Levelrail releases

Levelrail v0.2.0-beta.10: Correct Vikunja and Keycloak catalog...

2026-09-23T05:01:59Z

NOTE

This is a pre-release on the beta channel. Pin this exact version for anything you care about staying still.

What's changed

Bug fixes

correct Vikunja and Keycloak catalog templates so they boot (#615) by @thegdsks

Maintenance, CI, and dependency updates (1)

batch dependency updates (grpc, modernc.org/sqlite) (#614) by @thegdsks

Install

Fresh install on a Linux host, pinned to this release:

curl -fsSL https://raw.githubusercontent.com/glincker/levelrail/main/install.sh | sudo env LEVELRAIL_VERSION=v0.2.0-beta.10 sh

Upgrade an existing install in place (keeps the unit file and data):

curl -fsSL https://raw.githubusercontent.com/glincker/levelrail/main/install.sh | sudo env LEVELRAIL_VERSION=v0.2.0-beta.10 sh -s upgrade

Docker Compose: pin the image tag in docker-compose.yml:

yaml

services:
  levelrail:
    image: ghcr.io/glincker/levelrail:v0.2.0-beta.10

Container images

Multi-arch (linux/amd64, linux/arm64), signed with cosign, SBOM and provenance attached. Also tagged beta at release time (moving tags).

Image	Tag	Digest
`ghcr.io/glincker/levelrail`	`v0.2.0-beta.10`	`sha256:41e837446c28180acf6728459199996e68f1a3e7dda1e8f8c4e4441f482429bc`
`ghcr.io/glincker/levelrail-agent`	`v0.2.0-beta.10`	`sha256:c776ea59f47cbd8944bca76bef13361e6390977b9fdbbe6885ad66f4aa082936`

Verify

Binaries: check downloads against checksums.txt:

gh release download v0.2.0-beta.10 --repo glincker/levelrail --pattern 'levelrail-linux-amd64' --pattern checksums.txt
sha256sum --ignore-missing -c checksums.txt

Images: verify the keyless signature was made by this repository's release workflow:

cosign verify ghcr.io/glincker/levelrail@sha256:41e837446c28180acf6728459199996e68f1a3e7dda1e8f8c4e4441f482429bc \
  --certificate-identity-regexp '^https://github\.com/glincker/levelrail/\.github/workflows/release\.yml@refs/(heads/main|tags/v.+)$' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Contributors

Thanks to @thegdsks.

Full changelog: v0.2.0-beta.9...v0.2.0-beta.10 | Release page | Installing | Upgrading | Verifying signatures

Levelrail v0.2.0-beta.9: Bundle docs/ into the web build stage of...

2026-09-23T04:27:56Z

NOTE

This is a pre-release on the beta channel. Pin this exact version for anything you care about staying still.

What's changed

Bug fixes

bundle docs/ into the web build stage of the Docker image (#611) by @thegdsks

Install

Fresh install on a Linux host, pinned to this release:

curl -fsSL https://raw.githubusercontent.com/glincker/levelrail/main/install.sh | sudo env LEVELRAIL_VERSION=v0.2.0-beta.9 sh

Upgrade an existing install in place (keeps the unit file and data):

curl -fsSL https://raw.githubusercontent.com/glincker/levelrail/main/install.sh | sudo env LEVELRAIL_VERSION=v0.2.0-beta.9 sh -s upgrade

Docker Compose: pin the image tag in docker-compose.yml:

yaml

services:
  levelrail:
    image: ghcr.io/glincker/levelrail:v0.2.0-beta.9

Container images

Multi-arch (linux/amd64, linux/arm64), signed with cosign, SBOM and provenance attached. Also tagged beta at release time (moving tags).

Image	Tag	Digest
`ghcr.io/glincker/levelrail`	`v0.2.0-beta.9`	`sha256:ee87c125124bfe2f80bbf43a79225d691c282543daff725ac77e3f50bc5a9fcb`
`ghcr.io/glincker/levelrail-agent`	`v0.2.0-beta.9`	`sha256:f40e14cdc8965c5e334bbfc8ed7cc99779896fdd67d6ca6bff73d5aac806cb55`

Verify

Binaries: check downloads against checksums.txt:

gh release download v0.2.0-beta.9 --repo glincker/levelrail --pattern 'levelrail-linux-amd64' --pattern checksums.txt
sha256sum --ignore-missing -c checksums.txt

Images: verify the keyless signature was made by this repository's release workflow:

cosign verify ghcr.io/glincker/levelrail@sha256:ee87c125124bfe2f80bbf43a79225d691c282543daff725ac77e3f50bc5a9fcb \
  --certificate-identity-regexp '^https://github\.com/glincker/levelrail/\.github/workflows/release\.yml@refs/(heads/main|tags/v.+)$' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Contributors

Thanks to @thegdsks.

Full changelog: v0.2.0-beta.8...v0.2.0-beta.9 | Release page | Installing | Upgrading | Verifying signatures

Levelrail v0.2.0-beta.8: Https, redirect, status-range and exec...

2026-09-23T04:15:35Z

0.2.0-beta.8 (2026-09-23)

Features

https, redirect, status-range and exec health probes; active checks for 71 catalog templates (#610) (790496b)
rich release notes, release announcements, and an SEO changelog on the docs site (#607) (a324be0)

Bug Fixes

correct install/compose docs and fix doctor port_80 false fail (#591) (09c7d6d)
resolve high and critical CodeQL alerts (SSRF, email injection, zip slip, path injection, enrollment CA pin) (#609) (cd3487c)

Levelrail v0.2.0-beta.7: Setup wizard with live server, domain...

2026-09-23T02:26:12Z

NOTE

This is a pre-release on the beta channel. Pin this exact version for anything you care about staying still.

What's changed

Features

setup wizard with live server, domain, git, and first app verification (#587) by @thegdsks

Security

bump dependencies for security advisories (#583) by @thegdsks

Maintenance, CI, and dependency updates (1)

de-flake TestLive_ExecTTY and RamFitBadge, reapply orphaned webhook fixture (#586) by @thegdsks

Install

Fresh install on a Linux host, pinned to this release:

curl -fsSL https://raw.githubusercontent.com/glincker/levelrail/main/install.sh | sudo env LEVELRAIL_VERSION=v0.2.0-beta.7 sh

Upgrade an existing install in place (keeps the unit file and data):

curl -fsSL https://raw.githubusercontent.com/glincker/levelrail/main/install.sh | sudo env LEVELRAIL_VERSION=v0.2.0-beta.7 sh -s upgrade

Docker Compose: pin the image tag in docker-compose.yml:

yaml

services:
  levelrail:
    image: ghcr.io/glincker/levelrail:v0.2.0-beta.7

Container images

Multi-arch (linux/amd64, linux/arm64), signed with cosign, SBOM and provenance attached. Also tagged beta at release time (moving tags).

Image	Tag	Digest
`ghcr.io/glincker/levelrail`	`v0.2.0-beta.7`	`sha256:047e6971b67ffde2a233eefcd5d2759000becfe522309b4567690be38cc31cb1`
`ghcr.io/glincker/levelrail-agent`	`v0.2.0-beta.7`	`sha256:493a0fa474cafefd7726191932affdad2c86d2816250043bd106efa459354935`

Verify

Binaries: check downloads against checksums.txt:

gh release download v0.2.0-beta.7 --repo glincker/levelrail --pattern 'levelrail-linux-amd64' --pattern checksums.txt
sha256sum --ignore-missing -c checksums.txt

Images: verify the keyless signature was made by this repository's release workflow:

cosign verify ghcr.io/glincker/levelrail@sha256:047e6971b67ffde2a233eefcd5d2759000becfe522309b4567690be38cc31cb1 \
  --certificate-identity-regexp '^https://github\.com/glincker/levelrail/\.github/workflows/release\.yml@refs/(heads/main|tags/v.+)$' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Contributors

Thanks to @thegdsks.

Full changelog: v0.2.0-beta.6...v0.2.0-beta.7 | Release page | Installing | Upgrading | Verifying signatures

Levelrail v0.2.0-beta.6: Per-app exec/shell access opt-out...

2026-09-23T01:50:28Z

NOTE

This is a pre-release on the beta channel. Pin this exact version for anything you care about staying still.

Highlights

per-app exec/shell access opt-out, defaults enabled (#542) by @thegdsks
per-app outbound network allowlist (egress gateway) (#543) by @thegdsks
egress allowlist UI on the app network page (#545) by @thegdsks

What's changed

Features

per-app exec/shell access opt-out, defaults enabled (#542) by @thegdsks
per-app outbound network allowlist (egress gateway) (#543) by @thegdsks
egress allowlist UI on the app network page (#545) by @thegdsks
actionable CTAs on System Status, reusable docs help links (#551) by @thegdsks
Gitea as a fourth git provider (#553) by @thegdsks
configurable ingress HTTP/HTTPS listen ports (#556) by @thegdsks
WireGuard mesh key rotation and peer status visibility (#561) by @thegdsks
clone a whole environment's app set into a new environment (#562) by @thegdsks
distribute WireGuard mesh config to remote nodes over gRPC (#564) by @thegdsks
point-in-time restore for Postgres databases (#566) by @thegdsks
secret age tracking and rotation reminders (#563) by @thegdsks
two-person approval gate for deploys into protected environments (#567) by @thegdsks
detect and clean up orphaned named Docker volumes (#569) by @thegdsks
fleet-wide node CPU/memory/disk utilization view (#575) by @thegdsks
healthchecks and memory advisories for all 129 catalog templates (#576) by @thegdsks
add container restart count and build duration metrics (#560) by @thegdsks
empty states with prerequisite hints and template CTA (#579) by @thegdsks
doctor network, resource, and multi-firewall checks (#581) by @thegdsks
slow query log for Postgres/MySQL databases (#565) by @thegdsks
install works end to end (setup token, HTTP login, installer preflight) (#582) by @thegdsks

Bug fixes

confirm detach actions and surface missing success toasts (#546) by @thegdsks
stop doctor's port 80/443 check from false-failing on its own ingress (#547) by @thegdsks
live resource updates fail silently when only memory is set, no swap (#548) by @thegdsks
type errors blocking the real production build (npm run build) (#549) by @thegdsks
app status rollup, compose service pruning, and group lookup by app name (#552) by @thegdsks
stop treating unlabeled Docker networks as this instance's own (#557) by @thegdsks
detect frozen agent processes via heartbeat frames and gRPC keepalive (#558) by @thegdsks
retry transient SMTP failures for email notification channel (#559) by @thegdsks
rate limit the unauthenticated git webhook receiver (#574) by @thegdsks
wire Bitbucket App secrets manager, OAuth connect was permanently broken (#555) by @thegdsks
doctor's disk space check shows raw byte counts, not human-readable (#550) by @thegdsks

Documentation

document secret age tracking and rotation reminders (PR #563) (#573) by @thegdsks
update roadmap and status for recently shipped features (#572) by @thegdsks
add slow query log viewer documentation (#571) by @thegdsks
two-person deploy approval gate and environment cloning workflows (#570) by @thegdsks
add node heartbeat configuration and mesh status/key-rotation documentation (#568) by @thegdsks
add GLINR Discord community links (#584) by @thegdsks

Maintenance, CI, and dependency updates (6)

cut a duplicate check job and de-flake the frontend suite (#554) by @thegdsks
bump docker/setup-buildx-action from 4.3.0 to 4.4.0 (#477)
bump golang.org/x/crypto from 0.56.0 to 0.57.0 (#481)
bump @xterm/xterm from 5.5.0 to 6.0.0 in /web (#478)
run CI on docs-only PRs so required checks report (#580) by @thegdsks
Image tag channels, cosign signing, and a committed compose file (#578) by @thegdsks

Install

Fresh install on a Linux host, pinned to this release:

curl -fsSL https://raw.githubusercontent.com/glincker/levelrail/main/install.sh | sudo env LEVELRAIL_VERSION=v0.2.0-beta.6 sh

Upgrade an existing install in place (keeps the unit file and data):

curl -fsSL https://raw.githubusercontent.com/glincker/levelrail/main/install.sh | sudo env LEVELRAIL_VERSION=v0.2.0-beta.6 sh -s upgrade

Docker Compose: pin the image tag in docker-compose.yml:

yaml

services:
  levelrail:
    image: ghcr.io/glincker/levelrail:v0.2.0-beta.6

Container images

Multi-arch (linux/amd64, linux/arm64), signed with cosign, SBOM and provenance attached. Also tagged beta at release time (moving tags).

Image	Tag	Digest
`ghcr.io/glincker/levelrail`	`v0.2.0-beta.6`	`sha256:3db4d59e87b8cd6a0fdf37c1c6c29b13d2fe16842d455a93eaad9fbb08754b27`
`ghcr.io/glincker/levelrail-agent`	`v0.2.0-beta.6`	`sha256:cf217a7ec07c2d9fefe844d77529acba66185175681b677ac90373fd444ba119`

Verify

Binaries: check downloads against checksums.txt:

gh release download v0.2.0-beta.6 --repo glincker/levelrail --pattern 'levelrail-linux-amd64' --pattern checksums.txt
sha256sum --ignore-missing -c checksums.txt

Images: verify the keyless signature was made by this repository's release workflow:

cosign verify ghcr.io/glincker/levelrail@sha256:3db4d59e87b8cd6a0fdf37c1c6c29b13d2fe16842d455a93eaad9fbb08754b27 \
  --certificate-identity-regexp '^https://github\.com/glincker/levelrail/\.github/workflows/release\.yml@refs/(heads/main|tags/v.+)$' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Contributors

Thanks to @thegdsks.

Full changelog: v0.2.0-beta.5...v0.2.0-beta.6 | Release page | Installing | Upgrading | Verifying signatures

Levelrail v0.2.0-beta.5: CLI coverage for backup download...

2026-09-21T19:16:56Z

CAUTION

This release shipped no binaries or container images (its build did not publish). Use v0.2.0-beta.6 instead, which includes every change below.

What's changed

Features

CLI coverage for backup download, database logs, node placement (#529) by @thegdsks
CLI coverage for database attachment, manual build trigger, moves, resources, AI settings, git providers (#536) by @thegdsks
per-service readyTimeout override for the reconciler's readiness budget (#539) by @thegdsks

Bug fixes

never treat a master key read failure as no key yet (#522) by @thegdsks
resolve migration number collision at 0106 (#524) by @thegdsks
manual builds tag by resolved commit, pending image never hits Docker (#530) by @thegdsks
accessibility gaps in form labeling and muted-text contrast (#528) by @thegdsks
respect prefers-reduced-motion and avoid layout-triggering progress transition (#531) by @thegdsks
extend IAM resource scoping to 79 mutating app and database routes (#532) by @thegdsks
make tag CLI commands consistently take a name, not a mix of name and ID (#533) by @thegdsks
nudge reconciler after a build-triggered deploy completes (#534) by @thegdsks
classify a pre-port-bind crash as a crash reason, not generic ReadinessFailed (#535) by @thegdsks
scope container and network cleanup to this control plane's own instance (#537) by @thegdsks
rearm crashloop auto-rollback for a second, different bad deploy (#540) by @thegdsks
enforce required secrets on the build-triggered deploy path, not just webhook (#541) by @thegdsks

Documentation

document tags, shared env var secrets, and the fleet resource chart (#527) by @thegdsks
tag CLI names, IAM scoping, new CLI commands (#538) by @thegdsks

Maintenance, CI, and dependency updates (5)

Deploy pipeline polish: readiness fix, release triggers, auto-rollback, env upload (#519) by @thegdsks
BYOK AI assistant: MCP network transport, chat engine, and UI (#521) by @thegdsks
bump internal/api test timeout from 10m to 13m (#525) by @thegdsks
Multi-node OOM fix, disk-space preflight, default error boundary, UI consistency (#526) by @thegdsks
Dashboard resource chart, tags, and shared env var secrets/CLI/UI (#520) by @thegdsks

Container images

Multi-arch (linux/amd64, linux/arm64), signed with cosign, SBOM and provenance attached. Also tagged beta at release time (moving tags).

Image	Tag	Digest
`ghcr.io/glincker/levelrail-agent`	`v0.2.0-beta.5`	`sha256:daea6a4d899ee5b72bf79667dc777578558f971ac06f6d2a0569d8c4e71a2b82`

Verify

Images: verify the keyless signature was made by this repository's release workflow:

cosign verify ghcr.io/glincker/levelrail-agent@sha256:daea6a4d899ee5b72bf79667dc777578558f971ac06f6d2a0569d8c4e71a2b82 \
  --certificate-identity-regexp '^https://github\.com/glincker/levelrail/\.github/workflows/release\.yml@refs/(heads/main|tags/v.+)$' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Contributors

Thanks to @thegdsks.

Full changelog: v0.2.0-beta.4...v0.2.0-beta.5 | Release page | Installing | Upgrading | Verifying signatures

Levelrail v0.2.0-beta.4: Add domain-level custom error pages, Add...

2026-09-20T08:03:53Z

NOTE

This is a pre-release on the beta channel. Pin this exact version for anything you care about staying still.

Highlights

add domain-level custom error pages (#511) by @thegdsks
add curated local AI model templates to the service catalog (#514) by @thegdsks
collect real host memory for the control plane's own node (#515) by @thegdsks

What's changed

Features

add domain-level custom error pages (#511) by @thegdsks
add curated local AI model templates to the service catalog (#514) by @thegdsks
collect real host memory for the control plane's own node (#515) by @thegdsks
live RAM-fit check in the AI template wizard (#516) by @thegdsks

Documentation

wire up VitePress build to the GitHub Actions Pages deploy (#508) by @thegdsks
rail signal theme, SEO/AI-readiness assets, and readability pass (#510) by @thegdsks
mermaid diagrams, accordions, code groups, and cross-links (#513) by @thegdsks
SEO infra (canonical URLs, BreadcrumbList, AI crawler allowlist) (#517) by @thegdsks
self-hosted typography, homepage screenshots, richer footer (#518) by @thegdsks

Maintenance, CI, and dependency updates (1)

Create CNAME (cf94972) by @thegdsks

Install

Fresh install on a Linux host, pinned to this release:

curl -fsSL https://raw.githubusercontent.com/glincker/levelrail/main/install.sh | sudo env LEVELRAIL_VERSION=v0.2.0-beta.4 sh

Upgrade an existing install in place (keeps the unit file and data):

curl -fsSL https://raw.githubusercontent.com/glincker/levelrail/main/install.sh | sudo env LEVELRAIL_VERSION=v0.2.0-beta.4 sh -s upgrade

Docker Compose: pin the image tag in docker-compose.yml:

yaml

services:
  levelrail:
    image: ghcr.io/glincker/levelrail:v0.2.0-beta.4

Container images

Multi-arch (linux/amd64, linux/arm64), signed with cosign, SBOM and provenance attached. Also tagged beta at release time (moving tags).

Image	Tag	Digest
`ghcr.io/glincker/levelrail`	`v0.2.0-beta.4`	`sha256:0abd27fc1ad50075bde71a8928772876d17cb7f745142ba2b5a61666f1c4251e`
`ghcr.io/glincker/levelrail-agent`	`v0.2.0-beta.4`	`sha256:d5257950a1d930ee62182bd482f536b133fc38ff468038c60dec0412e7bf5879`

Verify

Binaries: check downloads against checksums.txt:

gh release download v0.2.0-beta.4 --repo glincker/levelrail --pattern 'levelrail-linux-amd64' --pattern checksums.txt
sha256sum --ignore-missing -c checksums.txt

Images: verify the keyless signature was made by this repository's release workflow:

cosign verify ghcr.io/glincker/levelrail@sha256:0abd27fc1ad50075bde71a8928772876d17cb7f745142ba2b5a61666f1c4251e \
  --certificate-identity-regexp '^https://github\.com/glincker/levelrail/\.github/workflows/release\.yml@refs/(heads/main|tags/v.+)$' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Contributors

Thanks to @thegdsks.

Full changelog: v0.2.0-beta.3...v0.2.0-beta.4 | Release page | Installing | Upgrading | Verifying signatures

Levelrail v0.2.0-beta.3: Add DNS-01 provider abstraction with...

2026-09-20T02:15:22Z

NOTE

This is a pre-release on the beta channel. Pin this exact version for anything you care about staying still.

Highlights

add DNS-01 provider abstraction with Route53 as a second provider (#492) by @thegdsks
per-preview env var overrides on parent app (#493) by @thegdsks
add instance-wide backup history view (#503) by @thegdsks

What's changed

Features

add DNS-01 provider abstraction with Route53 as a second provider (#492) by @thegdsks
per-preview env var overrides on parent app (#493) by @thegdsks
add instance-wide backup history view (#503) by @thegdsks
add deploy log download endpoint, CLI command, and UI button (#504) by @thegdsks
add concurrency_policy to scheduled tasks (#495) by @thegdsks
per-service pull_policy support for Docker Compose imports (#494) by @thegdsks
add domain-level redirects (#507) by @thegdsks
default published ports to a private bind address (#496) by @thegdsks

Bug fixes

lazy-load scoped sidebars, align react-dom to react 19.3.0 (#499) by @thegdsks
restore explicit Control cast for BackupMissingFields props (#500) by @thegdsks
resolve migration number collision at 0098 (#505) by @thegdsks
renumber colliding scheduled-task migration to 0101 (#506) by @thegdsks

Maintenance, CI, and dependency updates (19)

bump @tanstack/react-virtual from 3.14.11 to 3.14.13 in /web (#469)
bump @tanstack/router-plugin from 1.168.36 to 1.168.38 in /web (#470)
bump react and @types/react in /web (#472)
bump eslint-plugin-react-refresh from 0.5.6 to 0.5.7 in /web (#473)
bump @xterm/addon-fit from 0.10.0 to 0.11.0 in /web (#475)
bump tailwind-merge from 3.6.0 to 3.7.0 in /web (#479)
bump zod from 4.5.4 to 4.6.5 in /web (#476)
bump vite from 8.2.2 to 8.3.0 in /web (#484)
bump react-hook-form from 7.87.0 to 7.88.0 in /web (#485)
bump @thesvg/react from 3.3.3 to 3.3.7 in /web (#471)
bump @types/node from 26.5.0 to 26.5.1 in /web (#482)
bump docker/build-push-action from 7.3.0 to 7.4.0 (#467)
bump github.com/modelcontextprotocol/go-sdk from 1.7.0 to 1.8.0 (#483)
bump github.com/aws/aws-sdk-go-v2/credentials (#487)
bump github.com/aws/aws-sdk-go-v2/service/sesv2 (#490)
bump github.com/aws/aws-sdk-go-v2/feature/s3/manager (#486)
affected-package-scoped, race-free local test hooks (#502) by @thegdsks
add regression guard for Docker API version negotiation (#498) by @thegdsks
run frontend test suite in CI (#497) by @thegdsks

Install

Fresh install on a Linux host, pinned to this release:

curl -fsSL https://raw.githubusercontent.com/glincker/levelrail/main/install.sh | sudo env LEVELRAIL_VERSION=v0.2.0-beta.3 sh

Upgrade an existing install in place (keeps the unit file and data):

curl -fsSL https://raw.githubusercontent.com/glincker/levelrail/main/install.sh | sudo env LEVELRAIL_VERSION=v0.2.0-beta.3 sh -s upgrade

Docker Compose: pin the image tag in docker-compose.yml:

yaml

services:
  levelrail:
    image: ghcr.io/glincker/levelrail:v0.2.0-beta.3

Container images

Multi-arch (linux/amd64, linux/arm64), signed with cosign, SBOM and provenance attached. Also tagged beta at release time (moving tags).

Image	Tag	Digest
`ghcr.io/glincker/levelrail`	`v0.2.0-beta.3`	`sha256:44ce0a481e7f01c94878ee8d483a6a675c329d9852e6fec9bac152a00e55e40f`
`ghcr.io/glincker/levelrail-agent`	`v0.2.0-beta.3`	`sha256:a71b5cde80386d7f712485b22fc8764d369dd6708ccdb61a4baac33757d6120d`

Verify

Binaries: check downloads against checksums.txt:

gh release download v0.2.0-beta.3 --repo glincker/levelrail --pattern 'levelrail-linux-amd64' --pattern checksums.txt
sha256sum --ignore-missing -c checksums.txt

Images: verify the keyless signature was made by this repository's release workflow:

cosign verify ghcr.io/glincker/levelrail@sha256:44ce0a481e7f01c94878ee8d483a6a675c329d9852e6fec9bac152a00e55e40f \
  --certificate-identity-regexp '^https://github\.com/glincker/levelrail/\.github/workflows/release\.yml@refs/(heads/main|tags/v.+)$' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Contributors

Thanks to @thegdsks.

Full changelog: v0.2.0-beta.2...v0.2.0-beta.3 | Release page | Installing | Upgrading | Verifying signatures

Levelrail v0.2.0-beta.2: Zero-config sslip.io URL for apps with no...

2026-09-18T03:57:25Z

CAUTION

This release shipped no binaries or container images (its build did not publish). Use v0.2.0-beta.3 instead, which includes every change below.

Highlights

zero-config sslip.io URL for apps with no domain configured (#447) by @thegdsks
add Content-Security-Policy and opt-in HSTS, fix healthz routing (#449) by @thegdsks
fail fast when a container is OOM-killed during readiness wait (#451) by @thegdsks

What's changed

Features

zero-config sslip.io URL for apps with no domain configured (#447) by @thegdsks
add Content-Security-Policy and opt-in HSTS, fix healthz routing (#449) by @thegdsks
fail fast when a container is OOM-killed during readiness wait (#451) by @thegdsks
add apps wait and apps deploys list CLI commands (#460) by @thegdsks
first-party GitHub Action for deploying to Levelrail from CI (#461) by @thegdsks
selective backup archive deletion (#462) by @thegdsks
move an app to another node with its volumes (#464) by @thegdsks
resolve app secrets live from an external HashiCorp Vault instance (#465) by @thegdsks
add backup_missing alert rule kind (#463) by @thegdsks

Bug fixes

bound live Docker inspect calls with a timeout (#450) by @thegdsks
poll deploy status live so a rollback's actual progress is visible (#452) by @thegdsks
suppress duplicate lines when a log stream's EventSource reconnects (#453) by @thegdsks
retry transient notification delivery failures (#454) by @thegdsks
recognize every reconciler failure reason in the rollout stage (#458) by @thegdsks
revert cel-go bump that broke the build (#459) by @thegdsks
cut new-code duplication in the move-with-volumes handler and CLI (#466) by @thegdsks

Documentation

9 feature how-to guides plus exhaustive CLI and API reference (#446) by @thegdsks
cover CapRover migration, refresh roadmap against current main (#456) by @thegdsks
fix stale claims on the public comparison page (#457) by @thegdsks

Maintenance, CI, and dependency updates (1)

bump github.com/google/cel-go (#455)

Container images

Multi-arch (linux/amd64, linux/arm64), signed with cosign, SBOM and provenance attached. Also tagged beta at release time (moving tags).

Image	Tag	Digest
`ghcr.io/glincker/levelrail-agent`	`v0.2.0-beta.2`	`sha256:301e34c411d70b40c601a56d0ef54f60e03bfc7b53559650f11b7e30f1133091`

Verify

Images: verify the keyless signature was made by this repository's release workflow:

cosign verify ghcr.io/glincker/levelrail-agent@sha256:301e34c411d70b40c601a56d0ef54f60e03bfc7b53559650f11b7e30f1133091 \
  --certificate-identity-regexp '^https://github\.com/glincker/levelrail/\.github/workflows/release\.yml@refs/(heads/main|tags/v.+)$' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Contributors

Thanks to @thegdsks.

Full changelog: v0.2.0-beta.1...v0.2.0-beta.2 | Release page | Installing | Upgrading | Verifying signatures

Levelrail v0.2.0-beta.1: Add database stop/start lifecycle, API...

2026-09-13T04:44:07Z

NOTE

This is a pre-release on the beta channel. Pin this exact version for anything you care about staying still.

Highlights

add database stop/start lifecycle, API, CLI, and dashboard (#440) by @thegdsks
rank apps by live CPU, memory, and network usage on the dashboard (#443) by @thegdsks
add bulk restart for every app in a project (#442) by @thegdsks

What's changed

Features

add database stop/start lifecycle, API, CLI, and dashboard (#440) by @thegdsks
rank apps by live CPU, memory, and network usage on the dashboard (#443) by @thegdsks
add bulk restart for every app in a project (#442) by @thegdsks
pause and resume an entire project (#441) by @thegdsks
production-readiness batch - reconciler responsiveness, hardening, README (#445) by @thegdsks

Bug fixes

recognize AlreadyRunning as a done rollout condition (#439) by @thegdsks

Install

Fresh install on a Linux host, pinned to this release:

curl -fsSL https://raw.githubusercontent.com/glincker/levelrail/main/install.sh | sudo env LEVELRAIL_VERSION=v0.2.0-beta.1 sh

Upgrade an existing install in place (keeps the unit file and data):

curl -fsSL https://raw.githubusercontent.com/glincker/levelrail/main/install.sh | sudo env LEVELRAIL_VERSION=v0.2.0-beta.1 sh -s upgrade

Docker Compose: pin the image tag in docker-compose.yml:

yaml

services:
  levelrail:
    image: ghcr.io/glincker/levelrail:v0.2.0-beta.1

Container images

Multi-arch (linux/amd64, linux/arm64), signed with cosign, SBOM and provenance attached. Also tagged beta at release time (moving tags).

Image	Tag	Digest
`ghcr.io/glincker/levelrail`	`v0.2.0-beta.1`	`sha256:66d714269f82511712e7bf2001c5ff9eb407a997c43e8bc8b9363da8d852bf6a`
`ghcr.io/glincker/levelrail-agent`	`v0.2.0-beta.1`	`sha256:7795c41c2fd15bce90f351c4eb0c7d5d136254909fd5773b6715bef0d5326028`

Verify

Binaries: check downloads against checksums.txt:

gh release download v0.2.0-beta.1 --repo glincker/levelrail --pattern 'levelrail-linux-amd64' --pattern checksums.txt
sha256sum --ignore-missing -c checksums.txt

Images: verify the keyless signature was made by this repository's release workflow:

cosign verify ghcr.io/glincker/levelrail@sha256:66d714269f82511712e7bf2001c5ff9eb407a997c43e8bc8b9363da8d852bf6a \
  --certificate-identity-regexp '^https://github\.com/glincker/levelrail/\.github/workflows/release\.yml@refs/(heads/main|tags/v.+)$' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Contributors

Thanks to @thegdsks.

Full changelog: v0.2.0-beta...v0.2.0-beta.1 | Release page | Installing | Upgrading | Verifying signatures

Levelrail v0.2.0-beta: Add CLI metrics query and live log tailing...

2026-09-12T22:49:04Z

0.2.0-beta (2026-09-12)

Features

add CLI metrics query and live log tailing (#394) (41d253c)
add VitePress docs and landing site for GitHub Pages (#387) (e2b3ee1)
alert/channel editing, deploy-notify+promote MCP, secrets at app-create, reconciler test gaps (#433) (22e6032)
close CLI feature-completeness gaps for settings, storage, and git apps (#396) (ebf8362)
compose command/bind-mounts, self-service invites, more templates/tools/channels, e2e hardening (53846e6)
compose entrypoint, app.yaml command/bind-mounts, external registry browsing, more templates and MCP tools (#385) (753b57f)
dispatch builds to a remote build node over the agent transport (#432) (0a269e3)
ephemeral database per preview environment (#397) (fc08202)
interactive exec terminal over WebSocket (#436) (27266e3)
liveness probing and automatic restart (#434) (3725693)
node-move teardown fix, simple spread scheduling, CLI/MCP completeness batch (#395) (c8c9e5f)
opt-in per-domain WAF and rate limiting for embedded ingress (#398) (6df1bb0)
remote exec and Docker networking over the agent transport (#399) (610afd5)
replace guesswork form fields with real pickers and suggestions (#437) (39f9c5d)
TLS for managed Postgres and Redis connections (#364) (6138335)

Bug Fixes

address containerd and docs-site dependabot alerts (#392) (148094b)
chain release.yml to actually run after release-please tags a release (#373) (7c8a6bb)
derive Select trigger label automatically from item children (#438) (849f2de)
make manual release.yml dispatch actually target the right tag (#375) (d52596d)
pin cel-go to v0.28.1, restoring build compatibility with caddy (#389) (0b4695b)
raise Docker image build timeout and add layer caching (#378) (d3732f1)
route error components against unknown, not Error (#431) (3903d1f)
spread drained resources across nodes, warn on dropped depends_on (#435) (6a418eb)
stop and remove containers when a service is deleted (#381) (a608ebb)

Performance Improvements

build Docker images on native per-arch runners instead of QEMU (#380) (c42d372)

Levelrail v0.1.0: Actionable restart-required toast for health...

2026-09-09T05:27:06Z

0.1.0 (2026-09-09)

Features

actionable restart-required toast for health check and resource limit saves (e21390c)
actionable restart-required toast for health check and resource limit saves (e7112c9)
add a restart action for apps (99f4873)
add a restart action for apps (4a8287d)
add age-based backup retention alongside count-based retention (#194) (64db57e)
add backup targets settings page (c2a0619)
add build.base_directory for monorepo subdirectory builds (#139) (afb0a53)
add CLI support for deploying a Docker Compose file (#109) (0eb9b35)
add cloudflare-tunnel CLI subcommands (#188) (a1cc9c6)
add CPU/memory quick-stat cards to app overview (#163) (4160094)
add dashboard home page at / (4bd810d)
add developer-view raw text editor for env vars (4300911)
add Dokploy as a migrate CLI source (#135) (dcef119)
add Dragonfly and ClickHouse as managed database engines (#145) (b75a7d2)
add editable port control to app overview page (8c5bd1e)
add environment-level shared env var tier between project and app (#195) (0fede7b)
add fullscreen size variant to dialog primitive (4b57d39)
add fullscreen toggle to the create resource wizard (3106621)
add GET .../secrets and POST .../secrets/{key}/lock endpoints (7aa3c46)
add interactive wizard mode to apps create (#239) (0207202)
add interactive wizard mode to databases create (#245) (106cd53)
add levelrail-cli doctor command for local preflight health checks (#265) (91d20db)
add list_audit_log MCP tool (#285) (4eb5ca5)
add loading states across dashboard routes and data-fetching components (#248) (a91e388)
add MariaDB and KeyDB managed database engines (#141) (01716bc)
add MCP server, extract shared internal/apiclient package (#121) (e354a10)
add migrate caprover CLI command (#191) (910081d)
add Network tab showing live traffic path from domain to container (#148) (f29d827)
add nodes CLI subcommands (#192) (abea231)
add non-interactive exec endpoint for running commands in app containers (c5c86f8)
add organization-level shared env var tier above projects (#193) (59d737b)
add periodic OS package-update check per node (#220) (0d1a1d8)
add projects CRUD, project env vars, and project membership to the CLI (#250) (e804735)
add reversible per-secret lock to the store layer (bf808e5)
add secret key listing and lock mutation hooks (97136ce)
add settings sub-sidebar and fix stale route tree (#222) (428a5df)
add SetValueGuarded, ListKeys, SetLocked to secrets.Manager (996ed50)
add structured issue templates and type-specific PR templates (#77) (729a4ea)
add System status dashboard page (#324) (b20f380)
add test-connection action for backup targets (#307) (5d94dc0)
admin recovery email, general email capability, forgot-password flow (b384f35)
admin recovery email, general email capability, forgot-password flow (backend) (2d8b8d0)
alert on repeated scheduled task failures (#290) (ed20b7d)
allow clickhouse as an app.yaml database engine (#186) (5b957b5)
allow pinning a service's host port (#170) (f861ea1)
App Clone (78cf10e)
App Clone (aed12f5)
app detail screen polish - deploy history, grouped nav, build hints, convergence (ceddf79)
App Overview hero+checklist, batched Apps list status (7e10b6e)
App Overview hero+checklist, batched Apps list status (9fdc4e5)
app volume backups (backend, API, CLI, and web UI) (#311) (9dccec3)
app-detail polish - deploy columns, grouped nav, convergence badge, build-log hints (fa81b98)
app-level scheduled tasks (#140) (fb66f24)
apply resource limit changes to running containers live (#242) (c8f33cb)
apps deploy/status/logs and databases commands for the CLI (89e0143)
apps restart/rollback CLI subcommands (6f0f6b3)
apps restart/rollback CLI subcommands (6932e10)
apps table + read-path for multi-service app support (stage 1) (#61) (5cd187f)
attribute audit log entries to their client and add retention (#316) (7bbe9c7)
audit log CSV export via API, dashboard, and CLI (#277) (9dc536d)
audit log for write/deploy/root-tier requests (#125) (665cb0c)
auto-generate and persist master key on first boot (#60) (72265b0)
auto-verify scheduled backups right after they complete (#280) (51722a8)
backup file download to browser (3d6e8e9)
backup file download to browser (6599a88)
backup integrity verification (#273) (162dd0e)
backup target onboarding, connect an S3-compatible bucket (25fab52)
bounded health check and opt-in ufw setup in install.sh (#323) (060408f)
breadcrumb and hierarchical navigation for org/project/environment/app (#173) (145ab27)
browse and deploy from the curated service-template catalog (#119) (ccecb1f)
build Docker Compose services with build: directives (#190) (fbaa87e)
build pack selector and branch picker for git app creation (94d80c6)
build pack selector and branch picker for git app creation (97aeeac)
build.type: image, deploy a prebuilt registry image with no build (#124) (5e41b5e)
built-in container registry (#366) (56dc8d6)
BYO TLS certificate upload for domains (#363) (86a1e6d)
centralized Domains page with ACME settings and app-domain list (5e6a421)
changed-line coverage gate for PRs (#350) (2062874)
CLI and dashboard wiring for organizations and environments (#169) (5ee8706)
CLI CRUD for backup targets and registry credentials (#251) (1bba14d)
CLI device login flow (auth login --device) (#319) (97ac63a)
CLI exec, auth login/whoami, tokens, domains, backups commands (ae3c606)
CLI exec, auth, tokens, domains, and backups commands (f2a9b48)
CLI output formats and JMESPath query filtering (#318) (d94ea5b)
CLI support for app-level scheduled tasks (#144) (d27f0f5)
ClickHouse and Dragonfly backup/restore support (#157) (39689e9)
close git provider capability gaps (GitLab branches, GitHub webhooks, aggregated status) (#228) (f16833a)
Cloudflare Tunnel integration for outbound-only ingress (#138) (d235fc5)
collect and surface node disk space as a real telemetry metric (#185) (b2064f3)
connect a GitHub App for private-repo access and repo browsing (25e3952)
connect a GitHub App for private-repo access and repo browsing (1a5fbe5)
containers page and master key rotation UI, feature catalog doc (#358) (27a038c)
Coolify migration CLI (levelrail-cli migrate coolify) (#45) (b980659)
copyable DNS record rows and better layout for domain check (#63) (489e542)
curated named roles (admin/operator/viewer) over the ability model (#240) (eff9f9a)
curated service-template catalog and read-only browsing API (#117) (cc5581f)
custom Docker labels escape hatch on spec.Service (6b03e8b)
custom Docker labels escape hatch on spec.Service (0ef3331)
dashboard empty states for alerts, deploy history, and log search (#238) (090dbde)
dashboard home page at / (73e130f)
database backups to S3-compatible storage, with restore (c34c67e)
database publicly-accessible toggle + host port (78fb42f)
database publicly-accessible toggle + host port (71b2a46)
delete pruned scheduled-backup objects from their bucket (a76e782)
delete pruned scheduled-backup objects from their bucket (f24d563)
deploy comparison view (#272) (144976f)
deploy-outcome notifications (6fc9cca)
deploy-outcome notifications (c1bd571)
deterministic resource right-sizing suggestions (#279) (ab7c147)
dismissible dashboard nudge to enable platform-wide alert rules (#300) (aa23b42)
docker compose as a deploy target (#97) (b67064b)
draft autosave and guided defaults for create-resource forms (#260) (005830f)
editable port control on app overview (41b6741)
empty states and inline field guidance (0118b1e)
empty states and inline field guidance (97a7a22)
enforce frontend bundle size budget in CI (#299) (331bd52)
env var tier provenance and audit activity panel in EnvEditor (#261) (3be751f)
env/secrets developer view (frontend) (f771abe)
expand MCP server tool coverage to nodes, previews, alerts, metrics, rollback (#252) (85f1bda)
explicit Stop/Start action for apps (b460919)
explicit Stop/Start action for apps (4d81635)
extend resource right-sizing recommendations to databases (#288) (0c68dc3)
fan out git push webhook deploys to sibling app-group services (#172) (b6998ff)
feature flags with live evaluation via existing API tokens (#262) (6047a4b)
fill CLI gaps for app lifecycle, database delete, secrets, git-source (#247) (01451be)
forgot-password flow and email settings pages (frontend) (3da9466)
forward app logs to an external HTTP or syslog sink (#137) (3ecc436)
framework-aware guided deploy picker (9591ee4)
framework-aware guided deploy picker (d2042e5)
full-screen presentation for the create resource wizard (b33764b)
fullscreen log viewer toggle and finish-aware auto-scroll (#226) (e5296b4)
general per-actor rate limit on the authenticated API surface (#284) (9a47287)
generic OIDC SSO as a third login provider (#160) (e398b88)
GitHub Enterprise Server and Bitbucket Cloud git provider support (#221) (aaa03e2)
GitLab App integration (#127) (91a0cc2)
global notification channels settings page (ec520db)
global notification channels settings page (e28ca4e)
guided domain add flow with inline TLS status (9a5a818)
guided domain add flow with inline TLS status (50bc930)
guided domain DNS check (d03dafe)
guided domain DNS check (9333eee)
guided first-run onboarding flow for zero-app instances (#266) (db8b7a1)
HTTP Basic Auth protection for domains, with helpful no-domain UX (#162) (7c1c4ea)
IAM policies dashboard page (#322) (e43ea76)
IAM-style resource-scoped policy engine (#317) (6be11f5)
implement database dump mechanism for backup targets (61acbb9)
implement database restore from backup (f405544)
implement Redis backup restore (8e6cad3)
implement Redis backup restore (e080529)
implement rolling deploy strategy (#171) (2b6c679)
ingress settings and domains API endpoints (189e9b3)
ingress_settings store for ACME toggle and primary domain (2d3e226)
land on the live build log after triggering a build (#67) (080a67e)
let operators pick between CNAME, A, and AAAA for domain setup (#189) (6229630)
levelrail-cli version command and CHANGELOG (#301) (947f147)
lightweight non-RBAC Projects grouping (96f5c23)
lightweight non-RBAC Projects grouping (b49ca26)
list every container on a node, not just Levelrail-managed apps (#326) (73d0f17)
list secret keys with reversible lock toggle in SecretsEditor (5cf50a5)
live per-node alert status for patch_status, node_disk_space, node_resource_usage (#304) (94caeed)
live SSE log broadcaster and stream endpoint for app containers (ab4670f)
live-tailing terminal viewer for app container logs (1989c77)
log export as a downloadable text file (#276) (758097a)
make the New resource wizard friendlier to non-technical users (#70) (a692ae5)
managed database logs and metrics (#225) (2d882ab)
manual Docker disk/image/volume pruning (6577add)
manual Docker disk/image/volume pruning (93ef2a2)
manual GitHub App connect flow, domain disclaimer on automated setup (#104) (97e242b)
master key rotation for envelope-encrypted secrets (#295) (592b779)
MCP tools for feature flags, doctor, webhook deliveries, backup verification, deploy compare, notification deliveries (#274) (3b84bc8)
memory/CPU resource limits for databases (f4a3b9f)
memory/CPU resource limits for databases (d21df63)
MongoDB as a managed database engine (#120) (f33de88)
multi-service apps stage 2 (deploy fan-out + per-app Docker networking) (#75) (db6e96e)
multi-service support in apps create --interactive (#349) (31c78aa)
multi-user sessions, OAuth sign-in (Google/GitHub), users management (8a39531)
multi-user sessions, OAuth sign-in, users management API (b555e67)
named credentials profiles (--profile / APP_PROFILE) (#315) (f90903b)
named-volume support for ordinary application services (#76) (6ba605f)
node CPU/memory alert rule (node_resource_usage) (#297) (ca49158)
node-level resource dashboard (224e8fb)
node-level resource dashboard (e23c57f)
non-interactive one-off exec in app containers (d37e3a0)
notification channel test-send delivery history and CLI/UI wiring (#267) (470f2ff)
OAuth sign-in UI, OAuth and Users settings pages (8f554c6)
PagerDuty and Microsoft Teams notification channels (#151) (93409d1)
paginate backup execution history (#143) (cb3686f)
per-domain maintenance mode (#360) (6610745)
per-user RBAC, extending the existing ability system to sessions (#131) (6d76d9d)
persisted per-app git source + multi-app GitHub webhook (531afd4)
persisted per-app git source + multi-app GitHub webhook (fd49569)
persistent restart-required signal for env var changes (#263) (d51f5fa)
post GitHub PR comments and commit statuses for preview deploys (#361) (2afbafb)
pre/post-deploy hook commands (#362) (a296cb3)
preview environments per pull request (#246) (0417adb)
proactive alerting for certificate expiry (#283) (c57381e)
proactive domain_health alert rule kind (#308) (6b9f241)
proactive node disk space alerting (#293) (11b089c)
proactive node patch status alerting (#289) (0781c20)
promote an app's image across environments in the same project (#278) (eb9883d)
protected environments with confirm-to-deploy friction gate (#282) (c91eef6)
Pushover notification channel (#126) (47cf081)
Railpack auto-detection for Node.js and Go builds (ba9d15b)
Railpack auto-detection for Node.js and Go builds (3f296c5)
read-only dashboard visibility for static sites (8040079)
read-only deploy failure and crashloop diagnosis (#268) (eba61a9)
real ACME issuer option in ingress config builder (dd3e709)
real ACME issuer, platform primary domain, and centralized Domains page (8192230)
real app-to-database attachment (#146) (f6cee9d)
real deploy history, rollback, and build-log persistence (272c104)
real deploy history, rollback, and build-log persistence (841a419)
real multi-marker deploy history on the metrics chart (3655449)
real multi-marker deploy history on the metrics chart (01c7406)
real S3-compatible upload client for backup targets (fef6b4b)
real-time deploy stage timeline and in-progress banner (#158) (59f61ba)
real-time live log streaming for app containers (7f37281)
redesign deploy detail page with metadata card and collapsible stages (#165) (453b610)
redesign New Resource picker into a categorized, searchable modal (#110) (6ae5aa6)
registry credentials for pulling private images (#130) (fbc1bb2)
relabel git-source wizard card, elevate Railpack, add connect-GitHub CTA and domain field (#68) (1bbf90e)
replace one-off empty states with shared EmptyState component (#164) (2a998d4)
replace single-admin store with multi-user users table (65bda2b)
required-check CI gate, CodeQL path filtering, label taxonomy and auto-labeler (#95) (116d50f)
resolve SERVICE_FQDN_* magic vars to a service's own assigned domain (#113) (8a1465a)
resolve template SERVICE_ magic vars in compose deploys (#108) (3198c84)
restore a backup into a brand-new database, alongside in-place restore (#310) (0ab0e33)
restore app volume backups as a new, standalone volume (#313) (2b5c60a)
reuse GitRepoSourcePicker in GitSourceCard (#229) (d75549f)
scheduled database backup configuration UI and CLI (#174) (cae179e)
scheduled/cron backups (0d5f370)
scheduled/cron backups (ab41a3c)
scope new-resource picker to the caller's intent (#254) (9228977)
secret key list/lock API + scope deploy trigger card to Overview/Deploys (35601c6)
service templates, team invites, deploy comparison, notification channels, and MCP tools (b71b9bd)
settings hub, global search, updates page, and ingress DNS transparency (#111) (cd9c327)
shared/group env vars at the project level (7078159)
shared/group env vars at the project level (f451f00)
shell completion for levelrail-cli (bash, zsh, fish) (#270) (cdc18f4)
splice generated secrets into composite env values (#118) (3120457)
storage as an app resource (R2/S3) (6964d72)
storage as an app resource (R2/S3) (18d2a4e)
surface compose restart: and networks: as non-blocking notices (#287) (002bd8f)
surface deploy strategy and replicas on the app screen (2878e9b)
surface deploy strategy and replicas on the app screen (925e9e6)
surface Docker daemon reachability as a dashboard-wide health check (#259) (9276ff2)
swap memory and CPU pinning (cpuset) resource limits (#233) (2e2a09b)
test registry credentials before deploy relies on them (#291) (f4c8721)
thread ingress settings into the ingress reconciler (96f984d)
TOTP two-factor authentication for admin login (#114) (55ec280)
track commit sha and trigger source on deploy attempts (8894f40)
translate compose healthcheck blocks into readiness probes (#286) (888c221)
trigger and track a real database backup (e93c88c)
trigger and track database backups from the database page (600b294)
unify git provider connect flow, fix missing git-source and build bugs (#227) (b13deaa)
unify webhook-triggered and manual multi-service deploys (#241) (669ede6)
v1 install script, systemd unit, release build workflow (#44) (567af6e)
webhook delivery history and replay (#269) (5776a64)
wildcard domain support via Cloudflare DNS-01 (#152) (afae9c7)
wire alert rules to global notification channels (bdc2b1d)
wire alert rules to global notification channels (df4a033)
wire developer-view toggle into the Environment section (4216271)
wire Dockerfile build args through app spec, API, CLI, and UI (#155) (9367d6c)
wire IAM policy resource-scoped enforcement into apps/databases routes (#321) (f0482a3)
wire mesh DNS server into container creation (73b5377)
wire mesh DNS server into container creation (d6fefdd)
wire OAuth secrets, update recover-admin for multi-user store (6e171d7)
wire prebuilt-image build type into CLI, UI, and git-source validation (#129) (9903572)

Bug Fixes

accessibility gaps in git picker, log terminal, and nav sidebars (#232) (5f206a8)
accessible names for placeholder-only domain/env form inputs (0888368)
accessible names for placeholder-only domain/env form inputs (c9d40ad)
adapt notification_channel.go to the email.Sender interface (efc055c)
add accessible names to per-row feature flag toggle and rollout input (#275) (a0edb7f)
add missing --json support to three CLI clear commands (#271) (50bac91)
add TTL fallback sweep for preview environments across all git providers (#281) (e0db26e)
allow railpack build type through apps create (#147) (c53543d)
async build trigger, private repo auth, and ability-gated token minting (#64) (f6ca950)
avoid BuildKit MergeOp deadlock in Railpack deploy image assembly (#149) (f9d3158)
clear stored secrets when disconnecting a GitHub App (4055351)
close forgot-password rate-limit bypass, remove dead admin-email frontend code (fe52150)
close no-auth confirmation gap for KeyDB/Dragonfly, polish secrets CLI help (#303) (3d7d129)
close pre-existing AppDetail test-fixture typecheck gaps (#264) (0c9e76a)
correct misleading test name/comment on a secrets test (49191f0)
crashloop alert's view-logs link goes to a dead same-page anchor (#218) (3ed2889)
don't show a redundant inline error while the overwrite-confirm dialog is open (6dbad34)
drop stale preview-envs docs claim, skip live Docker tests in short mode (#314) (f0a052e)
eliminate race in TestHandleTriggerBuild_RecordsDeployAttempt_Succeeded (#298) (6094a5b)
explain why the live logs tail is empty, don't just wait forever (#161) (d90a2ea)
feed persisted build logs to diagnose for build-phase failures (#292) (b1a98b6)
fix overflowing create-resource picker, add category filter (#255) (b73c49d)
force 0.1.0 as release-please's first proposed version (#372) (bf5ad96)
gate one-off container exec at AbilityRoot, not AbilityDeploy (c2cb301)
generate routeTree.gen.ts before web lint, trim test duplication (#116) (5bc54e9)
get the main frontend bundle under the 500kB warning threshold (fe49363)
get the main frontend bundle under the 500kB warning threshold (397e45d)
guard ClickHouse restore live test against entrypoint's temp-server handoff (#312) (807a297)
image-sourced deploys show a clear no-build-output message (914a5ee)
image-sourced deploys show a clear no-build-output message instead of hanging on 'Waiting for log output...' (0ac7e1f)
land signed-in users on the dashboard, not /apps (#66) (9820068)
live deploy log stream stuck on zero output (f365ad7)
live deploy log stream stuck on zero output (b52572f)
make password-reset token single-use atomic, tidy go.mod, trim comments (df72b84)
mark orphaned deploy attempts as failed on startup (#159) (af04e62)
move showDeployTrigger's useRouterState above the early-return (faaf90e)
pin cel-go back to 0.28.1, incompatible with pinned Caddy version (#134) (be72bc2)
pin golangci-lint-action to a commit SHA, suppress a false-positive Sonar finding (#352) (fd6aeb0)
point install.sh at the real first-run registration path (#325) (d4840af)
poll for post-stop/remove state on CI's daemon (4847f8a)
poll for stopped state in Stop/Remove live test (2a4ae1b)
poll for stopped state in Stop/Remove live test instead of asserting immediately (7824a79)
pre-fill and suggest commands in the exec panel (#327) (a3fc79d)
raise internal/api CI test timeout to fix false-failure panics on main (908bea4)
raise internal/api's CI test timeout to 25m (2670e8f)
re-ensure a container's network before restarting it (#150) (180bf63)
record a deploy attempt when an app is created with a real image (#154) (189ae19)
record deploy attempts for compose deploys and image-changing updates (#256) (67065ee)
recreate a container whose Start fails even after EnsureNetwork (#153) (30af32a)
reduce SonarCloud duplication flagged after #228 merged (#231) (ae21dbd)
reject ACME contact emails with a display name (f55714f)
renumber cloudflare-tunnel migration to 0049, collided with 0047 (#142) (20bbaf2)
renumber deploy_attempts_commit_source migration to 0025 (84a30a0)
renumber domain-basic-auth migration to 0053, collided with 0052 (#166) (3107714)
renumber github app connection migration to 0029 (da478e0)
renumber ingress_settings migration to 0024 (df671a9)
renumber migration to 0028 (0027 claimed by service_labels) (a48c436)
renumber migration to 0030 (0029 claimed by service_git_sources) (f93c3c6)
renumber migrations past 0030_service_storage_target.sql (89b2f0e)
renumber oidc-provider migration to 0054, collided with 0053 (#168) (448d960)
renumber secret-lock migration to 0038 (0037 collision with PR #56) (27c275a)
renumber users migration to 0035, dedupe nullableString helper (3ca070a)
require MySQL readiness probe to hold twice before proceeding (96442a9)
resolve duplicate migration version 0052 (#167) (1bf10f1)
resolve migration 0030 number collision (github-app vs storage-target) (8b11236)
resolve migration 0030 number collision between github-app and storage-target (47ecc8c)
restore docker/docker + go-connections to versions internal/build/build.go's ImageLoadWithQuiet call needs (#100) (4d36c69)
restore frontend checks in the pre-commit hook (#72) (e5e3887)
restore main build and resolve SonarCloud findings on multi-service apps (#99) (3416514)
restrict git branch listing to http/https schemes (0436b01)
revert docker/docker, docker/go-connections, cel-go bumps (#98) (e4a0dc2)
revert typescript to 6.0.x, main is broken for npm ci (#96) (aedf340)
rework forgot-password and admin-email for the multi-user model (159e068)
satisfy golangci-lint (revive, unparam) and fix dangling doc refs (a54dcd1)
scope deploy trigger card to Overview and Deploys sections (1f79a92)
scope MongoDB restore to drop non-system databases first (#309) (19d0323)
set explicit Content-Type on remaining webhook-derived response bodies (#249) (1bd2238)
small UX polish bundle (git-source validation, stale doc comment, database status dots) (#223) (a86503b)
stop bundling zod into the eager main chunk via reset-password validateSearch (#230) (4a5cc80)
stop clipping browse-templates category headers in a nested scroll box (#257) (c29ecf9)
subscribe GitLab and Bitbucket webhooks to pull request events (#253) (2eacc2f)
suppress SonarCloud false-positive on the intentional unconditional backfill UPDATE (#132) (4e45748)
surface swap and CPU pinning limits on the app overview (#234) (ecfcae5)
TestValidateDatabaseResource's unknown-engine case used mongodb, now a real engine (#122) (52492b9)
unlock build fields after a failed build trigger in git app wizard (#224) (491e47c)
unstick finished-attempt deploy log SSE connection status (ef97298)
unstick finished-attempt deploy log SSE connection status (3acb273)
update Docker client call sites deprecated by the docker/docker 28.x bump (#103) (0933d50)
use localeCompare when sorting env var keys in dev view (#351) (534393d)
verify github app installation status live against github, not just the local row (#294) (d54e05d)
warn on missing secrets master key before database creation (3a113f8)
warn on missing secrets master key before database creation (25a0305)
widen TestCertStorage_TouchLock_KeepsItFresh's timing margin (#356) (dc55f2d)
wire Dragonfly into app.yaml spec and database URL resolution (#187) (d5d6e58)

Performance Improvements

scan only new log lines for build-log hints (36453f7)

Levelrail releases

Levelrail v0.2.0-beta.10: Correct Vikunja and Keycloak catalog...

What's changed ​

Bug fixes ​

Install ​

Container images ​

Verify ​

Contributors ​

Levelrail v0.2.0-beta.9: Bundle docs/ into the web build stage of...

What's changed ​

Bug fixes ​

Install ​

Container images ​

Verify ​

Contributors ​

Levelrail v0.2.0-beta.8: Https, redirect, status-range and exec...

0.2.0-beta.8 (2026-09-23) ​

Features ​

Bug Fixes ​

Levelrail v0.2.0-beta.7: Setup wizard with live server, domain...

What's changed ​

Features ​

Security ​

Install ​

Container images ​

Verify ​

Contributors ​

Levelrail v0.2.0-beta.6: Per-app exec/shell access opt-out...

Highlights ​

What's changed ​

Features ​

Bug fixes ​

Documentation ​

Install ​

Container images ​

Verify ​

Contributors ​

Levelrail v0.2.0-beta.5: CLI coverage for backup download...

What's changed ​

Features ​

Bug fixes ​

Documentation ​

Container images ​

Verify ​

Contributors ​

Levelrail v0.2.0-beta.4: Add domain-level custom error pages, Add...

Highlights ​

What's changed ​

Features ​

Documentation ​

Install ​

Container images ​

Verify ​

Contributors ​

Levelrail v0.2.0-beta.3: Add DNS-01 provider abstraction with...

Highlights ​

What's changed ​

Features ​

Bug fixes ​

Install ​

Container images ​

Verify ​

Contributors ​

Levelrail v0.2.0-beta.2: Zero-config sslip.io URL for apps with no...

Highlights ​

What's changed ​

Features ​

Bug fixes ​

Documentation ​

Container images ​

Verify ​

Contributors ​

Levelrail v0.2.0-beta.1: Add database stop/start lifecycle, API...

Highlights ​

What's changed ​

Features ​

Bug fixes ​

Install ​

Container images ​

Verify ​

What's changed

Bug fixes

Install

Container images

Verify

Contributors

What's changed

Bug fixes

Install

Container images

Verify

Contributors

0.2.0-beta.8 (2026-09-23)

Features

Bug Fixes

What's changed

Features

Security

Install

Container images

Verify

Contributors

Highlights

What's changed

Features

Bug fixes

Documentation

Install

Container images

Verify

Contributors

What's changed

Features

Bug fixes

Documentation

Container images

Verify

Contributors

Highlights

What's changed

Features

Documentation

Install

Container images

Verify

Contributors

Highlights

What's changed

Features

Bug fixes

Install

Container images

Verify

Contributors

Highlights

What's changed

Features

Bug fixes

Documentation

Container images

Verify

Contributors

Highlights

What's changed

Features

Bug fixes

Install

Container images

Verify

Contributors

0.2.0-beta (2026-09-12)

Features

Bug Fixes

Performance Improvements

0.1.0 (2026-09-09)

Features

Bug Fixes

Performance Improvements