# Release 0.78

:material-calendar: 2026-08-08 · :material-list-status: [Full Changelog](https://github.com/srl-labs/containerlab/releases)

## Deploy convergence

[`deploy`](../cmd/deploy.md) now acts like `apply` and converges a running lab to the desired state. When the lab is already deployed, containerlab compares the desired topology with the live runtime and applies only the supported delta: add or remove nodes and links, start stopped nodes, and recreate individual nodes when tracked configuration drift is detected.

Repeated `deploy` calls against an unchanged topology are idempotent. `apply` is now an alias of `deploy`; both commands accept the same flags and behave identically. Use `--dry-run` to preview planned changes and [`redeploy`](../cmd/redeploy.md) when you need a full destroy-and-recreate cycle.

In other words, you may find yourself not using `deploy --cleanup` or `deploy -c` or `redeploy` commands anymore, and using `deploy` instead for lab's lifecycle management.

Thanks @FloSch62 @kaelemc #3274 #3260

## Nokia SR-SIM and `veth-stitch` links

Links connected to the `nokia_srsim` nodes will now default to the new `veth-stitch` link type when the brief link notation is used. The new [`veth-stitch`](../manual/topo-def-file.md#veth-stitch) link type inserts a transparent tc stitch between two veth segments so traffic can be captured and impaired on links that SR-SIM dataplane interfaces cannot expose directly.

```yaml
links:
  # this link will use the new `veth-stitch` link type automatically
  # because it is connected to the `nokia_srsim` node
  - endpoints: ["srsim:1/1/c1/1", "srl:e1-1"]
```

> You can still set `type: veth-stitch` explicitly on any link that needs the same behavior.

Thanks @kaelemc #3270

## Topology validation

The new [`validate`](../cmd/validate.md) command parses a topology file and runs the schema, node, and link checks as `deploy` without touching the runtime. Use it locally or in CI to catch topology errors before deployment.

```bash
containerlab validate -t mylab.clab.yml
```

Thanks @kaelemc #3266

## Ciena SAOS 10

The new [`ciena_saos`](../manual/kinds/ciena_saos.md) kind adds support for Ciena SAOS 10.x routers as vrnetlab-backed QEMU VMs.

```yaml
topology:
  nodes:
    sw1:
      kind: ciena_saos
      image: vrnetlab/ciena_saos:10-12-00-0228
      type: "5164"
```

Thanks @jgroom33 #3262

## PLVision Enterprise SONiC

The new [`plvision_sonic`](../manual/kinds/plvision_sonic.md) kind adds PLVision's Enterprise SONiC Linux Distribution as a vrnetlab-backed VM node. Build a containerlab-compatible image from the vendor qcow2 with [vrnetlab](https://github.com/srl-labs/vrnetlab) and wire dataplane ports as `ethN` interfaces.

```yaml
topology:
  nodes:
    sonic1:
      kind: plvision_sonic
      image: vrnetlab/plvision_sonic:lite_1_13_202405
```

Thanks @romantymoshchuk #3288

## Container runtime options

Topology node definitions can now contain additional container runtime settings for Docker and Podman:

- [`privileged`](../manual/nodes.md#privileged) — run unprivileged containers when a kind does not require elevated privileges
- [`cgroupns-mode`](../manual/nodes.md#cgroupns-mode) — `host` or `private` cgroup namespace
- [`pid-mode`](../manual/nodes.md#pid-mode) — PID namespace mode, including `container:<node>` references resolved to lab container names
- [`tmpfs`](../manual/nodes.md#tmpfs) — tmpfs mounts keyed by container path
- [`security-opts`](../manual/nodes.md#security-opts) — security options such as `seccomp=unconfined`

```yaml
topology:
  nodes:
    svc1:
      kind: linux
      image: alpine:3
      privileged: false
      cgroupns-mode: host
      pid-mode: host
      tmpfs:
        /run: rw,nosuid
      security-opts:
        - seccomp=unconfined
```

Thanks @orrious #3302

## Miscellaneous

- SR Linux adds `ixr-h6` (7220 IXR-H6) platform support. Thanks @sacckth #3258
- SR-SIM 26.7+ now accepts ED25519 SSH keys during key injection. Thanks @vista- #3286
- `sonic-vm` nodes receive injected SSH keys over scrapligo SSH instead of a bind-mounted `authorized_keys` file. Thanks @steiler #3269
- Multi-bind nodes no longer spuriously recreate during deploy/apply reconciliation because bind mount ordering is deterministic. Thanks @FloSch62 #3300
- Node health and exit wait loops now honor context cancellation. Thanks @mvanhorn #3257
- Post-install instructions for adding a user to the `docker` group were clarified. Thanks @skoll43 #3297
- The structured [`components`](../manual/kinds/vr-sros.md#components) syntax that SR-SIM introduced in 0.75 now also works with Nokia SR OS vSIM (`nokia_sros`). Thanks @kaelemc #3240

## Patches

### 0.78.1

- Fixed reconciliation of host bridge links during repeated `deploy`/`apply`, including stale endpoint ownership and link remapping. #3314
- Fixed saved RouterOS configurations incorrectly dropping IP addresses from `ether10` and higher interfaces when removing the management `ether1` entry. #3313
- Allowed external CA certificate and key environment variables to be used without certificate authority settings in the topology. #3316
- Updated Ciena SAOS documentation for brand compliance and distributed image tags. #3310

### 0.78.2

- Improved `veth-stitch` and `vxlan-stitch` deployment reliability by retrying transient netlink errors and ensuring stitch rules are applied after both endpoints are ready. #3319
- Updated [`events`](../cmd/events.md) to report host-side stitch interfaces and their metadata, matching `inspect interfaces` for stitched links. #3319
