All notable changes to this project will be documented in this file.
- Fix to allowing running x86 apps in Sysbox containers (issue #350).
- Fix sysbox-fs nsenter mount leak.
- Fix sysbox emulation of /proc and /sys in containers for kernels 6.5+.
- Add hardening against CVE-2024-21626.
- Fix ordering of mounts under /run for containers with systemd (issue #767).
- Fix to ensure "docker --net=host" works inside Sysbox containers (issue #712).
- Fix bug when mounting host kernel headers into containers (issue #727).
- Fix emulation of /sys/devices/virtual/* inside containers (issue #719).
- Don't intercept *xattr syscalls by default (improves performance).
- Add feature to skip shiftfs and idmapping on specific container files/dirs (via
SYSBOX_SKIP_UID_SHIFTcontainer env var). - Fix bug with fsuid-map-fail-on-error config option.
- Fix bug with pivot-root inside Sysbox containers (ensures docker:24-dind image can run inside Sysbox containers).
- sysbox-deploy-k8s: add support for Kubernetes v1.27 and v1.28.
- sysbox-deploy-k8s: automatically detect installation on GKE clusters and set up configs accordingly.
- sysbox-deploy-k8s: support installation on Debian-based K8s nodes.
- sysbox-deploy-k8s: don't install shiftfs on K8s nodes with kernel >= 5.19.
- sysbox-deploy-k8s: deprecated support for K8s v1.24 and v1.25 (EOL'd).
- Fix bug in Sysbox's checking of host support for idmapping and shiftfs.
- Fix storage leak in /var/lib/sysbox when using Sysbox on K8s clusters.
- Fix bug in Sysbox's handling of "docker run -w" flag.
- Change disable-inner-image-preload flag to allow running (but not committing) sysbox containers with preloaded inner images.
- Set disable-inner-image-preload flag in Sysbox K8s deployments to improve performance when stopping pods.
- Added support for ID-mapped overlayfs lower layers; eliminates need for shiftfs and Sysbox rootfs chown; requires kernel 5.19+.
- Have Sysbox perform shiftfs and ID-mapping functional checks during init (issue #596).
- Fixed rootfs cloning to prevent inode leakage (for hosts with kernel < 5.19 and no shiftfs) (issue #570).
- Added support for Kubernetes v1.24 to v1.26.
- Added --disable-inner-image-preload flag to sysbox-mgr (speeds up Sysbox container startup).
- Added --syscont-mode flag to sysbox-mgr; allows Sysbox to work in system container mode (default) or regular container mode; the latter is meant for running microservices with stronger isolation.
- Added --disable-shiftfs-on-fuse flag to sysbox-mgr; prevents Sysbox from mounting shiftfs on top of FUSE-backed filesystems (some of which don't work with shiftfs).
- Added few optimizations to expedite I/O operations in procfs/sysfs emulated resources.
- Enhanced life-cycle management of Sysbox daemons in Systemd-free scenarios.
- Prevented concurrent execution of Sysbox daemons (multi-instance problem).
- Improved the handling of ungraceful shutdown scenarios.
- Eliminated Sysbox dependencies on configfs kernel module presence.
- Fixed emulation of /sys/module/nf_conntrack/parameters inside containers.
- Added emulation of /sys/devices/virtual/dmi branch inside containers (for hosts where this or inner resources is not present).
- Hide /sys/kernel/security inside containers (issue #662)
- Don't assign more capabilities to the container than those given to Sysbox itself.
- Don't fail in kernel distros without /lib/modules/.
- Increased the pods-per-node limit from 16 to 4K (Sysbox-CE now matches Sysbox-EE on this regard).
- Extended kubelet config-detection process to multiple drop-in files in sysbox-deploy-k8s daemon-set.
- Incorporated taints during sysbox-deploy-k8s installation process.
- Fixed issue preventing sysbox-deploy-k8s installation in rke2 environments (issue #614).
- Fixed issue preventing proper sysbox-deploy-k8s installation in Azure (issue #612).
- Fixed issue #544 preventing containers initialization within sysbox containers when running latest oci-runc releases (1.1.0-rc.1+).
- Added support to allow CIFS mounts within Sysbox containers (Sysbox-EE only).
- Fixed issue to allow shiftfs mounts over files that are themselves bind-mounts.
- Added support for Linux ID-mapped mounts (shiftfs alternative in kernels >= 5.12).
- Added support for ARM64 hosts.
- Added support for running buildx/buildkit inside Sysbox containers.
- Added support for running Rancher RKE2 and Mirantis K0s inside Sysbox containers.
- Added configs to disable trapping chown and xattr* syscalls (improves performance but may reduce functionality).
- Added config to strictly honor container capabilities from higher-level container manager.
- Added support for per-container configs via
SYSBOX_*env vars. - Improved performance of Sysbox's syscall interception code.
- Improved the way Sysbox releases the seccomp-fd handles for intercept syscalls (kernels >= 5.8).
- Improved Sysbox's cross-compilation support (artifacts can now be generated from/to either AMD64 or ARM64 hosts).
- Update to golang 1.16.
- Replaced the per-distro *.deb installation packages with a single deb bundle package.
- Allow alternative Docker data-root inside a Sysbox container (if Docker is pre-installed in the Sysbox container image).
- Fixed segfault when building Docker image inside Sysbox container (issue #484).
- Fixed segfault when running python pip install inside nested sysbox container (issue #485).
- Fixed issue with running KinD inside a Sysbox container (issue #415).
- Fixed problem with shiftfs mounts on Kubernetes persistent volumes (issue #431).
- None.
- Added important optimization to expedite the container creation cycle.
- Enhanced uid-shifting logic to perform shifting operations of Sysbox's special dirs on a need basis.
- Added support for Kinvolk's Flatcar Linux distribution (Sysbox-EE only).
- Added basic building-blocks to allow Sysbox support on ARM platforms.
- Fixed issue preventing Sysbox folders from being eliminated from HDD when Sysbox is shutdown.
- Enable sys container processes to set 'trusted.overlay.opaque' xattr on files (issue #254).
- Fixed bug resulting in the failure of "mount" operation within a sys container.
- Made various enhancements to Sysbox's kubernetes installer to simplify its operation.
- Extend Sysbox's kubernetes installer to support Rancher's RKE k8s distribution.
- Added support to create secure Kubernetes PODs with Sysbox (sysbox-pods).
- Added support for Cgroups-v2 systems.
- Added support to allow K3s execution within Sysbox containers.
- Extended Sysbox support to Fedora-33 and Fedora-34 releases.
- Extended Sysbox support to Flatcar Linux distribution.
- Modified Sysbox binaries' installation path ("/usr/local/sbin" -> "/usr/bin").
- Enhanced generation and handling of logging output by relying on systemd (journald) subsystem.
- Multiple enhancements in /proc & /sys file-system's emulation logic.
- Extended installer to allow it to deploy Sysbox in non-strictly-supported distros / releases.
- Improved security of shiftfs mounts.
- Fixed issue impacting sysbox-fs stability in scaling scenarios (issue #266).
- Fixed issue preventing sys-container initialization due a recent change in oci-runc (issue #291).
- Fixed issue with "--mountpoint" cli knob being ignored (sysbox issue #310).
- Fixed issue causing sysbox-fs handlers to stall upon access to a procfs node (issue #306).
- Fixed issue preventing write access to 'domainname' procfs node (issue #287).
- Fixed issue preventing systemd-based containers from being able to initialize (issue #273).
- Made changes to allow Docker network sharing between containers.
- Ensure that Sysbox mounts in read-only containers are mounted as read only.
- Deprecated EOL'd Fedora-31 and Fedora-32 releases.
- Secured system container initial mounts (mount/remount/unmounts on these from within the container are now restricted). See here for details.
- Improved Sysbox systemd service unit files (dependencies, open-file limits).
- Improved logging by sysbox-mgr and sysbox-fs (json logging, more succint logs).
- Added support for systemd-managed cgroups v1 on the host (cgroups v2 still not supported).
- Added support for read-only Docker containers.
- Synced-up sysbox-runc to include the latest changes from the OCI runc.
- Added support for Debian distribution (Buster and Bullseye).
- Added ground-work to support Sysbox on RedHat, Fedora, and CentOS (next step is creating a package manager for these).
- Added config option to configure the Sysbox work directory (defaults to /var/lib/sysbox).
- Added support and required automation for Sysbox-in-Docker deployments.
- Fixed sporadic session stalling issue during syscall interception handling.
- Fixed sysbox-mgr file descriptor leak (sysbox issue #195).
- Fixed problem with "docker --restart" on Sysbox containers (sysbox issue #184).
- Fixed race condition in sysbox-fs procfs & sysfs emulation.
- Fixed problem preventing kernel-headers from being properly imported within sys containers.
- Fixed inappropriate handling of mount instructions in chroot jail environments.
- None.
- Created debian packages for first community-edition release.
- Fixed package installer bug preventing 'shiftfs' feature from being properly utilized.
- Enhanced package installer to prevent network overlaps between inner and outer containers.
- Deprecated support of Ubuntu's EOL release: Eoan (19.10).
- Added initial Kubernetes-in-Docker support to enable secure, flexible and portable K8s clusters.
- Added support for running privileged-containers within secure system containers.
- Added support for containerd to run within system containers.
- Made multiple performance improvements to expedite container initialization and i/o operations.
- Added support for Ubuntu-Eoan (19.10) and Ubuntu-Focal (20.04).
- Extended support for Ubuntu-Cloud releases (Bionic, Eoan, Focal).
- Enhanced Sysbox documentation.
- Deprecated support of Ubuntu's EOL releases: Ubuntu-Disco (19.04) and Ubuntu-Cosmic (18.10).
- Created Sysbox Quick Start Guide document (with several examples on how to use system containers).
- Added support for running Systemd in a system container.
- Added support for the Ubuntu shiftfs filesytem (replaces the Nestybox shiftfs).
- Using
docker buildto create a system container image that includes inner container images. - Using
docker committo create a system container image that includes inner container images. - Added support for mounts over a system container's
/var/lib/docker(for persistency of inner container images). - Made multiple improvements to the Sysbox User's Guide and Design Guide docs.
- Rebranded 'sysboxd' to 'sysbox'.
- Deprecated Nestybox shiftfs module.
- Extend installer support to latest Ubuntu kernel (5.0.0-27).
- Initial public release.
- Added external documentation: README, user-guide, design-guide, etc.
- Extend support to Ubuntu-Bionic (+5.x kernel) with userns-remap disabled.
- Added consistent versioning to all sysboxd components.
- Increased list of kernels supported by nbox-shiftfs module (refer to nbox-shiftfs module documentation).
- Add changelog info to the debian package installer.
- Internal release (non-public).
- Supports launching system containers with Docker.
- Supports running Docker inside a system container.
- Supports exclusive uid(gid) mappings per system container.
- Supports partially virtualized procfs.
- Supports docker with or without userns-remap.
- Supports Ubuntu Disco (with userns-remap disabled).
- Supports Ubuntu Disco, Cosmic, and Bionic (with userns-remap enabled).
- Includes the Nestybox shiftfs kernel module for uid(gid) shifting.