chore(release): 0.11.0-rc.7 - #469
Merged
Merged
Conversation
Carries #468: the container-logs@1 grant can now serve a real Docker client. The contract has shipped since 0.11.0-rc.1 with no provider to exercise it. Packaging one (Dozzle, try-hola/apps#160) found three ways the proxy refused the clients it exists for — HEAD was rejected outright, so every Docker client failed on its first call; `/info` was refused, which an SDK client treats as "no engine"; and the redacted inspect omitted structural fields clients walk without nil-checking, segfaulting them. All three were shape, not policy: the grant discloses exactly what it did before, and stats, archive, images, secrets, volumes, restart, exec and delete were all re-verified at 403 on a VM after the fix. This is the release a container-logs provider needs. On rc.6 or earlier such an app installs and its proxy sidecar appears, but the app itself crash-loops. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Vck5KSX2CLxhohx14nb5Sh
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Version bump only — the usual seven files (five
package.json,packages/cli/src/version.ts,bun.lock).What ships in rc.7
#468 — the
container-logs@1grant can serve a real Docker client. The contract has been implemented since 0.11.0-rc.1 with nothing to exercise it. Packaging the first provider (Dozzle, try-hola/apps#160) and installing it on a VM found three defects, all shape rather than policy:HEADwas refused, so every Docker client failed on its first call (HEAD /_ping) and reported it as "no engine";GET /infowas refused, which a client on Docker's SDK treats as no engine present — now rebuilt from an allowlist that dropsHttpProxy/HttpsProxy,RegistryConfig,Plugins,Swarm;HostConfig/Mounts/NetworkSettings, which clients walk without nil-checking — now present but empty.The grant discloses exactly what it did before. After the fix, on the same VM, Dozzle reports
Connected to Dockerand reads a neighbouring app's logs withsh.hola.applabels intact, while stats,archive, images, secrets, volumes,POST restart,POST execandDELETEwere all re-verified at 403.This is the release a container-logs provider needs. On rc.6 or earlier such an app installs and its proxy sidecar appears, but the app crash-loops.
Gate
bun run typecheck && bun run lint && bun run typecheck && bun run test && bun run build— green (983 server + 360 web).Merging tags
cli-v0.11.0-rc.7, which builds the multi-arch images, the compose bundle and the four CLI binaries as a prerelease.:latestis unaffected.🤖 Generated with Claude Code
https://claude.ai/code/session_01Vck5KSX2CLxhohx14nb5Sh