Urunc v0.8.0 introduces breaking changes and security fixes

The release of urunc v0.8.0, as detailed in the project's GitHub release notes, includes several updates that change default behavior, address security vulnerabilities, and introduce new features. Notably, two security issues were fixed: argument injection into the Sandbox monitor command line via unverified image/Pod annotations (GHSA-crxr-jm9v-349c) and path traversal of arbitrary host files through annotations (GHSA-3385-hmpj-4678). Among the new features are support for vhost in Qemu's virtio networking, initial support for Hermit and hyperlight-unikraft unikernels, and the ability to set the urunc configuration file through the URUNC_CONFIG_FILE environment variable. Breaking changes include the relocation of all artifacts to /opt/urunc and configuration to /etc/urunc/config.toml, deprecation of the com.urunc.unikernel.cmdline annotations, and vAccel being disabled by default, requiring explicit enablement in the configuration.

Operators should carefully review the breaking changes before upgrading, particularly the relocation of configuration files and artifacts. Systems relying on the deprecated annotations or default vAccel settings may experience disruptions. Additionally, the shift to centralized mount handling and other internal adjustments could impact container creation workflows. Ensuring compatibility with these changes and testing in a staging environment is advisable to avoid operational issues.