Pithead v2.0.2

[2.0.2] - 2026-10-31

Pithead 2.0.2 is a patch release after 2.0.1. It makes a command-line restore refresh the
dashboard configuration, catches an occupied stratum port before Configuration applies it, and
makes the commands that act on data directories refuse a path with a line break in it. It changes
no configuration keys and no component version, and runs no data migration. Entries below apply
to both channels unless they say otherwise.

Fixed

• A command-line restore over an existing install refreshes the dashboard configuration before
  startup, so Configuration and the earnings calculator use the restored values (#3432).
• Configuration preview and apply refuse an occupied stratum port before committing the change,
  keeping the running proxy and mining intact. The check runs only when the port changes and does
  not reserve the port (#3417).
• reset-dashboard refuses a data directory whose path in .env contains a carriage return or
  line feed, so it never deletes a truncated path. The other data-directory checks refuse such a
  path too (#3502).
• First-start guidance names the chains your setup actually has to sync before mining starts
  (#3598).
• DIY: building the Monero, P2Pool and xmrig-proxy images from a source checkout tries
  apt-get update up to three times, pausing 5 and then 10 seconds, so a mirror that is briefly
  mid-sync no longer fails those builds at the index update. The package install is not retried
  (#1802).
• The appliance release gate accepts a measured Secure Boot non-boot for every version as
  unsupported by design. An unmeasured guest still fails; Secure Boot must remain off (#3678).

Security

• The dashboard development lock raises filelock to 4.2.4 and virtualenv to 21.14.13 to clear their
  dependency advisories. Both are development tooling only and are absent from the dashboard image
  (#3662, #3014).

Known issues in 2.0.2

The known issues listed for 2.0.1,
including those it carries over from 2.0.0, still apply, except #3432 and #3417, which are fixed
above. Five issues are planned for 2.0.3, including #3375 from the 2.0.1 list:

• On the appliance, the built-in miner can stay at 0 H/s after a dashboard backup or a recovery
  boot. The dashboard shows 0 H/s for it. Run sudo systemctl restart xmrig or reboot (#3375).
• On the appliance, after config-reset, a restore and pithead up, the stack starts but the
  enabled built-in miner may not start, so its saved workers do not reconnect. No workaround has
  been established (#3623).
• DIY: a checkout made under a restrictive umask such as umask 077 builds images whose files
  their non-root service users cannot read, and Tor then fails before setup completes. Make the
  checkout under the usual umask 022 (#3431).
• With the default Tor egress firewall, the setup wizard and Configuration refuse a remote node
  hostname whose DNS answer includes an IPv6 address, as on a dual-stack LAN, even when it also
  resolves to a private IPv4 address. Enter the node's private IPv4 address instead (#2351).
• On the appliance, choosing Set up again on a rig can, rarely, leave the setup URL and
  one-time token off the serial console, because the login prompt takes the console before the
  announcement finishes. Choose Set up again once more to show them again (#3803).

One more is open. The appliance's cosign binary is the same build as in 2.0.1. It carries go-jose
4.1.4, which scanners report as CVE-2026-116587 (HIGH, fixed in go-jose 4.1.6). Whether Pithead's
use of cosign is exposed has not been established (#3761).

Ingredients — Pithead v2.0.2

• Version: 2.0.2
• Commit: 2b8a778fcafa12db40991de95a8563bd5867ca0b
• Built: 2026-11-01T07:53:43Z

Published images (ghcr.io/p2pool-starter-stack, tags v2.0.2 + latest)

• ghcr.io/p2pool-starter-stack/pithead-tor:v2.0.2
  • digest: ghcr.io/p2pool-starter-stack/pithead-tor@sha256:e0ec539939d094dd3323c211670883f4d312966bfda1a8e0cf37f8a25200231f
• ghcr.io/p2pool-starter-stack/pithead-monero:v2.0.2
  • digest: ghcr.io/p2pool-starter-stack/pithead-monero@sha256:948c86ba7a211c58e28fe6d6760e97ac49fd813e8e72db2bcf4ea75774207f69
• ghcr.io/p2pool-starter-stack/pithead-p2pool:v2.0.2
  • digest: ghcr.io/p2pool-starter-stack/pithead-p2pool@sha256:e184028b243540be1dbc0050e51dd8fdcb98a4cd609d262e97bfd6f41258ed10
• ghcr.io/p2pool-starter-stack/pithead-xmrig-proxy:v2.0.2
  • digest: ghcr.io/p2pool-starter-stack/pithead-xmrig-proxy@sha256:d500917d0276f22058c0bd0c224a9c4f4d654aa100707f7a1b82e41b1d152ec0
• ghcr.io/p2pool-starter-stack/pithead-dashboard:v2.0.2
  • digest: ghcr.io/p2pool-starter-stack/pithead-dashboard@sha256:1209696637d051210d963d1787e9918be00ac3e84d0d85be96b35fad8a4ab73b
• ghcr.io/p2pool-starter-stack/pithead-os-rootfs:v2.0.2
  • digest: ghcr.io/p2pool-starter-stack/pithead-os-rootfs@sha256:590550ebc426431dcde97306d2434c77982cb4850c2da3a60f12d1371a240535

Upstream component pins

• p2pool: v4.18.1
• monerod: v0.18.5.1
• xmrig-proxy: 6.26.0
• tor base: alpine:3.24@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6
• tari node: ghcr.io/tari-project/minotari_node:v6.0.1-pre.0-mainnet@sha256:23ce381b74e48cf67677dfe85c800daf54a155a610c595c94b16db6b186950ec
• tari console wallet: ghcr.io/tari-project/minotari_console_wallet:v6.0.1-pre.0-mainnet@sha256:6f1f7d8990d304466f70a0379dcef4825c29b785c10d7fc7dff4d89163ed1b9d
• caddy: caddy:2.11.7@sha256:36c24ad91a7ff7bc4c87fe22bfa8df3c4b18da0773d73fc12ee2c52b98c0bb7e
• docker-socket-proxy: tecnativa/docker-socket-proxy:v0.5.0@sha256:1f5038b54f06c3e18422902cf00ba21803d1c97805aae032e5e6673d532d3459
• rigforge: b2d4c3d9ca1da74d0e6d5ccce772d401acc8be03
• bundle sha256: c0a0970de70c37056b0c381c2d7ddd811d2e608f54e5a838bd520c84d8a868a0