github.com/appc/spec

This is a minor release of the spec which resolves some small issues.

• A circular dependency is resolved by duplicating k8s.io/kubernetes/pkg/api/resource in-tree (#684)
• The ACE validator no longer expects the variables removed in #273 (#674)
• Some documentation updates (#676, #677, #680)

This is a minor release of the spec which includes a new isolator and a utility function to translate between appc and golang architectures.

• the os/linux/selinux-context isolator, which allows apps and pods to specify the SELinux context for their process (#673)
• schema.ToAppcOSArch() and ToGoOSArch(), functions that translate OS and architecture names. (#668)

v0.8.8

This is a minor release of the spec which includes some new small features intended to simplify implementation of the Kubernetes CRI (Container Runtime Interface)

Spec additions:

• Two new isolators: 'os/linux/oom-score-adj' and 'os/linux/cpu-shares' (#658, #661)
• UserAnnotations and UserLabels for both Pods and Apps: key-vaue pairs exclusively for end-user use (#663)
• The ability to specify a complete ExposedPort+PodPort and Volume+Mount, instead of matching by name (#656)

Bugfixes:

• Fixed a go vet failure in discovery/http.go

This is a minor but significant release of the spec with several new features, one notable bugfix, and some changes to the tooling codebase.

Changes to the spec since the previous release:

• Added an optional image manifest annotation, appc.io/executor/supports-systemd-notify, to allow apps to express whether they support notifications using sd_notify(). This may be used to signal that services within a pod are ready (#626)

• Added several new architectures to the validated whitelist: ppc64, ppc64le, s390x (#639, #651)

• Added a new os/unix/sysctl isolator class to the spec, and associated schema code (#647)

  Tooling and code changes:

• Added the ability to override capability isolators to actool patch-manifest. This changes the behaviour of the --capability and --revoke-capability flags (#638)

• Fixed a bug in the ACE validator where it was not correctly merging annotations it was checking (#649)

• Increased default timeout for connections in the discovery code (#644)

• Moved from using godeps to using glide to manage dependencies and vendoring. This included updating the go-semver dependency and a new build/test script. Dependency changes are now managed with scripts/glide-update (#632)

This is a minor release of the spec with one new feature and some updated dependencies:

• Added optional recursive field to volumes in the spec (#630)
• Update vendored Kubernetes dependencies (#635)

v0.8.5

This is a minor release of the spec, containing one new backwards-compatible feature, and several tooling improvements:

• Added seccomp support, via the os/linux/seccomp-remove-set and os/linux/seccomp-retain-set isolator types. This includes actool patch-manifest support (#521)
• Moved to using vendor/ directory with Godeps (#618)
• Added a port parameter to the discovery code, allowing users to perform discovery on arbitrary ports (#629)
• Changed schema code to fail more gracefully (return error instead of panic) if users inadvertently create a bad Isolator value (#633)

v0.8.4

This is a minor release of the spec; the only changes over 0.8.3 are that some of the Godeps are updated to use tagged releases.
This should help downstream developers trying to vendor and package the appc/spec code.

Minor release of the spec adding one backwards-compatible feature:

• Added a os/linux/no-new-privileges isolator type. Support also added to actool patch-manifest (#611)

Minor release of the spec with ACE validator fixes and a Godeps bump

Minor release of the spec which introduces one new backwards-compatible feature: the field readOnlyRootFS in the pod spec. If this field is set for an app, the app's root filesystem must be mounted read-only by the executor.

This release of the spec contains one major change over the 0.7.x series, which is that Simple Discovery has been removed. The value of Simple Discovery has always been somewhat dubious, and most implementations of the spec (apcera/kurma, 3ofcoins/jetpack, coreos/rkt) never actually implemented it. On the other hand, meta discovery is used actively and arguably is synonymous with discovery. Simple Discovery is now removed entirely and App Container Image Discovery is what was formerly called Meta Discovery.

There is also one breaking change in the discovery code: DiscoverEndpoints and DiscoverPublicKeys have been reworked. DiscoverEndpoints is renamed to DiscoverACIEndpoints (for consistency), and now each method returns only their requested type.

Spec changes:

• Defined a default capability set for executors
• Added specificity to metadata endpoint descriptions.
• Clarified image dependencies
• Added note that dependencies can form a tree or a directed acyclic graph as well if they share a common dependency.
• Fixed pod spec to clarify the 'mode' field is a string, not an integer.

Tooling/build changes:

• Dropped go 1.3 and 1.4 support in testing, add go 1.6
• Updated errorutil import path
• Performed an unrewrite of import paths
• Removed dependency on glibc in pkg/device, so that appc can be built as a statically linked binary on Linux
• Changed to use actual GOOS and GOARCH of system when building validator ACIs
• Implemented actool patch-manifest --revoke-capability

Minor release of the spec with some enhancements to the schema types and discovery code:

• Added AsIsolator constructors for Memory and CPU resource isolators (#552)
• Added insecure flags for HTTP and TLS to discovery code, for more granular control over security during discovery (#545, #551)

This is a minor release of the spec with one bug fix over the previous release:

• Fixed the AsIsolator function on the LinuxCapabilitiesSet isolator types so it correctly populates the value

This is a minor release of the spec which should be fully backwards-compatible but extends functionality in several ways and loosens some restrictions.

Spec changes:

• The requirement for the metadata service has been downgraded to a SHOULD. This requirement necessitated a daemon which seemed burdensome for implementations.
• Added a SHOULD requirement for Linux ACEs to provide a basic /etc/hosts if none already exists in application filesystems
• The requirement for exec fields in the app schema to be non-empty was removed. An ACE is permitted to override/replace this section and so this provides greater flexibility when generating images, particularly when converting from other image types to ACI.
• Added mode, uid, and gid parameters to empty volumes. This allows setting which permissions are applied to empty volumes.
• Changed the definition of the executable path in app.exec to be PATH-dependent. The procedure for an ACE to locate the executable path mimics that of the shell (as described in man 3 exec). This means that executable paths are no longer required to be absolute.

Other changes:

• Improved manifest parsing errors - when provided manifests are invalid JSON, the erroneous line and column number will now be highlighted in the produced error
• The discovery code now includes per-host HTTP headers, allowing authentication during discovery
• Added several new helper functions for initializing memory and CPU isolator types
• Added several helpers to work with LinuxCapabilitiesSet schema types
• Refactored the MakeQueryString helper to centralise the parsing of different comma-separated label/value strings used in several places (for volumes, ports, mountpoints, etc). This also now escapes values when parsing, allowing values with special URL characters like "+" or "&"
• Fixed a nil-pointer dereference in the schema Volume type's String() method