Project: mirrord (App Definition and Development / Application Definition & Image Build)
File: CHANGELOG.md

All notable changes to this project will be documented in this file. The format is based on , and this project adheres to . This project uses and the changes for the upcoming release can be found in <https://github.com/metalbear-co/mirrord/tree/main/changelog.d/>. <!-- towncrier release notes start --> Use operator to list targets to avoid inconsistencies Don't print error on permission denied Fixed a bug where outgoing connections where not intercepted from bound sockets. Fix all check-rust-docs warnings Use `withenvvars` in flaky `fsconfigdefault` test Move LicenseInfoOwned to another module Update contributing guide. mirrord-agent now catches SIGTERM signal and cleans iptables during graceful deletion. Fixed ping pong logic for intproxy-agent communication. Intproxy now sends pings on a fixed schedule, regardless of any other messages. Added experimental, temp feature for supporting hazelcast pings Provide value hint to Clap for generating shell completions for config_file to only resolve to files, not just first match. Changed default env exclude to have `BUNDLE_WITHOUT` Append more permissions to operator clusterrole Improve tera templating config error to dig into source and give out more details. env.unset feature is now case insensitive Fixed case where resolving DNS failed when setting HTTP filter Change agent resolver to only resolve IPv4 Fallback to OSS when operator license expired Fix IntelliJ Rider newest version stuck on macOS Fix case were agent log message causes startup failure added configuration option to control (local) hostname resolving Add ability to configure DNS params for agent (timeout, attempts) Change ports and http_ports in incoming configuration to be checked upon mapped port instead of local Read /Network locally by default on macOS Fix medschool dropping fields sometimes Fix DNS resolving case on macOS + Java Netty Internal proxy now emits plain text instead of ANSI don't re-resolve when connecting to loopback on outgoing filter Added `JetBrains.Debugger.Worker` to the list of known build tools, fixing compatibility with Rider 2024.1. Added getters to `KubernetesAPI`. Improved tracing in the agent connection task. Sending client certificate public key instead of fingerprint in the analytics to match operator's behavior. Added `create` and `delete` verbs on `pods` resource in `clusterrole/mirrord-operator` for operator setup. Set timeout of dns request to 1s and only attempt once Fix memory issue when binding Remove `AgentManagment` because only `KubernetesAPI` implements it now and there is no need for this abstraction and moved the used functions straight onto `KubernetesAPI`. Split off pod template to a separate `ContainerVariant` implementation used inside of `JobVariant` and `JobTargetedVariant`. Updates to rust nightly-2024-04-15. Also fixes some pointer copyfromnonoverlapping issues. Agent now authenticates TLS connections, using a provided X509 certificate (mirrord for Teams only). Changed port stealing configuration: Added new `ports` field to the `incoming` configuration. The field lists ports that should be stolen/mirrored. Other ports remain local. Changed the way `incoming.http_filter.ports` field is interpreted. Ports not listed in this field are not stolen, unless listed in `incoming.ports`. Change reqwest to use rustls with native certificates to work in more cases Increase max fd in internal proxy to fix connection limit issues Fixed layer making process zombie by calling panic from hookerror, also use `sigkill` instead of `sigterm` mirrord now listens on 0.0.0.0 when requested and changes address to localhost only when needed. Adjusted `mirrord-kube` and `mirrord-agent` crates to allow wrapping client-agent connections in TLS. Removed dummy span name from logs. Fix release build, don't fail release on warnings Some lint warnings appear only on release build, ignore it. Fix release compilation CI Allow `target` be a `string` in the JSON Schema Fixed excessive stack consumption in the `mirrord-layer` by reducing tracing in release

Fix e2e failing on release because image doesn't exist Use upstream tracing mirrord now unsets the env from within the process aswell New config `env.unset` that allows user to unset environment variables in the executed process. This is useful for unsetting env like `HTTPPROXY`, `AWSPROFILE` that come from the local environment and cause undesired behavior (because those aren't needed for deployed apps). Fix new IDE progress breaking older plugins. Three issues fixed: Show the new progress only when env var is set (to be set in newer IDE versions). Multi pod warning was showing everytime when no operator, not only when targetting a deployment + no operator. Show the message for rollouts as well. Update Frida version to 16.2.1 Added handling HTTP upgrades in filtered connections (`mirrord-agent`). Refactored TCP stealer code. Add a new diagnostic command to calculate mirrord session latency Changed `agent.image` config to also accept an extended version where you may specify both registry and tag with `agent.image.registry` and `agent.image.tag`. Proxy errors now don't propagate back to libc but exit with a message `use_proxy` behavior is now setting the proxy env to empty value instead of unsetting. This should help with cases where we need it to propogate to the extensions. Internal proxy and agent now properly handle connection shutdowns. Fix some open/fd potential issues Fixed the display of agent startup errors to the user. Fixed timeout set on new internal proxy connection in `fork` detour. Adds new message type `IdeMessage`. Allows us to send messages to the IDE that should be shown in notification boxes, with buttons/actions. Change design around analyticsreporter to be more robust/clean Prepared an e2e test for stealing WebSockets connections with an HTTP filter set. Removed problematic DNS cache from internal proxy. Fixed a bug with handling hints passed to `getaddrinfo` function. stealer to steal in incoming mode typo Add `kuma-sidecar` `kuma-init` to default list of skipped containers. (no need to target these containers) Added a unit test to internal proxy DNS cache. Added more tracing to internal proxy. Added support for `statx` function. Fix incoming network interception via port-forward when "stealing" traffic with a mesh like linkerd or istio (Using the same `OUTPUT` iptable rules for both meshed and not meshed networks) Add Kuma mesh detection and support to mirrord-agent. Added sidecar exclusion for kuma mesh, fixing issues running in that setup Adds operator session management commands to mirrord-cli, these are: `mirrord operator session kill-all`, `mirrord operator session kill --id {id}`, and the hidden `mirrrod operator session retain-active`. Notify user on license validity. Adds a new `PolicyRule` for `delete` and `deletecollection` of `sessions` for `mirrord operator setup`. Change pause feature from unstable to deprecated Increased size of buffers used by TCP steal to read incoming streams (from 4k to 64k in the agent, from 1k to 64k in the internal proxy). Increased size of buffers used by outgoing feature to read streams (from 4k to 64k in the agent, from 1k to 64k in the internal proxy). Fixed a bug where `gethostbyname` calls where intercepted regardless of the remote dns feature status. Fixed a bug where non-existent hosts in outgoing filter would prevent the application from initiating outgoing connections. Remove special handling for DNS when dealing with UDP outgoing sockets (manual UDP resolving). Fixed lints in hook macros. Add agent configuration to use nftables instead of iptables-legacy to make it work in mesh that uses nftables. The agent now processes all DNS queries concurrently. Also, client sessions in the agent do not block on the DNS

change kubeconfig path expansion to use env as well Increase internal proxy timeout from 5 seconds to 10 seconds to fix long agent ops Add information how to use config file in config docs Fixed issue with Golang calling fstat on Linux causing crash Change intproxy log to append use_proxy configuration now applies to mirrord operator status, and mirrord ls Add log level and log destination for int proxy mirrord CLI now does not check target type when the `copy_target` feature is enabled. The check is now done only in the operator. `mirrord operator setup` not includes permissions to read and change rollouts scale. Incoming traffic was being mirrord when set to `false`. Remove pause tests as part of deprecation Changed internal proxy to allow for HTTP upgrades with filtered HTTP steal. Added support for selecting malfunctioning targets with `copy_target` feature. Added configuration option `feature.env.loadfromprocess`, which allows for changing the way mirrord loads environment variables from the remote target. Add missing permissions needed by operator for copy and scaledown Add IDE release e2e to the ci-success job Change cleanup to delete without grace Removed `#![allow(incomplete_features)]` from the code - no longer needed. Reorganized `TcpSubscriptionStealer` code - extracted port subscriptions into a separate struct. Added `runAsNonRoot: false` and `runAsUser: 0` to the security context of an epheremal agent when running privileged (to prevent overriding these values with values from the pod spec). Disabled unix sockets being wrongfully sent to the agent when socket isn't connected `JAVATOOLOPTIONS` is excluded by default from the environment variables that are fetched from the target. Update links to new docs Running `mirrod exec go run EXECUTABLE` on macOS with go1.21. Fixed a compilation bug in `mirrord-operator` crate tests. Added license subscription id to operator status CRD. Adjusted `CredentialStore` to preserve signing key pair for the same operator license subscription id. CLI now sends machine host + username to show in mirrord operator status (not sent to our cloud!) Report port locks and filters in operator status Change configuration parsing to be strict unallowing unknown fields Cluster DNS resolving now happens by nameserver order rather by statistics Running R on macOS. Running scripts with whitespaces in the shebang. Allow both `x86_64` and `arm64` when patching thin binaries. Add support for shebang containing spaces like asdf's node does Report namespace for operator sessions add preadv and readv to fix erlang file reading Filesystem: File not found default filter happens after checking local filter The `copy_target` feature is now officialy stable. `mirrord operator status` reports active copy targets. Remove guard from dlopen, making calls from within dlopen hookable, potentially fixing issues Moved the docs from `CopyTargetFileConfig` to `CopyTargetConfig` so that medschool reads them. Fixed layer panics in trace only mode. Removed `httpheaderfilter`. Please use `http_filter` with key `header_filter` instead. `mirrord operator setup` defines a `MirrordPolicy` CRD so that admins can block certain features by creating policies. When recieving a forbidden error from the operator for trying to steal traffic, mirrord shows an error and

Added userextras/oid to mirrord operator role to solve issues in some AKS clusters Add function to load agentfileconfig from path Changed setup to not create self signed, letting operator fallback to it automatically on runtime Update dependencies Fix opendir not being hooked on macOS arm64 Deprecate go 18, enable go 21 Fix some test labels, separate tests by flags, update contributing guide Re-add outgoing traffic with many requests tests Remove unstable from ignore localhost Allow license key that starts with - Fix job lingering by exiting always successfuly on agent Added hook for realpath function, fixing issues on files not found in Java Fix dirfd crashing on macOS Remove waitlist signup from CLI Added new `teams` command to the CLI. Remove support for old cri-o, use new CRI API (v1) Uses the `syscalls` crate to handle calling the syscalls for go. And adds `pwrite64`, `pread64`, `fsync` and `fdatasync` hooks for go. Debug instructions for intproxy in contributer guide. Flush outgoing the console loggers after each logs so that we can see more logs before the layer or the intproxy exit when debugging. Fixed config verification in IDE context when the config does not specify the target but uses the `scale_down` feature. Removed confusing error from `mirrord exec` progress. Support binding [::] by resolving to ipv4 unspecified. Fix gRPC Python running in Docker Fix create react apps by adding node related files to default local Fixed an issue with internal proxy timing out when the user application spawns lengthy build processes. Adds a new trait `LicenseValidity` implemented for `DateTime` to help us when checking a license's validity. Relevant for . Update rust to nightly-2023-12-07. Fix asdf compatability by adjusting local files read defaults `mirrord verify-config` now outputs a list of available target types. Changed `operator` config to be optional. If the option is set to `true`, mirrord always uses the operator and aborts in case of failure. If the option is set to `false`, mirrord does not attempt to use the operator. If the option is not set at all, mirrord attempts to use the operator, but does not abort in case it could not be found. Fixed config verification in IDE context when `copy_target` feature is used. Reduce some code duplication around protocol and agent connection. Added support for connecting to the cluster with an HTTP proxy. Improved incoming config docs Improved handling of operator-related errors. Added new configuration 'use_proxy' that lets user disable usage of http/s proxy by mirrord even when env is set Changed the way `targetless` is printed in `mirrord verify-config` to allow the IDEs to properly show target selection dialogs. Fixed issues with mirroring incoming TCP connections when targeting multi-pod deployments. Add a hook for to allow erlang/elixir to resolve DNS. Change spammy connect log's level from info to trace. Documentation of `env` config pattern matching. Added 'copy pod' operator feature to the CLI. Added option to scale down target deployment when using `copy target` feature. Don't drop mutex in child on fork_detour, fixes bug with elixir. Fixed `port_mapping` feature. Local file filter now applies to directory listing [regex] and not just underlying files Improved crates structure around internal proxy and mirrord console. Support for cluster information in exec plugin (`KUBERNETESEXECINFO`) Fixed logging using `mirrord-console`. Added source identifier to waitlist register `tokio` runtime dropped from layer. Fix the markdown in one section of the FS configuration documentation. Fixed python e2e test not running - removed it since it never worked and adapting it would take time. Fixed `KUBERNETESEXECINFO` environment variable passed to `kubectl` authentication plugins. Added k0s support - add k0s containerd socket path. Clarify more about the pre-defined FS exceptions in docs, link to lists. Move path pattern default sets to separate files so that we can link to them from docs. Added `--mesh` option under `cli::Mode::Ephemeral`, allowing the agent to run in a mesh context with an ephemeral target. SOCKS5 proxy is now supported. Implemented missing hooks for `readdir` and `readdir64`. Reverted breaking change in CLI for config verify Adding some e2e tests for to protect against breaking changes in the

Add homepage link to README Example in style guide conforms with the rule it's supposed to explain. Adds the optional `--ide` flag to `mirrord verify-config [--ide] --path {/config/path}`, turning some errors into warnings (target related). Add ability to override container resource requests/limits for job agents via `agent.resources` config. Propagate to the agent that we're in a mesh context (moved `MeshVendor` to a common crate), and handle the special case for `istio`, where the sniffer should capture traffic on the `lo` interface. Bump dependencies Remove quotes around regex in release branch check job Added templating for mirrord config using Tera engine. Running `mix` works now (bug was calling `lstat` in `stat` bypass). Fix progress message shows wrong latest version Remove `runasuser` from operator deployment's `security_context`. Remove spammy messages from progress Added the ability to specify targetless in config file, to allow non-interactive targetless in IDEs Change targetless + steal mode to warning instead of error. Changed file filter to exclude jar files from being read remote by default Fixes selecting container to use when using operator New subcommand for generating shell completions for bash/fish/zsh/powershell/elvish Fix mirrord-cli verify-config command not serializing failures correctly due to serde not being able to serialize newtype pattern in tagged unions. CI: Add quotes to branch name in checkifrelease_branch Bump and clean depenedencies in our code and in tests Remove process feature from Tokio in layer package Add new command `mirrord verify-config [path]` to the mirrord-cli. It verifies a mirrord config file producing a tool friendly output. Support mirroring existing sessions by introducing an HTTP check when the sniffer receives a tcp packet. Run IDE e2e tests on release. Add `document` method on `KeyPair` to access pem encoded key. Added support for pausing ephemeral containers. This feature requires the agent to have privileged access. Add ruby related ENV to the default exclude list Add concurrent steal tests - operator Add ruby related ENV to the default exclude list Fixed connecting to unspecified ip i.e 0.0.0.0 Refactor code to match newest Rust nightly - 2023-09-07 Update tj-actions to v39 to check for fixes for similar hashes Add some Ruby env to excluded: GEMHOME, GEMPATH Disable opendir hook on aarch macOS since it crashes due to arm64e issues Add hooks for `opendir`, `readdir64r`, `lxstat`, `_lxstat64`, `xstat64`. Also contains a refactor of the `*stat` family of hooks (they now call a shared function), and `openat64` as its own function. CLI: Change operator setup to fetch from API version of operator to install Don't error on agent ready missing absent, add retry in connection to upstream agent Fixed agent crashing on flush connections not enabled CI: run macOS clippy on all of the codebase Fixed pause flakiness by improving our cleanup process [using watch] CLI: Change to use drain instead of hoping sleep would help Enable ephemeral containers for tests on operator Changed the targeted and non targeted flows for creating agent. Add info about errors to TELEMETRY.md Change agent to use current thread runtime, multi thread is enabled by mistake. Added a sleep before exiting both in layer and agent to allow `tokio::spawn` tasks spawned from `Drop` finish. Changed implementation of pause guard to use `tokio::spawn` - fixes pause in combination with above change. Fix analytics not being sent on drop Refactor [if Some / else None] pattern to use [bool.then()] in medschool. Add a "Try to reduce the use of non-optional `Option`s" rule to the mirrord style guide. Label mirroring integration tests as flaky Remove extra message of `{"type":"FinishedTask","name":"mirrord preparing to launch","success":true,"message":null}` that causes breakage in

Warn when running in a mesh service with mirror mode. Fixed detecting operator not found as an error Update hyper and hyper-util to fix double select call (and properly handle large http traffic). Fixed ongoing connections not being stolen by changing our flush mechanism - add a rule to drop marked connections and then mark existing connections when starting to steal. Fixed panic on crash analytics Fixed showing error on each file not found triggered by the file not found configuration Regex meta characters are now escaped in `$HOME` (`not-found` file filter). Set fork env in integration tests using uvicorn Fix complete_passthrough response flake Fix typo in flush connections conntrack command Add the ability to send analytics on errors and not only on successful runs. Report back internal proxy error stream to cli Changed config unstable/deprecations to be aggregated with other config warnings `not-found` file filter fixed to only match files inside the `$HOME` directory. Fix openshift detection taking too long by querying a subset instead of all APIs CI Improvements: Unify lint and integration for macOS to save cache and runner. Remove trace logging from integration tests on macos use node 18 for testing since installing 19 in CI takes hours. remove `build_mirrord` job - quite useless as it's used only in other workflow, so have it there and re-use cache also save some cache, specify target for all cargo invocations to re-use cache efficiently. fix flake with node server closing before time Fix regression in kube api blocking operator from compiling Reorganize the CI with the following objective of unifying as much as we can CI that can run on the same host, this is to have less caches and have better compilation time (as there's overlap). Things done: Remove the build layer CI, since we now have an integration tests that check it + clippy for aarch darwin / Linux Make clippy run for all of the project for aarch64 linux instead of agent only Revert removal of Rust cache from e2e (was by mistake) Don't use "cache" for other Gos since it will try to overwrite and have bad results. Add analytics collection to operator session information. Added an extra `not-found` file filter to improve experience when using cloud services under mirrord. Update telemetry.md with new info about mirrord for Teams Changed keep alive to happen from internal proxy to support cases where layer process is stuck [breakpoint/etc] Changed CLI progress to print warnings and not only set it as the last message of progress Changed config verify to return aggregated warnings list for user to print instead of warn in current progress - can fix issues with extension where we printed to stderr. Fix ephemeral agent creation api using agent namespace instead of target. Add note about agent namespace being irrelevant in ephemeral. Fix macOS SIP potential issues from exec having mirrord loaded into the code sign binary. Fix operator setup so `MIRRORDOPERATORIMAGE` will function properly. Fixed issue connecting to ephemeral container when target is in different namespace Changed e2e to use a shared setup e2e action to leverage all GitHub caches, reduce e2e time by half. Changes to the CI to make it fater: Use go cache for integration test use mac-13 runner for tests Support DNS resolution for the outgoing filter config. Fixed wrong errno being set by mirrord, fixing various flows that rely on errno even when return code is ok Detect and warn when cluster is openshift Add missing hook for open64, fixing certificate loading

C# + Linux Small changes relevant to operator for #1782. Fixed environment on ephemeral container This is done by two things: There was an issue where we used `self` instead of `1` to obtain env based on pid. We didn't have container runtime to use for fetching, so now we also copy env from the original pod spec and set it to ours. Added a missing comma in the documentation Add option to run agent container as privileged - `"agent" : {"privileged": true}` Should help with Bottlerocket or other secured k8s environments. Applicable for both job/ephemeral. Send only ResponseError::DnsLookup for all errors during DNS lookups Update Frida dependency Introduced hooks for sendmsg and recvmsg, so mongodb+srv protocol (Csharp) may resolve DNS (implementation follows previous sendto and recvfrom patch). Fixed more complicated scenarios using Go on Linux Arm Move e2e setup to a bash script Fix crash on forks by leaking HOOK_SENDER CLI now uses the json progress tracker as default. Add `nodes` and `pods/log` resource permissions to `mirrord-operator` ClusterRole. Add hooks for Go 1.19 >= on Linux Arm Add node allocatabillity check to prevent OutOfPods error on agent job. Incoming config now supports off mode, which is also used when `"incoming": "off"`. When incoming is off, listen requests go through. Changed targetless to warn on listen, since bind can happen on outgoing sockets as well. Replaced termspin with indicatif, fix multi line issues and refactored progress. Add trace only mode for layer for easier debugging Agent now prints its version in the initial "agent ready" message. Add missing hook for `read$NOCANCEL`, fixes reading remote files in some scenarios. Updated `hyper` version. Added `internal_proxy` timeout configurations to allow users specify timeouts in edge cases. Change operator / cli version mismatch to show only when mirrord is older than operator Fix grpc errors caused by missing trailers on filtered http responses. macOS - Running Go build with mirrord while Go binary is SIP protected is fixed by enabling file hooks on SIP load mode. Try to resolve an issue where internal proxy is under heavy load since bash scripts does a lot of fork/exec by: Increasing internal proxy's listen backlog (might not help on macOS) Change internal proxy to create the upstream (agent) connection in a different task, allowing it to keep accepting. Fixed detecting skipped processes during layer injection. Fix fork issues by changing layer runtime to be current thread Add support for selecting Kubeconfig context to use by either using: Configuration option `kube_context`. mirrord exec argument `--context` Environment variable `MIRRORDKUBECONTEXT` Add userextras/prinicipalid to operators cluster role Document behavior of deployment in OSS vs mirrord for Teams Skip HashiCorp Vault supporting containers Fix fork issue on macOS Add access for the operator's cluster role to argoproj rollouts Fixed warning on using deployment target with no operator Attempt to fix fork issue on macOS by avoiding access to CF on fork Add note to the HttpRequest message with information to add when we break the protocol. Change deployment warning to be emit on cli only Refactor the organization of go hooks in preparation for support for arm Sometimes the internal proxy doesn't flush before we do redirection then caller can't read port leading to "Couldn't get port of internal proxy" Remove signal dependency from layer Added mirrord-operator-user `ClusterRole` to operator setup with RBAC permissions to use operator. Exclude environment variable COMPLUS_EnableDiagnostics, fixes [mirrord intellij #67](https://github.com/metalbear-co/mirrord-intellij/issues/67) Redirect stderr and stdout of internal proxy to /dev/null (stdout only after printing

Add `jspawnhelper` to build-tool list & fix skip_processes detection Use `shellexpand` to resolve tilde for `kubeconfig`. Add automatic skip for build-tools `"skipbuildtools": boolean` to config [default: True] (build-tool list: `as`, `cc`, `ld`, `go`, `air`, `asm`, `cc1`, `cgo`, `dlv`, `gcc`, `git`, `link`, `math`, `cargo`, `hpack`, `rustc`, `compile`, `collect2`, `cargo-watch` and `debugserver`) Fix `feature.env.override` documentation "overrides" -> "override". Specify default value for `agent.tolerations` in docs as json instead of yaml. Changed internal proxy to drop stdout/stderr after it finishes loading Fixed flakes caused by stdout/stderr not being flushed before after process is done Add support for `agent.tolerations` configuraion field for setting agent `Toleration`s to work around `Taint`s in the cluster. Added env var exclusion for `JAVAOPTIONS` to avoid loading remote jars or settings that wouldn't work locally. Added Java Debug port detecting to use in VSCode/IntelliJ Support for OIDC refresh token Fixed case where proxy can timeout since it holds a stale connection. Added heartbeat to the connection handling Fixed dynamic pause with operator not working - moved pause request to be from internal proxy Update the code to reimplement the fix but without moving the pinging source. Add Cargo Chef to mirrord-agent docker image for better utilisation of cache layers. Reduce amount of API calls to use operator 'mirrod ls' command now no longer lists crashed pods as targets Add `readinessProbe` and `livenessProbe` to operator deployment. Add support for operator feature flags & new "proxy" verb api. Remove operator pvc from setup. Add outgoing traffic filter feature. Adds a way of controlling from where outgoing traffic should go, either through the remote pod, or from the local app. Can be configured with the `remote` and `local` options under `feature.network.outgoing`. mirrord configuration now allows disabling Linux capabilities for the agent container. Add env to specify operator image Add new error to the kube error enum needed by operator Update VS Code gif in README Make sure conntrack flushes the correct port. Added `CAPNETRAW` Linux capability agent. Use a patched (fixed) version of rasn, otherwise doing a cargo update breaks compilation due to rasn-derive from rasn used in apple-codesign. Layer now passes detected debugger port down to the child processes. Fixed double slash in uri path on `pause/unpause` requests in agent Fix agent steal crash by adding fallback to using only `PREROUTING` iptable chain. Add test for operator setup command that checks that the setup passes with `mirrord operator setup ... | kubectl apply --dry-run=client -f -`. Add --prepend --input and --output args when running medschool. Changed agent job definition to tolerate everything Fix a critical typo in operator setup added in 3.50.1. Small fix to operator setup command. We were overriding the fs mode only for the file filter, but not for the rest of the config. Removed error capture error trace feature Add support for Argo rollout target. Agent container is no longer privileged. Instead, it is given a specific set of Linux capabilities: `CAPNETADMIN`, `CAPSYSPTRACE`, `CAPSYSADMIN`. Changed agent job definition to include limits Running java 17.0.6-tem with mirrord. Add support for installing operator with online license key. Cleaning kube resources after e2e tests no longer needs two runtime threads. Small optimization in file reads to avoid sending empty data Changed internal proxy to close after 5s of inactivity instead of 1 use Frida's replace_fast in Linux Go hooks Child processes of python application would hang after a fork without an

Change locks in test process to be async to avoid deadlocks Fix listen ports flakiness by handling shutdown messages if they arrive Use Tokio current thread runtime in tests as it seems to be less flaky Use current thread Tokio runtime in fork integration test Added new analytics, see TELEMETRY.md for more details. Fix some text in the operator documentation and progress reporting Remove IDE instructions from CONTRIBUTING.md Added Deployment to list of targets returnd from `mirrord ls`. Bump rust nightly to 2023-04-19 (latest nightly with support for const std traits). Change loglevel of warnings to info of logs that were mistakenly warning Moved IntelliJ to its own repository and versioning Hook sendto and recvfrom, leveraging our existing UDP interceptor mechanism to manually resolve DNS (as expected by netty, especially relevant for macos). Add new rule to the OUTPUT chain of iptables in agent to support kubectl port-forward If the local user application closes a socket but continues running, we now also stop mirroring/stealing from the target. Add /home and /usr to the default file filter. Fixed reporting EADDRINUSE as an error (Operator only) Add `feature.network.incoming.onconcurrentsteal` option to allow overriding port locks. Improve medschool to produce more deterministic configuration.md, and (mostly) fixes it dropping some configuration docs during processing. Make mirrord ls deployment fetch parallel. Remove unused CRD for operator and don't error on missing operator credentials Added `listen_ports` to `incoming` config to control what port is actually being used locally so mirrored/stolen ports can still be accessed locally via those. If port provided by `listen_ports` isn't available, application will receive `EADDRINUSE`. Example configuration: ```json { "feature": { "incoming": { "listen_ports": [[80, 7111]] } } } ``` will make port 80 available on 7111 locally, while stealing/mirroring port Changed the logic of choosing local port to use for intercepting mirror/steal sockets now instead of assigning a random port always, we try to use the original one and if we fail we assign random port. This only happens if `listen_ports` isn't used. The path `/opt` itself is read locally by default (up until now paths inside that directory were read locally by default, but not the directory itself). Changed back required IntelliJ version to 222+ from 223+ Moved VSCode extension to its own repository and versioning https://github.com/metalbear-co/mirrord-vscode Running python with mirrord on apple CPUs. Use tagged version of ci-agent-build, so we can update Rust and the agent independently. Add support for HTTP Path filtering Refactor vscode-ext code to be more modular Fixed bogus warnings in the VS Code extension. Mirroring/stealing a port for a second time after the user application closed it once. fixed using dotnet debugger on VSCode Properly detecting and ignoring localhost port used by Rider's debugger. fix vscode SIP patch not working Add a state Persistent Volume Claim to operator deployment setup. Bring the style guide into the repo. Fix vscode e2e job not running Remove OpenSSL dependency again Switch to new licensing and operator authenticaion flow. fix launch json for vscode extension fix macos build script to use directory's toolchain Remove frida openSSL dependency Installation script now does not use `sudo` when not needed. This enbables installing mirrord in a `RUN` step in an ubuntu docker container, without installing `sudo` in an earlier step. fix crio on openshift Skipping `gcc` when debugging Go in VS Code extension. change `mirrord-protocol` to have its own versioning. add `mirrord-macros` and `protocol_break` attribute to mark places we want to break on major updates. Add CI to verify that if protocol is changed, `Cargo.toml` is changed as well (to force bumps) Fix some of the structs being `OS` controlled, potentially breaking the protocol between different OS's. (`GetDEnts64(RemoteResult<GetDEnts64Response>),`) Partial refactor towards 1512 Add integration test for DNS resolution Bumped versions of some VS Code extension

Frida bump and other dependencies Integration test for recv_from Reorganize dev docs Update our socket2 dependency, since the code we pushed there was released. Rider is now supported by the IntelliJ plugin. Chagned agent to not return errors on reading from outgoing sockets, and layer to not crash in that case anyway Use one thread for namespaced runtimes Better timeformatting in e2e and maybe reduce flakiness? Fix nodejs deprecation warnings in CI Set MIRRORDAGENTIMAGE for vscode e2e Change phrasing on version mismatch warning. Add `/Volumes` to default local on macOS Change Ping interval from 60s down to 30s. Changed local read defaults - list now includes `^/sbin(/|$)` and `^/var/run/com.apple`. Running postman with mirrord works. Return valid error code when dns lookup fails, instead of -1. Add E2E tests for vscode extension Fixed flaky integration tests. Fixed e2e tests' flakiness in the CI. Change CI log level to be debug instead of trace Hooking `_NSGetExecutablePath` on macOS to strip the `mirrord-bin` temp dir off the path. Introduce a tool to extract config docs into a markdown file. Update docs to match whats in mirrord-dev. On macOS, if we path a binary for SIP and it is in a path that is inside a directory that has a name that ends with `.app`, we add the frameworks directory to `DYLDFALLBACKFRAMEWORK_PATH`. Provide buffer for `IndexAllocator` to avoid re-use of indices too fast Never importing `RUST_LOG` environment variable from the cluster, regardless of configuration. Provide helpful error messages on errors in IDEs. Log level control when running targetless. Change to sticky balloon on warnings in intelliJ Setting the namespace via the configuration was not possible in the IDE without also setting a target in the configuration file. fixed IntelliJ failing silently when error happened on listing pods Fix the test of reading from the SIP patch dir, that was not testing anything. Make the path field of `TargetConfig` an `Option`. Changed agent's pause feature. Now the pause is requested dynamically by CLI during setup and the agent keeps the target container paused until exit or the unpause request was received. Added support for NPM run configuration on JetBrains products. Change mirrord ls to show only pods that are in running state (not crashing,starting,etc) Change fs mode to be local with overrides when targetless is used Make progress text consitently lowercase. Fix misalignment on IntelliJ not accepting complex path in target Add impersonate permissions for GCP specific RBAC in operator Fix node spawn test flakiness on macOS Support for targetless execution: when not specifying any target for the agent, mirrord now spins up an independent agent. This can be useful e.g. if you are just interested in getting the cluster's DNS resolution and outgoing connectivity but don't want any pod's incoming traffic or FS. Support for targetless mode in IntelliJ based IDEs. Support for targetless mode in vscode. If a user application tries to read paths inside mirrord's temp dir, we hook that and read the path outside instead. Don't print error if we fail checking for operator Added better detection for protected binaries, fixes not loading into Go binary Disallow binding on the same address:port twice. Solves part of issue 1123. Fix the lost update bug with config dropdown for intelliJ Fix the lost update bug with config dropdown for intelliJ. Fix intelliJ compatability issue by implementing missing createPopupActionGroup Run IntelliJ Plugin Verifier on CI Remove bors.toml since we use GH merge queue now Upgrade k8s dependencies and rustls, remove ugly feature ip patch mirrord config dropdown for

Log agent version when initializing the agent. Remove quotes in InvalidTarget' target error message Use ProgressManager for mirrord progress on intelliJ Fixed `go run` failing because of reading remote files by maing paths under /private and /var/folders read locally by default. Fix not loading into Go because of SIP by adding into default patched binaries Fixed regression in GoLand and NodeJS causing a crash Last selected target is now remembered in IntelliJ extension and shown first in the target selection dialog. Warn user when their mirrord version doesn't match the operator version. mirrord loading progress is displayed in the staus indicator on IntelliJ, replacing the singleton notifier Fix crash on unexpected LogMessage Added hook for recvfrom to support cases where caller expects the messages to be from address they were sent to. Add x-session-id to operator request, that is persistent across child processes in a single mirrord exec. Improve metadata for VSCode extension Remove unnecessary DNS resolve on agent addr when incluster feature is enabled in mirrord-kube. Add a message informing users of the operator when they impersonate deployments with mirrord. Last selected target is now remembered in VS Code and shown first in the quick pick widget. PyCharm plugin now detects `pydevd` debugger and properly excludes its port. VS Code extension now detects `debugpy` debugger and properly excludes its port. Fixed delve patch not working on GoLand macOS when running go tests Fixed issues when importing some packages in Python caused by PYTHONPATH to be used from the remote pod (add it to exclude) Added Clippy lint for slicing and indexing. Eliminate unused variable warnings for E2E tests on macOS. Updated IntelliJ usage gif. Add magic fix (by polling send_request) to (connection was not ready) hyper error. Also adds some more logs around HTTP stealer. Fix arduino/setup-protoc rate limiting error. Support for Node.js on IntelliJ - run/debug JavaScript scripts on IntelliJ with mirrord. Use RemoteFile ops in gethostname to not have a local fd. Fix latest tag Project build instructions in the testing guide now include the protoc dependency. Release action should work now. Add protobuf-compiler to rust docs action Add support for cri-o container runtime. A descriptive message is now presented in the IntelliJ extension when no target is available. Listing targets failure is now handled and an error notification is presented. Added waitlist registration via cli. Join the waitlist to try out first mirrord for Teams which is invite only at the moment. Add email option to help messages. When patching for SIP, use arm64 if possible (running on aarch64 and an arm64 binary is available). Changed our Discord invite link to https://discord.gg/metalbear Change detour bypass to be more robust, not crashing in case it can't update the bypass Added integration tests for outgoing UDP and TCP. All Kubernetes resources are now deleted after E2E tests. Use `MIRRORDE2EPRESERVE_FAILED` environment variable to preserve resources from failed tests. All resources created for E2E tests now share a constant label `mirrord-e2e-test-resource=true`. Added a debugging guide for the IntelliJ extension. Add `impersonate` permission on `userextras/accesskeyid`, `userextras/arn`, `userextras/canonicalarn` and `userextras/sessionname` resources to operator setup. Sometimes when using console logger mirrord crashes since tokio runtime isn't initialized, changed to just use a thread Removed armv7 builds that were wrongly added Add `ignore_ports` to `incoming` configuration so you can have ports that only listen locally (mirrord will not steal/mirror those ports). Add support for `xstatfs` to prevent unexpected behavior with

Improved bad target error Optimize agent Dockerfile for better cache use Cover more areas of the code and targets using clippy in CI and fix its warnings Rely more on Rusts own async trait and drop async-trait crate (the agent cant fully switch yet though). Notify clients about errors happening in agent's background tasks. Add support for the imagePullSecrets parameter on the agent pod. This can be specified in the configuration file, under agent.imagepullsecrets. Fix pause E2E test. Added an error prompt to the VS Code extension when there is no available target in the configured namespace. HTTP traffic stealer now supports HTTP/2 requests. Executable field was set to null if present, but no SIP patching was done. Fixed random crash in `closelayerfd` caused by supposed closing of stdout/stderr then calling to log that writes to it Use DashMap for `OPEN_DIRS` Use DashMap for `MANAGED_ADDRINFO` Use DashMap for `ConnectionQueue` Implemented `Default` for `Subscriptions`. Replaced usages of `Subscriptions::new` with `Default::default`. Improve testing guide. Removed unnecessary trait bounds for `Default` implementation on `IndexAllocator`. Replaced usages of `IndexAllocator::new` with `Default::default`. Update contributing guide. Update testing and building docs, and add instructions for the IDE extensions. Support for running SIP binaries via the vscode extension, for common configuration types. Add the failed connection address on failure to debug easily New IntelliJ icons - feel free to give feedback Fix internal proxy receiving signals from terminal targeted for the mirrord process/parent process by using setsid fix listing pods failing when config file exists on macOS Use DashMap instead of Mutex<HashMap> for `SOCKETS` Some small changes to make building the JetBrains plugin locally simpler. Update IntelliJ dependencies Update dependencies Update rust and remove unneccessary feature. Add default requests and limits values to mirrord-operator setup (100m/100Mi). Change CLI's version update message to display the correct command when mirrord has been installed with homebrew. fix using config with WSL on JetBrains Fix internal proxy exiting before IntelliJ connects to it in some situations (maven). Issue was parent process closing causing child to exit. Fixed by waiting from the extension call to the child. mirrord-cli: update cli so failing to use operator will fallback to no-operator mode. Add option to install specific version using the `install.sh` script via command line argument or `VERSION` environment variable Change connection reset to be a trace message instead of error Error when agent exits. Bring the testing documentation into the repo, link it in readme, and add some information. Introduce CheckedInto trait to convert raw pointers (checking for null) in Detour values. Re-enable http mirror e2e tests.. Change OPEN_FILES from Mutex HashMap to just using DashMap. Refactor file ops open/read/close to allow us to directly manipulate the remote file (in agent) withouht going through C (mainly used to not leak the remote file due to how gethostname works). Change dup to take an argument that signals if we should change the fd from SOCKETS to OPEN_FILES (or vice-versa). Support for outgoing unix stream sockets (configurable via config file or environment variable). Add version of hooked functions. add `Hash` trait on `mirrord_operator::license::License` struct dependencies bump and cleanup fix mirrord loading twice (to build also) and improve error message when no pods found fix f-stream functions by removing its hooks and add missing underlying libc calls fix deadlock in go20 test (remove trace?) set timeout for flaky/hanging test change outgoing connection drop to be trace instead of error since it's not an error Support stealing on meshed services with ports specified in --skip-inbound-ports on linkerd and itsio equivalent. fix microk8s support by adding possible containerd socket path fix gethostname null termination missing Update webbrowser dependency to fix security

fix mirroring not handling big requests - increase buffer size (in rawsocket dependency). also trace logs to not log the data. fix environment regression by mixing the two approaches together. priority is proc > oci (via container api) compile/test speed improvements add CARGONETGITFETCHWITH_CLI=true to agent's Dockerfile since we found out it saves a lot of time on fetching (around takes 60s when using libgit2) change `rust-toolchain.toml` so it won't auto install unneeded targets always remove `toolchain: nightly` parameter from `actions-rs/toolchain@v1` since it's not needed because we have `rust-toolchain.toml` saves a lot of time on fetching (takes around 60s when using libgit2) switch to use `actions-rust-lang/setup-rust-toolchain@v1` instead of `actions-rs/toolchain@v1` since it's deprecated and doesn't support `rust-toolchain.toml` remove s`Swatinem/rust-cache@v2` since it's included in `actions-rust-lang/setup-rust-toolchain@v1` use latest version of `Apple-Actions/import-codesign-certs` to remove warnings print logs of stealer/sniffer start failure run docker/containerd runtime at the same time to make e2e faster use base images for agent to reduce build time mirrord-layer: changed result of `getsockname` to return requested socket on `bind` instead of the detoured socket address mirrord-layer: Added `SocketId` to `UserSocket` as a better way of identifying sockets, part of #1054. CHANGELOG - changed to use towncrier Change socket error on reading from outgoing sockets and mirror to be info instead of error Possible bug when bound address is bypassed and socket stays in `SOCKETS` map. Change release.yaml so pushing final tags will occur only on real releases while manual releases will push into `ghcr.io/metalbear-co/mirrord-staging: ${{ github.sha }}` so we can leverage github CI for testing images. Don't build builder image as part of the build, use a prebuilt image - improve cd time Use `taiki-e/install-action` instead of `cargo install` (compiles from source) for installing `cross`. Fix broken aarch build config: `ignore_localhost` to `outgoing` config for ignoring localhost connections, meaning it will connect to local instead of remote localhost. config: `ignore_localhost` to `incoming` config for ignoring localhost bound sockets, meaning it will not steal/mirror those. combination of `ignore_localhost` in `incoming` and `outgoing` can be useful when you run complex processes that does IPC over localhost. `sip_binaries` to config file to allow specifying SIP-protected binaries that needs to be patched when mirrord doesn't detect those. See . Unnecessary error logs when running a script that uses `env` in its shebang. VSCode extension: running Python script with debugger fails because it tries to connect to the debugger port remotely. Big file leading to timeout: we found out that `bincode` doesn't do so well with large chunked messages so we limited remote read size to 1 megabyte, and read operation supports getting partial data until EOF. mirrord-operator: fix silent fail when parsing websocket messages fails. improved mirrord cli help message. mirrord-config: Change `flush_connections` default to `true`, related to . mirrord-layer: Added `port_mapping` under `incoming` configuration to allow mapping local ports to custom remote port, for example you can listen on port 9999 locally and it will steal/mirror the remote 80 port if `port_mapping: Fix issue when two (or more) containerd sockets exist and we use the wrong one. Fixes . Invalid toml in environment variables configuration examples. Use container's runtime env instead of reading it from `/proc/{containerrootpid}/environ` as some processes (such as nginx) wipe it. Fixes Removed the prefix "test" from all test names - . Created symbolic link from the vscode directory to the `LICENSE` and `CHANGELOG.md` files so that mirrord developers don't need to copy them there before building the app. mirrord-layer: `socket` hook will now block ipv6 requests and will return EAFNOSUPPORT. See

mirrord debug feature (for mirrord developers to debug mirrord): Cause the agent to exit early with an error. mirrord E2E tests: support for custom namespaces. Unpause the target container before exiting if the agent exits early on an error and the container is paused - . intellij-plugin: fix issue where execution hangs when running using Gradle. Fixes . intellij-plugin: fix issue where mirrord doesn't load into gradle, was found when fixing . mirrord-agent: reintroduce `-o lo` back to iptable rules to prevent issue where outinging messags could be intersepted by mirrord as incoming ones. mirrord-layer: binding same port on different IPs leads to a crash due to `ListenAlreadyExists` error. This is now ignored with a `info` message since we can't know if the IP/Port was already bound or not. Created a follow up issue to complete implementation and error at application's bind. VSCode Extension: Fix wrong CLI path on Linux VSCode Extension: Fix wrong CLI path Fix error in VSCode extension compilation CI: fix error caused by missing dir Change VSCode extension to package all binaries and select the correct one based on the platform. Fixes . agent: add log to error when handling a client message fails. agent: Make sniffer optional to support cases when it's not available and mirroring is not required. Update operator version mirrord now handles it when the local app closes a forwarded stolen tcp connection instead of exiting with an error. Potential fix for . missing kubeconfig doesn't fail extensions (it failed because it first tried to resolve the default then used custom one) layer: Don't print error when tcp socket faces error as it can be a normal flow. internal proxy - set different timeout for `mirrord exec` and running from extension fixing race conditions when running from IntelliJ/VSCode. Changed `withspanevents` from `FmtSpan::Active` to `FmtSpan::NEW | FmtSpan::CLOSE`. Practically this means we will have less logs on enter/exit to span and only when it's first created and when it's closed. JetBrains Plugin: Add debug logs for investigating user issues. JetBrains compatability: set limit from 222 (2022.2.4) since 221 isn't supported by us. Make `kubeconfig` setting effective always by using `-f` in `mirrord ls`. mirrord agent can now run without sniffer, will not be able to mirror but can still steal. this is to enable users who have older kernel (4.20>=) to use the steal feature. VSCode Extension: Prevent double prompting of the user to select the target if not specified in config. See . JetBrains enable support from 2021.3 (like we had in 3.14.3). mirrord-agent: localhost traffic (like healthprobes) won't be stolen by mirrord on meshed targets to allign behavior with non meshed targets. See Filter out agent pods from `mirrord ls`, for better IDE UX. Closes . Not exiting on SIP-check fail. Instead, logging an error and letting the program fail as it would without mirrord. See . Fix cache does not work on test-agent workflow. See . CI: merge queue + branch protection issues `gethostname` detour that returns contents of `/etc/hostname` from target pod. See relevant . `getsockname` now returns the remote local address of the socket, instead of the local fake address of the socket. This should fix issues with Akka or other software that checks the local address and expects it to match the local ip of the pod. This breaks agent protocol (agent/layer need to match). GoLand debug fails because of reading `/private/var/folders` remotely (trying to access self

fixed with filter change (see below) VSCode extension: update dialog message JetBrains: can now change focus from search field to targets using tab/shift+tab (for backwrad) Refactor - mirrord cli now spawns `internal proxy` which does the Kubernetes operations for the layer, so layer need not interact with k8s (solves issues with remote/local env mix) filter: add `/private/var/folders" to default local read override filter: fixed regex for `/tmp` default local read override disable flask e2e until we solve the glibc issue (probably fstream issue) Add a field to mirrord-config to specify custom path for kubeconfig , resolves . Removed limit on future builds `untilBuild` in JetBrains plugin. IntelliJ-ext: change the dialog to provide a sorted list and make it searchable, resolves . mirrord-layer: Changed default to read AWS credentials + config from remote pod. Removed unused env var (`MIRRORDEXTERNALENV`) mirrord-agent: Use `conntrack` to flush stealer connections (temporary fix for ). Added env guard to be used in cli + extension to prevent (self) misconfigurations (our kube settings being used from remote). mirrord-config: Fix disabled feature for env in config file, `env = false` should work. See . VS Code extension: release universal extension as a fallback for Windows and other platforms to be used with WSL/Remote development. Fixes Fix `MIRRORDAGENTRUST_LOG` can't be more than info due to dependency on info log. Fix pause feature not working in extension due to writing to stdout (changed to use trace) `DNSLookup` failures changed to be info log from error since it is a common case. mirrord-agent: now prints "agent ready" instead of logging it so it can't be fudged with `RUST_LOG` control. mirrord-agent: `agent::layer_recv` changed instrumentation to be trace instead of info. mirrord-layer/agent: change ttl of job to be 1 second for cases where 0 means in cluster don't clean up. Convert go fileops e2e tests into integration tests. Part of . Rust: update rust toolchain (and agent rust `DOCKERFILE`) to `nightly-2023-01-31`. exec/spawn detour refactor . mirrord-layer: Partialy load mirrord on certian processes that spawn other processes to allow sip patch on the spawned process. This to prevent breaking mirrord-layer load if parent process is specified in `--skip-processes`. (macOS only) mirrord-layer: DNS resolving doesn't work when having a non-OS resolver (using UDP sockets) since `/etc/resolv.conf` and `/etc/hosts` were in the local read override, leading to use the local nameserver for resolving. Fixes mirrord-agent: Infinite reading a file when using `fgets`/`read_line` due to bug seeking to start of file. Rare deadlock on file close that caused the e2e file-ops test to sometimes fail (). Support for Go's `os.ReadDir` on Linux (by hooking the `getdents64` syscall). Part of . Test mirrord with Go 1.20rc3. mirrord-agent: Wrap agent with a parent proccess to doublecheck the clearing of iptables. See mirrord-layer: Change `HOOK_SENDER` from `Option` to `OnceLock`. mirrord-agent: Handle HTTP upgrade requests when the stealer feature is enabled (with HTTP traffic) PR . E2E tests compile on MacOS. mirrord could not load into some newer binaries of node - . Now hooking also `posix_spawn`, since node now uses `libuv`'s `uvspawn` (which in turn calls `posixspawn`) instead of libc's `execvp` (which calls `execve`). Read files from the temp dir (defined by the system's `TMPDIR`) locally, closes . Support impersonation in operator Go crash in some scenarios . Remove already deprecated `--no-fs` and `--rw` options, that do not do anything anymore, but were still listed in the help message. Bug: SIP would fail the second time to run scripts for which the user does not have write permissions. Change layer/cli logs to be to stderr instead of stdout to avoid mixing with the output of the application. Closes Code refactor: moved all file request and response types into own file. Changelog error failing the JetBrains

mirrord-operator: replace operator api to use KubernetesAPI extension. tests: flaky passthrough fix. Avoid 2 agents running at the same time, add minimal sleep (1s) macOS x64/SIP(arm): fix double hooking `fstatat$INODE64`. Possible crash and undefined behavior. introduce `mirrord-console` - a utility to debug and investigate mirrord issues. Remove old fs mode cli: no `--rw` or `--no-fs`. layer: no `MIRRORDFILEOPS`/`MIRRORDFILEROOPS`/`MIRRORDFILEFILTERINCLUDE`/`MIRRORDFILEFILTER_EXCLUDE` crash when `getaddrinfo` is bypassed and libc tries to free our structure. Closes Stealer hangs on short streams left open and fails on short closed streams to filtered HTTP ports - . Issue when connect returns `libc::EINTR` or `libc::EINPROGRESS` causing outgoing connections to fail. config: file config updated to fix simple pattern of IncomingConfig. Agent now sends error encountered back to layer for better UX when bad times happen. (This only applies to error happening on connection-level). Partial ls flow for Go on macOS (implemented `fdopendir` and `readdir_r`). Closes New feature: HTTP traffic filter! Allows the user to steal HTTP traffic based on HTTP request headers, for example `Client: me` would steal requests that match this header, while letting unmatched requests (and non-HTTP packets) through to their original destinations. Update the setup-qemu-action action to remove a deprecation warning in the Release Workflow stat functions now support directories. Possible bugs with fds being closed before time (we now handle dup'ing of fds, and hold those as ref counts) agent: Return better error message when failing to use `PACKETIGNOREOUTGOING` flag. Add brew command to README intellij plugin: mirrord icon should always load now. intellij plugin: on target selection cancel, don't show error - just disable mirrord for the run and show message. fixed setting a breakpoint in GoLand on simple app hanging on release build (disabled lto). - Fixes . Removed `disabled` in favor of `local` in `fs` configuration. update `kube` dependency + bump other update `dlv` packed with plugins. Add go to skipped processes in JetBrains plugin. Solving GoLand bug. Running on specific Kubernetes setups, such as Docker for Desktop should work again. Add golang stat hooks, closes agent: mount /var from host and reconfigure docker socket to /var/run/docker.sock for better compatibility Error on specifying namespace in configuration without path (pod/container/deployment). Closes IntelliJ plugin with new UI enabled now shows buttons. Closes Fix deprecation warnings (partially), update checkout action to version 3. Refactored detours to use new helper function `Result::as_hook` to simplify flow. (no change in behavior) Logging for IntelliJ plugin for debugging/bug reports. Crash when mirroring and state is different between local and remote (happens in Mesh). We now ignore messages that are not in the expected state. (as we can't do anything about it). agent: Fix typo in socket path for k3s environments intellij-plugin: fix missing telemetry/version check Add `xstat` hook, fixes ) Fix build scripts for the refactored IntelliJ plugin agent: Add support for k3s envs IntelliJ plugin - refactor, uses cli like vs code. getaddrinfo: if node is NULL just bypass, as it's just for choosing ip/port, Fixes and cli now loads env, removes go env stuff at load, might fix some bugs there. Create empty release to overcome temporary issue with VS Code marketplace publication vscode ext: use process env for running mirrord. Fixes layer + go - connect didn't intercept sometimes (we lacked a match). Fixes . cli: Set environment variables from cli to spawned process instead of layer when using `mirrord exec`. cli: use miette for nicer errors cli: some ext exec preparations, nothing user facing yet. vs code ext: use cli, fixes some env bugs with go and better user

Don't add temp prefix when using `extract` command. VS Code extension: mirrord enable/disable to be per workspace. VS Code extension: bundle the resources Add `/System` to default ignore list. Remove `testmirrordlayer` from CI as it's covered in integration testing. fd leak on Linux when using libuv (Node). Caused undefined behavior. Fixes . Better separation in mirrord cli. Adjust filters - all directory filters also filter the directory itself (for when lstat/stating the directory). Added `/Applications` Add `mirrord ls` which allows listing target path. Hidden from user at the moment, as for now it's meant for extension use only. Refactor e2e tests: split into modules based on functionality they test. internal refactor in mirrord-agent: Stealer feature changed from working per connection to now starting with the agent itself ("global"). Got rid of `steal_worker` in favor of a similar abstraction to what we have in `sniffer.rs` (`TcpConnectionStealer` that acts as the traffic stealing task, and `TcpStealerApi` which bridges the communication between the agent and the stealer task). Tests CI: don't wait for integration tests to start testing E2E tests. Add missing `fstat`/`lstat`/`fstatat`/`stat` hooks. Weird crash that started happening after Frida upgrade on macOS M1. Fix asdf: Add `/tmp` not just `/tmp/` to exclusion. Add `.tool-version` to exclusion. `fclose` was calling close which doesn't flush. IntelliJ Plugin: downgrade Java to version 11. IntelliJ Plugin: update platform version to 2022.3. Disable progress in mirrord-layer - can cause issues with forks and generally confusing now that agent is created by cli (and soon to be created by IDE plugin via cli). Update to Frida 16.0.7 Add more paths to the default ignore list (`/snap` and `/.asdf/`) - to fix asdf issues. Add `/bin/` to default ignore list - asdf should be okay now! Update GitHub action to use latest `rust-cache` mirrord-operator: Add securityContext section for deployment in operator setup Fix `--fs-mode=local` didn't disable hooks as it was supposed to. Fix hooking wrong libc functions because of lack of module specification - add function to resolve module name to hook from (libc on Unix,libsystem on macOS). Partially fixes asdf issue. E2E test for pause feature with service that logs http requests and a service that makes requests. mirrord-layer: automatic operator discovery and connection if deployed on cluster. (Discovery can be disabled with `MIRRORDOPERATORENABLE=false`). Added `/tmp/` to be excluded from file ops by default. Fixes . Reformatted a bit the file stuff, to make it more readable. We now have `FILEMODE` instead of `FILEOPS_*` internally. Changed fileops test to also test write override (mirrord mode is read and override specific path) `--pause` feature (unstable). See . operator setup cli feature. mirrord-layer: operator connection that can be used instad of using kubernetes api to access agents. CI: cancel previous runs of same PR. cli: set canonical path for config file to avoid possible issues when child processes change current working directory. config: Refactor config proc macro and behavior - we now error if a config value is wrong instead of defaulting. layer: panic on error instead of exiting without any message. CI: don't run CI on draft PRs. Update dependencies. Update to clap v4 (cli parser crate). Started deprecation of fsmode=disabled, use fsmode=local instead. Typo in `--agent-startup-timeout` flag. Agent dockerfile: fix build for cross arch Added clippy on macOS and cleaned warnings. release.yaml: Linux AArch64 for real this time. (embedded so was x64) Create agent in the cli and pass environment variables to exec'd process to improve agent re-use. IntelliJ: change default log level to warning (match cli/vscode). IntelliJ: don't show progress (can make some tests/scenarios fail).

Build layer/cli with Centos 7 compatible glibc (AmazonLinux2 support). Change CPU/memory values requested by the Job agent to the lowest values possible. MacOS: Support for executing SIP binaries in user applications. We hook `execve` and create a SIP-free version of the binary on-the-go and execute that instead of the SIP binary. This means we now support running bash scripts with mirrord also on MacOS. Closes . Only warn about invalid certificates once per agent. Reduce tokio features to needed ones only. CI: Fix regex for homebrew formula Potentially ignoring write calls (`fd < 2`). CI: Fix release for linux aarch64. Fixes . Possible cases where we don't close fds correctly. VS Code Extension: Fix crash when no env vars are defined in launch.json CLI: change temp lib file to only be created for new versions mirrord-config: refactored macro so future implementations will be easier Release: fix homebrew release step CI: fix `release_gh` zip file step CI: download shasums and add git username/email to make the homebrew release work Remove `unimplemented` for some IO cases, we now return `Unknown` instead. Also added warning logs for these cases to track. Only recommend `--accept-invalid-certificates` on connection errors if not already set. Terminate user application on connection error instead of only stopping mirrord. CI: Update homebrew formula on release, refer VS Code Extension: change extension to use the target specified in the mirrord config file, if specified, rather than show the pod dropdown `MIRRORDAGENTNETWORK_INTERFACE` environment variable/file config to let user control which network interface to use. Workaround for . mirrord-config: `deprecated` and `unstable` tags to MirrordConfg macro for messaging user when using said fields VS Code Extension: change extension to use a mirrord-config file for configuration VS Code Extension: use the IDE's telemetry settings to determine if telemetry should be enabled mirrord-layer: Remove `unwrap` from initialization functions. Log level of operation bypassing log from warn to trace (for real this time). Perform filesystem operations for paths in `/home` locally by default (for real this time). VS Code Extension: add JSON schema Bypass SIP on MacOS on the executed binary, (also via shebang). See ]. This does not yet include binaries that are executed by the first binary. fix markdown job by adding the checkout action mirrord-agent: No longer resolves to `eth0` by default, now we first try to resolve the appropriate network interface, if this fails then we use `eth0` as a last resort. Fixes . intelliJ: use custom delve on macos Release: fix broken docker build step caused by folder restructure using gcloud auth for kubernetes. (mistakenly loaded layer into it) debugging Go on VSCode. We patch to use our own delivered delve. Changed layer not to crash when connection is closed by agent. Closed . IntelliJ: fallback to using a textfield if listing namespaces fails mirrord-config: New `mirrord-schema.json` file that contains docs and types which should help the user write their mirrord config files. This file has to be manually generated (there is a test to help you remember). IntelliJ: Fix occurring of small namespace selection window and make mirrord dialogs resizable IntelliJ: Fix bug when pressing cancel in mirrord dialog and rerunning the application no mirrord window appears again VS Code: Fix crash occurring because it used deprecated env vars. mirrord-config: Take `schema` feature out of feature flag (now it's always on). mirrord-config: Add docs for the user config types. mirrord-layer: Allow capturing tracing logs to file and print github issue creation link via MIRRORDCAPTUREERROR_TRACE env variable Fix vscode artifacts where arm64 package was not

IntelliJ plugin: if namespaces can't be accessed, use the default namespace Add `/home` to default file exclude list. Changed log level of `Bypassing operation...` from warning to trace. IntelliJ settings default to match CLI/VSCode. Fixed broken release step for VS Code Darwin arm64 version Fixed breaking vscode release step Fixed an issue with the release CI Update target file config to have `namespace` nested inside of `target` and not a separate `target_namespace`. See and aarch64 release binaries (no go support yet, no IntelliJ also). mirrord-layer: Add that allows the user to include or exclude file paths (with regex support) for file operations. mirrord-layer: Improve error message when user tries to run a program with args without `--`. Add tests for environment variables passed to KubeApi for authentication feature for cli credential fetch Remove openssl/libssl dependency, cross compilation is easier now. (It wasn't needed/used) mirrord-config: Changed the way works: now it supports 2 modes `Simple` and `Advanced`, where `Simple` is similar to the old behavior (enables read-only, read-write, or disable file ops), and `Advanced` allows the user to specify include and exclude (regexes) filters for . Lint `README` and update it for `--target` flag. mirrord-layer: improve error message for invalid targets. `--pod-name`, `--pod-namespace`, `--impersonatedcontainername` have been removed in favor of `--target`, `--target-namespace` Env var to ignore ports used by a debugger for intelliJ/VSCode, refer Add changelog for intelliJ extension, closes Add filter for changelog to ci.yml Telemetry for intelliJ extension. Update intelliJ extension: lint & bump java version to 17. Added `/Users` and `/Library` to path to ignore for file operations to improve UX on macOS. Use same default options as CLI in intelliJ extension. Improve UI layout of intelliJ extension. Separate tcp and udp outgoing option in intelliJ extension. Tighter control of witch environment variables would be passed to the KubeApi when fetching credentials via cli in kube-config. See Lint Changelog and fix level of a "Changed" tag. File operations - following symlinks now works as expected. Previously, absolute symlinks lead to use our own path instead of target path. For example, AWS/K8S uses `/var/run/..` for service account credentials. In many machines, `/var/run` is symlink to `/run` so we were using `/run/..` instead of `/proc/{target_pid}/root/run`. Fix not reappearing window after pressing cancel-button in intelliJ extension. Telemetries, see for more information. Added timeout for "waiting for pod to be ready..." in mirrord-layer to prevent unresponsive behavior. See IntelliJ Extension: Default log level to `ERROR` from `DEBUG` Issue with where they use `/run/dockershim.sock` instead of the default containerd path. Add new path as fallback. Extended support for both `-s` and `-x` wildcard matching, now supports `PREFIX*`, `*SUFFIX`, ect. Add to env default ignore `JAVAHOME`,`HOMEPATH`,`CLASSPATH`,`JAVAEXE` as it's usually runtime that you don't want from remote. Possibly fixes issue discussed on Discord (used complained that they had to use absolute path and not relative). Add `jvm.cfg` to default bypass for files. Clarify wrong target error message. mirrord-layer: Improve error message in `connection::handle_error`. Don't ignore passed `--pod-namespace` argument, closes ] Replace deprecated environment variables in IntelliJ plugin Issues with IntelliJ extension when debugging Kotlin applications Scrollable list for pods and namespaces for IntelliJ extension, closes ] `--impersonated-container-name` and `MIRRORDIMPERSONATEDCONTAINER_NAME` are deprecated in favor of `--target` or `MIRRORDIMPERSONATEDTARGET` `--pod-namespace` and `MIRRORDAGENTIMPERSONATEDPODNAMESPACE` are deprecated in favor of `--target-namespace` and `MIRRORDTARGETNAMESPACE` release: VS Code extension release as stable and not pre-release. Dev container failing to execute `apt-get install -y clang` Update some texts in documentation, READMEs, and extension package descriptions IntelliJ version check on enabling instead of on project start. Don't check again after less than 3

IntelliJ plugin crashing on run because both include and exclude were being set for env vars. `pwrite` hook (used by `dotnet`); Issue . Changed non-error logs from `error!` to `trace!`. Agent pod definition now has `requests` specifications to avoid being defaulted to high values. See . Change VSCode extension configuration to have file ops, outgoing traffic, DNS, and environment variables turned on by default. update intelliJ extension: toggles + panel for include/exclude env vars Exclude internal configuration fields from generated schema. Issue . We now detect NixOS/Devbox usage and add `sh` to skipped list. Reuse agent - first process that runs will create the agent and its children will be able to reuse the same one to avoid creating many agents. Don't print progress for child processes to avoid confusion. Skip istio/linkerd-proxy/init container when mirroring a pod without a specific container name. Add "linkerd.io/inject": "disabled" annotation to pod created by mirrord to avoid linkerd auto inject. mirrord-layer: support `-target deployment/deploymentname/container/containername` flag to run on a specific container. `/nix/*` path is now ignored for file operations to support NixOS. Shortcut `deploy` for `deployment` in target argument. Added the ability to override environment variables in the config file. Print exit message when terminating application due to an unhandled error in the layer. mirrord-layer: refactored `pod_api.rs` to be more maintainble. Use kube config namespace by default. mirrord-layer: Ignore `EAFNOSUPPORT` error reporting (valid scenario). `pread` hook (used by `dotnet`); mirrord-layer: ignore opening self-binary (temporal SDK calculates the hash of the binary, and it fails because it happens remotely) Layer integration tests with more apps (testing with Go only on MacOS because of known crash on Linux - ]). Closes ]. Added progress reporting to the CLI. CI: use for merging! woohoo. Don't report InProgress io error as error (log as info) mirrord-layer: Added some `dotnet` files to `IGNORE_FILES` regex set; mirrord-layer: Added the `Detour` type for use in the `ops` modules instead of `HookResult`. This type supports returning a `Bypass` to avoid manually checking if a hook actually failed or if we should just bypass it; mirrord-protocol: Reduce duplicated types around `read` operation; Layer integration tests for more apps. Closes ]. Rename http mirroring tests from `integration` to `http_mirroring` since there are now also integration tests in other files. Delete useless `e2e_macos` CI job. Integration tests also display test process output (with mirrord logs) when they time out. CI: mirrord-layer UT and integration run in same job. .devcontainer: Added missing dependencies and also kind for running e2e tests. Fix IntelliJ Extension artifact - use glob pattern Use LabelSelector instead of app=* to select pods from deployments Added another protection by setting an env flag to avoid loading then removing it after executing the api. Release image for armv7 (Cloud ARM) Release for non-amd64 arch failed because of lack of QEMU step in the github action. Re-added it Replaced `pcap` dependency with our own `rawsocket` to make cross compiling faster and easier. Release CI: Remove another failing step Release CI: Temporarily comment out failing step Release CI: Fix checkout action position in intelliJ release. Layer integration test. Tests the layer's loading and hooking in an http mirroring simulation with a flask web app. Addresses but does not close ] (more integration tests still

Release CI: Fix paths for release artifacts mirrord-cli: added a SIP protection check for macos binaries, closes ] Fixed unused dependencies issue, closes ] Remove building of arm64 Docker image from the release CI Release CI: add extensions as artifacts, closes ] Remote operations that fail logged on `info` level instead of `error` because having a file not found, connection failed, etc can be part of a valid successful flow. mirrord-layer: When handling an outgoing connection to localhost, check first if it's a socket we intercept/mirror, then just let it connect normally. mirrord-layer: removed `tracing::instrument` from `*_detour` functions. `getaddrinfo` now uses when resolving DNS (previously it would do a `getaddrinfo` call in mirrord-agent that could result in incompatibility between the mirrored pod and the user environments). Support clusters running Istio. Closes ]. Support impersonated deployments, closes ] Shorter way to select which deployment/pod/container to impersonate through `--target` or `MIRRORDIMPERSONATEDTARGET`, closes ] mirrord-layer: Support config from file alongside environment variables. intellij-ext: Add version check, closes ] intellij-ext: better support for Windows with WSL. `--pod-name` or `MIRRORDAGENTIMPERSONATEDPODNAME` is deprecated in favor of `--target` or `MIRRORDIMPERSONATEDTARGET` tcp-steal working with linkerd meshing. mirrord-layer should exit when agent disconnects or unable to make initial connection Test that verifies that outgoing UDP traffic (only with a bind to non-0 port and a call to `connect`) is successfully intercepted and forwarded. macOS binaries should be okay now. Ignore http tests because they are unstable, and they block the CI. Bundle arm64 binary into the universal binary for MacOS. release CI: Fix dylib path for `dd`. mirrord-layer: Fix `connect` returning error when called on UDP sockets and the outgoing traffic feature of mirrord is disabled. mirrord-agent: Add a `tokio::time:timeout` to `TcpStream::connect`, fixes golang issue where sometimes it would get stuck attempting to connect on IPv6. intelliJ-ext: Fix CLion crash issue, closes ] vscode-ext: Support debugging Go, and fix issues with configuring file ops and traffic stealing. mirrord-layer: Remove check for ignored IP (localhost) from `connect`. mirrord-layer: Refactor `connect` function to be less bloated. `.dockerignore` now ignores more useless files (reduces mirrord-agent image build time, and size). mirrord-agent: Use `tracing::instrument` for the outgoing traffic feature. mirrord-agent: `IndexAllocator` now uses `ConnectionId` for outgoing traffic feature. mirrord-layer: Remove `tracing::instrument` from `goenv::goenvsunix_detour`. mirrord-layer: Log to info instead of error when failing to write to local tunneled streams. mirrord-layer, mirrord-cli: new command line argument/environment variable - `MIRRORDSKIPPROCESSES` to provide a list of comma separated processes to not to load into. Closes ] , ] release CI: add arm64e to the universal dylib intellij-ext: Add support for Goland mirrord-layer: Return errors from agent when `connect` fails back to the hook (previously we were handling these as errors in layer, so `connect` had slightly wrong behavior). mirrord-layer: instrumenting error when `write_detur` is called to stdout/stderr mirrord-layer: workaround for `presented server name type wasn't supported` error when Kubernetes server has IP for CN in certificate. ] mirrord-layer: Use `tracing::instrument` to improve logs. Outgoing UDP test with node. Closes ] Fix crash in VS Code extension happening because the MIRRORDOVERRIDEENVVARSINCLUDE and MIRRORDOVERRIDEENVVARSEXCLUDE vars being populated with empty values (rather than not being populated at all) .Closes ]. Add exception to gradle when dylib/so file is not found. Closes ] mirrord-layer: Return errors from agent when `connect` fails back to the hook (previously we were handling these as errors in layer, so `connect` had slightly wrong behavior). Changed agent namespace to default to the pod namespace. Closes ]. Code sign Apple binaries. CD - Update latest tag after release is published. In `go-e2e` test, call `os.Exit` instead fo sending `SIGINT` to the process. Install script now downloads latest tag instead of main branch to avoid downtime on installs. Fix Environment parsing error when value contained '=' Closes ]. Fix bug in outgoing traffic with multiple requests in quick succession. Closes

Add missing dependency breaking the VS Code release. New feature: UDP outgoing, mainly for Go DNS but should work for most use cases also! E2E: add tests for python's fastapi with uvicorn Socket ops - `connect`: ignore localhost and ports 50000 - 60000 (reserved for debugger) Add "*.plist" to `IGNORE_REGEX`, refer ]. Change all functionality (incoming traffic mirroring, remote DNS outgoing traffic, environment variables, file reads) to be enabled by default. *Note that flags now disable functionality* mirrord-layer: User-friendly error for invalid kubernetes api certificate mirrord-cli: Add random prefix to the generated shared lib to prevent Bus Error/EXCBADACCESS Support for Go 1.19>= syscall hooking Fix Python debugger crash in VS Code Extension. Closes ]. Release arm64 agent image. Use selected namespace in IntelliJ plugin instead of always using default namespace. Fix bug where VS Code extension would crash on startup due to new configuration values not being the correct type. Unset DYLDINSERTLIBRARIES/LD_PRELOAD when creating the agent. Closes ]. Fix NullPointerException in IntelliJ Extension. Closes ]. FIx dylib/so paths for the IntelliJ Extension. Closes ]. Add more configuration values to the VS Code extension. Warning when using remote tcp without remote DNS (can cause ipv6/v4 issues). Closes VS Code needed restart to apply kubectl config/context change. Closes . Fixed DNS feature causing crash on macOS on invalid DNS name due to mismatch of return codes. . Fixed DNS feature not using impersonated container namespace, resulting with incorrect resolved DNS names. mirrord-agent: Use `IndexAllocator` to properly generate `ConnectionId`s for the tcp outgoing feature. tests: Fix outgoing and DNS tests that were passing invalid flags to mirrord. Go Hooks - use global ENABLEDFILEOPS Support macOS with apple chip in the IntelliJ plugin. Closes . New feature: mirrord now supports TCP traffic stealing instead of mirroring. You can enable it by passing `--tcp-steal` flag to cli. mirrord-layer: Go environment variables crash - run Go env setup in a different stack (should fix ) mirrord-layer: Add `#![feature(let_chains)]` to `lib.rs` to support new compiler version. CI:Release - Fix typo that broke the build New feature, . It's now possible to make requests to a remote host from the staging environment context. You can enable this feature setting the `MIRRORDTCPOUTGOING` variable to true, or using the `-o` option in mirrord-cli. mirrord-cli add login command for logging in to metalbear-cloud CI:Release - Provide zip and sha256 sums Environment variables feature on Golang programs. Issue #292 closed in #299 CI - set typescript version at 4.7.4 to fix broken release action Support for Golang fileops IntelliJ Extension for mirrord mirrord-layer: Added common `Result` type to to reduce boilerplate, removed dependency of `anyhow` crate. mirrord-layer: Split `LayerError` into `LayerError` and `HookError` to distinguish between errors that can be handled by the layer and errors that can be handled by the hook. (no more requiring libc errno for each error!). Closes CI - remove usage of ubuntu-18.04 machines (deprecated) E2E - add basic env tests for bash scripts mirrord-agent - Update pcap library, hopefully will fix dropped packets (syn sometimes missed in e2e). mirrord-agent/layer - Sometimes layer tries to connect to agent before it finsihed loading, even though pod is running. Added watching the log stream for a "ready" log message before attempting to connect. E2E - describe all pods on failure and add file name to print of logs. E2E - print timestamp of stdout/stderr of `TestProcess`. E2E - Don't delete pod/service on failure, instead leave them for debugging. mirrord-agent - Don't use `tokio::spawn` for spawning `sniffer` (or any other namespace changing task) to avoid namespace-clashing/undefined

Possibly fixing bugs. Change the version check on the VS Code extension to happen when mirrord is enabled rather than when the IDE starts up. mirrord-layer: You can now pass `MIRRORDAGENTCOMMUNICATION_TIMEOUT` as environment variable to control agent timeout. Expand file system operations with `access` and `faccessat` hooks for absolute paths Ephemeral Containers didn't wait for the right condition, leading to timeouts in many cases. mirrord-layer: Wait for the correct condition in job creation, resolving startup/timeout issues. mirrord-layer: Add a sleep on closing local socket after receiving close to let local application respond before closing. mirrord-layer: Fix DNS issue where `ai_addr` would not live long enough (breaking the remote DNS feature). Removed unused dependencies from `mirrord-layer/Cargo.toml`. (Closes #220) reduce e2e flakiness (add message sent on tcp listen subscription, wait for that message) reduce e2e flakiness - increase timeout time mirrord-layer - increase agent creation timeout (to reduce e2e flakiness on macOS) E2E - Don't do file stuff on http traffic to reduce flakiness (doesn't add any coverage value..) mirrord-layer - Change tcp mirror tunnel `select` to be biased so it flushes all data before closing it (better testing, reduces e2e flakiness) E2E - unify resolvenodehost for linux and macOS with support for wsl provided Docker & Kubernetes E2E - add `trace` for tests to have paramaterized arguments printed mirrord-agent - add debug print of args to identify runs E2E - remove double `--extract-path` parameter in tests E2E - macOS colima start with 3 cores and 8GB of RAM. E2E - Increase agent communication timeout to reduce flakiness. mirrord-layer - add `DetourGuard` to prevent unwanted calls to detours from our code. mirrord-layer - extract reused detours to seperate logic functions E2E - macOS run only sanity http mirror traffic with Python Add a flag for the agent, `--ephemeral-container`, to correctly refer to the filesystem i.e. refer to root path as `/proc/1/root` when the flag is on, otherwise `/`. Add support for Golang on amd64 (x86-64). Assign a random port number instead of `61337`. (Reason: A forking process creates multiple agents sending traffic on the same port, causing addrinuse error.) `mirrord-layer/socket` now uses `socket2::SockAddr` to comply with Rust's new IP format. Fix filesystem tests to only run if the default path exists. Fix extension not running due to the node_modules directory not being packaged. New feature, . It is now possible to use the remote's `addrinfo` by setting the `MIRRORDREMOTEDNS` variable to `true`, or using the `-d` option in mirrord-cli. New feature, . Use Kubernetes beta feature `Ephemeral Containers` to mirror traffic with the `--ephemeral-container` flag. E2E tests on macos for Golang using the Gin framework. Refactored `mirrord-layer/socket` into a module structure similar to `mirrord-layer/file`. Refactored the error part of the many `Result<Response, ResponseError>`. Refactored `file` related functions, created `FileHandler` and improved structure. Refactored error handling in mirrord-layer. E2E: Collect minikube logs and fix collecting container logs E2E: macOS use colima instead of minikube. Refactored `mirrord-layer/lib.rs` - no more passing many arguments! :) Refactored `mirrord-layer/lib.rs` - remove `unwrap()` and propagate error using `Result` Handle unwraps in fileops to gracefully exit and enable python fileops tests. Changed `addrinfo` to `VecDeque` - fixes a potential bug (loss of order) mirrord-cli `exec` subcommand accepts `--extract-path` argument to set the directory to extract the library to. Used for tests mainly. mirrord-layer provides `MIRRORDIMPERSONATEDCONTAINER_NAME` environment variable to specify container name to impersonate. mirrord-cli accepts argument to set variable. vscode-ext provides quick-select for setting `MIRRORDIMPERSONATEDCONTAINER_NAME` Refactor e2e, enable only Node HTTP mirroring test. E2E: add macOS to E2E, support using minikube by env

E2E: Skip loading to docker before loading to minikube (load directly to minikube..) layer: Environment variables now load before process starts, no more race conditions. Support connections that start with tcp flags in addition to Syn (on macOS CI we saw CWR + NS) `fcntl` error on macOS by a workaround. Refactor(agent) - change `FileManager` to be per peer, thus removing the need of it being in a different task, moving the handling to the peer logic, change structure of peer handling to a struct. Don't fail environment variable request if none exists. E2E: Don't assert jobs and pods length, to allow better debugging and less flakiness. Refactor(agent) - Main loop doesn't pass messages around but instead spawned peers interact directly with tcp sniffer. Renamed Peer -> Client and ClientID. Add context to agent/job creation errors (Fixes #112) Add context to stream creation error (Fixes #110) Change E2E to use real app, closes Add support for overriding a process' environment variables by setting `MIRRORDOVERRIDEENV_VARS` to `true`. To filter out undesired variables, use the `MIRRORDOVERRIDEFILTERENVVARS` configuration with arguments such as `FOO;BAR`. Remove `unwrap` from the `Future` that was waiting for Kube pod to spin up in `pod_api.rs`. (Fixes #110) Speed up agent container image building by using a more specific base image. CI: Remove building agent before building & running tests (duplicate) CI: Add Docker cache to Docker build-push action to reduce build duration. CD release: Fix universal binary for macOS Refactor: Change protocol + mirrord-layer to split messages into modules, so main module only handles general messages, passing down to the appropriate module for handling. Add a CLI flag to specify `MIRRORDAGENTTTL` CI: Collect mirrord-agent logs in case of failure in e2e. Add "app" = "mirrord" label to the agent pod for log collection at ease. CI: Add sleep after local app finishes loading for agent to load filter make tests less flaky. Handle relative paths for open, openat Fix once cell renamings, PR Enable the blocking feature of the `reqwest` library Compile universal binaries for MacOS. (Fixes #131) E2E small improvements, removing sleeps. (Fixes #99) File operations are now available behind the `MIRRORDFILEOPS` env variable, this means that mirrord now hooks into the following file functions: `open`, `fopen`, `fdopen`, `openat`, `read`, `fread`, `fileno`, `lseek`, and `write` to provide a mirrored file system. Support for running x64 (Intel) binary on arm (Silicon) macOS using mirrord. This will download and use the x64 mirrord-layer binary when needed. Add detours for fcntl/dup system calls, closes Add graceful exit for library extraction logic in case of error. Refactor the CI by splitting the building of mirrord-agent in a separate job and caching the agent image for E2E tests. Update bug report template to apply to the latest version of mirrord. Change release profile to strip debuginfo and enable LTO. VS Code extension - update dependencies. CLI & macOS: Extract to `/tmp/` instead of `$TMPDIR` as the executed process is getting killed for some reason. Fix bug that caused configuration changes in the VS Code extension not to work Fix typos Prompt user to update if their version is outdated in the VS Code extension or CLI. Add support for docker runtime, closes . Add a keep-alive to keep the agent-pod from exiting, closes Complete refactor and re-write of everything. The CLI/VSCode extension now use `mirrord-layer` which loads into debugged process using `LD_PRELOAD` /`DYLDINSERTLIBRARIES`. It hooks some of the syscalls in order to proxy incoming traffic into the process as if it was running in the remote pod. Mono repo Fixed unwraps inside of , closes