v0.4.5

Signedpublished August 18, 2026

What changed

Added

uninstall.sh --nuke returns the VPS to its pre-install state. --purge only ever removed DevGrail's own things; the host kept the changes install.sh made outside that namespace, so a re-install was never really a fresh install. --nuke implies --purge and additionally strips the userns-remap and default-address-pools keys the installer added to /etc/docker/daemon.json (restarting Docker), reclaims the now-orphaned per-UID data root, and removes the dockremap user and its subordinate ranges. The measurable result is that install.sh takes its fresh-host branch on the next run — it offers userns-remap again instead of refusing because the host still has Docker state.

Keys are removed only while they still hold the values install.sh writes. A userns-remap pointing at a named user, or pools tuned to the operator's own addressing, are decisions this script reports and leaves alone. A daemon.json that does not parse is never touched, and a daemon that does not come back gets its previous config restored. Interactively, --nuke is offered as a follow-up question after the data-wipe prompt rather than requiring the flag.
uninstall.sh --remove-docker additionally uninstalls Docker Engine, containerd and /var/lib/docker. It implies --nuke, is asked separately and defaults to no, because it stops and deletes every container on the host — DevGrail's or not. jq and openssl are never removed.

Fixed

uninstall.sh --purge left things behind, despite promising it did not. Per-workspace devgrail-ws-* networks were never removed (containers and volumes with the same devgrail.managed label always were), so each uninstall leaked one address-pool slot per workspace. Only :latest was removed for the two DevGrail images, leaving :previous and the release tag docker load unpacked. And once an earlier --purge had deleted the compose file, the fallback path removed two infra containers by name — missing Traefik, which declares no container_name, along with the project's volumes and networks. The stack's leftovers are now found by their Compose project labels, confirmed against the recorded config-file path so another project cannot be caught by the same sweep. uninstall.sh also honours docker-compose.override.yml now, as install.sh already did.

Container images

devgrail-container

registry build 13

amd64747 MB

sha256:fa73a2b12e95522990e8c7142d5f4e194336aa24c35ac59b9483e9fca5d59b5c

Download

arm64621 MB

sha256:79ea60a454390221b22c43f37d3845f90ddbba5271d38d99cd341c88e27833d0

Download

devgrail-server

registry build 13

amd6445 MB

sha256:f6e54b598081b3d1a4bb13ae3a5631614ad536b7eb93ee760236dd1b63b2e19a

Download

arm6444 MB

sha256:26eda5a5f7725b6a72d0bfd73a2799b0dbf8c40a2b7a5775a4cb02ac1f605280

Download

Installer files

docker-compose.yml11 KBsha256:61ecf9e19a3c6be92a1161c645fa31e0cb16795419b1b2ff84c3fafeeb21f57a

install.sh118 KBsha256:d95f439701a773f6694477fe3d9463ab81484b55aacb391d7094ade7a2f8dca7

traefik-dynamic-http.yml5 KBsha256:e344c8efd13c7d84996e2ebfbc75dcee2d995d8538c8a245c89c0e44fad0089b

traefik-dynamic.yml6 KBsha256:d18fa561b8eb7d53b015284e0246b2d05953bf281b65269c1fae3d6883530db6

uninstall.sh31 KBsha256:670dce6be818dc4b5f12f729b07324e4f6dfce8973a00a57dae96db90e863b85

Signature

ecdsa-p256-sha256key f1f1eaf642454d65

One signature covers every artifact above. It is made off this host, and neither this site nor the registry behind it can check it — that is the point, and it is why verifying it catches things a checksum from the same server cannot. How to verify it.

Verify devgrail-container (amd64)

curl -fsSL https://web-dev.trixibot.com/api/registry/releases/v0.4.5 -o release.json

# -j, not -r: -r appends a newline the signer never saw, and the check fails.
jq -j '.signature.payload'   release.json > payload
jq -r '.signature.signature' release.json | base64 -d > payload.sig

openssl dgst -sha256 -verify devgrail-release.pem -signature payload.sig payload
# -> Verified OK

# The payload must name this release, so an older signed one cannot be replayed.
head -2 payload

# ...and it must name this exact file. -qxF: whole line, literal.
grep -qxF 'image devgrail-container 13 amd64 fa73a2b12e95522990e8c7142d5f4e194336aa24c35ac59b9483e9fca5d59b5c' payload && echo "digest is covered by the signature"

The signed payload — shown for reading, not for verifying

Copy this from the manifest with jq -j, never from this page: the signature covers exact bytes, and rendering here drops the trailing newline the signer included.

devgrail-release-signature-v1
release v0.4.5
asset docker-compose.yml 12 61ecf9e19a3c6be92a1161c645fa31e0cb16795419b1b2ff84c3fafeeb21f57a
asset install.sh 12 d95f439701a773f6694477fe3d9463ab81484b55aacb391d7094ade7a2f8dca7
asset traefik-dynamic-http.yml 11 e344c8efd13c7d84996e2ebfbc75dcee2d995d8538c8a245c89c0e44fad0089b
asset traefik-dynamic.yml 12 d18fa561b8eb7d53b015284e0246b2d05953bf281b65269c1fae3d6883530db6
asset uninstall.sh 12 670dce6be818dc4b5f12f729b07324e4f6dfce8973a00a57dae96db90e863b85
image devgrail-container 13 amd64 fa73a2b12e95522990e8c7142d5f4e194336aa24c35ac59b9483e9fca5d59b5c
image devgrail-container 13 arm64 79ea60a454390221b22c43f37d3845f90ddbba5271d38d99cd341c88e27833d0
image devgrail-server 13 amd64 f6e54b598081b3d1a4bb13ae3a5631614ad536b7eb93ee760236dd1b63b2e19a
image devgrail-server 13 arm64 26eda5a5f7725b6a72d0bfd73a2799b0dbf8c40a2b7a5775a4cb02ac1f605280