smolvm

v1.0.4 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 1mo Virtualization

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 1 known CVE

Topics

containers crun libkrun microvm rust virtual-machine

Affected surfaces

auth rbac crypto_tls

Summary

AI summary

Added mTLS to serve API, introduced UDP relay and ICMP ping support in network modules, and fixed net port auto‑selection with egress restrictions.

Full changelog

What's Changed

feat(network): general UDP relay for virtio-net by @BinSquare in https://github.com/smol-machines/smolvm/pull/382
fix(api): echo networkBackend and allowedCidrs in machine info by @BinSquare in https://github.com/smol-machines/smolvm/pull/383
fix(net): published ports auto-select virtio-net (TSI is outbound-only) by @BinSquare in https://github.com/smol-machines/smolvm/pull/385
fix(api): start launches image workload + ports default to virtio-net by @BinSquare in https://github.com/smol-machines/smolvm/pull/386
feat: relay guest ICMP echo (ping) on virtio-net by @BinSquare in https://github.com/smol-machines/smolvm/pull/384
fix(seccomp): complete the VMM allowlist so enforce mode is safe by @BinSquare in https://github.com/smol-machines/smolvm/pull/387
test(fuzz): cargo-fuzz the guest-frame classifier by @BinSquare in https://github.com/smol-machines/smolvm/pull/388
fix(net): egress hard-floor — deny metadata/internal for all guests by @BinSquare in https://github.com/smol-machines/smolvm/pull/389
feat(serve): mTLS for fleet serve API (client-cert verify, fail-closed) by @BinSquare in https://github.com/smol-machines/smolvm/pull/391
feat(serve): dual listener — loopback plain-HTTP door for local node-agent under mTLS by @BinSquare in https://github.com/smol-machines/smolvm/pull/392
fix(embedded): carry gpu resources through MachineSpec::to_record by @BinSquare in https://github.com/smol-machines/smolvm/pull/393
Fix init readiness race for machine run by @Adityakk9031 in https://github.com/smol-machines/smolvm/pull/371
feat(serve): lossless restart — per-VM systemd scopes + detach + explicit drain by @BinSquare in https://github.com/smol-machines/smolvm/pull/394
bump: v1.0.4 by @BinSquare in https://github.com/smol-machines/smolvm/pull/396

New Contributors

@Adityakk9031 made their first contribution in https://github.com/smol-machines/smolvm/pull/371

Full Changelog: https://github.com/smol-machines/smolvm/compare/v1.0.3...v1.0.4

Security Fixes

Complete VMM seccomp allowlist to safely enforce mode

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track smolvm

Get notified when new releases ship.

About smolvm

Tool to build & run portable, lightweight, self-contained virtual machines.

All releases →

Related context

Related tools

Earlier breaking changes

v1.0.0 Remove built‑in store; VM now relies on host environment/files only.