v10.0.5-alpha — Non-root least-privilege console + one-click flip

Run the whole stack without root — a one-click least-privilege console

The infra-TAK console, and the entire TAK stack it manages, can now run as an unprivileged user instead of root — and existing servers can switch over with a single click.

What's new

• Born non-root. New installs come up as an unprivileged user automatically.
• One-click "Switch to non-root" on the Cyber Controls page for existing deployments. It migrates the running console to an unprivileged user, carries all of its state across, and relocates every managed service — Authentik/SSO, CloudTAK, TAK Portal, NetBird, Node-RED and more — into the new home so they stay fully manageable. If anything doesn't come back cleanly, it automatically rolls back to the previous working state.
• SSO and your hardened firewall posture are preserved across the switch — no backdoors opened, no single-sign-on interruption.
• Privileged broker. A small mediator handles the handful of genuinely root-level operations the console still needs, so routine management no longer runs with full root.
• Rocky / RHEL 9 complete. The non-root switch is now SELinux-aware, and firewall hardening is firewalld-correct — admin services stay behind the reverse proxy, only the ports that are meant to be public stay public.
• Two-server (separate database host) deployments hardened, including remote database health monitoring.

Also fixed in this release

• TAK Video Restreamer "Update Now" now works. Updates were aborting because the console's own configuration inside the app's clone conflicted with the upstream update. Update Now (and re-deploy) now cleanly refresh the source and re-apply your settings — your admin password and loopback-only bindings are preserved.
• Docker build-cache cleanup on large disks. The automatic build-cache reclaim only engaged when the root disk was nearly full, so on larger disks hundreds of GB of stale Docker build cache could pile up unnoticed. It now caps the build cache to a fixed size on every run regardless of how big the disk is, and the cleanup timer runs consistently. (Also picks the correct prune command on current Docker versions.)

Why it matters

Running the console as root meant any compromise was a full-host compromise. Moving to an unprivileged user with a narrow privileged broker is a real least-privilege security boundary — and now you can adopt it on an existing server without a rebuild.

Upgrade

Applied automatically on the next console update. Switching an existing server to non-root is opt-in from the Cyber Controls page, with automatic rollback if the migration doesn't complete cleanly. Supported on Ubuntu 22.04, Rocky / RHEL 9, and ARM64.