smolvm

v1.3.9 Security

This release includes 3 security fixes for security teams reviewing exposed deployments.

Published 24d Virtualization

✓ No known CVEs patched

This release patches 3 known CVEs

Topics

containers crun libkrun microvm rust virtual-machine

Affected surfaces

auth rbac

Summary

AI summary

Bump the engine to version 1.3.9 and add /dev/kmsg for nested Kubernetes support.

Full changelog

fix(fork): regenerate per-machine on-disk secrets and fail closed on clone rejuvenation by @BinSquare in https://github.com/smol-machines/smolvm/pull/531
Run streamed exec inside the persistent container overlay on image machines so SDK streamed changes survive by @BinSquare in https://github.com/smol-machines/smolvm/pull/534
Bump libkrun to the virtio-fs/gpu mapping-bounds-hardened build and refresh the bundled linux library by @BinSquare in https://github.com/smol-machines/smolvm/pull/526
Mark the aarch64 seccomp allowlist validated for enforce by @BinSquare in https://github.com/smol-machines/smolvm/pull/535
Fail closed to a strict egress floor on serve nodes by @BinSquare in https://github.com/smol-machines/smolvm/pull/536
Validate content digests before they become filesystem paths by @BinSquare in https://github.com/smol-machines/smolvm/pull/537
Add /dev/kmsg to the container device set so nested Kubernetes works out of the box by @BinSquare in https://github.com/smol-machines/smolvm/pull/538
Bump the engine to 1.3.9 by @BinSquare in https://github.com/smol-machines/smolvm/pull/539

Full Changelog: https://github.com/smol-machines/smolvm/compare/v1.3.8...v1.3.9

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track smolvm

Get notified when new releases ship.

About smolvm

Tool to build & run portable, lightweight, self-contained virtual machines.