MyPaas v0.5.0-beta.2

MyPaas v0.5.0-beta.2

Release type: Prerelease / beta
Release date: 2026-08-18
Release tag: v0.5.0-beta.2

v0.5.0-beta.2 is a focused runtime hotfix release following v0.5.0-beta.1.

Runtime fix

Compose healthchecks rendered in exec form (CMD) are converted to an equivalent shell form (CMD-SHELL) before MyPaas writes its sanitized Compose configuration. This avoids a Podman Compose argument-splitting incompatibility observed after v0.5.0-beta.1.

The conversion now shell-quotes every original argument, including empty arguments and values containing shell metacharacters such as $, &, and ;. Existing CMD-SHELL healthchecks are preserved unchanged.

Scope

This is intentionally a narrow beta hotfix. The runtime code delta from v0.5.0-beta.1 is limited to Compose healthcheck normalization; the remaining intervening runtime-neutral changes clarify MyPaas' Podman-first policy and add release-publishing automation.

Release provenance

The runtime hotfix and its dedicated regression coverage were qualified at commit:

a169cad84558fe791a9d0091284da982849e79d9

All mandatory gates passed on that runtime tree before release preparation: backend tests, Go race detector, frontend tests/type/build checks, deployment-script and benchmark regression checks, production Compose rendering, Docker routing-network alias verification, and rootful Podman compatibility smoke.

Subsequent commits before the tag only add release-publishing workflow support and this provenance note; they do not change runtime source, migrations, application dependencies, deployment scripts, or container definitions.

Validation

Dedicated regression coverage verifies shell-safe CMD healthcheck conversion, including whitespace, shell metacharacters, embedded single quotes, and empty arguments, while preserving existing CMD-SHELL healthchecks unchanged.

Install

curl -fsSL https://raw.githubusercontent.com/nabilrn/MyPaas/v0.5.0-beta.2/scripts/bootstrap.sh | \
  env MYPAAS_REF=v0.5.0-beta.2 bash

Fresh supported Linux hosts remain Podman-first by default. To intentionally use Docker Engine compatibility mode:

curl -fsSL https://raw.githubusercontent.com/nabilrn/MyPaas/v0.5.0-beta.2/scripts/bootstrap.sh | \
  env MYPAAS_REF=v0.5.0-beta.2 USE_PODMAN=false bash

Upgrade note

Operators on v0.5.0-beta.1 who deploy Compose applications with exec-form healthchecks should prefer this beta. As with any stateful update, verify backups and platform health before upgrading and verify at least one existing routed project afterward.

Known beta boundaries

The broader limitations documented for v0.5.0-beta.1 remain: MyPaas is a single-host platform, is intended for an owner/small trusted-team model, does not provide hostile multi-tenant VM-grade isolation, and does not support an in-place Docker-to-Podman state migration.

MyPaas v0.5.0-beta.1

MyPaas v0.5.0-beta.1

Release type: Prerelease / beta
Release date: 2026-08-16
Release tag: v0.5.0-beta.1
Release-source commit: 3c30112778c5a66cc0dcc495263e881133258b98
Runtime-qualified candidate: ddc26c9a0f877fc5dd4133d6559c5f36123d6a31

v0.5.0-beta.1 is the first MyPaas beta release backed by the full beta-readiness qualification program.

The release is intended for self-hosted evaluation and real small-team workloads on a single Linux host. It is not positioned as a highly available multi-node platform or as a hostile multi-tenant cloud control plane.

Documentation links in this release note are pinned to v0.5.0-beta.1 so they remain valid even after main advances.

Why a new beta tag

An older tag named v0.5.0-beta exists on an earlier commit. It is retained as immutable history and is not moved or reused.

This release uses a new SemVer prerelease identifier:

v0.5.0-beta.1

Highlights

Deployment sources

• Git repository deployment through Dockerfile, Docker Compose, or static mode.
• Public OCI image deployment from Docker Hub, GHCR, and compatible registries.
• Repository inspection, branch selection, base-directory support, runtime detection, environment-template discovery, and Compose preflight analysis.
• GitHub webhook deployments with HMAC verification and branch filtering.

Runtime and routing

• Caddy-managed project routes with reconciliation after control-plane restart.
• Side-by-side Dockerfile replacement using a distinct temporary host port before cutover.
• Compose deployment readiness checks before a route is promoted.
• Historical rollback for supported container-backed deployments.
• Lifecycle operations, deployment history, build logs, project logs, and runtime metrics.

Environment and data

• AES-256-GCM encrypted project environment values.
• Nested environment-template discovery for monorepo/Compose projects.
• Optional shared PostgreSQL provisioning.
• DB Studio Lite for PostgreSQL, MySQL, and MariaDB.
• DB Studio defaults to read-only and requires an explicit expiring write session for mutations.

Operations

• Scheduled PostgreSQL backups with retention.
• Backup/restore tooling with manifest/checksum validation and secret-safe reporting.
• Scoped MyPaas-managed image cleanup and build-cache retention.
• Opt-in self-update flow using immutable commit-SHA GHCR images, preflight checks, post-update verification, and rollback.
• Docker Engine and Podman-compatible operation.
• Optional mypaas-statd v0.2.0 host/runtime telemetry with Docker-compatible fallback.

Create Project reliability

The Create Project flow was qualified across:

• static Git repositories;
• Dockerfile repositories;
• Compose app + database repositories;
• nested/base-directory projects;
• public registry/GHCR images;
• invalid repository/error states.

Critical fail-closed behavior includes stale analysis invalidation, required-port enforcement, required environment checks, Compose Doctor blockers, backend analysis failure/timeout handling, and persistence of the registry container-port input through normal UI renders.

Beta-readiness qualification

The evidence-backed gate matrix records all mandatory gates as PASS:

Gate	Result	Tested SHA
Update / release safety	PASS	edea8615d75f8e032bfb66bf430ab598b05876b2 — carried forward after blast-radius review
Backup / fresh-VM restore	PASS	de63a285c621125959d0612e4eacb7397c887a0a — carried forward after blast-radius review
10 / 25 / 50-project performance	PASS	8c724026841ea31ed5b1bd39d5e7f16b1bd0a4b1 — carried forward after redeploy-only fix review
Concurrent-deploy resilience	PASS	ddc26c9a0f877fc5dd4133d6559c5f36123d6a31
Docker / build-cache retention	PASS	ddc26c9a0f877fc5dd4133d6559c5f36123d6a31
Create Project runtime contract	PASS	ddc26c9a0f877fc5dd4133d6559c5f36123d6a31
DB Studio Compose reliability	PASS	ddc26c9a0f877fc5dd4133d6559c5f36123d6a31
Documentation / limitations	PASS	evidence reconciliation

See the authoritative beta-readiness gate record for gate evidence, carry-forward provenance, historical failures, and caveats.

Performance evidence

The 10/25/50-project qualification completed the 50-project tier with 50/50 successful deployments on the tested 4-vCPU / approximately 8-GiB host.

This is a tested capacity result for that VM shape and fixture mix, not a universal capacity promise. Application memory/CPU demand, image size, build behavior, persistent storage, and host configuration materially affect practical capacity.

Defects resolved during qualification

The beta program found and fixed real runtime defects rather than weakening gates:

• Compose readiness/recovery handling that could leave deployment/port state divergent in an earlier candidate.
• Dockerfile side-by-side redeploy port self-collision where a replacement could attempt to bind the active runtime port.
• Fixture harness logic that previously treated an immutable commit SHA as a clonable Git branch.

Historical failed evidence remains preserved and is not rewritten as PASS.

Install

For a reproducible beta installation, pin the bootstrap source and checkout ref:

curl -fsSL https://raw.githubusercontent.com/nabilrn/MyPaas/v0.5.0-beta.1/scripts/bootstrap.sh | \
  env MYPAAS_REF=v0.5.0-beta.1 bash

Podman on a fresh Ubuntu/Debian host:

curl -fsSL https://raw.githubusercontent.com/nabilrn/MyPaas/v0.5.0-beta.1/scripts/bootstrap.sh | \
  env MYPAAS_REF=v0.5.0-beta.1 USE_PODMAN=true bash

The bootstrap installer supports an explicit MYPAAS_REF and rejects dirty installer-managed checkouts.

Updating an existing installation

Before updating a stateful installation:

1. verify the current installation is healthy;
2. take and verify a backup;
3. keep the existing project/runtime state as a rollback sentinel;
4. update through the repository-supported bootstrap/updater path;
5. verify API readiness, dashboard, Caddy, and at least one existing project route afterward.

For a strictly pinned beta installation, leave AUTO_UPDATE_ENABLED=false unless opting into a newer ref is intentional.

Container image provenance

MyPaas publishes API and dashboard images only after CI succeeds for a main push. Images are tagged with latest and immutable commit-SHA identities used by the release/update path.

For controlled updates, prefer immutable commit-SHA image tags over latest.

Runtime qualification was performed against:

ddc26c9a0f877fc5dd4133d6559c5f36123d6a31

The release tag points to:

3c30112778c5a66cc0dcc495263e881133258b98

The commits between those identities are documentation/product-positioning changes only; they do not alter runtime source, migrations, dependencies, workflows, deployment scripts, or container definitions.

Known beta limitations

• Single-host architecture; no multi-node HA or cluster scheduler.
• Owner / small trusted-team model; not a hostile multi-tenant security boundary.
• Public OCI registry images only; private-registry credential storage is not implemented.
• No supported in-place Docker-to-Podman state migration.
• Capacity and performance are workload- and host-specific.
• Disk-pressure warning UI is not yet implemented, although retention tooling is available manually and on schedule.
• Production Create Project qualification is intentionally non-destructive.
• Phase 6 browser evidence used Playwright Chromium; some historical artifact directory names still contain firefox.
• A Python urllib keepalive/connection reuse anomaly was observed in one high-rate webhook harness path; server-side transactions remained coherent in the accepted qualification evidence.

Security and trust model

Read the security boundaries before exposing MyPaas to users outside a trusted operator group.

The beta qualification does not convert the single-host architecture into VM-grade tenant isolation. The container engine, routing plane, project workloads, host paths, secrets, and privileged operator controls remain part of the documented trust model.

Documentation

• Repository README
• Documentation index
• Beta readiness gates
• Architecture
• Security boundaries
• mypaas-statd integration
• Product scope

Release decision

The qualified runtime lineage passed all mandatory beta-readiness gates. v0.5.0-beta.1 is published as a prerelease/beta, not as the stable v0.5.0 release.