v2.2.4

Security results that keep themselves up to date, poll for updates for many stacks at once and a ⌘K search palette.

Features

• Scans that don't go stale. The backend now rescans images on its own. A background sweep, about 30 seconds after start and then every 5 minutes, queues:

  • images that were never scanned, without anyone opening the Security page;
  • the images of stacks that Komodo deployed by itself (Global Auto Update, Komodo's UI, a procedure), read from Komodo's Updates;
  • images whose last scan attempt is older than TRIVY_RESCAN_INTERVAL_HOURS (24 by default), so new CVEs show up on images that haven't changed.

  The sweep keeps no state of its own, so a restart loses nothing, and deploys made through Komodo CD aren't scanned twice.

• Poll for updates from the bulk bar. Select stacks and turn on Komodo's poll for updates for all of them in one go, so the Global Auto Update checks their images. Session only, like deleting a stack (stacks.pollForUpdates).

• ⌘K search. The top bar search is now a palette over pages, recent pages and stacks, also on mobile.

• Most exposed images link to their stack on the overview.

Fixes

• The chart's screen reader table no longer peeks its caption over the title.

Look

• The pick-a-stack prompt is centered in the empty detail pane.

Configuration

Variable	Default
TRIVY_RESCAN_INTERVAL_HOURS	24	Hours before an image is rescanned on its own. 0 turns off the periodic rescan only; deploys made inside Komodo still trigger scans.

For contributors

• The Docker dev backend restarts after each sync: Bun stopped watching files the sync recreated, so edits never reloaded.

Images

ghcr.io/nonetss/komodo-cd-backend:2.2.4
ghcr.io/nonetss/komodo-cd-frontend:2.2.4
ghcr.io/nonetss/komodo-cd-gateway:2.2.4

latest keeps tracking main. Pin the installer to this release with:

curl -fsSL https://raw.githubusercontent.com/Nonetss/Komodo-CD/v2.2.4/scripts/bootstrap.sh | KCD_REF=v2.2.4 bash

Upgrading

No migrations. compose.yml passes the new optional TRIVY_RESCAN_INTERVAL_HOURS to the backend; with your own compose file the backend uses 24 when it's not set. Pull the new images and recreate the stack:

docker compose pull
docker compose up -d

On the first sweep after upgrading, every image whose last scan is older than the interval is queued once.

v2.2.3

The API docs one click from your keys, a roomier security overview and an orange logo.

Features

• API docs from API Keys. The API Keys page links to the Scalar reference at /scalar, so the endpoints, parameters and responses you call with a key are one click away.
• Most exposed images. On the overview, the most exposed images take the whole security block and list in two columns.

Fixes

• "And N more" on the overview. The line now sits under the lists, so both columns of a two-column list end on the same rule.

Look

• The logo is orange, in the app and on the website, to match the icons.

For contributors

• The docker/metadata-action and docker/build-push-action steps move to their Node 24 majors, dropping the Node 20 deprecation warning. The CI examples in the README and the docs use the same versions, so copying them doesn't warn either.

Images

ghcr.io/nonetss/komodo-cd-backend:2.2.3
ghcr.io/nonetss/komodo-cd-frontend:2.2.3
ghcr.io/nonetss/komodo-cd-gateway:2.2.3

latest keeps tracking main. Pin the installer to this release with:

curl -fsSL https://raw.githubusercontent.com/Nonetss/Komodo-CD/v2.2.3/scripts/bootstrap.sh | KCD_REF=v2.2.3 bash

Upgrading

No migrations and no changes to compose.yml. Pull the new images and recreate the stack:

docker compose pull
docker compose up -d

v2.2.2

Toasts that keep their look and a stack page that fits on a phone.

Fixes

• Toasts after navigating. Once you moved between pages, notifications lost their styles and showed up unstyled across the bottom of the screen. They now keep their card, position and icon on every page, with a thin border instead of the heavy ink one (which read as a white frame in the dark theme).
• Stack page on mobile. The security table pushed the page wider than the screen, so the bottom navigation looked off-centre and cut off on a stack's page. It now fits, and the table scrolls inside its own block.
• Security table rows. Clicking anywhere on an image row expands it; the chevron, the stack links and the rescan button keep their own click.

For contributors

• Sonner's stylesheet is imported in the toaster instead of relying on the <style> it injects once, which Astro's ClientRouter drops on navigation.
• DESIGN.md describes the hairline border of toasts and of the floating bulk bar.

Images

ghcr.io/nonetss/komodo-cd-backend:2.2.2
ghcr.io/nonetss/komodo-cd-frontend:2.2.2
ghcr.io/nonetss/komodo-cd-gateway:2.2.2

latest keeps tracking main. Pin the installer to this release with:

curl -fsSL https://raw.githubusercontent.com/Nonetss/Komodo-CD/v2.2.2/scripts/bootstrap.sh | KCD_REF=v2.2.2 bash

Upgrading

No migrations and no changes to compose.yml. Pull the new images and recreate the stack:

docker compose pull
docker compose up -d

v2.2.1

Deploys now wait for Komodo to finish, and you can delete several stacks at once.

Highlights

• Deploys wait for Komodo. A pull or redeploy used to be reported as done as soon as Komodo queued the task, so nothing had changed yet and failures never reached the caller. v0.deploy.trigger and POST /api/v0/deploy now wait for each task to complete: a pull-redeploy only redeploys if the pull succeeded, and a failed task answers 502 with the output of its first failed step (for example Pull Stack: manifest unknown). The deploy routes no longer hit Bun's 10 s idle timeout while Komodo works, so a CI call can last minutes.
• Bulk delete. Select several stacks and delete them from the bulk bar, with an inline confirmation that cannot be mistaken for a deploy. At most three at a time, one summary toast, and the ones that fail stay selected to retry. Only a signed-in session can do it.
• A bulk bar that stays in view. It floats at the bottom of the screen (above the bottom navigation on phones) instead of sitting at the end of the list, and only the main action, Pull + Redeploy, keeps its text.

Fixes

• Toaster styles and position, and the strip of the login page.

For contributors

• Type scale: a taller section role, a new name role for row subjects, and mono values without negative tracking. RelativeTime is the shared component for "3 minutes ago" with the full date on hover.
• New tests for the Komodo service (packages/api/tests/komodo.test.ts) and OpenSpec updated for both changes.

Images

ghcr.io/nonetss/komodo-cd-backend:2.2.1
ghcr.io/nonetss/komodo-cd-frontend:2.2.1
ghcr.io/nonetss/komodo-cd-gateway:2.2.1

latest keeps tracking main. Pin the installer to this release with:

curl -fsSL https://raw.githubusercontent.com/Nonetss/Komodo-CD/v2.2.1/scripts/bootstrap.sh | KCD_REF=v2.2.1 bash

Upgrading

No migrations and no changes to compose.yml. Pull the new images and recreate the stack:

docker compose pull
docker compose up -d

v2.2.0

Image vulnerability scanning with Trivy, a redesigned console with a key-figures overview, live deploy activity, bulk actions and stack deletion. This release also covers the changes tagged as v2.1.0 to v2.1.2, which had no release of their own.

Highlights

• Image security with Trivy. A new trivy service scans the images of every Komodo stack. The Security page (/security) lists each image with its stacks, the number of distinct CVEs per severity, how many have a fix and the scan state; each image opens in place into its CVEs, with severity filters, a "fixable only" switch, a rescan button and a copyable Markdown report. A stack's images are rescanned after every successful deploy, and the backend only scans when it has a Trivy server (TRIVY_SERVER_URL, set by the new compose.yml).
• Gate CI on vulnerabilities. GET /api/v0/security/images, GET /api/v0/security/image and POST /api/v0/security/scan work with an API key, so a pipeline can wait for the scan and fail on critical findings. See Fail on vulnerabilities.
• New overview. / now shows the key figures of the instance: stacks by state, which ones need attention (with the short reason) or have something new to deploy, CVEs by severity, the most exposed images and failed scans, and the deploys of the last 30 days per day with the success rate, the share launched from CI, the most deployed stacks and the latest failures. The running and stopped stacks are listed below.
• Redesigned console. Master–detail stacks page with a URL per stack (/stacks/<name>), a stack search in the top bar, a new palette and type shared with the website, and a stack page with its services, commits, CI snippet and a security section with the stack's images and CVEs.
• Bulk actions. Select several stacks and run Pull, Redeploy or Pull + Redeploy on all of them, at most three at a time, with one summary message.
• Delete a stack. Remove a stack from Komodo from its page, with a two-click confirm. Only a signed-in session can do it; an API key gets 403.
• Live deploy activity. GET /api/v0/deploy/events streams deploys as they start and finish (SSE). The dashboard follows deploys started from CI or another tab without a refresh.
• History says who ran each action: a user or an API key (with the key's name). GET /api/v0/history/activity?days=30 returns the deploy events of the last 1 to 90 days for summaries.

Fixes

• Scan totals count each CVE once instead of once per affected package.
• The gateway keeps event streams out of compression so they arrive event by event.
• The bottom bar labels stay whole on narrow phones, and every route has one short page fade.

For contributors

• Frontend: entities layer for pieces shared by several features (stack, deploy-action, image-scan) instead of cross-feature imports, typed i18n and shared feedback, layout and table pieces.
• New image_scan table, applied automatically on startup.
• The backend image ships the trivy CLI at the same version as the trivy service (TRIVY_VERSION); the dev stack runs a trivy server too.
• New OpenSpec capability image-security; the overview, stacks, history and access specs follow the changes above.

Images

ghcr.io/nonetss/komodo-cd-backend:2.2.0
ghcr.io/nonetss/komodo-cd-frontend:2.2.0
ghcr.io/nonetss/komodo-cd-gateway:2.2.0

latest keeps tracking main. Pin the installer to this release with:

curl -fsSL https://raw.githubusercontent.com/Nonetss/Komodo-CD/v2.2.0/scripts/bootstrap.sh | KCD_REF=v2.2.0 bash

Upgrading

One new migration (the image_scan table), applied by the backend on startup. Back up the database first (see Upgrades and backups), then download the new compose.yml, which adds the trivy service and its trivy_cache volume, and recreate the stack:

curl -fsSL https://raw.githubusercontent.com/Nonetss/Komodo-CD/v2.2.0/compose.yml -o compose.yml
docker compose pull
docker compose up -d --remove-orphans

On its first start the Trivy server downloads its vulnerability database, so the first scans may fail for a minute; retry them from the Security page.

v2.0.0

A standalone gateway in front of the app, a hardened backend, and a project website with full docs: https://nonetss.github.io/Komodo-CD/

⚠️ Breaking changes

• The gateway is now its own image and service. Caddy used to run inside the frontend image; it now lives in ghcr.io/nonetss/komodo-cd-gateway, the only service that publishes a port. The new frontend image no longer listens on port 80, so you need the new compose.yml (see Upgrading).
• API keys can no longer manage the configuration. The Komodo connection, ntfy and API key endpoints (/api/v0/deploy/credentials*, /api/v0/apikeys) now require a signed-in session and answer 403 to an x-api-key. CI keys keep full access to what they need: POST /api/v0/deploy, GET /api/v0/stacks and GET /api/v0/history.
• BETTER_AUTH_SECRET must be at least 32 characters. A shorter secret makes the backend refuse to start. Generate one with openssl rand -base64 32 (the installer already did).
• CORS only allows the app's own URL (APP_URL) instead of reflecting any origin with credentials. The dashboard and CI (curl) are not affected.

Highlights

• Gateway with security headers: one origin for the dashboard and the API, nosniff, SAMEORIGIN framing, a strict referrer policy and a restrictive Permissions-Policy, with zstd/gzip compression and a /health endpoint.
• Health-ordered startup: every service has a healthcheck; the frontend waits for the backend and the gateway for both. init: true everywhere, so docker stop no longer hangs for 10 s.
• Graceful shutdown: in-flight requests get up to 5 s to finish, then the database is closed, always before Docker's kill.
• Better errors for CI: a Komodo failure answers 502 with Komodo's message, a missing connection 503, and deleting unknown credentials 404. Every response carries an x-request-id that matches the backend's log line for that request.
• Request bodies are capped at 1 MiB.
• Project website with a screenshot tour and documentation in English and Spanish: getting started, connecting Komodo, deploying from CI, Docker Compose, configuration, REST API, architecture, upgrades and backups, and development.

Fixes

• Installer: it checks for an existing .env before asking anything, reads ports like 08 as decimal, and warns when the public URL is plain http:// on a host other than localhost.

For contributors

• The whole repo is configured from one root .env (bun run setup:dev generates it); BETTER_AUTH_URL falls back to APP_URL.
• bun run dev starts a Docker dev stack behind the production gateway on http://localhost:4321; bun run dev:local keeps the native flow.
• A bun test suite for the API on an in-memory SQLite with the real migrations, and CI that runs Biome, type checks, tests and a migration check on every PR and before publishing images. Images are only rebuilt when their inputs change.
• OpenSpec specs for every capability in openspec/specs/.

Images

ghcr.io/nonetss/komodo-cd-backend:2.0.0
ghcr.io/nonetss/komodo-cd-frontend:2.0.0
ghcr.io/nonetss/komodo-cd-gateway:2.0.0

latest keeps tracking main. Pin the installer to this release with:

curl -fsSL https://raw.githubusercontent.com/Nonetss/Komodo-CD/v2.0.0/scripts/bootstrap.sh | KCD_REF=v2.0.0 bash

Upgrading

No migrations. Back up the database first (see Upgrades and backups), check that BETTER_AUTH_SECRET in your .env has at least 32 characters, then download the new compose.yml and recreate the stack:

curl -fsSL https://raw.githubusercontent.com/Nonetss/Komodo-CD/v2.0.0/compose.yml -o compose.yml
docker compose pull
docker compose up -d --remove-orphans

If a pipeline used an API key to read or change the Komodo connection, ntfy or API keys, do that from the dashboard instead.

v1.1.2

Fixes

• All stacks are listed on Komodo v2: Komodo v2 paginates ListStacks using Core's default_pagination_limit, so only the first page of stacks showed up (e.g. 50 out of 131) on the Stacks page, in the Deploy picker and in the Connection stack count. Komodo CD now asks Komodo for every stack (limit: 0). Komodo v1 doesn't paginate this endpoint and ignores the field.

Images

ghcr.io/nonetss/komodo-cd-backend:1.1.2
ghcr.io/nonetss/komodo-cd-frontend:1.1.2

latest keeps tracking main. Pin the installer to this release with:

curl -fsSL https://raw.githubusercontent.com/Nonetss/Komodo-CD/v1.1.2/scripts/bootstrap.sh | KCD_REF=v1.1.2 bash

Upgrading

No migrations. With the default compose.yml:

docker compose pull
docker compose up -d

v1.1.1

Fixes

• Deploy stack picker lists every stack: the combobox on the Deploy page only suggested the first 50 stacks (alphabetically) when opened without typing. It now shows all of them in a scrollable list. The backend and the Stacks page were not affected: they already returned and showed every stack.

Images

ghcr.io/nonetss/komodo-cd-backend:1.1.1
ghcr.io/nonetss/komodo-cd-frontend:1.1.1

latest keeps tracking main. Pin the installer to this release with:

curl -fsSL https://raw.githubusercontent.com/Nonetss/Komodo-CD/v1.1.1/scripts/bootstrap.sh | KCD_REF=v1.1.1 bash

Upgrading

No migrations. With the default compose.yml:

docker compose pull
docker compose up -d

v1.1.0

Get notified on ntfy when a deploy fails.

Highlights

• Failure alerts via ntfy: a new Notifications section on the Connection page lets you set an ntfy server (ntfy.sh or self-hosted), a topic and an optional access token (tk_…) for protected topics. Every failed deploy, whether triggered from CI or manually, sends a high-priority notification with the stack, the action, who launched it and Komodo's error message.
• Send test button, both before saving and on the saved configuration, plus Pause / Resume without losing the token.
• The token is stored on the server and never returned by the API. If ntfy is down or slow, the deploy is unaffected: the failure is only logged (5 s timeout).
• New API endpoints under /v0/deploy/credentials/ntfy (GET, POST, DELETE, and POST …/test), documented in OpenAPI.

Fixes

• The mobile bottom nav stays in place across page transitions.

Images

ghcr.io/nonetss/komodo-cd-backend:1.1.0
ghcr.io/nonetss/komodo-cd-frontend:1.1.0

latest keeps tracking main. Pin the installer to this release with:

curl -fsSL https://raw.githubusercontent.com/Nonetss/Komodo-CD/v1.1.0/scripts/bootstrap.sh | KCD_REF=v1.1.0 bash

Upgrading

The new ntfy table is created by a migration that runs automatically when the backend starts. With the default compose.yml:

docker compose pull
docker compose up -d

v1.0.0

First release of Komodo CD as a single monorepo, with a redesigned dashboard.

Highlights

• Monorepo: backend and frontend now live together (Turborepo + Bun workspaces) with shared api, auth, db, env and logger packages. The old komodo-cd-backend and komodo-cd-frontend repositories are superseded.
• Redesigned dashboard: responsive app shell with a sidebar, new Stacks, Deploy, History, Connection and API Keys pages, dark and light themes, English and Spanish UI, and page transitions.
• Stacks: search, filters with counts (running, stopped, with issues), one-click Pull / Redeploy / Pull + Redeploy, and a details panel with services, commit, repository and a ready-to-paste CI curl.
• Syntax-highlighted CI snippets with the placeholder to replace (<api-key>) called out; Pull + Redeploy is the default action.
• History timeline of every action launched from the dashboard or from CI.
• Interactive installer: scripts/bootstrap.sh generates .env with a random secret and downloads compose.yml.
• Faster navigation: SSR-hydrated islands, hover prefetch and a session cookie cache.
• Komodo error messages are surfaced in deploys and stack listings.

Images

ghcr.io/nonetss/komodo-cd-backend:1.0.0
ghcr.io/nonetss/komodo-cd-frontend:1.0.0

latest keeps tracking main. Pin the installer to this release with:

curl -fsSL https://raw.githubusercontent.com/Nonetss/Komodo-CD/v1.0.0/scripts/bootstrap.sh | KCD_REF=v1.0.0 bash

Upgrading

The GHCR packages were recreated under this repository, so older image versions are no longer available. With the default compose.yml:

docker compose pull
docker compose up -d