- container/ (directory) refactor(registryproxy): simplify the proxy store, guest timing contract and size parsing
- disk/ (directory) fix(sandbox/container): host lock, deny-privileged and per-job warning, pids and swap limits, loop-mounted scratch disk, keep policy while the container may run, abortable boot, ErrLeaked
- drivers/ (directory) refactor(container): rename the rootless option UnsafeAllowRootlessForTests and test that production never sets it (G4)
- integration/ (directory) feat(image): binfmt_misc in the guest kernel (#37)
- netsetup/ (directory) fix(tcprelay): free-bind the relay under podman and rate-limit saturation warnings
- sandboxtest/ (directory) feat(cache): serve the cache on the guest loopback over the host channel (#27)
- vm/ (directory) refactor(registryproxy): simplify the proxy store, guest timing contract and size parsing
- cache.go 1.8 KiB feat(ci): artifacts v4 results service (#32)
- config.go 11.6 KiB feat(images): move the job image to Ubuntu 26.04 LTS
- contract.go 2.6 KiB feat(cache): serve the cache on the guest loopback over the host channel (#27)
- core_test.go 4.6 KiB feat(sandbox): host-wide lock, ErrLeaked/ErrBusy, boot gate, ID and Isolation, free-space warning, new limits in config
- externals.go 1.6 KiB feat(externals): provide pinned Node.js to sandboxes outside the image
- gate.go 1.3 KiB feat(sandbox): host-wide lock, ErrLeaked/ErrBusy, boot gate, ID and Isolation, free-space warning, new limits in config
- guestforge.go 7.3 KiB feat(container): run as an unprivileged container with a guest forge relay and first-run registration
- guestforge_test.go 6.2 KiB feat(container): run as an unprivileged container with a guest forge relay and first-run registration
- id.go 770 B feat(sandbox): add the Sandbox and Driver interfaces, config and isolation selection
- lock.go 1.6 KiB feat(sandbox): host-wide lock, ErrLeaked/ErrBusy, boot gate, ID and Isolation, free-space warning, new limits in config
- sandbox.go 6.3 KiB refactor(registryproxy): simplify the proxy store, guest timing contract and size parsing
- sandbox_test.go 10.3 KiB feat(externals): provide pinned Node.js to sandboxes outside the image
- select.go 4.6 KiB feat(sandbox): add the Sandbox and Driver interfaces, config and isolation selection
- space.go 1.4 KiB chore(build): consistent image tag, exact kernel option matching, e2fsprogs check, CI proto drift check; docs for the new limits, host lock and ip_forward
- tmpmode_test.go 700 B fix(sandbox): make the job's /tmp sticky