Tags give the ability to mark specific points in history as being important
-
v1.17.3
protectedRelease: swarmexec v1.17.3dc1d6579 · ·v1.17.3 — the secret stops travelling, and a node stops being exhaustible A security release. Four findings from our own audit, one of them sitting in the deployment mode our documentation recommends. **The shared secret no longer leaves your machine.** In self-signed mode the client cannot verify the agent — the certificate is regenerated on every restart, on every node — and it used to send the secret anyway, to whatever server answered the connection. One capture was one credential valid on every node, each holding the Docker socket. The client now sends a proof derived from the secret and the certificate of the connection it is travelling on. A proof collected on an attacker's connection authenticates nowhere else, and there is nothing left on the wire to steal. Said plainly, because the opposite would be worse: this defeats theft and replay, not eavesdropping. On a connection you chose not to verify, whoever answers still sees what that session sends them. For an untrusted network, provision a CA. **A node can no longer be talked into exhausting itself.** Every port-forward connection creates a container, so "open many connections" meant "start many containers", with nothing stopping it. Two limits now: 256 concurrent streams and 64 live forward sidecars, the second deliberately tighter so the refusal lands before any container exists. Over the limit the agent refuses and names the flag to raise, rather than queueing — a queue turns a resource limit into a wait nobody can tell apart from a hang. Session timeouts, which shipped disabled, now default to 30 minutes idle and 12 hours total. **Listing containers is authorized and audited** like every other call. It was the one that asked neither, so a policy could never restrict discovery — the container ids and service names that exec, logs and port-forward take as input — and mapping a whole cluster left no record at all. Also here: the security overlay's escaping is now tested on the path that actually renders it, and release announcements are built as CI artifacts instead of drafts nobody could find. **Update the agents: `swarmexec init --force`.** A v1.17.3 client sends only the bound proof, so it cannot authenticate to an older agent. While a fleet is mixed, `legacy_secret: true` in the client config bridges the gap; drop it afterwards. Apache-2.0, self-hosted, no telemetry.
-
v1.17.1
protectedRelease: swarmexec v1.17.19f5818cf · ·swarmexec v1.17.1 — audit your swarm, and run several of them from one place Two capabilities landed in v1.17.0 that change what a team can do with Docker Swarm. This release is the polish that makes them usable day to day — and since v1.17.0's announcement never went out, here is what both are for. **A security report over the whole cluster, as Markdown.** `swarmexec security report -o security.md` writes an auditable document: every service checked against eight rules — secrets passed as environment variables, root users, the Docker socket mounted in, added capabilities, host networking, unconfined seccomp/AppArmor — plus four checks no single service can answer: unencrypted overlay networks carrying traffic, managers that are not autolocked, agents drifting apart in version, and secrets and configs nothing uses. Three properties make it worth running on a schedule. It names its origin — cluster, time, build. It names its gaps, under "Not covered": a missing finding means "not found", never "not looked at". And its order depends only on the findings, so two reports diff cleanly and a pipeline can fail on the delta. Manager API only; the agents do nothing for it. **Several swarms, one session.** Teams rarely have one cluster. Switching between prod, staging and edge used to tear the tool down and rebuild it, losing where you were. It now keeps a connection, the fetched state and your position per cluster: you return to the same service, filters intact, and running port-forwards keep serving across the switch. Only the visible cluster is polled, so the others cost nothing. A sidebar says which are live and which are warm. What v1.17.1 itself fixes, both found by using it: - Setting a service's image version is now in the actions menu. It always worked, from a key named in one footer — so the menu an operator opens to see what is possible implied it was not. - A local port already in use by one of your own forwards is refused by name, saying which service and which cluster holds it. "Address already in use" cannot tell you that the holder is a cluster you are not looking at. Also here: a fifth demo on the landing page, which now describes the security report too; and release notes on the site render their emphasis instead of printing the asterisks. Client-side only; no agent redeploy needed. Apache-2.0, self-hosted, no telemetry.
-
v1.17.0
protectedRelease: swarmexec v1.17.02a51cdda · ·swarmexec v1.17.0 — the cluster you are on, and the ones you are not The largest release so far, and it has a theme: everything here is about working across clusters, and about a tool saying what it did and did not look at. **Cluster switching keeps your session.** Activating a context used to tear the UI down and build it again; where the cursor stood, which stacks were unfolded, the "/" filter and every running port-forward went with it. The UI now keeps a connection, a cache and a position per cluster and swaps between them. Only the cluster you are looking at is polled; the others stay warm, so going back is immediate and lands exactly where you left. Port-forwards survive a switch — the Forwards tab gained a CLUSTER column to say which belong to where. **The contexts are a sidebar, not a tab.** A tab is a destination, and switching cluster stopped being a journey the moment it became cheap. The clusters now sit in a column on the right, always saying which one is live (▶), which others are still connected and therefore instant (·), and which refused (✗). `c` focuses it from any tab. On a narrow terminal it steps aside rather than clip the tree. **The tab digits moved: Nodes is 6, Configs is 7.** **Stack files, both directions.** `stack export` writes a deployed stack back out as compose YAML; `stack diff` compares a file against what is actually running and prints a unified diff where a "+" is what deploying the file would add; `stack deploy` submits one, but checks it first — the same eight analyzers that badge the tree run on the spec the deploy would submit, and findings above informational stop it and ask. `--yes` means "don't ask", not "ignore". **A cluster-wide security report.** `swarmexec security report [-o file]`, or `w` in the risks overlay, writes Markdown covering every service plus four checks no single service spec can answer: unencrypted overlay networks carrying service traffic, manager autolock, agent version and protocol skew, and unused secrets and configs. It names its origin, it names its gaps ("Not covered"), and its ordering depends only on the findings — so two reports can be diffed, and a missing finding always means "not found" and never "not looked at". **One ssh connection per cluster instead of one per dial.** Every exec, log stream, port-forward, stats poll and refresh used to open its own ssh connection, paying a handshake and an authentication against a bastion that was connected a moment earlier. They now share a transport via OpenSSH's ControlMaster. Measured on a three-node cluster behind a jump host: `swarmexec doctor` went from 8 authentications and 3.6 s to 2 and 1.0 s. Set SWARMEXEC_SSH_MULTIPLEX=0 to switch it off; unavailable on Windows. **A stated minimum Docker version.** There was none — the client would fall back as far as API 1.24 (Docker 1.12, 2016) and then fail one view at a time. It is now API 1.40 / Docker Engine 19.03, checked when connecting and refused with both numbers named. Resource usage and the per-node image view want more from the node's own daemon (API 1.41/1.42, Docker 23.0) and stay empty rather than fail. Fixes: - Switching cluster in the UI left agent traffic tunnelled to the previous cluster's bastion. The tree kept working (that comes from the manager) while exec, logs, port-forward, stats and volumes went dark. Measured: 3/3 agents when started on a context, 0/3 after switching to the same one. There were two resolutions of the same question; there is now one. - grpc 1.83.2, for GO-2026-6443. Documentation follows in all five languages, and the site gains a fourth slide for the security report, a carousel that plays each one in full, and an explicit cache lifetime for its images. Client-side only; no agent redeploy needed. -
v1.16.2
protectedRelease: swarmexec v1.16.298cca40f · ·swarmexec v1.16.2 — states you can read off the screen Two reports from testing, both the same shape: something you can toggle, with no way to see which way it was set. - The log footer names the follow state instead of just the key. It read "follow on/off" whatever the view was doing, and that is the one place you look to find out — a view with follow switched off looks exactly like a container that has gone quiet. The active half is now marked, in colour and underlined, and it repaints on the toggle. - The inspect overlay has a tab strip. It has held three views for a while — the tabular summary, live resource usage, and the raw daemon JSON — but the only place any of them was named was a footer hint for whichever came NEXT. So the resource-usage view was reachable and undiscoverable at once: you had to press "t" twice to find it, past a hint that said "raw json", which is something else. The three are now named up front, in the same shape as the main window's tabs. - The digits select a view directly — 1 table, 2 stats, 3 raw json — and "t" still cycles. The help overlay lists both. - Documentation follows in all five languages. It also corrects a sentence that was wrong before this release and would have been plainly wrong after it: the service edit keys are in the overlay's footer, not its title. Client-side only; no agent redeploy needed.
-
v1.16.1
protectedRelease: swarmexec v1.16.1b81cfc8d · ·swarmexec v1.16.1 — a readable usage table, and a log view that lets go of the keyboard - The log view no longer blocks the keyboard. With a busy container open, keys arrived so late that the program looked crashed. Four causes, all real: every visible line was parsed twice per rebuild, every rebuild re-parsed lines whose format had not changed, each line was written to the widget on its own, and the usage poll kept running behind the overlay. A warm rebuild went from 229 ms to 2.6 ms, a cold one to 50 ms. - Usage is a table with its units, not a bare percentage. "87%" told you nothing you could act on: 87% of what, and how much is that? The rows now name the resource, show the reading against the limit it is measured on, and say whether that limit is the container's own or the whole node's — those are different facts and were being shown as one number. - Memory is in binary units, because that is what the limit is set in. A 1 GiB limit rendered as 1.07 GB looked like an off-by-something rather than the same number in other units. - The markers say "cpu" and "mem". They were glyphs, and a glyph does not tell you which resource is at 90% — which is the entire point of the marker. - The shortcut footer stops disappearing. Two status flashes in quick succession left the second one restoring the first one's text, so the shortcuts vanished until a tab switch redrew them. The footer now has one owner and a baseline it returns to. No agent redeploy needed: everything here is client-side.
-
v1.16.0
protectedRelease: swarmexec v1.16.04692dc4d · ·swarmexec v1.16.0 — healthchecks in the tree, image cleanup per node - The service tree is coloured by healthcheck, not only by replica count. A service whose every container was failing its probe used to render as a calm aqua "3/3": the count was true and the row was misleading. Swarm cannot tell you otherwise — a task reads "running" while its container fails every probe — so the verdict comes from the node. Every container failing is now as bad as none running; some failing reads like a partial rollout. A service that declares no healthcheck is deliberately NOT recoloured: nothing is known, and guessing would be the same mistake in the other direction. Stacks roll the same verdict up. - "No healthcheck configured" and "the probe passes" stay different facts everywhere. Empty never means healthy. - Image disk space, per node. A node whose filesystem fills with old layers was invisible from the cluster side — the manager API has no view of images at all. The node detail now shows what the layer store holds and what is reclaimable, and "P" reclaims it. - The two reclaim modes are two menu entries, not one flag with a default, because they are different acts: untagged leftovers are safe to remove, while removing every unused image also takes images that services scaled to zero and tasks between restarts still need — each then has to pull again. The agent authorizes the two separately, so a policy can permit one without the other. - The image figures match `docker system df` exactly. Summing image sizes does not: layers are shared, and that sum reported 32.7 GB where the daemon said 22.2 GB. Health markers and the image view both need the agents redeployed: run `swarmexec init --force`. Until then they stay absent, and say so.
-
v1.15.0
protectedRelease: swarmexec v1.15.0abb8bcd1 · ·swarmexec v1.15.0 — live CPU and memory usage - Resource usage, measured on the nodes. The manager API only ever knew what the scheduler had BOOKED against a node; it could report "8% reserved" about a node that was on fire. A new node-local Stats RPC adds the other half, and the two stay in separate blocks because they answer different questions. - Where it shows: a container or service past 70% carries an orange marker in the tree, past 90% a red one, naming the resource. A service takes its WORST replica, not an average — an average hides the one container about to die. The node detail gains a measured block under the reservations. The inspect overlay gains a third view: 't' now cycles table, stats and raw JSON. - Every percentage says what it is a percentage OF: the container's own limit when it has one, the node's capacity when it does not. 91% of a 256 MB limit and 91% of a 64 GB node are different conversations. - Memory excludes the page cache, so a container that has merely read a lot of files no longer looks like it is about to be OOM-killed. CPU needs two readings before it means anything and shows "…" until then, rather than a 0% that reads as idle. - The agent samples only while someone is looking and forgets its readings when they stop, so an agent nobody is watching costs nothing. - Docs: re-rolling the agents without changing the shared secret — including the trap that makes it go wrong — is now documented in all five languages. - Release notes on the site render as written again; a note in prose used to come out as one heading per line. This feature needs the agents redeployed: run `swarmexec init --force`. Until then the client shows no usage numbers, by design, and says so.
-
v1.14.1
protectedRelease: swarmexec v1.14.144385764 · ·swarmexec v1.14.1 — release notes render as written - fix(site): the /releases page now reads the shape of each release note instead of assuming a single house style. A note written as prose came out as one heading per source line, and an indented block lost its layout — v1.14.0 was the first release written that way, so its notes were unreadable. The renderer classifies line by line now: bullets stay bullets, an indented run keeps its layout as a screen, and a run of prose lines becomes one paragraph. Verified against all 60 existing tag messages — none of them renders differently than before. - Site-only. No client or agent changes vs v1.14.0.
-
v1.14.0
protectedRelease: swarmexec v1.14.0b14f25d3 · ·swarmexec v1.14.0 — addresses in the inspect NETWORKS section The NETWORKS section of the inspect overlay listed which networks a service is attached to and which DNS names resolve there, but never the addresses behind them — the question it is most often opened for. Answering it meant leaving the TUI for `docker service inspect` and reading Endpoint.VirtualIPs by hand. It now answers it on three levels: NETWORKS - gateway vip 10.0.2.32/24 (2 dns names) gl_gitlab tasks.gl_gitlab - 1 container gl_gitlab.1 10.0.2.125/24 docker3v2 - ingress vip 10.0.0.250/24 (routing mesh) published 2222 -> 22/tcp - 1 container gl_gitlab.1 10.0.0.64/24 docker3v2 Collapsed, the row already carries the address: "vip" on a service — what the swarm load balancer answers on — and "addr" on a task, its own address, which until now only appeared hidden inside the expanded network. Expanding once gives the DNS names as before plus a second collapsible row; expanding that gives one column-aligned row per container with its address and node. Copying inside NETWORKS yields the bare address without its mask, the form that goes into a curl. Which containers appear is filtered on the task's DESIRED state rather than its current one: a task that is only preparing or starting already holds its address, and during a rolling update that is most of them, so filtering on the current state would empty the drill-down exactly when it is most interesting. Such a task is listed with its state in brackets. A task the manager has given up on is excluded — its address has been released and may already belong to another container. The ingress network gets a row too, although no spec mentions it: swarm attaches a service to the routing mesh on its own as soon as it publishes a port in ingress mode, and that VIP is the address the mesh answers on. It is appended after the declared networks and lists the ingress-published ports that put the service there; host-mode ports bypass the mesh and are left out. A dnsrr service has no VIP by design and says so instead of showing a blank. Also: the "?" overlay gained a line for the network drill-down, and its "u" entry no longer claims to only update to a NEWER image — it has set any version since v1.13.0. Docs updated in all five languages. -
v1.13.0
protectedRelease: swarmexec v1.13.0efb0294f · ·v1.13.0 — day-2 operations: stacks, rollback, node control, hardening checks - Services are grouped by stack in the tree (stack → service → container), with per-stack roll-ups for in-flight updates and security findings. 's' toggles grouping, 'h'/'l' fold across all three levels. - Roll a service back to its previous version with 'R'; the confirm shows the spec diff reversed, so you see what will be undone. 'X' now removes a service straight from the tree. - 'u' sets any version, not just an available upgrade — pin a service, or go back to a known-good tag, including off :latest. - Nodes: 'a' sets availability (active / pause / drain, drain confirmed), and the node detail shows what the scheduler has booked against each node's CPU and memory — reservations, with tasks that declare none counted separately. - The security scan grew from 2 checks to 8: Docker socket mounted in, added capabilities, host network, seccomp/AppArmor disabled, plus informational notes on missing resource limits and unpinned images. - New Configs tab, showing a config's actual content — the thing the Secrets tab cannot do. - Site: a third demo slide showing the TUI; docs updated throughout and Polish added as a fifth language.
-
v1.12.0
protectedRelease: swarmexec v1.12.0a430583f · ·v1.12.0 — service security scan, port-forward demo, CVE gating - Security risks: static analyzers over each service spec flag containers pinned to root and credentials embedded in environment variables. A leading 🛡 marks a flagged service in the tree; '!' opens an overlay listing every finding by severity. Only an env var's key name is ever shown, never its value. The analyzer set is an extensible registry. - Site: a second demo slide showing port-forwarding, in a two-slide carousel next to the existing demo. - Security: fixed two reachable CVEs (grpc 1.82.1, x/text 0.39.0) and added a govulncheck CI stage that fails a build on a reachable vulnerability with an available fix. - Docs: the security scan documented and drifted docs corrected (logfmt, the L logs key, ? / --ssh-jump / SWARMEXEC_KEYS, keys.yaml) in all four languages.
-
v1.11.4
protectedRelease: swarmexec v1.11.45bbb9b04 · ·v1.11.4 — accurate service-update indicator - fix(ui): badge only actively-converging updates (updating, rollback_started). Swarm keeps UpdateStatus.State forever and defaults failure_action=pause, so services untouched for weeks were wrongly shown as 'update paused'; those sticky paused states no longer badge (tree + inspect). Docs (en/de/es/fr) updated to match.
-
v1.11.3
protectedRelease: swarmexec v1.11.3117dc039 · ·v1.11.3 — site domain cleanup - chore(site): point all references from the decommissioned swarm-exec.logle.io to the live swarm-exec.cloud-surfers.net (Traefik Host rule, privacy notice en/de/es/fr, docs back-links, meta/OG, README, CI/Dockerfile comments, NOTICE). - No client code changes.
-
v1.11.2
protectedRelease: swarmexec v1.11.241484769 · ·v1.11.2 — docs refresh + release-download fix - docs(site): docs pages (en/de/es/fr) updated to v1.10.1/v1.11.0 — ui.dim/SWARMEXEC_UI_DIM, the image version picker (+ downgrade warning), the rolling-update indicator, and the 1–7 tab-jump keys. - ci: release binaries published to the generic Package Registry (permanent, public), fixing the broken landing-page download links (carried over from v1.11.1). - No client code changes vs v1.11.0/v1.11.1.
-
v1.11.1
protectedRelease: swarmexec v1.11.1ba5946f9 · ·v1.11.1 — release download fix - CI: publish release binaries + SHA256SUMS to the generic Package Registry (permanent, publicly downloadable), replacing member-only/expiring job artifacts. Fixes broken public Download links on swarm-exec.logle.io. - No product code changes vs v1.11.0.
-
v1.11.0
protectedRelease: swarmexec v1.11.07174467b · ·v1.11.0 — TUI visual refresh - Theme: rounded thin borders (incl. focus), calm dark palette with teal accent - Backdrop dim behind overlays, configurable via ui.dim / SWARMEXEC_UI_DIM (default 0.6) - Clickable, modernised tab bar (underline indicator; click to switch) - Service rolling-update indicator in the tree and service inspect - New-context form row spacing fix
-
v1.10.1
protectedRelease: swarmexec v1.10.18fd222ba · ·v1.10.1 First working release of the 1.10 line (v1.10.0 failed CI on the agent image and could not be re-tagged; see the agent Dockerfile fix below). Highlights - Service image version picker: from a service's inspect view you can now update to any image version, not just the newest. The "newer version available" hint moved to the top of the inspect and is actionable from any row (u). A picker suggests newer versions with type-to-filter autocomplete, the field is freely editable to pin any existing tag (including an older one), a typed tag is validated against the registry, and downgrades are confirmed with a warning. :latest services keep the single current-digest confirm. Internal - Large TUI refactor (H1): the ~5,600-line ui.go god file is decomposed into a ui struct with methods split across per-concern files. Verified behavior-identical. - Named overlay-size constants + centeredPrompt helper; single cmdContext helper replacing the duplicated ctx==nil guard (L1, L2). - Agent RPC handlers share one authorize() gate for the drain/identity/ authorize/audit/deny sequence (M5). Fixes - agent: Dockerfile build stage bumped to golang:1.27-alpine to match the module's Go 1.27 requirement (the earlier Go bump missed the agent image).
-
v1.10.0
protected36b86a77 · ·v1.10.0 Highlights - Service image version picker: from a service's inspect view you can now update to any image version, not just the newest. The "newer version available" hint moved to the top of the inspect and is actionable from any row (u). A picker suggests newer versions with type-to-filter autocomplete, the field is freely editable to pin any existing tag (including an older one), a typed tag is validated against the registry, and downgrades are confirmed with a warning. :latest services keep the single current-digest confirm. Internal - Large TUI refactor (H1): the ~5,600-line ui.go god file is decomposed into a ui struct with methods split across per-concern files (ui_containers.go, ui_volumes.go, ui_networks.go, ui_secrets.go, ui_contexts.go, ui_nodes.go, ui_forwards.go, ui_serviceedit.go, ui_inspect.go). Verified behavior-identical. - Named overlay-size constants + centeredPrompt helper; single cmdContext helper replacing the duplicated ctx==nil guard (L1, L2). - Agent RPC handlers share one authorize() gate for the drain/identity/authorize/ audit/deny sequence (M5).
-
v1.9.0
protectedRelease: swarmexec v1.9.075f761fb · ·swarmexec v1.9.0 Features - Registry: detect a newer semver tag for version-pinned images, not just :latest — the tree shows the concrete target version (e.g. ↑ 2.12.0) and inspect offers a one-key update to it. - TUI: a full keybinding help overlay on "?", reachable everywhere (including the inspect view and other overlays); footers front-load the escape hatches so they never clip; the service-inspect editors are grouped behind an "a" actions menu instead of ~18 case-sensitive keys. - Site: Docker Hub hints across the landing/docs/release pages, full SEO (sitemap.xml, hreflang, canonical, Open Graph/Twitter, JSON-LD), and Umami click tracking on the download and repository links. Fixes - TUI: Ctrl-C inside a container shell now interrupts the foreground process (e.g. tail -f) instead of quitting the whole TUI; sh opens with a PTY. - TUI: the mouse can select and copy container-shell output again (mouse capture is released to the terminal emulator while the shell is open). Internal - Refactor: a single confirm() helper backs the two-button dialogs.
-
v1.8.3
protectedRelease: swarmexec v1.8.38dbb61f5 · ·swarmexec v1.8.3 UI fixes - Container tree: Enter on a service now toggles expand/collapse (was: opened its logs). Logs move to a new L key (works on a service or a container). - Restore shelling into a container as a specific user: the container menu gains "Shell as user…" (name or UID[:GID]) — the TUI equivalent of exec -u. - Closing a container shell (exit / Ctrl-D) now closes the pane; it no longer needs a second Esc. Only a shell that couldn't start (exit 126/127) keeps the pane up so the error stays readable. Site - Umami click tracking on the download links (per platform: linux/macOS/ windows, each a distinct event) and the repository link.