v0.7.0

Levelrail v0.7.0 is a self-hosted deployment platform: one control plane for Docker apps, databases, TLS, logs, metrics and rollback across your own servers. A lightweight alternative to Coolify, Dokploy and Kubernetes for small teams.

What's changed

Features

• Release 0.13: safer defaults, crash-safe operations, one search across everything and a signed plugin marketplace, with database password rotation, canary releases, an alert inbox and a smaller MCP footprint (#1291) by @thegdsks
  • Deploy and builds: Framework presets (Next.js, Go, React, Spring Boot and more), deploy diff before applying, canary releases that roll back on errors, build center with cache savings, a URL per recent deploy, scale-to-zero functions, promote any past deploy, typed Fix buttons for build and domain failures
  • Security and access: CLI logins pinned to their server, safer token and session defaults (90-day tokens, idle timeout), hash-chained audit log with a verify button, SSRF guards on every outbound fetch, crash-safe master key rotation plus per-app key rotation, secret masking in logs, least-privilege token suggestions, opt-in HSTS and one-click ingress shield, GitHub Actions deploys with a short-lived OIDC token
  • Account: Passkey manager (provider names, synced vs device-bound, guided add, test, safe removal), activity feed, preferences, data export, safe account deletion, email change with verification
  • Reliability: Disk guard, database integrity check with guided restore, safe-mode boot, reconcile storm protection, one-click control plane rollback, clean shutdown, no leaked servers or backup objects on failure paths, one agent link per node
  • Data and storage: Database password rotation with preview and rollback, archives of cold data, storage destinations (S3, R2, node directories), buckets with S3 env vars, opt-in control plane replica
  • Observability: Log search operators and relevance ranking, alert templates, quiet hours and an in-app inbox, SLO burn per app, traffic breakdowns, cost explorer and budgets, control plane health page with idle footprint
  • Search and UX: One Cmd+K search across apps, databases, nodes, templates and actions (permission-filtered, with prefix chips), environment health card, custom dashboards, settings health card, beta features switchable from the page, sample app on first run
  • Plugins and agents: Signed plugin marketplace with one-click install, plugin panels, six first-party alert channel plugins (Zulip, Matrix, Twilio SMS, DingTalk, WeCom, Mailgun), small default MCP tool list with on-demand tool groups, scripted MCP eval
  • Scale and platform: Placement and zone-loss what-if, autoscaler and HA decision records, first measured ingress numbers, 48 of the top 50 catalog templates pass the smoke run
  • Docs and brand: New README header and dark social cards, the marketing site moved to a private repo (docs stay at docs.levelrail.com)
  • Quality: Full Go and web test suites green, docs command checker, per-chunk bundle budgets, about 250 more strings translated, refreshed dark and light screenshots
• Release 0.14: migrate from Coolify, Dokploy, CapRover or Dokku with fewer manual steps, deploy with levelrail-cli up or git push, sign in with OIDC groups or a passkey, stream the audit log to your SIEM, and run local AI models behind Levelrail keys (#1294) by @thegdsks
  • Migrate to Levelrail: A migration hub plus one page per source (Coolify, Dokploy, CapRover, Dokku, Docker Compose) with an honest downtime table; import from a pasted Compose file or Dokku env dump; read-only import over SSH (Docker API only, host key pinned, nothing runs on the old server); guided same-server takeover of ports 80 and 443 with a verified, automatic rollback
  • Deploy and first run: levelrail-cli up (detects the stack, picks name, port and domain, flags for depth), a simple and advanced help split, apps scale --memory --cpu, rollback with no flag, a beta git push deploy remote (ADR 040), install profiles (minimal, standard, suite), HTTPS email prefilled and a four step first-run checklist, template requirements card, stop-first deploys for apps that lock their volume, template memory limits applied, rollback target check
  • Security and access: Exposure report with one-click fixes, block deploys on high severity vulnerabilities (opt-in), OIDC group to role mapping, JIT provisioning and domain routing (beta, never grants root), usernameless passkey sign-in, three more social logins (20 named providers plus OIDC), SAML and SCIM verified against Keycloak and SimpleSAMLphp with five SCIM fixes, SAML metadata fetch refuses internal addresses, Docker guard blocks container namespace joins, repo URL credentials redacted from logs, re-enrolling a node closes the old link
  • Audit and observability: Audit log streams to Splunk HEC, syslog and OpenTelemetry with hash chain fields, trusted proxy one-click fix and request limits, bench scenarios with a published limits table
  • AI and agents: Use a Mac, Ollama or any local model server as a private endpoint with keys, caps and fallback; MCP tool list filtered by token ability plus ten read-only tools in on-demand toolsets; OpenClaw template and a guide to controlling Levelrail from it; guides for self-hosting n8n, Langflow, Flowise, Qdrant, LiteLLM and Ollama with Open WebUI
  • Platform: Cloudflare DNS as the first first-party plugin (ADR 038); control plane HA decision with a WAL shipping prototype, off by default (ADR 039); migration tooling that fails CI on table rebuild mistakes and makes provider lists code-only; version comparison fix so a dev build is never offered an older release
  • Performance and UX: Server side paging and an apps summary, gzip for API JSON, lazy brand logos, accessibility fixes on the main pages, a Spanish language option, dependency bumps
  • Docs and repo: New migration pages, internal notes removed from the published docs, repo root reduced from 32 files to 14, two stray binaries untracked, README and comparison pages state SSO, SCIM and catalog size accurately
  • Quality: Upgrade matrix tests across schema versions and downgrade refusal, heavy live tests moved to nightly, go vet ./test/... now checked

Bug fixes

• ci: get main green again after 0.14 (#1297) by @thegdsks

Install

Fresh install on a Linux host, pinned to this release:

curl -fsSL https://raw.githubusercontent.com/glincker/levelrail/main/install.sh | sudo env LEVELRAIL_VERSION=v0.7.0 sh

Upgrade an existing install in place (keeps the unit file and data):

curl -fsSL https://raw.githubusercontent.com/glincker/levelrail/main/install.sh | sudo env LEVELRAIL_VERSION=v0.7.0 sh -s upgrade

Docker Compose: pin the image tag in docker-compose.yml:

services:
  levelrail:
    image: ghcr.io/glincker/levelrail:v0.7.0

Downloads

File	What it is
checksums.txt.sigstore.json	Control plane
levelrail-agent-linux-amd64	Node agent
levelrail-agent-linux-amd64.deb	Node agent
levelrail-agent-linux-amd64.rpm	Node agent
levelrail-agent-linux-arm64	Node agent
levelrail-agent-linux-arm64.deb	Node agent
levelrail-agent-linux-arm64.rpm	Node agent
levelrail-cli-darwin-amd64	Command line tool
levelrail-cli-darwin-arm64	Command line tool
levelrail-cli-linux-amd64	Command line tool
levelrail-cli-linux-arm64	Command line tool
levelrail-cli-windows-amd64.exe	Command line tool
levelrail-cli-windows-arm64.exe	Command line tool
levelrail-linux-amd64	Control plane
levelrail-linux-arm64	Control plane
release-manifest.json	Control plane
checksums.txt	SHA-256 of every file

Container images

Multi-arch (linux/amd64, linux/arm64), signed with cosign, SBOM and provenance attached. Also tagged v0.7, latest at release time (moving tags).

Image	Tag	Digest
ghcr.io/glincker/levelrail	v0.7.0	sha256:2f875991a299eeef9ae3248ff1699e3361709bf416f7d5f5904f7e7541ccde3b
ghcr.io/glincker/levelrail-agent	v0.7.0	sha256:b71356acb48058f8154374166b51b75dbbb96c8735c007cfdfbcf7156e87f894

Verify

Binaries: check downloads against checksums.txt:

gh release download v0.7.0 --repo glincker/levelrail --pattern 'levelrail-linux-amd64' --pattern checksums.txt
sha256sum --ignore-missing -c checksums.txt

Images: verify the keyless signature was made by this repository's release workflow:

cosign verify ghcr.io/glincker/levelrail@sha256:2f875991a299eeef9ae3248ff1699e3361709bf416f7d5f5904f7e7541ccde3b \
  --certificate-identity-regexp '^https://github\.com/glincker/levelrail/\.github/workflows/release\.yml@refs/(heads/main|tags/v.+)$' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Contributors

Thanks to @thegdsks.

Full changelog: v0.6.0...v0.7.0 | Release page | Installing | Upgrading | Verifying signatures