rconsole 1.4.3

rconsole 1.4.3

Added

• Music in the 📁 file browser. Clicking an audio file (mp3 wav ogg oga opus m4a aac flac weba) opens it in the
  same viewer as photos and videos, with the browser's audio player (play/pause, seeking, volume) under the song's
  name. ‹ › (or ←/→, swipe) now move through the folder's photos, videos and songs; the arrow keys are left to the
  player so they seek. Closing the viewer stops the sound. Nothing autoplays. A format the browser can't play shows a
  message and a download button.
• /api/media serves these audio types too: Range requests (so songs seek), Content-Disposition: inline, and the
  same sandboxing Content-Security-Policy. Other types are still refused with 415.

Changed

• Tests: the audio endpoint (types, Range, headers), the client/server extension lists staying in sync, and the viewer
  playing and skipping songs (tests/test_media_shell.py, tests/js/ui_check.js).

---

Host it yourself

Everything you need is in this release. Pick one:

1. Docker Compose with automatic HTTPS (any VPS)

curl -L https://github.com/Salehin-07/rconsole-ark/releases/download/v1.4.3/rconsole-1.4.3.tar.gz | tar xz
cd rconsole-1.4.3/deploy
cp .env.example .env && nano .env        # set RCONSOLE_DOMAIN and RCONSOLE_ADMIN_PASSWORD
docker compose up -d --build

2. Pull the image — no source needed (download docker-compose.yml, Caddyfile and env.example below)

cp env.example .env && nano .env         # set RCONSOLE_DOMAIN and RCONSOLE_ADMIN_PASSWORD
docker compose up -d

3. Just the container

docker run -d -p 5000:5000 -v rconsole-data:/data \
  -e RCONSOLE_ADMIN_PASSWORD='choose-a-strong-one' ghcr.io/salehin-07/rconsole-ark:1.4.3

(The image is built for amd64 and arm64. If docker pull is denied, the package is private: build from the
source archive instead, or make the package public in the repository's Packages settings.)

4. No Docker — extract the archive, uv sync, then uv run python serve.py
(see deploy/rconsole.service for systemd).

No budget? Rconsole is made to run your bots, sites and workers on a free tier (Render's free plan, with a
built-in keep-alive and encrypted backups to a private git repo). It cannot prevent provider restarts and loses
anything changed since the last backup. Start with FREE_HOSTING.md. Full documentation:
https://salehin-07.github.io/rconsole-ark/

Deploying to Railway, Fly.io, Kubernetes, AWS/GCP/Azure, a VPS or a Raspberry Pi? Follow DEPLOY.md.
All commands are documented in COMMANDS.md.

Assets

File	What
rconsole-1.4.3.tar.gz / .zip	the complete source: app, Dockerfile, deploy/ configs, docs, tests
docker-compose.yml, Caddyfile, env.example	the compose + HTTPS quick-start files on their own (pulls the image)
SHA256SUMS	checksums — verify with sha256sum -c SHA256SUMS

First login is ark with the password you set in RCONSOLE_ADMIN_PASSWORD (or ark/ark, which forces a change).

rconsole 1.4.2

rconsole 1.4.2

Added

• shell (admins only): opens an interactive window on the host shell, like vm shell does for a VM. It always
  targets the host, ignores the tab's current system, needs no sudo, and refuses normal users (also when
  RCONSOLE_ALLOW_USER_HOST is on). The launch is authorized again when the terminal starts.
• Photos and videos in the 📁 file browser. Clicking an image (png jpg jpeg gif webp bmp ico avif svg) shows it;
  clicking a video (mp4 m4v webm ogv mov) plays it in a player. Previous / next (buttons, ←/→, swipe) move through the
  folder's media, ⬇ downloads, Esc closes. New /api/media endpoint: login required, same path confinement as the rest
  of the file browser, whitelisted types only (others get 415), Range requests so videos seek, and a sandboxing
  Content-Security-Policy so an SVG can never run scripts. Unplayable codecs get a message and a download button.
• tests/test_media_shell.py.

Changed

• help lists shell; COMMANDS.md, FEATURES.md, README.md and structure.md describe the new command and the viewer.

Security

• /api/media serves only a fixed list of image and video types with Content-Security-Policy: sandbox and no
  script source, so even an SVG opened directly cannot run code with the console's session.

---

Host it yourself

Everything you need is in this release. Pick one:

1. Docker Compose with automatic HTTPS (any VPS)

curl -L https://github.com/Salehin-07/rconsole-ark/releases/download/v1.4.2/rconsole-1.4.2.tar.gz | tar xz
cd rconsole-1.4.2/deploy
cp .env.example .env && nano .env        # set RCONSOLE_DOMAIN and RCONSOLE_ADMIN_PASSWORD
docker compose up -d --build

2. Pull the image — no source needed (download docker-compose.yml, Caddyfile and env.example below)

cp env.example .env && nano .env         # set RCONSOLE_DOMAIN and RCONSOLE_ADMIN_PASSWORD
docker compose up -d

3. Just the container

docker run -d -p 5000:5000 -v rconsole-data:/data \
  -e RCONSOLE_ADMIN_PASSWORD='choose-a-strong-one' ghcr.io/salehin-07/rconsole-ark:1.4.2

(The image is built for amd64 and arm64. If docker pull is denied, the package is private: build from the
source archive instead, or make the package public in the repository's Packages settings.)

4. No Docker — extract the archive, uv sync, then uv run python serve.py
(see deploy/rconsole.service for systemd).

No budget? Rconsole is made to run your bots, sites and workers on a free tier (Render's free plan, with a
built-in keep-alive and encrypted backups to a private git repo). It cannot prevent provider restarts and loses
anything changed since the last backup. Start with FREE_HOSTING.md. Full documentation:
https://salehin-07.github.io/rconsole-ark/

Deploying to Railway, Fly.io, Kubernetes, AWS/GCP/Azure, a VPS or a Raspberry Pi? Follow DEPLOY.md.
All commands are documented in COMMANDS.md.

Assets

File	What
rconsole-1.4.2.tar.gz / .zip	the complete source: app, Dockerfile, deploy/ configs, docs, tests
docker-compose.yml, Caddyfile, env.example	the compose + HTTPS quick-start files on their own (pulls the image)
SHA256SUMS	checksums — verify with sha256sum -c SHA256SUMS

First login is ark with the password you set in RCONSOLE_ADMIN_PASSWORD (or ark/ark, which forces a change).

rconsole 1.4.1

rconsole 1.4.1

Added

• Arch Linux as a system (vm install arch, alias archlinux; also in vm install all and vm list). It is a
  rolling release, so there is exactly one release (arch). The root filesystem comes from the linuxcontainers mirrors
  (amd64 and arm64) and is verified against the published SHA-256, like Debian.
• Everything the other systems have works on Arch: vm shell/run/use/status/doctor/reset/remove, per-user /root,
  neofetch/fetch (with an Arch logo and the pacman package count), vm setup <profile> for tools, build,
  python, node, rust, db, all, docker and udocker (Arch package names; the real Docker client comes
  from Docker's static build because Arch has no client-only package), vm update (a full pacman -Syu with the
  usual lock, snapshot, verify and rollback) and the dependency backup/restore (pacman -Qqen is recorded and
  reinstalled after a restore).
• pacman works under proot out of the box: the space check, the download user and the sandbox are switched off (a
  fake root has no real mounts or users), signature checking stays on, systemd/udev hooks that cannot run in a VM
  are turned into no-ops, a mirror is written if none is active, and the first pacman -S creates the signing keys
  by itself (/usr/local/bin/pacman wrapper, the real one stays at /usr/bin/pacman).
• tests/test_arch.py.

Fixed

• Arch: pacman-key failed with /dev/fd/63: No such file or directory on hosts where a VM has no PID namespace of
  its own (bash process substitution needs /dev/fd -> /proc/self/fd, which the restricted /proc lacks). The host
  now creates the signing keys itself, with a fixed command, at vm install arch and on vm update arch (which also
  repairs a half-made keyring). Inside the VM, pacman says to run vm update arch instead of printing errors.

Changed

• vm list wraps its heading lines to the screen width (the longer Arch line overflowed a 34-column phone).

Removed

• A Bengali-script alias for Kali (code, docs, tests and wiki). kali, kali-linux and kalilinux still work.

Notes

• Arch is not tested in a real VM yet: the rootfs download is not reachable from the build sandbox. Everything else is
  covered by tests with faked mirrors.

---

Host it yourself

Everything you need is in this release. Pick one:

1. Docker Compose with automatic HTTPS (any VPS)

curl -L https://github.com/Salehin-07/rconsole-ark/releases/download/v1.4.1/rconsole-1.4.1.tar.gz | tar xz
cd rconsole-1.4.1/deploy
cp .env.example .env && nano .env        # set RCONSOLE_DOMAIN and RCONSOLE_ADMIN_PASSWORD
docker compose up -d --build

2. Pull the image — no source needed (download docker-compose.yml, Caddyfile and env.example below)

cp env.example .env && nano .env         # set RCONSOLE_DOMAIN and RCONSOLE_ADMIN_PASSWORD
docker compose up -d

3. Just the container

docker run -d -p 5000:5000 -v rconsole-data:/data \
  -e RCONSOLE_ADMIN_PASSWORD='choose-a-strong-one' ghcr.io/salehin-07/rconsole-ark:1.4.1

(The image is built for amd64 and arm64. If docker pull is denied, the package is private: build from the
source archive instead, or make the package public in the repository's Packages settings.)

4. No Docker — extract the archive, uv sync, then uv run python serve.py
(see deploy/rconsole.service for systemd).

No budget? Rconsole is made to run your bots, sites and workers on a free tier (Render's free plan, with a
built-in keep-alive and encrypted backups to a private git repo). It cannot prevent provider restarts and loses
anything changed since the last backup. Start with FREE_HOSTING.md. Full documentation:
https://salehin-07.github.io/rconsole-ark/

Deploying to Railway, Fly.io, Kubernetes, AWS/GCP/Azure, a VPS or a Raspberry Pi? Follow DEPLOY.md.
All commands are documented in COMMANDS.md.

Assets

File	What
rconsole-1.4.1.tar.gz / .zip	the complete source: app, Dockerfile, deploy/ configs, docs, tests
docker-compose.yml, Caddyfile, env.example	the compose + HTTPS quick-start files on their own (pulls the image)
SHA256SUMS	checksums — verify with sha256sum -c SHA256SUMS

First login is ark with the password you set in RCONSOLE_ADMIN_PASSWORD (or ark/ark, which forces a change).

rconsole 1.4.0

rconsole 1.4.0

Added

• Admin dashboard at /dashboard (admins only). One page to watch the whole instance, live (refreshes every 5 s):
  • Overview: CPU, memory, disk and network (container-aware: cgroup limits, so it shows what your plan allows),
    load, process count, users online, running terminals / jobs / services, uptime, alerts (CPU or memory
    pegged, disk nearly full, a service stuck in crash backoff, a failed system, backups unconfigured or failing, the
    factory ark password still in use) and one hour of history as graphs (5 / 15 / 60 min).
  • Processes: every service (restart, stop, start, remove, logs), every job (output, kill), every open terminal
    (close) and the busiest host processes with CPU %, memory and which user / job / terminal they belong to.
  • Users: who is online and when they were last seen, per-user terminals, jobs, services, apps and systems;
    create users, promote and demote admins, reset passwords, stop everything a user runs, delete users — the web
    counterpart of sudo muser, auser, nauser, cpass and ruser (they share the same code).
  • Systems: every user's Linux systems with state and per-system process list (stop a process), and disk usage by
    area (each system, backups, logs ...), measured in the background.
  • Apps: exposed ports with a live "is anything listening?" check, and hosted apps.
  • Activity: an audit trail of logins (also failed and locked-out ones), logouts, and every account or process
    change made from the dashboard or with sudo commands. Kept in memory and in logs/audit.jsonl (rotated at 1 MB).
  • Health: server facts, backups (with a "Back up now" button), keep-alive and update status.
• Logout button next to the theme and system buttons (in the ⚙ menu on phones). It does exactly what the
  logout command does (POST /api/logout): ends the login, keeps your terminals and data.
• Dashboard link in the ⚙ menu, rendered only for admins. The ⚙ button now also shows on wide screens for admins.
• RCONSOLE_METRICS_INTERVAL (default 5): seconds between dashboard samples.
• tests/test_dashboard.py (access control, every section, every action, audit trail, logout) and jsdom checks
  tests/js/dashboard_check.js plus new menu / logout checks in tests/js/ui_check.js.

Design

• Dashboard: cards with a status-coloured top edge and a trend line under each meter, graphs with dashed
  gridlines and a hover / touch readout of the nearest sample, status pills, alert banners with icons, a pulsing
  live indicator, a pill-style tab bar, focus rings and reduced-motion support. Colours come from the console theme
  variables, so all 17 themes work.
• Dashboard on phones: a bottom tab bar with icons, two-column meter cards, every table turns into one labelled
  card per row, dialogs open as bottom sheets, and tap targets are at least 36 px.
• Logout button with a power icon that turns red on hover; in the ⚙ menu it is a full-width outlined button. The
  Dashboard link in the menu is now a highlighted row with an icon, a one-line description and an arrow.

Changed

• sudo auser, nauser, muser, cpass and ruser now also write to the audit trail. ruser shares its
  implementation with the dashboard (cmd_users.remove_user).
• Non-admins get a plain 404 for /dashboard and 403 for its API; the page link is never sent to them.
• The dashboard refuses to demote, delete or stop yourself (use sudo nauser / ruser); the last admin was
  already protected.

---

Host it yourself

Everything you need is in this release. Pick one:

1. Docker Compose with automatic HTTPS (any VPS)

curl -L https://github.com/Salehin-07/rconsole-ark/releases/download/v1.4.0/rconsole-1.4.0.tar.gz | tar xz
cd rconsole-1.4.0/deploy
cp .env.example .env && nano .env        # set RCONSOLE_DOMAIN and RCONSOLE_ADMIN_PASSWORD
docker compose up -d --build

2. Pull the image — no source needed (download docker-compose.yml, Caddyfile and env.example below)

cp env.example .env && nano .env         # set RCONSOLE_DOMAIN and RCONSOLE_ADMIN_PASSWORD
docker compose up -d

3. Just the container

docker run -d -p 5000:5000 -v rconsole-data:/data \
  -e RCONSOLE_ADMIN_PASSWORD='choose-a-strong-one' ghcr.io/salehin-07/rconsole-ark:1.4.0

(The image is built for amd64 and arm64. If docker pull is denied, the package is private: build from the
source archive instead, or make the package public in the repository's Packages settings.)

4. No Docker — extract the archive, uv sync, then uv run python serve.py
(see deploy/rconsole.service for systemd).

No budget? Rconsole is made to run your bots, sites and workers on a free tier (Render's free plan, with a
built-in keep-alive and encrypted backups to a private git repo). It cannot prevent provider restarts and loses
anything changed since the last backup. Start with FREE_HOSTING.md. Full documentation:
https://salehin-07.github.io/rconsole-ark/

Deploying to Railway, Fly.io, Kubernetes, AWS/GCP/Azure, a VPS or a Raspberry Pi? Follow DEPLOY.md.
All commands are documented in COMMANDS.md.

Assets

File	What
rconsole-1.4.0.tar.gz / .zip	the complete source: app, Dockerfile, deploy/ configs, docs, tests
docker-compose.yml, Caddyfile, env.example	the compose + HTTPS quick-start files on their own (pulls the image)
SHA256SUMS	checksums — verify with sha256sum -c SHA256SUMS

First login is ark with the password you set in RCONSOLE_ADMIN_PASSWORD (or ark/ark, which forces a change).

rconsole 1.3.11

rconsole 1.3.11

Added

• Tests for the journalctl, systemd-hwdb and udevadm shims (JournalctlShimTests, HwdbShimTests).

Fixed

• Setting up systemd printed /proc/ is not mounted and Failed to update catalog in Debian, Ubuntu and Kali
  VMs. systemd's install script runs journalctl --update-catalog, which has nothing to do in a VM (no journal, no
  real /proc mount). Debian-family VMs now get a journalctl shim in /usr/local/bin that skips just that call;
  every other journalctl command runs the real binary. Existing VMs get it on their next launch.
• Setting up udev printed Failed to write database /usr/lib/udev/hwdb.bin: Function not implemented. The
  hardware database cannot be written under proot and a VM has no hardware to describe. Debian-family VMs now get
  systemd-hwdb and udevadm shims that skip only update / hwdb --update; every other call runs the real tool.

---

Host it yourself

Everything you need is in this release. Pick one:

1. Docker Compose with automatic HTTPS (any VPS)

curl -L https://github.com/Salehin-07/rconsole-ark/releases/download/v1.3.11/rconsole-1.3.11.tar.gz | tar xz
cd rconsole-1.3.11/deploy
cp .env.example .env && nano .env        # set RCONSOLE_DOMAIN and RCONSOLE_ADMIN_PASSWORD
docker compose up -d --build

2. Pull the image — no source needed (download docker-compose.yml, Caddyfile and env.example below)

cp env.example .env && nano .env         # set RCONSOLE_DOMAIN and RCONSOLE_ADMIN_PASSWORD
docker compose up -d

3. Just the container

docker run -d -p 5000:5000 -v rconsole-data:/data \
  -e RCONSOLE_ADMIN_PASSWORD='choose-a-strong-one' ghcr.io/salehin-07/rconsole-ark:1.3.11

(The image is built for amd64 and arm64. If docker pull is denied, the package is private: build from the
source archive instead, or make the package public in the repository's Packages settings.)

4. No Docker — extract the archive, uv sync, then uv run python serve.py
(see deploy/rconsole.service for systemd).

No budget? Rconsole is made to run your bots, sites and workers on a free tier (Render's free plan, with a
built-in keep-alive and encrypted backups to a private git repo). It cannot prevent provider restarts and loses
anything changed since the last backup. Start with FREE_HOSTING.md. Full documentation:
https://salehin-07.github.io/rconsole-ark/

Deploying to Railway, Fly.io, Kubernetes, AWS/GCP/Azure, a VPS or a Raspberry Pi? Follow DEPLOY.md.
All commands are documented in COMMANDS.md.

Assets

File	What
rconsole-1.3.11.tar.gz / .zip	the complete source: app, Dockerfile, deploy/ configs, docs, tests
docker-compose.yml, Caddyfile, env.example	the compose + HTTPS quick-start files on their own (pulls the image)
SHA256SUMS	checksums — verify with sha256sum -c SHA256SUMS

First login is ark with the password you set in RCONSOLE_ADMIN_PASSWORD (or ark/ark, which forces a change).

rconsole 1.3.10

rconsole 1.3.10

Added

• Tests for the ln shim, the /proc whitelist and the games PATH (KaliLoginNoiseTests).

Changed

• VMs start in /home (new tabs, the interactive window, vm run, services without --cwd, and the fallback when a
  directory is missing). The host shell is unchanged (/home/rconsole), and $HOME and cd ~ inside a VM are still
  /root. /home is created in VMs that lack it.

Fixed

• Kali VM printed errors on start and after every command (ln: failed to create symbolic link '/dev/fd': Permission denied, same for /dev/stdin, /dev/stdout, /dev/stderr, and bash: /proc/sys/kernel/random/uuid: No such file or directory, same for boot_id). Kali's login scripts try to re-create the standard /dev links (the host's
  /dev is read-only here and already has them) and read two kernel files that the restricted /proc did not expose.
  VMs now get a small ln shim in /usr/local/bin that skips those four links when they already exist, and the
  restricted /proc now includes sys/kernel/random/uuid and boot_id (harmless, random values). Existing VMs get
  the shim on their next launch.
• Programs in /usr/games were "command not found" on Debian, Ubuntu and Kali (apt install sl then sl).
  Debian's /etc/profile resets root's PATH without /usr/games and /usr/local/games; Alpine installs to
  /usr/bin, which is why it was unaffected. Both directories are now always on PATH (line mode, login shells and
  scripts).

---

Host it yourself

Everything you need is in this release. Pick one:

1. Docker Compose with automatic HTTPS (any VPS)

curl -L https://github.com/Salehin-07/rconsole-ark/releases/download/v1.3.10/rconsole-1.3.10.tar.gz | tar xz
cd rconsole-1.3.10/deploy
cp .env.example .env && nano .env        # set RCONSOLE_DOMAIN and RCONSOLE_ADMIN_PASSWORD
docker compose up -d --build

2. Pull the image — no source needed (download docker-compose.yml, Caddyfile and env.example below)

cp env.example .env && nano .env         # set RCONSOLE_DOMAIN and RCONSOLE_ADMIN_PASSWORD
docker compose up -d

3. Just the container

docker run -d -p 5000:5000 -v rconsole-data:/data \
  -e RCONSOLE_ADMIN_PASSWORD='choose-a-strong-one' ghcr.io/salehin-07/rconsole-ark:1.3.10

(The image is built for amd64 and arm64. If docker pull is denied, the package is private: build from the
source archive instead, or make the package public in the repository's Packages settings.)

4. No Docker — extract the archive, uv sync, then uv run python serve.py
(see deploy/rconsole.service for systemd).

No budget? Rconsole is made to run your bots, sites and workers on a free tier (Render's free plan, with a
built-in keep-alive and encrypted backups to a private git repo). It cannot prevent provider restarts and loses
anything changed since the last backup. Start with FREE_HOSTING.md. Full documentation:
https://salehin-07.github.io/rconsole-ark/

Deploying to Railway, Fly.io, Kubernetes, AWS/GCP/Azure, a VPS or a Raspberry Pi? Follow DEPLOY.md.
All commands are documented in COMMANDS.md.

Assets

File	What
rconsole-1.3.10.tar.gz / .zip	the complete source: app, Dockerfile, deploy/ configs, docs, tests
docker-compose.yml, Caddyfile, env.example	the compose + HTTPS quick-start files on their own (pulls the image)
SHA256SUMS	checksums — verify with sha256sum -c SHA256SUMS

First login is ark with the password you set in RCONSOLE_ADMIN_PASSWORD (or ark/ark, which forces a change).

rconsole 1.3.9

rconsole 1.3.9

Fixed

• RCONSOLE_BACKUP_TOKEN and RCONSOLE_BACKUP_PASSPHRASE reached host child processes. The docs said server
  secrets never reach user commands, hosted apps or services, but only four secrets were stripped. Both are now removed
  from the environment of every command, terminal, job, service and hosted app on the host shell (VMs never inherited
  the server environment). Backups are unaffected: the backup engine reads them itself.
• Documentation contradicted the code and itself. README still described the shared PID namespace removed in
  1.3.8; DEPLOY said the free Render blueprint has a 5 GB disk (only render.paid.yaml does); "never sleeps",
  "as many VMs as you like", "services survive redeploys" and "open terminals reconnect" promised more than the
  implementation does; the architecture diagram said Alpine only; RCONSOLE_VM_ROOTFS_URL was documented as an
  Alpine-only default; the README listed Python 3.12 as passing though 3.14 is required; the shutdown backup was
  documented as 25 s (it waits about 22 s); Koyeb was listed as a free option for new users; the settings tables
  omitted RCONSOLE_VM_PIDNS, RCONSOLE_RESTORE_DEPS, RCONSOLE_UPDATE_API, RCONSOLE_LOG_LEVEL,
  RCONSOLE_DOMAIN, RCONSOLE_VERSION and the Docker-shim variables, and gave wrong defaults for
  RCONSOLE_TRUST_PROXY, RCONSOLE_COOKIE_SECURE and RCONSOLE_USER_VM_PROC.

Added

• Documentation website (GitHub Pages, https://salehin-07.github.io/rconsole-ark/) built from the repository's
  own Markdown by scripts/build_docs.py: quick start, guides, command reference, search, dark mode, mobile layout.
  New pages: backups and restore, updating and rollback, configuration, security model, architecture, compatibility.
• SECURITY.md (how to report a vulnerability).
• One authoritative environment-variable list (scripts/envvars.py); the tables in README, FEATURES and the site
  are generated from it, and tests fail when the code, the list or any document disagree.
• Documentation tests for cross-document facts: version, Python version, Render blueprints, backup limits, release
  asset names, per-user limits, secret stripping, broken links.

Notes

• No restart-sensitive behaviour changed apart from the secret stripping. Host-shell scripts that read
  RCONSOLE_BACKUP_TOKEN or RCONSOLE_BACKUP_PASSPHRASE from the environment must now get them another way.
• Enable the site once: repository Settings → Pages → Source: GitHub Actions.

---

Host it yourself

Everything you need is in this release. Pick one:

1. Docker Compose with automatic HTTPS (any VPS)

curl -L https://github.com/Salehin-07/rconsole-ark/releases/download/v1.3.9/rconsole-1.3.9.tar.gz | tar xz
cd rconsole-1.3.9/deploy
cp .env.example .env && nano .env        # set RCONSOLE_DOMAIN and RCONSOLE_ADMIN_PASSWORD
docker compose up -d --build

2. Pull the image — no source needed (download docker-compose.yml, Caddyfile and env.example below)

cp env.example .env && nano .env         # set RCONSOLE_DOMAIN and RCONSOLE_ADMIN_PASSWORD
docker compose up -d

3. Just the container

docker run -d -p 5000:5000 -v rconsole-data:/data \
  -e RCONSOLE_ADMIN_PASSWORD='choose-a-strong-one' ghcr.io/salehin-07/rconsole-ark:1.3.9

(The image is built for amd64 and arm64. If docker pull is denied, the package is private: build from the
source archive instead, or make the package public in the repository's Packages settings.)

4. No Docker — extract the archive, uv sync, then uv run python serve.py
(see deploy/rconsole.service for systemd).

No budget? Rconsole is made to run your bots, sites and workers on a free tier (Render's free plan, with a
built-in keep-alive and encrypted backups to a private git repo). It cannot prevent provider restarts and loses
anything changed since the last backup. Start with FREE_HOSTING.md. Full documentation:
https://salehin-07.github.io/rconsole-ark/

Deploying to Railway, Fly.io, Kubernetes, AWS/GCP/Azure, a VPS or a Raspberry Pi? Follow DEPLOY.md.
All commands are documented in COMMANDS.md.

Assets

File	What
rconsole-1.3.9.tar.gz / .zip	the complete source: app, Dockerfile, deploy/ configs, docs, tests
docker-compose.yml, Caddyfile, env.example	the compose + HTTPS quick-start files on their own (pulls the image)
SHA256SUMS	checksums — verify with sha256sum -c SHA256SUMS

First login is ark with the password you set in RCONSOLE_ADMIN_PASSWORD (or ark/ark, which forces a change).

rconsole 1.3.8

rconsole 1.3.8

Fixed

• VMs shared one PID space. Every VM of every user ran in the server's PID namespace: an admin's VM listed
  everyone's processes (the server, other users' VMs) and kill (even kill -9 -1) reached them all. Each VM now
  gets its own PID namespace (unshare --user --pid, new pidns.py, init in pidns_init.py): inside a VM
  ps, top, kill and /proc show only that VM's processes, with PIDs starting at 1, and kill -9 -1 only
  reaches that VM. All commands of one VM (terminals, jobs, services, hosted apps) share its namespace, so a
  service started in one terminal is visible from another. The namespace's init reaps zombies and exits when the
  server dies, so nothing is orphaned.
• On a host that forbids user namespaces rconsole still works, without isolation: it says so in vm doctor
  (pid ns: line), and admins' VMs no longer get the host's whole /proc (everyone gets only the harmless
  system files, as normal users already did). Use vm ps / vm kill there. RCONSOLE_VM_PIDNS=off restores the
  old behaviour, on is the same as auto but documents intent.
• A restore could start services on a half-built VM. After a redeploy a VM was marked ready as soon as its system
  was reinstalled, so a service could start before its vm setup profiles were back and crash-loop. A VM is now
  locked in a restoring state (set before the supervisor's first pass) until its system, setups and
  packages are back; its services wait, then start by themselves.

Added

• Dependency manifest per VM (deps.json, part of every backup, new vmdeps.py): before each backup rconsole
  records what is installed in each VM — manually installed system packages (apk world / apt-mark showmanual),
  pip packages of the system Python, global npm packages, every Python virtualenv under /root with its
  packages, and every Node project that had a node_modules (with its lockfile type). node_modules and
  virtualenvs are not in backups, so this list is what brings them back. It is refreshed only when something
  changed (directory mtimes), never while a VM is being restored, and a partial restore never makes it forget
  what could not be reinstalled.
• Full restore: after a redeploy each VM is rebuilt, its profiles re-applied, then everything in its manifest
  reinstalled (apk add/apt-get install, pip install -r, npm install -g, venvs recreated, npm ci / yarn /
  pnpm install in projects). Failures are per item, logged, and shown by vm deps. RCONSOLE_RESTORE_DEPS=0 skips it.
• vm ps [name], vm kill <pid> [name] [--9], vm deps [name] (capture / restore run it now).
• vm doctor and vm status show the PID-namespace mode and the restoring state.
• Tests: PID isolation between VMs and users, kill -1 containment, the no-namespace fallback, manifest
  parsing/merge/restore script, and "services wait for a full restore".

Notes

• The Docker image now installs util-linux explicitly (unshare, nsenter). Docker's default seccomp profile
  blocks user namespaces: on plain Docker add --security-opt seccomp=unconfined (or a profile allowing
  unshare/setns) to get isolation; vm doctor tells you which mode you are in. Not verified on Render.
• Not captured: files outside /root (/etc, /opt, /usr/local), custom apt repositories, and host-shell
  packages (admin host mode). Keep projects under /root.

---

Host it yourself

Everything you need is in this release. Pick one:

1. Docker Compose with automatic HTTPS (any VPS)

curl -L https://github.com/Salehin-07/rconsole-ark/releases/download/v1.3.8/rconsole-1.3.8.tar.gz | tar xz
cd rconsole-1.3.8/deploy
cp .env.example .env && nano .env        # set RCONSOLE_DOMAIN and RCONSOLE_ADMIN_PASSWORD
docker compose up -d --build

2. Pull the image — no source needed (download docker-compose.yml, Caddyfile and env.example below)

cp env.example .env && nano .env         # set RCONSOLE_DOMAIN and RCONSOLE_ADMIN_PASSWORD
docker compose up -d

3. Just the container

docker run -d -p 5000:5000 -v rconsole-data:/data \
  -e RCONSOLE_ADMIN_PASSWORD='choose-a-strong-one' ghcr.io/salehin-07/rconsole-ark:1.3.8

(The image is built for amd64 and arm64. If docker pull is denied, the package is private: build from the
source archive instead, or make the package public in the repository's Packages settings.)

4. No Docker — extract the archive, uv sync, then uv run python serve.py
(see deploy/rconsole.service for systemd).

No budget? rconsole is made to run your bots, sites and workers on a free tier (Render's free plan, with a
built-in keep-alive and encrypted backups to a private git repo). Start with FREE_HOSTING.md.

Deploying to Railway, Fly.io, Kubernetes, AWS/GCP/Azure, a VPS or a Raspberry Pi? Follow DEPLOY.md.
All commands are documented in COMMANDS.md.

Assets

File	What
rconsole-1.3.8.tar.gz / .zip	the complete source: app, Dockerfile, deploy/ configs, docs, tests
docker-compose.yml, Caddyfile, env.example	the compose + HTTPS quick-start files on their own (pulls the image)
SHA256SUMS	checksums — verify with sha256sum -c SHA256SUMS

First login is ark with the password you set in RCONSOLE_ADMIN_PASSWORD (or ark/ark, which forces a change).

rconsole 1.3.7

rconsole 1.3.7

Added

• RCONSOLE_HOST_HOME (default /home/rconsole): where the host shell starts.
• tests/test_cwd.py: default directories, ending a terminal keeps the tab, and a real host shell's directory
  carried back on exit.

Changed

• Default directories: the host shell now starts in /home/rconsole, a VM in /root. In the Docker image
  /home/rconsole is linked to the persistent workspace (<data>/workspace) by the entrypoint, so what you keep
  there is still part of every backup; where /home/rconsole does not exist or is not writable (a plain
  install), the host falls back to <data>/workspace as before. RCONSOLE_HOST_HOME overrides the path.
  This needs a redeploy / container restart (the entrypoint runs at start).
• File manager: the always-visible ☑ button next to the new file / folder buttons and the All button in the
  selection bar are gone. A select-all checkbox now appears at the start of the selection bar once at least one
  item is selected (empty, or ticked when everything is selected; clicking it selects all / none), like other file managers. Ctrl/Cmd+A still works.
• The login logo is smaller (96 px, was 132 px).
• The app is called Rconsole in the PWA manifest (installed app name), the home-screen title, the page titles
  and the README.

Fixed

• The prompt in a VM's interactive window no longer shows the server's long host id and a bare #. It reads
  <system>@root:<dir># (ubuntu@root:~#, alpine@root:/etc#), coloured in bash. It comes from a managed
  ~/.rconsole_prompt that .bashrc / .profile load (existing VMs get it on their next launch; the old
  per-VM PS1= line is retired).
• Returning from an interactive window no longer resets the directory. Ending a terminal session used to delete
  the tab on the server, so the next command ran in a new tab in the default directory (and the tab's history was
  lost). The tab is kept now. On the host the directory the shell ended in is carried back too (cd inside
  bash, then exit); inside a VM the console returns to the directory the window was opened from.

---

Host it yourself

Everything you need is in this release. Pick one:

1. Docker Compose with automatic HTTPS (any VPS)

curl -L https://github.com/Salehin-07/rconsole-ark/releases/download/v1.3.7/rconsole-1.3.7.tar.gz | tar xz
cd rconsole-1.3.7/deploy
cp .env.example .env && nano .env        # set RCONSOLE_DOMAIN and RCONSOLE_ADMIN_PASSWORD
docker compose up -d --build

2. Pull the image — no source needed (download docker-compose.yml, Caddyfile and env.example below)

cp env.example .env && nano .env         # set RCONSOLE_DOMAIN and RCONSOLE_ADMIN_PASSWORD
docker compose up -d

3. Just the container

docker run -d -p 5000:5000 -v rconsole-data:/data \
  -e RCONSOLE_ADMIN_PASSWORD='choose-a-strong-one' ghcr.io/salehin-07/rconsole-ark:1.3.7

(The image is built for amd64 and arm64. If docker pull is denied, the package is private: build from the
source archive instead, or make the package public in the repository's Packages settings.)

4. No Docker — extract the archive, uv sync, then uv run python serve.py
(see deploy/rconsole.service for systemd).

No budget? rconsole is made to run your bots, sites and workers on a free tier (Render's free plan, with a
built-in keep-alive and encrypted backups to a private git repo). Start with FREE_HOSTING.md.

Deploying to Railway, Fly.io, Kubernetes, AWS/GCP/Azure, a VPS or a Raspberry Pi? Follow DEPLOY.md.
All commands are documented in COMMANDS.md.

Assets

File	What
rconsole-1.3.7.tar.gz / .zip	the complete source: app, Dockerfile, deploy/ configs, docs, tests
docker-compose.yml, Caddyfile, env.example	the compose + HTTPS quick-start files on their own (pulls the image)
SHA256SUMS	checksums — verify with sha256sum -c SHA256SUMS

First login is ark with the password you set in RCONSOLE_ADMIN_PASSWORD (or ark/ark, which forces a change).

rconsole 1.3.6

rconsole 1.3.6

Added

• Select, compress, extract and Properties in the 📁 file manager, working like a desktop file manager:
  • Selecting. Click the blank space of a row to select it (the name still opens the file or folder);
    Ctrl/Cmd+click toggles, Shift+click selects a range, dragging a rectangle selects every row it touches
    (Ctrl/Shift+drag adds; it auto-scrolls near the edges), double-click opens. On phones and tablets a
    long-press selects a row and dragging without lifting sweeps over more rows; after that a tap toggles rows
    and tapping a name selects instead of opening, so nothing opens by accident. A plain tap on blank space does
    nothing while nothing is selected, so scrolling never selects. Select all (the ☑ button, or Ctrl/Cmd+A),
    Esc clears the selection (a second Esc closes the browser), and the Delete key deletes it.
  • A selection bar with the item count and total size and: All, Compress, Extract (only when
    every selected item is an archive), Properties (only when exactly one item is selected), Delete
    (one confirmation for the whole selection) and ✕.
  • Compress to zip, tar, tar.gz, tar.bz2, tar.xz, tar.zst (Python 3.14+), 7z, RAR and the one-file
    gz, bz2, xz, zst. Only formats that work on the server are offered; one-file formats are greyed out unless
    exactly one plain file is selected; the default name follows the selection; an existing archive is never
    overwritten (name (2).zip). Symlinks are stored as links, never followed.
  • Extract zip (also jar, war, ear, apk, whl, egg), tar, tar.gz/bz2/xz, gz, bz2, xz, zst and, through bsdtar,
    7z, RAR (RAR3 and RAR5), CAB, ISO, CPIO, DEB, RPM, LZH, XAR. Extract to a new folder (an archive with
    exactly one top folder becomes that folder, otherwise a folder named after the archive) or Extract here
    (never overwrites; skipped entries are counted).
  • Properties: type, location, size (folders counted without following links), size on disk, modified /
    accessed / changed, permissions (-rw-r--r-- and octal), owner and group, link target, MIME type and, for zip
    and tar archives, the number of entries and their unpacked size.
  • Compress and extract run as background jobs with a progress bar and a Cancel button (temp files are
    removed); one job per user at a time. New endpoints: GET /api/props, POST /api/archive,
    GET /api/archive/<id>, POST /api/archive/<id>/cancel, and the delete_many action of /api/fs.
• RCONSOLE_MAX_EXTRACT_MB (default 2048): the most an archive may expand to when extracted (zip-bomb guard).
• fileops.py (the engine, standard library only) and static/files-core.js (the selection logic, DOM-free), with
  tests: tests/test_fileops.py (46), tests/test_fileman_api.py, tests/js/files_check.js (15) and a larger
  tests/js/ui_check.js that drives the real handlers (click, ctrl/shift, rectangle, long-press, dialogs).
• The Docker image now installs libarchive-tools (bsdtar), which gives 7z creation and 7z / RAR / CAB / ISO
  extraction. This is a Dockerfile change, so it needs a redeploy; the self-updater does not install packages.
  Without bsdtar those formats are simply not offered (zip, tar and gz/bz2/xz always work).

Changed

• New logo everywhere: favicon, home-screen / PWA icons (including an Android maskable icon), the iOS
  touch icon, the login page (it showed ASCII art) and the README. static/icon.svg is gone.
• The editor's font-size buttons moved to the top bar next to Save and Close and are now just − and +
  (the size is in their tooltip; it is still remembered and still 16 px minimum on iOS).
• In a file row, the name now only takes the room it needs; the free space to its right is the click target for
  selecting.

Safety

• Extraction cannot escape the folder it is given. Every member is created relative to a directory file
  descriptor with O_NOFOLLOW, so the classic "symlink, then a file below the symlink" archive writes nothing
  outside. .., absolute and Windows drive-letter names are refused; devices, FIFOs and hard links are skipped;
  setuid bits are dropped; files are never overwritten; the expanded size, the entry count (200,000) and the free
  disk space are all checked while writing (zip and gzip bombs stop early). All of it is tested with crafted archives.
• Confined (VM) users only get bsdtar for the external formats, because it refuses to write through symlinks
  by default; 7-Zip, unrar, unar and rar are used only for the host admin. 7z / RAR creation is refused for
  trees that contain symlinks, since those tools may follow them out of the folder.
• Archives are written to a hidden temp file and renamed into place, so an interrupted job never leaves a
  half-written archive.

Fixed

• test_download_and_upload_are_confined_to_the_vm sat inside the if __name__ == "__main__": block of
  tests/test_app.py, so it never ran under test discovery. It now does (it needs proot, so it is skipped
  where proot is missing, exactly like its neighbours).

Known limits

• RAR files cannot be created without WinRAR's proprietary rar tool, so RAR only appears in the Compress
  list for an admin who installed rar. Extraction works (via bsdtar).
• Password-protected archives are not supported (the job says so).
• There is no right-click menu, copy / cut / paste or drag-and-drop of files between folders yet.
• Folder sizes in Properties stop counting after 3 seconds or 500,000 entries and say so.
• Zstandard (tar.zst, .zst) needs Python 3.14 (the Docker image and CI have it).
• Touch behaviour was tested with simulated touch events (jsdom), not on a real phone. The long-press drag relies on
  the browser letting the page cancel scrolling once the long-press fired, which Chrome and Safari allow.

---

Host it yourself

Everything you need is in this release. Pick one:

1. Docker Compose with automatic HTTPS (any VPS)

curl -L https://github.com/Salehin-07/rconsole-ark/releases/download/v1.3.6/rconsole-1.3.6.tar.gz | tar xz
cd rconsole-1.3.6/deploy
cp .env.example .env && nano .env        # set RCONSOLE_DOMAIN and RCONSOLE_ADMIN_PASSWORD
docker compose up -d --build

2. Pull the image — no source needed (download docker-compose.yml, Caddyfile and env.example below)

cp env.example .env && nano .env         # set RCONSOLE_DOMAIN and RCONSOLE_ADMIN_PASSWORD
docker compose up -d

3. Just the container

docker run -d -p 5000:5000 -v rconsole-data:/data \
  -e RCONSOLE_ADMIN_PASSWORD='choose-a-strong-one' ghcr.io/salehin-07/rconsole-ark:1.3.6

(The image is built for amd64 and arm64. If docker pull is denied, the package is private: build from the
source archive instead, or make the package public in the repository's Packages settings.)

4. No Docker — extract the archive, uv sync, then uv run python serve.py
(see deploy/rconsole.service for systemd).

No budget? rconsole is made to run your bots, sites and workers on a free tier (Render's free plan, with a
built-in keep-alive and encrypted backups to a private git repo). Start with FREE_HOSTING.md.

Deploying to Railway, Fly.io, Kubernetes, AWS/GCP/Azure, a VPS or a Raspberry Pi? Follow DEPLOY.md.
All commands are documented in COMMANDS.md.

Assets

File	What
rconsole-1.3.6.tar.gz / .zip	the complete source: app, Dockerfile, deploy/ configs, docs, tests
docker-compose.yml, Caddyfile, env.example	the compose + HTTPS quick-start files on their own (pulls the image)
SHA256SUMS	checksums — verify with sha256sum -c SHA256SUMS

First login is ark with the password you set in RCONSOLE_ADMIN_PASSWORD (or ark/ark, which forces a change).