Stratum v1.0.0-rc.27

Release candidate. Continues the Stratum 1.0 preview — recommended for evaluation and staging. Hold production rollouts for the stable v1.0.0 release.

Highlights

Hardened plugin sandbox. Plugins run in a tightened out-of-process sandbox — seccomp syscall filtering, no-new-privileges, dropped credentials, and parent-enforced CPU and file-descriptor limits — so a plugin stays firmly inside its boundary.

VRF & Geneve networking. Manage VRF routing-isolation devices and Geneve overlay tunnels directly from the agent (ctl vrf … / ctl geneve …), alongside the existing bridges and VXLAN.

Interface tamper auto-recovery. The agent now continuously reconciles the interfaces it manages: if one is changed or removed out-of-band, the change is detected and the interface is restored to its intended configuration (with the optional kernel module providing tamper-evidence). Safe by design — the reconciler never touches interfaces it does not manage and never undoes a change you make through the platform.

Feedback on this release candidate is welcome — report issues through your account before the stable v1.0.0 cut.