nsjail-2.4

• open kafel file in each kafel subproc individually to avoid file posiiton sharing
• more and better examples in configs/

nsjail-2.3

• fixed --max_conns_per_ip
• made it compilable under OpenWRT
• removed lingering -fblocks code
• better config example for ImageMagick
• fixed check for non-existent group- and user-names

nsjail-2.2

• Works correctly with some archs which need aligned stack for clone (e.g. aarch64)
• Enable CLONE_NEWCGROUP by default (can be disabled)
• Added CTRL+\ (SIGQUIT) handler to show all connections
• Create new dirs in /run/user/ first (instead of /tmp)
• Unblock all signals prior to execve
• Don't start new ns-init id CLONE_NEWPID is not requested
• Support cgroup net_cls subsystem
• Mount: better statvfs -> mount flags mapping

nsjail-2.1

• Works correctly with some 32bit platforms that use setres(u|g)id32
• Supports executing binaries through execveat
• New config example for busybox which demonstrates use of execveat

nsjail-2.0

Fixes a crash in <= nsjail-1.9 where a stack variable was incorrectly marked as 'static', overflowing an array after a couple hundred of executions of a single program (e.g. in -Ml and -Mr modes)

nsjail-1.9 [broken]

BROKEN - can crash nsjail after a couple hundred of iterations in -Ml and -Mr modes. Use version 2.0 instead.

• Remove dependency on libcap-dev (which didn't understand newer capabilities)
• Add /proc manipulation options (path and R/W)
• Add hard/soft/inf options to config.proto for rlimits
• Make it compile under uClibc

nsjail 1.8

• Make Dockerfile compilable with libprotobuf (C++)
• Fix NULL crashes if certain values were not set in the config file (e.g. hostname)

nsjail 1.7 [broken]

• BROKEN - config.proto defaults don't work correctly (might crash with NULL if e.g. hostname is not set in the config file)
• Depends on C++ libprotobuf now (libprotobuf-c was buggy, and didn't support text-format by default)
• nsjail exits with 255 now in case of startup errors (formerly: with 1)
• man page (thx to John Vogel)

nsjail 1.6

• CAP_AUDIT_READ fixes (not present in older kernel headers)
• Fixed dockerfile

nsjail 1.5

• New config examples (e.g. Apache httpd)
• Capability adding --cap
• Improved R/O remounting (missing MS_BIND flag)
• Setting maximum number of used CPUs --max_cpus
• Accept IPv4 in --bindhost
• Use open()/fdopendir() instead of opendir() to set O_CLOEXEC atomically
• Improved docker build file