Pin socktop apt version (1.60.2-1); bump to 0.3.10

Image 0.3.9 baked socktop 1.60.1 because CI's registry layer cache reused
the apt-install layer from before the 1.60.2 release. 1.60.1 has no
--no-kill flag, so the restricted shell's invocation parsed it as the
positional websocket URL, breaking (and on overwrite, corrupting) the
local profile. Pinning the package version busts the cache and ties the
installed binary to the flags the restricted shell uses.

Also point the manifest's webterm container at the current tag so a
manual kubectl apply cannot roll the image back to 0.2.2.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Cargo.lock

@@ -2609,7 +2609,7 @@ dependencies = [
 
 [[package]]
 name = "webterm"
-version = "0.3.8"
+version = "0.3.10"
 dependencies = [
  "actix",
  "actix-files",

Cargo.toml

@@ -6,7 +6,7 @@ documentation = "https://docs.rs/webterm"
 readme = "README.md"
 categories = ["web-programming", "web-programming::websocket", "web-programming::http-server", "command-line-utilities"]
 keywords = ["terminal", "xterm", "websocket", "terminus", "console"]
-version = "0.3.9"
+version = "0.3.10"
 authors = ["fabian.freyer@physik.tu-berlin.de","jasonpwitty+socktop@proton.me"]
 edition = "2021"
 license = "BSD-3-Clause"

Dockerfile

@@ -121,12 +121,17 @@ RUN apt-get update && \
     curl \
     && rm -rf /var/lib/apt/lists/*
 
-# Add socktop APT repository and install packages
+# Add socktop APT repository and install packages.
+# The version is pinned: the restricted shell passes flags that must exist in
+# the installed binary (e.g. --no-kill), and CI's registry layer cache would
+# otherwise happily reuse an apt layer from before a socktop release. Bump the
+# pin together with any restricted-shell.sh change that uses a new flag.
+ARG SOCKTOP_VERSION=1.60.2-1
 RUN curl -fsSL https://jasonwitty.github.io/socktop/KEY.gpg | \
     gpg --dearmor -o /usr/share/keyrings/socktop-archive-keyring.gpg && \
     echo "deb [signed-by=/usr/share/keyrings/socktop-archive-keyring.gpg] https://jasonwitty.github.io/socktop stable main" > /etc/apt/sources.list.d/socktop.list && \
     apt-get update && \
-    apt-get install -y --no-install-recommends socktop socktop-agent && \
+    apt-get install -y --no-install-recommends socktop=${SOCKTOP_VERSION} socktop-agent=${SOCKTOP_VERSION} && \
     rm -rf /var/lib/apt/lists/*
 
 # Create application user (if not already exists from socktop packages)

kubernetes/03-deployment.yaml

@@ -85,7 +85,7 @@ spec:
 
       containers:
         - name: webterm
-          image: gt.wittyoneoff.com/jason/socktop-webterm:0.2.2
+          image: gt.wittyoneoff.com/jason/socktop-webterm:0.3.10
           imagePullPolicy: Always
 
           command: ["/docker-entrypoint.sh"]