cardinal 1.24 — major security hardening
seccomp, AppArmor, network isolation, encrypted backups, and audit logging.
1.24 is the security release. Six new layers of defense:
- seccomp profile — blocks 30+ dangerous syscalls by default, overridable
with --seccomp-profile.
- AppArmor profile —
--apparmor-profileapplies a named profile per
container.
- Device restrictions —
/dev/shm,/dev/mqueue,/proc/sys, and/sys
mount read-only.
- Network segmentation —
--isolatedcuts a container off from its peers. - Encrypted backups —
--encrypted-backupwraps archives in AES-256-GCM. - Audit logging —
--audit-logrecords container lifecycle events.
The full pivot to pivot_root, protected bind sources, and dangerous-capability
gating is documented in an expanded SECURITY.md.