swarmexec v1.17.1 — audit your swarm, and run several of them from one place Two capabilities landed in v1.17.0 that change what a team can do with Docker Swarm. This release is the polish that makes them usable day to day — and since v1.17.0's announcement never went out, here is what both are for. **A security report over the whole cluster, as Markdown.** `swarmexec security report -o security.md` writes an auditable document: every service checked against eight rules — secrets passed as environment variables, root users, the Docker socket mounted in, added capabilities, host networking, unconfined seccomp/AppArmor — plus four checks no single service can answer: unencrypted overlay networks carrying traffic, managers that are not autolocked, agents drifting apart in version, and secrets and configs nothing uses. Three properties make it worth running on a schedule. It names its origin — cluster, time, build. It names its gaps, under "Not covered": a missing finding means "not found", never "not looked at". And its order depends only on the findings, so two reports diff cleanly and a pipeline can fail on the delta. Manager API only; the agents do nothing for it. **Several swarms, one session.** Teams rarely have one cluster. Switching between prod, staging and edge used to tear the tool down and rebuild it, losing where you were. It now keeps a connection, the fetched state and your position per cluster: you return to the same service, filters intact, and running port-forwards keep serving across the switch. Only the visible cluster is polled, so the others cost nothing. A sidebar says which are live and which are warm. What v1.17.1 itself fixes, both found by using it: - Setting a service's image version is now in the actions menu. It always worked, from a key named in one footer — so the menu an operator opens to see what is possible implied it was not. - A local port already in use by one of your own forwards is refused by name, saying which service and which cluster holds it. "Address already in use" cannot tell you that the holder is a cluster you are not looking at. Also here: a fifth demo on the landing page, which now describes the security report too; and release notes on the site render their emphasis instead of printing the asterisks. Client-side only; no agent redeploy needed. Apache-2.0, self-hosted, no telemetry.