diff --git a/COMPATIBILITY.md b/COMPATIBILITY.md
index 34f842b0a7..f4dbc5c036 100644
--- a/COMPATIBILITY.md
+++ b/COMPATIBILITY.md
@@ -1,15 +1,32 @@
-# Compatibility Contract
-
-The migration preserves established `io.cattle.*` Java packages, Maven coordinates, database schemas and migration IDs, setting keys, API resource and field names, event names, Docker labels, generated client types, and internal service identifiers. These values are persisted or consumed across repositories and are not product branding.
-
+# Compatibility Contract
+
+The migration preserves established `io.cattle.*` Java packages, Maven coordinates, database schemas and migration IDs, setting keys, API resource and field names, event names, Docker labels, generated client types, and internal service identifiers. These values are persisted or consumed across repositories and are not product branding.
+
New operator-facing names use PastureStack and `PASTURESTACK_*`. Compatibility identifiers must be changed only with an explicit data migration, a dual-read or dual-write transition, a rollback plan, and cross-repository verification.
-The `rancher.compose.*` setting keys and inherited executable aliases remain compatibility contracts for existing launchers. Public artifact URLs and container images are hosted under the PastureStack GitHub organization; remove an alias only after its launcher and rollback fixtures accept the replacement name.
-
-## Host API token rollout
-
-The Engine is the issuer for Host API access tokens. Docker socket access carries the exact `scope=dockersocket` claim. Host statistics carry a single formatted `resourceId`; container statistics carry only the Docker identifiers and formatted resource IDs that the caller is allowed to observe. Empty or broader compatibility tokens are not valid.
+## Docker host policy
-Deploy the issuing Engine first, allow tokens issued by the previous Engine to expire, and only then deploy a Host API version that enforces these claims. Rollback follows the reverse compatibility boundary: retain the strict issuer while rolling Host API back, and do not reintroduce empty claims.
+The unreleased candidate adds Docker Engine `29.8.0` as an exact supported
+version alongside the preserved legacy ranges, `24.0.9`, and the existing
+`29.4.1` through `29.7.2` interval. It does not widen the interval to admit
+untested patch versions. `newest.docker.version` is `v29.8.0` so the host UI
+classifies versions above it as untested rather than misreporting them as
+supported.
-Before release, validate clean installation, upgrade from a preserved database, rollback, API and UI behavior, subscriptions, agent events, scheduler, networking, storage, secrets, authentication, catalog, backup and restore, and both supported database engines in isolated VMs.
+Host Docker version classification and host firewall backend selection are
+different contracts. Ubuntu version does not determine whether an operator
+uses `iptables-legacy`, `iptables-nft`, or Docker's native nftables backend.
+Network components must detect the host's actual active backend before
+installing only their owned rules, without switching the host default or
+modifying another backend. Each of those modes needs runtime acceptance on
+the relevant host before this candidate is published as fully supported.
+
+The `rancher.compose.*` setting keys and inherited executable aliases remain compatibility contracts for existing launchers. Public artifact URLs and container images are hosted under the PastureStack GitHub organization; remove an alias only after its launcher and rollback fixtures accept the replacement name.
+
+## Host API token rollout
+
+The Engine is the issuer for Host API access tokens. Docker socket access carries the exact `scope=dockersocket` claim. Host statistics carry a single formatted `resourceId`; container statistics carry only the Docker identifiers and formatted resource IDs that the caller is allowed to observe. Empty or broader compatibility tokens are not valid.
+
+Deploy the issuing Engine first, allow tokens issued by the previous Engine to expire, and only then deploy a Host API version that enforces these claims. Rollback follows the reverse compatibility boundary: retain the strict issuer while rolling Host API back, and do not reintroduce empty claims.
+
+Before release, validate clean installation, upgrade from a preserved database, rollback, API and UI behavior, subscriptions, agent events, scheduler, networking, storage, secrets, authentication, catalog, backup and restore, and both supported database engines in isolated VMs.
diff --git a/README.md b/README.md
index ededce596b..204877f860 100644
--- a/README.md
+++ b/README.md
@@ -8,9 +8,10 @@ PastureStack is an independent community effort to preserve, audit, and moderniz
## Project status
-This source tree and its current public GitHub Release
+The current public GitHub Release
[`v0.183.298`](https://github.com/PastureStack/orchestration-engine/releases/tag/v0.183.298)
-produce engine version `0.183.298`. It retains the existing Java 25, Ubuntu
+produces engine version `0.183.298`. This branch prepares an unreleased
+`0.183.299` Docker host policy candidate. It retains the existing Java 25, Ubuntu
26.04, Maven, Liquibase, MariaDB/MySQL, WebSocket, dependency, concurrency, and
runtime-hardening work from the maintained compatibility line. Release builds
consume the exact `5.7.4` runtime JAR published by
@@ -44,9 +45,9 @@ dependency line. The existing platform JSON surface remains on
`com.fasterxml.jackson` 2.22. Packaging gates admit only the reviewed,
version-pinned pair and verify that their class namespaces are disjoint.
-Host compatibility is evidence-based. The default policy recognizes the preserved legacy ranges, Docker Engine `24.0.9`, and every stable Docker 29 release from `29.4.1` through `29.7.2` inclusive. The bounded Docker 29 interval includes `29.6.2`; Docker 25 through 28 and versions outside that interval remain unsupported.
+Host compatibility is evidence-based. The candidate default policy preserves the legacy ranges and Docker Engine `24.0.9`, retains the bounded `29.4.1` through `29.7.2` interval, and adds exactly `29.8.0`. It does not admit unverified `29.7.3` or `29.8.1`, or Docker 25 through 28. The frontend marks versions above the configured newest version as *untested*, not *supported*. The `29.8.0` policy still requires the separate Ubuntu 26.04 host and firewall-backend runtime acceptance gate before release.
-The build and Dapper images compile the Docker `29.7.2` CLI from the pinned official tag commit with Go `1.27.0`; they do not import Docker's precompiled Go `1.26.5` binary. The source archive SHA-256 and Go builder image digest are enforced by the source gate and the resulting images are scanned before release.
+The build and Dapper images still compile the Docker `29.7.2` CLI from the pinned official tag commit with Go `1.27.0`; the CLI tool version is separate from the Docker daemon host support setting. They do not import Docker's precompiled Go `1.26.5` binary. The source archive SHA-256 and Go builder image digest are enforced by the source gate and the resulting images are scanned before release.
Container and service port changes expose a read-only `portpreflight` project action. The action evaluates persisted workload ownership, eligible-host capacity, requested scheduling constraints, rolling-upgrade overlap, and live Node Agent socket observations before a change is saved. Primary and sidekick bindings retain their own network modes while sharing one physical-host collision check. Managed-network published ports are unique across the environment even when a workload targets one host; bridge and host-network checks remain scoped to an explicitly requested host, and host networking checks the effective container port rather than a misleading published-port remap. Running owners block the applicable scope, stopped owners remain visible as warnings, and incomplete live inspection is reported as unknown rather than available. During a start-first upgrade, unchanged bindings reserve their current hosts without being reported as self-conflicts; changed bindings are checked as new requests, and runtime probes ignore only the exact containers already represented by those persisted reservations. The allocator and final create/upgrade validation repeat the authoritative check so the browser result is never the only enforcement boundary. Project authorization explicitly exposes the action's nested input and read-only result schemas; regression tests load the shipped authorization overlays and verify the network-scope, upgrade-capacity, self-ownership, and runtime-probe contracts.
@@ -92,7 +93,7 @@ The gate performs dependency-hygiene checks, builds every Maven module with JDK
To create the complete release archive after the gate passes:
```sh
-ENGINE_VERSION=0.183.298 bash scripts/build --release
+ENGINE_VERSION=0.183.299 bash scripts/build --release
bash scripts/check-release-artifact dist/artifacts/cattle.jar
```
diff --git a/code/framework/api-pub-sub-jetty/pom.xml b/code/framework/api-pub-sub-jetty/pom.xml
index dd03200af1..b7f0dd7dac 100644
--- a/code/framework/api-pub-sub-jetty/pom.xml
+++ b/code/framework/api-pub-sub-jetty/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.298
+ 0.183.299
../../parent/pom.xml
diff --git a/code/framework/api-pub-sub/pom.xml b/code/framework/api-pub-sub/pom.xml
index 2c8bf68d62..95dcc90f38 100644
--- a/code/framework/api-pub-sub/pom.xml
+++ b/code/framework/api-pub-sub/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.298
+ 0.183.299
../../parent/pom.xml
diff --git a/code/framework/api/pom.xml b/code/framework/api/pom.xml
index 5ec98b7bf6..19d71b2056 100644
--- a/code/framework/api/pom.xml
+++ b/code/framework/api/pom.xml
@@ -4,7 +4,7 @@
cattle-parent
io.cattle
- 0.183.298
+ 0.183.299
../../parent/pom.xml
diff --git a/code/framework/archaius/pom.xml b/code/framework/archaius/pom.xml
index fb8c67ba6a..46b7f4c42a 100644
--- a/code/framework/archaius/pom.xml
+++ b/code/framework/archaius/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-meta-parent
- 0.183.298
+ 0.183.299
../../meta-parent/pom.xml
diff --git a/code/framework/async/pom.xml b/code/framework/async/pom.xml
index 6770f44d8d..96c818b18f 100644
--- a/code/framework/async/pom.xml
+++ b/code/framework/async/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.298
+ 0.183.299
../../parent/pom.xml
diff --git a/code/framework/auditing/pom.xml b/code/framework/auditing/pom.xml
index 154d98cdd1..bfef7b3fcf 100644
--- a/code/framework/auditing/pom.xml
+++ b/code/framework/auditing/pom.xml
@@ -4,7 +4,7 @@
cattle-parent
io.cattle
- 0.183.298
+ 0.183.299
../../parent/pom.xml
diff --git a/code/framework/db-loader/pom.xml b/code/framework/db-loader/pom.xml
index 88d0093694..1146dab5ea 100644
--- a/code/framework/db-loader/pom.xml
+++ b/code/framework/db-loader/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.298
+ 0.183.299
../../parent/pom.xml
diff --git a/code/framework/deferred/pom.xml b/code/framework/deferred/pom.xml
index ef981d248a..74cb0ee899 100644
--- a/code/framework/deferred/pom.xml
+++ b/code/framework/deferred/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.298
+ 0.183.299
../../parent/pom.xml
diff --git a/code/framework/encryption/pom.xml b/code/framework/encryption/pom.xml
index 68579df375..73f96ceeaa 100644
--- a/code/framework/encryption/pom.xml
+++ b/code/framework/encryption/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.298
+ 0.183.299
../../parent/pom.xml
diff --git a/code/framework/engine/pom.xml b/code/framework/engine/pom.xml
index 6d6a5f8e25..d77ebcb149 100644
--- a/code/framework/engine/pom.xml
+++ b/code/framework/engine/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.298
+ 0.183.299
../../parent/pom.xml
diff --git a/code/framework/eventing/pom.xml b/code/framework/eventing/pom.xml
index 1eb5837efe..63428d007b 100644
--- a/code/framework/eventing/pom.xml
+++ b/code/framework/eventing/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.298
+ 0.183.299
../../parent/pom.xml
diff --git a/code/framework/events/pom.xml b/code/framework/events/pom.xml
index 7fbc68f0eb..bab55e66d6 100644
--- a/code/framework/events/pom.xml
+++ b/code/framework/events/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.298
+ 0.183.299
../../parent/pom.xml
diff --git a/code/framework/extension-spring/pom.xml b/code/framework/extension-spring/pom.xml
index c61ce17db5..ab12e547d2 100644
--- a/code/framework/extension-spring/pom.xml
+++ b/code/framework/extension-spring/pom.xml
@@ -4,7 +4,7 @@
cattle-parent
io.cattle
- 0.183.298
+ 0.183.299
../../parent/pom.xml
diff --git a/code/framework/extension/pom.xml b/code/framework/extension/pom.xml
index 2ff1f4cc01..ed63da4459 100644
--- a/code/framework/extension/pom.xml
+++ b/code/framework/extension/pom.xml
@@ -4,7 +4,7 @@
cattle-parent
io.cattle
- 0.183.298
+ 0.183.299
../../parent/pom.xml
diff --git a/code/framework/java-server/pom.xml b/code/framework/java-server/pom.xml
index e8cc0a20e8..c09d8cec83 100644
--- a/code/framework/java-server/pom.xml
+++ b/code/framework/java-server/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.298
+ 0.183.299
../../parent/pom.xml
diff --git a/code/framework/jmx/pom.xml b/code/framework/jmx/pom.xml
index fa060d1600..f4a976399d 100644
--- a/code/framework/jmx/pom.xml
+++ b/code/framework/jmx/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.298
+ 0.183.299
../../parent/pom.xml
diff --git a/code/framework/jooq/pom.xml b/code/framework/jooq/pom.xml
index d222e3f81b..bb58dc7784 100644
--- a/code/framework/jooq/pom.xml
+++ b/code/framework/jooq/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.298
+ 0.183.299
../../parent/pom.xml
diff --git a/code/framework/json/pom.xml b/code/framework/json/pom.xml
index ac67886fd2..62a790e1be 100644
--- a/code/framework/json/pom.xml
+++ b/code/framework/json/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.298
+ 0.183.299
../../parent/pom.xml
diff --git a/code/framework/launcher/pom.xml b/code/framework/launcher/pom.xml
index e42fe92f95..997f2ba342 100644
--- a/code/framework/launcher/pom.xml
+++ b/code/framework/launcher/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.298
+ 0.183.299
../../parent/pom.xml
diff --git a/code/framework/lock/pom.xml b/code/framework/lock/pom.xml
index 43a8139c1e..b85ff9bbce 100644
--- a/code/framework/lock/pom.xml
+++ b/code/framework/lock/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.298
+ 0.183.299
../../parent/pom.xml
diff --git a/code/framework/logback/pom.xml b/code/framework/logback/pom.xml
index edeac0fd37..f0e614047c 100644
--- a/code/framework/logback/pom.xml
+++ b/code/framework/logback/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-meta-parent
- 0.183.298
+ 0.183.299
../../meta-parent/pom.xml
diff --git a/code/framework/managed-context/pom.xml b/code/framework/managed-context/pom.xml
index 8e11b0d64a..d4f03e91c0 100644
--- a/code/framework/managed-context/pom.xml
+++ b/code/framework/managed-context/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.298
+ 0.183.299
../../parent/pom.xml
diff --git a/code/framework/metrics/pom.xml b/code/framework/metrics/pom.xml
index 10a8fa127f..a057ba10b1 100644
--- a/code/framework/metrics/pom.xml
+++ b/code/framework/metrics/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.298
+ 0.183.299
../../parent/pom.xml
diff --git a/code/framework/module/pom.xml b/code/framework/module/pom.xml
index 98f8e3b373..2ddaeaa534 100644
--- a/code/framework/module/pom.xml
+++ b/code/framework/module/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.298
+ 0.183.299
../../parent/pom.xml
diff --git a/code/framework/object/pom.xml b/code/framework/object/pom.xml
index 5c3b95a5a5..c101ed69e2 100644
--- a/code/framework/object/pom.xml
+++ b/code/framework/object/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.298
+ 0.183.299
../../parent/pom.xml
diff --git a/code/framework/pool/pom.xml b/code/framework/pool/pom.xml
index 5a613d7682..660fd543b4 100644
--- a/code/framework/pool/pom.xml
+++ b/code/framework/pool/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.298
+ 0.183.299
../../parent/pom.xml
diff --git a/code/framework/resource-monitor/pom.xml b/code/framework/resource-monitor/pom.xml
index 8150f784c1..487d9d2352 100644
--- a/code/framework/resource-monitor/pom.xml
+++ b/code/framework/resource-monitor/pom.xml
@@ -4,7 +4,7 @@
cattle-parent
io.cattle
- 0.183.298
+ 0.183.299
../../parent/pom.xml
diff --git a/code/framework/schema/pom.xml b/code/framework/schema/pom.xml
index 5169da4336..9d01a4e79b 100644
--- a/code/framework/schema/pom.xml
+++ b/code/framework/schema/pom.xml
@@ -4,7 +4,7 @@
cattle-parent
io.cattle
- 0.183.298
+ 0.183.299
../../parent/pom.xml
diff --git a/code/framework/server/pom.xml b/code/framework/server/pom.xml
index c500cfcf9f..de2c8e21a0 100644
--- a/code/framework/server/pom.xml
+++ b/code/framework/server/pom.xml
@@ -4,7 +4,7 @@
cattle-meta-parent
io.cattle
- 0.183.298
+ 0.183.299
../../meta-parent/pom.xml
diff --git a/code/framework/spring/pom.xml b/code/framework/spring/pom.xml
index 64caaf36aa..288fc44db9 100644
--- a/code/framework/spring/pom.xml
+++ b/code/framework/spring/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.298
+ 0.183.299
../../parent/pom.xml
diff --git a/code/framework/system-task/pom.xml b/code/framework/system-task/pom.xml
index c402971718..8f07206c00 100644
--- a/code/framework/system-task/pom.xml
+++ b/code/framework/system-task/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.298
+ 0.183.299
../../parent/pom.xml
diff --git a/code/framework/token/pom.xml b/code/framework/token/pom.xml
index 37e21cd8c4..5e6fbef658 100644
--- a/code/framework/token/pom.xml
+++ b/code/framework/token/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.298
+ 0.183.299
../../parent/pom.xml
diff --git a/code/framework/utils/pom.xml b/code/framework/utils/pom.xml
index 11061a07ea..bff5d97eee 100644
--- a/code/framework/utils/pom.xml
+++ b/code/framework/utils/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.298
+ 0.183.299
../../parent/pom.xml
diff --git a/code/iaas/agent-instance/pom.xml b/code/iaas/agent-instance/pom.xml
index 0a96665fb3..fb8cee3d75 100644
--- a/code/iaas/agent-instance/pom.xml
+++ b/code/iaas/agent-instance/pom.xml
@@ -4,7 +4,7 @@
cattle-parent
io.cattle
- 0.183.298
+ 0.183.299
../../parent/pom.xml
diff --git a/code/iaas/agent-server/pom.xml b/code/iaas/agent-server/pom.xml
index 0a8db9cd4c..01ab960544 100644
--- a/code/iaas/agent-server/pom.xml
+++ b/code/iaas/agent-server/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.298
+ 0.183.299
../../parent/pom.xml
diff --git a/code/iaas/agent/pom.xml b/code/iaas/agent/pom.xml
index fd7be14053..2ecbdda698 100644
--- a/code/iaas/agent/pom.xml
+++ b/code/iaas/agent/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.298
+ 0.183.299
../../parent/pom.xml
diff --git a/code/iaas/allocator/pom.xml b/code/iaas/allocator/pom.xml
index 68ca9d9a6f..ee5a185a14 100644
--- a/code/iaas/allocator/pom.xml
+++ b/code/iaas/allocator/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.298
+ 0.183.299
../../parent/pom.xml
diff --git a/code/iaas/api-logic/pom.xml b/code/iaas/api-logic/pom.xml
index 024b62e84e..42d909d7d1 100644
--- a/code/iaas/api-logic/pom.xml
+++ b/code/iaas/api-logic/pom.xml
@@ -4,7 +4,7 @@
cattle-parent
io.cattle
- 0.183.298
+ 0.183.299
../../parent/pom.xml
diff --git a/code/iaas/archaius-management/pom.xml b/code/iaas/archaius-management/pom.xml
index 96bb1e306e..15ab2394ef 100644
--- a/code/iaas/archaius-management/pom.xml
+++ b/code/iaas/archaius-management/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.298
+ 0.183.299
../../parent/pom.xml
diff --git a/code/iaas/auth-logic/pom.xml b/code/iaas/auth-logic/pom.xml
index 7ea8a58738..6182b322fb 100644
--- a/code/iaas/auth-logic/pom.xml
+++ b/code/iaas/auth-logic/pom.xml
@@ -4,7 +4,7 @@
cattle-parent
io.cattle
- 0.183.298
+ 0.183.299
../../parent/pom.xml
diff --git a/code/iaas/bootstrap/pom.xml b/code/iaas/bootstrap/pom.xml
index 430467cac2..2c483fe09a 100644
--- a/code/iaas/bootstrap/pom.xml
+++ b/code/iaas/bootstrap/pom.xml
@@ -4,7 +4,7 @@
cattle-parent
io.cattle
- 0.183.298
+ 0.183.299
../../parent/pom.xml
diff --git a/code/iaas/config-item/api/pom.xml b/code/iaas/config-item/api/pom.xml
index 6b8e10bbaa..60aa68c9e0 100644
--- a/code/iaas/config-item/api/pom.xml
+++ b/code/iaas/config-item/api/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.298
+ 0.183.299
../../../parent/pom.xml
diff --git a/code/iaas/config-item/common/pom.xml b/code/iaas/config-item/common/pom.xml
index a8912b2a09..61fb41e4f5 100644
--- a/code/iaas/config-item/common/pom.xml
+++ b/code/iaas/config-item/common/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.298
+ 0.183.299
../../../parent/pom.xml
diff --git a/code/iaas/config-item/server/pom.xml b/code/iaas/config-item/server/pom.xml
index 5ad61d2482..f863f5eac6 100644
--- a/code/iaas/config-item/server/pom.xml
+++ b/code/iaas/config-item/server/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.298
+ 0.183.299
../../../parent/pom.xml
diff --git a/code/iaas/engine-jooq/pom.xml b/code/iaas/engine-jooq/pom.xml
index 1843cab228..46fca95c4a 100644
--- a/code/iaas/engine-jooq/pom.xml
+++ b/code/iaas/engine-jooq/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.298
+ 0.183.299
../../parent/pom.xml
diff --git a/code/iaas/events/pom.xml b/code/iaas/events/pom.xml
index 5a902cfaca..63a8d6bf9e 100644
--- a/code/iaas/events/pom.xml
+++ b/code/iaas/events/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.298
+ 0.183.299
../../parent/pom.xml
diff --git a/code/iaas/external-handler/pom.xml b/code/iaas/external-handler/pom.xml
index 3204b19265..871acae5de 100644
--- a/code/iaas/external-handler/pom.xml
+++ b/code/iaas/external-handler/pom.xml
@@ -4,7 +4,7 @@
cattle-parent
io.cattle
- 0.183.298
+ 0.183.299
../../parent/pom.xml
diff --git a/code/iaas/ha/pom.xml b/code/iaas/ha/pom.xml
index 925f669021..f3cc67aaf9 100644
--- a/code/iaas/ha/pom.xml
+++ b/code/iaas/ha/pom.xml
@@ -4,7 +4,7 @@
cattle-parent
io.cattle
- 0.183.298
+ 0.183.299
../../parent/pom.xml
diff --git a/code/iaas/healthcheck/pom.xml b/code/iaas/healthcheck/pom.xml
index 8c55d23c4e..3f1aa348e3 100644
--- a/code/iaas/healthcheck/pom.xml
+++ b/code/iaas/healthcheck/pom.xml
@@ -4,7 +4,7 @@
cattle-parent
io.cattle
- 0.183.298
+ 0.183.299
../../parent/pom.xml
diff --git a/code/iaas/labels/pom.xml b/code/iaas/labels/pom.xml
index a47fdd3594..b9a3ebe3f2 100644
--- a/code/iaas/labels/pom.xml
+++ b/code/iaas/labels/pom.xml
@@ -4,7 +4,7 @@
cattle-parent
io.cattle
- 0.183.298
+ 0.183.299
../../parent/pom.xml
diff --git a/code/iaas/logic-common/pom.xml b/code/iaas/logic-common/pom.xml
index db7cf55154..0f8ed09608 100644
--- a/code/iaas/logic-common/pom.xml
+++ b/code/iaas/logic-common/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.298
+ 0.183.299
../../parent/pom.xml
diff --git a/code/iaas/logic/pom.xml b/code/iaas/logic/pom.xml
index 8aaabc44ae..c683fa94d4 100644
--- a/code/iaas/logic/pom.xml
+++ b/code/iaas/logic/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.298
+ 0.183.299
../../parent/pom.xml
diff --git a/code/iaas/metadata/pom.xml b/code/iaas/metadata/pom.xml
index 0a2bc8d67f..6b8bcf07b2 100644
--- a/code/iaas/metadata/pom.xml
+++ b/code/iaas/metadata/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.298
+ 0.183.299
../../parent/pom.xml
diff --git a/code/iaas/model/pom.xml b/code/iaas/model/pom.xml
index 7c5b9395bc..ed2df6015c 100644
--- a/code/iaas/model/pom.xml
+++ b/code/iaas/model/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.298
+ 0.183.299
../../parent/pom.xml
diff --git a/code/iaas/resource-pool/pom.xml b/code/iaas/resource-pool/pom.xml
index 824150820f..bce612502c 100644
--- a/code/iaas/resource-pool/pom.xml
+++ b/code/iaas/resource-pool/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.298
+ 0.183.299
../../parent/pom.xml
diff --git a/code/iaas/service-discovery/api/pom.xml b/code/iaas/service-discovery/api/pom.xml
index 3a88ad83b9..9f44013d79 100644
--- a/code/iaas/service-discovery/api/pom.xml
+++ b/code/iaas/service-discovery/api/pom.xml
@@ -4,7 +4,7 @@
cattle-parent
io.cattle
- 0.183.298
+ 0.183.299
../../../parent/pom.xml
diff --git a/code/iaas/service-discovery/server/pom.xml b/code/iaas/service-discovery/server/pom.xml
index 4507d432e6..67a355b984 100644
--- a/code/iaas/service-discovery/server/pom.xml
+++ b/code/iaas/service-discovery/server/pom.xml
@@ -4,7 +4,7 @@
cattle-parent
io.cattle
- 0.183.298
+ 0.183.299
../../../parent/pom.xml
diff --git a/code/iaas/ssh-common/pom.xml b/code/iaas/ssh-common/pom.xml
index f5781f8c09..0731cfb24a 100644
--- a/code/iaas/ssh-common/pom.xml
+++ b/code/iaas/ssh-common/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.298
+ 0.183.299
../../parent/pom.xml
diff --git a/code/iaas/storage-service/pom.xml b/code/iaas/storage-service/pom.xml
index 3d89c24717..667f08a5b0 100644
--- a/code/iaas/storage-service/pom.xml
+++ b/code/iaas/storage-service/pom.xml
@@ -4,7 +4,7 @@
cattle-parent
io.cattle
- 0.183.298
+ 0.183.299
../../parent/pom.xml
diff --git a/code/iaas/task-jooq/pom.xml b/code/iaas/task-jooq/pom.xml
index be6e170850..a6059cb9bd 100644
--- a/code/iaas/task-jooq/pom.xml
+++ b/code/iaas/task-jooq/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.298
+ 0.183.299
../../parent/pom.xml
diff --git a/code/implementation/activity-log/pom.xml b/code/implementation/activity-log/pom.xml
index 121432bdb0..528e190935 100644
--- a/code/implementation/activity-log/pom.xml
+++ b/code/implementation/activity-log/pom.xml
@@ -5,7 +5,7 @@
io.cattle
cattle-parent
- 0.183.298
+ 0.183.299
../../parent/pom.xml
diff --git a/code/implementation/agent-instance-impl/pom.xml b/code/implementation/agent-instance-impl/pom.xml
index 5b4faa3a64..27845f380e 100644
--- a/code/implementation/agent-instance-impl/pom.xml
+++ b/code/implementation/agent-instance-impl/pom.xml
@@ -3,7 +3,7 @@
cattle-parent
io.cattle
- 0.183.298
+ 0.183.299
../../parent/pom.xml
cattle-agent-instance-impl
diff --git a/code/implementation/docker/api/pom.xml b/code/implementation/docker/api/pom.xml
index a199a02d27..04f22c5bed 100644
--- a/code/implementation/docker/api/pom.xml
+++ b/code/implementation/docker/api/pom.xml
@@ -5,7 +5,7 @@
io.cattle
cattle-parent
- 0.183.298
+ 0.183.299
../../../parent/pom.xml
diff --git a/code/implementation/docker/common/pom.xml b/code/implementation/docker/common/pom.xml
index 9406d55297..484c6f135c 100644
--- a/code/implementation/docker/common/pom.xml
+++ b/code/implementation/docker/common/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.298
+ 0.183.299
../../../parent/pom.xml
diff --git a/code/implementation/docker/compute/pom.xml b/code/implementation/docker/compute/pom.xml
index cc948911cd..65354100e9 100644
--- a/code/implementation/docker/compute/pom.xml
+++ b/code/implementation/docker/compute/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.298
+ 0.183.299
../../../parent/pom.xml
diff --git a/code/implementation/docker/machine/pom.xml b/code/implementation/docker/machine/pom.xml
index d2fe6c40e2..3768b5ecb9 100644
--- a/code/implementation/docker/machine/pom.xml
+++ b/code/implementation/docker/machine/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.298
+ 0.183.299
../../../parent/pom.xml
diff --git a/code/implementation/docker/storage/pom.xml b/code/implementation/docker/storage/pom.xml
index 8cea0651f9..9b47507e47 100644
--- a/code/implementation/docker/storage/pom.xml
+++ b/code/implementation/docker/storage/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.298
+ 0.183.299
../../../parent/pom.xml
@@ -21,12 +21,12 @@
io.cattle
cattle-docker-common
- 0.183.298
+ 0.183.299
io.cattle
cattle-iaas-allocator
- 0.183.298
+ 0.183.299
diff --git a/code/implementation/extension-api/pom.xml b/code/implementation/extension-api/pom.xml
index 1e178878a8..77c97ac7b4 100644
--- a/code/implementation/extension-api/pom.xml
+++ b/code/implementation/extension-api/pom.xml
@@ -3,7 +3,7 @@
cattle-parent
io.cattle
- 0.183.298
+ 0.183.299
../../parent/pom.xml
cattle-extension-api
diff --git a/code/implementation/hazelcast/common/pom.xml b/code/implementation/hazelcast/common/pom.xml
index 31203d49a8..867e183b71 100644
--- a/code/implementation/hazelcast/common/pom.xml
+++ b/code/implementation/hazelcast/common/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.298
+ 0.183.299
../../../parent/pom.xml
diff --git a/code/implementation/hazelcast/eventing/pom.xml b/code/implementation/hazelcast/eventing/pom.xml
index b6392cf93c..a9a1e1afeb 100644
--- a/code/implementation/hazelcast/eventing/pom.xml
+++ b/code/implementation/hazelcast/eventing/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.298
+ 0.183.299
../../../parent/pom.xml
diff --git a/code/implementation/hazelcast/lock/pom.xml b/code/implementation/hazelcast/lock/pom.xml
index abd71daa1b..dd27d29de0 100644
--- a/code/implementation/hazelcast/lock/pom.xml
+++ b/code/implementation/hazelcast/lock/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.298
+ 0.183.299
../../../parent/pom.xml
diff --git a/code/implementation/host-api/pom.xml b/code/implementation/host-api/pom.xml
index 97b73c456d..a0a5cebaac 100644
--- a/code/implementation/host-api/pom.xml
+++ b/code/implementation/host-api/pom.xml
@@ -5,7 +5,7 @@
io.cattle
cattle-parent
- 0.183.298
+ 0.183.299
../../parent/pom.xml
diff --git a/code/implementation/host-stats/pom.xml b/code/implementation/host-stats/pom.xml
index 7f0010e021..2bfc30106f 100644
--- a/code/implementation/host-stats/pom.xml
+++ b/code/implementation/host-stats/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.298
+ 0.183.299
../../parent/pom.xml
diff --git a/code/implementation/register/pom.xml b/code/implementation/register/pom.xml
index 5db6598de0..7428bdde9b 100644
--- a/code/implementation/register/pom.xml
+++ b/code/implementation/register/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.298
+ 0.183.299
../../parent/pom.xml
diff --git a/code/implementation/sample-setup/pom.xml b/code/implementation/sample-setup/pom.xml
index 7318a1c8b8..2ebaea35b1 100644
--- a/code/implementation/sample-setup/pom.xml
+++ b/code/implementation/sample-setup/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.298
+ 0.183.299
../../parent/pom.xml
diff --git a/code/implementation/settings-api/pom.xml b/code/implementation/settings-api/pom.xml
index 8f7eabdb5a..45c7500af9 100644
--- a/code/implementation/settings-api/pom.xml
+++ b/code/implementation/settings-api/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.298
+ 0.183.299
../../parent/pom.xml
diff --git a/code/implementation/simulator/agent-connection/pom.xml b/code/implementation/simulator/agent-connection/pom.xml
index 6397f3c9a8..d978196476 100644
--- a/code/implementation/simulator/agent-connection/pom.xml
+++ b/code/implementation/simulator/agent-connection/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.298
+ 0.183.299
../../../parent/pom.xml
diff --git a/code/implementation/simulator/storage/pom.xml b/code/implementation/simulator/storage/pom.xml
index 97d7b15e76..02ff5bd17a 100644
--- a/code/implementation/simulator/storage/pom.xml
+++ b/code/implementation/simulator/storage/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.298
+ 0.183.299
../../../parent/pom.xml
diff --git a/code/implementation/system-stack/pom.xml b/code/implementation/system-stack/pom.xml
index f8e5f0eefc..eaf8ee7ef2 100644
--- a/code/implementation/system-stack/pom.xml
+++ b/code/implementation/system-stack/pom.xml
@@ -5,7 +5,7 @@
io.cattle
cattle-parent
- 0.183.298
+ 0.183.299
../../parent/pom.xml
diff --git a/code/implementation/vm/pom.xml b/code/implementation/vm/pom.xml
index 1b863918ae..4ad8939b16 100644
--- a/code/implementation/vm/pom.xml
+++ b/code/implementation/vm/pom.xml
@@ -3,7 +3,7 @@
cattle-parent
io.cattle
- 0.183.298
+ 0.183.299
../../parent/pom.xml
cattle-vm
diff --git a/code/meta-parent/pom.xml b/code/meta-parent/pom.xml
index 34e6b53c69..afb5024c4e 100644
--- a/code/meta-parent/pom.xml
+++ b/code/meta-parent/pom.xml
@@ -9,7 +9,7 @@
4.0.0
io.cattle
cattle-meta-parent
- 0.183.298
+ 0.183.299
pom
PastureStack Orchestration Engine
Compatibility orchestration engine for the PastureStack server.
diff --git a/code/packaging/app-config/pom.xml b/code/packaging/app-config/pom.xml
index 4bbe86a441..20194a9fb3 100644
--- a/code/packaging/app-config/pom.xml
+++ b/code/packaging/app-config/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.298
+ 0.183.299
../../parent/pom.xml
jar
diff --git a/code/packaging/app-config/src/main/resources/META-INF/cattle/api-server/defaults.properties b/code/packaging/app-config/src/main/resources/META-INF/cattle/api-server/defaults.properties
index 21cfba7c6f..f59c11da2f 100644
--- a/code/packaging/app-config/src/main/resources/META-INF/cattle/api-server/defaults.properties
+++ b/code/packaging/app-config/src/main/resources/META-INF/cattle/api-server/defaults.properties
@@ -104,7 +104,7 @@ ui.show.system=default_hide
ui.show.custom.host=true
engine.install.url=https://artifacts.invalid/rc16/install-docker/19.03.sh
account.version=2
-supported.docker.range=~v1.12.3 || ~v1.13.0 || ~v17.03.0 || ~v17.06.0 || ~v17.09.0 || ~v17.12.0 || ~v18.03.0 || ~v18.06.0 || ~v18.09.0 || ~v19.03.2 || v24.0.9 || >=v29.4.1 <=v29.7.2
-newest.docker.version=v29.7.2
+supported.docker.range=~v1.12.3 || ~v1.13.0 || ~v17.03.0 || ~v17.06.0 || ~v17.09.0 || ~v17.12.0 || ~v18.03.0 || ~v18.06.0 || ~v18.09.0 || ~v19.03.2 || v24.0.9 || >=v29.4.1 <=v29.7.2 || v29.8.0
+newest.docker.version=v29.8.0
api.auth.shibboleth.redirect.whitelist=
ipsec.service.enable.healthcheck=false
diff --git a/code/packaging/app/pom.xml b/code/packaging/app/pom.xml
index 8b52a65ee7..53d203f36b 100644
--- a/code/packaging/app/pom.xml
+++ b/code/packaging/app/pom.xml
@@ -4,7 +4,7 @@
cattle-parent
io.cattle
- 0.183.298
+ 0.183.299
../../parent/pom.xml
war
diff --git a/code/packaging/bundle/pom.xml b/code/packaging/bundle/pom.xml
index 871688201e..5a9e40f604 100644
--- a/code/packaging/bundle/pom.xml
+++ b/code/packaging/bundle/pom.xml
@@ -4,7 +4,7 @@
cattle-parent
io.cattle
- 0.183.298
+ 0.183.299
../../parent/pom.xml
diff --git a/code/packaging/dev/pom.xml b/code/packaging/dev/pom.xml
index 85a043c00b..7c4ae6451c 100644
--- a/code/packaging/dev/pom.xml
+++ b/code/packaging/dev/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.298
+ 0.183.299
../../parent/pom.xml
diff --git a/code/packaging/meta/pom.xml b/code/packaging/meta/pom.xml
index 8ae747c460..449cd61350 100644
--- a/code/packaging/meta/pom.xml
+++ b/code/packaging/meta/pom.xml
@@ -4,7 +4,7 @@
cattle-parent
io.cattle
- 0.183.298
+ 0.183.299
../../parent/pom.xml
diff --git a/code/parent/pom.xml b/code/parent/pom.xml
index f41ee701db..46ec49a9be 100644
--- a/code/parent/pom.xml
+++ b/code/parent/pom.xml
@@ -5,7 +5,7 @@
io.cattle
cattle-meta-parent
../meta-parent/pom.xml
- 0.183.298
+ 0.183.299
pom
diff --git a/docs/releases/orchestration-engine-0.183.299.md b/docs/releases/orchestration-engine-0.183.299.md
new file mode 100644
index 0000000000..f1bd4665ad
--- /dev/null
+++ b/docs/releases/orchestration-engine-0.183.299.md
@@ -0,0 +1,18 @@
+# Orchestration Engine 0.183.299 candidate (unreleased)
+
+- Preserve the established Docker host ranges and add only Engine `29.8.0` as
+ an exact match. Set `newest.docker.version` to `v29.8.0`; later versions remain
+ untested, not implicitly supported.
+- Keep the pinned build-container Docker CLI at `29.7.2`. Its version is not
+ the host daemon compatibility policy.
+- Check the 11 relevant boundary and host-status cases, and verify both
+ settings inside the packaged `cattle-app-config` JAR. The Server must embed
+ this new `0.183.299` JAR, not reuse `0.183.298` with documentation changes.
+
+Release remains pending actual Ubuntu 26.04 / Docker 29.8.0 acceptance with
+each installed firewall backend mode (`iptables-legacy`, `iptables-nft`, or
+native nftables), plus preserved older-host compatibility. Backend detection
+must use host state, not Ubuntu version; no test may silently switch a host's
+default firewall backend. After the runtime gate passes, the release workflow
+must build, test, scan, publish the versioned JAR, and record its SHA-256 for
+the Server pin and release evidence.
diff --git a/pom.xml b/pom.xml
index b8cbe640d0..b180536e07 100644
--- a/pom.xml
+++ b/pom.xml
@@ -3,7 +3,7 @@
io.cattle
cattle-parent
- 0.183.298
+ 0.183.299
code/parent/pom.xml
cattle
diff --git a/resources/pom.xml b/resources/pom.xml
index 5ba0289e3d..dd41dfb5d7 100644
--- a/resources/pom.xml
+++ b/resources/pom.xml
@@ -4,7 +4,7 @@
cattle-parent
io.cattle
- 0.183.298
+ 0.183.299
../code/parent/pom.xml
diff --git a/scripts/build b/scripts/build
index 151cd7d3b2..cd6ee1cc2f 100755
--- a/scripts/build
+++ b/scripts/build
@@ -16,7 +16,7 @@ fi
SOURCE_REVISION=${SOURCE_REVISION:-$(git rev-parse HEAD)}
SOURCE_DATE_EPOCH=${SOURCE_DATE_EPOCH:-$(git show -s --format=%ct HEAD)}
-ENGINE_VERSION=${ENGINE_VERSION:-0.183.298}
+ENGINE_VERSION=${ENGINE_VERSION:-0.183.299}
case "$SOURCE_REVISION" in
''|*[!0-9a-f]*)
diff --git a/scripts/check-docker-host-support b/scripts/check-docker-host-support
index 09780d7c1a..1f6b4c1728 100755
--- a/scripts/check-docker-host-support
+++ b/scripts/check-docker-host-support
@@ -17,10 +17,10 @@ require_line()
}
defaults=code/packaging/app-config/src/main/resources/META-INF/cattle/api-server/defaults.properties
-supported='supported.docker.range=~v1.12.3 || ~v1.13.0 || ~v17.03.0 || ~v17.06.0 || ~v17.09.0 || ~v17.12.0 || ~v18.03.0 || ~v18.06.0 || ~v18.09.0 || ~v19.03.2 || v24.0.9 || >=v29.4.1 <=v29.7.2'
+supported='supported.docker.range=~v1.12.3 || ~v1.13.0 || ~v17.03.0 || ~v17.06.0 || ~v17.09.0 || ~v17.12.0 || ~v18.03.0 || ~v18.06.0 || ~v18.09.0 || ~v19.03.2 || v24.0.9 || >=v29.4.1 <=v29.7.2 || v29.8.0'
require_line "$defaults" "$supported"
-require_line "$defaults" 'newest.docker.version=v29.7.2'
+require_line "$defaults" 'newest.docker.version=v29.8.0'
require_line Makefile 'DOCKER_VERSION ?= 29.7.2'
require_line Dockerfile 'ARG DOCKER_VERSION=29.7.2'
require_line Dockerfile.dapper 'ARG DOCKER_VERSION=29.7.2'
@@ -39,4 +39,74 @@ if grep -Eq 'supported\.docker\.range=.*(v29\.4\.1 \|\| v29\.7\.2|~v29|v2[5-8]\.
fail incorrect_modern_range
fi
-printf 'DOCKER_HOST_SUPPORT_GATE_OK newest=29.7.2 exact_legacy_modern=24.0.9 docker_29_range=29.4.1..29.7.2 docker_29_6_2=supported broad_25_to_28=0\n'
+if python3 --version >/dev/null 2>&1; then
+ python_command=python3
+elif python --version >/dev/null 2>&1; then
+ python_command=python
+else
+ fail python_required_for_classification_test
+fi
+
+"$python_command" - "$defaults" <<'PY'
+from pathlib import Path
+import re
+import sys
+
+properties = {}
+for line in Path(sys.argv[1]).read_text(encoding="utf-8").splitlines():
+ if "=" in line and not line.lstrip().startswith("#"):
+ key, value = line.split("=", 1)
+ properties[key] = value.strip()
+
+clauses = [part.strip() for part in properties["supported.docker.range"].split("||")]
+newest = properties["newest.docker.version"]
+version_pattern = re.compile(r"v?(\d+)\.(\d+)\.(\d+)$")
+
+def version(value):
+ match = version_pattern.fullmatch(value)
+ if match is None:
+ raise ValueError(f"invalid test version: {value}")
+ return tuple(int(part) for part in match.groups())
+
+def permitted(candidate):
+ parsed = version(candidate)
+ for clause in clauses:
+ if clause.startswith("~"):
+ # These preserved legacy clauses are frozen by the exact-line gate.
+ continue
+ if clause.startswith(">="):
+ match = re.fullmatch(r">=(v\d+\.\d+\.\d+) <=(v\d+\.\d+\.\d+)", clause)
+ if match is None:
+ raise ValueError(f"unrecognized Docker interval: {clause}")
+ if version(match[1]) <= parsed <= version(match[2]):
+ return True
+ elif parsed == version(clause):
+ return True
+ return False
+
+def host_state(candidate):
+ if permitted(candidate):
+ return "supported"
+ return "untested" if version(candidate) > version(newest) else "unsupported"
+
+expected = {
+ "v24.0.9": "supported",
+ "v25.0.0": "unsupported",
+ "v28.9.9": "unsupported",
+ "v29.4.0": "unsupported",
+ "v29.4.1": "supported",
+ "v29.6.2": "supported",
+ "v29.7.2": "supported",
+ "v29.7.3": "unsupported",
+ "v29.8.0": "supported",
+ "v29.8.1": "untested",
+ "v30.0.0": "untested",
+}
+for candidate, state in expected.items():
+ actual = host_state(candidate)
+ if actual != state:
+ raise SystemExit(f"DOCKER_HOST_CLASSIFICATION_MISMATCH version={candidate} expected={state} actual={actual}")
+print(f"DOCKER_HOST_CLASSIFICATION_OK cases={len(expected)}")
+PY
+
+printf 'DOCKER_HOST_SUPPORT_GATE_OK newest=29.8.0 exact_legacy_modern=24.0.9 docker_29_range=29.4.1..29.7.2 docker_29_8_0=exact broad_25_to_28=0\n'
diff --git a/scripts/check-pasturestack-source b/scripts/check-pasturestack-source
index 0b32111480..8ed723a95a 100755
--- a/scripts/check-pasturestack-source
+++ b/scripts/check-pasturestack-source
@@ -41,7 +41,7 @@ fi
project_version=$(sed -n 's/^[[:space:]]*\([^<]*\)<\/version>[[:space:]]*$/\1/p' code/meta-parent/pom.xml | head -n 1)
[[ "$project_version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] || fail non_numeric_project_version
-require_line code/meta-parent/pom.xml ' 0.183.298'
+require_line code/meta-parent/pom.xml ' 0.183.299'
require_line code/meta-parent/pom.xml ' https://github.com/PastureStack/orchestration-engine'
require_line Dockerfile 'FROM ubuntu:26.04@sha256:2260313b31c8c011cd2eebe728008efac1b3982be73eb71348ea2648d2c0e09b'
require_line Dockerfile.dapper 'FROM ubuntu:26.04@sha256:2260313b31c8c011cd2eebe728008efac1b3982be73eb71348ea2648d2c0e09b'
@@ -94,8 +94,8 @@ require_line Dockerfile.dapper 'COPY --from=docker-cli-build /go/src/github.com/
if grep -Fq 'download.docker.com/linux/static/stable' Dockerfile Dockerfile.dapper; then
fail vulnerable_prebuilt_docker_cli
fi
-require_line code/packaging/app-config/src/main/resources/META-INF/cattle/api-server/defaults.properties 'supported.docker.range=~v1.12.3 || ~v1.13.0 || ~v17.03.0 || ~v17.06.0 || ~v17.09.0 || ~v17.12.0 || ~v18.03.0 || ~v18.06.0 || ~v18.09.0 || ~v19.03.2 || v24.0.9 || >=v29.4.1 <=v29.7.2'
-require_line code/packaging/app-config/src/main/resources/META-INF/cattle/api-server/defaults.properties 'newest.docker.version=v29.7.2'
+require_line code/packaging/app-config/src/main/resources/META-INF/cattle/api-server/defaults.properties 'supported.docker.range=~v1.12.3 || ~v1.13.0 || ~v17.03.0 || ~v17.06.0 || ~v17.09.0 || ~v17.12.0 || ~v18.03.0 || ~v18.06.0 || ~v18.09.0 || ~v19.03.2 || v24.0.9 || >=v29.4.1 <=v29.7.2 || v29.8.0'
+require_line code/packaging/app-config/src/main/resources/META-INF/cattle/api-server/defaults.properties 'newest.docker.version=v29.8.0'
require_line code/meta-parent/pom.xml ' 2.22.2'
require_line code/meta-parent/pom.xml ' 5.7.4'
require_line code/meta-parent/pom.xml ' 12.1.12'
@@ -318,4 +318,4 @@ fi
require_line README.md 'PastureStack is an independent community effort to preserve, audit, and modernize the Rancher 1.6 ecosystem. It is not affiliated with or endorsed by Rancher Labs or SUSE.'
require_line ORIGIN.md '- Preserved upstream boundary: `82d154a53f4089fecfb9f320caad826bb4f6055f`'
-printf 'PASTURESTACK_SOURCE_GATE_OK version=0.183.298 runtime_sources=github_release images=digest_pinned ubuntu=26.04 ubuntu_snapshot=20260826T000000Z jdk=25.0.4 maven=3.9.16 patched_hazelcast=5.7.4 docker=29.7.2 credential_secret_capacity=mediumtext port_preflight=authoritative volume_preflight=runtime_resolution_aligned volume_preflight_project_schema=authorized volume_preflight_type_set=registered v1_hardware_schema=container-and-launchConfig\n'
+printf 'PASTURESTACK_SOURCE_GATE_OK version=0.183.299 runtime_sources=github_release images=digest_pinned ubuntu=26.04 ubuntu_snapshot=20260826T000000Z jdk=25.0.4 maven=3.9.16 patched_hazelcast=5.7.4 docker_cli=29.7.2 docker_host_29_8_0=exact credential_secret_capacity=mediumtext port_preflight=authoritative volume_preflight=runtime_resolution_aligned volume_preflight_project_schema=authorized volume_preflight_type_set=registered v1_hardware_schema=container-and-launchConfig\n'
diff --git a/scripts/check-release-artifact b/scripts/check-release-artifact
index b10129d2ef..e06427f0b8 100755
--- a/scripts/check-release-artifact
+++ b/scripts/check-release-artifact
@@ -4,7 +4,7 @@ set -euo pipefail
cd "$(dirname "$0")/.."
artifact=${1:-dist/artifacts/cattle.jar}
-expected_version=${EXPECTED_ENGINE_VERSION:-0.183.298}
+expected_version=${EXPECTED_ENGINE_VERSION:-0.183.299}
test -f "$artifact"
artifact=$(realpath "$artifact")
@@ -86,6 +86,13 @@ tr -d '\r' <"$workdir/META-INF/MANIFEST.MF" | grep -Fx "Implementation-Version:
tr -d '\r' <"$workdir/META-INF/maven/io.cattle/cattle-app/pom.properties" \
| grep -Fx "version=${expected_version}" >/dev/null
+app_config_defaults=$(unzip -p "$workdir/$app_config_entry" \
+ META-INF/cattle/api-server/defaults.properties | tr -d '\r')
+printf '%s\n' "$app_config_defaults" | grep -Fx \
+ 'supported.docker.range=~v1.12.3 || ~v1.13.0 || ~v17.03.0 || ~v17.06.0 || ~v17.09.0 || ~v17.12.0 || ~v18.03.0 || ~v18.06.0 || ~v18.09.0 || ~v19.03.2 || v24.0.9 || >=v29.4.1 <=v29.7.2 || v29.8.0' >/dev/null
+printf '%s\n' "$app_config_defaults" | grep -Fx \
+ 'newest.docker.version=v29.8.0' >/dev/null
+
for class_name in \
io/cattle/platform/iaas/api/auth/identity/AuthIdentityLink.class \
io/cattle/platform/iaas/api/auth/identity/AuthIdentityOperation.class \
@@ -311,5 +318,5 @@ for schema_type in \
grep -aF "$schema_type" >/dev/null
done
-printf 'ENGINE_RELEASE_ARTIFACT_OK artifact=%s version=%s webapp=1 resources=1 auth_logic=1 app_config=1 api_logic=1 model=1 port_preflight=authoritative volume_preflight=authoritative volume_preflight_project_schema=authorized volume_preflight_type_set=registered nfs_contract=environment-multiHostRW-complete-coverage identity_security_v1_schemas=1 v1_hardware_schema=container-and-launchConfig frozen_mfa_policy_schema=1 mfa_account_holder_boundary=1 mfa_attempt_transactions=requires-new-read-and-write recovery_email_enrollment_schema=1 credential_secret_capacity=mediumtext launcher=1\n' \
+printf 'ENGINE_RELEASE_ARTIFACT_OK artifact=%s version=%s webapp=1 resources=1 auth_logic=1 app_config=1 api_logic=1 model=1 docker_host_29_8_0=exact port_preflight=authoritative volume_preflight=authoritative volume_preflight_project_schema=authorized volume_preflight_type_set=registered nfs_contract=environment-multiHostRW-complete-coverage identity_security_v1_schemas=1 v1_hardware_schema=container-and-launchConfig frozen_mfa_policy_schema=1 mfa_account_holder_boundary=1 mfa_attempt_transactions=requires-new-read-and-write recovery_email_enrollment_schema=1 credential_secret_capacity=mediumtext launcher=1\n' \
"$artifact" "$expected_version"