Upgrade, repair, uninstall

Everything Sealant needs lives in ~/.sealant: the compose file (compose.yaml), your generated secrets and knobs (.env), and pointers to Docker volumes that hold your data. The installer is idempotent, so the same one-liner both installs and repairs.

Repair the current install

Re-running the installer without SEALANT_VERSION reconciles the install at its currently pinned version. It regenerates the compose file, re-pulls images, re-runs migrations, and restarts the stack. Your generated secrets and your data are never regenerated or lost.

curl -fsSL https://get.sealant.dev | sh

Use this after editing ~/.sealant/.env (for example, to add GitHub App credentials) — it restarts the services with the new environment.

Upgrade to the latest release

Set SEALANT_VERSION=latest to re-resolve GitHub's latest release and move to it:

curl -fsSL https://get.sealant.dev | SEALANT_VERSION=latest sh

Note the placement: the variable must be set on the sh side of the pipe. Prefixed to curl it would apply to the download only and the installer would silently repair the current version instead.

The resolved version is written back to ~/.sealant/.env and pinned there, so subsequent plain re-runs stay on that version until you upgrade again.

Pin an exact version

To install or switch to a specific version — for a reproducible deployment, or to roll back — name it explicitly:

curl -fsSL https://get.sealant.dev | SEALANT_VERSION=0.4.0 sh

The installer requires a running Docker daemon and Docker Compose >= 2.23.1.

Stop without deleting data

To stop the stack but keep your database, registry, and secrets:

docker compose --project-directory ~/.sealant down

Start it again with the installer, or with docker compose --project-directory ~/.sealant up -d.

Logs

Tail everything, or one service:

docker compose --project-directory ~/.sealant logs -f
docker compose --project-directory ~/.sealant logs -f api

Service names are api, worker, web, ssh-gateway, postgres, rabbitmq, and zot (the registry).

Uninstall

down -v stops the stack and deletes the compose volumes — your Postgres data, registry data, and the SSH gateway host key. This is destructive and irreversible.

docker compose --project-directory ~/.sealant down -v && rm -rf ~/.sealant

Caveat: workspace containers outlive uninstall

Workspace containers and images are created by the worker on the host Docker daemon (via the mounted Docker socket), not inside the compose project. Tearing down the compose project with down -v does not remove workspace runtime containers or images that were already built. Clean them up on the host separately, for example:

docker ps -a            # find leftover workspace containers
docker rm -f <container>
docker image prune      # reclaim orphaned workspace images

Workspace control sockets also live on the host at /run/sealant/sockets; remove that directory if you want a fully clean host.

What is and isn't preserved

See Ports and data for the full volume and port map, and Installer and compose for what the one-liner does step by step.