# v1.10.0

## Release Notes

These release notes describe all changes since the previous minor release, [v1.9.0](https://docs.edera.dev/reference/release-notes/v1.9.0/), not since the most recent 1.9.x patch. Some of the fixes and enhancements listed below were also delivered in the v1.9.1 patch release; they are repeated here so this page is a complete record of what changed between 1.9.0 and 1.10.0.

## New Features & Enhancements

### Installer

- [KVM-based virtualization](https://docs.edera.dev/technical-overview/architecture/kvm/) is in Early Access. The feature is supported but ships with minor known issues in this release (see [Known Issues](https://docs.edera.dev/reference/release-notes/v1.10.0/#known-issues)). KVM-based virtualization is opt-in, and may be enabled by passing the `HYPERVISOR=kvm` flag to the installer. KVM is more convenient, can use your existing kernel, and does not require installing Xen or modifying boot-level components, but has reduced performance compared to Xen.
- The installer now automatically chooses the best available virtualization mechanism for Xen zones based on available hardware virtualization capabilities.
- Removed the `protect-orchestrator` service from the install.

### Core

- Added zone suspend/restore capabilities to Xen zones, allowing zones to be suspended or resumed safely.
- Added zone forking capabilities to Xen zones. This allows a new zone to be cheaply “snapshotted” from an existing suspended zone, using a copy-on-write mechanism and shared pages to achieve tight bin-packing and efficient memory consumption. This feature is currently only supported with Xen PVH zones, is currently in Early Access, and requires enabling the [`fork-v0` feature flag](https://docs.edera.dev/reference/configuration/daemon-toml/#fork-v0) to use.
- Full NUMA support. Edera now intelligently selects the optimal NUMA node count and selection strategy, and it is now possible to manually specify NUMA topology options for optimal performance, if desired.
- Added support for issuing Edera control plane API commands from Edera-managed workloads. This requires enabling the [`control-api-idm-v0` feature flag](https://docs.edera.dev/reference/configuration/daemon-toml/#control-api-idm-v0) for those workloads.
- Added hundreds of zone-specific kernel metrics to the node-level `/metrics/resource` Prometheus endpoint. These expose all stats in each zone kernel’s:
  - `/proc/meminfo`
  - `/proc/stat`
  - `/proc/net/netstat`
  - `/proc/net/snmp`
  - `/proc/diskstats`
  - `/proc/vmstat`
- Added live eBPF-based memory pressure event tracking and metrics to all zones. See the [daemon configuration](https://docs.edera.dev/reference/configuration/daemon-toml/#metrics) for scrape configuration and the [metrics reference](https://docs.edera.dev/reference/observability/metrics/v1.10.0/) for more details.
- Destroyed zone logs are now retained as tombstones so they remain available for post-mortem inspection.
- The Prometheus `/metrics` endpoint previously hosted by `protect-orchestrator` is now hosted by `protect-daemon`. The default port and endpoint are unchanged, and previously exposed metrics are all still present.

### Tools

- `protect-ctl zone|workload destroy` now supports destroying multiple zones/workloads by selector match, for example `protect-ctl zone destroy --selector status.state=failed`. Currently, `status` is the only supported selector field.
- `protect-ctl zone launch` now supports the `--numa-nodes` and `--numa-strategy` flags.
- Added the `protect-ctl zone suspend` subcommand.
- Added the `protect-ctl zone resume` subcommand.
- Added the `protect-ctl zone fork` subcommand. Note that this command will not function unless the [`fork-v0` feature flag](https://docs.edera.dev/reference/configuration/daemon-toml/#fork-v0) has been enabled.

## Bug Fixes

### Kubernetes

- Fixed an issue where the read-only flag for K8S host mounts was not respected in all cases.
- Fixed an issue where zones were not destroyed as eagerly as they could be when the kubelet invoked `RemovePodSandbox`/`StopPodSandbox`.
- Fixed an issue where the wrong image cache ref could be handed back to the kubelet in some cases, causing pod scheduling to fail.
- Fixed an issue where the Kubernetes SPDY proxy service would not properly restart if `protect-cri` was restarted via systemd.

### Core

- Fixed several IDM deadlocks and throughput bottlenecks under load, including a storm-induced irrecoverable deadlock, bottlenecks that capped packet throughput, and a self-deadlock in stale-stream cleanup, resulting in a 7.5x speedup in IDM throughput.
- Reworked the zone IDM reader to use a per-backend event channel file descriptor with non-blocking polling.
- Fixed Xen event channel issues, including retrying `ioctl`s on `EINTR` and closing a `WakeMap` unbind/subscribe race.
- Raised the `protect-daemon` file descriptor limit to 8192.
- Fixed an issue where Xen physmap population could incorrectly fail in conditions where memory is heavily fragmented.
- Fixed an issue where Edera’s dom0 memory resource monitoring was not accurately calculating the free pool size.
- Fixed an issue where a malformed zone kernel image could cause `protect-daemon` to crash.
- Fixed various OCI image parsing and handling bugs.

### Tools

- Fixed an issue where commands that stream zone/workload stdin would appear to hang until terminal input was received.

## Known Issues

### KVM support

- PCI passthrough is not supported.
- NUMA support is not enabled.
- The Edera DRA driver does not function on KVM nodes.
- KVM zones will not correctly respect custom MTU values set on host links.
- KVM workloads are not resilient across `protect-daemon` restarts/crashes.

## Upgrade notes

There are no known breaking changes in this release from the previous minor or patch release.

Last updated on 2026-07-02