V7.24beta [development] is released!

Announcements
143

RHEL 8 (and derivatives) is on 4.18 (which wasn't LTS) and critical patches are still being backported (and will be until 2029) so go figure...
I presume MT is doing something similar, probably cherry picking whats relevant for more or less embedded network devices use of Linux kernel as is the case here...

144

I think it should also be noted that RouterOS likely uses only a fraction of available kernel modules.

145

Also bringing back Tile architecture (which was removed back in 4.17 kernel) to a later kernels would likely be more difficult...
I presume that Tile support will be dropped in ROS 8, but until then those CCRs are still workhorses :slight_smile:

146

MikroTik applies a lot of changes to the released kernel, and changing to a new kernel requires that all to be re-done. It has taken many years to release v7 which has a different kernel than v6 (it had been announced years before but it was a lot of work).

There is always the decision "do we track kernel releases and apply our own changes every time or do we remain on the same kernel and backport changes in new kernels all the time". Both of them are work and incur risks.

At some point it will become unpractical to include stuff like manufacturer drivers from newer kernels into this one, and it will be decided to upgrade the kernel. But then it my still take a long time for it to appear in RouterOS, probably in version 8.

147

I understand your intention in bringing up that example.
But I'd say it's a bit unfair.

RHEL 8 is widely used to maintain legacy systems (even some famous ERPs) on legacy hardware...

If there's one thing that has changed A LOT since Kernel 5.6.3 until now, it's almost everything related to networking stack.
And at the same time, the concepts of RING0, userland, and systemland have become increasingly elaborate.

For example, eBPF.
The need for this tool is undeniable if you want to have advanced firewall resources.
I mentioned this only to demonstrate that not everything is backportable.

So, RHEL vs. RouterOS are tools with different purposes!
Talking about the kernel of both is an unfair comparison!

148

Do not forget that Linus set a high pace on new releases: every 3 monhts you get new one with a lot of "wonderful" changes however tested by zylion people. On the other hand Linux phases out "old" architectures: https://lwn.net/Articles/1035727/ so we can say goodby to many MT devices chasing the latest kernels.

149

V8! Codename "Eleonore"!
As in the unicorn...

150

Yeah. my original post is more the fact I'm impressed than annoyed.

151

With all the forum space offering "a chat," all this off-topic chatter is happening right here...

This is just a topic for reporting problems.
It's NOT FORBIDDEN to open another topic to discuss "whatever you want" about RouterOS.

152

Hello Mikrotik, since you're working on OSPF, it would be great if you could add interface authentication, which is currently only available through templates. It would also be fantastic if you could work on integrating https://datatracker.ietf.org/doc/html/rfc5838 https://datatracker.ietf.org/doc/html/rfc5340 Best regards. Hopefully, we'll see this before the final release of v7.24.

153

What's new in 7.24beta3 (2026-Jun-19 14:02):

  • app - added "HF_TOKEN" env to openwebui;
  • app - added "network-outgoing-access" parameter which does not allow app to make outgoing connections;
  • app - added hermes-agent;
  • app - allow "reset" even if disk not configured;
  • app - allow setting "working_dir" in app YAML;
  • app - fixed "reset" not working with certain apps;
  • app - fixed apps not updating firewall redirects when changed in YAML;
  • app - fixed apps sometimes getting stuck on "waiting for layer";
  • app - only generate secrets for enabled apps;
  • app - removed healthcheck from opencloud-extended-collabora;
  • app - resolved issue where duplicate swaps are created;
  • app - show CHR's address instead of the container's;
  • bgp - improved stability when receiving malformed packets;
  • bridge - added scheduling point during VLAN processing to prevent soft lockups when flushing FDB over large VLAN ranges;
  • bridge - fixed local static host entries (additional fixes);
  • bridge - fixed MLAG MAC address handling issues related to aging, flushing and moving;
  • bridge - fixed stuck MLAG session when using mismatched L2MTU (introduced in v7.23);
  • bridge - temporarily reverted ARP inspection and IP source guard support (introduced in v7.24beta2);
  • certificate - use AES encryption when exporting certificates in PKCS#12 format;
  • console - added comparison operators for array type;
  • console - fixed issues with multi-argument properties (introduced in v7.24beta2);
  • console - renamed "reauth-timeout" to "reauth-period" in "/interface/dot1x/server" (backwards compatible via deprecation);
  • container - added "save" command to allow saving container images;
  • container - added "swap-current" usage;
  • container - added "swap-max" global and per-container limit;
  • container - added ability to run containers in privileged mode;
  • container - added initial support for RKE2;
  • container - fixed container "devices" override to appear under "/dev";
  • container - improved layer size calculation to avoid potential loops;
  • discovery - added "last-breath" feature (additional fixes);
  • disk - resolved issue where storage device may change information upon reboot;
  • ethernet - fixed stability issue for Chateau PRO ax devices;
  • ethernet - fixed stability issue for devices with Alpine CPU;
  • ipsec - fixed policy move handling;
  • ipsec,ike1 - fixed negotiated PFS validation;
  • ipsec,ike2 - improved PPK handling by always using it when authorized, including additional Child SAs, and moved PPK processing to the Child SA task;
  • ipsec,qkd - moved QKD to "/system/keymat-provider" menu and made it a generic key material provider;
  • ipv6,ra - fixed prefix invalidation (additional fixes);
  • leds - added dark mode support for hAP ax2, hAP ax3, hEX refresh, hEX S (2025), hAP ax S and Chateau ax devices;
  • leds - fixed missing wireless LED configuration (introduced in v7.21);
  • lte - enabled AT registration unsolicited event reporting for EG25-G and EC25-EU boards;
  • lte - fixed cases where EC25-EU and EG25-G boards would receive packets with missing last 4 bytes;
  • lte - fixed IPv6 RA handling for multiapn non-primary interface;
  • lte - limit IPv6 prefix lifetime only when lifetime is advertised as infinity (additional fixes);
  • netwatch - fixed an issue with DNS probe "timeout" parameter;
  • netwatch - fixed HTTP GET probe over IPv6;
  • poe-out - firmware update for 802.3at capable boards (the update will cause a brief power interruption to poe-out interfaces);
  • poe-out - firmware update for 802.3bt capable boards (the update will cause a brief power interruption to poe-out interfaces);
  • ppp - fixed cases where BG77 or BG770 firmware upgrade was not available;
  • ppp - improved "info" command for BG77 and BG770 modems (additional fixes);
  • routerboard - renamed "ipq53xx" firmware type to "ipq5300";
  • supout - added LTE eSIM section;
  • upgrade - prevent package scheduling from interfering with the upgrade feature;
  • wifi - updated radio regulatory information;
  • wifi-mediatek - improved channel switching;
  • wifi-qcom - fixed connectivity after interrupted DFS channel availability check (introduced in v7.24beta2);
154

Thank you for these fixes. I was able to reset all the apps with secrets and now /app export show-sensitive can finally produce an empty output :+1:.

155

I don't know whether I really understood this new feature, but isn't the result pointed by the blue arrow below wrong?

image
image298×333 5.37 KB

156

Could you clarify how the new privileged mode for containers works?

Does enabling this option grant any additional privileges that were previously unavailable to containers, or does disabling it remove some privileges that containers previously had by default?

In other words, what specific capabilities or restrictions are affected by the privileged mode setting?

157

Well that's "vague". I get "last-breath" implies some "on shutdown/crash", and discovery implies MNDP, CDP, or LLDP. But we're missing some details on the 5 W's... what, where, why.

e.g. Is some final MNDP packet with some "terminating" message? If so, how does it manifest? Or, is this some LLDP thing? etc. etc.

158

I believe that it is a feature that it is similar to Dying-GASP.

159

What is the intended purpose of this? Does this mean RouterOS will be able to run a local LLM/AI agent through the app/container system, or is it meant for something else?

Ref: GitHub - NousResearch/hermes-agent: The agent that grows with you · GitHub

ps..
When will MikroTik start documenting new features properly instead of just adding one-line changelog entries?!?

160

Sure... but a "last-breath" or "Dying-GASP" is typically close-to-hardware trigger on crash (perhaps shutdown). The question is what does it trigger?. Given it's marked a "discovery", I presume it send some LLDP/CDP/MNDP thing...but it's anyones guess beyond that was my point. And if you can identify some routing that "dying" (shutting down) via discovery, that's actually useful...

And in the theme:
161

Now with the new manual.mikrotik.com it will be a breeze to publish docs. Just someone has to write more than a one-liner.

162

I understood that it was the plan to move the change logs to manual pages, the only question is when that will happen.