v0.8.4

Levelrail v0.8.4 is a self-hosted deployment platform: one control plane for Docker apps, databases, TLS, logs, metrics and rollback across your own servers. A lightweight alternative to Coolify, Dokploy and Kubernetes for small teams.

What's changed

Features

• Adds a Cleanup center and a Security and runtime settings page, hardens agent enrollment, bind mounts and webhooks, and redesigns the New app screen. Agents now need APP_CA_FINGERPRINT to enroll (#1376) by @thegdsks
  • Cleanup center: A retention window per data type, a dry-run preview before any delete, run history with CSV and JSON export, and revoked tokens cleaned up after 90 days | Settings > Cleanup
  • Security settings: Protections on by default, a saved value beats an environment variable, a confirmation and audit row when one is turned off, a restart banner, and a first-run review | Settings > Security and runtime
  • Hardening: Agents must pin the CA to enroll, safer bind mounts, replayed git webhooks ignored, log and export reads audited, and five injection or escape bugs fixed | Agent, API, deploys
  • New app screen: One repository picker, git settings, compact start options and a dry-run checked monorepo import plan | Apps > New app
  • Speed: Dashboard and search reads use a read-only SQLite pool; load balancers gain client_ip_hash and per-upstream stats | Dashboard, ingress
  • CI: Sonar and Codecov only on main and release branches, weekly scans, a calmer nightly run, and fixes for the flaky tests behind most red runs | .github/workflows

Maintenance, CI, and dependency updates (1)

• let the break-glass e2e agent enroll unpinned on loopback (#1380) by @thegdsks

Install

Fresh install on a Linux host, pinned to this release:

curl -fsSL https://raw.githubusercontent.com/glincker/levelrail/main/install.sh | sudo env LEVELRAIL_VERSION=v0.8.4 sh

Upgrade an existing install in place (keeps the unit file and data):

curl -fsSL https://raw.githubusercontent.com/glincker/levelrail/main/install.sh | sudo env LEVELRAIL_VERSION=v0.8.4 sh -s upgrade

Docker Compose: pin the image tag in docker-compose.yml:

services:
  levelrail:
    image: ghcr.io/glincker/levelrail:v0.8.4

Downloads

File	What it is
checksums.txt.sigstore.json	Control plane
levelrail-agent-linux-amd64	Node agent
levelrail-agent-linux-amd64.deb	Node agent
levelrail-agent-linux-amd64.rpm	Node agent
levelrail-agent-linux-arm64	Node agent
levelrail-agent-linux-arm64.deb	Node agent
levelrail-agent-linux-arm64.rpm	Node agent
levelrail-cli-darwin-amd64	Command line tool
levelrail-cli-darwin-arm64	Command line tool
levelrail-cli-linux-amd64	Command line tool
levelrail-cli-linux-arm64	Command line tool
levelrail-cli-windows-amd64.exe	Command line tool
levelrail-cli-windows-arm64.exe	Command line tool
levelrail-linux-amd64	Control plane
levelrail-linux-arm64	Control plane
release-manifest.json	Control plane
checksums.txt	SHA-256 of every file

Container images

Multi-arch (linux/amd64, linux/arm64), signed with cosign, SBOM and provenance attached. Also tagged v0.8, latest at release time (moving tags).

Image	Tag	Digest
ghcr.io/glincker/levelrail	v0.8.4	sha256:b6837ce4a900a0ef90deb6f45ff1df604eb8f7c8ae44c997855de8bd58d05dab
ghcr.io/glincker/levelrail-agent	v0.8.4	sha256:4ec1874da86805c95092e4136608d9fbdc483fe56f05ea4d16cb5c20e678ba05

Verify

Binaries: check downloads against checksums.txt:

gh release download v0.8.4 --repo glincker/levelrail --pattern 'levelrail-linux-amd64' --pattern checksums.txt
sha256sum --ignore-missing -c checksums.txt

Images: verify the keyless signature was made by this repository's release workflow:

cosign verify ghcr.io/glincker/levelrail@sha256:b6837ce4a900a0ef90deb6f45ff1df604eb8f7c8ae44c997855de8bd58d05dab \
  --certificate-identity-regexp '^https://github\.com/glincker/levelrail/\.github/workflows/release\.yml@refs/(heads/main|tags/v.+)$' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Contributors

Thanks to @thegdsks.

Full changelog: v0.8.3...v0.8.4 | Release page | Installing | Upgrading | Verifying signatures