# kern 1.0.2 > Stdlib restructured into packages, containers hardened, control plane HA. Source: https://kern-lang.eu/releases/1.0.2 Stdlib restructured into packages, containers hardened, control plane HA ## Release notes 38 commits on the 1.0 line (v1.0.1 was a one-day patch carrying E0331, the trait-bound fix and the shared macOS container VM). The standard library split into a **290-module core** and **ten bundled packages** (`kern_cloud`, `kern_vm`, `kern_security`, `kern_net_services`, `kern_ble`, `kern_ops`, `kern_auth`, `kern_otel`, `kern_ai`, `kern_mcp`), each with its own `kern.toml` and README, declared by package name (`from kern_vm.vfio import ...`). 19 contentless stubs removed, 100% docstrings, conformance tests for 12 previously untested modules. ### Seccomp allowlist (UR-89): process containers default to an allowlist BPF filter built from the Docker-default syscall base (`runtime/kern_ns.c`, per arch through `__NR_*`); the old denylist stays as `denylist` per instance. ### IO class and cgroup `io.max` (UR-88): `InstanceSpec.io_class` is `standard`, `high` or `unlimited`, with host-configurable bandwidth and IOPS bounds applied on the whole block device. `unlimited` requires an operator mark (`kern cloud tenant set --io-unlimited`). ### Per-instance disk and network byte counters (UR-93): four cumulative counters (disk read/write, net rx/tx) from the cgroup's `io.stat` and the instance's tap; a counter that cannot be read is `-1`, never `0`. ### Control plane HA (UR-96): hostd dials a list of planes and fails over between them; `routes.set` is replayable with a parity gate between commit sites and replay arms (UR-103). ### VM runner containment A per-VM subordinate uid, its own user/mount/pid/net namespaces and an empty root before the guest image exists. ### VM datapath Vhost-net rings through ioeventfd and irqfd, a block device thread. ### Unicode safety (CWE-176/180): `kern_uni_first_rune` rejects overlong, surrogate and invalid UTF-8 sequences. ### Field encryption at rest `std.fieldcrypt`. ### std.ai Added as a stdlib entry. ### `crypto_gen_token` requires `Cap` String cache safety: per-thread strcache cleared in `epoch_end` and `arena_reset`. Compiler registers the return signature for `kern_str_replace` (W0001). TCB raised to 41,786 for the strcache fix. Toolchain: clang 21/22 blessed, `dnf` in the error hint. Install `$ curl -fsSL https://kern-lang.eu/install.sh | sh` Upgrade with the same install command. Releases are signed. [Get started ](https://kern-lang.eu/get-started)