Issues

• A TAP interface with no guest_mac is matched by name, which fails in Cloud Hypervisor guests

  area/cloud-hypervisorkind/bug
  liquidmetal-dev/flintlock#1285 · Filter by author richardcase opened on Oct 5, 2026

• MicroVMs with a TAP interface and no guest_mac can come up with the same guest MAC

  kind/bug
  liquidmetal-dev/flintlock#1284 · Filter by author richardcase opened on Oct 5, 2026

• CreateMicroVM accepts a guest_mac equal to the metadata interface's MAC, and the VMM then fails to start

  kind/bug
  liquidmetal-dev/flintlock#1283 · Filter by author richardcase opened on Oct 5, 2026
  1

  

• Enforce read-only virtiofs volumes

  area/cloud-hypervisorkind/feature
  liquidmetal-dev/flintlock#1275 · Filter by author richardcase opened on Sep 29, 2026

• e2e: follow-ups to the checks that a guest has booted

  area/testingkind/test
  liquidmetal-dev/flintlock#1267 · Filter by author richardcase opened on Sep 28, 2026

• A delete is lost when it comes while the MicroVM is created

  kind/bug
  liquidmetal-dev/flintlock#1266 · Filter by author richardcase opened on Sep 28, 2026

• A MicroVM is CREATED when its VMM has exited

  kind/bug
  liquidmetal-dev/flintlock#1263 · Filter by author richardcase opened on Sep 27, 2026
  1

• The Firecracker kernel images do not boot with Firecracker v1.16

  kind/bug
  liquidmetal-dev/flintlock#1262 · Filter by author richardcase opened on Sep 27, 2026
  1

• The provider of a MicroVM is not in the API responses

  kind/bug
  liquidmetal-dev/flintlock#1261 · Filter by author richardcase opened on Sep 27, 2026

• Lint the e2e code in CI

  area/build-and-releasearea/testinggood first issuehelp wantedkind/chore
  liquidmetal-dev/flintlock#1259 · Filter by author richardcase opened on Sep 27, 2026

• Move the generated containerd config to version 3

  kind/improvement
  liquidmetal-dev/flintlock#1257 · Filter by author richardcase opened on Sep 27, 2026

• e2e teardown removes all of /etc/containerd

  area/testingkind/bug
  liquidmetal-dev/flintlock#1256 · Filter by author richardcase opened on Sep 27, 2026

• Harden VMID construction now that it is identity-bearing

  area/securitykind/improvement
  liquidmetal-dev/flintlock#1246 · Filter by author richardcase opened on Sep 23, 2026

• Hot-reload the authorization policy without a restart

  area/securitykind/feature
  liquidmetal-dev/flintlock#1245 · Filter by author richardcase opened on Sep 23, 2026

• ADR: issuing SPIFFE SVIDs to guest microVMs

  adr-requiredarea/securitykind/proposal
  liquidmetal-dev/flintlock#1244 · Filter by author richardcase opened on Sep 23, 2026

• Hyphenated flags cannot be set via their FLINTLOCKD_* env var

  area/clikind/bug
  liquidmetal-dev/flintlock#1243 · Filter by author richardcase opened on Sep 23, 2026

• Deprecate the HTTP/JSON gateway and rely on gRPC only

  adr-requiredarea/apikind/cleanupkind/proposal
  liquidmetal-dev/flintlock#1241 · Filter by author richardcase opened on Sep 23, 2026

• Update downstream clients (battery, brigade, fl, hammertime) for the identity model

  area/apiarea/securitykind/feature
  liquidmetal-dev/flintlock#1240 · Filter by author richardcase opened on Sep 23, 2026

• Document TLS, mTLS and identity configuration

  help wantedkind/documentation
  liquidmetal-dev/flintlock#1239 · Filter by author richardcase opened on Sep 23, 2026

• Authentication hardening: constant-time token compare, unenforced client CA, unconditional reflection

  area/securitykind/bug
  liquidmetal-dev/flintlock#1238 · Filter by author richardcase opened on Sep 23, 2026

• HTTP gateway bypasses TLS and authentication

  area/securitykind/bugpriority/critical-urgent
  liquidmetal-dev/flintlock#1237 · Filter by author richardcase opened on Sep 23, 2026
  1

• Issue SPIFFE SVIDs to guest microVMs via the metadata path

  area/securitykind/feature
  liquidmetal-dev/flintlock#1236 · Filter by author richardcase opened on Sep 23, 2026

• Hot-reload credentials and support the SPIFFE Workload API as a source

  area/securitykind/feature
  liquidmetal-dev/flintlock#1235 · Filter by author richardcase opened on Sep 23, 2026

• Client-side identity: verify the server's SPIFFE ID and add client auth helpers

  area/apikind/feature
  liquidmetal-dev/flintlock#1234 · Filter by author richardcase opened on Sep 23, 2026

• Authorize requests by principal via a pluggable policy engine

  area/apiarea/securitykind/feature
  liquidmetal-dev/flintlock#1233 · Filter by author richardcase opened on Sep 23, 2026