Skip to content

Release 0.82#

2026-10-22 ยท Full Changelog

New mikrotik_chr kind#

Containerlab can now run MikroTik RouterOS CHR from the official mikrotik/chr image with the new mikrotik_chr kind. The image is used as is - no vrnetlab build - and is published for amd64 and arm64, booting with KVM when /dev/kvm is available and falling back to QEMU's TCG emulation otherwise:

topology:
  nodes:
    r1:
      kind: mikrotik_chr
      image: mikrotik/chr:7.24.5
      startup-config: r1.rsc
  links:
    - endpoints: ["r1:ether2", "r2:ether2"]

Management is transparent by default: the node's management address is RouterOS's own ether1 address, so SSH, REST, Winbox, the RouterOS API, SNMP and LLDP all reply directly on the address containerlab assigned, and the IPv4/IPv6 shown in the inspect table are the ones configured in RouterOS. Data interfaces map in order - container ethN is RouterOS ether(N+1) - with the MTU copied from the veth.

To make the original image work with the reach Containerlab's featureset, an embedded launcher script has been added to the original image. This script handles bootstrap over the image's REST API (credentials, identity and startup-config), readiness detection backed by a default healthcheck so wait-for: healthy and stages ordering work, and restarts - containerlab restart, a Docker restart or an in-router reboot - that keep interface names, MACs, configuration and links intact. Custom credentials create the user in the full group and disable the factory admin account, which has a blank password on a fresh CHR disk.

The original mikrotik_ros kind - CHR from an image built with vrnetlab - is untouched, and both kinds share the interface naming and startup-config conventions, so a lab moves between them by changing kind and image.

See the mikrotik_chr kind documentation.

Done in #3498 thanks to @lz-networks

SR-SIM#

Custom startup credentials#

The SR OS startup configuration that containerlab generates for SR-SIM nodes renders the admin user and password from the node credentials key instead of hardcoding admin / NokiaSros1!. For model-driven nodes the generated configuration grants console, gRPC and NETCONF access to that user, and the postdeploy SSH and NETCONF operations use the same credentials. When credentials are not set, the defaults stay unchanged.

Version-aware startup templates#

The model-driven startup template is split by SR OS release. Releases up to 26.3 keep the CCM8 TLS cipher their TLS bootstrap relies on, while SR OS 26.7, later releases and development images - which report version 0.0.0 - use a template without it. The obsolete system grpc md-cli and md-cli-session lines are emitted only for releases up to 25.10. The classic SR, IXR and SAR templates follow the same CCM8 cutoff.

Integrated chassis tweaks#

  • components entries with a type set the NOKIA_SROS_CARD variable and skip the generated card and MDA configuration.
  • Node-level env overrides components: when the same variable is set to different values, the environment variable wins and containerlab logs a warning naming it.
  • ixr-r6 accepts components in both slots A and B, with one container per CPM, making a proper dual-CPIOM node.
  • User component overrides no longer fail the deployment.
  • At deploy time containerlab reads chassis_info.json from the selected SR-SIM image and compares the effective components configuration with the hardware types listed for the chassis. Unsupported slots and card, SFM, XIOM or MDA types produce warnings without stopping the deployment.

Done in #3446, #3488 thanks @sacckth and @kaelemc

Arch Linux support#

The installation script now detects Arch-based systems and its package manager, and installs the containerlab-bin package from the aur package repository. Note, that currently only linux/amd64 variant is available, so on linux/arm64 systems download the package from our github releases.

Miscellaneous#

  • inspect no longer errors on a partially built lab: containers that were not created are skipped, so a lab whose deployment failed midway can still be inspected. #3516
  • destroy --cleanup no longer removes unrelated clab-* directories when a lab has no running containers: the lab directory is resolved deterministically from the topology name, mismatched directories are refused with a warning, and a missing directory is a no-op. #3501
  • TX checksum offload management is reapplied on every start for the cisco_iol and linux kinds. A stop/start cycle recreates the management veth and resets the offload settings to their defaults, which broke TCP/UDP connectivity of IOL nodes. #3510
  • Parked link endpoints survive a failed restore: the parking network namespace is kept on the node - and reused by a subsequent park/restore cycle - so the parked endpoints can be recovered instead of being lost. #3506
  • The c9s runtime stamps every c9s Node object and the stored topology definition with a c9s.run/originalNodeName label holding the node name exactly as the clab file spells it, so tooling that only sees the clab file can select the c9s nodes by their original names even though the cluster objects carry sanitized names. The label key is reserved: a value set for it in the topology file is overwritten on every deploy. #3509