# Release notes

## 1.0.1 — 2026-10-29

`podman stop` now stops a running agent container immediately instead of
after a 10-second SIGTERM timeout followed by SIGKILL.

### Why

Containers used `sleep infinity` as PID 1. The kernel does not apply
default signal dispositions to PID 1, and `sleep` has no SIGTERM handler,
so the stop signal was silently ignored and every stop fell through to
SIGKILL. PID 1 now traps TERM (and INT) itself and exits on request:

```sh
trap "exit 0" TERM INT; sleep infinity & wait
```

### Upgrading

The PID 1 command is baked in when a container is created, so existing
containers are detected on the next run and recreated automatically.
Nothing in the container home is touched.

## 1.0.0 — 2026-10-29

Containers now run with rootless Podman instead of Docker.

### Why

Whoever can talk to `/var/run/docker.sock` is root on the host. A single
`docker run --privileged -v /:/host` edits any file, including
`/etc/shadow` and your SSH keys. Being in the `docker` group is therefore
the same as having root, and an agent with that access leaves the project
directory whenever it likes — the confinement this tool exists for holds
only against accidents, not against a malicious tool call.

Rootless Podman removes the shortcut: containers run inside a user
namespace owned by you, and container root maps to a subordinate UID from
`/etc/subuid` instead of to host root. Nothing outside your own file
permissions is reachable, and the `docker` group is not needed at all.

### Upgrading

Rootless Podman has to work on the host first:

```sh
sudo pacman -S podman passt            # or slirp4netns
grep "^$USER:" /etc/subuid /etc/subgid # expect an entry like 100000:65536
podman info >/dev/null && echo ok
```

If the subuid/subgid entries are missing, add them with
`usermod --add-subuids 100000-165535 --add-subgids 100000-165535 <user>`.

Existing Docker containers and images are not reused. They are left
untouched, and the first Podman run builds a fresh image
(`localhost/agent-container:latest`).

1. Rebuild the image with Podman:

   ```sh
   git pull
   agent-container update
   ```

2. Remove the old Docker containers and image:

   ```sh
   docker ps -a --filter 'name=^ac-' --format '{{.Names}}' | xargs -r docker rm -f
   docker rmi agent-container:latest
   ```

3. Use `pi`, `claude`, and `opencode` as before. The first run creates a
   Podman container per project.

4. Leave the `docker` group once nothing else on the machine needs the
   socket as your user, then log out and in again:

   ```sh
   sudo gpasswd -d "$USER" docker
   ```

Your container home (`$XDG_DATA_HOME/agent-container/container-home`) is
untouched: logins, settings, and history carry over.