Ofelia v0.27.1 - Run Job Container Cleanup

Ofelia v0.27.1 was published on July 27, 2026. This patch fixes container cleanup for type=run jobs created through the web UI or API, preventing a successful first execution from turning every later schedule into a Docker resource conflict.

The full release notes and downloads are on the GitHub release page.

Ofelia had two different construction paths for the same job type. Jobs decoded from config.ini received the delete default, while jobs created through the API did not. Jobs restored from the state file after a daemon restart also bypassed that default.

The difference was operationally expensive. A run job completed, but its container remained visible in docker ps -a. At the next scheduled execution, Docker rejected the reused name with job run: creating container: create container "<name>": resource conflict. A daily ETL task therefore ran once and then failed once per day until someone removed the stale container.

PR 745 applies the same default to the API and state restoration paths. The fix aligns job behavior rather than adding another configuration branch. That is the right boundary for a patch release: one job definition should not acquire different lifecycle semantics because it entered the scheduler through a different interface.

The release moves the Go toolchain from 1.26.4 to 1.26.5. This clears GO-2026-5856, an Encrypted Client Hello privacy leak in crypto/tls. The affected path was reachable through the Docker client TLS dialer, so this update is relevant even when Ofelia only talks to a remote Docker daemon.

The module refresh also moves docker/cli from 29.5.3 to 29.6.2 and golang.org/x/crypto from 0.53.0 to 0.54.0. PR 744 and PR 746 contain that maintenance work.

This is not a clean vulnerability report. Advisories in docker/docker still appear in govulncheck because the v28 line has no available fix. The project tracks those findings in issue 667. Operators get the reachable TLS fix in this release, but should retain the remaining Docker findings in their exception and review process.

The published container tags are ghcr.io/netresearch/ofelia:0.27.1, ghcr.io/netresearch/ofelia:0.27, and ghcr.io/netresearch/ofelia:0. Each downloadable asset has a Sigstore bundle, while checksums.txt has its own signed bundle for manifest verification.

Build provenance needs one detail that is easy to miss. A reusable workflow signs these releases, so gh attestation verify requires the workflow identity in --signer-workflow. Omitting that option makes verification fail even when the artifact is valid.

gh attestation verify <artifact> \
  --repo netresearch/ofelia \
  --signer-workflow netresearch/.github/.github/workflows/release-go-app.yml

Container consumers can verify both the Cosign signature and the OCI attestation. Pinning 0.27.1 makes the selected release explicit; the 0.27 and 0 tags remain available for environments that intentionally follow a moving version line.

Ofelia v0.27.1 is backward compatible and requires no configuration change. Before the next scheduled run, inspect docker ps -a and remove containers left by affected jobs with docker rm <name>. The patch corrects cleanup behavior for subsequent executions, including jobs restored from the state file.