Skip to main content

Release notes

1.2.0​

Compose host networking and compose ps, security process/docs/warnings, UFW-friendly bridge firewall rules, and Docker-compatible WORKDIR / VOLUME / COPY behaviour. Compatible with 1.x; see Stability and compatibility.

New​

  • nyx compose ps: list stack services with container id, image, status, ports, and IP (-q / --no-trunc; optional service names). Like docker compose ps.
  • SECURITY.md and docs/security.md: vulnerability reporting, threat model, and operator guidance (socket = root-equivalent, rootless preference, known gaps such as unsigned images).
  • Security warnings: nyx run --network host / control-socket binds; compose up for host network, privileged, or host socket mounts; daemon warns when rootful without -userns-remap or when -net-driver=host.
  • nyx ps / nyx compose ps: host-network containers show host in the PORTS and IP columns (they have no bridge address or DNAT publish map; processes bind on the host).

Fixed​

  • nyx compose: honour per-service network_mode: host (and compose networks with driver: host). Previously the field was ignored and services stayed on the bridge, so 127.0.0.1 URLs between services failed. Same rules as nyx run --network host (no published ports:; service names resolve via /etc/hosts on loopback).
  • Image tag / build meta: concurrent writes of the same image ref (e.g. nyx compose up --build while another pull/build finishes) no longer fail with rename .../ref.tmp .../ref: no such file or directory. Meta files use unique temp names and image-directory updates are serialised.
  • Native bridge + UFW: with bridge-nf-call-iptables=1, UFW's FORWARD DROP no longer black-holes container DNS to the gateway or east-west bridge traffic. nyxd installs idempotent iptables ACCEPT rules (comment nyxd-fw-) ahead of UFW on each bridge ensure — see Networking.
  • nyx build: WORKDIR and VOLUME create their paths; COPY/ADD destinations of . and /. are directories (a single file no longer replaces the workdir). --chmod and --checksum expand like --chown; ADD of local archives honours --chown/--chmod.

1.1.7​

New​

  • nyx stats / nyx compose stats: live CPU, memory, net/block I/O and PIDs (docker/podman-like; --no-stream for one sample). API: GET /v1/containers/stats.
  • nyx inspect: low-level container JSON (array, like docker inspect). API: GET /v1/containers/{id}/inspect.

Security​

  • Built with Go 1.27.3: fixes GO-2026-6809 in crypto/x509 (compromised intermediate certificates were trusted), reachable through image pulls over TLS.

1.1.6​

New​

  • nyx run -v SRC:DST[:ro]: bind mounts (SRC is an absolute path on the nyxd host), and nyx run --network host: share the host's network. API: volumes and network on POST /v1/containers/run.
  • scripts/repo-smoke.sh runs on nyxd as well as Docker (ENGINE=nyx), so the repos CI job runs on the local runners.

Fixed​

  • nyx run --rm printed nothing and failed with no matching container for a command that exits at once: the logs were removed before nyx could stream them. The output now comes from the run stream, as with -i / -t.
  • Images that set no PATH (e.g. registry.fedoraproject.org/fedora) could not run sh: containers now get Docker's default PATH.
  • No default RLIMIT_NPROC (it was 512): the kernel counts it over every process of the uid on the host, so a container running as a uid the host also uses (the rootless moby/buildkit image runs as 1000) failed with exec …: Resource temporarily unavailable. The cgroup pids limit (pids_limit) still caps a container.

1.1.5​

Fixed​

  • nyx run -it: stop doubling every PTY byte (prompt, echo, and output) caused by merging distinct stdout/stderr MultiWriters that both wrapped the client stream.
  • nyx run -it … bash on images without bash: clearer tip to use sh (e.g. alpine).

1.1.4​

New​

  • nyx run --rm: remove container logs when the workload exits (Docker-compatible; incompatible with --restart always / unless-stopped).
  • nyx run -i / -t / -it: attach stdin and/or a PTY to the container init (interactive shells and piped stdin), via application/x-nyxd-run+v1 on POST /v1/containers/run.

1.1.3​

Fixed​

  • macOS: vfkit exited immediately (the VM stopped on its own) when the machine lived under ~/Library/Application Support/… — spaces break vfkit’s unix:// vsock URLs. Machines now live in ~/Library/nyx/machines (legacy dirs are moved on first use). nyx machine logs also shows vfkit.log.

1.1.2​

Fixed​

  • macOS: after a failed start or an upgrade, a leftover run.pid made nyx machine run exit with "already running", so vfkit never restarted and nyx fell back to /run/nyxd/nyxd.sock. nyx machine start and upgrades now replace a supervisor that is not answering.

1.1.1​

Fixed​

  • macOS: nyx machine start timed out with nyxd did not answer within 120s even when the VM console showed nyxd ready. vfkit was started with vsock listen (guest dials host) while the VM image listens on vsock; it now uses connect so the Mac can reach the API and shutdown ports. Reinstall or replace nyx only — the VM image is unchanged.

1.1.0​

Compose and native-network controls for multi-bridge stacks, plus a macOS VM init fix and docs for what works in each environment. Compatible with 1.0; see Stability and compatibility.

New​

  • Compose apparmor_profile: applied when the host has AppArmor and the named profile is loaded; otherwise logged and skipped so the same file works on SELinux-only or Alpine hosts.
  • Compose dns and /etc/resolv.conf: set nameservers from the compose file, or keep a caller-owned resolv.conf bind mount without nyxd rewriting it.
  • Compose ulimits and memory_swap: ulimits map to OCI rlimits; deploy memory swap follows Docker-style defaults when omitted.
  • GET /v1/network: returns the active driver, bridge, gateway and subnet over the control socket.
  • Per-network native bridges: compose networks with bridge + subnet get their own nyxbr* bridge, IPAM, NAT, cross-bridge isolation and embedded DNS zone; services that omit networks stay on nyxbr0.
  • Platform matrix: feature availability for Linux rootful/rootless/userns-remap and macOS/Windows machines — Platform matrix.
  • Docker socket docs: mounting a host docker.sock or running DinD under nyxd — Docker sockets.

Changed​

  • Socket-group access (--socket-group) is documented as root-equivalent for container operations (same trust model as the Docker group).
  • Custom native bridge names must start with nyxbr; foreign host interfaces are not adopted.

Fixed​

  • macOS: nyx machine init failed with VM image: rootfs.img missing because release tarballs pack that file as a GNU sparse member.
  • Embedded DNS could race or deadlock under concurrent zone updates and shutdown.
  • Reject unsafe container IDs on run so paths cannot escape the data directory.
  • IPAM no longer panics on /31 or /32 subnets; tiny prefixes are rejected with an error.
  • Website dependency advisory on the old Faker 5 package used by the OpenAPI explorer.

1.0.0​

The first stable release. From here on, nyxd follows Semantic Versioning: the /v1 API, the nyx CLI and its flags, daemon flags, on-disk data, the log format and the packages stay compatible for all of 1.x. What is covered, and what is not, is in Stability and compatibility.

New​

  • Bounded container logs: size rotation with -log-max-size and -log-max-files (3 × 10 MiB per container by default). nyx logs --tail reads from the end of the file, nyx logs -f follows across rotations, and lines over 64 KiB are split instead of ending the stream.
  • No leftovers: bundle directories are removed when a container exits or is removed, and nyx rm deletes the logs of an exited container.
  • Load and failure testing: scripts/stress.sh (make test-stress) and the Stress workflow run 50 containers at once, 200 short-lived ones, a log flood, an OOM kill and a daemon crash with containers running. See Load and failure testing.
  • Package repositories: signed apt, dnf/yum, zypper, apk and pacman repositories at pkgs.nyxd.io, and one-line installers for Linux, macOS and Windows. See Get started.
  • make help: make with no target lists every target.
  • nyx --version (-v) prints the client version without needing the daemon.
  • Clearer errors when nyxd can't be reached: nyx says whether the daemon isn't running or you lack access to its socket (join the nyx group), instead of a raw dial unix error.

Changed​

Check these before upgrading from 0.9:

  • nyx run no longer restarts containers by default. Without --restart, the policy is now no, as in Docker and in nyx compose. Before, it was unless-stopped. Add --restart unless-stopped to containers that should come back after they exit.
  • A memory limit now limits swap too. A container with a memory limit and no swap value can use at most twice the limit in memory plus swap (Docker's default). Before, swap was unlimited, so a container over its limit swapped instead of being OOM-killed.
  • Container logs are rotated. Logs used to grow without bound; they now keep 3 × 10 MiB per container unless you set -log-max-size / -log-max-files.

Fixed​

  • nyx rm of a container that had just stopped could leave its log files behind.
  • The last output of a container that exits right after writing it could be missing from its log.
  • Rootless: after the daemon was killed, nyx exec into the containers it re-adopted could fail with Permission denied. The new daemon now joins the user namespace those containers run in.
  • A foreground nyx run of a very short command could hang while its container restarted in a loop.