This release adds 3 notable features for engineering teams evaluating rollout.
✓ No known CVEs patched in this version
Topics
Summary
AI summaryUpdates nix/smolvm, virtiofs, and fix across a mixed release.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Feature | Medium |
Return 404 for missing registry image and carry raw exec output bytes alongside lossy text. Return 404 for missing registry image and carry raw exec output bytes alongside lossy text. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Feature | Medium |
Brokered P2P layer-blob sharing on engine side. Brokered P2P layer-blob sharing on engine side. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Feature | Medium |
Decompress zstd image layers in the guest agent, not just gzip. Decompress zstd image layers in the guest agent, not just gzip. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Feature | Medium |
Add CUDA support with forward‑to‑host‑libs remoting and guest‑RAM zero‑copy. Add CUDA support with forward‑to‑host‑libs remoting and guest‑RAM zero‑copy. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Feature | Medium |
Auto‑stage CUDA guest shims into --cuda containers and auto‑discover host CUDA libraries. Auto‑stage CUDA guest shims into --cuda containers and auto‑discover host CUDA libraries. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Feature | Medium |
Add Rosetta 2 x86_64 binary translation on Apple Silicon. Add Rosetta 2 x86_64 binary translation on Apple Silicon. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Feature | Low |
Give user volumes and packed layers a DAX window in virtiofs. Give user volumes and packed layers a DAX window in virtiofs. Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Dependency | Medium |
Bump libkrunfw submodule to 6.12.95 so overlay re‑cuts carry the current guest kernel. Bump libkrunfw submodule to 6.12.95 so overlay re‑cuts carry the current guest kernel. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Dependency | Medium |
Bump libkrun to merged main (b982e75) and refresh all bundled libs. Bump libkrun to merged main (b982e75) and refresh all bundled libs. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Dependency | Low |
Update nix/smolvm to latest GitHub release. Update nix/smolvm to latest GitHub release. Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Bugfix | Medium |
Fix ssh‑agent forwarding for non‑interactive exec/run via the keep‑alive container. Fix ssh‑agent forwarding for non‑interactive exec/run via the keep‑alive container. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Bugfix | Medium |
Reliably kill _boot‑vm child on start failure to prevent orphan processes. Reliably kill _boot‑vm child on start failure to prevent orphan processes. Source: llm_adapter@2026-07-15 Confidence: high |
— |
Full changelog
What's Changed
- Return 404 for a missing registry image and carry raw exec output bytes alongside the lossy text by @BinSquare in https://github.com/smol-machines/smolvm/pull/565
- Brokered P2P layer-blob sharing (engine side) by @BinSquare in https://github.com/smol-machines/smolvm/pull/566
- decompress zstd image layers in the guest agent, not just gzip by @BinSquare in https://github.com/smol-machines/smolvm/pull/568
- nix/smolvm: Update to latest github release by @mmlb in https://github.com/smol-machines/smolvm/pull/571
- Fix the clippy byte_char_slices lint failing CI on main by @BinSquare in https://github.com/smol-machines/smolvm/pull/575
- Bump the libkrunfw submodule to 6.12.95 so overlay re-cuts carry the current guest kernel by @BinSquare in https://github.com/smol-machines/smolvm/pull/567
- fix incomplete ssh-agent examples in the docs by @BinSquare in https://github.com/smol-machines/smolvm/pull/576
- fix ssh-agent forwarding for non-interactive exec/run via the keep-alive container by @BinSquare in https://github.com/smol-machines/smolvm/pull/578
- virtiofs: give user volumes and packed layers a DAX window by @BinSquare in https://github.com/smol-machines/smolvm/pull/581
- fix: reliably kill _boot-vm child on start failure to prevent orphans by @geekgonecrazy in https://github.com/smol-machines/smolvm/pull/583
- libkrun: bump to merged main (b982e75) and refresh all bundled libs by @BinSquare in https://github.com/smol-machines/smolvm/pull/584
- CUDA support: forward-to-host-libs remoting with guest-RAM zero-copy by @BinSquare in https://github.com/smol-machines/smolvm/pull/577
- cuda: auto-stage guest shims into --cuda containers and auto-discover host CUDA libraries by @BinSquare in https://github.com/smol-machines/smolvm/pull/585
- Add Rosetta 2 x86_64 binary translation on Apple Silicon by @BinSquare in https://github.com/smol-machines/smolvm/pull/580
- Rebuild the Windows krun.dll with disk exports and add a bundled-libkrun symbol check to CI by @BinSquare in https://github.com/smol-machines/smolvm/pull/586
- release: smolvm 1.5.0 — guest kernel 6.12.95, zstd image layers, ssh-agent exec/run fix by @BinSquare in https://github.com/smol-machines/smolvm/pull/579
New Contributors
- @mmlb made their first contribution in https://github.com/smol-machines/smolvm/pull/571
Full Changelog: https://github.com/smol-machines/smolvm/compare/v1.4.7...v1.5.0
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About smolvm
Tool to build & run portable, lightweight, self-contained virtual machines.
Related context
Related tools
Earlier breaking changes
- v1.0.0 Remove built‑in store; VM now relies on host environment/files only.
Beta — feedback welcome: [email protected]