# v0.4.4

## Fixes

- **Fix Landlock making $HOME tmpfs read-only** — Inside the sandbox `$HOME` is a tmpfs. Landlock's `/` read-only rule was preventing tools (mise, gem, etc.) from creating directories under `$HOME`. Added `$HOME` as read-write in Landlock normal mode. bwrap's ro-bind mounts for individual dotdirs still prevent writes to those.

- **Fix DNS resolution inside sandbox on WSL** (PR #3, @fevitta) — On WSL systems using systemd-resolved, `/etc/resolv.conf` is a symlink pointing into `/run/`, which is mounted as an empty tmpfs. The fix detects the symlink, copies the resolved content to a temp file, and mounts it at the symlink target path so DNS works inside the sandbox.
