Workshop 0.9.8 release notes

16 October 2026

These release notes cover new features and changes in Workshop 0.9.8 and SDKcraft 0.9.4.

Requirements and compatibility

Workshop relies on Snap and LXD:

What’s new in 0.9.8

Workshop 0.9.8 introduces the secret interface, letting SDKs request credentials such as API keys at runtime and letting users provide them from the host keyring. SDKcraft 0.9.4 adds matching support for declaring secret plugs. The release replaces confinement: virtual-machine with runtime: lxd-vm; use runtime: lxd-container for container workshops.

Workshop

Repository: https://github.com/canonical/workshop

  • Added the builtin secret interface, so an SDK can declare a secret plug and retrieve a connected credential at runtime through workshopctl get-secret, including systemd credential delivery. Users can provide a secret from the host keyring through a connected secret slot, or ad hoc as an environment variable for a single workshop exec command.

  • Added connection maintenance: manual interface connections are now disconnected and require a reconnection when a plug or a slot changed its definition (secrets, tunnels, etc.).

  • Enabled socket activation for the untrusted socket.

  • Added shell completion for workshop init options.

  • Sped up virtual machine startup by disabling secure boot, skipping the firmware boot menu, removing unused devices, disabling pollinate.service, and adding a quiet kernel parameter.

SDKcraft 0.9.4

Repository: https://github.com/canonical/sdkcraft

  • Added support for declaring secret plugs, matching the new Workshop secret interface.

Docs

Repository: https://github.com/canonical/workshop

  • Added how-tos for providing secrets to a workshop and for using secrets in an SDK.

  • Added a how-to for experimental virtual machine workshops.

  • Documented workshopctl get-secret and refreshed the CLI reference.

Full Changelog: