<div class="container">
<h1>Recommended update for az-cli-cmd, aws-cli-cmd, flake-pilot</h1>
<table class="table table-striped table-bordered">
<tbody>
<tr>
<th>Announcement ID:</th>
<td>SUSE-RU-2026:24714-1</td>
</tr>
<tr>
<th>Release Date:</th>
<td>2026-11-05T14:07:59Z</td>
</tr>
<tr>
<th>Rating:</th>
<td>important</td>
</tr>
<tr>
<th>References:</th>
<td>
<ul>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1274855">bsc#1274855</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1277029">bsc#1277029</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1282900">bsc#1282900</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1285040">bsc#1285040</a>
</li>
</ul>
</td>
</tr>
<tr>
<th>Affected Products:</th>
<td>
<ul class="list-group">
<li class="list-group-item">SUSE Linux Enterprise Server 16.1</li>
<li class="list-group-item">SUSE Linux Enterprise Server for SAP Applications 16.1</li>
</ul>
</td>
</tr>
</tbody>
</table>
<p>An update that has four fixes can now be installed.</p>
<h2>Description:</h2>
<p>This update for az-cli-cmd, aws-cli-cmd, flake-pilot fixes the following issues:</p>
<p>Changes in az-cli-cmd:</p>
<ul>
<li>Allow to skip missing host volume sharing paths (bsc#1274855)</li>
</ul>
<p>Changes in aws-cli-cmd:</p>
<ul>
<li>
<p>Allow to skip missing host volume sharing paths (bsc#1274855)
Changes in flake-pilot:</p>
</li>
<li>
<p>Fix: aws and az do not work on the immutable flavor (bsc#1282900)</p>
</li>
<li>Update to version 3.2.10:<ul>
<li>Make sure bubblewrap holds no host mounts</li>
</ul>
</li>
<li>Update to version 3.2.9:<ul>
<li>Differentiate stderr and stdout channels</li>
<li>Fix EOF wait in firecracker-pilot</li>
<li>Fix handling of resume and force_vsock options</li>
<li>Fix race condition</li>
<li>Fix firecracker exit code handling</li>
<li>Fix bwrap lookup in bubblewrwap-pilot</li>
<li>Use the which crate to lookup a binary in PATH</li>
</ul>
</li>
<li>Update to version 3.2.8:<ul>
<li>No color output by default
flake-pilot no longer prints color by default.
This change affects the messages as well as any progress information.
Applied the change on the documentation side as well. (bsc#1285040)</li>
</ul>
</li>
<li>Update to version 3.2.7:<ul>
<li>Update user guide:
Fix gcloud example</li>
</ul>
</li>
<li>Update to version 3.2.6:<ul>
<li>Update user guide:
Refactor the section how to build your own app images</li>
<li>Update user guide:
reference Leap16 variant of claude image in the examples</li>
<li>Fix package name in claude image</li>
</ul>
</li>
<li>Update to version 3.2.5:<ul>
<li>Update claude image:
Add backports repo which provides poetry</li>
<li>Allow to configure tmpfs size in bwrap sandbox</li>
<li>Detect and report squatted private meta data dirs</li>
<li>Add poetry to firecracker claude image</li>
</ul>
</li>
<li>Update to version 3.2.4:<ul>
<li>Allow install as documented</li>
<li>Refactor bubblewrap overlay and write area</li>
</ul>
</li>
<li>Do not unconditionally pull newer or prune
podman-pilot no longer asks the registry for a newer image
or prunes images on every launch. Both are now opt-in pilot
options, %pull_newer and %prune_images. They can be set in
a registration's pilot_options or given at call time,
like the existing options.</li>
<li>Update to version 3.2.3:<ul>
<li>Fix indentation</li>
<li>Do not call systemfiles script as root</li>
<li>Document FLAKE_LOG_STYLE environment variable in user guide</li>
</ul>
</li>
<li>Refactor running privileged applications</li>
<li>Update to version 3.2.2:<ul>
<li>Volume export/release guest address from state</li>
<li>Close DHCP port on the host for VMs</li>
<li>Close DNS port on the host for VMs</li>
<li>Add locking to the firecracker network state file</li>
<li>Load kvm module in sci if present</li>
<li>sci accepted commands from any vsock peer</li>
<li>Add kiwi to claude firecracker image</li>
<li>Validate given names and paths in flake-ctl</li>
<li>Update documentation:
Clearly state isolation limits</li>
</ul>
</li>
<li>Update to version 3.2.1:<ul>
<li>Delete OSS scanner metadata</li>
<li>Refactor firecracker networking per security scan</li>
</ul>
</li>
<li>Update to version 3.2.0:<ul>
<li>Fix bubblewrap documentation and code comments</li>
<li>Drop sci injection</li>
<li>Drop include feature from flake-pilot.</li>
<li>Update troubleshooting section</li>
<li>Create the metadata directory in init</li>
<li>Get rid of some sudo restrictions</li>
<li>Add privileges documentation chapter</li>
<li>Use absolute paths for every sudo target</li>
</ul>
</li>
<li>Update to version 3.1.79:<ul>
<li>Use sysctl to enable IP forwarding</li>
<li>Export NFS volumes strictly to one app</li>
<li>Update firecracker appstore images:
drop insecure settings with regards to sudo and ssh</li>
<li>Drop runas registration option</li>
</ul>
</li>
<li>Update to version 3.1.78:<ul>
<li>Sign up for Anthropics OSS scanner</li>
<li>Leap16 requires NetworkManager</li>
<li>Move claude firecracker image to Leap16</li>
<li>Cleanup unused code</li>
</ul>
</li>
<li>Update to version 3.1.77:<ul>
<li>Add support for direct OCI export</li>
<li>Fix spec file</li>
</ul>
</li>
<li>Update to version 3.1.76:<ul>
<li>Switch hardcoded paths in spec to macros</li>
<li>Add /etc/flakes/APP.d drop-in directory</li>
<li>Add license statement for the logo</li>
<li>Add a logo to the project</li>
</ul>
</li>
<li>Update to version 3.1.75:<ul>
<li>Add app store URLs to user guide</li>
</ul>
</li>
<li>Update to version 3.1.74:<ul>
<li>Add missing %post for tmpfiles</li>
</ul>
</li>
<li>Update to version 3.1.73:<ul>
<li>Fix Makefile</li>
</ul>
</li>
<li>Update to version 3.1.72:<ul>
<li>Move system wide flake podman storage to var</li>
<li>Drop rootless_storage_path from config</li>
<li>Update state file handling</li>
</ul>
</li>
<li>Update to version 3.1.71:<ul>
<li>Improve write performance onoverlay</li>
<li>Update to latest version of pi for deepseek</li>
<li>Fix sudoers setup for firecracker images</li>
<li>Add deepseek(pi) firecracker image</li>
</ul>
</li>
<li>Update to version 3.1.70:<ul>
<li>Auto select outgoing interface</li>
<li>Check if storage path really exists</li>
<li>Drop the garbage collector from firecracker-pilot</li>
<li>Make sure firecracker-pilot gets HOME from userdb</li>
<li>Allow firecracker show on config without include</li>
<li>Fix size constraints</li>
<li>Add storage information to firecracker show</li>
</ul>
</li>
<li>Update to version 3.1.69:<ul>
<li>Fix setup of resolver link</li>
</ul>
</li>
<li>Update to version 3.1.68:<ul>
<li>firecracker-pilot should not delete storage</li>
<li>remount / to make it visible in the overlay</li>
<li>Leap16 uses NetworkManager</li>
<li>immediately write journal</li>
<li>Make sure overlay write mount is visible to /</li>
<li>fix overlay storage handling</li>
</ul>
</li>
<li>Update to version 3.1.67:<ul>
<li>Move to leap16 in the examples</li>
<li>Update claude firecracker app</li>
<li>Move firecracker images to ext4</li>
<li>Switch firecracker storage to ext4</li>
</ul>
</li>
<li>Update to version 3.1.66:<ul>
<li>Update main page:
Add information on the main page to be more use case focused</li>
<li>Add sanity check for NFS server</li>
</ul>
</li>
<li>Update to version 3.1.65:<ul>
<li>Deduplicate podman code between pilot and ctl tool</li>
<li>Add new command flake-ctl podman reset</li>
<li>Move leap firecracker image to Leap 16</li>
</ul>
</li>
<li>Update to version 3.1.64:<ul>
<li>Update documentation:
Add url to the flake store on s3, cloudfront</li>
</ul>
</li>
<li>Update to version 3.1.63:<ul>
<li>Use mount call with full path</li>
<li>Fix overlay dir creation for bubblewrap pilot</li>
</ul>
</li>
<li>Update to version 3.1.62:<ul>
<li>Fix overlay-src sorting in bubblewrap-pilot</li>
<li>bubblewrap pilot should create user overlay</li>
<li>Add sanity check for firecracker iptables rules</li>
</ul>
</li>
<li>Update to version 3.1.61:<ul>
<li>Update appstore URL:
Now serving from cloudfront (https)</li>
<li>Make sure to set a User-Agent</li>
</ul>
</li>
<li>Update to version 3.1.60:<ul>
<li>Update appstore URL:
Now serving from an S3 bucket and not from git LFS</li>
<li>Remove LFS</li>
</ul>
</li>
<li>Update to version 3.1.59:<ul>
<li>Check if the pilot template exists</li>
<li>Refactor registration file reading/writing</li>
<li>Add new pilot named bubblewrap-pilot</li>
<li>Refactor podman appstore:
Add build category and a simple push script to automate
building and push to an AWS ECR</li>
</ul>
</li>
<li>Update to version 3.1.58:<ul>
<li>Add flake-ctl firecracker/podman remove checks</li>
<li>Add tap device sanity check</li>
</ul>
</li>
<li>Update to version 3.1.57:<ul>
<li>Update appstore:
Add openssl-devel to claude system</li>
<li>Add network and volume info to firecracker show</li>
<li>Adapt boxbuild options to kiwi v11</li>
<li>pull newer kiwi container</li>
<li>Update appstore:
Added some useful software to the claude image</li>
</ul>
</li>
<li>Update to version 3.1.56:<ul>
<li>Update architecture diagram</li>
<li>Update appstore:
Install latest version of claude</li>
</ul>
</li>
<li>Update to version 3.1.55:<ul>
<li>Add troubleshooting section regarding users</li>
<li>Add troubleshooting section for firewalld</li>
</ul>
</li>
<li>Update to version 3.1.54:<ul>
<li>Dynamically select private network</li>
</ul>
</li>
<li>Update to version 3.1.53:<ul>
<li>Fix overlay root (/) permission settings</li>
<li>Drop use of pivot_root</li>
<li>Fix default firecracker setup at registration time</li>
<li>Update appstore:
Add an ai user to the claude image</li>
<li>Add handler for terminal resize over vsock</li>
<li>Update completion</li>
</ul>
</li>
<li>Update to version 3.1.52:<ul>
<li>Fix flake-pilot-firecracker-guestvm-tools spec</li>
<li>Add doc chapter about firecracker volumes</li>
<li>Implement firecracker NFS volume add/remove</li>
<li>Implement firecracker NFS volume handling</li>
<li>Add support for NFS mounts in sci</li>
</ul>
</li>
<li>Update to version 3.1.51:<ul>
<li>Fix UDS socket setup</li>
<li>Fix firecracker network setup</li>
<li>Update appstore:
Make sure nfs-client exists in the firecracker images</li>
</ul>
</li>
<li>Update to version 3.1.50:<ul>
<li>Fix evaluation of %ignore_missing_volume_path</li>
<li>Add new pilot_options section to the flake config (bsc#1274855)</li>
</ul>
</li>
<li>Update to version 3.1.49:<ul>
<li>Fixed Makefile:
ghpages target missing the setup</li>
</ul>
</li>
<li>Update to version 3.1.48:<ul>
<li>Fix bumpversion config</li>
<li>Refactor documentation:
Create a user guide rather than a README</li>
<li>Fix CWE-59 / Privilege Escalation issues (bsc#1277029)</li>
</ul>
</li>
<li>Update to version 3.1.47:<ul>
<li>Fix --no-net firecracker registrations</li>
<li>Do not store network.yaml meta file in flakes dir</li>
<li>Update README:
Rewrite networking chapter for firecracker</li>
<li>Delete unused documentation diagrams</li>
<li>Add flake-ctl firecracker network remove</li>
<li>Add flake-ctl firecracker network add</li>
<li>Add flake-ctl firecracker network init</li>
<li>Update README:
Fix information about user vs. system wide flakes</li>
<li>Add support for Per-instance boot_args</li>
<li>Fix tap device setup</li>
</ul>
</li>
<li>Update to version 3.1.46:<ul>
<li>Drop --user flag</li>
</ul>
</li>
</ul>
<h2>Patch Instructions:</h2>
<p>
To install this SUSE update use the SUSE recommended
installation methods like YaST online_update or "zypper patch".<br/>
Alternatively you can run the command listed for your product:
</p>
<ul class="list-group">
<li class="list-group-item">
SUSE Linux Enterprise Server 16.1
<br/>
<code>zypper in -t patch SUSE-SLES-16.1-26</code>
</li>
<li class="list-group-item">
SUSE Linux Enterprise Server for SAP Applications 16.1
<br/>
<code>zypper in -t patch SUSE-SLES-16.1-26</code>
</li>
</ul>
<h2>Package List:</h2>
<ul>
<li>
SUSE Linux Enterprise Server 16.1 (aarch64 ppc64le s390x x86_64)
<ul>
<li>flake-pilot-podman-3.2.10-160100.1.1</li>
<li>flake-pilot-3.2.10-160100.1.1</li>
</ul>
</li>
<li>
SUSE Linux Enterprise Server 16.1 (noarch)
<ul>
<li>aws-cli-cmd-1.36.2-160100.4.1</li>
<li>az-cli-cmd-1.37.1-160100.4.1</li>
</ul>
</li>
<li>
SUSE Linux Enterprise Server for SAP Applications 16.1 (noarch)
<ul>
<li>aws-cli-cmd-1.36.2-160100.4.1</li>
<li>az-cli-cmd-1.37.1-160100.4.1</li>
</ul>
</li>
<li>
SUSE Linux Enterprise Server for SAP Applications 16.1 (ppc64le x86_64)
<ul>
<li>flake-pilot-podman-3.2.10-160100.1.1</li>
<li>flake-pilot-3.2.10-160100.1.1</li>
</ul>
</li>
</ul>
<h2>References:</h2>
<ul>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1274855">https://bugzilla.suse.com/show_bug.cgi?id=1274855</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1277029">https://bugzilla.suse.com/show_bug.cgi?id=1277029</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1282900">https://bugzilla.suse.com/show_bug.cgi?id=1282900</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1285040">https://bugzilla.suse.com/show_bug.cgi?id=1285040</a>
</li>
</ul>
</div>