Changelog

Fixes and improvements, October

Fixes and smaller improvements shipped in October.

  • Containers on machines with persistent volumes are replaced with their own volume, handed off during machine drain, keep retrying while a volume is still attaching, and grow their filesystem when the disk grows, including on Azure.
  • Machines keep serving traffic through updates: load balancer targets stay healthy during drain and deregistration, rollouts wait for ALB target health, and DNS keeps answering across restarts.
  • A failed machine agent update now rolls back, and heartbeats and exec keep working while an update downloads.
  • AWS compute clusters that hit a capacity shortage keep running instead of failing, scale-in no longer drains healthy machines, and Google Cloud and Azure clusters keep reconciling through shortages.
  • alien destroy finds a deployment by ID or by group and name in the right project, even when it is not tracked locally, and alien deployments delete --forget removes a deployment whose cloud is gone.
  • CLI errors now name each failed resource, show the manager's own error and S3's rejection reason, and report the cause of a failed teardown.
  • --json output and exit behavior are consistent across CLI commands.
  • The CLI prompts for deployer secrets securely, alien vault commands accept deployment IDs and reach the right manager, and deployer secrets moved to the deployment actions menu in the dashboard.
  • Management identities on AWS, Google Cloud, and Azure can no longer read deployment secrets or decrypt with the deployment key, and the Azure management identity can no longer grant itself roles.
  • Alien never adopts or deletes an AWS bucket, build project, or registry role that the deployment did not create, and volume backups only snapshot the stack's own volumes.
  • On Azure, initial setup grants each management role only at the scope it names and covers the permissions needed for scale sets, gateway subnets, public IPs, and disk snapshots.
  • Google Cloud deployments reuse and clean up only their own custom roles, workers on a network without NAT can reach the internet, and Cloud Run IAM and storage lifecycle rules apply correctly.
  • Workers return application HTTP redirects instead of following them, report their URL from the first public endpoint, support custom domains, and renew certificates without a full update.
  • Lambda workers export application logs before the function freezes, and a slow log endpoint no longer delays invocations.
  • Custom domains keep serving the last issued certificate until its replacement is ready, and renewal keeps retrying.
  • Log search supports quoted phrases, runs faster, keeps pagination and the time window stable across pages, and the Logs page shows loading after a filter change and runs one search.
  • The dashboard's deployment and release pages load without layout jumps, show correct compute status and ready-replica counts, hide completed installation panels, and stop rendering after a deployment is deleted.
  • CLI commands copied from the dashboard include the workspace, and the CLI uses the linked project's workspace in a linked directory.
  • CLI sign-in now finish for signed-out users, and approved users land in their workspace after signup.
  • Rerunning initial setup with an older setup link no longer rolls a deployment back, new CloudFormation stacks get unique names, a second stack for the same deployment is refused, CloudFormation stack updates from a rerun can always roll back, and first deployments show initial setup and provisioning progress.
  • Existing Kubernetes deployments keep working across Operator upgrades, Kubernetes quota failures are shown, and teardown removes vault-owned Kubernetes secrets.
  • Air-gapped sites verify downloads reliably, receive configuration changes on the same release, get bundles built for their architecture, and show offline reports in the deployment portal.
  • alien dev passes deploy inputs to the local deployment, recovers interrupted sessions, honors the selected Docker context, and runs local Postgres and non-root containers correctly.
  • Remote Sandboxes honor env and cwd, run commands as the image's non-root user, replace a terminated sandbox in getOrCreate, and keep egress open when one gateway replica stops answering.
  • Transient credential errors are retried instead of failing the deployment, and every service trusts the updated CA bundles.