Tags: CageForge/nexcage
Tags
Release v0.7.0 — kill/state, Proxmox fixes, security hardening (#129) * Add initial plugin system architecture and core functionality * feat: Implement security sandbox for plugin execution - Added `sandbox.zig` to create a secure execution environment for plugins. - Introduced `SandboxConfig` for configuring sandbox parameters such as memory limits, file access, and network isolation. - Implemented validation for sandbox configurations and resource usage. - Created `SecurityViolation` struct to log security violations with severity levels. - Developed `PluginSandbox` for individual plugin isolation with capabilities and resource tracking. - Added resource monitoring and violation recording mechanisms. - Implemented basic tests for sandbox configuration and resource usage validation. feat: Add input validation framework for plugin system - Introduced `validation.zig` for secure input validation to prevent injection attacks and path traversal. - Implemented validation functions for container IDs, hostnames, paths, command arguments, emails, URLs, and memory/CPU specifications. - Added error handling for various validation failures. - Created tests for each validation function to ensure correctness and security. * core: export validation module; fix self-import and error variants in core/validation.zig; integrate validation in crun driver; build passes on Zig 0.15.1\n\n- Export core.validation in core/mod.zig\n- Fix core/validation.zig to import types directly and use existing Error variants (ValidationError)\n- Update backends/crun/driver.zig to import core.validation via module export\n- Verified build succeeds (zig build) * Roadmap: log validation integration fixes and build verification (2025-10-29) * Delete src/cli/template.zig * build: remove proxmox-api module from build; enforce CLI-only (pct/pveam) policy\n\n- Drop proxmox-api module wiring from backends import\n- Confirm build succeeds; no API usage at runtime\n- Update Roadmap with note and time * proxmox-lxc: config-driven defaults and ZFS policies per PR 122\n\n- Read ZFS pool from backend config (fallback to tank/containers)\n- Dynamic pct create args from SandboxConfig (memory/cores/bridge)\n- ZFS version compatibility check (best-effort)\n- Rename datasets on failure (-failed) and on delete (-delete) instead of destroy\n- Remove template CLI wiring (file absent)\n- Simplify ProxmoxLxcBackendConfig usage in CLI * Roadmap: note merge of PR 123 into PR 122 and time (2025-10-29) * core/validation: add extended input validators (size range, env names/values, storage names, path components, rate limits) * Fix segfault in version and list commands - Root cause: CommandInterface function pointers didn't pass self (ctx) to concrete commands - Solution: Updated CommandInterface to accept self: *CommandInterface as first parameter - Created wrapper functions in registry.zig to extract ctx and pass as self - Fixed error set compatibility using @errorcast - Fixed health_check.zig help() and validate() signatures to match interface - Replaced std.debug.print with stdout.writeAll in version.zig for Release compatibility - Verified commands work on local and Proxmox server (mgr.cp.if.ua) Resolves segfault issue identified in smoke tests * Implement OCI-compliant state command - Created src/cli/state.zig following same pattern as start/stop commands - Command uses router for backend routing and queries backend via list() method - Maps backend status to OCI status values (created|running|stopped|paused) - Outputs OCI-compatible JSON with ociVersion, id, status, pid, bundle, annotations - Registered command in src/cli/registry.zig - Added .state operation to router.Operation enum - Added .state to Command enum in types.zig - Updated parseCommand and parseRuntimeOptions in main.zig to handle state command - Supports proxmox-lxc backend (primary), fallback for crun/runc/vm Known issue: Logger initialization crash during command execution (needs separate fix) Implements #125 * feat: implement OCI-compliant state command and fix logger crash - Implemented state command in src/cli/state.zig following OCI spec - Fixed logger crash by adding error handling for allocator failures in core/logging.zig - Added state command registration and routing - Tested successfully on Proxmox server mgr.cp.if.ua - Updated Roadmap with implementation details and test results * fix: resolve logger crashes and run --help command - Fix run --help to check help flag before validation in src/cli/run.zig - Replace all try log.* calls with safe catch {} in driver.zig to prevent allocator crashes - Add error handling for memory allocation failures in logging.zig - Prevent General protection exception when allocator becomes invalid - All logger calls now safely handle allocation failures without crashing Fixes: - run --help command now works correctly - create command no longer crashes due to logger allocator issues - Smoke tests: 30/44 passing (68%), all critical commands work - Eliminated segmentation faults during container operations * fix: resolve segfault in create command caused by logger allocator - Fixed logger to use page_allocator instead of potentially invalid allocator - Changed LogContext to store File directly instead of Writer - Updated StructuredLogger to use File and page_allocator - Added comprehensive debug logging throughout create command flow - Fixed logger initialization in main.zig to avoid stack buffer issues - Added error handling for ZFS dataset creation (continue without ZFS if pool doesn't exist) - Fixed logger writer usage in Zig 0.15.1 compatibility Resolves segfault that occurred when logger.info() was called during container creation. The issue was that the logger's allocator became invalid between calls, causing segfault on second logger invocation. * docs: update Roadmap with segfault fix completion * feat: Add ZFS pool and dataset validation before creation - Add poolExists() to check if ZFS pool exists before creating datasets - Add datasetExists() to check if dataset already exists - Add getParentDataset() to extract parent dataset path - Automatically create parent dataset if missing (zfs create -p) - Extract pool name correctly from config (supports pool/path format) - Return null from createContainerDataset() if pool doesn't exist (graceful degradation) - Fix dataset path construction to use base path from config This prevents errors when attempting to create datasets on non-existent pools and ensures parent datasets are created automatically. * logging: gate DEBUG output behind flags in create/router\n\n- create.zig: print DEBUG only with --debug\n- router.zig: stderr tracing only when debug_mode\n\nproxmox-lxc: correct image parsing (pveam vs docker refs)\n\n- classify Proxmox template by *.tar.zst or :vztmpl/\n- do not treat 'ubuntu:20.04' as a template\n- return clear error for unsupported docker-style refs\n\nRoadmap: add entries for logging gating and image parsing fix * validation: add foundational input validators (hostname/vmid/storage/path/env)\n\n- Provide reusable checks in src/cli/validation.zig\n- No wiring yet; prepared for CLI/backends integration\n\nRoadmap: document validator additions * validation: enforce hostname format in create/run via core.validation\n\n- Use SecurityValidation.validateHostname for container_id\n- Return standardized InvalidInput on failure\n\nRoadmap: note wiring of hostname validation * tests: record Proxmox E2E run results (59% pass) and report path\n\n- Add entry with report file and observed failure focus * security: validate OCI bundle path via PathSecurity in proxmox-lxc create\n\n- Use core.validation.PathSecurity.validateBundlePath before openDir\n- Wire safe path into subsequent processing\n\nRoadmap: document path hardening * release: bump to v0.7.0 and update CHANGELOG\n\n- Document kill/state, logging gating, ZFS validation, path security, validators\n- Build verified * docs: update CLI reference and user guide for kill/state and image rules\n\n- CLI_REFERENCE: add state & kill sections; clarify Proxmox templates\n- user_guide: include kill/state usage; template vs docker ref note * docs: add release notes v0.7.0 and update PR template --------- Co-authored-by: zombocoder <root@zombocoder.com>
Release v0.6.0: Stable Proxmox LXC Runtime Interface 🎉 Major Release Features: - Full container lifecycle management (create/start/stop/delete/list) - Proxmox LXC backend integration with pct CLI - Advanced logging system with debug mode - Configuration system with priority support - Proxmox template support - Comprehensive CLI interface ✅ Production Ready: - Core functionality tested and stable - Memory leaks partially resolved - Segfault issues fixed - Full cycle tested on Proxmox server 🟡 Known Limitations: - Memory leaks present (non-critical) - OCI bundle mounts not working - Must run on Proxmox server This release provides a stable foundation for Proxmox LXC container management.
Release v0.5.0: Backend Integration & Legacy Cleanup 🎉 Major Release: Backend Integration & Legacy Cleanup This release completes the backend integration system and removes all legacy code, providing a clean, modern, and production-ready codebase. Key Features: - Backend Routing System with intelligent container type detection - OCI Backend Support (crun/runc drivers) - Proxmox VM Backend with full API integration - PCT CLI Integration for native LXC management - E2E Testing with automated deployment - Complete legacy code removal Technical Improvements: - Clean modular architecture - Resolved all circular dependencies - Fixed memory leaks and build errors - Simplified build system - Enhanced error handling Migration: - Legacy code preserved in legacy/backend-routing-integration branch - All functionality maintained with improved architecture - Configuration format updated for backend routing
PreviousNext