Skip to content

Harbor Desk v0.4.0

Pre-release
Pre-release

Choose a tag to compare

View all tags
@github-actions github-actions released this 28 Aug 09:50
· 71 commits to main since this release
v0.4.0
339a296
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Harbor Desk v0.4.0 preview

This preview contains the client-first desktop app with its automatic loopback policy gateway, plus the optional server-side Docker gateway installer.

Changes

Added

  • The desktop app now starts its Fastify gateway automatically on the default
    http://127.0.0.1:4310 loopback endpoint before loading the interface and
    closes the managed runtime when the app quits.
  • Each managed gateway receives a random per-launch desktop session token.
    Development authentication fails closed without that token even though the
    packaged file:// renderer origin is allowed through CORS.

Changed

  • Harbor Desk now follows a client-first startup flow: users launch one desktop
    app and then add Docker Engine connections without running a separate gateway
    command. Explicit non-loopback gateway configurations and
    HARBOR_DISABLE_MANAGED_GATEWAY=1 continue to use an external gateway instead
    of silently starting another service.
  • Troubleshoot and About diagnostics now report whether the gateway was managed
    by the desktop, supplied externally, disabled, or unavailable without exposing
    its per-launch token.

Fixed

  • Release checksum generation now excludes SHA256SUMS itself, preventing the
    manifest from publishing an impossible self-referential hash.

Downloads

  • Windows: x64 NSIS installer and blockmap
  • Linux: x86_64 AppImage and Debian package
  • macOS: x64 and arm64 DMG/ZIP packages and blockmaps
  • Server: attached GitHub release tarball harbor-desk-0.4.0.tgz
  • Integrity: SHA256SUMS contains SHA-256 checksums for every distributable asset

npm distribution

At release time, the npm registry's latest version was v0.2.0, so an unpinned npx --yes harbor-desk command will not fetch v0.4.0.

After downloading and verifying the attached tarball, run it explicitly:

npx --yes --package ./harbor-desk-0.4.0.tgz harbor-desk --version

Preview and security boundaries

This remains a prerelease. Desktop binaries are currently unsigned; verify SHA256SUMS before installation and use a source build where signed artifacts are required.

The desktop starts its bundled gateway automatically on 127.0.0.1 and does not require a local Docker Engine. Docker access remains behind the gateway; the renderer never receives a Docker socket or direct Engine connection. The optional server installer supports controlled Linux, Windows, and macOS Docker hosts, but requires explicit --allow-local-engine-socket acknowledgement before mounting a host's Docker Engine socket.

See SECURITY.md for the current security and dependency-advisory boundary.

Assets 16
Loading