main 33a243c

2026-10-12

2f75a56fix(sandbox/vm): jailer cgroup v2 limits and PID namespace, rate limiters, keep network while the VMM may run, abortable boot, reap by --id, Lchown/fchown GPG Verifiedbrice
1905b39feat(sandbox): host-wide lock, ErrLeaked/ErrBusy, boot gate, ID and Isolation, free-space warning, new limits in config GPG Verifiedbrice
8784b11fix(guest): escalate cancellation SIGINT/SIGTERM/SIGKILL, stream through frame writers, forward init signals; cancel channel in Drive GPG Verifiedbrice
af04fdcfix(dnsfwd): bound TCP connections and in-flight queries per listener, absolute TCP deadline, drop saturated UDP GPG Verifiedbrice
a706491fix(netpolicy): check guest traffic before conntrack accepts, close gateway DNS to other interfaces, block more special-use ranges GPG Verifiedbrice
b5ce612docs(readme): document sandboxes, configuration and integration tests GPG Verifiedbrice
ea1f07etest(sandbox): add opt-in VM and container integration tests GPG Verifiedbrice
d928a74feat(runner): add the init, exec and sandbox-check subcommands GPG Verifiedbrice
ecb0362feat(sandbox/container): add the Docker container driver with label-based reaping GPG Verifiedbrice
82488a8feat(sandbox/vm): add the Firecracker micro-VM driver with jailer, TAP and crash reaping GPG Verifiedbrice
d85c6abfeat(guest): add init (guest PID 1) and the stub executor GPG Verifiedbrice
a743879feat(sandbox): add the Sandbox and Driver interfaces, config and isolation selection GPG Verifiedbrice
4f2d9a2feat(dnsfwd): add a UDP and TCP DNS forwarder for sandbox gateways GPG Verifiedbrice
2e4b251feat(netpolicy): generate and apply the nftables policy of job sandboxes GPG Verifiedbrice
b44fbc4feat(execstream): add the framed protobuf stream between host and executor GPG Verifiedbrice
c37a8f5build(images): add the guest kernel config, the Ubuntu 24.04 image and build scripts GPG Verifiedbrice
885c03fchore: bootstrap ermite-runner with license, README, lint and CI GPG Verifiedbrice

Keyboard shortcuts

Single-key shortcuts are on. ctrl k and esc work whatever this says.

ctrl k :
go to a section, branch, tag, file or repository
?
this list
j k
move the row cursor down / up
enter
open the row under the cursor; on Files, a directory opens or closes in place
↑ ↓ ← → home end
in the file tree (focus on a row): previous / next row, close / open a directory or go to its parent / first entry, first / last row. They never open a file
l h
on Files: open a directory or a file / close a directory or go up to its parent, then to the parent page. Elsewhere: into the side panel (on a merge request, its files) / back to the content; there j k move between its controls
g g G
first / last row
/
filter the list; on Files, find a file anywhere in the repository (esc clears, enter opens the best match)
b
switch branch or tag
g s g f g c g b g m g i g r g a
tabs: summary, files, commits, branches & tags, merge requests, issues, releases, actions (when available)
g h
home
w
wide mode: use the whole width of the screen, or not (remembered)
y
copy a permalink pinned to the commit
d u x
diff: split / unified / collapse or expand all
e E
diff: the whole file in view / every file, with the lines the hunks hide
n
merge request: next note in the diff
esc
close a dialog, leave a field

Branches 4

Tags 11

↑↓ moveenter openesc close