Harbor Desk v0.6.1

Harbor Desk v0.6.1 preview

This preview contains the client-first desktop app with its automatic loopback policy gateway, plus the optional server-side Docker gateway installer.

Changes

Fixed

• The Connections screen now exposes the initial connection button when no
  target is configured and opens the Gateway/Docker Engine registration dialog.
• Unavailable-connection guidance now points to the Connections screen instead
  of sending users to a settings page without an action.

Downloads

• Windows: x64 NSIS installer and blockmap
• Linux: x86_64 AppImage and Debian package
• macOS: x64 and arm64 DMG/ZIP packages and blockmaps
• Server: attached GitHub release tarball harbor-desk-0.6.1.tgz
• Integrity: SHA256SUMS contains SHA-256 checksums for every distributable asset

npm distribution

The npm registry provides v0.6.1 under the preview dist-tag (the default latest dist-tag is unchanged). To run that exact version instead of following the latest dist-tag:

npm exec --yes harbor-desk@0.6.1 -- --version

Preview and security boundaries

This remains a prerelease. Desktop binaries are currently unsigned; verify SHA256SUMS before installation and use a source build where signed artifacts are required.

The desktop detects a configured Harbor Desk Gateway or Docker Engine. It uses a Server Gateway directly, and starts a bundled Local Gateway wrapper on 127.0.0.1 only for a raw Engine target. Docker access remains behind a Gateway; the renderer never receives a Docker socket or direct Engine connection. The optional server installer supports controlled Linux, Windows, and macOS Docker hosts, but requires explicit --allow-local-engine-socket acknowledgement before mounting a host's Docker Engine socket.

See SECURITY.md for the current security and dependency-advisory boundary.

Harbor Desk v0.6.0

Harbor Desk v0.6.0 preview

This preview contains the client-first desktop app with its automatic loopback policy gateway, plus the optional server-side Docker gateway installer.

Changes

Changed

• The desktop now accepts one Gateway or Docker Engine target and detects the
  connection type before creating the renderer. Server Gateways are used
  directly; raw Engine targets start a Local Gateway wrapper on a dynamic
  loopback port, so a Server Gateway and an unnecessary local Gateway are no
  longer started together.
• Connection settings, diagnostics, CSP, REST, and WebSocket routing now use
  the active Gateway uniformly. Remote raw Engines require HTTPS plus CA,
  client certificate, and private key material held by the Electron main
  process.

Downloads

• Windows: x64 NSIS installer and blockmap
• Linux: x86_64 AppImage and Debian package
• macOS: x64 and arm64 DMG/ZIP packages and blockmaps
• Server: attached GitHub release tarball harbor-desk-0.6.0.tgz
• Integrity: SHA256SUMS contains SHA-256 checksums for every distributable asset

npm distribution

The npm registry provides v0.6.0 under the preview dist-tag (the default latest dist-tag is unchanged). To run that exact version instead of following the latest dist-tag:

npm exec --yes harbor-desk@0.6.0 -- --version

Preview and security boundaries

This remains a prerelease. Desktop binaries are currently unsigned; verify SHA256SUMS before installation and use a source build where signed artifacts are required.

The desktop detects a configured Harbor Desk Gateway or Docker Engine. It uses a Server Gateway directly, and starts a bundled Local Gateway wrapper on 127.0.0.1 only for a raw Engine target. Docker access remains behind a Gateway; the renderer never receives a Docker socket or direct Engine connection. The optional server installer supports controlled Linux, Windows, and macOS Docker hosts, but requires explicit --allow-local-engine-socket acknowledgement before mounting a host's Docker Engine socket.

See SECURITY.md for the current security and dependency-advisory boundary.

Harbor Desk v0.5.3

Harbor Desk v0.5.3 preview

This preview contains the client-first desktop app with its automatic loopback policy gateway, plus the optional server-side Docker gateway installer.

Changes

Added

• The default server-side npm exec --yes harbor-desk command now opens a
  keyboard-driven TUI when run from an interactive SSH session.
• The TUI supplies safe defaults, detects the server Docker socket as the
  common connection, keeps remote Engine mTLS as an advanced choice, validates
  the configuration, and prints SSH tunnel plus Gateway/WebSocket connection
  information after installation.
• install is now an alias for install-server; non-interactive sessions fail
  with explicit SSH guidance instead of waiting for input.

Changed

• Server setup no longer opens a browser or requires users to assemble long
  installation arguments for the normal interactive path. Explicit options
  remain available for automation.

Downloads

• Windows: x64 NSIS installer and blockmap
• Linux: x86_64 AppImage and Debian package
• macOS: x64 and arm64 DMG/ZIP packages and blockmaps
• Server: attached GitHub release tarball harbor-desk-0.5.3.tgz
• Integrity: SHA256SUMS contains SHA-256 checksums for every distributable asset

npm distribution

The npm registry provides v0.5.3 under the preview dist-tag (the default latest dist-tag is unchanged). To run that exact version instead of following the latest dist-tag:

npm exec --yes harbor-desk@0.5.3 -- --version

Preview and security boundaries

This remains a prerelease. Desktop binaries are currently unsigned; verify SHA256SUMS before installation and use a source build where signed artifacts are required.

The desktop starts its bundled gateway automatically on 127.0.0.1 and does not require a local Docker Engine. Docker access remains behind the gateway; the renderer never receives a Docker socket or direct Engine connection. The optional server installer supports controlled Linux, Windows, and macOS Docker hosts, but requires explicit --allow-local-engine-socket acknowledgement before mounting a host's Docker Engine socket.

See SECURITY.md for the current security and dependency-advisory boundary.

Harbor Desk v0.5.2

Harbor Desk v0.5.2 preview

This preview contains the client-first desktop app with its automatic loopback policy gateway, plus the optional server-side Docker gateway installer.

Changes

Added

• The server-side npx harbor-desk install-server flow now supports a remote
  Docker Engine over HTTPS mTLS with --engine-endpoint, CA, client
  certificate, and client private key file options.
• Remote Engine credentials stay on the server host and are mounted read-only
  into the gateway container without mounting a Docker socket. The interactive
  setup and -AI context describe both Engine transport choices.

Security

• Remote Engine mode requires HTTPS and all three mTLS files, validates them
  before writing the install target, and rejects mixing remote mTLS with the
  privileged local Docker socket mount.

Downloads

• Windows: x64 NSIS installer and blockmap
• Linux: x86_64 AppImage and Debian package
• macOS: x64 and arm64 DMG/ZIP packages and blockmaps
• Server: attached GitHub release tarball harbor-desk-0.5.2.tgz
• Integrity: SHA256SUMS contains SHA-256 checksums for every distributable asset

npm distribution

The npm registry provides v0.5.2 under the preview dist-tag (the default latest dist-tag is unchanged). To run that exact version instead of following the latest dist-tag:

npx --yes harbor-desk@0.5.2 --version

Preview and security boundaries

This remains a prerelease. Desktop binaries are currently unsigned; verify SHA256SUMS before installation and use a source build where signed artifacts are required.

The desktop starts its bundled gateway automatically on 127.0.0.1 and does not require a local Docker Engine. Docker access remains behind the gateway; the renderer never receives a Docker socket or direct Engine connection. The optional server installer supports controlled Linux, Windows, and macOS Docker hosts, but requires explicit --allow-local-engine-socket acknowledgement before mounting a host's Docker Engine socket.

See SECURITY.md for the current security and dependency-advisory boundary.

Harbor Desk v0.5.1

Harbor Desk v0.5.1 preview

This preview contains the client-first desktop app with its automatic loopback policy gateway, plus the optional server-side Docker gateway installer.

Changes

Added

• The server-side npx harbor-desk install-server flow now offers an
  interactive terminal setup for the destination, port, network binding,
  authentication mode, OIDC provider file, browser origins, and Docker socket
  acknowledgement.
• -AI and --ai-context now provide stable machine-readable setup context for
  non-interactive agents without reading Docker, touching the filesystem, or
  exposing provider credentials.
• The installer supports an explicit public preview binding with OIDC, HTTPS
  provider endpoint validation, narrow allowed origins, and protected generated
  environment settings while retaining loopback plus development authentication
  as the default.

Security

• Public server preview setup rejects development authentication and requires
  OIDC configuration. TLS or reverse-proxy termination, firewall policy, and
  operational controls remain deployment responsibilities.

Downloads

• Windows: x64 NSIS installer and blockmap
• Linux: x86_64 AppImage and Debian package
• macOS: x64 and arm64 DMG/ZIP packages and blockmaps
• Server: attached GitHub release tarball harbor-desk-0.5.1.tgz
• Integrity: SHA256SUMS contains SHA-256 checksums for every distributable asset

npm distribution

The npm registry provides v0.5.1 under the preview dist-tag (the default latest dist-tag is unchanged). To run that exact version instead of following the latest dist-tag:

npx --yes harbor-desk@0.5.1 --version

Preview and security boundaries

This remains a prerelease. Desktop binaries are currently unsigned; verify SHA256SUMS before installation and use a source build where signed artifacts are required.

The desktop starts its bundled gateway automatically on 127.0.0.1 and does not require a local Docker Engine. Docker access remains behind the gateway; the renderer never receives a Docker socket or direct Engine connection. The optional server installer supports controlled Linux, Windows, and macOS Docker hosts, but requires explicit --allow-local-engine-socket acknowledgement before mounting a host's Docker Engine socket.

See SECURITY.md for the current security and dependency-advisory boundary.

Harbor Desk v0.5.0

Harbor Desk v0.5.0 preview

This preview contains the client-first desktop app with its automatic loopback policy gateway, plus the optional server-side Docker gateway installer.

Changes

Added

• The desktop client checks the public Harbor Desk GitHub Releases metadata
  after startup and reports available updates in the shared shell. General
  settings can disable startup checks or exclude preview releases, and the
  status bar can trigger a manual refresh.
• Update checks run in the Electron main process behind a narrow preload API.
  The client opens only the fixed Harbor Desk release-tag page after a user
  action and never downloads or executes an installer automatically.

Fixed

• Release checksum manifests now use portable asset basenames instead of the
  CI-only release-assets/ staging path.

Downloads

• Windows: x64 NSIS installer and blockmap
• Linux: x86_64 AppImage and Debian package
• macOS: x64 and arm64 DMG/ZIP packages and blockmaps
• Server: attached GitHub release tarball harbor-desk-0.5.0.tgz
• Integrity: SHA256SUMS contains SHA-256 checksums for every distributable asset

npm distribution

The npm registry provides v0.5.0. To run that exact version instead of following the latest dist-tag:

npx --yes harbor-desk@0.5.0 --version

Preview and security boundaries

This remains a prerelease. Desktop binaries are currently unsigned; verify SHA256SUMS before installation and use a source build where signed artifacts are required.

The desktop starts its bundled gateway automatically on 127.0.0.1 and does not require a local Docker Engine. Docker access remains behind the gateway; the renderer never receives a Docker socket or direct Engine connection. The optional server installer supports controlled Linux, Windows, and macOS Docker hosts, but requires explicit --allow-local-engine-socket acknowledgement before mounting a host's Docker Engine socket.

See SECURITY.md for the current security and dependency-advisory boundary.

Harbor Desk v0.4.0

Harbor Desk v0.4.0 preview

This preview contains the client-first desktop app with its automatic loopback policy gateway, plus the optional server-side Docker gateway installer.

Changes

Added

• The desktop app now starts its Fastify gateway automatically on the default
  http://127.0.0.1:4310 loopback endpoint before loading the interface and
  closes the managed runtime when the app quits.
• Each managed gateway receives a random per-launch desktop session token.
  Development authentication fails closed without that token even though the
  packaged file:// renderer origin is allowed through CORS.

Changed

• Harbor Desk now follows a client-first startup flow: users launch one desktop
  app and then add Docker Engine connections without running a separate gateway
  command. Explicit non-loopback gateway configurations and
  HARBOR_DISABLE_MANAGED_GATEWAY=1 continue to use an external gateway instead
  of silently starting another service.
• Troubleshoot and About diagnostics now report whether the gateway was managed
  by the desktop, supplied externally, disabled, or unavailable without exposing
  its per-launch token.

Fixed

• Release checksum generation now excludes SHA256SUMS itself, preventing the
  manifest from publishing an impossible self-referential hash.

Downloads

• Windows: x64 NSIS installer and blockmap
• Linux: x86_64 AppImage and Debian package
• macOS: x64 and arm64 DMG/ZIP packages and blockmaps
• Server: attached GitHub release tarball harbor-desk-0.4.0.tgz
• Integrity: SHA256SUMS contains SHA-256 checksums for every distributable asset

npm distribution

At release time, the npm registry's latest version was v0.2.0, so an unpinned npx --yes harbor-desk command will not fetch v0.4.0.

After downloading and verifying the attached tarball, run it explicitly:

npx --yes --package ./harbor-desk-0.4.0.tgz harbor-desk --version

Preview and security boundaries

This remains a prerelease. Desktop binaries are currently unsigned; verify SHA256SUMS before installation and use a source build where signed artifacts are required.

The desktop starts its bundled gateway automatically on 127.0.0.1 and does not require a local Docker Engine. Docker access remains behind the gateway; the renderer never receives a Docker socket or direct Engine connection. The optional server installer supports controlled Linux, Windows, and macOS Docker hosts, but requires explicit --allow-local-engine-socket acknowledgement before mounting a host's Docker Engine socket.

See SECURITY.md for the current security and dependency-advisory boundary.

Harbor Desk v0.3.2

Harbor Desk v0.3.2 preview

This preview contains the remote-first desktop client and the server-side Docker gateway installer.

Changes

Fixed

• The desktop shell now remains available after a restart or reload while the
  remote gateway is offline. Session bootstrap failures use the existing
  gateway-unavailable state instead of replacing the whole interface with a
  nearly blank error screen.

Changed

• The Windows NSIS installer now uses Harbor Desk application, header, welcome,
  finish, and uninstaller artwork; bilingual English/Korean assisted setup;
  explicit shortcut, install-scope, destination, and finish behavior; and
  branded Add/Remove Programs metadata.
• The Windows application explicitly runs as the invoking user, while the
  installer keeps optional elevation limited to a user-selected all-users
  install. The NSIS GUID is pinned to the identity already shipped in v0.3.1 so
  custom branding does not break upgrades.
• Release artifact transfer now uses the current Node 24-based
  actions/upload-artifact@v7 and actions/download-artifact@v8 actions.
• Generated release notes now include the matching changelog section and report
  whether the tagged package is actually available from npm. An attached GitHub
  tarball is no longer described as though it were already npm-published.
• The README documents how to compare GitHub and npm versions and how to invoke
  a downloaded, checksum-verified release tarball explicitly.

Downloads

• Windows: x64 NSIS installer and blockmap
• Linux: x86_64 AppImage and Debian package
• macOS: x64 and arm64 DMG/ZIP packages and blockmaps
• Server: attached GitHub release tarball harbor-desk-0.3.2.tgz
• Integrity: SHA256SUMS contains SHA-256 checksums for every distributable asset

npm distribution

At release time, the npm registry's latest version was v0.2.0, so an unpinned npx --yes harbor-desk command will not fetch v0.3.2.

After downloading and verifying the attached tarball, run it explicitly:

npx --yes --package ./harbor-desk-0.3.2.tgz harbor-desk --version

Preview and security boundaries

This remains a prerelease. Desktop binaries are currently unsigned; verify SHA256SUMS before installation and use a source build where signed artifacts are required.

The desktop client remains remote-first and does not require a local Docker Engine. The server installer supports controlled Linux, Windows, and macOS Docker hosts, but requires explicit --allow-local-engine-socket acknowledgement before mounting a host's Docker Engine socket.

See SECURITY.md for the current security and dependency-advisory boundary.

Harbor Desk v0.3.1

Harbor Desk v0.3.1 preview

v0.3.1 supersedes v0.3.0 for desktop installs.

Fixed in v0.3.1

• Fixed the packaged desktop client opening as an empty dark window. Vite had emitted root-relative /assets/... URLs, which Electron could not load from the packaged file:// page.
• Renderer JavaScript and CSS references are now package-relative (./assets/...).
• Added a regression test that inspects the built renderer HTML and verifies that every local asset reference is relative and resolves to a packaged file.

The Windows x64 installer was also installed over v0.3.0 and smoke-tested locally; the full remote-first Containers UI rendered successfully.

Downloads

• Windows: x64 NSIS installer and blockmap
• Linux: x86_64 AppImage and Debian package
• macOS: x64 and arm64 DMG/ZIP packages and blockmaps
• Server: harbor-desk-0.3.1.tgz
• Integrity: SHA256SUMS contains SHA-256 checksums for all 14 assets

The attached server tarball is v0.3.1. The public npm registry currently remains at v0.2.0, so npx --yes harbor-desk install-server will not fetch this release until the registry is synchronized.

Verification

• Tag commit: a59cf3576f1bd4e1ca208e416c244a56a2ffaf81
• Release workflow: all verification and Windows/Linux/macOS packaging jobs passed
• Downloaded Windows installer SHA-256: 773a972d5a3b823393d25a956ea1b1275c6b8cb1e2a0ccbc0e7c6dcabc8ec539
• The downloaded installer hash matches both SHA256SUMS and GitHub's asset digest

Preview and security boundaries

This remains a prerelease. Desktop binaries are currently unsigned; verify SHA256SUMS before installation and use a source build where signed artifacts are required.

The server installer supports Linux, Windows, and macOS hosts running Docker or Docker Desktop. Harbor Desk remains remote-first and requires explicit --allow-local-engine-socket acknowledgement before mounting a host's local Docker Engine socket.

A known high-severity transitive extract-zip advisory currently affects Electron's install-time build tooling, and no patched npm release is available as of this release. It is not included in the runtime server tarball; see SECURITY.md for the documented boundary.

Harbor Desk v0.3.0

Harbor Desk v0.3.0 preview

This preview contains the remote-first desktop client and the server-side
Docker gateway installer.

Downloads

• Linux client: x86_64 AppImage and Debian package
• Windows client: x64 NSIS installer
• macOS client: x64 and arm64 DMG/ZIP packages
• Server: npm package for npx --yes harbor-desk install-server
• SHA256SUMS: SHA-256 checksums for every release asset

The server installer supports Linux, Windows, and macOS hosts running
Docker or Docker Desktop. It is a development preview and requires an
explicit --allow-local-engine-socket acknowledgement when the local
Docker Engine socket is mounted.

Desktop binaries are currently unsigned. Verify SHA256SUMS before
installation and use the source build for environments that require
signed artifacts.