$ the-wire · showcase
Arch kernel v7.2.3-arch1 ships with new userns sysctl
By RepoJournal · Filed · About Arch Linux
The Arch Linux kernel v7.2.3-arch1 adds a sysctl option to disable unprivileged user namespaces, while package updates land for ImageMagick, Sundials, and a rewrite of the Hyprland wayland stack.
The Arch Linux kernel v7.2.3-arch1 applies on top of stable v7.2.3 and includes a single Arch-specific change: "add sysctl to allow disabling unprivileged CLONE_NEWUSER" [1]. This kernel exposes a sysctl to disable unprivileged user namespaces, giving administrators a straightforward way to lock down a common container-escape surface. Users with hardened kernels or containerized services may want to review this option and decide whether to enable it. Upgrade to the new kernel before your next reboot to get the change.
Across the extra repository, ImageMagick updated to 7.1.2.31-1 [2] and Sundials (the SUNDIALS suite of nonlinear and differential/algebraic equation solvers) moved to 7.9.0-1 [3], both routine upstream maintenance. pixi, a package manager and workflow tool written in Rust, updated to 0.79.0-1 [4]. These are standard package updates, each aligning Arch with current upstream releases.
In the wayland ecosystem, the Hyprland compositor updated to 0.56.2-3 in extra-testing [5], paired with aquamarine 0.15.0-2 in extra [6]. aquamarine serves as the low-level rendering and DRM backend underlying the next Hyprland generation, so this pair signals the compositor is closing in on a stable release. Users on the testing track should exercise their multi-monitor and hardware-acceleration setups, while stable users can track this as an indication of what is landing next.
In infrastructure, the Arch Linux Matrix homeserver upgraded Synapse to 1.160.0 [7], the latest server release. Separately, the signstar project (which secures package signing) added logging to its `signstar-configure-build` command [8], improving observability for builders.
Action items
- → Upgrade to the v7.2.3-arch1 kernel before your next reboot to get the CLONE_NEWUSER sysctl. archlinux/linux [plan]
- → Test against Hyprland 0.56.2-3 and aquamarine 0.15.0-2 on the extra-testing track if you run the compositor. archlinux/state [monitor]
- → Update ImageMagick, Sundials, and pixi packages from extra when convenient. archlinux/state [plan]
- → Review your unprivileged user namespace policy after the sysctl lands in the default kernel. archlinux/linux [monitor]
References
- [1] Arch Linux kernel v7.2.3-arch1 ↗ archlinux/linux
- [2] update imagemagick to 7.1.2.31-1 in extra-x86_64 ↗ archlinux/state
- [3] update sundials to 7.9.0-1 in extra-x86_64 ↗ archlinux/state
- [4] update pixi to 0.79.0-1 in extra-x86_64 ↗ archlinux/state
- [5] update hyprland to 0.56.2-3 in extra-testing-x86_64 ↗ archlinux/state
- [6] update aquamarine to 0.15.0-2 in extra-x86_64 ↗ archlinux/state
- [7] matrix: Update synapse to 1.160.0 ↗ archlinux/infrastructure
- [8] feat: Add logging to `signstar-configure-build` ↗ archlinux/signstar