Anso
cd9247db1e
Sencho exits public beta after a clean v0.92.0 QA pass. Replace the global "public beta on the path to v1.0" callout with scoped maturity language across the README, KNOWN_LIMITATIONS, quickstart, troubleshooting, upgrade, and the security-architecture reference. The copy stays honestly pre-1.0 and avoids a blanket "stable" claim. Reframe the Scale limitations to credit QA, audit, and end-to-end validation while keeping the honest caveat that large-scale performance is not yet benchmarked. Fold the new v0.92.0 capabilities into the README sections: Compose Doctor preflight checks, health-gated updates with stalled-update recovery, file move/rename in the explorer, ordered multi-file Compose for Git sources, the Security overview, on-demand node-wide scans, the Compose network inspector with an exposure-intent guard, scan policy packs, documentation-drift flags, and configurable image-update cadence with registry/source links.
3.0 KiB
Known limitations
Note
Sencho is used in production for day-to-day Docker Compose and fleet management. As a pre-1.0 project it still evolves quickly, so review the limitations below and validate against your own setup before deploying it on critical infrastructure.
Below are the limitations we know about today. If you hit something that is not here, please file a bug.
Scale
Sencho's core workflows are validated through QA, repeated security and code audits, and end-to-end journey testing, so day-to-day correctness is well exercised. What is not yet characterized is performance at large scale: the figures below are ranges we have run comfortably, not hard ceilings.
- Single instance: comfortable at typical homelab and small-team loads (tens of stacks and a few hundred containers per node). Very large nodes are not yet benchmarked and may show UI slowdowns.
- Fleet: validated on small fleets (a handful of nodes). Larger fleets work but are less exercised, and fleet-wide operations are not yet benchmarked at scale.
- Container log streaming: handles normal log volumes smoothly. Sustained high log rates are not yet benchmarked, and very chatty containers may lag the UI.
Platform support
- Operating systems: Linux (primary), macOS (development), Windows with WSL2 (development). Production deployments should be on Linux.
- Docker: requires Docker Engine 20.10 or later and Docker Compose v2.
- Browsers: latest two stable versions of Chrome, Firefox, Safari, Edge.
Architecture
- Sencho runs as root inside its container by default. Non-root operation is supported via
SENCHO_USER=senchobut may require adjusting bind-mount ownership. - Mounting
/var/run/docker.sockgrants Sencho root-equivalent privilege on the host. This is the same model as Portainer, Dockge, Komodo, and similar tools. - Plain HTTP works on trusted networks but is not safe to expose to the public internet. Always front Sencho with a TLS-terminating reverse proxy in production.
- Multi-node fleets require either the remote node reaching the primary or the primary reaching the remote, depending on Pilot Agent vs direct proxy mode. Both directions blocked at once is not supported.
- There is no downgrade path between minor versions; back up
/app/databefore upgrading. - Trivy vulnerability scanning requires outbound HTTPS to the Trivy database mirror unless configured for air-gapped operation.
Features
- Mesh networking depends on a shared Docker network alias scheme; it does not currently support overlay networks or Swarm.
- Auto-update applies one image at a time per node; concurrent updates of the same stack are serialized.
- Pilot Agent tunnels have a hard limit of 256 concurrent connections per primary.
- Some features are tier-gated; see pricing.
What we will fix vs document
Items in this file are either (a) on the roadmap, (b) architectural constraints that will not change in 1.x, or (c) documented for awareness because the right fix is a workaround. Each item should say which.