Dockplane 0.1.0-rc.4

Dockplane 0.1.0-rc.4

The fourth release candidate. No new features: this one is about the
documentation being true, the checks being real, and the parts of the release
machinery that could pass without doing anything.

Documentation

The documentation is now organised into getting started, operations, security
and reference, and it is written once — in the repository, beside the code it
describes. The website builds its index from those files rather than keeping a
second copy, so a page that is added or rewritten shows up on the site and
nothing on the site can quietly fall out of step.

New pages cover adding a host,
upgrading,
supported platforms,
known limitations and the
vulnerability assessment.

One correction matters if you followed the old pages. They told you to
install dockplane-agent_0.1.0~rc.2_amd64.deb. Nothing was ever published
under that name — the tilde belongs in the package's version field, not in a
file name — and the download would have failed. Every documented file name is
now checked against what the project actually publishes.

Which agent version a new host gets

Adding a host installs the agent matching your control plane, and follows it
across every upgrade. That was already true; what was missing is that an
explicit pin was invisible.

If AGENT_RELEASE_VERSION is set in your .env, new hosts keep receiving the
version named there. An upgrade now says so, and dockplane-control doctor
reports it at any time:

! AGENT_RELEASE_VERSION is pinned to 0.1.0-rc.3, not 0.1.0-rc.4
  Add host will keep installing the 0.1.0-rc.3 agent on new machines.

Neither changes it. A pin is your setting, and only you can decide it has
served its purpose.

Security

The web image applies its distribution's security updates. Caddy publishes
an image per release and does not rebuild it when Alpine patches a library
inside it, so an image on the newest Caddy still carried what its base held the
day it was built. This removes five of the ten high findings against it — curl,
libcurl and c-ares.

Five remain, all compiled into the Caddy binary, and only Caddy can fix them by
publishing a build against a newer Go toolchain.

The control server's findings are unchanged: twenty-two, every one a Debian 12
package with no published fix, none from Dockplane's own dependencies. Each of
the five critical ones is now assessed by name rather than reported as a count.
See the vulnerability assessment.

Release verification

Three ways a release check could pass without doing its job, all closed:

• The asset verification compared checksums without requiring the tool that
  computes them. On a machine without it, both sides of the comparison were
  the empty string, they matched, and a release verified having read nothing.
  This is why 0.1.0-rc.3 was reported green from a machine that never read a
  single package.
• The build wrote a placeholder into the release manifest when it could not
  determine an image digest — as present as a real digest to anything that only
  asked whether one was there, and pinning nothing.
• Several scripts reached for dpkg-deb, sha256sum, tar and git without
  naming them as requirements.

A required tool that is missing now fails the gate and says which one.

Continuous integration

The website, the workflow files, the documentation and the browser flows are
now gates rather than things somebody remembered to run. The search palette and
Add host suites run against an instance created for the run and destroyed with
it — its own database, its own certificate authority, and an administrator
whose password is generated in the process. No credential is configured for
CI, and nothing there can reach a real deployment.

Fixed

• The features page advertised images, networks, volumes, container metrics,
  host groups and resource scopes. None exist in this release. All six are now
  listed as planned.

Supported platforms

Control plane	Ubuntu 24.04, Ubuntu 22.04 or Debian 12, with Docker Engine and the Compose plugin
Managed hosts	Debian 12, Ubuntu 24.04 or Ubuntu 22.04 with systemd. amd64 is supported; arm64 is experimental

arm64 is experimental — built and inspected, not runtime-tested. Use amd64
in production.

Upgrading

VERSION=0.1.0-rc.4

sha256sum -c SHA256SUMS
tar xzf "dockplane-$VERSION.tar.gz"
cd "dockplane-$VERSION"
sudo ./install-control-plane.sh --domain dockplane.example.com

The installer takes a backup before it changes anything, reads it back the way
a restore would, and stops if any of that fails. See
Upgrading.

Known limitations

Unchanged from 0.1.0-rc.3, and set out in full under
Known Limitations: re-enrolling a machine
creates a new host record, backups are not encrypted by Dockplane, images are
not signed, there is no shell or exec, Compose projects are read-only, and
there is no automatic update or APT repository.

License

AGPL-3.0-only. See LICENSE.