All pull requests

Pull requests

• cgroup: cap RAM when only cgroup_mem_memsw_max is set

  #367·ilyas-mallah opened Oct 21, 2026·

  ·

• nstun: add a bounds-checked reader for IP parsing

  #366·agusgarcia3007 opened Oct 19, 2026·

  ·
  1

• net, contain: run under gVisor (skip an unused link cache, tolerate a no-op RLIMIT_MSGQUEUE EPERM)

  #365·rubenfiszel opened Oct 18, 2026·

  ·
  2

• nstun: drain TCP listener at flow capacity

  #364·elnadym165 opened Oct 13, 2026·

  ·
  1

• pid: fail closed when dummy init setup fails

  #363·ikeago opened Oct 12, 2026·

  ·
  1

• nstun: enforce REDIRECT selectors on inbound traffic

  #362·paulchum opened Oct 11, 2026·

  ·
  1

• Open seccomp policy file with O_NOFOLLOW

  #361·kalt2212 opened Oct 10, 2026Contributor·

  ·

• mnt: ignore non-mandatory and nested submount remount failures in legacy backend (fixes #355)

  #359·jdymitarai opened Oct 8, 2026·

  ·

• security: ensure ro mounts are propagated to submounts

  #358·Matir opened Oct 7, 2026Member·

  ·

• nstun: reject direct guest flows destined to parent host-local routes (fixes #356)

  #357·jdymitarai opened Oct 4, 2026·

  ·

• nstun: drop IPv4 multicast destinations

  #354·g0w6y opened Oct 1, 2026Contributor·

  ·
  1

• subproc: mark supervisor fds CLOEXEC before helper exec

  #351·ManoharPaturi opened Sep 27, 2026·

  ·
  3

• [logs] finish writing log messages on short writes

  #350·ManoharPaturi opened Sep 27, 2026·

  ·
  2

• [net] close the listening socket on setup failure and open sockets CLOEXEC

  #349·ManoharPaturi opened Sep 27, 2026·

  ·
  2

• [cgroup] fix uint32 overflow in CPU quota computation

  #348·ManoharPaturi opened Sep 27, 2026·

  ·
  3

• mnt: retry read-only remounts on EBUSY

  #347·HanziJiang opened Sep 23, 2026·

  ·

• cgroup2: harden subtree controller detection and add O_CLOEXEC

  #346·filtede98 opened Sep 23, 2026·

  ·

• logs: add --log_stderr_level for an independent stderr log threshold

  #345·HanziJiang opened Sep 21, 2026·

  ·
  2

• mnt: fail closed when applying mount flags or final remount fails

  #344·Yudis-bit opened Sep 20, 2026·

  ·
  1

• ci: attest published container images

  #343·mcc0nnell opened Sep 18, 2026·

  ·

• cgroup2: enforce memsw-only limits when memory.max is unset

  #342·TUYU-42 opened Sep 16, 2026·

  ·
  1

• Add security hardening notes: pidfd proposal, unotify observational limits

  #341·Mohamed-elnady opened Sep 14, 2026·

  ·

• Add ASan+UBSan build target, libFuzzer harnesses (nstun, kafel), CI fuzz-smoke workflow

  #340·Mohamed-elnady opened Sep 14, 2026·

  ·

• Add compiler hardening (Full RELRO, stack protector, FORTIFY_SOURCE)

  #339·Mohamed-elnady opened Sep 14, 2026·

  ·
  1

• mnt: fail closed when applying new-API mount flags

  #338·atharvmantri opened Sep 14, 2026·

  ·
  1

  2