BeforeUp 0.4.3

BeforeUp 0.4.3 is the first stable release of the read-only Docker Compose preflight and deployment-change checker for native Linux Docker Engine setups.

What it checks

• Docker Compose configuration resolution, host-port ownership and collisions, missing local bind sources and build contexts, and Docker disk headroom.
• Differences between a proposed Compose project and its currently running services: published ports, bind mounts/volumes, declared environment values and image references. Sensitive values and resolved bind-source paths are not printed.
• Optional JSON output and strict warning exit codes for scripting.

Install

• Debian/Ubuntu: download the appropriate .deb asset and SHA256SUMS, verify the checksum, and install with sudo apt install ./beforeup_0.4.3_amd64.deb (or the ARM64 package).
• Other Linux: use the static linux_amd64 or linux_arm64 archive after verifying its checksum.
• Run beforeup check -f compose.yaml or beforeup compare -f compose.yaml.

Requirements and limitations
Docker CLI with Compose v2, the Linux ss command, and permission to inspect the target Docker Engine. BeforeUp never performs up, down, build, pull or Docker cleanup. A successful preflight does not guarantee successful deployment or application health.

Rootless writable binds, Docker Desktop for Linux, SELinux-enforcing hosts, some dual-stack setups, replicated services and ARM64 real-device installation are not independently qualified. See docs/platform-support.md for exactly what was tested. The ARM64 package is cross-built, not install-tested on ARM64 hardware.

Validation: 57 Go tests, race checks, a 14-case Compose matrix, a disposable real Docker comparison, package install/remove on Debian 13 and Ubuntu 24.04/26.04, and executable startup across ten Linux distribution images. The last two do not imply full Docker Engine compatibility on those distributions.

BeforeUp 0.4.3 preview 1

BeforeUp 0.4.3 preview — quality audit and focused correctness fixes.

Fixes:

• BUILD_CONTEXT_INVALID warns when an existing local build context is a file, not a directory.
• Added/removed published-port findings have deterministic ordering in text and JSON output.
• PORT_OWNERS_UNKNOWN warns when Docker cannot inspect published-port ownership. BeforeUp no longer claims ports are clear merely because ss shows no listener.
• Regression from the interrupted review is now part of build_test.go, not a stranded review artifact.
• Python cache files are ignored; changelog and platform documentation updated.

Broader audit:

• Reviewed CLI behavior, Docker command boundaries, report redaction, deterministic output, module/dependency structure, packaging/test scripts and documentation.
• 57 Go tests, repeated deterministic-order checks, race detector, vet, make check, Go module verification and Docker Compose integration all passed.
• 14 reproducible Docker Compose cases passed and a read-only comparison against an existing Docker service returned no blockers.
• All tracked shell scripts passed POSIX sh syntax validation; Python fixture source passed parsing.
• Source documentation passed strict prose checks with zero warnings; Go statement coverage is 83.1%.
• AMD64 and ARM64 static Linux archives and .deb packages built; AMD64 .deb installed and removed on Debian 13 and Ubuntu 24.04/26.04.

This is a preview, not universal certification. Real Docker Desktop Linux, SELinux enforcing, rootless application write paths, IPv6 configurations beyond tested cases and native ARM64 package installation remain outside verified scope.

BeforeUp 0.4.2 preview 1

BeforeUp 0.4.2 preview adds a focused preflight check validated against representative Docker Compose projects.

New diagnostic:

• BUILD_CONTEXT_MISSING warns when a local Compose build directory does not exist, even when docker compose config -q accepts the YAML. It never prints the path and does not mistake remote Git contexts for local directories. Missing directories are warnings, not guaranteed deployment failures.

Real-world QA:

• Checked six published docker/awesome-compose configurations: WordPress/MariaDB, PostgreSQL/pgAdmin, NGINX/Node.js/Redis, Prometheus/Grafana, Gitea/PostgreSQL and Nextcloud/Redis/MariaDB. All six passed native Compose validation and completed BeforeUp host checks. These were tested without their sibling directories or starting the applications; missing local build/mount directories in those isolated copies are expected.
• Started one disposable Alpine Docker Compose service with no network or published ports and a read-only root filesystem. BeforeUp first reported RUNNING_MATCH, then correctly identified ENV_CHANGED and MOUNT_SOURCE_CHANGED after editing its proposed Compose file. It did not print private host paths. The temporary container was removed.
• Validated a denied non-root application bind-mount write and a permitted root write in an isolated test directory using conventional Docker Engine.
• Tried a separate rootless Docker Engine. Engine metadata checks worked, but rootless application containers could not start because this VPS session lacks the necessary AppArmor and cgroup access. Rootless write behavior remains unverified; no host policy was changed.

Gates: 54 Go tests, Go race and vet, real Docker Compose integration, 14 synthetic Compose cases, Debian AMD64 install/remove on Debian 13 and Ubuntu 24.04/26.04. Linux amd64/arm64 archives and Debian packages include SHA256SUMS. Downloaded release files are checked separately after publication.

This remains an early preview. Docker Desktop for Linux and SELinux-enforcing runtime testing, full rootless container writes and real ARM64 device installation are still outside the verified scope.

BeforeUp 0.4.1 preview 1

BeforeUp 0.4.1 preview improves comparison reliability and keeps the project small.

Corrections:

• Report running services that are absent from the proposed Compose project even when those old services have multiple replicas.
• Recognize scaled services before attempting Docker inspect, so one unsupported service does not prevent the rest of the stack from being compared.
• Stop printing mount target paths in reports; Compose interpolation could otherwise expose sensitive values.
• Summarize changed and removed data mounts by count and service instead of emitting several indistinguishable warnings.
• Make orphan findings stable in order for machine-readable output.

Maintenance:

• The roadmap now covers unfinished work only. Released features remain in CHANGELOG.md.
• make check is read-only and verifies gofmt, Go vet and unit tests. Formatting is an explicit make fmt action.
• No new runtime dependencies, background processes or extra packaging formats.

Verification:

• 51 Go tests, Go vet, race testing and Docker Compose integration.
• A 14-case Compose configuration regression matrix.
• A real isolated three-container test reproduced the scaled-orphan scenario; all test containers were removed.
• Linux AMD64 Debian package installed, executed and uninstalled on Debian 13, Ubuntu 24.04 and Ubuntu 26.04.
• Both static Linux tarballs and AMD64/ARM64 .deb files include SHA256SUMS.

This remains a preview. Independent user testing, full rootless container write tests, SELinux and Docker Desktop integration, and real ARM64 package installation are still pending.

BeforeUp 0.4.0 preview 1

BeforeUp 0.4.0 preview improves the reliability of Docker Compose host diagnostics and adds optional CI strictness.

Changes:

• Docker Desktop on Linux: detect the VM-backed daemon and skip workstation-side socket, mount and disk checks that cannot reliably describe the VM. Running-container metadata comparison remains available.
• Rootless Docker: warn about potentially restricted host ports and bind-source permissions that cannot be proven from path existence alone. Respect the host's unprivileged-port threshold where available.
• IPv6/IPv4: distinguish definite duplicate host-port bindings from cross-family wildcard overlap whose behavior depends on the host's networking configuration.
• --strict: return a nonzero exit code on warnings for CI, without changing finding severities.
• Visual: subtle transparent rounded corners on the README banner.
• Docs: practical rootless, Docker Desktop and CI guidance, with scope and limitations stated.

Verification on the maintainer's Debian 13 host:

• 46 Go tests, full integration tests, race checks and static vet.
• 14 synthetic Compose cases, including a regression for two services publishing the same default host port.
• Temporary IPv6 loopback listener and cross-family Docker Compose configuration/dry-run cases.
• An isolated, unprivileged rootless Docker Engine with read-only BeforeUp checks; no rootless application container was launched. The isolated daemon was stopped and removed.
• Linux amd64 and arm64 archives and .deb packages; amd64 .deb install, execution and removal on Debian 13, Ubuntu 24.04 and Ubuntu 26.04.
• SHA-256 release artifacts validated after publication.

Limitations: Docker Desktop Linux itself and an SELinux-enforcing host were not available for live integration tests. Real rootless bind-mount write access and privileged-port publication remain untested. ARM64 packaging was compiled, but not installed on real ARM64 hardware. This is a preview, not a guarantee of successful deployment.

BeforeUp 0.3.3 preview 1

BeforeUp 0.3.3 preview fixes an important running-stack comparison limitation.

When multiple running containers belong to one Compose service, BeforeUp now reports REPLICAS_UNSUPPORTED for that service while continuing to compare unrelated services. It no longer abandons the whole comparison or claims that a partially checked stack has no changes.

Verification:

• 37 Go tests, including two failing-before-fix replica regressions.
• Read-only Docker Compose integration and race tests.
• Three disposable, network-isolated Docker containers (two workers plus one independent service) verified partial comparison; all were removed.
• 14 reproducible Compose configuration cases.
• Debian package installation/removal on Debian 13 and Ubuntu 24.04/26.04.

The README now includes the project's purple banner. The image is a small, optimized static asset, and no additional unused logo variants were included.

Archives and Debian packages are provided for Linux amd64 and arm64 with checksums. Real ARM64 installs, Docker rootless, SELinux and full per-replica comparison remain outside the verified scope.

BeforeUp 0.3.2 preview 2

BeforeUp 0.3.2 preview 2 adds native Debian packages and a reproducible Linux binary portability matrix.

Assets:

• Static Linux amd64 and arm64 tarballs.
• Native Debian packages for amd64 and arm64 (no install scripts, services or automatic permission changes).
• SHA256SUMS covering the exact downloadable filenames.

Validation:

• Static Linux/amd64 binary executed on ten distribution OCI base images.
• AMD64 Debian package installed, ran and was removed on Debian 13, Ubuntu 24.04 and Ubuntu 26.04.
• 35 Go tests, race coverage, Docker Compose integration and 14 synthetic Compose cases.
• SHA-256 checksums verified after GitHub download.

The Debian control Version uses 0.3.2~preview2, while release filenames use 0.3.2.preview2 to avoid GitHub filename rewriting. This is intentional.

Only executable startup was tested across the ten distributions; rootless Docker, SELinux and full Docker integration outside the maintainer's Debian Engine remain unverified. ARM64 packages were built and inspected, not installed on an ARM64 host. See docs/platform-support.md.

BeforeUp 0.3.1 preview 1

BeforeUp 0.3.1 preview adds a targeted check for an image tag that has been updated locally without changing its name.

When comparing a proposed Compose project with a running one, BeforeUp can now report LOCAL_IMAGE_UPDATED if the image ID currently available on the host differs from the image used to create the container. The check is read-only: no registry access, no image pull, and no container restart. Explicitly platform-pinned services are excluded until platform-sensitive local image checks are supported.

The README and troubleshooting guide now describe the commands people already use for ports, environment changes, volumes and image updates, and explain exactly where BeforeUp adds useful evidence. The public project description and topics focus on those supported cases, without promises about remote images or successful deployments.

Verification: 35 Go tests, Docker Compose integration, race testing, 14 reproducible Compose scenarios, a read-only existing-stack smoke test and local image ID checks across 30 containers. Independent adoption remains unverified.

Linux amd64 and arm64 packages include checksums. This remains a preview release.

BeforeUp 0.3.0 preview 1

A focused preview update informed by recurring Docker Compose troubleshooting questions.

BeforeUp compare now:

• Detects changed values of explicitly declared container environment settings versus the running container, without printing setting names or values.
• Warns when a proposed image reference differs from the running container's reference. This does not check remote digests.
• Reports running services missing from the proposed resolved Compose configuration, without assuming Docker will delete them.
• Explicitly reports missing runtime metadata instead of claiming a healthy comparison.
• Keeps the previous port ownership, bind-mount and published-port change checks.

The new docs/common-issues.md explains common failures and native Docker workarounds first, and when BeforeUp provides extra evidence.

Tests: 31 Go regressions including Docker Compose integration and race checks, plus 14 reproducible synthetic Compose cases. Read-only checks against existing Linux services were performed. No external user adoption or product superiority is claimed.

Binaries are available for Linux amd64 and arm64 with SHA-256 checksums. BeforeUp does not start containers, modify configuration, pull images or change Docker services.

BeforeUp 0.2.0 preview 1

This preview adds a running-stack comparison to BeforeUp.

Run beforeup compare -f compose.yaml to review proposed host-port and data-mount changes against containers that are already running in the same Docker Compose project.

Changes:

• Recognize when a published port belongs to the same service, or to a different Docker project.
• Warn about added and removed host port bindings.
• Highlight removed mounts and changed mount sources, without printing raw host bind-source paths.
• Resolve Compose-managed named volume identifiers to avoid misleading mount warnings.
• Handle projects where no services are selected by active profiles.
• Add repeatable tests for 14 synthetic Compose scenarios, plus regression tests for running-project comparisons and failure cases.

The tool remains read-only. The comparison does not inspect image versions, environment changes, container health or application behavior, and it does not promise that a deployment will succeed.

Linux amd64 and arm64 executables are included with SHA-256 checksums. Independent user testing is still required before a stable release.