CHANGELOG

What shipped, and when.

Including the fixes that were our fault. A changelog that only lists features is a marketing page wearing a build log’s clothes.

RSS ↗
v1.0.12026-08-05AddedFixed

amd64 images, and a first install that works

  • Addedlinux/amd64 images. 1.0.0 published arm64 only, so on most machines the install stopped at "no matching manifest for linux/amd64" before anything started. Both architectures are now in every published tag.
  • FixedA brand-new install could not create its first account from a browser. The login page offered only "contact your organization admin for an invite" — on an install that has no admin, no invite and no organization yet. It now shows a "Create a workspace" link while no organization exists, and hides it again once one does, so a fresh install stays claimable exactly once.
  • FixedThe documented way to generate the database password produced passwords that broke the install. `openssl rand -base64 24` emits "/" and "+", and that value is substituted into a connection URL where a "/" ends the authority section — so the backend restarted forever on "invalid port number in database URL", a message that never mentions the password. The instructions now generate URL-safe hex, and the backend stops with an explanation and the command to fix it instead of that error.
  • FixedPinning a version as TALOS_VERSION=v1.0.1 failed with "manifest unknown". The release is named v1.0.1 but the image tag carries no "v", which made the wrong value the natural guess. The correct form is documented alongside the variable.
v1.0.02026-08-04AddedSecurity

First public release

  • AddedA published Docker Compose install: two generated secrets and a database password, one command, no source checkout, no registry login and no account. The images are public.
  • AddedAgentless server management over plain SSH. Nothing is installed on the machines you manage, and read-only discovery reports OS, kernel, runtimes, containers and database engines without changing anything.
  • AddedTen project types from one control plane: bare servers, Frappe/ERPNext, Docker, Kubernetes, application deployments, databases, hypervisors, and AWS, Azure, GCP and Oracle.
  • AddedEvery action runs as a queued job with live log streaming, and what you watch is exactly what lands in the audit ledger.
  • AddedBackups with verified restores — a backup is only marked verified after it has actually been restored into a throwaway instance and checked — plus point-in-time recovery for managed Postgres and tiered retention per database.
  • AddedDestructive operations are plan-then-apply: you see exactly what will be destroyed, and how each item was identified, before anything runs. A server reset requires a verified backup first.
  • AddedAn optional AI engine on your own API key, across multiple providers. It cannot act directly — it writes a proposal, a human reviews the exact diff, and only on approval does the work enter the same job queue a human would have used. No model provider is contacted unless you configure one.
  • AddedPer-project dashboards, scheduled reports, and a read-only assistant for asking questions about your own fleet without granting write access.
  • SecurityThe backend refuses to start on a missing or published-default JWT_SECRET or ENCRYPTION_KEY, before it opens a network connection — rather than warning and carrying on with a signing key that is published in a public repository.
  • SecuritySSH keys, cloud credentials and database passwords are encrypted at rest under your ENCRYPTION_KEY, decrypted in memory only for the duration of a job, and never written to a log line or a job payload.
  • SecurityPer-resource permissions are enforced on visibility, proposal, approval and execution independently, and every route is organization-scoped. The control plane itself is not indexable and serves no public page — the first thing it presents is a login form.
  • AddedOne switch selects self-hosted or multi-tenant mode against a single shared schema, so the isolation a hosted deployment relies on is the same code a self-hosted install runs.