v1.11.0

6 min read

Release Notes

These release notes describe all changes since the previous minor release, v1.10.0, not since the most recent 1.10.x patch. Some of the fixes and enhancements listed below were also delivered in the intervening v1.10.x patch releases; they are repeated here so this page is a complete record of what changed between 1.10.0 and 1.11.0.

New Features & Enhancements

Installer

• Added support to optionally install and boot into the Edera host kernel. The option is enabled by default on Xen and disabled on KVM, where kernel compatibility is assumed instead. Enabling the option on KVM installs the Edera host kernel, updates GRUB, and boots into it.

Kubernetes

• Added support for applying seccomp and AppArmor confinement profiles to Kubernetes-driven workloads.
• Added a Containerd shim so zones can be driven directly through the Containerd runtime interface, enabling integration with Containerd-based orchestration (for example, standard Kubernetes CRI paths).

Core

• Added the ability to fork zones from a pre-suspended state, with support for concurrent create/fork operations and new CLI commands to drive the workflow, aimed at faster zone spin-up.
• Added the ability to configure CPU turbo boost and frequency-governor behavior for the daemon. See the [power] section of daemon.toml.
• Added host_memory_available_bytes, hypervisor_memory_total_bytes, and hypervisor_memory_available_bytes to the /metrics endpoint, exposing machine-wide memory alongside the existing dom0-scoped host metrics. See the metrics reference for details.
• Added support for selecting among Edera-provided kernel variants when booting a zone, as well as defining custom variants.
• Enabled compressed RAM-backed swap for zones, improving memory headroom under pressure without relying on disk-backed swap.
• Added early init logging, improving visibility into boot failures that previously happened before logging was available.
• Moved the 9p filesystem backend into the storage daemon rather than as a separate component, simplifying the storage path for zone volumes.
• Restructured the 9pfs backend to be NUMA-aware, improving I/O locality and throughput on multi-socket/multi-NUMA-node hosts.
• Added support for booting standard raw or qcow2 disk images directly as zones without conversion, broadening compatibility with existing VM images.
• Added a Rust-based implementation of xenstored, the Xen store daemon, for improved memory safety and reliability.
• Added a dedicated Rust-based network backend (protect-network), a significant architectural change improving the safety, performance, and maintainability of zone networking. Requires enabling the vif-protect-network-v0 feature flag.
• Added support for running arm64 guests under the Xen platform, extending architecture coverage beyond x86.
• Added support for enforcing seccomp filters inside zones, restricting the syscalls workloads can make and shrinking the kernel attack surface.
• Added support for publishing SBOMs and attestations alongside released OCI artifacts, supporting supply chain verification of what’s shipped.
• Introduced object-capability-based (OCAP) privileged invocation over the IDM channel, a sudo-like model scoped to capabilities rather than blanket privilege. Requires enabling the object-capabilities-v0 feature flag.
• Added a Docker Engine API, allowing Docker tooling and clients to create and manage zones as if they were Docker containers.

Integrations

• Updated Cloud Hypervisor from v51.0 to v52.0.
• Added preliminary SPIRE (SPIFFE Runtime Environment) support, enabling workload identity/attestation infrastructure. Requires enabling the spire-v0 feature flag; see the [spire] section of daemon.toml for agent/server configuration.

Bug Fixes

Kubernetes

• Fixed the CRI reporting of a container’s final state and exit status when it’s torn down, so orchestrators see accurate termination info.
• Fixed teardown of CNI plugins to occur in the reverse of their configured order, matching expected CNI semantics for cleanup.
• Added retry logic when spawning a CNI plugin binary hits ETXTBSY, preventing spurious network setup failures.
• Ensured seccomp profiles requested through the CRI shim are actually applied to the workload rather than silently dropped.

Core

• Zone kernel-event delivery no longer breaks when a client falls behind; it now warns instead of failing hard.
• Fixed reporting when the KVM VMM task is terminated by a signal rather than exiting normally.
• Fixed the e820 memory map so the reserved block is properly accounted for within the zone’s memory allocation.
• Improved reliability for the xenclient and xenstore components.
• Addressed multiple resiliency issues found in the Xen platform layer.
• Prevented the daemon from resyncing workloads before a zone has actually reached the Ready state.
• Routed path calculation for workload/sandbox injections through a single resolver, fixing inconsistent path handling.
• Ensured backend teardown on network destruction is logged rather than silently dropped.
• Fixed a zone mount failure (ENOENT) that occurred specifically for block-device-backed mounts.
• Fixed a daemon reconcile-loop bug where an unpinned sleep future could misbehave.
• Ensured the KVM runtime waits for virtiofsd to be reaped before releasing the domain ID, avoiding a use-after-free-style race.
• Improved performance in the IDM (identity/messaging) subsystem.
• Improved reliability of zone startup.
• Fixed the resync snapshot so newly created workloads are correctly reflected as Created rather than missing/incorrect state.
• Hid sensitive host paths from unprivileged zone workloads, closing an isolation gap.
• Fixed a hang in protect-daemon triggered by rapid, repeated zone allocation.
• Switched the capability model to default-deny with an explicit allow-list, tightening the default security posture.
• Fixed zone CPU-usage reporting to smooth out spikes the way cAdvisor does, for more consistent metrics.
• Ensured every zone gets the correct xenstore permission set, closing a gap where some zones didn’t.
• Fixed forked zone children so their device tree is rebuilt correctly and guest frontends can reconnect.
• Capped IDM per-request state so a flood of requests from a zone can’t exhaust daemon resources.
• Closed a symlink-traversal vulnerability where a guest could redirect a bind mount to an unintended host path.
• Fixed read-only remounting of zone volumes to use the resolved real path instead of /proc/self/fd, avoiding a race/bypass.
• Applied a set of hardening fixes identified by automated security analysis of the codebase.
• Ensured a zone that failed (for example, due to insufficient memory) stays reported as failed rather than flapping, with an added e2e test.
• Fixed df reporting per volume by giving each zone volume a distinct 9p mount instead of sharing one.
• Closed a path-traversal issue where a malicious OCI image symlink could point outside its image directory.
• Fixed xenstored to fail loudly instead of continuing in a broken state when it can’t map the dom0 ring.
• Fixed domain creation on newer Xen (4.22) by passing DOMID_ANY as expected by that version’s hypercall interface.
• Fixed a correctness assumption in the Xen platform where newly populated guest memory pages weren’t guaranteed to be zeroed.
• Fixed KVM networking to correctly handle interfaces with non-default MTU values.
• Ensured kernel events for failed syscalls are still captured and emitted instead of being dropped.
• Restricted protect-monitor to an observe-only role and adjusted the dom0 resource limit accordingly.
• Brought the IDM performance improvements previously made for Xen over to the KVM backend.
• Fixed vCPU count reporting to use the value the hypervisor actually provides, rather than an assumed/derived value.
• Aligned the PVH paging memory pool sizing with libxl’s calculation to avoid undersized pools.

Known Issues

KVM support

• PCI passthrough is not supported.
• NUMA support is not enabled.
• Memory ballooning is not supported.

Upgrade notes

There are no known breaking changes in this release from the previous minor or patch release.