Changelog

v0.12.0 (2026-07-28)

doki run -it, attach, and exec -it attach to a live PTY (or multiplexed pipes), with window resize and multi-client fan-out
Real Kubernetes exec/attach streaming over the remotecommand WebSocket channel protocol (v5.channel.k8s.io, v4 fallback)

Podman libpod endpoints wired to the real engine — containers, volumes, build, play/generate kube — with honest 503/501 instead of stubs
k4s: restart policy with exponential backoff and real RestartCount (K14); readiness probes for exec/tcp/http (K13); ConfigMap/Secret volume projection
doki update applies live cgroup v2 CPU/memory limits (D1); the scheduler filters nodes by resource requests (K16)

Five critical fixes: digest write-what-where, image-cache poisoning, docker cp path traversal, build-secret leakage, unsandboxed RUN
CVE-2018-15664-class symlink-escape defense (SecureJoin + O_NOFOLLOW mounts)
Decompression-bomb bounds (16 GiB / 2,000,000 entries), xattr and device-node stripping, registry auth-realm SSRF guard, same-origin control API
/info and container inspect report the real security posture for the active runtime mode (native / proot / namespaces)

Combined boolean short flags (-it), --key=value parsing, and Docker-compatible doki update flag order
32-bit (armv7) build overflow fixed (maxLayerUncompressedBytes typed int64)
The dok1.xyz installer now downloads every binary (not just doki) and fixes x86_64 and Intel-Mac architecture selection

5 supported platforms: linux/amd64, linux/arm64, darwin/amd64, darwin/arm64, android/arm64
30+ release binaries
Native darwin VZ backend on Apple Silicon

v0.10.x config format still accepted with deprecation warning; will be removed in v0.12.0.