Survey

Please take the Kata Containers survey:

• https://openinfrafoundation.formstack.com/forms/kata_containers_user_survey

This will help the Kata Containers community understand:

• how you use Kata Containers
• what features and improvements you would like to see in Kata Containers

Libseccomp Notices

The kata-agent binaries inside the Kata Containers images provided with this release are
statically linked with the following GNU LGPL-2.1 licensed libseccomp library.

• libseccomp

The kata-agent uses the libseccomp v2.5.5 which is not modified from the upstream version.
However, in order to comply with the LGPL-2.1 (§6(a)), we attach the complete source code for the library.

Kata Containers builder images

• agent (on all its different flavours): quay.io/kata-containers/builders:agent-8d4e72f0d-75ac09bab-1.80.0-x86_64
• Kernel (on all its different flavours): quay.io/kata-containers/builders:kernel-493ba63c7-x86_64
• OVMF (on all its different flavours): quay.io/kata-containers/builders:ovmf-75ac09bab-x86_64
• QEMU (on all its different flavurs): quay.io/kata-containers/builders:qemu-4c006c707-x86_64
• shim-v2: quay.io/kata-containers/builders:shim-v2-go-1.22.11-rust-1.80.0-75ac09bab-x86_64
• tools: quay.io/kata-containers/builders:tools-26bd7989b-fd6c16e20-b7786fbcf-75ac09bab-x86_64
• virtiofsd: quay.io/kata-containers/builders:virtiofsd-1.83.0-musl-1cf1a332a-x86_64

Installation

Follow the Kata installation instructions.

What's Changed

• genpolicy: bump oci-distribution to v0.12.0 by @katexochen in #10896
• agent: make policy feature optional again by @katexochen in #10895
• example: Use multi-arch image for test-deploy-kata-qemu.yaml by @BbolroC in #10894
• ci: Fix spell_check and improve header_check by @RuoqingHe in #10893
• gpu: QEMU SNP+TDX experimental updates by @zvonkok in #10867
• QEMU TDX experimental workflow by @zvonkok in #10868
• tests: Support systemd unit files in /usr/lib as well as /lib by @BbolroC in #10903
• agent: clear log pipes if denied by policy by @burgerdev in #10818
• GHA: Turn off MEASURED_ROOTFS in build-kata-static-tarball-s390x by @BbolroC in #10904
• shim-v2: Remove MEASURED_ROOTFS assignment for s390x by @BbolroC in #10906
• IOMMUFD GPU enhancement by @zvonkok in #10743
• dragonball: Appease clippy, setup workspace and centralize RustVMM by @RuoqingHe in #10780
• Disabling Nesting Check for SNP upstream by @arvindskumar99 in #10784
• minor build fixes by @mythi in #10881
• agent: Fix race condition with cgroup watchers by @sprt in #10911
• arm: ci: k8s: Enable CI by @fidencio in #10929
• workflows: Refactor publish workflows by @stevenhorsman in #10932
• build: Drop redundant ARCH override by @RuoqingHe in #10921
• gpu: IOMMUFD fix by @zvonkok in #10931
• runtime-rs: TEE support framework by @pmores in #10819
• agent: Fix non-guest-pull build by @fidencio in #10934
• runtime: add cause to CDI errors by @burgerdev in #10935
• genpolicy: add get_process_fields to CronJob by @burgerdev in #10654
• ci: Enable partial components build-check on riscv by @RuoqingHe in #10831
• genpolicy: fail when layer can't be processed by @katexochen in #10925
• genpolicy: support sysctls from PodSpec and environment defaults by @burgerdev in #10652
• workflows: Add codeql config by @stevenhorsman in #10930
• ci: k8s: Pin k0s version to get cri-o tests back working by @stevenhorsman in #10883
• versions: update confidential initrd to 22.04 by @ryansavino in #10803
• ci: arm64: Skip tests that depend on virt on non-virt capable runners by @fidencio in #10950
• ci: Add shellcheckrc by @zvonkok in #10953
• kata-deploy: Update kata-deploy to support microk8s by @stalb in #10846
• kata-deploy: k0s: Fix drop-in path by @fidencio in #10960
• gpu: add module signing by @zvonkok in #10870
• Fix virtio-net-ccw by @Jakob-Naucke in #10817
• gpu: fix init symlinks by @zvonkok in #10965
• Shell check errors fix by @stevenhorsman in #10958
• runtime: Properly set default hyp loglevel to 1 by @Camelron in #10955
• Rework and fix metrics issues by @stevenhorsman in #10954
• runtime-rs: Enable Dragonball only for x86_64 & aarch64 by @RuoqingHe in #10963
• agent: Fix default linux device permissions by @zvonkok in #10976
• agent: Enable VFIO and initContainers by @zvonkok in #10971
• agent: fix permisssion according to runc by @zvonkok in #10982
• tests: Bring back kata-deploy tests by @fidencio in #10966
• runtime: Remove console=ttysclp0 for s390x by @BbolroC in #10981
• kata-types: Fix bugs related to annotations in kata-types by @Apokleos in #10937
• runtime-rs: Fix log_level's comments in configuration-dragonball.toml.in by @teawater in #10975
• runtime-rs: Enable IBM SE for QEMU by @BbolroC in #10862
• ci: cri-containerd: upgrade the LTS / Active versions for containerd by @lifupan in #10876
• runtime-rs: remove snp certs path support from qemu-rs by @pmores in #10941
• runtime-rs: Remove s390x conditional compilation by @RuoqingHe in #10985
• add the Route flags suport when adding the route in the guest by @lifupan in #10760
• kata-deploy: Use docker.io for all architectures by @RuoqingHe in #10987
• gha: always delete workspace on rebase error by @danmihai1 in #10992
• runtime-rs: Add mem-agent config to clh and qemu config file by @teawater in #10998
• tests: k8s: log kubectl exec ouput by @danmihai1 in #11000
• ci: Refactor matrix for build-checks by @RuoqingHe in #10948
• ci: temporarily avoid using the Mariner Host image by @danmihai1 in #10973
• tests: fix confidential ssh Dockerfile by @ryansavino in #11006
• tests: k8s: skip trusted storage tests for qemu-tdx by @mythi in #11009
• runtime-rs: Add guest swap support by @teawater in #10994
• workflows: shellcheck: Expand vendor ignore by @stevenhorsman in #10990
• ci: Change the way we modify runtimeclass in webhook by @ldoktor in #10892
• runtime: upgrade grpc vendor dependency by @ms-mahuber in #11003
• kernel: Support and enable riscv kernel build by @RuoqingHe in #11001
• ci: Add coco required tests by @stevenhorsman in #10967
• genpolicy: Introduce UpdateRoutesRequest rules in genpolicy-settings by @...

Survey

Please take the Kata Containers survey:

• https://openinfrafoundation.formstack.com/forms/kata_containers_user_survey

This will help the Kata Containers community understand:

• how you use Kata Containers
• what features and improvements you would like to see in Kata Containers

Libseccomp Notices

The kata-agent binaries inside the Kata Containers images provided with this release are
statically linked with the following GNU LGPL-2.1 licensed libseccomp library.

• libseccomp

The kata-agent uses the libseccomp v2.5.5 which is not modified from the upstream version.
However, in order to comply with the LGPL-2.1 (§6(a)), we attach the complete source code for the library.

Kata Containers builder images

• agent (on all its different flavours): quay.io/kata-containers/builders:agent-8d4e72f0d-75ac09bab-1.80.0-x86_64
• Kernel (on all its different flavours): quay.io/kata-containers/builders:kernel-c95ae5a50-x86_64
• OVMF (on all its different flavours): quay.io/kata-containers/builders:ovmf-75ac09bab-x86_64
• QEMU (on all its different flavurs): quay.io/kata-containers/builders:qemu-4c006c707-x86_64
• shim-v2: quay.io/kata-containers/builders:shim-v2-go-1.22.11-rust-1.80.0-75ac09bab-x86_64
• tools: quay.io/kata-containers/builders:tools-ec0af6fbd-78b96a6e2-72833cb00-75ac09bab-x86_64
• virtiofsd: quay.io/kata-containers/builders:virtiofsd-1.83.0-musl-1cf1a332a-x86_64

Installation

Follow the Kata installation instructions.

What's Changed

• virtiofsd: Update ubuntu to 22.04 for gnu target by @RuoqingHe in #10741
• gpu: Fix rootfs build by @zvonkok in #10736
• gpu: Add rootfs target amd64/arm64 by @zvonkok in #10764
• Revert "gpu: Add rootfs target amd64/arm64" by @zvonkok in #10769
• ci: Unify on $GH_PR_NUMBER environment variable by @sprt in #10754
• Add reclaim_guest_freed_memory config to qemu and cloud-hypervisor by @teawater in #10711
• gpu: Add kernel dep for the non coco use-case by @zvonkok in #10770
• ci: Retry on failure of Create AKS cluster by @RuoqingHe in #10773
• agent: Update ttrpc to include the fix for connectivity issues by @fidencio in #10775
• workflows: Switch to github-hosted arm runners by @stevenhorsman in #10776
• agent: Ensure proper cgroupsV2 handling with init_mode=true by @zvonkok in #10778
• libs/kata-types: Remove config enable_swap by @teawater in #10762
• gpu: Fix arm64 kernel build by @zvonkok in #10777
• rootfs-confidential: Ensure systemd is used as init by @fidencio in #10755
• rootfs: minor systemd file deletion cleanup by @danmihai1 in #10732
• kernel: Ensure no cgroupsv1 is used by @fidencio in #10720
• workflows: Move arm static checks runner by @stevenhorsman in #10779
• virtiofsd: Enable build for RISC-V by @RuoqingHe in #10740
• Remove shebang in non-executable completion script by @balintTobik in #10766
• build(deps): bump the go_modules group across 3 directories with 1 update by @dependabot in #10768
• metrics: Increase minval range for blogbench test by @stevenhorsman in #10782
• versions: Bump Ubuntu base image & initrd by @fidencio in #10794
• kernel: Add CONFIG_TMPFS_XATTR to tdx.conf by @JakubLedworowski in #10790
• gpu: Add driver version selection by @zvonkok in #10749
• agent: Add proper activation param handling to activate cgroupV2 by @zvonkok in #10785
• Enable VFIO-AP coldplug for s390x by @BbolroC in #10767
• egrep/fgrep removal by @balintTobik in #10805
• packaging: virtiofsd: Allow building a specific commit by @stevenhorsman in #10823
• build(deps): bump github.com/golang/glog from 1.2.0 to 1.2.4 in /src/tools/csi-kata-directvolume in the go_modules group across 1 directory by @dependabot in #10807
• snp: update kata to use latest upstream packages for snp by @ryansavino in #10751
• versions: Fix formatting by @stevenhorsman in #10828
• versions: Bump golang version by @stevenhorsman in #10827
• workflows: Add delete kata-deploy timeouts for crio tests by @stevenhorsman in #10826
• CLH: config: add hypervisor_loglevel by @Camelron in #10811
• gpu: Fix arm64 build by @zvonkok in #10812
• Updates in prep of rust 1.80 bump by @stevenhorsman in #10824
• local-build: Do not build measured rootfs on s390x by @BbolroC in #10841
• tests: disable k8s-policy-job.bats on coco-dev by @danmihai1 in #10842
• Rust 1.80.0 bump by @stevenhorsman in #10806
• gpu: Add first target and fix extratarballs by @zvonkok in #10791
• ci: Only use the Ubuntu TDX machine in the CI by @fidencio in #10857
• workflows: build: Do not store unnecessary content on the tarball by @fidencio in #10860
• sandbox: Add the sandbox api support by @lifupan in #10716
• gha: Add shellcheck by @zvonkok in #10814
• Clean the config block_device_cache_direct of runtime-rs by @teawater in #10850
• gpu: enable confidential initrd build by @zvonkok in #10866
• Skipping SNP and SEV from deploying and deleting Snapshotter by @arvindskumar99 in #10810
• packaging: Move builds to Ubuntu 22.04 by @fidencio in #10864
• dragonball: Appease clippy by @RuoqingHe in #10839
• policy: add policy crate and add network namespace check to policy by @3u13r in #10613
• ci: k8s: Bump kcli image version by @stevenhorsman in #10869
• ci: Update yq to v4.44.5 to support riscv64 by @RuoqingHe in #10832
• tests: Skip block volume test on fc, stratovirt by @stevenhorsman in #10874
• CI: Deprecate SEV by @AdithyaKrishnan in #10877
• packaging(release): Properly handle version tag for the release bundle by @ananos in #10879
• Add process to init subcgroup when we're using dind with cgroups v2 by @antoine-gaillard in #10845
• agent: Bump image-rs to 514c561d93 by @fidencio in #10851
• agent: Bump agent crates to resolve CVEs by @stevenhorsman in #10885
• version: Bump kernel to 6.12.13 by @fidencio in #10787
• gpu: Update config files by @zvonkok in #10786
• gpu: agent cdi timeout by @zvonkok in #10878
• release: Bump version to 3.14.0 by @ananos in #10880
• release: Remove artifacts for release by @zvonkok in #10890

New Contributors

• @RuoqingHe made their first contribution in #10741
• @balintTobik made their first contribution in #10766
• @arvindskumar99 made their first contribution in https://github.com/kata-containers/kat...

Survey

Please take the Kata Containers survey:

• https://openinfrafoundation.formstack.com/forms/kata_containers_user_survey

This will help the Kata Containers community understand:

• how you use Kata Containers
• what features and improvements you would like to see in Kata Containers

Libseccomp Notices

The kata-agent binaries inside the Kata Containers images provided with this release are
statically linked with the following GNU LGPL-2.1 licensed libseccomp library.

• libseccomp

The kata-agent uses the libseccomp v2.5.5 which is not modified from the upstream version.
However, in order to comply with the LGPL-2.1 (§6(a)), we attach the complete source code for the library.

Kata Containers builder images

• agent (on all its different flavours): quay.io/kata-containers/builders:agent-8d4e72f0d-107265821-x86_64
• Kernel (on all its different flavours): quay.io/kata-containers/builders:kernel-c95ae5a50-x86_64
• OVMF (on all its different flavours): quay.io/kata-containers/builders:ovmf-aff3d98dd-x86_64
• QEMU (on all its different flavurs): quay.io/kata-containers/builders:qemu-69ed4bc3b-x86_64
• shim-v2: quay.io/kata-containers/builders:shim-v2-go-1.22.2-rust-1.75.0-9c8b20b2b-x86_64
• tools: quay.io/kata-containers/builders:tools-d15a7baed-2068801b8-5218345e3-fb87bf221-x86_64
• virtiofsd: quay.io/kata-containers/builders:virtiofsd-1.83.0-musl-0af353632-x86_64

Installation

Follow the Kata installation instructions.

What's Changed

• release: Abort if release version exists by @stevenhorsman in #10675
• doc: Update the release process by @stevenhorsman in #10668
• packaging: fix the broken usage help by @deagon in #9387
• tests: Fix qemu-coc-dev skip by @stevenhorsman in #10676
• doc: Add required jobs info by @stevenhorsman in #10380
• workflows: Add timeout to some ppc64le steps by @stevenhorsman in #10685
• workflows: Add more ppc64le timeouts by @stevenhorsman in #10686
• Add mem-agent to kata by @teawater in #10626
• runtime-rs: Remove unneeded mut from new_hypervisor() by @justxuewei in #10683
• kata-ctl: direct-volume: Auto create KATA_DIRECT_VOLUME_ROOT_PATH by @teawater in #10696
• CI: change the containerd tarball name from cri-containerd-cni to containerd by @lifupan in #10702
• versions: Move kernel to the latest 6.12 release (the current LTS) by @fidencio in #10468
• metrics: Increase latency minimum range by @stevenhorsman in #10718
• tests: Re-enable oom tests for mariner by @fidencio in #10717
• Update Trustee and Guest Components by @fitzthum in #10541
• virtiofsd: Update to its v1.13.0 ( + one patch) release :-) by @fidencio in #10714
• tests/gha-run-k8s-common: shorten AKS cluster name by @wainersm in #9871
• metrics: Increase latency test range by @stevenhorsman in #10721
• runtime: use actual booleans for QMP device_add boolean options by @msanft in #10719
• versions: Bump trustee to latest by @BbolroC in #10730
• agent: alternative implementation for sealed_secret as volume by @bpradipt in #10674
• rootfs: reduced console output by default by @danmihai1 in #10731
• image: bump mariner guest version to 3.0 by @danmihai1 in #10727
• tests: Introduce retry_kubectl_apply() for trusted storage by @BbolroC in #10735
• runtime: skip empty Guest console output lines by @danmihai1 in #10738
• release: Bump version to 3.13.0 by @zvonkok in #10742

Full Changelog: 3.12.0...3.13.0

Survey

Please take the Kata Containers survey:

• https://openinfrafoundation.formstack.com/forms/kata_containers_user_survey

This will help the Kata Containers community understand:

• how you use Kata Containers
• what features and improvements you would like to see in Kata Containers

Libseccomp Notices

The kata-agent binaries inside the Kata Containers images provided with this release are
statically linked with the following GNU LGPL-2.1 licensed libseccomp library.

• libseccomp

The kata-agent uses the libseccomp v2.5.5 which is not modified from the upstream version.
However, in order to comply with the LGPL-2.1 (§6(a)), we attach the complete source code for the library.

Kata Containers builder images

• agent (on all its different flavours): quay.io/kata-containers/builders:agent-8d4e72f0d-107265821-x86_64
• Kernel (on all its different flavours): quay.io/kata-containers/builders:kernel-c95ae5a50-x86_64
• OVMF (on all its different flavours): quay.io/kata-containers/builders:ovmf-aff3d98dd-x86_64
• QEMU (on all its different flavurs): quay.io/kata-containers/builders:qemu-69ed4bc3b-x86_64
• shim-v2: quay.io/kata-containers/builders:shim-v2-go-1.22.2-rust-1.75.0-9c8b20b2b-x86_64
• tools: quay.io/kata-containers/builders:tools-95fc58510-59ed19e8b-3fb91dd63-fb87bf221-x86_64
• virtiofsd: quay.io/kata-containers/builders:virtiofsd-1.72.0-musl-c99ba42d6-x86_64

Installation

Follow the Kata installation instructions.

What's Changed

• ci: Re-enable SNP CI by @AdithyaKrishnan in #10558
• osbuilder: Fix build dependency of ubuntu rootfs with Docker by @coolljt0725 in #10377
• ci: Required jobs by @ldoktor in #10447
• osbuilder: Drop Clear Linux by @fidencio in #10520
• gpu: NVIDIA GPU initrd/image build by @zvonkok in #10464
• docs: Fix several build failures when I tried the procedures in "Kata Containers with AMD SEV-SNP VMs" by @kimullaa in #10386
• ci: Fix error on self-hosted machines by @zvonkok in #10516
• genpolicy: avoid regorus warning by @danmihai1 in #10543
• runtime-rs: fix vfio device name combination issue by @Apokleos in #10577
• kata-deploy: Support containerd configuration version 3 by @fidencio in #10584
• workflows: Remove rootfs binary artifacts by @stevenhorsman in #10586
• agent: fix startup when guest_components_procs is set to none by @squarti in #10583
• kata-deploy: Use drop-in files whenever it's possible by @fidencio in #10585
• coco: ci: Lay groundwork for compiling and publishing CSI driver image [1/x] by @sprt in #10561
• runtime: clh: addNet() logging clean-up by @danmihai1 in #10564
• gha: Unbreak CI and work around workflow limit by @sprt in #10589
• ci: unbreak: Reallow no-op builds by @sprt in #10594
• Unbreak the CI, 3rd attempt by @fidencio in #10597
• gatekeeper: add run-k8s-tests-on-zvsi(devmapper) to required jobs by @BbolroC in #10595
• ci: Fix variant for confidential targets by @zvonkok in #10590
• ci: Fix Docker publishing for CSI driver by @sprt in #10609
• policy: add constants to rules.rego by @Redent0r in #10592
• policy: ignore optional metadata uid field by @Redent0r in #10608
• ci: Fix Docker publishing for CSI driver, 2nd try by @sprt in #10612
• coco: ci: Fully implement compilation of CSI driver and require it for CoCo tests [2/x] by @sprt in #10563
• Add subchannel support to qemu-runtime-rs for s390x by @BbolroC in #10574
• genpolicy: align state path getter and setter by @3u13r in #10604
• runtime: skip logging some of the dial errors by @danmihai1 in #10607
• workflows: Fix remove artifact name filter by @stevenhorsman in #10615
• metrics: Increase minval range for failing tests by @stevenhorsman in #10588
• tests: Skip k8s job test on qemu-coco-dev by @stevenhorsman in #10617
• ci.gatekeeper: Update existing results by @ldoktor in #10572
• kata-deploy: Add support to multi-installation by @fidencio in #10551
• release: helm: Add the chart as part of the release by @fidencio in #10627
• runtime: Set memory config shared=false when shared_fs=None in CLH. by @Sumynwa in #10548
• Action lint workflow by @stevenhorsman in #10631
• policy: improve pod namespace validation by @Redent0r in #10593
• Revert "ci: Skip the failing tests in SNP" by @ryansavino in #10581
• runtime-rs: Fix the issues with stderr fifo by @justxuewei in #10638
• runtime-rs: Ignore BUILD_TYPE if it is not release by @justxuewei in #10641
• runtime-rs & agent: Fix the issues with bind volumes by @justxuewei in #10643
• qemu: Upgrade qemu 9.1.2 by @zvonkok in #10492
• vfio-ap: Assign default string "0" for empty APID and APQI by @BbolroC in #10660
• kata-ctl: fix outdated comments by @liubogithub in #10655
• release: Bump version to 3.12.0 by @zvonkok in #10663
• qemu: Fix aarch64 build by @zvonkok in #10669
• workflows: Remove potential timing issues with artifacts by @stevenhorsman in #10620

New Contributors

• @coolljt0725 made their first contribution in #10377
• @kimullaa made their first contribution in #10386

Full Changelog: 3.11.0...3.12.0

Survey

Please take the Kata Containers survey:

• https://openinfrafoundation.formstack.com/forms/kata_containers_user_survey

This will help the Kata Containers community understand:

• how you use Kata Containers
• what features and improvements you would like to see in Kata Containers

Libseccomp Notices

The kata-agent binaries inside the Kata Containers images provided with this release are
statically linked with the following GNU LGPL-2.1 licensed libseccomp library.

• libseccomp

The kata-agent uses the libseccomp v2.5.5 which is not modified from the upstream version.
However, in order to comply with the LGPL-2.1 (§6(a)), we attach the complete source code for the library.

Kata Containers builder images

• agent (on all its different flavours): quay.io/kata-containers/builders:agent-8d4e72f0d-107265821-x86_64
• Kernel (on all its different flavours): quay.io/kata-containers/builders:kernel-c95ae5a50-x86_64
• OVMF (on all its different flavours): quay.io/kata-containers/builders:ovmf-aff3d98dd-x86_64
• QEMU (on all its different flavurs): quay.io/kata-containers/builders:qemu-74662a072-x86_64
• shim-v2: quay.io/kata-containers/builders:shim-v2-go-1.22.2-rust-1.75.0-9c8b20b2b-x86_64
• tools: quay.io/kata-containers/builders:tools-c20731226-df5e6e65b-0ce3f5fc6-0adf7a66c-x86_64
• virtiofsd: quay.io/kata-containers/builders:virtiofsd-1.72.0-musl-c99ba42d6-x86_64

Installation

Follow the Kata installation instructions.

What's Changed

• re-enable measured rootfs build & tests by @fidencio in #10466
• build: cache: Ensure shim-v2-root_hash.txt is in "${workdir}" by @fidencio in #10473
• runtime: log vm start error before cleanup by @koct9i in #10074
• Revert "tests: Add trap statement in kata doc script" by @stevenhorsman in #10475
• tests: Increase time to run stressng k8s tests by @GabyCT in #10462
• packaging: Remove kernel config repo variable as it is unused by @GabyCT in #10474
• gha: Switch KUBERNETES from k3s to kubeadm on s390x by @BbolroC in #10476
• runtime-rs: Add basic boilerplate for remote hypervisor by @Chasing1020 in #10225
• genpolicy: support darwin target by @burgerdev in #10425
• gha: Add missing steps in Kata stability workflow by @GabyCT in #10480
• ci: Use ubuntu for static building of kata tools. by @Sumynwa in #10442
• runtime: Add GPU annotations for remote hypervisor by @bpradipt in #10453
• docs: Update virtualization document by @GabyCT in #10482
• agent: perform attestation init w/o process launch by @mkulke in #10481
• gha: Fix source for gha stability run script by @GabyCT in #10485
• agent-ctl: Add support to test kata-agent's container creation APIs. by @Sumynwa in #10395
• tests: k8s: Update bats by @stevenhorsman in #10459
• builds: ovmf: Workaround Zeex repo becoming private by @fidencio in #10490
• image: Add suffix to image or initrd depending on the NVIDIA driver version by @zvonkok in #9480
• build: kernel: Teach our machinery to deal with -rc kernels by @fidencio in #10488
• agent: fix typo on getting EphemeralHandler size option by @fidencio in #10491
• ci: export CONTAINER_RUNTIME to the test scripts by @littlejawa in #10496
• ci: skip nginx connectivity test with qemu/crio by @littlejawa in #10495
• workflows: Use AUTO_GENERATE_POLICY for qemu-coco-dev by @fidencio in #10486
• gha: Add install kata tools as part of the stability workflow by @GabyCT in #10493
• runtime: Files are not synced between host and guest VMs by @squarti in #10500
• kata-agent: Add CDI support by @zvonkok in #9584
• metrics: Skip metrics on stratovirt by @stevenhorsman in #10505
• workflow: Remove/skip runk CI by @stevenhorsman in #10506
• tests: k8s: Update image pull timeout error by @stevenhorsman in #10498
• ci.ocp: Use the official python:3 container for sanity by @ldoktor in #10511
• tests: remove manifest v1 test by @Redent0r in #10517
• ci: tdx: kbs: Ensure https_proxy is taken in consideration by @fidencio in #10513
• gha: Hardcode ubuntu-22.04 instead of latest by @sprt in #10515
• gha: Get artifacts when installing kata tools in stability workflow by @GabyCT in #10508
• Reapply "runtime: confidential: Do not set the max_vcpu to cpu" by @fidencio in #10519
• ci: Temporarily skip SNP CI by @AdithyaKrishnan in #10539
• osbuilder: remove redundant env variable by @ncppd in #10521
• genpolicy: add state to policy by @Redent0r in #10431
• runtime: Set maxvcpus equal to vcpus for the static resources case by @alex-matei in #9195
• rootfs: Install missing clang in Ubuntu docker image by @mrIncompetent in #9407
• ci: tdx: Split jobs to run in 2 different machines by @fidencio in #10501
• kernel: add CONFIG_KEYS=y to enable kernel keyring by @Crypt0s in #10542
• agent: overwrite OCI process spec when overwriting pause image by @squarti in #10514
• runtime: fix comment to accurately reflect clh behavior by @Camelron in #10545
• release: Bump version to 3.11.0 by @stevenhorsman in #10552
• workflows: Remove skipping of artifact uploads by @stevenhorsman in #10562

New Contributors

• @koct9i made their first contribution in #10074
• @Chasing1020 made their first contribution in #10225
• @ncppd made their first contribution in #10521
• @mrIncompetent made their first contribution in #9407
• @Crypt0s made their first contribution in #10542
• @Camelron made their first contribution in #10545

Full Changelog: 3.10.1...3.11.0

Survey

Please take the Kata Containers survey:

• https://openinfrafoundation.formstack.com/forms/kata_containers_user_survey

This will help the Kata Containers community understand:

• how you use Kata Containers
• what features and improvements you would like to see in Kata Containers

Libseccomp Notices

The kata-agent binaries inside the Kata Containers images provided with this release are
statically linked with the following GNU LGPL-2.1 licensed libseccomp library.

• libseccomp

The kata-agent uses the libseccomp v2.5.5 which is not modified from the upstream version.
However, in order to comply with the LGPL-2.1 (§6(a)), we attach the complete source code for the library.

Kata Containers builder images

• agent (on all its different flavours): quay.io/kata-containers/builders:agent-2b2d0f738-107265821-x86_64
• Kernel (on all its different flavours): quay.io/kata-containers/builders:kernel-c95ae5a50-x86_64
• OVMF (on all its different flavours): quay.io/kata-containers/builders:ovmf-c99ba42d6-x86_64
• QEMU (on all its different flavurs): quay.io/kata-containers/builders:qemu-74662a072-x86_64
• shim-v2: quay.io/kata-containers/builders:shim-v2-go-1.22.2-rust-1.75.0-25c784c56-x86_64
• tools: quay.io/kata-containers/builders:tools-c06bf2e3b-fefcf7cfa-322846b36-bc195d758-x86_64
• virtiofsd: quay.io/kata-containers/builders:virtiofsd-1.72.0-musl-c99ba42d6-x86_64

Installation

Follow the Kata installation instructions.

What's Changed

• tools: Change PACKAGES var for cbl-mariner by @ms-mahuber in #10439
• workflows: Ensure shim-v2 is built as the last asset by @fidencio in #10446
• runtime: Failed to clean up resources when QEMU is terminated by @wtootw in #10208
• Add a specific workflow for testing the CI, without messing up with the "nightly" weather by @fidencio in #10449
• docs: Fix misspelling in CI documentation by @GabyCT in #10438
• tests: Add trap statement in kata doc script by @GabyCT in #10452
• workflows: devel: Follow-up on the manually triggered jobs by @fidencio in #10461
• agent: Correct rustjail device filemode permission typo by @skaegi in #10463
• release: Bump version to 3.10.1 by @stevenhorsman in #10467
• workflows: Possibly fix the release workflow by @fidencio in #10471

New Contributors

• @wtootw made their first contribution in #10208

Full Changelog: 3.10.0...3.10.1

Survey

Please take the Kata Containers survey:

• https://openinfrafoundation.formstack.com/forms/kata_containers_user_survey

This will help the Kata Containers community understand:

• how you use Kata Containers
• what features and improvements you would like to see in Kata Containers

Libseccomp Notices

The kata-agent binaries inside the Kata Containers images provided with this release are
statically linked with the following GNU LGPL-2.1 licensed libseccomp library.

• libseccomp

The kata-agent uses the libseccomp v2.5.5 which is not modified from the upstream version.
However, in order to comply with the LGPL-2.1 (§6(a)), we attach the complete source code for the library.

Kata Containers builder images

• agent (on all its different flavours): quay.io/kata-containers/builders:agent-2b2d0f738-107265821-x86_64
• Kernel (on all its different flavours): quay.io/kata-containers/builders:kernel-c95ae5a50-x86_64
• OVMF (on all its different flavours): quay.io/kata-containers/builders:ovmf-c99ba42d6-x86_64
• QEMU (on all its different flavurs): quay.io/kata-containers/builders:qemu-74662a072-x86_64
• shim-v2: quay.io/kata-containers/builders:shim-v2-go-1.22.2-rust-1.75.0-25c784c56-x86_64
• tools: quay.io/kata-containers/builders:tools-c06bf2e3b-fefcf7cfa-3dabe0f5f-bc195d758-x86_64
• virtiofsd: quay.io/kata-containers/builders:virtiofsd-1.72.0-musl-c99ba42d6-x86_64

Installation

Follow the Kata installation instructions.

What's Changed

• gha: Increase timeout to run k8s tests on TDX by @GabyCT in #10336
• acrn: Drop support by @fidencio in #10239
• kata-deploy: clean up and fix docs for k0s by @sprt in #10335
• runtime-rs: fix the issue of using block_on by @lifupan in #10339
• tests: Fix loop device handling for exec_host() by @BbolroC in #10232
• doc: Update the release process by @stevenhorsman in #10337
• tools.kata-webhook: Specify runtime class using configMap by @Bickor in #10329
• Introduce cdi in runtime-rs by @Apokleos in #10146
• ci: don't require sudo for yq if already installed by @pawelpros in #10311
• runtime: add DAN support for VFIO network device in Go kata-runtime by @l8huang in #9977
• tests: Improve k8s negative tests by @BbolroC in #10328
• ci: Reorder webhook deployment by @ldoktor in #10345
• tests: Delete custom node debugger pod on EXIT by @BbolroC in #10348
• Some prepared work for sandbox api support by @lifupan in #10330
• runtime-rs: Notify containerd when process exits by @lsc2001 in #10293
• ci: Enable basic docker tests for runtime-rs by @lsc2001 in #10318
• tests: Minor improvement k8s tests by @BbolroC in #10346
• agent: fix the issue of setup sandbox pidns by @lifupan in #10351
• sandbox: refactor the sandbox init process by @lifupan in #10349
• runtime-rs: Port TAP implementation from dragonball by @sidneychang in #10219
• gha: Add ita_key as a github secret by @fidencio in #10357
• docs: Remove qemu information not longer valid by @GabyCT in #10342
• ci:tdx: Use an ITA key for TDX by @GabyCT in #10305
• runtime-rs: Add Configurable Compilation for Dragonball in Runtime-rs by @sidneychang in #10312
• tests: Add k8s-block-volume test to GHA CI by @sprt in #7165
• genpolicy: validate create sandbox storages by @Redent0r in #10340
• tests: Skip k8s-block-volume.bats for qemu-runtime-rs by @BbolroC in #10374
• metrics: Update fast footprint script to use grep by @GabyCT in #10369
• tests: k8s-policy-rc: remove default UID from YAML by @danmihai1 in #10370
• k8s: tests: Re-enable empty-dirs tests for TDX / coco-qemu-dev by @fidencio in #10371
• runtime-rs: add network device hotplugging to qemu-rs by @pmores in #10165
• k8s:kbs: Add trap statement to clean up tmp files by @GabyCT in #10375
• ci.ocp: Sort images according to git by @ldoktor in #10134
• osbuilder: Remove duplicated arch variable definition by @GabyCT in #10381
• CI: Select jobs by touched code by @ldoktor in #9637
• gha: enable AUTO_GENERATE_POLICY where needed by @danmihai1 in #10376
• tests: k8s: AUTO_GENERATE_POLICY=yes for local testing by @danmihai1 in #10384
• build: Fix RPM build fail due to AGENT_POLICY by @emanuellima1 in #10389
• image-builder: Remove unused variable by @GabyCT in #10383
• Support Confidential Sealed Secrets (as volume) by @ChengyuZhu6 in #10363
• local-build: add ability to build rootfs-image-mariner by @danmihai1 in #10390
• tools/osbuilder/tests: Add trap statement in test images script by @GabyCT in #10388
• Revert "agent:cdh: unittest for sealed secret as file" by @fidencio in #10404
• ci: mariner: Use the image instead of the initrd by @fidencio in #10396
• packaging: Remove unused variable in build kernel script by @GabyCT in #10407
• build: mariner: Remove the ability to build the marine initrd by @fidencio in #10397
• Kbs deploy overlays update by @stevenhorsman in #10401
• agent:cdh: fix unit tests about sealed secret by @ChengyuZhu6 in #10406
• kbs: ita: Ensure the proper image / image_tag is used for ITA by @fidencio in #10409
• tools/osbuilder/tests: Remove egrep in test images script by @GabyCT in #10415
• ci: Install build dependencies for building agent-ctl with image pull. by @Sumynwa in #10402
• genpolicy: read binaryData value as String by @3u13r in #10426
• ci: static_sandbox_resource_mgmt for cbl-mariner by @danmihai1 in #10416
• tests: k8s-inotify.bats improvements by @danmihai1 in #10417
• agent: config: Use rstest for unit tests by @stevenhorsman in #10412
• gha: Use a arch_to_golang variable to have uniformity by @GabyCT in #10428
• docs: Update CI documentation by @GabyCT in #10430
• runtime-rs: Use vCPU and memory values from config by @ananos in #10435
• ci: add provenance attestation for agent artifact by @mkulke in #10433
• ci: don't parse oci image for cached artifacts by @mkulke in #10437
• kata-agent: fixing bug of unable setting hostname correctly. by @Apokleos in #10421
• runtime-rs: support virtio-scsi device in qemu-rs by @pmores in #10420
• release: Bump VERSION to 3.10.0 by @gkurz in #10443

New Contributors

• @Bickor made their first contribution in #10329
• @pawelpros made their first contribution in #10311
• @lsc2001 made their first contribution in https:...

Survey

Please take the Kata Containers survey:

• https://openinfrafoundation.formstack.com/forms/kata_containers_user_survey

This will help the Kata Containers community understand:

• how you use Kata Containers
• what features and improvements you would like to see in Kata Containers

Libseccomp Notices

The kata-agent binaries inside the Kata Containers images provided with this release are
statically linked with the following GNU LGPL-2.1 licensed libseccomp library.

• libseccomp

The kata-agent uses the libseccomp v2.5.5 which is not modified from the upstream version.
However, in order to comply with the LGPL-2.1 (§6(a)), we attach the complete source code for the library.

Kata Containers builder images

• agent (on all its different flavours): quay.io/kata-containers/builders:agent-2b2d0f738-107265821-x86_64
• Kernel (on all its different flavours): quay.io/kata-containers/builders:kernel-c95ae5a50-x86_64
• OVMF (on all its different flavours): quay.io/kata-containers/builders:ovmf-c99ba42d6-x86_64
• QEMU (on all its different flavurs): quay.io/kata-containers/builders:qemu-74662a072-x86_64
• shim-v2: quay.io/kata-containers/builders:shim-v2-go-1.22.2-rust-1.75.0-25c784c56-x86_64
• tools: quay.io/kata-containers/builders:tools-593cbb871-eb1227f47-1597f8ba0-69535e545-x86_64
• virtiofsd: quay.io/kata-containers/builders:virtiofsd-1.72.0-musl-c99ba42d6-x86_64

Installation

Follow the Kata installation instructions.

What's Changed

• genpolicy: deny UpdateEphemeralMountsRequest by @Redent0r in #9911
• metrics: Remove unused variable in openvino script by @GabyCT in #10198
• kata-deploy: Rework the logic a little bit by @fidencio in #10194
• ci: commit-message-check: Take re-revert into consideration by @fidencio in #10196
• agent: kill child process when console socket closed by @soulfy in #10141
• Revert "tests: add image check before running coco tests" by @amshinde in #10207
• tests: Fix k8s test issues on s390x by @BbolroC in #10202
• agent/config: Make CDH_API_TIMEOUT configurable by @BbolroC in #10199
• kata-manager: Avoid docker rate-limit by @fidencio in #10209
• Upgrade to Cloud Hypervisor v41.0 by @likebreath in #10205
• metrics: Add OpenVINO general information into README by @GabyCT in #10201
• stability: Add kubernetes parallel test by @GabyCT in #10193
• runtime: Allow machine_type in kata config for remote hypervisors by @squarti in #10212
• runtime: check if cold_plug_vfio is enabled before create PhysicalEndpoint by @l8huang in #10210
• ci: reinstate Mariner host and guest kernel by @sprt in #10037
• gha: Add GHA workflow to run Kata CoCo stability tests by @GabyCT in #10214
• docs: Add oneDNN benchmark information to metrics README by @GabyCT in #10221
• genpolicy: add priorityClassName as a field in PodSpec interface by @Redent0r in #10160
• agent: image-rs: check xattrs for image unpacking by @amshinde in #10224
• metrics: Remove unused variable in oneDNN benchmark by @GabyCT in #10228
• agent: avoid policy.txt log without debug enabled by @danmihai1 in #10222
• ci: Transition GARM tests to free runners, pt. III by @sprt in #10038
• agent: Update image-rs to 02af65abc by @fidencio in #10236
• kata-deploy: helm: Add INSTALLATION_PREFIX by @fidencio in #10204
• ci: Remove stdio tests by @fidencio in #10238
• metrics: Remove metrics report for Kata Containers by @GabyCT in #10247
• agent:cdh: Refactor CDHClient usage and initialization by @ChengyuZhu6 in #10233
• helm: Several fixes, including some reasonable re-work on kata-deploy.sh script by @fidencio in #10192
• runtime: fix bad default machine_type for remote hypervisor by @squarti in #10250
• runtime: Don't error out about SNP cert path on non SNP platforms by @fidencio in #10254
• gha: Turn on KBS for qemu-coco-dev on s390x by @BbolroC in #10244
• versions: Update firecracker version to 1.8.0 by @GabyCT in #10229
• tests: Enable k8s soak stability test for Kata CoCo CI by @GabyCT in #10237
• genpolicy: support readonly hostpath by @Redent0r in #10251
• ci: Add workflow to run kata-agent api tests using kata-agent-ctl by @Sumynwa in #10263
• ci: send SIGKILL to kill kata components by @Sumynwa in #10255
• ci: Enable kata agent API tests by @Sumynwa in #10270
• genpolicy: add support for PodDisruptionBudget yaml by @Redent0r in #10268
• metrics: Update openVINO and oneDNN tests references by @GabyCT in #10267
• agent: Refactor storage handler registration by @ChengyuZhu6 in #10245
• Refine device management for kata-agent by @ChengyuZhu6 in #10213
• kata-deploy: Remove kata-cleanup unneeded vars by @fidencio in #10257
• runtime: qemu: tdx: Add support for setting mrconfigid / mrowner / mrownerconfig by @fidencio in #10272
• Add support of dragonball virtio-balloon free page reporting by @teawater in #10253
• tests: Increase timeout to wait for soak stability test deployment by @GabyCT in #10277
• runtime-rs: configuration-dragonball.toml.in: Remove duplication by @teawater in #10282
• runtime: Fix runtime/cdi panic with assignment to entry in nil map by @Apokleos in #10276
• ci: tdx: Adapt how we get the host IP by @fidencio in #10292
• agent-ctl: Refactor CopyFile Handler by @Sumynwa in #10271
• Bump guest-components / trustee to a version that supports ITA by @fidencio in #10294
• tests: Enable stressng k8s stability test for Kata CoCo CI by @GabyCT in #10289
• metrics: Remove unused remove img var in common script by @GabyCT in #10295
• genpolicy: fix and re-enable create container UID verification by @danmihai1 in #10291
• tests: Introduce retry mechanism for helm install by @BbolroC in #10309
• tests: Fix indentation in the cri containerd tests by @GabyCT in #10304
• tests: k8s-inotify: pod termination polling by @danmihai1 in #10316
• CoCo: Bump Coco components to 0.10 releases by @stevenhorsman in #10313
• Merge to main: supporting pull cosign signed images by @Xynnn007 in #10009
• doc: Update how-to-run-kata-containers-with-SE-VMs.md by @BbolroC in #10315
• local-build: Fix unbound variable issue for lib_se.sh by @BbolroC in #10321
• agent: add support to provide default agent policy via env by @Sumynwa in #10303
• kata-deploy: Switch Kubernetes URL by @stevenhorsman in #10323
• ci: Fix indentation of install libseccomp script by @GabyCT in #10324
  *...

Survey

Please take the Kata Containers survey:

• https://openinfrafoundation.formstack.com/forms/kata_containers_user_survey

This will help the Kata Containers community understand:

• how you use Kata Containers
• what features and improvements you would like to see in Kata Containers

Libseccomp Notices

The kata-agent binaries inside the Kata Containers images provided with this release are
statically linked with the following GNU LGPL-2.1 licensed libseccomp library.

• libseccomp

The kata-agent uses the libseccomp v2.5.5 which is not modified from the upstream version.
However, in order to comply with the LGPL-2.1 (§6(a)), we attach the complete source code for the library.

Kata Containers builder images

• agent (on all its different flavours): quay.io/kata-containers/builders:agent-d0b0004ce-107265821-x86_64
• Kernel (on all its different flavours): quay.io/kata-containers/builders:kernel-c95ae5a50-x86_64
• OVMF (on all its different flavours): quay.io/kata-containers/builders:ovmf-c99ba42d6-x86_64
• QEMU (on all its different flavurs): quay.io/kata-containers/builders:qemu-74662a072-x86_64
• shim-v2: quay.io/kata-containers/builders:shim-v2-go-1.22.2-rust-1.75.0-25c784c56-x86_64
• tools: quay.io/kata-containers/builders:tools-c22ac4f72-a9b436f78-a78d82f4f-69535e545-x86_64
• virtiofsd: quay.io/kata-containers/builders:virtiofsd-1.72.0-musl-c99ba42d6-x86_64

Installation

Follow the Kata installation instructions.

What's Changed

• tests: Rebuild secure boot image for guest-pull-image-authenticated for IBM SE by @BbolroC in #10032
• metric: Upgrade blogbench to 1.2 by @amshinde in #10028
• ci: cleanup: Ignore nonexisting resources by @sprt in #9959
• genpolicy: container.exec_commands args validation by @danmihai1 in #10022
• tests: Call repack_secure_image() in set_metadata_annotation() by @BbolroC in #10034
• Implement hotplug support for physical endpoints by @amshinde in #8597
• runtime-rs: container: fix the issue of missing cleanup container by @lifupan in #10045
• gha: enable autogenerated policy testing on SEV and SEV-SNP by @Redent0r in #9835
• metrics: update avg reference values for blogbench. by @dborquez in #10040
• tests: k8s-credentials-secrets: policy for second pod by @danmihai1 in #10035
• Add kernel config for NVIDIA DPU/ConnectX adapter by @l8huang in #9620
• tests: Fix missing log on TDX by @ChengyuZhu6 in #10031
• dragonball: kernel gpu dragonball 6.1.x by @zvonkok in #9968
• gpu: rootfs/initrd build init by @zvonkok in #9920
• tools: Allow setting policy rego file via by @Redent0r in #9910
• ci: cache: Pass through RELEASE env by @stevenhorsman in #10053
• metrics: Update launch times to use grep -F by @GabyCT in #10060
• gpu: rootfs ubuntu build expansion by @zvonkok in #9919
• runtime-rs: add memory hotplugging support to qemu-rs by @pmores in #9965
• gha: Increase timeout to run CoCo tests by @ChengyuZhu6 in #10063
• docs: Update url links in kata nydus document by @GabyCT in #10054
• genpolicy: Add support for envFrom by @Redent0r in #9576
• tests: k8s: reuse policy exec variable by @danmihai1 in #10051
• runtime-rs: enhance debug info for agent connect. by @Apokleos in #10058
• Align kata oci spec with oci-spec-rs by @Apokleos in #9944
• Fix issue while adding multiple networks with nerdctl by @amshinde in #9899
• initdata: add initdata annotation in hypervisor config by @huoqifeng in #9988
• tee: osbuilder: Set /run to use 50% of the image with systemd by @fidencio in #10078
• genpolicy: validate each exec command line arg by @danmihai1 in #10069
• tests: k8s: minor policy tests clean-up by @danmihai1 in #10083
• runtime-rs : fix the issue of stop sandbox by @lifupan in #10043
• runtime-rs: enable dragonball hypervisor support initrd by @lifupan in #10024
• runtime-rs: Fix QEMU backend for runtime-rs by @ananos in #10052
• gha: Eradicate {pre,post}-action steps for s390x runners by @BbolroC in #10096
• ci: Fix rate limit error by migrating busybox_image by @AdithyaKrishnan in #10101
• gha: Restore cleanup-zvsi for s390x by @BbolroC in #10104
• tests: add image check before running coco tests by @ChengyuZhu6 in #10080
• GHA: Run k8s e2e tests for qemu-runtime-rs on s390x by @BbolroC in #10070
• version: bump trustee version by @ChengyuZhu6 in #10110
• ci: Temporarily remove arm64 builds by @fidencio in #10111
• metrics: Update memory tests to use grep -F by @GabyCT in #10099
• ci: Temporarily remove arm64 builds -- part II by @fidencio in #10117
• kata-manager: Ensure distro specific TDX config is set by @fidencio in #10114
• tests: k8s: Rotate & cleanup journal for every run by @fidencio in #10107
• tests: kbs: Add missing dependencies to install kbs cli by @GabyCT in #10116
• tests: Fix error with kubectl debug by @ChengyuZhu6 in #10102
• agent: fix the AllowRequestsFailingPolicy functionality by @danmihai1 in #10098
• ci: re-enable arm CI by @fidencio in #10123
• Fix metrics json results file by @dborquez in #10120
• genpolicy: reject create custom hook settings by @Redent0r in #10075
• ci: Remove jobs that are not running by @fidencio in #10125
• ci: Enable encrypted image tests for TEEs by @fidencio in #10124
• genpolicy: add --version flag by @Redent0r in #10121
• kata-deploy: Add Helm Chart by @zvonkok in #9880
• runtime: image-pull: Make it work with nerdctl by @fidencio in #10132
• genpolicy: add crate-scoped integration test by @burgerdev in #10068
• ci: Enable nerdctl tests for clh by @amshinde in #10089
• tools: Support for building qemu with linux aio by @hex2dec in #10129
• tests:k8s: Update image in kubectl debug for the exec host function by @GabyCT in #10127
• qemu: don't emit scsi parameter by @Freax13 in #10113
• ci: cache: Include kata version in artefact versions by @stevenhorsman in #10140
• tests: Update ubuntu image for stress Dockerfile by @GabyCT in #10142
• ci: Transition GARM tests to free runners, pt. II by @wainersm in #10007
• kata-manager: Only check files when tarball is not passed by @fidencio in #10149
• tests: Add kubernetes stress-ng tests by @GabyCT in #10154
• tests: Disable k8s file volume test by @GabyCT in https://github.com/kata-containers/kata-cont...

Survey

Please take the Kata Containers survey:

• https://openinfrafoundation.formstack.com/forms/kata_containers_user_survey

This will help the Kata Containers community understand:

• how you use Kata Containers
• what features and improvements you would like to see in Kata Containers

Libseccomp Notices

The kata-agent binaries inside the Kata Containers images provided with this release are
statically linked with the following GNU LGPL-2.1 licensed libseccomp library.

• libseccomp

The kata-agent uses the libseccomp v2.5.5 which is not modified from the upstream version.
However, in order to comply with the LGPL-2.1 (§6(a)), we attach the complete source code for the library.

Kata Containers builder images

• agent (on all its different flavours): quay.io/kata-containers/builders:agent-d0b0004ce-107265821-x86_64
• Kernel (on all its different flavours): quay.io/kata-containers/builders:kernel-c95ae5a50-x86_64
• OVMF (on all its different flavours): quay.io/kata-containers/builders:ovmf-c99ba42d6-x86_64
• QEMU (on all its different flavurs): quay.io/kata-containers/builders:qemu-259ec408b-x86_64
• shim-v2: quay.io/kata-containers/builders:shim-v2-go-1.22.2-rust-1.75.0-25c784c56-x86_64
• tools: quay.io/kata-containers/builders:tools-f31c1b121-6c1a2f01f-eb07f5ef5-c99ba42d6-x86_64
• virtiofsd: quay.io/kata-containers/builders:virtiofsd-1.72.0-musl-c99ba42d6-x86_64

Installation

Follow the Kata installation instructions.

What's Changed

• tests: Use selector rather than pod name for kubectl logs/describe by @BbolroC in #9862
• Tokio vulnerability bump by @stevenhorsman in #9860
• sandbox: fix the issue of failed to get the vmm master tid by @lifupan in #9834
• runtime-rs: add base qmp framework by @pmores in #9772
• kata-deploy: always copy ci/install_yq.sh by @wainersm in #9863
• ci: tdx: Disable TDX CI by @fidencio in #9869
• ci: gha no sudo ppc64 by @zvonkok in #9877
• runtime-rs: adjust qemu vm shutdown behaviour by @pmores in #9870
• ci: tdx: Use vanilla k8s instead of k3s by @fidencio in #9882
• qemu: upgrade to 8.2.4 by @ryansavino in #9149
• tests: nerdctl: Fix variables names and remove network by @GabyCT in #9874
• ci: tdx: Re-enable TDX CI by @fidencio in #9884
• runtime: Support policy in remote hypervisor by @stevenhorsman in #9881
• kernel: Add CONFIG_S390_UV_UAPI for s390x by @BbolroC in #9886
• gha: Do not fail when collecting artifacts by @GabyCT in #9845
• genpolicy: reject untested CreateContainer field values by @danmihai1 in #9856
• ci: remove sudo from s390x build by @zvonkok in #9876
• runtime: updates to qemu-coco-dev configuration by @wainersm in #9865
• ci: gha no sudo arm64 by @zvonkok in #9875
• CI: disable jobs that failed >= 50% on nightly CI recently - part 2 by @wainersm in #9857
• genpolicy: ignore SeccompProfile in PodSpec by @Redent0r in #9579
• metrics: Improve variable definition in memory inside containers script by @GabyCT in #9872
• runtime-rs: fix the bug of func count_files by @gaohuatao-1 in #9830
• workflow: coco: Add auth registry secret by @stevenhorsman in #9903
• genpolicy: allow specifying layer cache file by @3u13r in #9864
• ci: Add scheduled job to cleanup resources, pt. I by @sprt in #9898
• tests: attestation: Restrict sample policy use by @stevenhorsman in #9906
• ci.ocp: Ensure we smoke-test with the right runtime class by @ldoktor in #9887
• tests: Increase timeout to crictl calls on kata monitor tests by @GabyCT in #9897
• runtime-rs: remove attempt to access sandbox bundle from container bu… by @pmores in #9879
• kata-ctl: Update Cargo.lock by @gkurz in #9913
• gpu: Missing separator by @zvonkok in #9916
• tests: Increase interval and max_tries for kubectl_retry by @BbolroC in #9923
• versions: bump coco guest components and trustee by @fitzthum in #9896
• runtime: fix missing of VhostUserDeviceReconnect parameter assignment by @markyangcc in #9849
• rootfs: Fix spurious error by @zvonkok in #9918
• CI: Use multi-arch image for alpine-bash-curl by @BbolroC in #9936
• CI: Eliminate dependency on tests repo by @BbolroC in #9932
• gha: ci: Remove incorrect secrets line by @stevenhorsman in #9947
• Upgrade to Cloud Hypervisor v40.0 by @likebreath in #9930
• tests: Update help section in openvino test by @cmaf in #9949
• kata-deploy: fix qemu static build on ppc64le by @Amulyam24 in #9914
• ci: Temporarily disable kata-deploy and GARM tests by @sprt in #9941
• genpolicy: add topologySpreadConstraints support by @Redent0r in #9577
• ci: Add scheduled job to cleanup resources, pt. II by @sprt in #9909
• osbuilder: allow rootfs builds w/o git or version file deps by @ms-mahuber in #9825
• docs: Remove jenkins reference from unit testing presentation by @GabyCT in #9952
• metrics: Remove variable in sysbench that is not being used by @GabyCT in #9954
• genpolicy: allow some empty env vars by @Redent0r in #9907
• runtime-rs: firecracker hypervisor backend by @Pyrromanis in #8070
• tests: Fixes TEE timeout issue by @AdithyaKrishnan in #9943
• ci: Transition GARM tests to free runners, pt. I by @sprt in #9960
• Fix issues on CI about guest-pull by @ChengyuZhu6 in #9695
• gha: Fix pip installation for nerdctl GHA by @GabyCT in #9971
• Image rs bump to latest main by @stevenhorsman in #9828
• tests: Use variable already defined in metrics common script for stability tests by @GabyCT in #9966
• Support Confidential Sealed Secrets (as env vars) by @fitzthum in #9719
• tests: Extend vfio-ap hotplug test to use a zcrypttest tool by @BbolroC in #9859
• tests: cri-containerd: Ensure Docker isn't present by @sprt in #9976
• Add memory and vcpus info to metrics results by @dborquez in #9973
• metrics: Remove duplicate check of processes from memory test. by @dborquez in #9987
• cri-containerd: Remove use_devmapper variable for cri-containerd tests by @GabyCT in #9985
• gha: make run-k8s-tests-on-zvsi inherit secrets by @stevenhorsman in #9981
• runtime: pass certificates to get extended attestation report for SNP coco by @niteeshkd in #9806
• scripts: Eliminate CI variable as it is not longer used by @GabyCT in #9962
• runtime-rs: bugfix for root bus slot allocation by @Apokleos in https:/...