Announcing new releases Alpha 4628.0.0, Beta 4593.1.0, Stable 4459.2.4

2 views
Skip to first unread message

Flatcar Container Linux User

unread,
Mar 9, 2026, 1:01:45 PM (9 days ago) Mar 9
to Flatcar Container Linux User

Hello,

We are pleased to announce a new Flatcar Container Linux release for the Alpha, Beta, Stable channel.

Alpha 4628.0.0

Changes since Alpha 4593.0.0

Security fixes:Bug fixes:
  • Added full terminfo database to support modern terminals like foot and Alacritty.
  • Enabled back PAM sssd support for LDAP authentication (scripts#3696)
Changes:
  • Dropped the "Oklo" release codename as it was never updated in a meaningful way.
  • Function tracer (ftrace) enabled in ARM64 builds. (Enables CONFIG_FUNCTION_TRACER & CONFIG_DYNAMIC_FTRACE for observability and security tools) (flatcar/scripts#3685)
  • Moved systemd-sysext image mounting into the initrd, so that system extensions can better define the behavior of the final system at boot without workarounds to apply settings late at boot. This means .wants symlinks for systemd units work as expected now and, therefore, we dropped the ensure-sysext.service workaround. We still recommend extensions to keep their workarounds, e.g., using .upholds instead of .wants, to better support live reloading. A skipping logic prevents an extension refresh late at boot but only if no changes were found. For extensions that are not stored on a custom filesystem, such as a separate /var partition, the new extension mounting from the initrd won't be able to load them early but they will be picked up late at boot through the extension refresh. This is another case where it's good if extensions keep workarounds for late loading.
  • OS-dependent sysexts (e.g., docker-flatcar, containerd-flatcar, podman, zfs, nvidia) are now cryptographically signed using dm-verity roothash signatures. This enables stricter sysext policies via systemd-sysext and provides a foundation for verifying user-provided extensions in future releases. The format changed from squashfs to erofs-based Discoverable Disk Images (DDI). OEM sysexts (e.g., oem-azure, oem-gce) are now also signed and built during the image phase to ensure consistent signing with the same ephemeral key. (scripts#3162)
  • Switched /etc/ from a custom overlayfs for A/B updates to using a systemd-confext extension providing the default contents by using systemd-confext in the mutable mode where /etc/ gets used as upperdir scripts#3555
Updates:Beta 4593.1.0

Changes since Beta 4547.1.0

Security fixes:Bug fixes:
  • Enabled back PAM sssd support for LDAP authentication (scripts#3696)
Changes:
  • Enabled netkit module (scripts#3524)
  • Function tracer (ftrace) enabled in ARM64 builds. (Enables CONFIG_FUNCTION_TRACER & CONFIG_DYNAMIC_FTRACE for observability and security tools) (flatcar/scripts#3685)
Updates:Stable 4459.2.4

Changes since Stable 4459.2.3

Security fixes:Updates:

Best, 

The Flatcar Container Linux Maintainers

Reply all
Reply to author
Forward
This conversation is locked
You cannot reply and perform actions on locked conversations.
0 new messages