# Teable Platform Release manifest -- one platform version pins the whole
# component set below. Generated by the release pipeline; do not edit by hand.
# Schema: schemas/versions.schema.json. Human-readable copy: VERSIONS.md.
#
# China deployments: every ghcr.io/teableio/ image is mirrored with identical
# tags at registry.cn-shenzhen.aliyuncs.com/teable/ (digests differ per registry; the
# digests below are for the canonical registry shown in each reference).
platformRelease: v2026.11.14
releasedAt: '2026-11-10T07:11:16Z'
components:
  teable:
    image: ghcr.io/teableio/teable:release.2026-11-10T05-38-53Z.3830
    digest: sha256:623dadaeb94f7de141ebdb202138fd185b2611be51e9945f11c4f951356faf68
    architectures:
    - amd64
    - arm64
    note: Stable channel (:latest) resolved to its release tag at generation time;
      beta is the rolling channel.
  teable-sandbox-agent:
    image: ghcr.io/teableio/teable-sandbox-agent
    note: 'Prefix only, no tag: at runtime the app pulls `<prefix>:<its own release
      tag>`, so sandbox hosts need registry access; air-gapped installs mirror the
      tag matching their app release and point the prefix at it.'
  teable-app-runtime:
    image: ghcr.io/teableio/teable-app-runtime:20261102T033513Z
    digest: sha256:d1f1d6f0b5b7e28b3c4f89926e55f0a1eb84e3c34b5eb952db0f5f480e98eb4d
    architectures:
    - amd64
    - arm64
  teable-infra-service:
    image: ghcr.io/teableio/teable-infra-service:20261109T020734Z
    digest: sha256:9d63041b9b9c027322ad0b61029f8d784a32c63623b34c08c0d5851878f7eeea
    architectures:
    - amd64
    - arm64
  opensandbox-server:
    image: ghcr.io/teableio/opensandbox-server:v0.2.0-fix11
    digest: sha256:3fd3e584285edc79850d998e7fcfa5def37dac2b0d40120f73f3d49ef58236e0
    architectures:
    - amd64
    - arm64
    note: 'Patched build: adds the /v1 mount-prefix fix for proxied sandbox endpoints
      (path-proxy mode needs >= fix5), docker-runtime sandbox_env/sandbox_binds for
      private-CA trust (>= fix6), the container-level securityContext backfill plus
      shared-volume subPath pre-creation that unprivileged sandboxes need (>= fix7),
      docker-runtime workspace-directory ownership pre-creation (>= fix8), and setgid/sticky
      bits accepted in the subPath pre-creation dir_mode (>= fix9), and API-key enforcement
      on the sandbox path-proxy routes including WebSocket (>= fix11); upstream does
      not include them yet.'
  opensandbox-ingress:
    image: ghcr.io/teableio/opensandbox-ingress:v1.0.7
    digest: sha256:f67bef778e4c80c7de182f76a213363ba2c5214c323823b364cda859dbd36198
    architectures:
    - amd64
    - arm64
  opensandbox-controller:
    image: ghcr.io/teableio/opensandbox-controller:v0.2.0
    digest: sha256:a9a5f73c1785ebd955336ffa313973a35c1a1b662cb7afc4ea82d92021b3532a
    architectures:
    - amd64
    - arm64
  opensandbox-image-committer:
    image: ghcr.io/teableio/opensandbox-image-committer:v0.1.0
    digest: sha256:d72cce22ff1ea248e86620e945b7cf12615db74c8a8402fcc01dbfa4a09e7442
    architectures:
    - amd64
    - arm64
    note: Also used as the hold container of the app-triggered agent-image preheat
      DaemonSet (created by infra-service at runtime).
  opensandbox-execd:
    image: ghcr.io/teableio/opensandbox-execd:v1.0.19-fix3
    digest: sha256:996e8460bd58ef7fb2680a2884f3a36ddf37755fc819f942b5f70a82b745c11b
    architectures:
    - amd64
    - arm64
    note: 'Patched build: upstream v1.0.19 (the execd release matching server v0.2.0),
      the issue #1064 fix (owner/group on auto-created parent directories) and, from
      fix3, the credential handling an unprivileged sandbox needs (an older execd
      fails every command with `operation not permitted`); injected by the server
      into every sandbox.'
  opensandbox-egress:
    image: ghcr.io/teableio/opensandbox-egress:v1.0.12
    digest: sha256:ddf92e8f303c5715c8bbe8f346af80d7f14efaef6d760add92bf50e558b06c2a
    architectures:
    - amd64
    - arm64
    note: Per-sandbox egress sidecar, started by the server on demand.
  postgres:
    image: postgres:15.4
    digest: sha256:d1168ad5397bf9c94cc417c530469805a8767ed585481d93f174461ac8557e3a
    architectures:
    - amd64
    - arm64
  redis:
    image: redis:7.2.4
    digest: sha256:5a93f6b2e391b78e8bd3f9e7e1e1e06aeb5295043b4703fb88392835cec924a0
    architectures:
    - amd64
    - arm64
  minio:
    image: ghcr.io/teableio/minio:RELEASE.2025-04-22T22-12-26Z
    digest: sha256:a1ea29fa28355559ef137d71fc570e508a214ec84ff8083e39bc5428980b015e
    architectures:
    - amd64
    - arm64
    note: Hosted under ghcr.io/teableio (upstream withdrew its Docker Hub images),
      same digest as the upstream build; pinned by the chart and the Docker defaults.
  minio-mc:
    image: ghcr.io/teableio/minio-mc:RELEASE.2025-04-16T18-13-26Z
    digest: sha256:aead63c77f9db9107f1696fb08ecb0faeda23729cde94b0f663edf4fe09728e3
    architectures:
    - amd64
    - arm64
    note: Bucket-provisioning sidecar for MinIO; pinned alongside it.
  caddy:
    image: caddy:2.9.1
    digest: sha256:748016f285ed8c43a9ce6e3aed6d92d3009d90ca41157950880f40beaf3ff62b
    architectures:
    - amd64
    - arm64
    note: 'Docker entry proxy (official image): used as-is by local mode and by server
      mode with your own certificate (TLS_MODE=static, CADDY_STATIC_IMAGE in .env);
      the automatic-certificate mode builds a Cloudflare DNS-plugin variant on top
      of it locally. Not used on Kubernetes.'
teableCompatibility:
  minRelease: release.2026-07-14T12-24-39Z.2228
  verifiedRelease: release.2026-11-10T05-38-53Z.3830
requiredMigrations: []
migrationCatalog: []
hotSwap: true
verified:
  docker: '2026-07-15'
  kubernetes: '2026-07-15'
  backupRestore: '2026-07-14'