v1.7.0-rc.21

Full Changelog: v1.7.0-rc.20...v1.7.0-rc.21

[1.7.0-rc.21] — 2026-10-09

Lifecycle hook labels baked into an image are no longer carried onto a recreated container. When drydock replaces a container it now leaves out any dd.hook.* label whose key and value match the image the old container was created from, so a label an image baked in can't become a container label and run at a later update. Labels you set on the container are carried over unchanged. The check runs on every recreate, whatever DD_HOOKS_ENABLED and DD_HOOKS_ALLOW_IMAGE_LABELS are set to. If the old image's labels can't be read, hook labels are left off the new container and a warning is logged. A container an earlier version already recreated can still carry such a label; Labels baked into images shows how to check. The hook provenance failure now ends with its code, [hook-provenance-unverified], in the log, the audit entry and the update operation.

The Playwright suite no longer fails now and then with route.fetch: socket hang up in the stabilization countdown test. The server closes an idle keep-alive connection six seconds after its last response, Playwright's request client never expires its pooled ones, and a fetch that reused one right at that moment died. Intercepted fetches now retry a connection reset, the way a browser already does.