openstack/ironic-python-agent — Week of 2026-08-08

Container steps hardening. The bulk of the week — roughly ten changes and well over 1,200 lines — reworked the container-based step machinery. The allowlist is now actually enforced (998375), transport prefixes are stripped before matching allowed containers, and registry TLS is verified by default. Container steps can no longer shadow existing built-in steps, priorities are only honored during cleaning, and the runtime is checked for presence before use. Errors reading the container steps file are now surfaced instead of swallowed, whitespace-separated container options are accepted, and container_clean_step was renamed to the more accurate generic_container_step. The unused container_conf_file option was dropped.

Security. Alongside the allowlist enforcement fix, NTP command handling received a security fix that tightened how those commands are constructed and invoked.

Maintenance. A .gitreview update opened the bugfix/12.0 branch for backports.