Arcane Release Notes

[!NOTE] This release fixes Compose path and image handling, improves backup and update reliability, and adds a setting for Signal notifications. It also includes fixes for remote environments, authentication, and environment navigation.

Compose and updates

• Interpolate variables in Compose include paths (#4298) — @kmendell
• Preserve Compose image spelling during project updates and self-updates (#4330) — @kmendell
• Keep the selected tag during self-updates and refresh stale project update status (commit e862615fc4e47c8bf7fbfc089254bf509d0a82c7) — @kmendell

Environments, notifications, and authentication

• Resolve webhook target names in remote environments (#4299) — @kmendell
• Default notifySelf to true and add a setting for Signal notifications (#4302) — @Shraymonks
• Prevent logout from hanging on permission errors after OIDC login (#4309) — @kmendell
• Navigate to the selected environment on environment-scoped routes (#4320) — @kmendell

Backups and maintenance

• Prevent system backups from failing when project files are in use (#4311) — @kmendell
• Allow deleting backups when their S3 repository no longer exists (#4319) — @kmendell
• Report accurate reclaimed space in scheduled pruning (#4317) — @kmendell
• Store Francis actor state in its own SQLite database (commit 93a740597df7a6aa47d5925d9d8dc5499934af05) — @kmendell
• Use persistent Git storage for SSH host keys on native installs (#4300) — @kmendell

Interface and platform …

[!NOTE] This release adds registry browsing, mobile table sorting, and project deployment feedback. It also fixes issues with project and GitOps workflows, remote agents, job processing, and application reliability.

Features and interface

• Browse repositories and tags in configured registries. (#4162) @Laval13
• Add mobile sorting to the shared table menu. (#4225) @kmendell
• Add unsaved-changes warnings when deploying or redeploying projects. (32f1e335) @kmendell
• Add actor statuses to the diagnostics page. (01a8964d) @kmendell
• Make several UI/UX improvements, support backup login, and show both digest values. (#4271) @kmendell
• Update the dashboard header design. (#4269) @kmendell
• Refresh the login screen layout. (32262306) @kmendell
• Clean up crowded action buttons. (#4233) @kmendell

Fixes and reliability

• Handle .env directories in project scans, environment saves, and workspaces. (#4213) @Mczubi
• Honor *_FILE settings on the environment-managed settings path. (#4203) @mortencombat
• Reduce manager polling and config-sync egress to remote agents. (#4218) @kmendell
• Align editor themes with the selected application theme and prevent overlapping columns in virtualized tables. (#4219, #4220) @kmendell
• Avoid duplicate deployment events on project redeploy. (1b31dd9c) @kmendell
• Prevent GitOps directory sync from copying unrelated project data and stop loaded associations from overwriting repository updates. (#4222, #4243) @kmendell …

[!NOTE] This release adds bulk actions for vulnerability findings, a redesigned risk-based security view, container process visibility, and search in the template selector. It also improves update workflows, Compose handling, backups, Easy Join, and activity processing while resolving several access and configuration issues.

Security and vulnerability management

• Added bulk ignore and restore actions for vulnerability findings — 8dd49f1ac48b6dc1a17c960e08287338934eb33f (#4158) (@kmendell)
• Redesigned the risk-based security view — cac682df3161e4228b5217fc3c9361700485c280 (#4204) (@kmendell)
• Improved the risk score model — 0238e1414138788e1b674b1ae9d1ffc5b65adc38 (#4205) (@kmendell)
• Fixed environment-admin resource pages requesting globally protected data — 91825a6865e1e3a5a5913c0dfb938dc4093dbfe6 (#4151) (@kmendell)
• Accepted Safari’s unrequested appid=false value during passkey assertions — a7db1aeafd3aff1e5e3161780dd37d117ac0084a (#4208) (@kmendell)

Containers, projects, and updates

• Added a container processes tab — bbc70f7d6007b3532c1bc103e30e1cb9222ef6fe (#4187) (@kmendell)
• Routed container updates through the activity system — 2e35dfda39ed51e692fb4b00c944fd1ba6ceb6e5 (#4167) (@kmendell)
• Resolved pending update status consistently across containers, projects, and the dashboard — aaac10a0d5e1105edfa01a0708f4cdbaf6e96375 (#4189) (@kmendell) …

[!NOTE] This release fixes project directory creation, container update, and upgrade workflows. It also improves backup coverage and updates the Compose example configuration.

Project and Compose fixes

• Create missing project bind directories as the runtime user — 8bcb59d538a28bcd149b42bcbb9e096d10eb1059 (#4138) (@kmendell)
• Update the Compose example to include DISTRIBUTION=1 — 1b21e5c3594d3e60d8f8a449981a078a989790d6 (@kmendell)

Container update and backup fixes

• Allow manual updates for containers excluded from automatic updates — 6c227d02de0f412371f4124214934af2933fe7f5 (#4139) (@kmendell)
• Preserve data volumes when recreating containers during upgrades — 75f6ddb2bb8cee8cec52259d11d5123fe7b97f4d (#4141) (@kmendell)
• Include separately mounted projects in system backups — 081e638de8000ec033a7fe4b4ac036ff8571e238 (#4144) (@kmendell)

[!NOTE] This release adds richer log controls, Telegram topic destinations, bulk container updates, retained logs, and project editor preferences. It also improves update workflows, registry handling, UI behavior, and performance across projects, activity, and image updates.

Features

• Added a stream label toggle for distinguishing STDOUT and STDERR in logs. (#3976, 4f10dee49f7a3c4b32a695cc9f05584403ea674d) — @kmendell
• Added Telegram topic destinations for notifications. (#3978, e47164421a22b8a9f12714a923be566889d2cbe1) — @kmendell
• Added a timestamp toggle to the log viewer controls. (#3979, 9fa57c867b1085a7142d7e755f87ddd9318b1a1d) — @kmendell
• Added personal defaults for the project editor layout. (#3986, 67b34b9c032d8f56379ed60322839d39dc5af855) — @kmendell
• Added bulk updates for selected containers. (#3971, 0365c6861d50ef5fc5aaf7f816e370955eadc398) — @mewajda
• Added retained log viewing for stopped projects. (#4097, b350d394cd19027e90bb8dd581474de54745c434) — @kmendell

Fixes and UI improvements

• Nested Compose services and networks under their respective sections in the outline. (#3985, f4573188664d88d6d3a8ac0427c34611211dcb72) — @angst911
• Let the backend generate run IDs for manually submitted jobs. (#3987, af96a6e99b3fdc0b64cd8b26552e624be7732e54) — @kmendell
• Added a separate tag-listing timeout for large registries. (#3990, 5262d2f33af966b856a10b8572c061bf7ba8fc18) — @kmendell …

[!NOTE] This release adds more flexible Git-based backups, improved vulnerability scanning, and expanded container and network visibility. It also fixes several authentication, permissions, deployment, and agent-related issues.

Backups and Git sync

• Added Back up to Git sync mode and the ability to link existing projects to syncs — dadf87f93d9214dcd741c7ed503dfbf504c9df54 (#3932) (@kmendell)
• Added configurable Git identity for pushes — 372f168940702645d63d34d0d6d80b742a7cb8da (#3935) (@kmendell)
• Added an explicit environment-backup switch with a warning for project backups — 9ba395d5272ee5a3506682e61b9d1e06c4752f16 (#3937) (@kmendell)
• Added support for binary files in Git backups and reused the editor file tree in the sync dialog — b80880fab4146572c02f071126d44751391031b9 (#3946) (@kmendell)
• Preserved pre-deploy hooks and deployment options when importing GitOps syncs — da22a65fac881f7b6ff6048bae91399608d2eeab (#3952) (@kmendell)
• Added S3 backup discovery and re-keyed volume backups to the recovery key — 02208f5cd24e028dfb0e2221305febbf3ee58837 (#3885) (@neurekadev)

Security and vulnerability scanning

• Added CSV export to the security vulnerabilities table — af5538dde929bcc0e94053fd9ad4f3d263820da7 (#3936) (@kmendell)
• Added a Fix available filter to the security vulnerabilities table — bf48ce6eebebca249607b02dcebb7df37079ab90 (#3944) (@kmendell) …

[!NOTE] This release fixes authentication, vulnerability-management, and Docker compatibility issues. It also improves file-mode preservation, project navigation, notifications, and dashboard reliability.

Authentication and notifications

• Align first-login password validation with the configured policy — b71892d0902480a5e430bf4c10439d167508301c (@kmendell)
• Prevent passkey MFA failures caused by reactive options — 95e5a3bc14706e69a9a366794d92706c55a53a7f (#3926) (@kmendell)
• Preserve notification event subscriptions during partial settings updates and warn when none are subscribed — 817444abbd7984401e9f2e3ef59447e474f8d97b (#3925) (@kmendell)

Vulnerability management and Docker compatibility

• Fall back to cpuset for Trivy when the Docker host lacks CFS quota support — 41eae6334d8807d7fd7c159b73f157b28422e2a8 (#3910) (@kmendell)
• Allow vulnerability management to be disabled per environment — 4e432b30a69458c2077f9eac5ceb1a83709282b6 (#3914) (@kmendell)
• Pull pre-deploy runner images using configured registry credentials — 989e160ec544842d0db69ade182037cd2976b310 (#3918) (@kmendell)
• Fail image patching early when Docker lacks the containerd image store — 6fdcf37c2dba690a227d09e1bf5aaf3a3c632330 (#3928) (@kmendell)

Projects and GitOps

• Preserve existing file modes when saving project and global environment files — c92f3932cca1597c3d3fe3484b3d9a1e41289216 (#3919) (@kmendell) …

[!NOTE] This release adds durable job execution, Docker event streaming, label-based container management, non-UTF-8 workspace uploads, and improved backup recovery. It also improves synchronization, auto-update recovery, project workflows, frontend performance, and error reporting.

Features and improvements

• Added durable job execution with offline recovery (58823c2ac4afd674f88bccee38b5da9e985da335, #3863) (@kmendell).
• Streamed Docker daemon events to the Arcane event log (2a61718a3af98393ddcdef40d02d30fe416c70ec, #3862) (@kmendell).
• Added tag-based container updates (f8f456a62b866108b3c8c433cb04f8d6f6c119bb, #3865) (@kmendell).
• Added filtering for containers and projects by labels, plus support for hiding containers through labels and Compose metadata (5dfd281c628bac0b4880c465bd629040d94a301e, #3874; 6006dbefd64e437e4935c80e38006b96d53c4b93, #3875) (@kmendell).
• Added support for uploading non-UTF-8 workspace files (a38a0a2fbff09efeeda6430be15c933af00719fe, #3859) (@neurekadev).
• Linked Git-managed projects and synced files to their repositories (6eed748e3fc976ebeaa8a227239ec8b7565ad86d, #3879) (@FusselTV).
• Added backup recovery key import and reset confirmation controls (16db5a33747b49350407073aa0040baa5e151947, #3884) (@neurekadev).
• Improved environment synchronization by surfacing failures and recording manual sync activity (c6ad1016d913efd100260967dc1a5da8cacb7e32, #3854) (@kmendell). …

[!NOTE] This release adds performance improvements across authentication, Docker calls, scheduled scans, project loading, and CVE serving. It also fixes container shell handling, scheduler overlap, image digest display, authentication flows, agent reconnection, and several UI and integration issues.

Fixes

• Surface container shell close reasons and disable WebSocket compression — 30e1bb590a34d9aeded744a71d39e8709b3b7b33, b9b8c813f6d3735770f2bc1bf5c80b4967eb7e26 / #3814 (@kmendell)
• Skip overlapping scheduled cron job runs — 51cf6bb6a1049a01596a5933ddb2508de6938dea, 5232b4d04bfb482ed9d3ec869f30ec2fee03ca30 / #3815 (@kmendell)
• Refactor image digest inspection logic — d256fc2787efd18341d84e63e59e7cd38300e99d / #3826 (@jdrouhard)
• Keep the first-login password dialog open and clear its flag after an admin password change — 6f90da73f3606e42e58a0f00c98208f5817c27c9 / #3831 (@kmendell)
• Allow the frontend to recover from stale chunks after a redeploy — 8c294a7316f3616a704edfec366f4adccd91a577 (@kmendell)
• Keep edge agents on gRPC after a manager restart — 4febf6d0dcf64997b53cba7743d082b4c7550979 (@kmendell)
• Show digest-pinned image references — 5c0592994278ac9ab4600966dcdb460ecbef857b / #3836 (@kmendell)
• Hide passkey login when no credentials are registered — b7b568e1a6911bf1b8369de129af792fb0f23e4e (@kmendell)
• Honor SSH usernames in Git repository URLs — 837fe10c92ddbb2391d7b13475d475a68f7fca2c (@kmendell) …

[!NOTE] This release fixes browser session cookie size issues and missing sidebar usernames. It also updates the gopsutil and zod dependencies.

Fixes

• Issue compact browser session cookies instead of the larger ML-DSA access JWT — df7c24c85e9d4fa9d380532db928ecc3aa13dc17 (@kmendell); e874390f6b4ca611a4b5f733868cca1e01138aca / #3813 (@kmendell).
• Fall back to the username when the display name is unset in the sidebar user menu — 0c7174f1089079d79535563ac2d54b032ea6914a (@kmendell).

Dependencies

• Bump github.com/shirou/gopsutil/v4, including 4.26.7 to 4.26.8 — c9ad2e6f9f9751764e5608128b7e55abf9349b88 (@dependabot[bot]); dd02c011c575c298dbd3f3167e4ba291edc06c59 / #3798 (@kmendell).
• Bump zod from 4.4.3 to 4.5.4 — d95764cf15a2867e2ac573f8cf6f78654da597d7 / #3812 (@dependabot[bot]).

[!NOTE] This release adds selective system restores, scheduled volume backups, Convert to Compose, direct image patching, Apple push notifications, and ML-DSA-87 signing for authentication and edge mTLS. It also improves upgrade reliability, image update discovery, project logs, Swarm access, backup downloads, and UI performance.

Backups and recovery

• Add selective system restores and harden recovery — 874134cfedc2e8ae44e6f0cd7e957e87bc760988 (#3708) (@neurekadev)
• Add system-managed volume backup scheduling — 53a959f93e26193c6c9ac4bb4053555f18e8b2ff (#3737) (@neurekadev)
• Reduce S3 backup download amplification — 538350af6c72d0e6d80164f6aacb3b8dd02cd1bd (#3773) (@kmendell)

Containers, images, and projects

• Add experimental Convert to Compose for running containers — 9aef34e4ea703cbee29d31a4338413018ce54f34 (#3746) (@kmendell)
• Add direct Copacetic image patching — 3617720518f0bdfc4282a7b5844508f3b7da60ec (#3744) (@kmendell)
• Restrict Copa patches to OS-level issues — e95c55326a59a615993113e0ee809df734a40b0a (@kmendell)
• Store raw Trivy reports in the database and fix patch-target pagination — 53e7e82715bfebd9ed0d1a27dc0b777d0bbd68b0 (@kmendell)
• Honor UI container exclusions during image update discovery — b9b2092c0e36d3eaba66335e003b7ecd5e858540 (#3763) (@kmendell)
• Stop checking Arcane-built local images against registries — 8d10b7db2d34aefa44f0f9a684f3b84b2ae355d7 (@kmendell) …

[!NOTE] This release adds automated S3 backups, standalone container editing, batched container-update notifications, and GitOps redeployment for stopped projects. It also expands the CLI with commands for vulnerabilities, activities, and webhooks while improving project handling, OIDC support, and API behavior.

Features

• Add automated S3 backups — 555c5dfbac478e7bbe336fff29cfe4d6277b2d6d (#3459) (@affeldt28)
• Batch container-update notifications — 0239f62b45c7b2d485285a54fc54e44b6a0721e8 (#3650) (@wyx1818)
• Add the ability to edit standalone containers — 24894fc7310b747e95d2b5d59e0a5100bb8bf12f (#3646) (@kmendell)
• Add renaming for unused volumes — 1e413ada2f2413fa2a7c97798288b73ddb9d6b6c (#3704) (@neurekadev)
• Pull and redeploy images after GitOps sync for stopped projects — f17e84412ae41dac1945f5b6896bafce8c244bb9 (#3698) (@ohOgil)
• Add CLI commands for the latest server features and adopt hyphen-free command naming — d84511b8d67bef5fe3117832c9173ecc987e38da (@kmendell)
• Add CLI commands for vulnerabilities, activities, and webhooks with end-to-end coverage — f4f9df0e8f1373a9e7fcba145383fcda8b4b3fc2 (@kmendell)

Fixes

• Ensure stable ordering for page walks without an explicit sort — bf783a828ef816acf789851dffb2b8b8ed249450 (#3648) (@kmendell)
• Percent-decode API path parameters before use — c469305cdacf49b80f7f5639f00eef597c1ca102 (#3682) (@kmendell) …

Bug fixes

• report never-pulled image refs as a distinct 'not pulled' state instead of failing the update check (#3631 by @kmendell)
• localize category cards (#3596 by @InfinityPacer)
• coalesce concurrent Docker image/container list calls to cut duplicate decodes (#3635 by @kmendell)
• gate project archiving on live Docker state instead of stale persisted status(c487936 by @kmendell)
• use stored credentials for non-Docker Hub registries (#3639 by @BobzTH)
• add missing options to project redeploy dropdown(f7cb885 by @kmendell)
• go1.26.6 h2c ReadHeaderTimeout regression(6d4f222 by @kmendell)
• use errors.Is(err, fs.ErrNotExist) for acfs error checks (#3647 by @rohitkumbhar)
• unblock git sync workspaces and pre-deploy hooks on permission edges (#3637 by @kmendell)

Dependencies …

New features

• update ui layout and consolidate views (#3534 by @kmendell)
• add volume workspace (#3497 by @NeurekaSoftware)
• add animated logos(a2f597e by @kmendell)
• chunked upload sessions for large-file endpoints (#3595 by @kmendell)
• add ability to tag projects (#3601 by @kmendell)

Bug fixes

• move ios app passkey logic to backend(3b0fc6a by @kmendell)
• return actual passkey identity(1ef7cc5 by @kmendell)
• keep detecting passkeys with old ids(bfc35fb by @kmendell)
• serialize concurrent per-container updates to prevent stranded recreate (#3541 by @JoeJoeflyn)
• put arcane binary on $PATH in container images (#3547 by @JoeJoeflyn)
• editor line highlight and selection rendering fully opaque on default accent color (#3554 by @kmendell) …

[!IMPORTANT] Project variable resolution now matches the Docker Compose CLI

Previously, environment variables set on Arcane's own container (such as PORT) could be picked up when resolving ${VARIABLE} references in your projects' compose files. This could cause surprising results — for example, a project using ${PORT:-8191} could end up binding to Arcane's own port instead of its default (#3499).

Starting with this release, variable references in a project's compose file resolve only from:

• your global Variables (.env.global)
• the project's own .env file
• defaults in the compose file itself (${VAR:-default})
• timezone and locale from Arcane's environment (TZ, LANG, LANGUAGE, LC_ALL)

This means a project deployed through Arcane now resolves its variables the same way as running docker compose up in the project directory, and projects can no longer accidentally pick up Arcane's own configuration.

If a project referenced a variable that was only defined on Arcane's container, add it under Customization → Variables to share it with all projects, or to that project's .env file. No other action is needed.

New features

• simplify build registry image references (#3243 by @traeli)
• add gated admin password reset to interal CLI (#3470 by @kmendell) …

New features

• raw docker CLI output for all operations + interactive watch mode (#3376 by @kmendell)
• clickable dashboard tiles, volumes tile, and default landing page (#3383 by @kmendell)
• add row, bulk, and Update All actions to the updates page (#3398 by @kmendell)

Bug fixes

• harden gRPC tunnel reliability and request lifecycle (#3325 by @kmendell)
• prevent image update checks from getting stuck in a running state (#3327 by @kmendell)
• preserve IPAM fields in network inspect responses (#3335 by @kmendell)
• remove full stack trace from logging(1bed071 by @kmendell)
• correct swarm resource scoping and stack deploy conformance (#3385 by @kmendell)
• tear down abandoned dashboard and activity streams promptly (#3388 by @kmendell)
• skip unreadable directories instead of discarding the project file tree (#3393 by @kmendell) …

New features

• unify swarm node agent deployment and easy join swarm agent/nodes (#3279 by @kmendell)
• replace scheduled image polling with Docker event-driven update checks (#3290 by @kmendell)
• redesigned events view to remove bulky dialog (#3301 by @kmendell)
• redesigned templates browser and view (#3304 by @kmendell)
• redesign global variables with environment scoping and secrets (#3311 by @kmendell)
• rework activity center ui/ux and backend lifecycle (#3313 by @kmendell)

Bug fixes

• preserve tag when saving update records for tag@digest-pinned images (#3242 by @pkoutsovasilis)
• tab routing for all pages can cuase in correct tabs to tr yand be shown (#3249 by @kmendell)
• generate remote swarm node agent tokens on the manager(a0a77dc by @kmendell)
• recover auth and reload after self-update (#3289 by @kmendell) …

New features

• restart dependent services on project-level service restart (#3103 by @pkoutsovasilis)
• support for docker override files (#3104 by @kmendell)
• increase max session timeout limit to 1 year (#3222 by @OlziYT)
• localized timezone based on current locale (#3238 by @kmendell)

Bug fixes

• scope project update backup to changed files and lazy-load file tree (#3158 by @kmendell)
• workspace editor showing stale file content after save (#3188 by @kmendell)
• don't overwrite good image update records on registry rate-limit errors (#3190 by @kmendell)
• skip SMTP auth without full credentials and add none auth mode (#3192 by @kmendell)
• git clone failures with Azure DevOps repositories (#3197 by @kmendell)
• fix https links on containers list (#3191 by @ribbal)
• gitops sync failing with 'invalid hostPort: /placeholder-undefined' for compose files using variable defaults (#3198 by @kmendell) …