Audit cleanup of CHANGELOG.md accumulated over 43 releases:
- Delete 23 orphaned `[Unreleased]` sections. Release-please does not
consolidate manually-added Unreleased content into the next release, so
each previous contributor's notes were left stranded between release
blocks. The auto-generated release sections above each orphan already
captured the commits.
- Sanitize internal implementation details that should not be in a
public changelog: internal service/class/middleware names, library
names, container file paths, internal endpoint paths, exact rate-limit
thresholds, encryption primitives, and CVE/version-specific remediation
details.
- Normalize tier naming throughout: legacy "Team Pro" / "Personal Pro" /
"Sencho Pro" / "(Pro)" references rewritten to "Skipper" / "Admiral" /
"Skipper and Admiral" per current product tiering.
- Deduplicate the v0.39.0 bulk dump and other sections where
release-please swept the same commit subjects in multiple times.
- Rewrite the v0.1.0 section from a raw engineering log (with file
paths, attack payloads, and internal module names) into user-facing
release notes organised by Security / Added / Fixed / Changed /
Removed.
- Update CONTRIBUTING.md to tell contributors not to edit CHANGELOG.md
directly, matching the actual release-please flow. This is the root
cause that created the 23 orphan Unreleased sections in the first
place.
Verification:
- `## [Unreleased]` count: 0
- Legacy tier name count: 0
- Internal service/library name count: 0
- CVE IDs: 0
- File shrunk from 1,599 to 901 lines
Every filesystem operation against user compose folders (save, create,
deploy, update, rollback, template install, fleet snapshot restore)
previously failed with EACCES whenever a stack container had chowned
its own bind mount to another UID, which is extremely common with
linuxserver/* images and anything that runs as root by default.
Running Sencho as root eliminates the entire class of permission bugs
at the source and matches the default posture of Portainer, Dockge,
Komodo, and Yacht. Mounting /var/run/docker.sock is already equivalent
to root-on-host, so the previous non-root hardening provided essentially
no additional isolation while breaking real features.
Changes:
- docker-entrypoint.sh: default path stays root, no GID dance, no
privilege drop. Opt-out via SENCHO_USER=sencho restores the legacy
behavior bit-for-bit (chown data dir, match Docker socket GID,
su-exec to the user). Fails fast if SENCHO_USER names a nonexistent
account. Kubernetes / OpenShift forced-non-root compat preserved via
the existing id -u = 0 guard.
- FileSystemService: delete forceDeleteViaDocker (the ~40-line helper
that shelled out to an alpine container to work around EACCES during
deleteStack) and simplify deleteStack to a single fsPromises.rm call.
Tests updated accordingly.
- Dockerfile: keep the sencho user+group pre-created so the opt-out
path works out of the box; comments updated to document the new
default.
- Docs: new "Container user" section in configuration.mdx documenting
the root default and the SENCHO_USER opt-out; troubleshooting and
self-hosting updated to match.
The Skipper/Admiral atomic deploy/update path used to create
.sencho-backup/ inside the user's stack folder, which silently failed
with EACCES whenever a container had chowned the bind mount (swag,
tautulli, linuxserver/* images, etc). That broke auto-rollback and the
manual rollback endpoint for those stacks. Stack backups now live under
<DATA_DIR>/backups/<stackName>/ next to sencho.db, which is always
writable by the Sencho user.
While stress-testing the same scenario, MonitorService also flooded the
error log with "Error parsing stats for container ... 404 no such
container" because per-container stats polls (30s tick) raced with
docker compose recreating containers. The 404 case is now skipped
silently; non-404 stats failures still log at error level.
sencho-quartermaster[bot]