Arch removed the package that allowed sandboxes to function while unprivileged user namespaces stayed disabled, and there is no replacement for it. Ditana reverses the arrangement instead: a namespace is refused to everything that has not been explicitly declared, and a BPF program on the kernel’s userns_create hook enforces that. A machine that cannot load the program keeps namespaces entirely switched off, so a failure costs sandboxes and never protection.

An installation can now also run with nobody at the keyboard, taking its answers from a file on a small config drive that the installer discovers by itself. And the pipeline that builds the Ditana package repository has been made public, together with every run it has ever made.

Release notes: https://ditana.org/release-notes/0-9-4-beta/

Every build of the package repository: https://ditana.org/builds/