What changed in each release. JEKYO follows semantic versioning; while pre-1.0, minor versions may contain breaking changes.
http.websocket opts a route into WebSocket upgrades. Contour rejects them with a 403 by default; websocket: true annotates the route path, and a list of paths scopes it to specific routes. The setting survives redeploys, unlike annotating the Ingress by hand (#22).logs, exec and attach help text documents the full target grammar: three-segment app/service/container targets and the app/sidecar shorthand.jekyo logs app/name, exec app/name and attach app/name resolve a sidecar by name when no service matches, so the two-segment target works the way ps output suggests it should. Ambiguous names list the full app/service/container paths, and unknown names list every service and sidecar the app has (#21).caps: and security: per init container and per sidecar, overriding the service-level values. The Kubernetes pattern this unlocks: do the privileged setup (NET_ADMIN as root) in an init container that exits, and run the workload unprivileged and non-root. This also sidesteps the execve capability drop that makes service-level caps unusable for shelled-out commands under a non-root run-as (#20).build: exactly like services do; images are tagged <app>/<service>-<sidecar> through the same content-hash pipeline, so jekyo up deploys what is in the repo again (#18).app/service/container targets work in logs, exec and attach; multi-container logs streams every container with a prefix instead of erroring; jekyo ps lists sidecars indented under their parent; jekyo top --json breaks pods down per container; the ui tree shows sidecar rows with their own cpu, memory and restarts (#19).jekyo ui sidebar shows a restart count per service, dim at zero, amber when restarting, red past five.secrets: on a service delivers env values via a Kubernetes Secret and secretKeyRef instead of inline literals, and jekyo render redacts them (#1).files: mounts operator-supplied files: a local path becomes a ConfigMap entry, interpolated content becomes a Secret mounted 0600, both via subPath so directories are not shadowed (#8).init: run-to-completion containers before the service starts, inheriting env, secrets and volumes (#13).sidecars: extra containers in the service's pod, sharing volumes and localhost (#9).network.egress: restricted|internal renders enforced NetworkPolicy presets with CIDR exceptions via allow:; SSRF in an app no longer reaches the cluster or metadata (#5).network.host: true and caps: [NET_ADMIN] for networking workloads (#2).security: run-as, read-only-root, no-new-privileges, with the runtime default seccomp profile (#6).placement: node selectors and tolerations (#11).expose.host: publishes raw TCP/UDP on any conventional host port, not just the NodePort range (#10).stop-grace: sets terminationGracePeriodSeconds (#7).shm: sizes /dev/shm so browser workloads work by default (#3).metrics: renders Prometheus scrape annotations (#12).volumes.<name>.access: rwx for ReadWriteMany claims (#14).health.grace: a startup budget in seconds (default 60).jekyo render fails when build.dockerfile does not exist instead of deferring the error to deploy (#17).jekyo schema agrees with the validator: health.command and the {path, subpath} volume mount form are accepted (#15).jekyo context add <user@host>: adopt a server that already runs JEKYO from any machine. Everything a context needs (IP, domain, storage path, registry credentials, kubeconfig) is discovered from the server itself; no export blob required. The VPN admin password is the one thing that cannot be recovered.jekyo update refreshes the globally installed agent skill after updating, so agents never operate on stale docs.jekyo ls; backup CronJobs keep one successful and two failed jobs of history instead of piling up.jekyo ui or count against the health verdict; failed backups still surface via the freshness line and events.jekyo backup config --local stores restic repositories on the server at /var/lib/jekyo/backups, no S3 account needed. Mount a dedicated disk there for real durability; snapshots, ls, and restore work identically.jekyo ui opens a revision picker: every recorded revision with its age, not just the previous one. Enter confirms.jekyo templates <query> fuzzy-searches the catalog by name and description, ranked, for humans and agents alike.jekyo ui no longer disappears on terminals around 36 rows; the height gate was off by the header's growth.jekyo down on an app without volumes removes it completely instead of leaving a ghost entry in jekyo ls; the closing message now says whether volumes were actually kept.jekyo update verifies downloads against the release's sha256 checksums before installing.jekyo ui crashed on terminals narrower than ~130 columns (negative meter widths). All gauges and graphs now clamp safely, and the brand box steps aside on narrow terminals instead of squeezing the data.jekyo update: self-update to the latest release in place, atomic replace of the running binary (suggests sudo when the install location needs it).jekyo ui header: wordmark, version, an update-available alert pointing at jekyo update, and the motto.jekyo server harden: installs and configures fail2ban (sshd jail, 1h bans) and unattended security updates on the server. One command, idempotent.jekyo ui server box reports whether every volume with a backup: schedule has a recent successful snapshot, red when overdue; jekyo top --json gains a backups array with per-volume age and overdue flags.jekyo ui server box: pending system updates with the security count highlighted, a red reboot-required alert after kernel updates, and failed SSH login attempts from the auth log. All read over SSH, nothing installed on the server.http.redirect: a service with only http: {domain, redirect} is a pure routing rule. The ingress answers with a permanent redirect and the domain keeps automatic TLS; no container runs. www-to-apex redirects no longer need an inline Caddy image.jekyo ui header gains a server box: apps, pods with a health verdict, services, hosted domains, cluster domain, Kubernetes and JEKYO versions. Vitals (temperature, load, API latency, certificate runway) moved to the footer's right side.jekyo top --json gains services and domains counts.jekyo ui: header columns, the metrics strip, and the sidebar no longer share flush borders.jekyo ui header: Kubernetes API latency and days until the nearest TLS certificate expires (red under 14 days) next to the cpu summary, disk read/write rates in the disks box border, and a swap row in the mem box when swap exists.jekyo top --json gains apiLatencyMs and nearestCertExpiryDays, so agents can watch cluster health and certificate runway.jekyo ui layout: service metrics are always visible now. A btop strip (cpu, mem, traffic with braille history and now/peak) sits above the logs pane for whatever is selected; m toggles it, s swaps logs for status. The metrics tab is gone because it no longer needs to exist.jekyo ui header now mirrors btop faithfully: fused superscript box titles, braille density graphs, a mem box built from /proc/meminfo (Total, Used, Available, Cached, Free with meters), disks in two-line-per-filesystem layout, and net with rates plus lifetime totals.jekyo ui: every CPU core with its own gauge in an adaptive grid, package temperature, load average, memory with absolutes, each real filesystem with its own usage bar, and network rates. Read over SSH from /proc, no agent on the server.jekyo ui shows the server's load average and uptime, read over SSH per context (skipped gracefully when SSH is unavailable).jekyo ui opens with the JEKYO logomark splash while the first snapshot loads.jekyo ui icons render in every terminal font. The default set is now plain Unicode; Nerd Font glyphs (which showed as ? without a patched font) moved behind --nerd / JEKYO_NERD=1.jekyo ui visual overhaul: the JEKYO wordmark and a boxed server strip in the header, Nerd Font icons throughout (pass --ascii or set JEKYO_ASCII=1 on terminals without a patched font), a proper tab bar, keycap-style footer, full-width row selection, and clearer confirm and status banners.jekyo ui grew btop-style server gauges (CPU, memory, disk) with history sparklines, live network rates for the whole server, per-service download/upload sparklines in the metrics tab, and volume usage bars in the status tab.jekyo top --json now includes network counters per pod and node, node disk usage, and per-volume usage, all from the kubelet stats API. Diff two snapshots for rates.jekyo top and jekyo ui merged into one dashboard: top in a terminal opens the UI; piped or with --json it prints the snapshot.jekyo --help is organized into groups (Apps, Observe, Operate, Servers & access, Agents & tooling) so the everyday commands stand out and plumbing sinks to the bottom.jekyo ui: an interactive terminal UI in the spirit of lazydocker and btop combined. Left pane navigates apps and services with live status and resource use; right pane tabs between streaming logs, CPU and memory history graphs, and status with recent events; node capacity gauges in the header. One key acts: r restart (with confirm), b rollback, e exec, a attach, q quit.jekyo top: a live btop-style resource dashboard. Per-pod CPU, memory, restarts, and status with usage bars against limits, plus node capacity gauges. jekyo top --json prints one machine-readable snapshot for agents and scripts.jekyo attach: stream a service's main process output live; Ctrl+C detaches without stopping anything. -i forwards stdin.jekyo logs -t/--timestamps prefixes each line with its RFC3339 timestamp.curl -fsSL https://jekyo.com/install | sh, and all documentation links point there.registry.jekyo.local and the in-cluster address.jekyo server install restarts k3s when a converge changes the registry configuration; containerd only reads it at startup.kcert namespace (RBAC denied) and created ACME challenge ingresses with class nginx, which Envoy ignores. First real Let's Encrypt issuance verified end to end.backup: per volume compiles to scheduled restic snapshots on any S3-compatible storage; jekyo backup config, now, ls, and restore (restore stops the app, replaces the volume, restarts).jekyo init prompts for them, --set/--defaults resolve them non-interactively, jekyo templates inspect -o json exposes them to agents. Secrets land in .env, never in jekyo.yaml.jekyo templates.jekyo init: offers a schedule (15m, hourly, daily, weekly, or cron) for every volume a template ships; --backup for automation.schedule: on a service compiles to a CronJob.subpath.health.command alongside HTTP probes.jekyo registry login wires pull secrets automatically.jekyo context export/import for CI and second machines.curl -fsSL https://jekyo.com/install | sh).--internal-domain install flag for a custom cluster DNS suffix.jekyo skill install --global works in every session.jekyo-<app> (grouped and recognizable in kubectl). Apps deployed before 0.2.0 keep working; they adopt the new namespace on their next jekyo up.jekyo render works on apps with build: services.jekyo server install: idempotent preflight-gated installer turning an Ubuntu server into a k3s cluster with Envoy ingress (Contour), automatic TLS (kcert), a private registry, a WireGuard VPN (wg-easy), and NVIDIA GPU support.