All pull requests

Pull requests

• mnt: retry read-only remounts on EBUSY

  #347·HanziJiang opened Sep 23, 2026·

  ·

• cgroup2: harden subtree controller detection and add O_CLOEXEC

  #346·filtede98 opened Sep 23, 2026·

  ·

• logs: add --log_stderr_level for an independent stderr log threshold

  #345·HanziJiang opened Sep 21, 2026·

  ·
  2

• mnt: fail closed when applying mount flags or final remount fails

  #344·Yudis-bit opened Sep 20, 2026·

  ·
  1

• ci: attest published container images

  #343·mcc0nnell opened Sep 18, 2026·

  ·

• cgroup2: enforce memsw-only limits when memory.max is unset

  #342·TUYU-42 opened Sep 16, 2026·

  ·
  1

• Add security hardening notes: pidfd proposal, unotify observational limits

  #341·Mohamed-elnady opened Sep 14, 2026·

  ·

• Add ASan+UBSan build target, libFuzzer harnesses (nstun, kafel), CI fuzz-smoke workflow

  #340·Mohamed-elnady opened Sep 14, 2026·

  ·

• Add compiler hardening (Full RELRO, stack protector, FORTIFY_SOURCE)

  #339·Mohamed-elnady opened Sep 14, 2026·

  ·
  1

• mnt: fail closed when applying new-API mount flags

  #338·atharvmantri opened Sep 14, 2026·

  ·
  1

  2

• config: Fix overflow in rlimit unit conversion

  #337·HazEOskA opened Sep 13, 2026·

  ·

• logs: refuse symlink log targets

  #336·ManyGlue0 opened Sep 13, 2026·

  ·
  1

• util: add optional -fbounds-safety annotation for readFromFd

  #335·LaptopsPlural opened Sep 11, 2026·

  ·

• mnt: fail closed when explicit security mount flags cannot be applied

  #334·HazEOskA opened Sep 11, 2026·

  ·

• nstun: preserve bounds in selected network buffer paths with std::span

  #333·YuvalFradkin1 opened Sep 11, 2026·

  ·
  1

• contain: fail closed when setpriority fails

  #332·HazEOskA opened Sep 10, 2026·

  ·
  1

• mnt: keep locked mount flags when remounting the jail root read-only

  #330·sanil18 opened Sep 10, 2026·

  ·

• mnt: new mount API backend ignores a mount's source under --chroot /

  #329·sanil18 opened Sep 10, 2026·

  ·

• contain: fail closed on incomplete file descriptor cleanup

  #328·canbolayir opened Sep 10, 2026·

  ·

• mnt: reject untrusted staging work directories

  #327·mcc0nnell opened Sep 10, 2026·

  ·

• nstun: avoid unaligned network address loads

  #326·mcc0nnell opened Sep 10, 2026·

  ·

• mnt: anchor legacy mount destinations to an O_NOFOLLOW parent fd

  #325·artemkulyk opened Sep 6, 2026·

  ·

• cpu: fail closed when --max_cpus exceeds available CPUs

  #324·h1-mrz opened Sep 3, 2026Contributor·

  ·
  2

• logs: refuse symlinks when opening the log file (O_NOFOLLOW)

  #323·h1-mrz opened Sep 3, 2026Contributor·

  ·
  2

• tests: build and run path_containment_test

  #322·andreeapid opened Sep 1, 2026·

  ·
  1