Quick start · Preview · Features · Monitoring · Readiness · Roadmap · Changelog · Support
Important
v2.7.0 is the first public release of Software Release Radar. The application, Docker lifecycle, backup and restore path, automated monitoring, dependency audit, static security gate and clean macOS installation were validated before publication.
Software Release Radar is a self-hosted dashboard for people who run a growing collection of software and want a better way to keep track of updates.
It checks upstream releases, compares them with the versions you run, adds machine and service context, and gives you one place to decide what should be updated, delayed, ignored or investigated.
|
The application is written in Python 3.13 and served through Gunicorn. |
Docker Compose is the primary deployment path. Host Python is not required for the recommended first run. |
Core monitoring is deterministic. AI can help interpret release notes when wanted. |
Imagine you run 20 or 30 apps at home, in a homelab, or on your own servers.
Each app gets updates at different times. Without a tool like this, you may need to visit several websites, remember what version you installed, read release notes, work out which server runs each app, and decide whether the update is worth doing.
Software Release Radar handles the repetitive tracking so you can focus on the decision.
Software you run
│
▼
Check official upstream releases
│
▼
Compare latest version with your version
│
▼
Add machine, container and health context
│
▼
Put the result in one review queue
│
├── Update
├── Wait
├── Ignore
└── Investigate
Note
Release Radar is not an unattended production updater. It is designed to improve the information available before you make a change.
- Docker Engine or Docker Desktop
- Docker Compose v2
- Git
git clone https://github.com/muhdusama/Software-Release-Radar.git
cd Software-Release-Radar
bash scripts/setup.shThe setup helper asks for the first administrator account, generates secure application secrets inside a temporary Docker container, writes a protected .env, builds the stack, starts all services and waits for the application to report healthy.
Then open:
http://localhost:9120
The administrator password itself is not written to .env.
Read docs/DOCKER.md before exposing Release Radar beyond a trusted network.
The following visuals use neutral demo data and contain no private production information.
| Area | Capability |
|---|---|
| 📡 Release tracking | GitHub releases, prereleases and latest tags |
| ⏱️ Automatic monitoring | Scheduler checks only trackers whose individual refresh interval is due |
| 🔢 Version awareness | Installed, detected and upstream version comparison |
| 🖥️ Fleet inventory | Machine, service, container, folder, port and health context with editable display names |
| 🐳 Portainer or Dockhand | Inventory and source-name synchronisation with local aliases and resilient container rebinding |
| ✅ Review workflow | Update, Wait, Ignore, Deployed and Needs Attention decisions |
| 🩺 Diagnostics | Separates real updates from checker failures and unavailable comparisons |
| 🔔 Notifications | System-wide, personal, channel and per-software controls for SMTP email and Pushover |
| 🧠 Optional AI | OpenAI-compatible release comparison and tracker chat |
| 👥 Multi-user | Administrator and standard-user roles |
| 💾 Data safety | SQLite WAL mode, online backup helper and guarded restore helper |
| 📦 Deployment | Docker Compose with persistent state |
- Track stable releases, prereleases or latest tags.
- Set a refresh interval per software package.
- Compare upstream releases with installed or detected versions.
- Keep checker failures separate from confirmed updates.
- Handle version schemes that need deterministic normalisation.
- Associate software with machines and services.
- Record host, port, health and Docker container context.
- Group services by machine.
- Surface online, offline, update and needs-attention states.
- Search and filter larger inventories.
- Edit machine, software and stack or folder display names directly from Fleet.
- Follow renamed inventory-provider environments and services automatically while preserving deliberate local aliases.
Release Radar can discover Docker environments and containers from Portainer or Dockhand. Select a provider under Settings, save its encrypted API credential, test the connection, then synchronise from Inventory. Existing Portainer installations remain selected after upgrade.
Dockhand synchronisation verifies each environment before accepting an empty container list. Offline environments keep their last-known inventory. See docs/CONFIGURATION.md for token setup and the current Dockhand API limitation.
Release Radar provides an operational review queue rather than an unattended updater. A release can carry priority, risk, maintenance timing, notes, rollback context and deployment history.
An OpenAI-compatible endpoint can be used for release-note analysis and tracker chat. Core release checking, scheduling, probing, version comparison and standard notifications do not require an AI model.
The Notifications page separates password-recovery email from release alerts. An administrator can pause release notifications system-wide, each user can choose a personal default and delivery channels, and individual software trackers can inherit that default, always notify, or remain muted. Muted releases are recorded as skipped so turning alerts back on does not send an unexpected backlog.
The standard Docker stack contains three long-running services:
Browser
│
▼
Web application ───────────────┐
│ │
├── SQLite state │
├── GitHub release API │ shared application data
├── optional inventory provider │
└── optional AI │
│
Scheduler ─────────────────────┤
│ │
└── checks due trackers │
│
Inventory worker ──────────────┘
└── background inventory jobs
The scheduler wakes every 60 seconds by default. It does not check every tracker every minute. Each tracker keeps its own refresh interval, and only due trackers are checked.
Automatic monitoring therefore works out of the box without an external cron job.
Create a verified online SQLite backup:
./scripts/backup.shRestore a verified backup:
bash scripts/restore.sh ./backups/radar-YYYYMMDD-HHMMSS.db --confirmThe backup helper uses SQLite's online backup API and runs PRAGMA integrity_check.
The restore helper validates the requested backup, creates a fresh pre-restore safety backup, stops database writers, restores through a narrowly scoped maintenance container, returns ownership to the non-root application user, validates the restored database and confirms that the full stack returns healthy.
See docs/DOCKER.md for the full operational procedure.
The v2.8.0 release includes:
- CSRF protection on state-changing browser routes;
- HTTP-only, same-site session cookies;
- optional secure-only session cookies for HTTPS deployments;
- generated application secrets;
- Fernet encryption for stored integration secrets;
- shared login and password-reset throttling;
- security response headers;
- TLS verification enabled by default for inventory providers;
- proxy forwarding headers disabled unless explicitly enabled;
- OpenAI-compatible endpoints restricted to complete HTTP or HTTPS URLs without embedded credentials;
- a non-root application container user;
- strict SSH host-key checking for optional Docker probes;
- fixed remote Docker inspection rather than arbitrary remote shell execution;
- blocking dependency vulnerability auditing with
pip-audit; and - a reviewed Bandit static-analysis gate in CI.
Security vulnerabilities should not be posted in public issues. Follow SECURITY.md.
For production hardening guidance, see docs/SECURITY-HARDENING.md.
The release candidate is tested as a complete lifecycle, not only as a Docker image build.
| Gate | v2.8.0 status |
|---|---|
| Python compilation and complete automated test suite | ✅ Passed |
| Dependency vulnerability audit | ✅ Passed |
| Reviewed Bandit security gate | ✅ Passed |
| Real public first-run setup on a clean Linux runner | ✅ Passed |
| Web health and login-page acceptance | ✅ Passed |
| Automatic scheduler remains running | ✅ Passed |
| Inventory worker remains running | ✅ Passed |
| Online SQLite backup and integrity check | ✅ Passed |
| Guarded restore and return to healthy state | ✅ Passed |
| Persistent state after Compose restart | ✅ Passed |
| Clean macOS Docker Desktop acceptance | ✅ Passed |
| Visual review of clean deployment | ✅ Passed |
| Final privacy and secret scan after version freeze | ✅ Passed |
| Clean public Git root | ✅ Passed |
| GitHub safety settings and final launch review | ✅ Passed |
The public release is published from a sanitised clean Git history, and the same automated lifecycle gates continue to run on repository changes.
See ROADMAP.md for the final launch checklist.
Software Release Radar is very much a vibe-coded project.
I am not a software developer. I started building this because I had a practical problem in my own self-hosted setup and wanted a better way to solve it.
I have used OpenAI Codex heavily to help design, write, refactor, test and document the project. I set the direction, decide what the application should do, test it in a real environment, review the results and make the final call on changes.
I am being open about this because contributors should know how the project came together. There may be places where an experienced developer would choose a cleaner pattern or spot something that I missed. If you find one, please open an issue or pull request.
|
Product decisions, priorities and release decisions stay human-led. |
Codex has been used extensively for implementation, testing, refactoring and documentation. |
AI-generated code is not treated as reviewed simply because a tool produced it. Tests and release gates still apply. |
| Contributor | Role |
|---|---|
| @muhdusama | Creator and maintainer. Product direction, feature decisions, real-world testing and release decisions. |
| OpenAI Codex | AI coding contributor. Implementation, refactoring, tests, debugging, documentation and code review assistance. |
Codex is an AI coding tool rather than a conventional GitHub contributor account. GitHub's contributor graph is based on commit authorship, so Codex may not appear there as a separate account.
See CONTRIBUTORS.md for more detail.
Once the repository is public:
- propose a feature using the structured feature request form;
- vote with a 👍 reaction on requests that would help you;
- strong candidates can move into a roadmap poll for direct comparison; and
- results help guide priority alongside security, reliability and maintenance effort.
📊 Read how feature voting works • 🗺️ View the roadmap
Software Release Radar is licensed under the GNU Affero General Public License v3.0 (AGPL-3.0).
AGPL-3.0 permits use, modification, distribution and commercial use while applying strong copyleft requirements. Covered modifications and derivative works must remain under AGPL-3.0. If a modified version is provided to users over a network, those users must be offered access to the corresponding source code under the licence.
Software Release Radar is a side project I am building and maintaining while I look for my next role. If it saves you time or is useful in your environment, any support is appreciated and helps me keep improving it.
Financial support is optional. The project remains available under its open-source licence either way.
| Document | What it is for | |
|---|---|---|
| 🐳 | Docker deployment | Install, back up, restore, upgrade and troubleshoot |
| ⚙️ | Configuration | Environment variables and optional integrations |
| 🔔 | Notification controls | Global, personal, channel and per-software alert policy |
| 🏗️ | Architecture | Runtime services, data flow and design boundaries |
| 🔐 | Security hardening | Production deployment checklist |
| 🗺️ | Roadmap | Launch gates and future direction |
| 📜 | Changelog | Release history |
| 🗳️ | Feature voting | How feature requests and roadmap polls work |
| 🤝 | Contributing | Contribution and validation workflow |
| 🛡️ | Security policy | How to report vulnerabilities |
| ☕ | Support | Project support and funding options |
Track releases. Compare versions. Know what changed.