Levelrail v0.2.0-beta.6

Released 2026-09-23 as a pre-release. View on GitHub. All releases.

NOTE

This is a pre-release on the beta channel. Pin this exact version for anything you care about staying still.

Highlights

• per-app exec/shell access opt-out, defaults enabled (#542) by @thegdsks
• per-app outbound network allowlist (egress gateway) (#543) by @thegdsks
• egress allowlist UI on the app network page (#545) by @thegdsks

What's changed

Features

• per-app exec/shell access opt-out, defaults enabled (#542) by @thegdsks
• per-app outbound network allowlist (egress gateway) (#543) by @thegdsks
• egress allowlist UI on the app network page (#545) by @thegdsks
• actionable CTAs on System Status, reusable docs help links (#551) by @thegdsks
• Gitea as a fourth git provider (#553) by @thegdsks
• configurable ingress HTTP/HTTPS listen ports (#556) by @thegdsks
• WireGuard mesh key rotation and peer status visibility (#561) by @thegdsks
• clone a whole environment's app set into a new environment (#562) by @thegdsks
• distribute WireGuard mesh config to remote nodes over gRPC (#564) by @thegdsks
• point-in-time restore for Postgres databases (#566) by @thegdsks
• secret age tracking and rotation reminders (#563) by @thegdsks
• two-person approval gate for deploys into protected environments (#567) by @thegdsks
• detect and clean up orphaned named Docker volumes (#569) by @thegdsks
• fleet-wide node CPU/memory/disk utilization view (#575) by @thegdsks
• healthchecks and memory advisories for all 129 catalog templates (#576) by @thegdsks
• add container restart count and build duration metrics (#560) by @thegdsks
• empty states with prerequisite hints and template CTA (#579) by @thegdsks
• doctor network, resource, and multi-firewall checks (#581) by @thegdsks
• slow query log for Postgres/MySQL databases (#565) by @thegdsks
• install works end to end (setup token, HTTP login, installer preflight) (#582) by @thegdsks

Bug fixes

• confirm detach actions and surface missing success toasts (#546) by @thegdsks
• stop doctor's port 80/443 check from false-failing on its own ingress (#547) by @thegdsks
• live resource updates fail silently when only memory is set, no swap (#548) by @thegdsks
• type errors blocking the real production build (npm run build) (#549) by @thegdsks
• app status rollup, compose service pruning, and group lookup by app name (#552) by @thegdsks
• stop treating unlabeled Docker networks as this instance's own (#557) by @thegdsks
• detect frozen agent processes via heartbeat frames and gRPC keepalive (#558) by @thegdsks
• retry transient SMTP failures for email notification channel (#559) by @thegdsks
• rate limit the unauthenticated git webhook receiver (#574) by @thegdsks
• wire Bitbucket App secrets manager, OAuth connect was permanently broken (#555) by @thegdsks
• doctor's disk space check shows raw byte counts, not human-readable (#550) by @thegdsks

Documentation

• document secret age tracking and rotation reminders (PR #563) (#573) by @thegdsks
• update roadmap and status for recently shipped features (#572) by @thegdsks
• add slow query log viewer documentation (#571) by @thegdsks
• two-person deploy approval gate and environment cloning workflows (#570) by @thegdsks
• add node heartbeat configuration and mesh status/key-rotation documentation (#568) by @thegdsks
• add GLINR Discord community links (#584) by @thegdsks

Maintenance, CI, and dependency updates (6)

• cut a duplicate check job and de-flake the frontend suite (#554) by @thegdsks
• bump docker/setup-buildx-action from 4.3.0 to 4.4.0 (#477)
• bump golang.org/x/crypto from 0.56.0 to 0.57.0 (#481)
• bump @xterm/xterm from 5.5.0 to 6.0.0 in /web (#478)
• run CI on docs-only PRs so required checks report (#580) by @thegdsks
• Image tag channels, cosign signing, and a committed compose file (#578) by @thegdsks

Install

Fresh install on a Linux host, pinned to this release:

curl -fsSL https://raw.githubusercontent.com/glincker/levelrail/main/install.sh | sudo env LEVELRAIL_VERSION=v0.2.0-beta.6 sh

Upgrade an existing install in place (keeps the unit file and data):

curl -fsSL https://raw.githubusercontent.com/glincker/levelrail/main/install.sh | sudo env LEVELRAIL_VERSION=v0.2.0-beta.6 sh -s upgrade

Docker Compose: pin the image tag in docker-compose.yml:

services:
  levelrail:
    image: ghcr.io/glincker/levelrail:v0.2.0-beta.6

Container images

Multi-arch (linux/amd64, linux/arm64), signed with cosign, SBOM and provenance attached. Also tagged beta at release time (moving tags).

Image	Tag	Digest
ghcr.io/glincker/levelrail	v0.2.0-beta.6	sha256:3db4d59e87b8cd6a0fdf37c1c6c29b13d2fe16842d455a93eaad9fbb08754b27
ghcr.io/glincker/levelrail-agent	v0.2.0-beta.6	sha256:cf217a7ec07c2d9fefe844d77529acba66185175681b677ac90373fd444ba119

Verify

Binaries: check downloads against checksums.txt:

gh release download v0.2.0-beta.6 --repo glincker/levelrail --pattern 'levelrail-linux-amd64' --pattern checksums.txt
sha256sum --ignore-missing -c checksums.txt

Images: verify the keyless signature was made by this repository's release workflow:

cosign verify ghcr.io/glincker/levelrail@sha256:3db4d59e87b8cd6a0fdf37c1c6c29b13d2fe16842d455a93eaad9fbb08754b27 \
  --certificate-identity-regexp '^https://github\.com/glincker/levelrail/\.github/workflows/release\.yml@refs/(heads/main|tags/v.+)$' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Contributors

Thanks to @thegdsks.

Full changelog: v0.2.0-beta.5...v0.2.0-beta.6 | Release page | Installing | Upgrading | Verifying signatures