v0.4.50
Signedpublished October 1, 2026What changed
-
Containers are now called workspaces throughout the dashboard. The sidebar entry, the list, the create page and every page that mentions one say workspace, and the pages have moved from
/containersto/workspaces. Old links and bookmarks still work: they forward to the same page, tab included. Container is kept where it means the Docker container a workspace runs in, which a snapshot restore can replace while the workspace stays. The Workspaces page forgets whether you chose the grid or the list once, after the upgrade, and the Terminal tab forgets which terminals you had tiled in its grid; the terminals themselves keep running. -
Breaking: the API says workspace too. Every
/api/v1/containers…path is now/api/v1/workspaces…, and/api/v1/admin/container-domainsis/api/v1/admin/workspace-domains. The old paths are gone rather than aliased. Schemas and operation IDs follow (WorkspaceResponse,CreateWorkspaceRequest,listWorkspaces, …), and so do the fields that name a workspace:container_idisworkspace_id,container_nameisworkspace_name, andattached_container_*andsource_container_*areattached_workspace_*andsource_workspace_*. An API-key grant on a workspace hasresource_typeworkspace, notcontainer. Automations have acreate_workspaceaction (wascreate_container), aworkspaceparameter type, and aworkspace_idfield onrun_scriptandcreate_api_keysteps. Keys, saved automations and automation history are moved onto the new names when the server upgrades. Error messages follow: "workspace is not running", "workspace is delete-locked". -
Breaking: so do the MCP tools. The fourteen tools named after containers are named after workspaces:
list_workspaces,get_workspace,get_workspace_logs,create_workspace,update_workspace,delete_workspace,start_workspace,stop_workspace,restart_workspace,list_project_workspaces,add_workspace_to_project,remove_workspace_from_project,add_workspace_subdomainandremove_workspace_subdomain, in a tool group calledworkspaces. Arguments and results follow:container_idisworkspace_id,source_container_idissource_workspace_id, andlist_workspacesreturnsworkspaces. Keys granted the old tools, and automations that list them for a new key, are moved onto the new names when the server upgrades. A Claude.ai connector sees a new tool list and asks again before using the renamed tools. -
Breaking: a workspace's id is in
DEVGRAIL_WORKSPACE_ID. New workspaces, and any workspace a snapshot is restored onto, getDEVGRAIL_WORKSPACE_IDinstead ofDEVGRAIL_CONTAINER_ID. A workspace whose container was created before this release keeps the old variable until then, because a running container's environment cannot be changed; the instructions file DevGrail writes into it states the id either way. The agent-instructions placeholder is{{DEVGRAIL_WORKSPACE_ID}}: saved instructions are moved onto it when the server upgrades, and{{DEVGRAIL_CONTAINER_ID}}still renders. -
The database says workspace as well: the
containerstable isworkspaces,container_domains,container_snapshotsandcontainer_subdomainsareworkspace_domains,workspace_snapshotsandworkspace_subdomains, and everycontainer_idcolumn isworkspace_id. The tables are renamed in place when the server upgrades; no data is copied. This matters only if you query the SQLite file yourself. A backup taken after the upgrade restores only onto this release or a later one, as with any schema change. -
The server log says workspace too: a log line about a workspace names it under
workspaceorworkspace_id, notcontainerorcontainer_id. This matters only if you filter the server's logs by those keys. -
The MCP server now gives agents instructions when they connect: what a workspace is, and that
/workspaceis a directory inside one. The tool descriptions and the instructions DevGrail writes into each workspace say workspace too, so asking an agent for "the test workspace" no longer sends it searching/workspacefor files. Each workspace'sdashboard_urlnow points at/workspaces/<id>. -
The create page no longer says a volume lets a workspace be "recreated", or that an ephemeral workspace loses its files when recreated for a new image. Recreating was replaced by restoring a snapshot onto the current image. An ephemeral workspace's
/workspacegoes into its snapshots and is replaced when one is restored over it. -
Opening several terminals in a workspace now connects each pane to its own session. Before, every pane could display and control the same session.
-
sudo devgrail passwdandsudo devgrail add-userkeep spaces at the start or end of a password. Before, they dropped them, so the password saved was not the one you typed and you could not log in with it. A password set that way before this release still works without those spaces. -
Both commands also take the password from a pipe, so a provisioning script can run them:
printf '%s\n' "$PASSWORD" | sudo devgrail add-user alice. At a terminal they prompt twice as before. -
Secret names are limited to 64 characters, as the API reference always said. Before, the dashboard and the API accepted longer names and only the MCP tools refused them. A secret that already has a longer name keeps it, and you can still change its value without renaming it.
-
Creating a workspace with a launch script whose parameters are missing or wrong no longer leaves an unused volume behind. The volume was made before the parameters were checked, and was not removed when they failed. Volumes left this way by earlier versions are listed under the Volumes tab of the Containers page, where you can delete them.
-
A project's name and description are saved the same way wherever they come from: spaces at the start and end are dropped, and the documentation is kept exactly as written. Before, the dashboard kept spaces around a description, and a project an agent created lost the indentation at the start of its documentation, which could break a Markdown code block.
-
When the server cannot reach Docker, the System page and the Orphaned networks page load again: the one shows what it can, the other says Docker is unavailable. Before, the server dropped both requests without an answer, so the pages showed an error.
-
A folder or multi-file download that breaks partway through, for example because the workspace stopped, now shows as failed in the browser. Before, it could look finished and leave a zip that would not open.
-
The dashboard, the guides and the built-in agent skills now talk about Antigravity CLI (
agy) rather than Gemini CLI, which workspaces stopped shipping in v0.4.40. An agent helping you set up Antigravity is pointed at the Antigravity scripts, its sign-in token andagy mcp add, instead of atgeminicommands that no longer exist in a current workspace.
Container images
Installer files
Signature
One signature covers every artifact above. It is made off this host, and neither this site nor the registry behind it can check it — that is the point, and it is why verifying it catches things a checksum from the same server cannot. How to verify it.
curl -fsSL https://web-dev.trixibot.com/api/registry/releases/v0.4.50 -o release.json
# -j, not -r: -r appends a newline the signer never saw, and the check fails.
jq -j '.signature.payload' release.json > payload
jq -r '.signature.signature' release.json | base64 -d > payload.sig
openssl dgst -sha256 -verify devgrail-release.pem -signature payload.sig payload
# -> Verified OK
# The payload must name this release, so an older signed one cannot be replayed.
head -2 payload
# ...and it must name this exact file. -qxF: whole line, literal.
grep -qxF 'image devgrail-container 37 amd64 3e6698c4b5051ffde7bd54564bd20b1f8ff24037169c2f64185b0438e9ef24b3' payload && echo "digest is covered by the signature"The signed payload — shown for reading, not for verifying
Copy this from the manifest with jq -j, never from this page: the signature covers exact bytes, and rendering here drops the trailing newline the signer included.
devgrail-release-signature-v1
release v0.4.50
asset docker-compose.yml 58 54873642ee398b1de1b9e074d88e4a89895a98d0bcc11b055707dfd4b2bc1dad
asset install.sh 58 8f7735149f7ed6b94b2963683b22cb682342527ac0ed207e3dd57dd353f3b3b4
asset traefik-dynamic-http.yml 57 09d88c6184e1b46b8036d79a075df5c058c8a010bce486537398b5d4b6c2936e
asset traefik-dynamic.yml 58 54c85ea3c4bc1e73de71dac019e4242cdfe7320dcd1f1aa17a5d639e4dd325ac
asset uninstall.sh 58 287ed1ff0ece38bd7da9d9b88d67923b48e75b934500900a0905477169a33151
image devgrail-container 37 amd64 3e6698c4b5051ffde7bd54564bd20b1f8ff24037169c2f64185b0438e9ef24b3
image devgrail-container 37 arm64 7af5e5db5fb3e7cb67206bcb4b84e7a71a1301d08f6bb3108b29bd2cde3d59a1
image devgrail-desktop 3 amd64 c57bea7891f59f3734b08a9006aa5410a1e3349e8077e0320ed7c6d50d038584
image devgrail-server 74 amd64 d71a771d79325881f8acb68bd88c52752fa709e80cf1906f67bf84f2d0ab10e3
image devgrail-server 74 arm64 348b25a5f45ea3f39e8797e50229949d009fab70d9c15cde744843d6a54d6a63