This release introduces the persistent Kubernetes execution mode, extra scope support for OIDC authentication, important bug fixes for Kerberos and Docker image pulling, and a lot of dependency updates.

Summary

1. Persistent Kubernetes execution mode
2. OIDC extra scopes
3. Kerberos authentication fixes
4. Docker image pull policy fix

Persistent Kubernetes execution mode

A new persistent execution mode has been added to the Kubernetes backend. Unlike the existing connection mode which create a new pod for each SSH connection and terminates the pod after the session terminates, persistent mode execs into an already existing pod with an option to create the pod if it doesn't exist, or to simply refuse entry if it doesn't. This mode can be useful for use-cases where stateful sessions are needed, including but not limited to managing long-running interactive processes, resource sharing etc.

!!! warning "ContainerSSH cannot guarantee user isolation in this mode"
It is expeced that the users of this feature will use the configuration server to ensure that every user is dropped into the correct pod, ideally unique per-user. Do not specify the pod to use in the global configuration as this will lead to all users to be sent to the same pod without any isolation. If this is combined with any type of credential forwarding it can lead to the users credentials being compromised.

In the simplest form the persistent mode can be configured with the following block:

kubernetes:
  pod:
    mode: persistent
    metadata:
      name: my-existing-pod
      namespace: default

With the createMissingPods option a minimal pod spec is also required:

kubernetes:
  pod:
    mode: persistent
    createMissingPods: true
    metadata:
      name: my-pod
      namespace: default
    spec:
      containers:
        - name: shell
          image: containerssh/containerssh-guest-image

Thanks to @gigabyte132 for contributing this feature.

Read more »{: .md-button}

OIDC extra scopes

The OIDC authentication provider now supports requesting additional scopes beyond the default openid scope.

Two new configuration options have been added for the oidc provider:

• extraScopes: A list of additional OIDC scopes to request during authentication.
• enforceScopes: When set to true, authentication will be rejected if the user does not grant all requested extra scopes.

auth:
  keyboardInteractive:
    method: oauth2
    oauth2:
      provider: oidc
      oidc:
        url: https://your-oidc-server.example.com/
        extraScopes:
          - profile
          - email
        enforceScopes: true

These options work with both the device flow and authorization code flow.

Thanks to @hashkrish for contributing this feature.

Read more »{: .md-button}

Kerberos authentication fixes

This release fixes two issues with Kerberos authentication:

• enforceUsername=false now works correctly. Previously, disabling username enforcement would still reject valid logins with differing usernames.
• Metadata merging is now additive. Kerberos authentication metadata is now correctly merged with existing connection metadata instead of replacing it. This ensures that metadata set by earlier authentication or configuration steps is preserved.

Thanks to @gigabyte132 for contributing this feature.

Docker image pull policy fix

The behavior of the IfNotPresent image pull policy has been corrected. Previously, images with no tag or the :latest tag were always pulled even when already present locally, which prevented using local images. The IfNotPresent policy now consistently skips pulling when the image is already available locally, regardless of the tag.

Thanks to @AlbertoPimpo for the fix

Full changelog:

Changelog

• 76b43f4 Bump github.com/cloudflare/circl from 1.6.1 to 1.6.3 (#673)

What's Changed

• Bump github.com/cloudflare/circl from 1.2.0 to 1.3.7 by @dependabot[bot] in #629
• Update examples git submodule with latest fixes by @AlbertoPimpo in #649
• fix(kerberos): fix kerberos ticket delegation and authentication by @gigabyte132 in #657
• Don't pull latest tag if the pull policy is IfNotPresent by @AlbertoPimpo in #650
• Add extra scopes to OIDC by @hashkrish in #666
• Updates dependencies by @SebastianThorn in #664
• Bump github.com/cloudflare/circl from 1.3.7 to 1.6.1 by @dependabot[bot] in #669
• Bump github.com/go-git/go-git/v5 from 5.4.2 to 5.16.5 by @dependabot[bot] in #668
• feat: add persistent connection mode #643 by @gigabyte132 in #659
• Bump golang.org/x/sys from 0.41.0 to 0.42.0 by @dependabot[bot] in #678
• Bump k8s.io/apimachinery from 0.35.0 to 0.35.2 by @dependabot[bot] in #676
• Bump k8s.io/client-go from 0.35.0 to 0.35.2 by @dependabot[bot] in #675
• Bump k8s.io/api from 0.35.0 to 0.35.2 by @dependabot[bot] in #674
• Bump github.com/cloudflare/circl from 1.6.1 to 1.6.3 by @dependabot[bot] in #673

New Contributors

• @AlbertoPimpo made their first contribution in #649
• @gigabyte132 made their first contribution in #657
• @hashkrish made their first contribution in #666
• @SebastianThorn made their first contribution in #664

What's Changed

• Bump github.com/gorilla/schema from 1.2.1 to 1.4.1 by @dependabot in #608

• Bump github.com/go-git/go-git/v5 from 5.1.0 to 5.13.0 by @dependabot in #625

• Bump github.com/oschwald/geoip2-golang from 1.9.0 to 1.11.0 by @dependabot in #628

• Bump golang.org/x/crypto from 0.23.0 to 0.32.0

• Move handshake success processing outside the callbacks (ContainerSSH/libcontainerssh#671)
  Note: While this change was prompted by crypto/ssh 's CVE-2024-45337 , ContainerSSHs handling of public key authentication did not allow any additional access, this change was made to make the code and handling clearer in light of the published vulnerability.

• Deprecate libcontainerssh, all library code is now under the main ContainerSSH repository, go.containerssh.io/libcontainerssh should be changed to go.containerssh.io/containerssh

Full Changelog: v0.5.1...v0.5.2

Changelog

• 340ae99 Bump libcontainerssh version to 0.5.1

Changelog

• 6f991ff Release ContainerSSH v0.5.0

Changelog

• 658f794 Provide github token as env variable

Read the full release announcement on containerssh.io »

Bugfixes

• #201: Incorrect JSON serialization/deserialization from the configuration server when using the Docker backend
• #209: Incorrect YAML deserialization when using the Kubernetes backend
• #167: Authentication server ignores password and pubkey options

Discussion

You can discuss this release here.

This pre-release fixes bugs #201 and #209 where parts of the config returned from the config server were ignored.

This pre-release fixes bugs #201 and #209 where parts of the config returned from the config server were ignored.

Read the full release announcement on containerssh.io »

What we added

• Audit logging
• Improved logging
• New SSH proxy backend
• New Kubernetes backend
• New Docker backend
• New security layer
• The guest agent

What we deprecated:

• The KubeRun backend
• The DockerRun backend
• The Listen config option
• The sessionId parameter in the auth/config webhook

What we removed

• The pubKeyBase64 field in the auth webhook
• Moving from GET to POST in webhooks

Read the full release announcement on containerssh.io »

Changelog

3157158 Github release to containerssh/

Docker images

• docker pull containerssh/containerssh-test-authconfig:latest
• docker pull containerssh/containerssh-test-authconfig:0.3
• docker pull containerssh/containerssh-test-authconfig:0.3.1
• docker pull docker.pkg.github.com/containerssh/containerssh/containerssh-test-authconfig:latest
• docker pull docker.pkg.github.com/containerssh/containerssh/containerssh-test-authconfig:0.3
• docker pull docker.pkg.github.com/containerssh/containerssh/containerssh-test-authconfig:0.3.1
• docker pull containerssh/containerssh:latest
• docker pull containerssh/containerssh:0.3
• docker pull containerssh/containerssh:0.3.1
• docker pull docker.pkg.github.com/containerssh/containerssh/containerssh:latest
• docker pull docker.pkg.github.com/containerssh/containerssh/containerssh:0.3
• docker pull docker.pkg.github.com/containerssh/containerssh/containerssh:0.3.1