Restow 0.3.4

Restow 0.3.4. Released 2026-10-11, channel beta.

Beta release. Run it alongside your existing backups, not as your only one, until
you have verified restores against your own data.

Summary

Restow 0.3.4 is a hotfix: Proxmox VE container backups no longer fail on the
lost+found folder of an unprivileged container, VMs & containers show when a backup
waits for its node or runs, and a short hiccup while the browser re-checks the sign-in
no longer replaces the whole interface with "Restow could not be loaded". No database
migration.

Breaking Changes

None.

Added

• Proxmox VE › VMs & containers: the state of a guest says "Waiting for the node" once
  a backup was handed out and "Backup running" while it runs; a container whose last
  backup succeeded says so (a VM says it with its incremental/full-read badge).

Changed

• Proxmox VE container backups that restic could not read completely (exit code 3: the
  snapshot is written, some files are missing) keep their restore point instead of
  failing. The PVE task log names the unreadable items (the first 20) and the restore
  point records how many there were.

Fixed

• Container backups of unprivileged containers on ext4 (LVM, LVM-thin, directory
  storage) failed with "open lost+found: permission denied": that folder belongs to the
  host's root, which the container's ID map does not include. The lost+found at the
  root of the container and of every mount point is left out, as vzdump does.
• A failed container backup with a long restic error could stay "running" forever: the
  server refused error texts over 4000 characters (422), and the node only logged that.
  The server now keeps the first 4000 characters.
• A backup whose own end the node could not report is closed when the node reports its
  task: succeeded with a restore point, failed without one. A task that failed closes
  every run it left open, not only one.
• A backup still running after 30 minutes was handed to its node a second time.
• The interface fell back to "Restow could not be loaded" whenever a single background
  re-check of the sign-in failed (when the window got the focus again, after the network
  came back, or while the API restarted), although the session was still valid. It now
  stays up and keeps the session; only a failed first load or a 401 changes the screen.
  Errors of the sign-in service name a server or connection problem instead of the
  generic "The action could not be completed".

Security

None.

Upgrade Notes

New image and a new restow-pve helper for the Proxmox VE nodes; no database
migration. After the server update, run restow-pve update on every node so the
container fix applies there; the server part works with older helpers too.

Known Issues

• The inventory's node rows do not yet show "Waiting for the node" or "Backup running";
  VMs & containers does.
• The known issues of 0.3.3 still apply.

Verification

Before the tag, on 2026-10-11, on the release candidate (main plus the 0.3.4 changes):
lint, typecheck, the Go tests of the agent and the PVE helper (including new tests for
the container backup's arguments, exit code 3 and other failures), apps/web 3803, and
the Proxmox VE suites of apps/api with Postgres 16 (pve 11, protection 6). The full
suites run in CI on the release pull request.

Release pipeline, 2026-10-11:

Check	Result	Duration
1. Install: images, compose up, migrations (new install and upgrade)	PASS	80s
2. Health endpoints, worker and scheduler registered	PASS	0s
3. Passkey sign-in E2E with a virtual authenticator, tenant creation, i18n de/en	PASS	2m 01s
4. Microsoft 365 backup and restore against the dev tenant	SKIPPED	0s
5. IMAP backup and restore against Dovecot, hash comparison	PASS	8s
6. Journal receipt, chain verification, export	PASS	3s
7. Standalone restore with restow-restore from the storage of check 5	PASS	24s
8. Storage targets: S3 (Garage), local path, mounted directory	PASS	19s
9. Image scan (Trivy) and dependency audit (pnpm audit)	PASS	20s
10. Endpoint backup: the agent enrolls, backs up a folder, restores it	PASS	11s
11. Mail import (folder and upload) and export (EML ZIP, MBOX), compared by hash	PASS	8s

10 of 11 checks passed in full, 0 partly, 1 skipped, 0 failed. The full report, including the reason for every skipped or partial check, is attached to the release as smoke-report.md.

The Community images were smoke-tested on their own (smoke-report-community.md, smoke-report-community-arm64.md): amd64 PASS with gaps: 8 of 11 checks passed in full, 0 partly, 3 skipped (see the reasons below); arm64 PASS with gaps: 8 of 11 checks passed in full, 0 partly, 3 skipped (see the reasons below).

Images

Two builds of the same release. The full build is the Apache-2.0 core plus the Business and Service Provider modules (Restow Enterprise License), which stay locked until a license key is installed. The Community build is the Apache-2.0 core alone.

ghcr.io/restow-backup/restow:0.3.4
ghcr.io/restow-backup/restow-web:0.3.4
ghcr.io/restow-backup/restow-community:0.3.4
ghcr.io/restow-backup/restow-web-community:0.3.4

The digests of the multi-arch manifests (the opt-in updater verifies the pulled images against the two lines of its build):

restow: sha256:c6d88d81e962ef3148d44c45115fe1dafee7dc8090fe83da3691653444c545a3
restow-web: sha256:5d9a70d7c5d21a88bc9ce9e992ca0f3901403636520375b90bc164d053940d6f
restow-community: sha256:4430be2581a056742605dc57c3d99cc768759ce3384f98f37313701aede87747
restow-web-community: sha256:6a0e543b7c30cce77b21a84cc513d59ecc252a5ac776d95a4fed50f068a155b3

All four images are multi-arch (linux/amd64, linux/arm64), signed with cosign (keyless) and carry an SPDX SBOM as attestation. Verify any of them with:

cosign verify ghcr.io/restow-backup/restow:0.3.4 \
  --certificate-identity-regexp '^https://github.com/restow-backup/restow/\.github/workflows/release\.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
cosign verify ghcr.io/restow-backup/restow-web:0.3.4 \
  --certificate-identity-regexp '^https://github.com/restow-backup/restow/\.github/workflows/release\.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
cosign verify ghcr.io/restow-backup/restow-community:0.3.4 \
  --certificate-identity-regexp '^https://github.com/restow-backup/restow/\.github/workflows/release\.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
cosign verify ghcr.io/restow-backup/restow-web-community:0.3.4 \
  --certificate-identity-regexp '^https://github.com/restow-backup/restow/\.github/workflows/release\.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

docker-compose.yml and env.example are the release stack (deploy/release/); install.sh installs it on a dedicated Linux VM (README.md, "Install with the script"; install.sh.sha256 for sha256sum -c after the download); restow-agent-THIRD_PARTY_NOTICES.txt holds the licenses of the agent binaries and of the restic they run; SHA256SUMS lists every file of this release and is signed (SHA256SUMS.sigstore.json).