# mvirt 0.14.10 migrations: no wire: unchanged rev: 5dd309e8e9604f51c464419b670c7c222314714c v0.14.10 — /tmp is disk, and the host firewall is one nftables table A container's /tmp was an unsized tmpfs, so the kernel default applied: half the pod-VM's memory. A 512 MiB pod handed its container a ~256 MiB RAM-backed /tmp, and a workload that wrote there OOM'd the pod while the 8 GiB scratch disk sat unused. /tmp is now a plain directory on the container's own writable root — the same filesystem as /, on the pod's disk — which is what Docker, containerd and kubelet do; an image that ships its own /tmp keeps it untouched, and /dev/shm stays a real tmpfs. Writes to /tmp now count against the pod's ephemeral disk instead of its memory, which is the point (#200). The host firewall is now rendered whole from the module as one nftables table `inet mvirt` on every node, replacing the NixOS firewall: input policy drop admitting by interface role, forward policy drop admitting exactly the north-south paths the border creates, and no reverse-path filter — strict contradicts the ADR-0067 relay and loose is vacuous on a host with a default route, which is what dropped every relayed packet on 2026-08-18. mvirt-ebpf level-sets the dynamic pool and GRE-peer sets from the same pass that programs the routes (ADR-0083). Also: every TLS terminator logs one structured line per completed handshake — version, cipher, key-exchange group, and whether it is the ML-KEM hybrid — under the `mvirt_tls` target, so the PQ story is observable rather than asserted; and `/v1/nodes` no longer renders half of all raft ids negative (#196). ## Upgrading Point your flake's `mvirt` input at this release and redeploy the control-plane host first, then each node in turn: ``` nix run .#colmena -- apply boot --reboot --on nix run .#colmena -- apply boot --reboot --on # one at a time ``` This release adds no migrations, so the control-plane host rolls back the same way a node does: boot the previous NixOS generation.