hakurei, branch v0.3.1

release: 0.3.1

2025-11-11T15:53:14Z

Signed-off-by: Ophestra

container: set FD_CLOEXEC on all open files

2025-11-11T15:18:29Z

While fd created from this side always has the FD_CLOEXEC flag, the same is not true for files left open by the parent. This change prevents those files from leaking into the container. Signed-off-by: Ophestra

container/init: close setup pipe early

2025-11-10T22:31:58Z

This prevents leaking the setup pipe. Signed-off-by: Ophestra

container/init: close initial process files on termination

2025-11-10T11:35:59Z

This closes them during the adopt wait delay. This also keeps them alive. Signed-off-by: Ophestra

treewide: reject impossible user-supplied fd

2025-11-10T11:31:26Z

These are all trusted user input, however this check reduces the likelihood of hard to debug errors. Signed-off-by: Ophestra

cmd/hakurei: expose current instance identifier

2025-11-09T22:52:35Z

This writes the 16-byte instance identifier to file descriptor specified by --identifier-fd if set, and closes the file. This enables safely obtaining the new instance's identifier. Signed-off-by: Ophestra

internal/outcome: handle group lookup message

2025-11-08T17:15:48Z

This results in slightly less messy error reporting. Signed-off-by: Ophestra

nix: update names to reflect new terminology

2025-11-08T16:48:31Z

These are terminology from way early days. Update them now to be less confusing. Signed-off-by: Ophestra

container/std/seccomp: remove ineffectual typecast

2025-11-06T20:45:51Z

This is no longer necessary since the return type changed. Signed-off-by: Ophestra

container/seccomp/presets: add fields to literals

2025-11-06T20:11:57Z

This keeps composites analysis happy. Signed-off-by: Ophestra