Skip to content
Vaicoa
Alpha: for testing only; it does not yet meet the Cyber Resilience Act’s requirements. Status and limits →

Releases and updates

Every release is a manifest signed with the release keys, which stay offline. The hub imports only what verifies, and its servers’ agents install only versions a verified manifest names.

The channel Built

Section titled “The channel ”
  • The hub polls the signed channel index hourly, outbound only; off for a hub without internet, which then imports releases by hand.
  • The channel (stable by default, candidate for twins) is signed in the manifest, so an import cannot put a candidate on stable.
  • Each release carries a class, security or feature, an expiry, a security floor (minVersion) and a list of revoked versions. A floor or a revocation blocks everything below it, rollbacks and queued upgrades included. A re-signed manifest can only make things stricter.

Who moves a release

Section titled “Who moves a release”
  • Feature releases: you promote them, server by server (vai release promote VERSION --host NAME).
  • Security releases, automatic by default: to twins and staging servers as soon as they are offered, to production 3 days later (1 day for an actively exploited vulnerability), inside the maintenance window. You can turn this off per environment, or postpone it once by up to 14 days.
  • Production waits for proof: when the hub has a twin or a staging server, production waits until one of them has run the release; a failed upgrade there stops the automatic rollout until you decide.
  • The hub sends a signed notice when a release is offered, scheduled, applied, and when it fails.

Rollback

Section titled “Rollback”

Each server keeps two image slots. An upgrade boots the new slot, a health gate runs, and only then is the slot committed. Rolling back boots the old slot without a download.

Drilled (a production Podman host following the channel to a security release, rolled back by the customer, then a broken release; ownpaas lab and Hetzner Cloud, 20 October 2026):

  • the app was down 25 s (lab) and 35 s (Hetzner) for the upgrade, 23 s and 34 s for the rollback; the data volume kept at every step;
  • a release whose Podman could not start a container fell back by itself after the gate’s 20 minutes; the app was down for those 20 minutes.

Open

Section titled “Open”
  • In progress The release keys’ ceremony (two offline keys) and a release build that refuses the alpha’s fixture key: the gate before the alpha leaves testing.