- CI now builds the image locally on the (arm64) runner and runs
scripts/verify-image-socktop-flags.sh before pushing: every --flag the
restricted/session shells pass must be documented by the socktop
binary actually installed in the image. Catches the 0.3.9 failure
class (cached apt layer shipping a pre-flag socktop) at build time.
- Manifest adds CHOWN/DAC_OVERRIDE/FOWNER alongside SETUID/SETGID:
with ALL dropped, uid 0 has no implicit file privilege and
prepare_demo_home crash-looped on the demo-owned 700 home dir.
Sessions still run with zero capabilities via setpriv.
- Agent liveness probe uses /proc instead of kill -0: without CAP_KILL
even root gets EPERM signalling the socktop-user agent, so the old
check false-alarmed in the pod logs.
- 0.3.11
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- Updated Rust toolchain from 1.90 to 1.91 (required by pop-telemetry)
- Migrated analytics to use pop-telemetry crate for privacy-focused telemetry
- Added dirs dependency for cross-platform config directory handling
- Refactored init-config.sh to handle permission restrictions in K8s
- Gracefully handles chown failures in restricted security contexts
- Uses alternative copy methods (cat > file) when cp fails
- Continues operation with warnings instead of failing
- Updated Dockerfile to use rust:1.91-slim-bookworm base image
- Changed telemetry configuration from endpoint/website_id to config file path
This addresses permission denied errors when deploying to K3s with
security contexts that prevent ownership changes on pre-existing directories.
jasonwitty
jason