds stay denied, and BuildKit job refs and callback session IDs are scoped by client and profile. The module declares `github.com/codeswhat/sockguard/v2`, so Go users can pin a candidate by tag and `@latest` resolves to v2.3 once v2.3.0 is published; Docker, Homebrew, deb and rpm installs are unchanged. Also on the line: legacy `HostConfig.Tmpfs` held to `allow_tmpfs_privileged_options`, the remote-context grant required for raw LLB remote sources, the reserved `BUILDKIT_SYNTAX` frontend override rejected on restricted Dockerfile builds, OCI image loads bounded by cumulative logical blob size, and object-shaped secret `Driver` selection behind `allow_custom_drivers` | | **v2.x** | Security Hardening | Continued mutation-test hardening of the rule-evaluation core and config validators | | **v2.x** | Supply Chain | `egress-policy: block` with curated allow-lists on high-privilege release jobs | | **v2.x** | Policy Refinement | Named rule path aliases and further response-policy refinement | diff --git a/docs/content/docs/roadmap.mdx b/docs/content/docs/roadmap.mdx index 75938e21..ffcd108c 100644 --- a/docs/content/docs/roadmap.mdx +++ b/docs/content/docs/roadmap.mdx @@ -51,7 +51,7 @@ BuildKit and Podman's builder each do. v2.2.10 is a tenth security patch: native Podman pod create refuses any nonempty `infra_conmon_pid_file`, matching the container-create `conmon_pid_file` refusal and preventing a caller-selected host PID-file write. [v2.3.0-rc.8](https://github.com/CodesWhat/sockguard/releases/tag/v2.3.0-rc.8) -is the current candidate for the next line; v2.3.0 is not stable yet. This roadmap describes direction and priorities, not +is the latest published candidate for the next line; v2.3.0-rc.9 will carry the 2.2.11 fixes, and v2.3.0 is not stable yet. This roadmap describes direction and priorities, not promises about dates. A feature is available only after the release notes say it has shipped. @@ -122,7 +122,9 @@ and [TLS scan](https://github.com/CodesWhat/sockguard/actions/runs/38828636275) passed on rc.8's exact head, `3d959fe3`. The soak used a mock daemon, completed 257,857,747 requests with zero request errors, and recorded 3,739,648 bytes of RSS growth, below the 64 MiB threshold. This does not -validate real BuildKit workloads. GA is no earlier than 2026-10-23. +validate real BuildKit workloads. v2.3.0-rc.9 carries the 2.2.11 fixes into +the candidate line and needs its own soak, TLS scan and published-image +conformance run before GA, which is no earlier than 2026-10-23. Every new candidate needs a fresh four-hour soak and TLS scan; a candidate containing only fixes already released on the v2.2 line keeps the date, while a v2.3-only behavior change restarts the 14-day window. diff --git a/website/src/lib/site-content.ts b/website/src/lib/site-content.ts index 7d77629d..03746bba 100644 --- a/website/src/lib/site-content.ts +++ b/website/src/lib/site-content.ts @@ -390,7 +390,7 @@ export const roadmap: Milestone[] = [ items: [ "Implemented in v2.3.0-rc.8, awaiting stable release: individual raw-LLB ExecOp digest approvals, external frontend gateway mediation and the pinned companion runner; opaque in-daemon frontends and interactive execution stay denied", "The /v2 Go module migration is in the candidate, including imports, release linker flags and regenerated BuildKit descriptors; Docker, Homebrew, deb and rpm installation paths are unchanged", - "rc.8 carries the 2.2.10 pod infra PID-file refusal; its four-hour soak and TLS validation passed on the exact head, and every new candidate requires fresh validation. GA remains no earlier than 2026-10-23", + "rc.9 carries the 2.2.11 fixes into the candidate line; rc.8's four-hour soak and TLS validation passed on its exact head, and rc.9 needs fresh validation. GA remains no earlier than 2026-10-23", ], }, ]; From 585517910b2e97360e3c5153738b0a9dd48611a4 Mon Sep 17 00:00:00 2001 From: scttbnsn <80784472+scttbnsn@users.noreply.github.com> Date: Sun, 25 Oct 2026 20:41:15 -0400 Subject: [PATCH 2/2] docs(readme): name rc.9 in the candidate cutoff CodeRabbit pass 1 on #622: 'until it is cut' could read as rc.8. --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 85cf7bb2..ea64996d 100644 --- a/README.md +++ b/README.md @@ -505,7 +505,7 @@ Added in 2.2.11: native Podman container and pod creates refuse caller-selected | **v2.1.0** ✅ | Native libpod Write Inspection & Owner Isolation | Copy-into-container, update, restore, checkpoint and mount inspected on the libpod routes, owner isolation fails closed with `404` / `403` / `502` across the prune family, commit and image export/removal, process-list reads need the read-exfiltration acknowledgment, read-side redaction reaches libpod inspect, volume reads and network topology | | **v2.2.x** ✅ | Volume-Mount Containment & Read-Side Redaction | `local` volume driver `type`/`o`/`device` options held to `allowed_bind_mounts` on container create and Swarm mounts, `PUT /volumes/{name}` inspection, request-target guard, redaction that survives gzip, `HEAD`, `304` and image inspect, `sockguard verify`, `server.shutdown_grace`, rootless `match.path` rejected, fewer per-request allocations. Security patches 2.2.1 to 2.2.10 cover Podman/libpod create and body-key hardening, compat create host paths, Dockerfile directive, line-assembly and heredoc forms, a Go toolchain rebuild, owner-isolation image naming, form-body refusal and pod infra PID-file refusal The 2.2.11 patch also closes `BUILDKIT_SYNTAX` argument overrides on restricted classic and mediated builds. | | **v2.2.11** | Maintenance | Security fixes for native Podman hosts files and restricted frontend overrides, Go 1.27.3 certificate-verification remediation, dependency/CI updates, a compatible Gosec action and isolated static docs builds | -| **v2.3.0** | BuildKit Frontend Mediation & Go Module v2 | **v2.3.0-rc.9 is the next candidate and carries the 2.2.11 fixes; [v2.3.0-rc.8](https://github.com/CodesWhat/sockguard/releases/tag/v2.3.0-rc.8) stays the latest published candidate until it is cut. GA remains no earlier than 2026-10-23 and follows fresh soak, TLS and published-image conformance on rc.9.** Raw LLB ExecOps are approved individually through `request_body.buildkit.control.solve.allowed_exec_digests`, and with `control.solve.allow_frontend_gateway` on, each iterative LLB Solve from a third-party frontend is mediated under the root build's policy while the `sockguard frontend` companion runner executes a pinned compiler image in an isolated Docker container ([frontend runner guide](https://getsockguard.com/docs/frontend-runner)). Interactive container/process RPCs and daemon-resolved nested gateway builds stay denied, and BuildKit job refs and callback session IDs are scoped by client and profile. The module declares `github.com/codeswhat/sockguard/v2`, so Go users can pin a candidate by tag and `@latest` resolves to v2.3 once v2.3.0 is published; Docker, Homebrew, deb and rpm installs are unchanged. Also on the line: legacy `HostConfig.Tmpfs` held to `allow_tmpfs_privileged_options`, the remote-context grant required for raw LLB remote sources, the reserved `BUILDKIT_SYNTAX` frontend override rejected on restricted Dockerfile builds, OCI image loads bounded by cumulative logical blob size, and object-shaped secret `Driver` selection behind `allow_custom_drivers` | +| **v2.3.0** | BuildKit Frontend Mediation & Go Module v2 | **v2.3.0-rc.9 is the next candidate and carries the 2.2.11 fixes; [v2.3.0-rc.8](https://github.com/CodesWhat/sockguard/releases/tag/v2.3.0-rc.8) stays the latest published candidate until v2.3.0-rc.9 is cut. GA remains no earlier than 2026-10-23 and follows fresh soak, TLS and published-image conformance on rc.9.** Raw LLB ExecOps are approved individually through `request_body.buildkit.control.solve.allowed_exec_digests`, and with `control.solve.allow_frontend_gateway` on, each iterative LLB Solve from a third-party frontend is mediated under the root build's policy while the `sockguard frontend` companion runner executes a pinned compiler image in an isolated Docker container ([frontend runner guide](https://getsockguard.com/docs/frontend-runner)). Interactive container/process RPCs and daemon-resolved nested gateway builds stay denied, and BuildKit job refs and callback session IDs are scoped by client and profile. The module declares `github.com/codeswhat/sockguard/v2`, so Go users can pin a candidate by tag and `@latest` resolves to v2.3 once v2.3.0 is published; Docker, Homebrew, deb and rpm installs are unchanged. Also on the line: legacy `HostConfig.Tmpfs` held to `allow_tmpfs_privileged_options`, the remote-context grant required for raw LLB remote sources, the reserved `BUILDKIT_SYNTAX` frontend override rejected on restricted Dockerfile builds, OCI image loads bounded by cumulative logical blob size, and object-shaped secret `Driver` selection behind `allow_custom_drivers` | | **v2.x** | Security Hardening | Continued mutation-test hardening of the rule-evaluation core and config validators | | **v2.x** | Supply Chain | `egress-policy: block` with curated allow-lists on high-privilege release jobs | | **v2.x** | Policy Refinement | Named rule path aliases and further response-policy refinement |