v0.4.7

Signedpublished August 18, 2026

What changed

Fixed

Installing with userns-remap enabled left the server crash-looping on unable to open database file (14). With daemon-level userns-remap on, Docker creates new named-volume directories owned by the remapped root (100000:100000), not by 0:0. devgrail-server deliberately opts out of the remap (userns_mode: host, so it is real uid 0) and runs cap_drop: ALL — and root without CAP_DAC_OVERRIDE gets no permission bypass, so it could not write a directory it did not own. Every SQLite open returned SQLITE_CANTOPEN, the server never reached healthy, and install.sh gave up after 180s. A one-shot devgrail-data-init service now chowns the volume to 0:0 before devgrail-server starts (condition: service_completed_successfully), holding only CAP_CHOWN. It re-runs on every compose up, so the fixup is self-healing rather than install-time-only, and is a no-op on a host without remap, where the directory is already 0:0. Only volumes created while remap is active were affected — a fresh install or a reinstall after enabling it.

Container images

devgrail-container

registry build 15

amd64747 MB

sha256:1d8672a3e1dcf83d85ba670e6ff01cf4e3a445234b088ef9a08bf2a2c22f4e4f

Download

arm64621 MB

sha256:0b1f4eae66086445f8088d101177282ef4d8a255a020c9657502d430afe76ec7

Download

devgrail-server

registry build 15

amd6445 MB

sha256:f7a09e32bb991686b4e683a16746ff6c2d62b277281b507bd66fd15e309e5e8d

Download

arm6444 MB

sha256:35d1594e54444818940a70187f83b5f00a4f6433696abab9fb01d439beedc020

Download

Installer files

docker-compose.yml13 KBsha256:bcf8204407e998b2d3a7beddecf741d83446b5d59d152d2a9562450eafb92e99

install.sh118 KBsha256:0778997357114bc291f9f1c05084fa871bc92e2c80723ff9648c9fd13068002c

traefik-dynamic-http.yml5 KBsha256:e344c8efd13c7d84996e2ebfbc75dcee2d995d8538c8a245c89c0e44fad0089b

traefik-dynamic.yml6 KBsha256:d18fa561b8eb7d53b015284e0246b2d05953bf281b65269c1fae3d6883530db6

uninstall.sh31 KBsha256:d8dc586f38e0cf33eadc126d75b303c660e970e55028f60ad4e2872c40cbaa71

Signature

ecdsa-p256-sha256key f1f1eaf642454d65

One signature covers every artifact above. It is made off this host, and neither this site nor the registry behind it can check it — that is the point, and it is why verifying it catches things a checksum from the same server cannot. How to verify it.

Verify devgrail-container (amd64)

curl -fsSL https://web-dev.trixibot.com/api/registry/releases/v0.4.7 -o release.json

# -j, not -r: -r appends a newline the signer never saw, and the check fails.
jq -j '.signature.payload'   release.json > payload
jq -r '.signature.signature' release.json | base64 -d > payload.sig

openssl dgst -sha256 -verify devgrail-release.pem -signature payload.sig payload
# -> Verified OK

# The payload must name this release, so an older signed one cannot be replayed.
head -2 payload

# ...and it must name this exact file. -qxF: whole line, literal.
grep -qxF 'image devgrail-container 15 amd64 1d8672a3e1dcf83d85ba670e6ff01cf4e3a445234b088ef9a08bf2a2c22f4e4f' payload && echo "digest is covered by the signature"

The signed payload — shown for reading, not for verifying

Copy this from the manifest with jq -j, never from this page: the signature covers exact bytes, and rendering here drops the trailing newline the signer included.

devgrail-release-signature-v1
release v0.4.7
asset docker-compose.yml 14 bcf8204407e998b2d3a7beddecf741d83446b5d59d152d2a9562450eafb92e99
asset install.sh 14 0778997357114bc291f9f1c05084fa871bc92e2c80723ff9648c9fd13068002c
asset traefik-dynamic-http.yml 13 e344c8efd13c7d84996e2ebfbc75dcee2d995d8538c8a245c89c0e44fad0089b
asset traefik-dynamic.yml 14 d18fa561b8eb7d53b015284e0246b2d05953bf281b65269c1fae3d6883530db6
asset uninstall.sh 14 d8dc586f38e0cf33eadc126d75b303c660e970e55028f60ad4e2872c40cbaa71
image devgrail-container 15 amd64 1d8672a3e1dcf83d85ba670e6ff01cf4e3a445234b088ef9a08bf2a2c22f4e4f
image devgrail-container 15 arm64 0b1f4eae66086445f8088d101177282ef4d8a255a020c9657502d430afe76ec7
image devgrail-server 15 amd64 f7a09e32bb991686b4e683a16746ff6c2d62b277281b507bd66fd15e309e5e8d
image devgrail-server 15 arm64 35d1594e54444818940a70187f83b5f00a4f6433696abab9fb01d439beedc020