arcane Updates & Release Notes

Note

This release fixes backup handling across older Docker daemons and S3, improves health and scheduler reliability, and reduces live-stats rendering costs.

Backups and storage

• Bind-mount volume subpaths when backing up on daemons older than API 1.45. (#4399) @kmendell
• Send S3 request checksums only when required, improving GCS compatibility. (#4401) @kmendell
• Write S3-only system backups directly to S3 without a local repository. (#4400) @kmendell
• Include the absolute path and UID in project-directory permission errors. (#4404) @kmendell

Containers, projects, and scheduling

• Report Francis as down when its host exits and extend its health-check deadline. (#4402) @kmendell
• Exclude Swarm task containers from the standalone-container filter. (#4405) @kmendell
• Preserve build image references when Compose fails to load, and document the update-check label. (#4406) @kmendell
• Reset invalid cron settings to defaults at startup. (#4425) @kmendell
• Clear caches when refreshing a workspace. (#4427) @kmendell
• Allow manual updates for services with the updater disabled. (#4430) @kmendell

Registries, updates, and access

• Retry digest lookups after TLS handshake timeouts. (#4428) @kmendell
• Remove the stale digest name left behind when a frozen pull is tagged. (#4409) @kmendell
• Stop resending image-update push notifications on every poll. (cd7c39cfcb6c364751d4b55bab887c11b5ebd859) @kmendell
• Restrict SSH host-key algorithms to entries in known_hosts. (#4403) @kmendell
• Match user email lookups without regard to case. (#4429) @kmendell

Interface and performance

• Fix virtualized table cells being clipped by locking column widths in pixels. (#4407) @kmendell
• Localize settings backup cards and role presets, and prevent long labels from overflowing. (#4408) @kmendell
• Batch live stats by environment to reduce table rendering costs. (3330f4e0f53bb152cc4720be8ae724cdb1bd8cbb) @kmendell

Maintenance

• Merge all-environment resource lists on the server. (#4419) @kmendell
• Simplify registry helpers with composite literals and inline helpers. (00daf4441a6724cc9ff991f2927d73dcd61f4b89) @kmendell
• Simplify project construction, merge duplicates, and remove dependency-injection nil checks. (a432f2c80c44017d1cba7042cf971bb03a63c410) @kmendell
• Simplify system construction and remove dependency-injection nil checks and mappers. (cdfe49e8cbe0110e60e582aba3a4ce93c8fdb962) @kmendell

Note

This release adds OpenTelemetry support, a redesigned multiplexed edge tunnel, and useful CLI previews and self-update tooling. It also improves container and project workflows while fixing issues across authorization, databases, and connectivity.

Interface and container workflows

• Prevent duplicate role assignments from causing a 500 in the user editor. (#4332; @DominikZublasing)
• Recognize JSON in container logs. (20c2438; @kmendell)
• Virtualize large tables, confirm before loading all vulnerabilities, and keep table height within the viewport. (#4340; 011d2cc; 7d8b207; @kmendell)
• Reuse unclaimed project directories when creating projects. (#4343; b80f1bc; @kmendell)
• Remember the last-used shell for each Compose service. (#4348; 8176ee5; @kmendell)
• Confirm before bulk-updating containers or projects. (#4347; f5672c9; @kmendell)
• Close editor tabs with a middle-click and save projects with Ctrl/Cmd+S. (#4333; a7f16c9; @DominikZublasing)
• Support icon_url in remote template registries. (#4350; a78fc13; @kmendell)
• Add development/beta version branding. (2158fe7; @kmendell)
• Fix action button overflow and make menus more compact. (94b1658; @kmendell)

Jobs, storage, and reliability

• Enforce SQLite foreign keys and remove orphaned authorization records. (#4339; 33bdd33; @kmendell)
• Allow schedules to be updated for disabled jobs. (e7317f0; @kmendell)
• Prune local backup repositories daily to free space from deleted backup data. (#4235; 2ecc763; @GiulioSavini)
• Migrate jobs to fan-out workflows. (#4356; 1cb7577; @kmendell)
• Stop the app if the Francis host fails during bootstrap. (#4371; e9b8ee1; @kmendell)
• Keep SQLite tuning on the Francis actor store and stop syncing on commit. (#4372; a4376c5; @kmendell)

Edge, security, and observability

• Stream edge responses, pool proxy connections, and clean up the edge package. (#4354; df80491; @kmendell)
• Mark direct agents online when the dashboard can reach them. (8b3756c; @kmendell)
• Add OpenTelemetry metrics, traces, and logs. (#4367; f3bfc28; @kmendell)
• Report environment counts only from the manager. (17c223a; @kmendell)
• Add a multiplexed edge tunnel and redesigned connection view. (#4375; 70c2954; @kmendell)
• Extract client IPs only from configured TRUSTED_PROXIES. (#4351; ceab1a7; @kmendell)
• Skip API-path auto-login checks when auto-login is disabled. (64eb4d3; @kmendell)
• Require a verified email before merging OIDC accounts. (#4381; bc6547f; @kmendell)
• Gate actions on variable permissions rather than templates:update. (#4382; ccb06ea; @kmendell)
• Prevent stale user writes from overwriting profiles. (ae7641d; @kmendell)
• Match Trivy scans by layer diff IDs. (ebb5a1f; @kmendell)
• Allow self-upgrade helpers through the Wollomatic socket proxy. (#4383; 9e2e9f4; @kmendell)

CLI and integrations

• Add an all-environments preview to the CLI and UI. (c8ec324; 298c8cf; @kmendell)
• Refactor CLI commands around constructors, generic helpers, and shared types. (0d07bea; @kmendell)
• Display JSON stream output and correctly formatted configuration in the CLI. (ace2c8d; e8b83db; @kmendell)
• Store CLI authentication settings in a separate auth.json file. (#4379; 517cd55; @kmendell)
• Add a Sigstore-verified self-update preview to the CLI. (#4380; 2a7673a; @kmendell)
• Let ECR registries use the AWS default credential chain. (#4357; fc18c60; @Guik)
• Improve ntfy notification formatting. (#4336; 1899f0b; @maghuro)
• Standardize on github.com/docker/go-units. (#4377; aafcfb4; @kmendell)
• Disable Gravatar by default and make it configurable. (#4349; 75996ec; @kmendell)

Note

This release fixes Compose path and image handling, improves backup and update reliability, and adds a setting for Signal notifications.

It also includes fixes for remote environments, authentication, and environment navigation.

Compose and updates

• Interpolate variables in Compose include paths (#4298) — @kmendell
• Preserve Compose image spelling during project updates and self-updates (#4330) — @kmendell
• Keep the selected tag during self-updates and refresh stale project update status (commit e862615fc4e47c8bf7fbfc089254bf509d0a82c7) — @kmendell

Environments, notifications, and authentication

• Resolve webhook target names in remote environments (#4299) — @kmendell
• Default notifySelf to true and add a setting for Signal notifications (#4302) — @Shraymonks
• Prevent logout from hanging on permission errors after OIDC login (#4309) — @kmendell
• Navigate to the selected environment on environment-scoped routes (#4320) — @kmendell

Backups and maintenance

• Prevent system backups from failing when project files are in use (#4311) — @kmendell
• Allow deleting backups when their S3 repository no longer exists (#4319) — @kmendell
• Report accurate reclaimed space in scheduled pruning (#4317) — @kmendell
• Store Francis actor state in its own SQLite database (commit 93a740597df7a6aa47d5925d9d8dc5499934af05) — @kmendell
• Use persistent Git storage for SSH host keys on native installs (#4300) — @kmendell

Interface and platform

• Remove table header blur (commit 4d9bca092d6006b7265a6ce07928860b47ab84a5) — @kmendell
• Release arcane-cli only for Apple Silicon (arm64), dropping amd64 support (commit b3acb52dd02f39e39489203ce04ab316b47de8f6) — @kmendell

Internal changes

• Move the Docker utils package to go.getarcane.app/docker (#4296) — @kmendell
• Inline logic in project services (commit 73b43dba1e83f9a630b81e21381b533e50cdc57d) — @kmendell

Note

This release adds registry browsing, mobile table sorting, and project deployment feedback. It also fixes issues with project and GitOps workflows, remote agents, job processing, and application reliability.

Features and interface

• Browse repositories and tags in configured registries. (#4162) @Laval13
• Add mobile sorting to the shared table menu. (#4225) @kmendell
• Add unsaved-changes warnings when deploying or redeploying projects. (32f1e335) @kmendell
• Add actor statuses to the diagnostics page. (01a8964d) @kmendell
• Make several UI/UX improvements, support backup login, and show both digest values. (#4271) @kmendell
• Update the dashboard header design. (#4269) @kmendell
• Refresh the login screen layout. (32262306) @kmendell
• Clean up crowded action buttons. (#4233) @kmendell

Fixes and reliability

• Handle .env directories in project scans, environment saves, and workspaces. (#4213) @Mczubi
• Honor *_FILE settings on the environment-managed settings path. (#4203) @mortencombat
• Reduce manager polling and config-sync egress to remote agents. (#4218) @kmendell
• Align editor themes with the selected application theme and prevent overlapping columns in virtualized tables. (#4219, #4220) @kmendell
• Avoid duplicate deployment events on project redeploy. (1b31dd9c) @kmendell
• Prevent GitOps directory sync from copying unrelated project data and stop loaded associations from overwriting repository updates. (#4222, #4243) @kmendell
• Allow project redeploys with restricted bind sources. (#4260) @kmendell
• Prevent volume detail-page errors when navigating away. (#4229) @kmendell
• Include ECR Public in the Docker image list. (0d3cd419) @kmendell
• Omit SQL parameters from query logs to prevent oversized logs. (#4221) @kmendell
• Automatically clean up upgrade logs according to configurable retention. (#4230) @kmendell
• Show upgrade status for Arcane self-upgrades. (#4278) @kmendell
• Reject events from cancelled stream connections, and harden stream cleanup against stale cache fills. (#4241, #4267) @kmendell
• Remove manual job review, fix Francis scheduling, and recover oversized legacy job histories on startup. (#4268, #4270) @kmendell

Performance and internal improvements

• Reduce database queries and simplify frequently used queries. (#4239) @kmendell
• Switch log streaming from JSON lines to SSE. (#4276) @kmendell
• Simplify the JSON serializer. (b47a8b90) @kmendell
• Adopt go.getarcane.app for common utilities. (#4223) @kmendell
• Use Francis for distributed actors. (#4261) @kmendell
• Standardize on Go standard-library errors. (#4263) @kmendell
• Standardize domain package layouts. (7d41c588) @kmendell
• Remove Viper config loading from the CLI in favor of raw YAML marshalling. (e4c1c0a3) @kmendell
• Regroup CLI commands and add loading states. (0f6591f7) @kmendell

Note

This release adds bulk actions for vulnerability findings, a redesigned risk-based security view, container process visibility, and search in the template selector.

It also improves update workflows, Compose handling, backups, Easy Join, and activity processing while resolving several access and configuration issues.

Security and vulnerability management

• Added bulk ignore and restore actions for vulnerability findings — 8dd49f1ac48b6dc1a17c960e08287338934eb33f (#4158) (@kmendell)
• Redesigned the risk-based security view — cac682df3161e4228b5217fc3c9361700485c280 (#4204) (@kmendell)
• Improved the risk score model — 0238e1414138788e1b674b1ae9d1ffc5b65adc38 (#4205) (@kmendell)
• Fixed environment-admin resource pages requesting globally protected data — 91825a6865e1e3a5a5913c0dfb938dc4093dbfe6 (#4151) (@kmendell)
• Accepted Safari’s unrequested appid=false value during passkey assertions — a7db1aeafd3aff1e5e3161780dd37d117ac0084a (#4208) (@kmendell)

Containers, projects, and updates

• Added a container processes tab — bbc70f7d6007b3532c1bc103e30e1cb9222ef6fe (#4187) (@kmendell)
• Routed container updates through the activity system — 2e35dfda39ed51e692fb4b00c944fd1ba6ceb6e5 (#4167) (@kmendell)
• Resolved pending update status consistently across containers, projects, and the dashboard — aaac10a0d5e1105edfa01a0708f4cdbaf6e96375 (#4189) (@kmendell)
• Preserved Compose formatting when applying tag updates — b9d64a9f116f700f64fa30ebc04d5816e3174f20 (#4172) (@kmendell)
• Recreated namespace dependents when updating Compose services — 33216715407a75a2b2ce499d228dab68a847ac87 (#4179) (@kmendell)
• Preserved pinned Compose tags unless enabled by the updater strategy — 72532defe45ac340d07aaf01b6d6a9e393972d87 (#4180) (@kmendell)
• Continued checking for updates for containers excluded from automatic updates — 4eeb7d43d3c4aea469803ea6f94645ab94f8de1c (#4181) (@kmendell)
• Logged project updates during Git sync only when content changed — 439aee51db0e19769928e68454d610f2cb53cfcd (#4206) (@kmendell)
• Skipped symlinked external bind sources when preparing project updates — bcaa9d447b5aa044c60a9aa657179b8000dfa2d7 (#4207) (@kmendell)
• Kept the project Save action mounted to maintain a stable toolbar layout — dd37ce953c0e673776f7a843fabff612fa928147 (#4157) (@kmendell)

Environments, backups, and configuration

• Allowed token re-entry when changing an agent API URL — af4dab5f00980e34c3870deffae636eb4a498793 (#4160) (@kmendell)
• Allowed deleting backup records for missing snapshots — b30e617cfa403d91fd6306dfe88bdd2133a8dcb6 (#4161) (@kmendell)
• Surfaced Docker join errors and added a manager-address override to Easy Join — e2312137c99ff400f8473265780816d6bf9cab3f (#4191) (@kmendell)
• Allowed dots and hyphens in .env variable names — 144d7acced1ba23e0661148ce29b3db107732b58 (#4199) (@DominikZublasing)
• Added search to the template selection dialog — 4bbcbfea6274e149a57daa386a57543df688f380 (#4183) (@kmendell)
• Forwarded proxy configuration to Trivy scan containers — 85b9b16baa0d79edc7ab3d01df98dcd3d811a1d1 (#4168) (@kmendell)

Activity processing

• Isolated activity subscriber payloads to prevent concurrent writes — 9fc00866b9107366824b91cdd887de54c8b089d6 (#4159) (@kmendell)