v0.3.0

Minor Changes

• 2003bb3 Thanks @angelorc! - Add vmsan snapshot command group with create, list, and delete subcommands for saving and restoring VM state.

v0.2.1

Patch Changes

• #72 204b06e Thanks @angelorc! - Move built-in runtime distribution to Cloudflare R2.

  • switch release installs to manifest-driven runtime downloads
  • keep source installs on local runtime builds
  • reduce default install requirements by removing Docker from the normal release path

v0.2.0

Minor Changes

• #66 10841fa Thanks @angelorc! - Migrate firewall backend from iptables to nftables with atomic rule application.

  Breaking changes:

  • ICMP blocked by default from VMs (prevents ICMP tunneling)
  • UDP blocked by default except DNS (prevents UDP data exfiltration)
  • nftables kernel support required on host (kernel ≥ 5.10)
  • Reserved port ranges: 10053-10307, 10443-10697, 10080-10334 (for future DNS/SNI proxy)
  • Host firewalls (ufw/firewalld) may need explicit allow rules for vmsan traffic

  New features:

  • Atomic nftables rule application via google/nftables netlink library
  • Per-VM table isolation (vmsan_<vmId>) — one DelTable() for complete cleanup
  • DoT (TCP 853) and DoH blocking for DNS bypass prevention
  • Cross-VM isolation blocking internal subnets
  • Deterministic port allocation for future DNS/SNI proxy
  • Per-namespace ip_forward setting
  • vmsan doctor checks for nftables kernel support and host firewall detection
  • Backward compatibility: VMSAN_LEGACY_IPTABLES=1 env var for iptables fallback

v0.1.1

Patch Changes

• #68 55b6ab6 Thanks @angelorc! - Detect nodev filesystem and /dev/net/tun issues that prevent Firecracker from opening TAP devices inside the jailer chroot. Adds doctor checks and actionable error messages with fix instructions.

v0.1.0-beta.2

Minor Changes

• #56 07ac73b Thanks @angelorc! - feat: add vmsan doctor diagnostic command and fix JSON output consistency

Patch Changes

• #55 0899f7f Thanks @angelorc! - docs: sync documentation with beta.1 CLI changes

• #54 d518f9a Thanks @angelorc! - test: add e2e smoke test script and manual test matrix

Full Changelog: v0.1.0-beta.1...v0.1.0-beta.2

v0.1.0

Minor Changes

• #56 07ac73b Thanks @angelorc! - feat: add vmsan doctor diagnostic command and fix JSON output consistency

• #47 bfc12a7 Thanks @angelorc! - Add KVM pre-flight check to vmsan create and cleanup verification after vmsan stop/vmsan remove

• #46 913e721 Thanks @angelorc! - Add state file versioning to VM state store for future migration support

Patch Changes

• #48 c824d44 Thanks @angelorc! - Audit and fix CLI help text for all commands

• #55 0899f7f Thanks @angelorc! - docs: sync documentation with beta.1 CLI changes

• #59 14492aa Thanks @angelorc! - docs: add known limitations and doctor command to README

• #54 d518f9a Thanks @angelorc! - test: add e2e smoke test script and manual test matrix

• #60 d96e740 Thanks @angelorc! - fix: use hoisted linker for docs to work around @nuxt/content context isolation bug

• #63 de8fb76 Thanks @angelorc! - fix: include error code and fix/why fields at top level of JSON error output

• #44 725924c Thanks @angelorc! - Fix install failure on systems without loop devices by replacing mount -o loop with mkfs.ext4 -d for rootfs creation, and auto-install Docker when not found instead of skipping runtime builds.

• #40 fe41441 Thanks @angelorc! - Harden installer and VM networking reliability across mixed Linux hosts.

  • fix branch/commit installs and uninstalls in install.sh, including safer cleanup of per-VM iptables rules
  • migrate the default VM subnet to 198.19.x.x while preserving compatibility with legacy persisted 172.16.x.x states
  • keep stopped VM slots reserved, tighten persisted IP parsing, and restore agent connectivity on hosts with restrictive local firewalls

• #62 5092c9d Thanks @angelorc! - Persist isolation flags (disableSeccomp, disablePidNs, disableCgroup) in VM state so they are honored on restart

• #36 b9a5d9c Thanks @angelorc! - Improve runtime VM usability and the release lifecycle.

  • fix PATH handling for agent exec and PTY shells so Node/npm and user-global installs work reliably inside runtime VMs
  • improve source installs in install.sh with branch/commit bootstrap support and modern Go enforcement
  • switch the project to a real Changesets workflow with authored changesets, release PRs, and npm/agent publishing from reviewed version commits

• #49 cab910a Thanks @angelorc! - Add comprehensive unit test suite and reduce stale lock timeout from 5m to 30s

v0.1.0-beta.1

Minor Changes

• #47 bfc12a7 Thanks @angelorc! - Add KVM pre-flight check to vmsan create and cleanup verification after vmsan stop/vmsan remove

• #46 913e721 Thanks @angelorc! - Add state file versioning to VM state store for future migration support

Patch Changes

• #48 c824d44 Thanks @angelorc! - Audit and fix CLI help text for all commands

• #49 cab910a Thanks @angelorc! - Add comprehensive unit test suite and reduce stale lock timeout from 5m to 30s

Full Changelog: v0.1.0-alpha.27...v0.1.0-beta.1

v0.1.0-alpha.27

Patch Changes

• #44 725924c Thanks @angelorc! - Fix install failure on systems without loop devices by replacing mount -o loop with mkfs.ext4 -d for rootfs creation, and auto-install Docker when not found instead of skipping runtime builds.

Full Changelog: v0.1.0-alpha.26...v0.1.0-alpha.27

v0.1.0-alpha.26

Patch Changes

• #40 fe41441 Thanks @angelorc! - Harden installer and VM networking reliability across mixed Linux hosts.

  • fix branch/commit installs and uninstalls in install.sh, including safer cleanup of per-VM iptables rules
  • migrate the default VM subnet to 198.19.x.x while preserving compatibility with legacy persisted 172.16.x.x states
  • keep stopped VM slots reserved, tighten persisted IP parsing, and restore agent connectivity on hosts with restrictive local firewalls

v0.1.0-alpha.25

Patch Changes

• #36 b9a5d9c Thanks @angelorc! - Improve runtime VM usability and the release lifecycle.

  • fix PATH handling for agent exec and PTY shells so Node/npm and user-global installs work reliably inside runtime VMs
  • improve source installs in install.sh with branch/commit bootstrap support and modern Go enforcement
  • switch the project to a real Changesets workflow with authored changesets, release PRs, and npm/agent publishing from reviewed version commits

What's Changed

• feat: pre-built runtime images and remove node22-demo by @angelorc in #36
• Version Packages (alpha) by @github-actions[bot] in #38
• fix: format changeset prerelease state by @angelorc in #39

Full Changelog: v0.1.0-alpha.24...v0.1.0-alpha.25