chore(release): prepare v2.3.0-rc.9

CHANGELOG.md

@@ -7,6 +7,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.3.0-rc.9] - 2026-10-25
+
+### Security
+
+- **The 2.2.11 fixes are now on the v2.3 line.** Native Podman container create's `base_hosts_file` and pod create's `hostsFile` are limited to the exact empty, `image` and `none` selectors, so a caller can no longer name a host file for the daemon to read into the container's `/etc/hosts`. `BUILDKIT_SYNTAX` frontend overrides are refused while RUN instructions are restricted. The mediated BuildKit Solve guard was already on v2.3; the classic Docker/Podman build-argument guard is new here, and it also refuses ambiguous query spellings, repeated values and malformed JSON. Release binaries and images are rebuilt with Go 1.27.3 for GO-2026-6809. The 2.2.11 entry below describes the source and test evidence; no live-daemon reproduction is claimed.
+
+### Changed
+
+- Carries the stable line's dependency, GitHub Actions and Gosec pin updates, and the docs build adapter isolation. The BuildKit frontend mediation, companion runner and `/v2` module path behave as they did in rc.8. This candidate only carries changes already released on 2.2.x, so the GA floor stays 2026-10-23. GA follows a fresh four-hour soak, TLS scan and published-image conformance run on the rc.9 head.
+
 ## [2.2.11] - 2026-10-24
 
 ### Fixed

README.md

@@ -505,7 +505,7 @@ Added in 2.2.11: native Podman container and pod creates refuse caller-selected
 | **v2.1.0** ✅ | Native libpod Write Inspection & Owner Isolation | Copy-into-container, update, restore, checkpoint and mount inspected on the libpod routes, owner isolation fails closed with `404` / `403` / `502` across the prune family, commit and image export/removal, process-list reads need the read-exfiltration acknowledgment, read-side redaction reaches libpod inspect, volume reads and network topology |
 | **v2.2.x** ✅ | Volume-Mount Containment & Read-Side Redaction | `local` volume driver `type`/`o`/`device` options held to `allowed_bind_mounts` on container create and Swarm mounts, `PUT /volumes/{name}` inspection, request-target guard, redaction that survives gzip, `HEAD`, `304` and image inspect, `sockguard verify`, `server.shutdown_grace`, rootless `match.path` rejected, fewer per-request allocations. Security patches 2.2.1 to 2.2.10 cover Podman/libpod create and body-key hardening, compat create host paths, Dockerfile directive, line-assembly and heredoc forms, a Go toolchain rebuild, owner-isolation image naming, form-body refusal and pod infra PID-file refusal The 2.2.11 patch also closes `BUILDKIT_SYNTAX` argument overrides on restricted classic and mediated builds. |
 | **v2.2.11** | Maintenance | Security fixes for native Podman hosts files and restricted frontend overrides, Go 1.27.3 certificate-verification remediation, dependency/CI updates, a compatible Gosec action and isolated static docs builds |
-| **v2.3.0** | BuildKit Frontend Mediation & Go Module v2 | **v2.3.0-rc.8 carries the 2.2.10 patch; fresh candidate validation is pending. GA remains no earlier than 2026-10-23.** Raw LLB ExecOps are approved individually through `request_body.buildkit.control.solve.allowed_exec_digests`, and with `control.solve.allow_frontend_gateway` on, each iterative LLB Solve from a third-party frontend is mediated under the root build's policy while the `sockguard frontend` companion runner executes a pinned compiler image in an isolated Docker container ([frontend runner guide](https://getsockguard.com/docs/frontend-runner)). Interactive container/process RPCs and daemon-resolved nested gateway builds stay denied, and BuildKit job refs and callback session IDs are scoped by client and profile. The module declares `github.com/codeswhat/sockguard/v2`, so Go users can pin a candidate by tag and `@latest` resolves to v2.3 once v2.3.0 is published; Docker, Homebrew, deb and rpm installs are unchanged. Also on the line: legacy `HostConfig.Tmpfs` held to `allow_tmpfs_privileged_options`, the remote-context grant required for raw LLB remote sources, the reserved `BUILDKIT_SYNTAX` frontend override rejected on restricted Dockerfile builds, OCI image loads bounded by cumulative logical blob size, and object-shaped secret `Driver` selection behind `allow_custom_drivers` |
+| **v2.3.0** | BuildKit Frontend Mediation & Go Module v2 | **v2.3.0-rc.9 is the next candidate and carries the 2.2.11 fixes; [v2.3.0-rc.8](https://github.com/CodesWhat/sockguard/releases/tag/v2.3.0-rc.8) stays the latest published candidate until it is cut. GA remains no earlier than 2026-10-23 and follows fresh soak, TLS and published-image conformance on rc.9.** Raw LLB ExecOps are approved individually through `request_body.buildkit.control.solve.allowed_exec_digests`, and with `control.solve.allow_frontend_gateway` on, each iterative LLB Solve from a third-party frontend is mediated under the root build's policy while the `sockguard frontend` companion runner executes a pinned compiler image in an isolated Docker container ([frontend runner guide](https://getsockguard.com/docs/frontend-runner)). Interactive container/process RPCs and daemon-resolved nested gateway builds stay denied, and BuildKit job refs and callback session IDs are scoped by client and profile. The module declares `github.com/codeswhat/sockguard/v2`, so Go users can pin a candidate by tag and `@latest` resolves to v2.3 once v2.3.0 is published; Docker, Homebrew, deb and rpm installs are unchanged. Also on the line: legacy `HostConfig.Tmpfs` held to `allow_tmpfs_privileged_options`, the remote-context grant required for raw LLB remote sources, the reserved `BUILDKIT_SYNTAX` frontend override rejected on restricted Dockerfile builds, OCI image loads bounded by cumulative logical blob size, and object-shaped secret `Driver` selection behind `allow_custom_drivers` |
 | **v2.x** | Security Hardening | Continued mutation-test hardening of the rule-evaluation core and config validators |
 | **v2.x** | Supply Chain | `egress-policy: block` with curated allow-lists on high-privilege release jobs |
 | **v2.x** | Policy Refinement | Named rule path aliases and further response-policy refinement |

docs/content/docs/roadmap.mdx

@@ -51,7 +51,7 @@ BuildKit and Podman's builder each do. v2.2.10 is a tenth security patch:
 native Podman pod create refuses any nonempty `infra_conmon_pid_file`,
 matching the container-create `conmon_pid_file` refusal and preventing a
 caller-selected host PID-file write. [v2.3.0-rc.8](https://github.com/CodesWhat/sockguard/releases/tag/v2.3.0-rc.8)
-is the current candidate for the next line; v2.3.0 is not stable yet. This roadmap describes direction and priorities, not
+is the latest published candidate for the next line; v2.3.0-rc.9 will carry the 2.2.11 fixes, and v2.3.0 is not stable yet. This roadmap describes direction and priorities, not
 promises about dates. A feature is available only after the release notes say
 it has shipped.
 
@@ -122,7 +122,9 @@ and [TLS scan](https://github.com/CodesWhat/sockguard/actions/runs/38828636275)
 passed on rc.8's exact head, `3d959fe3`. The soak used a mock daemon,
 completed 257,857,747 requests with zero request errors, and recorded
 3,739,648 bytes of RSS growth, below the 64 MiB threshold. This does not
-validate real BuildKit workloads. GA is no earlier than 2026-10-23.
+validate real BuildKit workloads. v2.3.0-rc.9 carries the 2.2.11 fixes into
+the candidate line and needs its own soak, TLS scan and published-image
+conformance run before GA, which is no earlier than 2026-10-23.
 Every new candidate needs a fresh four-hour soak and TLS scan; a candidate
 containing only fixes already released on the v2.2 line keeps the date,
 while a v2.3-only behavior change restarts the 14-day window.

website/src/lib/site-content.ts

@@ -390,7 +390,7 @@ export const roadmap: Milestone[] = [
     items: [
       "Implemented in v2.3.0-rc.8, awaiting stable release: individual raw-LLB ExecOp digest approvals, external frontend gateway mediation and the pinned companion runner; opaque in-daemon frontends and interactive execution stay denied",
       "The /v2 Go module migration is in the candidate, including imports, release linker flags and regenerated BuildKit descriptors; Docker, Homebrew, deb and rpm installation paths are unchanged",
-      "rc.8 carries the 2.2.10 pod infra PID-file refusal; its four-hour soak and TLS validation passed on the exact head, and every new candidate requires fresh validation. GA remains no earlier than 2026-10-23",
+      "rc.9 carries the 2.2.11 fixes into the candidate line; rc.8's four-hour soak and TLS validation passed on its exact head, and rc.9 needs fresh validation. GA remains no earlier than 2026-10-23",
     ],
   },
 ];