Upgrading
Releases
Casvisor is released by pushing a version tag such as v1.110.0. Each release appears on GitHub Releases and as Docker images:
| Image | Contents |
|---|---|
casbin/casvisor | Casvisor alone |
casbin/casvisor-all-in-one | Casvisor with MariaDB and guacd |
Both are tagged with the version, for example v1.110.0, and latest follows the newest release. Pin a version in production and move it forward on purpose.
Upgrading the Docker image
docker pull casbin/casvisor-all-in-one:<version>
docker rm -f casvisor
docker run -d --name casvisor -p 19000:19000 \
-v "$PWD/app.conf:/conf/app.conf" \
-v casvisor-db:/var/lib/mysql \
casbin/casvisor-all-in-one:<version>With the all-in-one image the database is inside the casvisor-db volume; without that volume, replacing the container loses it. Open sessions are cut off when the old container stops, and people sign in again if sessions are kept as files rather than in Redis.
The database
At start, Casvisor creates any table or column the new version needs. It does not drop anything: tables and columns that a newer version no longer uses stay in the database, untouched. Back the database up before upgrading across many versions, so that you can go back.
From versions before v1.107.0
Casvisor changed a lot in October 2026, when it was narrowed down to a bastion host:
- v1.107.0 removed the Machines and Providers pages, the cloud sync behind them, and writing logs to a blockchain. The old
machineandprovidertables stay in the database and can be dropped once you no longer need them. An asset now holds its own protocol, host, port and account, so assets made for the old machine-based connection have to be filled in again before they connect. - v1.108.0 connects SSH and VNC natively instead of through guacd.
- v1.109.0 added permissions. Users who are not administrators can reach nothing until permissions are created for them.
- After v1.109.0, RDP connects natively as well, so guacd is only needed for Telnet.
Behind a reverse proxy
Put Casvisor behind nginx or another reverse proxy for HTTPS: pass WebSockets through for the connections, keep long timeouts, and set X-Forwarded-For so permissions see the real client IP.
Roadmap
What is being built next in Casvisor: certificates from configuration, an encrypted credential vault, connections from native SSH clients, session recording and playback, then database, Kubernetes and access requests.