51 Releases 272 Tags

RSS Feed

• v32.12.0 ed9f0e6bba

  Compare

  Onebox v32.12.0 Stable

  jkunz released this 2026-09-25 15:04:43 +00:00 | 6 commits to main since this release

  2026-09-25 - 32.12.0

  Features

  • Make the SMB storage target password write-only instead of storing and returning it in the clear. The password is no longer part of the target configuration: it is set with the new setStorageTargetPassword request, stored with Onebox's credential encryption, and every response reports only passwordSet. getStorageConfig and upsertStorageTarget return no password, the settings dialog no longer pre-fills it, and a configuration that still contains one is refused. Changing an SMB target's server, share or kind removes the stored password.
  • Give every volume on an NFS or SMB target an explicit subPath below the target's root. The data version moves to 0.25.0 through the step storage-target-credentials, which encrypts stored SMB passwords, rewrites every existing network volume to subPath: "." (the root it already mounts, so no data moves), and removes credential elements from other stored volume options. A request may name another subPath, which must exist on the export; a volume keeps its subPath across updates. Restoring a backup from an earlier release drops the mount options it recorded for such a volume. The step is one-way: Onebox releases up to 32.11.0 know data versions only up to 0.24.0 and refuse a 0.25.0 ledger by name, so going back to 32.11.0 after the upgrade needs a database copy taken before it; without one, recovery is forward-only.

  Fixes

  • Stop copying a volume's resolved mount options onto the service record. A volume on an NFS or SMB target is stored as its storage class and subPath; its mount, with the decrypted password, is composed only when Onebox creates the runtime. Onebox creates such a Docker volume before the runtime and mounts it by name, so container and Swarm service specifications no longer carry the password. Docker's local volume driver keeps it in the volume's options: it mounts with mount(2), and the kernel ignores credentials=, so there is no credentials file it can read instead.
  • Refuse storage target values that could add mount options. The server, username, domain, password and every option value of an NFS or SMB target are refused when they contain a comma or a control character, option keys are limited to letters, digits, dots, dashes and underscores, and options may not restate the address, version or identity the target states. Refusals are reported as storage-target-config-invalid and name the field, never the value. Storage targets now have one typed configuration per kind, and a member the kind does not have is refused.
  • Backups and database copies from earlier releases contain the SMB password in the clear; change it on the SMB server after upgrading and set the new one on the target.

  Downloads

  • onebox-linux-arm64
    1.0 GiB

    2026-09-25 15:20:15 +00:00
  • onebox-linux-x64
    1.0 GiB

    2026-09-25 15:13:19 +00:00
  • serve.zone-onebox-32.12.0.tgz
    12 MiB

    2026-09-25 15:04:53 +00:00
  • SHA256SUMS.txt
    257 B

    2026-09-25 15:20:18 +00:00
  • THIRD_PARTY_NOTICES.md
    43 KiB

    2026-09-25 15:20:17 +00:00
  • Source Code (ZIP)
  • Source Code (TAR.GZ)