Updates & Rollbacks

The update and rollback model is the same for Compose and Kubernetes: change the pinned image tag and roll the stack.

Updating

1. Change the pinned image tag in your deployment repo (or set Q15_IMAGE_TAG for Compose).
2. Roll the stack — Kubernetes rollout or docker compose up -d for Compose.
3. Preserve existing persistent storage for /workspace, /memory, /skills, /nix, and /var/lib/q15/proxy.

Rolling back

1. Restore the previous pinned sha-<short-sha> tag across all three services.
2. Roll the stack back.
3. Persistent storage is preserved during normal upgrades and downgrades.

Note

If release tags are added later, treat them the same way as sha-* tags: pin one immutable tag across the full stack and keep rollback history in the deployment repo.

Image tag guidance

Tag	Use case
sha-<short-sha>	Recommended for production. Pin one immutable tag across all three services.
main	Moving integration tag. Use for fast-moving or development consumption only.

GHCR images

Runtime services are published as OCI images to GHCR on verified pushes to main:

• ghcr.io/q15co/q15-agent
• ghcr.io/q15co/q15-exec
• ghcr.io/q15co/q15-proxy

Images are publicly pullable without registry auth for ordinary self-hosted consumption.

q15-auth releases

q15-auth is published separately as GitHub Release archives on pushed tags matching v*, after the tagged commit passes verification and is confirmed reachable from main:

• q15-auth_<version>_linux_amd64.tar.gz
• q15-auth_<version>_linux_arm64.tar.gz
• q15-auth_<version>_darwin_amd64.tar.gz
• q15-auth_<version>_darwin_arm64.tar.gz
• checksums.txt