github flatcar/scripts stable-4459.2.0
on GitHub

latest releases: main-4516.0.0-nightly-20251111-2100, alpha-4487.0.1-nightly-20251111-2100, beta-4459.1.1...
11 hours ago

Changes since Stable 4230.2.4

Security fixes:

Bug fixes:

  • Enabled CONFIG_CPUSETS_V1 to mitigate cgroupsv1 removal (e.g JVM) (Flatcar#1884)
  • Enabled CONFIG_MEMCG_V1 to mitigate cgroupsv1 removal (e.g JVM) (Flatcar#1884)
  • Excluded TUN/TAP interfaces from the default DHCP network configuration to solve conflicts with the programs that created them (Flatcar#1933)
  • Fix non-conforming GPT partition table (Flatcar#1651)
  • Fixed Intel microcode updates which were broken in recent Alpha and Beta releases by switching back to built-in extra firmware instead of early cpio inclusion (Flatcar#1909)
  • Fixed a UID/GID mis-alignment for user/group messagebus between acct-user/acct-group and baselayout. (baselayout#36)
  • Fixed path handling in the QEMU .sh launcher scripts. Given paths now are relative to the current directory and absolute paths work as you would expect.
  • Fixed race condition in the script that grows the root partition to fill the disk. This bug sometimes caused the operation to not occur. (init#132)
  • Fixed that the needed Flatcar extensions don't get removed on update which caused a re-download (update_engine#51)
  • Reenabled console support for DRM drivers, so that with the virtio graphics driver the interactive console is shown again after boot (Flatcar#1834)
  • azure: Fixed issue of wa-linux-agent overriding ssh public key from ignition configuration during provisioning (flatcar/Flatcar#1661)
  • sysext-podman: removed /etc/subuid and /etc/subgid generation for core user, before this change it partially overwrites the file and causes issues. (Flatcar#1733) This could be created through initial provisioning. (scripts#3043)
  • update-ssh-keys: More intuitive --help text and the -n (no-replace) option has been fixed. (flatcar/Flatcar#1554)

Changes:

  • Added overlaybd system extension to support accelerated container images. Add overlaybd to /etc/flatcar/enabled-sysext.conf to check it out. The extension includes both overlaybd as well as accelerated-container-image tools.
  • Added changes for our secureboot signed images with our signed release process until the official shim signing (scripts#2754)
  • Added nftables-load.service and nftables-store.service services to load/store rules from/in /var/lib/nftables/rules-save (Flatcar#900)
  • Added support for podman in toolbox (toolbox#11)
  • Allow per-sysext USE flags and architecture-specific sysexts. (scripts#2798)
  • Always truncate hostnames on the first occurrence of . (cloud-init#32)
  • Azure OEM: add inotify-tools, python urllib3 (flatcar/scripts#3116)
  • Build Intel iGPU i915 driver as module (scripts#2349)
  • Compiled OS-dependent NVIDIA kernel module sysexts signed for secure boot. (scripts#2798)
  • Enabled CONFIG_INET_DIAG_DESTROY in kernel options (flatcar/scripts#3176)
  • Enabled EROFS module with XATTR support (Flatcar#1659)
  • Enabled virtiofs and fuse-dax modules in the kernel for advaned Qemu usecases. Thank you @aaronk6! (Flatcar#2825)
  • Ensured hostnames never exceeds 63 characters, regardless of the metadata provider (cloud-init#31)
  • Hyper-V images now use a systemd-sysext image for layering additional platform-specific software on top of /usr
  • Provided an Incus Flatcar extension as optional systemd-sysext image with the release. Write 'incus' to /etc/flatcar/enabled-sysext.conf through Ignition and the sysext will be installed during provisioning. (scripts#1655)
  • Scaleway: The Linux console is now attached to the correct console port. (scripts#3383)
  • Signed out-of-tree kernel modules using the ephemeral signing key so that ZFS and NVIDIA sysexts can work with secure boot. (scripts#2636)
  • The kernel image and its embedded initrd are now compressed with xz rather than zstd. This gives greater compression at the cost of decompression performance. Systems may therefore now be ever so slightly slower to boot, but this was necessary to avoid running out of space in the /boot partition. Further measures to address the space issue are planned, and perhaps we can switch back to zstd in a later release.
  • The qemu script (flatcar_production_qemu*.sh) received two new options. -D (or -image-disk-opts) can be used to add extra options to the virtio-blk-pci device for primary disk. -d (or -disk) can be used to add extra disks to the machine - this one takes a path to a raw or qcow2 image file and, after a comma, virtio-blk-pci options. To learn what disk options can be passed to -D or -d, call qemu-system-x86_64 -device virtio-blk-pci,help (qemu-system-aarch64 can be used too).
  • /boot is now only accessible by the root user for better security. (Flatcar#296)
  • ftrace syscalls also available in ARM64 builds. (Enables syscall tracepoints) (flatcar/scripts#2600)
  • sysext-incus: removed /etc/subuid and /etc/subgid generation for root user, it has to be created through initial provisioning. (scripts#3028)
  • systemd now uses OpenSSL instead of gcrypt for cryptography to reduce the size of the initrd. This change disables systemd-journal's Forward Secure Sealing feature, but it is generally not useful for Flatcar.

Updates:

Changes since Beta 4459.1.0

Security fixes:

Bug fixes:

  • Enabled CONFIG_MEMCG_V1 to mitigate cgroupsv1 removal (e.g JVM) (Flatcar#1884)
  • Excluded TUN/TAP interfaces from the default DHCP network configuration to solve conflicts with the programs that created them (Flatcar#1933)
  • Fixed Intel microcode updates which were broken in recent Alpha and Beta releases by switching back to built-in extra firmware instead of early cpio inclusion (Flatcar#1909)
  • Fixed that the needed Flatcar extensions don't get removed on update which caused a re-download (update_engine#51)

Changes:

  • Scaleway: The Linux console is now attached to the correct console port. (scripts#3383)

Updates:

Check out latest releases or
releases around flatcar/scripts stable-4459.2.0

Don't miss a new scripts release

NewReleases is sending notifications on new releases.

Get notifications