Release 2.1.161 (2026-07-23)

Bug fixes

• reclaim anonymous venv mask volume on cache-build cleanup (#2501) The cache-build path creates a build container, commits it, then removes it in the finally block. The cleanup used rm without -v, orphaning the anonymous /workspace/.venv mask volume introduced in #2495 — nerdctl volume ls grew by one per cold build. Add -v so the container's anonymous volumes are reclaimed on removal, matching the run path's run --rm behavior.

CI Evidence: All gates passed — full audit bundle available. Download →