PastureStack Hosts File Updater

hosts-file-updater populates a managed container's /etc/hosts file from a legacy metadata service. This repository is maintained by the PastureStack community as a compatibility project.

Independent Community Project

PastureStack is an independent community effort to preserve, audit, and modernize the Rancher 1.6 ecosystem. It is not affiliated with or endorsed by Rancher Labs or SUSE.

Upstream: rancher/etc-host-updater. This GitHub fork retains the upstream Git history, authorship, dates, and license notices unchanged; PastureStack maintenance is consolidated into one commit after the preserved upstream boundary.

Third-party names and marks remain the property of their respective owners. See ORIGIN.md, COMPATIBILITY.md, and the unchanged NOTICE for provenance and compatibility details.

Names and Compatibility

The preferred executable is hosts-file-updater. Builds also provide an etc-host-updater executable alias because existing catalog templates invoke that exact legacy command.

The default metadata base URL remains:

http://metadata/2015-12-19

Use --metadata-url to point a development or isolated deployment at a mock service without changing the legacy default:

./bin/hosts-file-updater \
  --metadata-url http://127.0.0.1:18080/2015-12-19

The service polls /version, reads /hosts, validates hostnames and agent IP addresses, and writes the resulting host entries to /etc/hosts.

Build

Build the preferred executable and compatibility alias on Linux:

./scripts/build

The outputs are:

bin/hosts-file-updater
bin/etc-host-updater -> hosts-file-updater

The maintained container image name is:

ghcr.io/pasturestack/hosts-file-updater:v0.0.4

The current published release is v0.0.4. Use the numeric image tag above for deployment; it preserves the existing metadata and compatibility-command contracts.

Safe Quick Test

The test suite uses an in-process mock metadata server and a temporary hosts file. It does not write the development machine's /etc/hosts:

go test ./...

Production Runtime Warning

Normal service execution rewrites /etc/hosts and therefore intentionally runs as root in the legacy sidekick deployment model. Do not run the service directly on a development host. Test it in an isolated container or VM, and read SECURITY.md before deployment.

License and Original Attribution

The project remains licensed under the Apache License, Version 2.0. The existing LICENSE and NOTICE files are preserved.

PastureStack's later modifications do not remove or replace the original authors' copyright, attribution, or project history. Exact legal attribution is preserved in NOTICE and ORIGIN.md.

October 2026 security maintenance

Maintained Go builds select the patched Go 1.27.3 compiler without raising the existing Go language requirement. Ubuntu build/runtime stages apply the checksum-pinned ca-certificates 20260816ubuntu0.26.04.1 security package after their frozen APT baseline; the final trust store and installed version are verified. Release artifacts must pass the repository's existing checks before publication.

Full-severity release policy

Release verification retains the complete runtime vulnerability report. Every finding with an official fix blocks release, regardless of severity. Unknown findings block unless a separately reviewed, exact not-affected statement is proved by the actual product dependency graph. LOW/MEDIUM findings without an official fix require the repository's exact CVE/package/version/PURL review ledger; new or changed findings fail closed. This policy-only update does not replace any already published immutable artifact.