kern 0.9.0-rc3

v0.9.0-rc3, SQL checked against your schema at compile time (E0311)

Injection prevention stops a query built from user input from type-checking. The typechecker now goes one step further and validates the SQL itself against your declared schema, before the program runs. A query against a table that does not exist, or a SELECT / INSERT naming a column that is not in that table, is a compile error (E0311): not a 500 in production at 2am. The whole class of “typo in a column name” and “migration drifted from the code” bugs moves from runtime to kern build. Combined with the @sql_literal rule, a Kern SQL statement is checked for both injection safety and schema correctness at the same compile step.

v0.9.0-rc3, a self-contained container engine (no docker, no podman)

The container subsystem used to shell out to a host Docker or Podman. It is now a complete OCI engine compiled into the language. It pulls and runs real images (debian:bookworm-slim, alpine:3.19) with nothing on the host but the Kern binary, a Linux kernel 5.15 or newer, and libc. No docker, podman, runc, crun, skopeo, iptables, nft or iproute2 required. HTTPS and tar extraction run in-tree (vendored mbedTLS plus a statically linked libarchive).

Network setup is hand-rolled netlink (RTM_NEWLINK / NEWADDR / NEWROUTE), and outbound NAT installs an inet kern_nat nftables table directly over NFNETLINK_NFT. oci_pull_image_verified() checks a cosign-compatible Ed25519 signature and pins the manifest digest. A build gate (make check-container-no-shellout) fails if popen or system appears in the container runtime sources, and a CI leg apt-purges every shellout binary before running the suite under an strace execve tripwire.

Read the announcement: kern v0.9.0-rc3, the engine moves inside the language →