From 6711ac030fcffc4f08d2217ae1b5bd24978538b9 Mon Sep 17 00:00:00 2001
From: jasonwitty <jason.witty@bydeluxe.com>
Date: Mon, 24 Aug 2026 09:16:29 -0700
Subject: [PATCH] Pin socktop apt version (1.60.2-1); bump to 0.3.10

Image 0.3.9 baked socktop 1.60.1 because CI's registry layer cache reused
the apt-install layer from before the 1.60.2 release. 1.60.1 has no
--no-kill flag, so the restricted shell's invocation parsed it as the
positional websocket URL, breaking (and on overwrite, corrupting) the
local profile. Pinning the package version busts the cache and ties the
installed binary to the flags the restricted shell uses.

Also point the manifest's webterm container at the current tag so a
manual kubectl apply cannot roll the image back to 0.2.2.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 Cargo.lock                    | 2 +-
 Cargo.toml                    | 2 +-
 Dockerfile                    | 9 +++++++--
 kubernetes/03-deployment.yaml | 2 +-
 4 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 5a4706f..64886f8 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2609,7 +2609,7 @@ dependencies = [
 
 [[package]]
 name = "webterm"
-version = "0.3.8"
+version = "0.3.10"
 dependencies = [
  "actix",
  "actix-files",
diff --git a/Cargo.toml b/Cargo.toml
index 0067c2b..6a95f08 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -6,7 +6,7 @@ documentation = "https://docs.rs/webterm"
 readme = "README.md"
 categories = ["web-programming", "web-programming::websocket", "web-programming::http-server", "command-line-utilities"]
 keywords = ["terminal", "xterm", "websocket", "terminus", "console"]
-version = "0.3.9"
+version = "0.3.10"
 authors = ["fabian.freyer@physik.tu-berlin.de","jasonpwitty+socktop@proton.me"]
 edition = "2021"
 license = "BSD-3-Clause"
diff --git a/Dockerfile b/Dockerfile
index 2d6f306..29f1e27 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -121,12 +121,17 @@ RUN apt-get update && \
     curl \
     && rm -rf /var/lib/apt/lists/*
 
-# Add socktop APT repository and install packages
+# Add socktop APT repository and install packages.
+# The version is pinned: the restricted shell passes flags that must exist in
+# the installed binary (e.g. --no-kill), and CI's registry layer cache would
+# otherwise happily reuse an apt layer from before a socktop release. Bump the
+# pin together with any restricted-shell.sh change that uses a new flag.
+ARG SOCKTOP_VERSION=1.60.2-1
 RUN curl -fsSL https://jasonwitty.github.io/socktop/KEY.gpg | \
     gpg --dearmor -o /usr/share/keyrings/socktop-archive-keyring.gpg && \
     echo "deb [signed-by=/usr/share/keyrings/socktop-archive-keyring.gpg] https://jasonwitty.github.io/socktop stable main" > /etc/apt/sources.list.d/socktop.list && \
     apt-get update && \
-    apt-get install -y --no-install-recommends socktop socktop-agent && \
+    apt-get install -y --no-install-recommends socktop=${SOCKTOP_VERSION} socktop-agent=${SOCKTOP_VERSION} && \
     rm -rf /var/lib/apt/lists/*
 
 # Create application user (if not already exists from socktop packages)
diff --git a/kubernetes/03-deployment.yaml b/kubernetes/03-deployment.yaml
index dc0e61a..f416fa8 100644
--- a/kubernetes/03-deployment.yaml
+++ b/kubernetes/03-deployment.yaml
@@ -85,7 +85,7 @@ spec:
 
       containers:
         - name: webterm
-          image: gt.wittyoneoff.com/jason/socktop-webterm:0.2.2
+          image: gt.wittyoneoff.com/jason/socktop-webterm:0.3.10
           imagePullPolicy: Always
 
           command: ["/docker-entrypoint.sh"]