Pullrun

v0.6.7 Feature

This release adds 3 notable features for engineering teams evaluating rollout.

Published 10d Containers & Orchestration

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Affected surfaces

auth breaking_upgrade

Summary

AI summary

Updates Rootless Linux, Smaller improvements, and Bug fixes across a mixed release.

Changes in this release

Type	Severity	Summary	CVE
Feature	Low	Adds support for digest prefix matching in `pullrun rmi <prefix>`. Adds support for digest prefix matching in `pullrun rmi <prefix>`. Source: llm_adapter@2026-07-17 Confidence: high	—
Bugfix
Bugfix	Medium	Fixes runc flag ordering for rootless Linux. Fixes runc flag ordering for rootless Linux. Source: llm_adapter@2026-07-17 Confidence: high	—
Bugfix	Medium	Fixes swallowed spawn failure in rootless start(). Fixes swallowed spawn failure in rootless start(). Source: llm_adapter@2026-07-17 Confidence: high	—
Bugfix	Medium	Fixes tag resolution for `pullrun save <tag>` to avoid empty archives. Fixes tag resolution for `pullrun save <tag>` to avoid empty archives. Source: llm_adapter@2026-07-17 Confidence: high	—
Bugfix	Medium	Fixes prune to remove exited workloads, allowing `pullrun rmi` on stopped image references. Fixes prune to remove exited workloads, allowing `pullrun rmi` on stopped image references. Source: llm_adapter@2026-07-17 Confidence: high	—
Bugfix	Medium	Fixes missing uid/gid mappings in rootless config application. Fixes missing uid/gid mappings in rootless config application. Source: llm_adapter@2026-07-17 Confidence: low	—
Bugfix	Low	Improves error message when a directory is passed as Dockerfile argument. Improves error message when a directory is passed as Dockerfile argument. Source: llm_adapter@2026-07-17 Confidence: high	—
Bugfix	Low	Fixes `walk_dag_collect` to error on invalid digest instead of using zero digest. Fixes `walk_dag_collect` to error on invalid digest instead of using zero digest. Source: llm_adapter@2026-07-17 Confidence: high	—
Bugfix	Low	Applies uid/gid mappings when applying rootless config. Applies uid/gid mappings when applying rootless config. Source: granite4.1:30b@2026-07-17-audit Confidence: low	—

Full changelog

Bug fixes

Rootless Linux (3 stacked bugs)

runc flag ordering — --root is a global runc flag and must come before the subcommand. Every rootless run previously died with flag provided but not defined: -root.
Swallowed spawn failure — rootless start() spawned runc run -d and returned Ok(()) without checking, so bug #1 surfaced as a phantom Started workload with exit code 0.
uid/gid mappings never applied — apply_rootless_config built a complete rootless patch but only applied the user namespace entry and noNewPrivileges. runc rejected with user namespaces enabled, but no uid mappings found.

Save tag resolution

pullrun save <tag> now resolves the tag to a digest via ListImages before export. Previously it silently produced a 2 KB empty archive when given a tag name. Unknown tags now produce a clear error.

Prune + rmi

pullrun prune now removes exited workloads from the workload map, so pullrun rmi on an image referenced by a stopped workload works without FailedPrecondition: image is in use by workload.

Smaller improvements

rmi digest prefix — pullrun rmi <prefix> now matches truncated digests (as displayed by pullrun images).
build directory guard — passing a directory as the Dockerfile arg now gives a clear error with the correct arg order hint.
dag_export — walk_dag_collect now errors on invalid digest instead of silently using the zero digest.

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track Pullrun

Get notified when new releases ship.

About Pullrun

All releases →