docker and podman don't suck 🤣

* Generate files for 1.3.3 release

* Prepare for next release

* Merge release 1.3.3 files
Co-authored-by: hc-github-team-nomad-core <github-team-nomad-core@hashicorp.com>

* Fixes a bug for first-time SecVars users on namespaces

* Namespace computed dep

* Namespace computed dep

* Changelog and lintfix

* Changelog removed

* Forbidden state on individual variables

* CanRead checked on variable path links

* Mirage fixture with lesser secure variables access, temporary fix for * namespaces

* Read flow acceptance tests

* Unit tests for variable.canRead

* lintfix

* TODO squashed, thanks Jai

* explicitly link mirage fixture vars to jobs via namespace

* Typofix; delete to read

* Linking the original alloc

* Percy snapshots uniquely named

* Guarantee that the alloc we depend on has tasks within it

* Logging variables

* Trying to skip delete

* Now without create flow either

* Dedicated cluster fixture for testing variables

* Disambiguate percy calls

Merge pull request #13798 from hashicorp/dependabot/go_modules/github.com/hashicorp/consul/api-1.13.1

chore(deps): bump github.com/hashicorp/consul/api from 1.13.0 to 1.13.1

fix minor unreachable code caused by t.Fatal

* refact: add conditional logic to variables.index

* refact: add conditional logic to variables.path

* refact: update query selectors in assertions

Signed-off-by: Abirdcfly <fp544037857@gmail.com>

Introduces the post publish website event

core: automatically plumb task name into task-level services and checks

docs: minor readme tweaks

* refact: allow namespace glob matching

* test:  namespace glob matching

Bumps [tmpl](https://github.com/daaku/nodejs-tmpl) from 1.0.4 to 1.0.5.
- [Release notes](https://github.com/daaku/nodejs-tmpl/releases)
- [Commits](https://github.com/daaku/nodejs-tmpl/commits/v1.0.5

)

---
updated-dependencies:
- dependency-name: tmpl
  dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* api: use errors.New not fmt.Errorf when error doesn't have format.

* semgrep: add rule to catch fmt.Errorf use without formatting.

* Check against all your policies' namespaces' secvars' paths' capabilities to see if you can list vars

* Changelog and lintfix

* Unit tests for list-vars

* Removed unused computed dep

* Changelog removed

- Remove Circle CI badge (pretty much always misleadingly red)
- Add MPL license badge
- Remove link to deprecated google groups

Bumps [github.com/hashicorp/consul/api](https://github.com/hashicorp/consul) from 1.13.0 to 1.13.1.
- [Release notes](https://github.com/hashicorp/consul/releases)
- [Changelog](https://github.com/hashicorp/consul/blob/main/CHANGELOG.md)
- [Commits](https://github.com/hashicorp/consul/compare/api/v1.13.0...api/v1.13.1

)

---
updated-dependencies:
- dependency-name: github.com/hashicorp/consul/api
  dependency-type: direct:production
  update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>

deps: update runc to v1.1.3

nsd: add support for setting request body in http checks

This PR adds support for settings check.body in checks of services
making use of Nomad's service provider.

The QEMU driver can take an optional `graceful_shutdown` configuration
which will create a Unix socket to send ACPI shutdown signal to the VM.

Unix sockets have a hard length limit and the driver implementation
assumed that QEMU versions 2.10.1 were able to handle longer paths. This
is not correct, the linked QEMU fix only changed the behaviour from
silently truncating longer socket paths to throwing an error.

By validating the socket path before starting the QEMU machine we can
provide users a more actionable and meaningful error message, and by
using a shorter socket file name we leave a bit more room for
user-defined values in the path, such as the task name.

The maximum length allowed is also platform-dependant, so validation
needs to be different for each OS.

UID/GID 0 is usually reserved for the root user/group. While Nomad
clients are expected to run as root it may not always be the case.

Setting these values as -1 if not defined will fallback to the pervious
behaviour of not attempting to set file ownership and use whatever
UID/GID the Nomad agent is running as. It will also keep backwards
compatibility, which is specially important for platforms where this
feature is not supported, like Windows.

When a QEMU task is recovered the monitor socket path was not being
restored into the task handler, so the `graceful_shutdown` configuration
was effectively ignored if the client restarted.

The `timestamp` HCL2 function was never part of the set of supported
functions.

nsd: add support for setting headers on nomad service http checks

* add Nomad RetryConfig to agent template config

New variable creation adds the first namespace in your available list at variable creation time (#13991)

* New variable creation adds the first namespace in your available list at variable creation time

* Changelog

ui: fix zero memory utilization bug on systems using cgroups v2