One fix in the registry set of the Lo (kind) driver, in Go and bash (#261). A short network error during the image pull no longer stops the command, and the error line names the real cause. The release binaries are built with Go 1.26.9 and golang.org/x/net v0.60.0 for nine Go security advisories (see Security). No new command, no new field.

Fixes

• The registry image is pulled before use, with retries. Before, lo let docker container create and docker run pull a missing registry image (registry:2.8.3) implicitly. A transient network error during that implicit image pull stopped the command at the registry set, with no retry. Now, before lo creates a container of the registry set, it runs docker image inspect. When the image is not local, lo runs docker pull first. This applies to each registry container and to the temporary container that reads and writes the registry TLS certificate, so to every command that creates one of them, for example lo up, lo provision, lo registry up, lo registry tls status and lo registry tls renew.
  • A failed pull is tried again after 2 s, 5 s and 10 s (4 attempts). Each failed attempt before the last prints one line: [warn] docker pull registry:2.8.3 failed (attempt 1 of 4): <cause>. Retrying in 2s. When the last attempt fails, lo prints error: docker pull registry:2.8.3 failed after 4 attempts: <cause> and stops. A network error that lasts longer than the retries still stops the command.
  • lo checks the image once per run. After a failed pull series, the other registries fail at once. They do not wait through the retries again.
  • The pull runs before lo removes an old registry container. When the configuration of a running registry changed and the pull fails, the running registry stays up.
• The error line names the real cause. On the implicit pull, docker prints the notice "Unable to find image … locally" first and the pull error after it. Before, the error line of the TLS certificate container showed only the first line, which is the notice. Now one summary of the docker error output goes into the <cause> of the pull lines and into four error lines: the registry start, and the docker volume create, docker cp and docker container create steps of the TLS certificate. lo removes the empty lines, the notice and docker's --help hint, then keeps the last three lines, joined with |. It masks the user:password@ part of a URL (for example a proxy URL) as ***@.

Security

• Go 1.26.9 and golang.org/x/net v0.60.0 (#263). The release builds every binary (lo, lo-full, kustomize-secret and lochat, the lo chat engine) with Go 1.26.9. lo and lo-full use golang.org/x/net v0.60.0. These versions fix nine Go advisories in net/http (HTTP/1 and HTTP/2), crypto/tls, net/textproto and mime/multipart: GO-2026-6603, GO-2026-6605, GO-2026-6607, GO-2026-6608, GO-2026-6610, GO-2026-6611, GO-2026-6612, GO-2026-6613 and GO-2026-6617. govulncheck found them reachable in lo, lo-full and lochat. The operator image (operator/Dockerfile) also builds lo with Go 1.26.9.

Upgrade

• None required.
• A project with its own bash tree in .lok8s/ (lo assets eject bash) runs that tree for a command that lok8s.yaml routes to bash. Run lo assets update bash to get the bash twin of the fix.

Commits

• 7d1c0ee fix(lo): pull the registry image with a retry and report the real cause (#261)
• 47aa0a9 chore(go): build with Go 1.26.9 and golang.org/x/net v0.60.0 (#263)