Skip to content

chore(release): prepare v0.6.0 - #433

Merged
WaylandYang merged 1 commit into
devfrom
feature/release-0.6.0
Nov 1, 2026
Merged

WaylandYang merged 1 commit into
devfrom
feature/release-0.6.0

Conversation

@WaylandYang

Copy link
Copy Markdown
Contributor

Prepares v0.6.0. Nothing here tags or publishes.

Fixed: would have broken the release

  • The Docker image did not build. node/images.rs compiles in rootfs-init/, and the Dockerfile did not copy it. Reproduced with exactly the files the Dockerfile copies: two couldn't read errors, and with rootfs-init added the check passes.
  • The binary needed glibc 2.38. Built on ubuntu-latest it binds __isoc23_sscanf@GLIBC_2.38, so Ubuntu 22.04 and Debian 12 could not run it, and a node runs the master's binary. The 2.39 symbols are weak and do not bind. binaries now runs on ubuntu-22.04.
  • Cargo.lock was ignored, so a release resolved its dependencies on the day. It is now tracked, and the release and the image build with --locked. This is the lockfile from the build tested below.

New

ci-release builds the Docker image and checks the glibc floor on pull requests, because release.yml otherwise only runs on a tag. This PR is its first run, and that is the real proof of the two fixes above: Docker Hub cannot be reached from the test host, so docker build itself was not run there.

Versions

Package From To
sandstorm-core, sandstorm-sdk, @deeplethe/sandstorm 0.5.3 0.6.0
sandstorm-mcp 0.2.1 0.3.0

Unreleased becomes v0.6.0 - 2026-11-01, with a summary and the note that v0.5 does not upgrade in place. The README Status says v0.6 is current. The date needs changing if the tag lands on another day.

Closes #317

#317 on KVM

Bare metal, --backend firecracker on XFS, dev at ce5beff, one tag forked into 4 children at once. 0 failed.

  • Each Firecracker holds a different inode under its own layers/<id>/disk/rootfs.ext4, and nothing holds the template's or the tag's image.
  • Each child wrote the same paths, including 32 MiB of random data, at the same time. After going to the snapshot tier and back, each read only its own writes, and the data's hash matched.
  • e2fsck -fn is clean on all 4 disks, checked while no process held them, and on the tag's image.
  • The tag's rootfs.ext4 hashes the same before and after, and the parent was untouched.

🤖 Generated with Claude Code

The Docker image no longer built: image templates compile in
rootfs-init, which the Dockerfile did not copy. Only a tag runs that
build, so nothing had noticed. The release binary, built on ubuntu-latest,
needed glibc 2.38 and would not start on Ubuntu 22.04 or Debian 12.

Build the binary on ubuntu-22.04, and add ci-release so both are tried on
a pull request rather than on a tag.

Track Cargo.lock, which was ignored, so a release builds what was tested,
and build with --locked.

Bump the core and SDKs to 0.6.0 and the MCP server to 0.3.0, and turn
Unreleased into v0.6.0 with the note that v0.5 does not upgrade in place.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: WaylandYang <145302500+WaylandYang@users.noreply.github.com>
@WaylandYang
WaylandYang merged commit 3714ea2 into dev Nov 1, 2026
14 checks passed
@WaylandYang
WaylandYang deleted the feature/release-0.6.0 branch November 1, 2026 03:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Firecracker backend: verify on KVM that forks of one tag never share a writable rootfs

1 participant