v1.12.0

4 min read

Release Notes

These release notes describe all changes since the previous minor release, v1.11.0, not since the most recent 1.11.x patch. Some of the fixes and enhancements listed below were also delivered in the intervening v1.11.x patch releases; they are repeated here so this page is a complete record of what changed between 1.11.0 and 1.12.0.

New Features & Enhancements

Kubernetes

  • The Containerd shim is now the default CRI integration for new installs. See Upgrade notes.
  • Added CRI-O integration, including AppArmor support, alongside the existing Containerd shim.
  • Added PCI device passthrough support for workloads run through the Containerd shim.
  • The Helm chart now performs privileged host setup with an init container instead of a privileged DaemonSet.

Core

  • KVM zones now survive a protect-daemon restart: the daemon adopts already-running KVM zones instead of destroying and recreating them. Configurable via the [kvm] section of daemon.toml.
  • Zone forking now carries a zone’s running workloads through the fork, including console and session state, instead of forking only the zone’s memory.
  • Added the ability to hotplug an additional host-directory volume into a running workload without recreating the zone.
  • Improved Xen PVH zone boot performance by building a domain’s initial memory with a copy hypercall instead of mapping it.
  • When the object-capabilities-v0 feature is enabled, OCI image fetch and pack now run in their own capability-scoped processes instead of in the daemon.
  • Consolidated protect-meminfo into protect-monitor and fixed a startup-ordering issue between them.
  • Added an alpha, opt-in zone-services-v0 feature: a zone can advertise a name that every other zone resolves to its address through /etc/hosts. See the zone-services-v0 feature flag.

Observability

  • Added zone_memory_target_bytes, zone_memory_min_bytes, and zone_memory_adjustment_policy metrics exposing each zone’s active memory-sizing (balloon) policy, plus per-NUMA-node vmstat snapshots and a last-transition timestamp alongside the existing memory-pressure metrics. See the metrics reference for details.

Integrations

  • Updated Cloud Hypervisor to v53.
  • Expanded SPIRE workload attestation with SVID projection and per-workload socket grants, along with a new protect-ctl host spire-start command to launch a SPIRE server zone. Requires the spire-v0 feature flag.

Bug Fixes

Kubernetes

  • Fixed ExecSync CRI calls to use the workload’s environment.
  • Fixed CNI plugins to tolerate non-compliant VERSION command handlers.
  • The installer now detects a non-default CNI plugin binary directory configured via containerd, and seeds cri.toml appropriately.
  • The kubelet container runtime endpoint is now set with a systemd drop-in that appends --container-runtime-endpoint to ExecStart, instead of rewriting kubelet’s environment variables.
  • Fixed protect-ctl workload exec to run inside the workload’s cgroup.
  • Fixed a fallocate regression, multi-container networking, and OCI layer handling in the Containerd shim, and improved image import times.
  • SPIRE agent-socket access inside a SPIRE-enabled zone is now opt-in per workload by default, instead of open to every workload.

Core

  • Fixed a dom0 boot failure on PVH hosts, in some configurations.
  • Removed the mixed node type from protect-monitor. It now defaults to edera, which is the only recommended mode.
  • Fixed oversized IDM packets being silently dropped instead of fragmented, which could leave a pod stuck in CreateContainerError when many environment variables were injected into a workload launch request (for example, via Kubernetes’ enableServiceLinks).
  • Fixed IDM to terminate served streams when the transport reconnects.
  • Fixed a seccomp filter bug where a rule’s action could match without its configured errno taking effect.
  • Hardened the object-capability session protocol: capability names are validated as plain relative paths, and handlers refuse methods they haven’t opted in to.
  • Fixed concurrent Xen domain destroys spinning inside the hypercall.
  • The KVM runtime now accepts empty-body 200 responses from Cloud Hypervisor.

Observability

  • Fixed zone CPU-time metrics running far faster than real time, on both Xen and KVM.

Installer

  • Denylisted virtio-balloon under Xen.
  • Increased dom0 memory by 128 MiB by default when Kubernetes is enabled.
  • Fixed an issue with dracut 107, present in Azure Linux 4, where --hostonly packs only the filesystem modules currently loaded and skips the mounted-filesystem probe.

Known Issues

KVM support

  • NUMA support is not enabled.
  • Memory ballooning is not supported.

Upgrade notes

There are no known breaking changes in this release from the previous minor or patch release.

Containerd shim default for new installs

The containerd shim will be enabled by default for new installs but upgrades will continue to use the old CRI method.

Last updated on