Dockplane 0.3.0

Dockplane 0.3.0

The third stable release.

The interface now answers what a deployment is running, and on which
machines. Versions are reported per component and per agent, a host
that has been replaced can be taken out of the working set without losing what
it ran, and the management views stay usable at the widths people actually work
at. What Dockplane manages is unchanged from 0.2.0: the same capability
catalog, the same containers and stacks, the same trust boundary.

Highlights

The management views fit the window. Every column carries the priority of
what it tells an operator, and the width that decides which columns are shown is
the table's own rather than the browser's — so a wide window with the sidebar
open is treated as the narrower content area it is. What somebody cannot act
without — what the thing is, which host it belongs to, what state it is in, and
the way to act on it — is in view at every width, without scrolling sideways.
Below a tablet's width a table becomes a stacked list rather than a table nobody
can read.

Settings says what this installation is. The control server's release and
commit, the browser application's own release and commit, the migration the
database has reached, the agent protocol range, and what every enrolled agent
reports. The server and the application are two images and are reported as two:
an operator who upgraded one and not the other is running two revisions, and one
number called "the Dockplane version" would hide exactly that.

A fleet on more than one version is shown as one, not as a fault. An agent on
an older release is supported for as long as its protocol version is one the
control server accepts. Only a protocol outside that range is reported as an
incompatibility, and an agent that has never reported a readable version is
counted as unknown rather than pushed to one end of an ordering.

Dockplane can be asked whether a newer release exists, and does not ask by
itself. The check is off, and stays off on a new installation and across every
upgrade until an administrator sets UPDATE_CHECK_ENABLED. When it is on, the
control server makes one request a few times a day to a fixed public address,
with no query string, no body and nothing about the installation in it. Nothing
is downloaded, installed or upgraded by it: the result is a sentence. There is
no auto-updater and no agent auto-upgrade.

A superseded host can be archived. Enrolling a machine again produces a
second host record, and a fleet accumulates them. Archiving takes one out of the
active lists and stops it being offered as somewhere to run new work, and
everything it carried stays: its containers, Compose projects, stacks, actions
and every audit entry that names it. Its agent is untouched — not deleted, not
revoked. Archiving is reversible, and it is not a delete, not a merge and not a
revocation: Dockplane still does not decide that two host records are the same
machine.

A stack's containers are its own, everywhere. Dockplane labels every
container it builds for a stack with the stack, the service and the revision, and
those labels now travel from the host through to what the interface shows. A
running stack reads as deployed, its operations find the containers they are
meant to act on, and the container lists say which stack a container belongs to
rather than presenting it as somebody else's.

Security and supply chain

The agent is scanned and its reports are published. Until this release the
vulnerability reports covered the two control-plane images; the agent — the
artifact that ends up on every managed host — had none. It is now scanned on
both architectures, from the binary in the release tarball rather than one built
for the occasion, with the same scanner, the same severities and the same
release policy the images are held to. Both reports are published as release
assets and covered by SHA256SUMS.

A missing report is now a failed release. Every one of the six reports is
required by name. Before, they were expected only if a matching file happened to
be present, so a scan that never ran and a scan that found nothing looked the
same.

The Go toolchain moved to 1.26.6, which resolves the standard-library
findings the 0.3.0-rc.2 build carried in the Compose compiler and in the agent.

Release inputs are pinned. Every base image is named by digest as well as by
tag, including the one the agent is compiled in, so what a build consumes is a
function of the commit rather than of the day it ran.

The assessment behind the published numbers, including findings that are carried
with a reason, is in
Vulnerability Assessment. The agent's evidence
is its checksums and those scan reports; it has no bill of materials and no
provenance attestation of its own.

Installation

Ubuntu 24.04, Ubuntu 22.04 or Debian 12, with Docker Engine and the Compose
plugin:

VERSION=0.3.0

sha256sum -c SHA256SUMS
tar xzf "dockplane-$VERSION.tar.gz"
cd "dockplane-$VERSION"
sudo ./install-control-plane.sh --domain dockplane.example.com

Then sign in and add your first host. See
Installation and
Add a Host.

Upgrading

The installer is the upgrade: download the release, check it, unpack it, run it.
It takes a backup and validates it before anything changes, and stops if either
fails. Pulling images and editing .env is not an upgrade path.

One migration is applied, 0016_host_archive, which adds a nullable column to
the hosts table. Every existing host stays active, including the ones that are
offline or whose agent was revoked.

Upgrade the control plane first, then the agents. The protocol version is
unchanged at 1, so a half-upgraded fleet goes on working: inventory, metrics,
logs, container operations and Compose discovery are served by an older agent
exactly as before.

Stack management is the exception. Attributing a stack's containers depends
on what the agent reports, so a host whose agent predates 0.3.0-rc.2 has its
stack operations refused with AGENT_UPGRADE_REQUIRED before anything is sent
to it. That host is not incompatible and nothing else it serves is affected.
Upgrading its agent is the whole repair: the package upgrade keeps the host's
identity and its private key, so nothing is enrolled again. See
Upgrading and Stacks.

Supported platforms

Control plane	Ubuntu 24.04, Ubuntu 22.04 or Debian 12, amd64
Managed hosts	Debian 12, Ubuntu 24.04 or Ubuntu 22.04 with systemd

Ports: 80 and 443 for browsers, 9443 for agents. The API and PostgreSQL are not
published. See Supported Platforms.

ARM64

experimental — built and inspected, not runtime-tested

Packages, binaries and images are produced for arm64 and inspected, and no arm64
machine has run them. Use amd64 in production.

Known limitations

Read Known Limitations before deploying.
In short:

• There is no remote shell, exec or attach, and no generic command execution
  on a managed host.
• A host is never deleted and two host records are never merged. Archiving takes
  a host out of the working set; nothing deduplicates by hostname or by anything
  else.
• A host whose agent is connected cannot be archived, and an archived host that
  starts answering again stays archived.
• Compose projects discovered on a host are read-only and cannot be taken over.
• build: is refused: Dockplane deploys images, it does not build them.
• There is no automatic update, no self-updater, no APT repository, and no Git
  or webhook integration.
• There is no downgrade path.
• Re-enrolling a machine creates a new host record.
• Applying a revision recreates every service, so a stack is briefly down while
  it is rebuilt.
• A rollback deploys an earlier configuration; it does not restore data. Volumes
  are never removed, and a stack's networks are not removed when it is deleted.
• A backup holds the control plane's own state. Nothing on a managed host is in
  it — not your containers, not their volumes, not their data.
• Volume deletion and image management are not implemented.
• Notifications, alerting and scheduled automation are not in this release.
• Backups are not encrypted by Dockplane, and images are not signed.
• Container output is not stored; logs are read from the host when you ask for
  them.
• arm64 is experimental, as above.

License

AGPL-3.0-only. See LICENSE.