swarmexec v1.17.0 — the cluster you are on, and the ones you are not
The largest release so far, and it has a theme: everything here is about
working across clusters, and about a tool saying what it did and did not look
at.
**Cluster switching keeps your session.** Activating a context used to tear the
UI down and build it again; where the cursor stood, which stacks were unfolded,
the "/" filter and every running port-forward went with it. The UI now keeps a
connection, a cache and a position per cluster and swaps between them. Only the
cluster you are looking at is polled; the others stay warm, so going back is
immediate and lands exactly where you left. Port-forwards survive a switch —
the Forwards tab gained a CLUSTER column to say which belong to where.
**The contexts are a sidebar, not a tab.** A tab is a destination, and switching
cluster stopped being a journey the moment it became cheap. The clusters now sit
in a column on the right, always saying which one is live (▶), which others are
still connected and therefore instant (·), and which refused (✗). `c` focuses it
from any tab. On a narrow terminal it steps aside rather than clip the tree.
**The tab digits moved: Nodes is 6, Configs is 7.**
**Stack files, both directions.** `stack export` writes a deployed stack back out
as compose YAML; `stack diff` compares a file against what is actually running
and prints a unified diff where a "+" is what deploying the file would add;
`stack deploy` submits one, but checks it first — the same eight analyzers that
badge the tree run on the spec the deploy would submit, and findings above
informational stop it and ask. `--yes` means "don't ask", not "ignore".
**A cluster-wide security report.** `swarmexec security report [-o file]`, or `w`
in the risks overlay, writes Markdown covering every service plus four checks no
single service spec can answer: unencrypted overlay networks carrying service
traffic, manager autolock, agent version and protocol skew, and unused secrets
and configs. It names its origin, it names its gaps ("Not covered"), and its
ordering depends only on the findings — so two reports can be diffed, and a
missing finding always means "not found" and never "not looked at".
**One ssh connection per cluster instead of one per dial.** Every exec, log
stream, port-forward, stats poll and refresh used to open its own ssh
connection, paying a handshake and an authentication against a bastion that was
connected a moment earlier. They now share a transport via OpenSSH's
ControlMaster. Measured on a three-node cluster behind a jump host: `swarmexec
doctor` went from 8 authentications and 3.6 s to 2 and 1.0 s. Set
SWARMEXEC_SSH_MULTIPLEX=0 to switch it off; unavailable on Windows.
**A stated minimum Docker version.** There was none — the client would fall back
as far as API 1.24 (Docker 1.12, 2016) and then fail one view at a time. It is
now API 1.40 / Docker Engine 19.03, checked when connecting and refused with
both numbers named. Resource usage and the per-node image view want more from
the node's own daemon (API 1.41/1.42, Docker 23.0) and stay empty rather than
fail.
Fixes:
- Switching cluster in the UI left agent traffic tunnelled to the previous
cluster's bastion. The tree kept working (that comes from the manager) while
exec, logs, port-forward, stats and volumes went dark. Measured: 3/3 agents
when started on a context, 0/3 after switching to the same one. There were two
resolutions of the same question; there is now one.
- grpc 1.83.2, for GO-2026-6443.
Documentation follows in all five languages, and the site gains a fourth slide
for the security report, a carousel that plays each one in full, and an explicit
cache lifetime for its images.
Client-side only; no agent redeploy needed.