v1.16.1

firecracker-microvm/firecrackerv1.16.1Jul 2, 2026by not4s

AI Summary

This patch release addresses critical bugs related to the jailer's file path handling and vsock connectivity issues that arose during snapshot restoration.

Key Highlights

Reverted the use of `O_NOFOLLOW` for the jailer's cgroup and network namespace file operations to allow symlinks.
Fixed a bug causing vsock guest-to-host connections to time out after snapshot restore.
Device now replays TX queue notifications to re-process in-flight descriptors.

Full Release Notes

## Fixed

* [#5959](https://github.com/firecracker-microvm/firecracker/pull/5959): Reverted the use of `O_NOFOLLOW` for the jailer's cgroup and network namespace file operations, so symlinks are again allowed in these paths.
* [#5958](https://github.com/firecracker-microvm/firecracker/pull/5958): Fixed a bug that caused vsock guest-to-host connections to time out after snapshot restore, triggered by taking a snapshot with a TX descriptor in-flight. On restore the device now replays the TX queue notification so in-flight TX descriptors are re-processed and notification suppression is re-armed.