@naviyra/cloud-panel 0.0.0-stage → 0.0.1

package/bin/naviyra.mjs

@@ -0,0 +1,177 @@
+#!/usr/bin/env node
+import { spawn } from "node:child_process";
+import { cp, readdir, readFile, mkdir, access } from "node:fs/promises";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import path from "node:path";
+
+const source = path.resolve(
+  path.dirname(fileURLToPath(import.meta.url)),
+  "..",
+);
+const skip = new Set([
+  "node_modules",
+  ".next",
+  ".git",
+  ".runtime",
+  "coverage",
+  "test-results",
+  "playwright-report",
+  ".env",
+  ".env.local",
+]);
+
+async function exists(file) {
+  try {
+    await access(file);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function isPanel(dir) {
+  try {
+    const pkg = JSON.parse(
+      await readFile(path.join(dir, "package.json"), "utf8"),
+    );
+    return (
+      pkg.name === "@naviyra/cloud-panel" &&
+      (await exists(path.join(dir, "apps", "panel", "package.json")))
+    );
+  } catch {
+    return false;
+  }
+}
+async function isEmpty(dir) {
+  try {
+    const entries = await readdir(dir);
+    return entries.length === 0;
+  } catch (error) {
+    if (error.code === "ENOENT") return true;
+    throw error;
+  }
+}
+async function copyTree(from, to) {
+  await mkdir(to, { recursive: true });
+  for (const entry of await readdir(from, { withFileTypes: true })) {
+    if (skip.has(entry.name) || entry.name.endsWith(".log")) continue;
+    const src = path.join(from, entry.name);
+    const dest = path.join(to, entry.name);
+    if (entry.isDirectory()) await copyTree(src, dest);
+    else if (entry.isFile()) await cp(src, dest);
+  }
+}
+function run(command, args, cwd) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(command, args, {
+      cwd,
+      stdio: "inherit",
+      shell: process.platform === "win32" && command === "npm",
+      windowsHide: true,
+    });
+    child.once("error", reject);
+    child.once("exit", (code) =>
+      code === 0 ? resolve() : reject(Error(`${command} exited ${code}`)),
+    );
+  });
+}
+function start(cwd, args) {
+  const child = spawn(process.execPath, ["scripts/start-naviyra.mjs", ...args], {
+    cwd,
+    stdio: "inherit",
+    windowsHide: true,
+  });
+  child.once("error", (error) => {
+    console.error(`Could not start Naviyra: ${error.message}`);
+    process.exitCode = 1;
+  });
+  child.once("exit", (code, signal) => {
+    process.exit(code ?? (signal ? 1 : 0));
+  });
+}
+
+async function enableBackground(target) {
+  if (process.platform !== "win32" || process.env.NAVIYRA_SKIP_SERVICE === "1")
+    return null;
+  const registrar = path.join(target, "scripts", "windows-boot.mjs");
+  if (!(await exists(registrar))) return null;
+  try {
+    const boot = await import(pathToFileURL(registrar).href);
+    const installed = await boot.installBootTask({ root: target });
+    if (!installed.ok) {
+      console.error(
+        `Could not register the Windows startup task. ${installed.message}`,
+      );
+      return null;
+    }
+    console.log(installed.message);
+    const started = await boot.startBootTask();
+    if (!started.ok) {
+      if (started.message) console.error(started.message);
+      return null;
+    }
+    return boot;
+  } catch (error) {
+    console.error(
+      `Could not register the Windows startup task. ${error.message}`,
+    );
+    return null;
+  }
+}
+
+const cwd = process.cwd();
+try {
+  const args = process.argv.slice(2);
+  for (const arg of args)
+    if (!["--help", "-h", "--install-only", "--no-browser"].includes(arg))
+      throw Error(`Unknown option: ${arg}. Run with --help for usage.`);
+  if (args.includes("--help") || args.includes("-h")) {
+    console.log(`Usage: npx @naviyra/cloud-panel [--install-only] [--no-browser]
+
+Installs into the current empty folder, or a naviyra subfolder.
+In a terminal, asks for the administrator email, password, and agent port.
+On Windows, also registers a scheduled task that keeps the panel running
+and restarts it if it stops. The task uses the account that runs the
+installer, starts again at the next sign-in, and starts at boot when the
+installer itself is elevated.
+--install-only  Install, register the startup task, and leave it running.
+--no-browser    Do not open a browser after the panel is ready.
+
+Startup requires PostgreSQL and the private runtime's OS prerequisites.
+See docs/managed-runtime.md in the installed folder.`);
+    process.exit(0);
+  }
+  let target = cwd;
+  if (path.resolve(cwd) !== source && !(await isPanel(cwd))) {
+    if (!(await isEmpty(cwd))) {
+      target = path.join(cwd, "naviyra");
+      if (!(await isPanel(target)) && !(await isEmpty(target)))
+        throw Error(
+          "This folder is not empty. Run npx @naviyra/cloud-panel in an empty folder.",
+        );
+    }
+    if (!(await isPanel(target))) {
+      console.log(`Installing Naviyra into ${target}`);
+      await copyTree(source, target);
+    }
+  }
+  // Always let npm validate the complete workspace. A failed install may have
+  // created pg already while leaving Next.js or the agent dependencies missing.
+  console.log("Checking and installing dependencies…");
+  await run("npm", ["install", "--omit=dev"], target);
+  await run(process.execPath, ["scripts/setup-local.mjs"], target);
+  const background = await enableBackground(target);
+  if (background) {
+    console.log(
+      "Naviyra will keep running in the background. Stop it with: node scripts/windows-boot.mjs stop",
+    );
+    if (!args.includes("--install-only") && !args.includes("--no-browser"))
+      await background.openPanelWhenReady(target);
+  } else if (args.includes("--install-only")) {
+    console.log(`Naviyra installed in ${target}. Run npm run services:start there to start it.`);
+  } else {
+    start(target, args.filter((arg) => arg === "--no-browser"));
+  }
+} catch (error) {
+  console.error(error.message);
+  process.exit(1);
+}

package/db/001_init.sql

@@ -0,0 +1,28 @@
+CREATE TABLE IF NOT EXISTS users (
+ id uuid PRIMARY KEY, email text NOT NULL UNIQUE, password_hash text NOT NULL,
+ role text NOT NULL DEFAULT 'user' CHECK (role IN ('admin','user')), created_at timestamptz NOT NULL DEFAULT now()
+);
+CREATE TABLE IF NOT EXISTS agents (
+ id uuid PRIMARY KEY, name text NOT NULL UNIQUE, token_hash text NOT NULL, last_seen timestamptz
+);
+CREATE TABLE IF NOT EXISTS projects (
+ id uuid PRIMARY KEY, user_id uuid NOT NULL REFERENCES users(id), agent_id uuid NOT NULL REFERENCES agents(id),
+ name text NOT NULL UNIQUE, type text NOT NULL DEFAULT 'nodejs' CHECK(type='nodejs'), subdomain text NOT NULL UNIQUE,
+ port integer UNIQUE, status text NOT NULL DEFAULT 'created', folder_path text,
+ source_type text NOT NULL CHECK(source_type IN ('zip','git')), git_url text NOT NULL DEFAULT '',
+ created_at timestamptz NOT NULL DEFAULT now(), updated_at timestamptz NOT NULL DEFAULT now()
+);
+CREATE TABLE IF NOT EXISTS tunnels (
+ project_id uuid PRIMARY KEY REFERENCES projects(id) ON DELETE CASCADE,
+ tunnel_id text NOT NULL, tunnel_name text NOT NULL, credentials_path text, config_path text
+);
+CREATE TABLE IF NOT EXISTS deployments (
+ id uuid PRIMARY KEY, project_id uuid NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+ status text NOT NULL, source_type text NOT NULL, logs_ref text, error text,
+ created_at timestamptz NOT NULL DEFAULT now(), finished_at timestamptz
+);
+CREATE UNIQUE INDEX IF NOT EXISTS one_active_deployment ON deployments(project_id) WHERE status IN ('queued','deploying');
+CREATE TABLE IF NOT EXISTS audit_logs (
+ id bigserial PRIMARY KEY, user_id uuid REFERENCES users(id), project_id uuid,
+ action text NOT NULL, created_at timestamptz NOT NULL DEFAULT now()
+);

package/db/002_native_runtimes.sql

@@ -0,0 +1,3 @@
+ALTER TABLE projects DROP CONSTRAINT IF EXISTS projects_type_check;
+ALTER TABLE projects ADD CONSTRAINT projects_type_check CHECK(type IN ('nodejs','python','php','go','static','custom'));
+ALTER TABLE projects ADD COLUMN IF NOT EXISTS runtime_config jsonb NOT NULL DEFAULT '{}';

package/db/003_databases.sql

@@ -0,0 +1,8 @@
+CREATE TABLE IF NOT EXISTS app_databases (
+  id uuid PRIMARY KEY,
+  user_id uuid NOT NULL REFERENCES users(id),
+  name text NOT NULL UNIQUE,
+  db_name text NOT NULL UNIQUE,
+  db_user text NOT NULL UNIQUE,
+  created_at timestamptz NOT NULL DEFAULT now()
+);

package/db/004_database_engines.sql

@@ -0,0 +1,4 @@
+ALTER TABLE app_databases ADD COLUMN IF NOT EXISTS engine text NOT NULL DEFAULT 'postgresql';
+ALTER TABLE app_databases ADD COLUMN IF NOT EXISTS runtime_id text;
+ALTER TABLE app_databases ADD COLUMN IF NOT EXISTS host text;
+ALTER TABLE app_databases ADD COLUMN IF NOT EXISTS port integer;

package/deploy/naviyra-agent.service

@@ -0,0 +1,17 @@
+[Unit]
+Description=Naviyra Host Agent
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/naviyra-panel
+EnvironmentFile=/opt/naviyra-panel/.env
+ExecStart=/usr/bin/node /opt/naviyra-panel/apps/agent/src/server.mjs
+Restart=on-failure
+RestartSec=5
+UMask=0077
+
+[Install]
+WantedBy=multi-user.target

package/docker-compose.yml

@@ -0,0 +1,18 @@
+services:
+  postgres:
+    image: postgres:17-alpine
+    environment:
+      POSTGRES_USER: naviyra
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-naviyra}
+      POSTGRES_DB: naviyra
+    ports:
+      - "127.0.0.1:${POSTGRES_PORT:-55432}:5432"
+    volumes:
+      - postgres_data:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U naviyra"]
+      interval: 5s
+      timeout: 5s
+      retries: 10
+volumes:
+  postgres_data:

package/docs/managed-runtime.md

@@ -0,0 +1,52 @@
+# Naviyra-managed Docker
+
+Naviyra includes its own Docker runtime manager. Users do not install Docker Desktop or Docker Engine separately. Choosing PostgreSQL, MySQL, or MariaDB automatically prepares the private runtime, downloads the chosen database image when missing, and starts a database with credentials and a loopback port.
+
+## Setup and lifecycle
+
+```sh
+npm install
+npm run runtime:setup
+npm run db:migrate
+npm run runtime:status
+```
+
+`runtime:setup` can be run before opening the panel to complete downloads without a browser or reverse-proxy timeout. Database creation also invokes setup automatically. `runtime:start` starts the existing engine or installs it if missing. `runtime:stop` stops the engine and its databases while retaining their data. The runtime survives panel process exit. Database operations also start a stopped engine on demand. On Windows, `npx @naviyra/cloud-panel` registers a scheduled task for the installing account. That task starts the panel at sign-in, including after a reboot, and the panel starts this runtime. An elevated install can also start it at boot, before sign-in. On Linux, include `runtime:start` in the host's startup supervisor.
+
+The default runtime directory is `<repository>/.runtime/docker`, independent of the current working directory. `NAVIYRA_RUNTIME_ROOT` can select a different absolute directory; changing it selects a different runtime, so keep it stable. The archive cache is `<repository>/.runtime/runtime-downloads`. Do not delete the runtime directory: it contains database data (or the WSL virtual disk).
+
+## Windows x64 / ARM64
+
+Windows must support WSL2 and have hardware virtualization enabled. When WSL2 is unavailable, Naviyra reports this command:
+
+```powershell
+wsl --install --no-distribution
+```
+
+Run it as Administrator and restart Windows if requested. Naviyra does not force a restart or enable Windows features from a web request. These are OS prerequisites, not a separate Docker installation.
+
+Naviyra imports a small Alpine root filesystem into a dedicated `Naviyra-<installation-id>` WSL2 distribution, installs its OS dependencies, copies the verified Docker binaries, and starts a private daemon there. Other WSL distributions and Docker Desktop are not used or modified. Keep setup and the panel under the same Windows account, because WSL registrations are per-user. WSL's localhost forwarding must be enabled for native Windows applications to reach database ports. The private engine log is `/opt/naviyra/daemon.log` inside that distribution.
+
+## Linux x64 / ARM64
+
+An ordinary service account uses Naviyra's downloaded rootless Docker binaries. The OS must provide `tar`, `sh`, `nohup`, `newuidmap` and `newgidmap` (usually the `uidmap` package), subordinate UID/GID ranges in `/etc/subuid` and `/etc/subgid`, and support unprivileged user namespaces. Distribution security policies may require rootlesskit configuration. Set up those prerequisites for the panel service account; Naviyra reports missing prerequisites rather than installing system packages with an assumed sudo password. See [Docker rootless prerequisites](https://docs.docker.com/engine/security/rootless/).
+
+When deliberately run as root, setup uses a private rootful daemon, requiring the standard Docker kernel/network prerequisites including iptables. Use the same account for runtime setup and panel execution. Prefer an unprivileged service account with rootless support. The daemon log is `<runtime-root>/daemon.log`.
+
+## Isolation, upgrades, and recovery
+
+The client always targets the private Unix socket, checks the installation's daemon label, and ignores external Docker environment settings and contexts. Database containers use a dedicated bridge network, private loopback port bindings, and persistent volumes. Operations never fall back to a system Docker executable or the Docker Desktop socket.
+
+Docker 29.8.2 and Alpine 3.23.6 archives are pinned in `packages/runtime/artifacts.json`. Downloads are bounded, checksum-verified, and atomically cached. Runtime updates require an explicit Naviyra release; OS package updates do not update these binaries. The maintainer utility `scripts/runtime-download-manifest.mjs` resolves release hashes from official HTTPS distribution endpoints. Review updated versions and hashes before shipping them. [Docker documents the maintenance requirements of static binaries](https://docs.docker.com/engine/install/binaries/).
+
+Setup is serialized across panel workers and the CLI. A failed setup can be retried; the installed marker is written only after extraction and configuration finish. Do not change runtime directories to repair an existing database. If a panel process is killed during database creation, inspect the private engine for a `naviyra-db-<id>` container before retrying. Container deletion also deletes its database volume; runtime stop preserves it.
+
+The panel's own metadata database still uses `DATABASE_URL` and must be initialized before signing in. Existing native PostgreSQL databases and the native PostgreSQL creation option are retained.
+
+## Verification
+
+```sh
+node --test tests/database-runtime.test.mjs tests/managed-runtime.test.mjs
+```
+
+Set `NAVIYRA_RUNTIME_INTEGRATION=1` and run `node --test tests/managed-databases.integration.test.mjs` to download images and test real database creation, host port access, authentication, password reset, and deletion. This test creates and deletes only its own randomly named databases.

package/docs/native-hosts.md

@@ -0,0 +1,48 @@
+# Native Windows and Linux hosting
+
+Application deployment does not require Docker. Node.js runs the panel and agent; PostgreSQL can be a native installation or a remote PostgreSQL service. The existing Docker Compose file is only an optional local database shortcut.
+
+For a dedicated local database using an installed PostgreSQL distribution, set `POSTGRES_BIN` to its bin directory if needed and run `npm run db:local`. On Windows the default is `C:/Program Files/PostgreSQL/18/bin`. This creates a separate cluster under `.runtime/postgres`, bound only to loopback using the port and credentials in `DATABASE_URL`; it does not import or modify other PostgreSQL installations or Docker volumes. Stop it with `npm run db:local:stop`. On Linux, put PostgreSQL tools on PATH or set `POSTGRES_BIN`, and run as an ordinary user (PostgreSQL refuses root).
+
+Set `AGENT_MODE=native` in `.env`, run `npm run db:migrate`, then start the agent (`npm run agent`) and panel (`npm run dev`). Set `NATIVE_TUNNELS=false` for real local applications without Cloudflare credentials. Project details show the assigned loopback URL. A loopback link opens on the computer using the browser; use it on the agent host. To publish domains, set `NATIVE_TUNNELS=true`, install cloudflared, run `cloudflared tunnel login` as the account running the agent, and configure `CLOUDFLARE_CERT`. Use the full hostname from a Cloudflare-managed zone. DNS deletion also requires `CLOUDFLARE_API_TOKEN` and `CLOUDFLARE_ZONE_ID`.
+
+## Host prerequisites
+
+| Selection         | Required on the host               | Source requirements                                                    |
+| ----------------- | ---------------------------------- | ---------------------------------------------------------------------- |
+| Node.js           | Node.js + npm                      | `package.json` with `start`; optional `build`                          |
+| Python            | Python 3 with venv/pip             | Optional `requirements.txt`; ASGI or WSGI `module:object`              |
+| PHP               | PHP CLI, PHP-CGI, Caddy            | Web root containing `index.php`; Composer PHAR if composer.json exists |
+| Go                | Go toolchain                       | Buildable main package at repository root                              |
+| Static / frontend | Node.js; npm if building           | `index.html` in selected public directory, e.g. `dist`                 |
+| Other             | Owner-configured native executable | Prebuilt application; executable alias and JSON argument array         |
+
+Executables are discovered through PATH; override their paths with the variables in `.env.example`. Restart the agent after installing a runtime or changing PATH. No runtimes are silently installed system-wide. Python dependencies are installed in a project-specific virtual environment; the agent adds Uvicorn for ASGI or Waitress for WSGI. Go is built to a project-specific executable. PHP runs through Caddy and PHP-CGI, not PHP's development web server. PHP extensions, application databases, framework secrets, migrations, and writable storage configuration remain host-owner responsibilities.
+
+All apps must bind to `127.0.0.1` and use the assigned `PORT`. Python and PHP bindings are generated automatically. Custom argument values may include `{PORT}`, which is replaced with the allocated port. Commands are invoked with argument arrays, without shell interpretation. Set an executable alias map on the host, for example:
+
+```dotenv
+NATIVE_EXECUTABLES={"dotnet":"C:/Program Files/dotnet/dotnet.exe","java":"C:/Java/bin/java.exe"}
+```
+
+A prebuilt .NET app can use alias `dotnet` and arguments `["MyApp.dll", "--urls", "http://127.0.0.1:{PORT}"]`. Build these custom applications before upload; arbitrary custom build commands are not supported.
+
+## Windows
+
+Use Node.js and native PostgreSQL (or a remote PostgreSQL URL). Install the runtimes you want to deploy and cloudflared if publishing. For PHP, add both PHP-CGI and Caddy. Run the commands from PowerShell at the repository root. Paths with spaces are supported in native mode. Use an ordinary dedicated account with access to the application directory.
+
+`npx @naviyra/cloud-panel` registers one startup task that runs the panel and the agent together, under the account that performed the install, and restarts them if they stop. Keep that account: the private runtime and Cloudflare certificate are per-user. Remove the task with `node scripts/windows-boot.mjs remove` from the installed folder. Running the panel under another account changes PATH and the Cloudflare certificate location; configure absolute paths.
+
+## Linux
+
+Native mode uses the same process supervisor as Windows and does not require privileged per-project systemd operations. Run the agent as a dedicated unprivileged user with access to its project directory and installed tools. To start it on boot, adapt `deploy/naviyra-agent.service`: change `User=root` to your dedicated user, set `AGENT_MODE=native`, and use directories owned by that user. The existing `host` backend remains a Linux-only legacy Node.js/systemd deployment option.
+
+## Lifecycle and limits
+
+The agent supervises application processes and tunnels, captures bounded logs, and retries unexpected exits three times. IPC watchdogs stop child process trees when the agent disconnects, including on Windows. On a normal agent restart, previously running native projects restart from their saved launch specifications. Interrupted builds are marked failed; redeploy to retry. Restarting/redeploying is not zero-downtime. Only one agent process may manage a given state directory.
+
+Native applications execute as the agent account and are intended for trusted source code. Native mode is not tenant isolation. Child environments exclude panel, database, and Cloudflare secrets, but applications running as the same OS user can access files that user owns. Native per-process CPU/RAM counters are not yet collected; the UI shows unavailable instead of invented values. Host memory/load remain available. Static serving does not provide SPA fallback routing; build separate HTML routes or use a Node.js server for history fallback.
+
+Examples are included under `examples/hello-node`, `hello-python`, `hello-php`, `hello-go`, and `hello-static`. ZIP each example's contents, choose its runtime, create, and deploy. Python uses `app:app` with ASGI; PHP/static use `.` as the public directory.
+
+References: [Uvicorn settings](https://www.uvicorn.org/settings/), [Waitress runner](https://docs.pylonsproject.org/projects/waitress/en/latest/runner.html), [Caddy PHP hosting](https://caddyserver.com/docs/caddyfile/directives/php_fastcgi).

package/package.json

@@ -1,6 +1,63 @@
 {
   "name": "@naviyra/cloud-panel",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.0.1",
+  "description": "Self-hosted Naviyra panel for projects, databases, DNS, and email routing.",
+  "type": "module",
+  "bin": {
+    "cloud-panel": "./bin/naviyra.mjs"
+  },
+  "files": [
+    "bin",
+    "apps",
+    "!apps/**/.next/**",
+    "!apps/**/.runtime/**",
+    "packages",
+    "scripts",
+    "db",
+    "docs",
+    "deploy",
+    ".env.example",
+    "docker-compose.yml",
+    "README.md"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "workspaces": [
+    "apps/*",
+    "packages/*"
+  ],
+  "scripts": {
+    "services:start": "node scripts/start-naviyra.mjs",
+    "service:install": "node scripts/windows-boot.mjs install",
+    "service:stop": "node scripts/windows-boot.mjs stop",
+    "service:remove": "node scripts/windows-boot.mjs remove",
+    "runtime:setup": "node --env-file-if-exists=.env scripts/runtime.mjs setup",
+    "runtime:start": "node --env-file-if-exists=.env scripts/runtime.mjs start",
+    "runtime:status": "node --env-file-if-exists=.env scripts/runtime.mjs status",
+    "runtime:stop": "node --env-file-if-exists=.env scripts/runtime.mjs stop",
+    "db:local": "node --env-file-if-exists=.env scripts/postgres-local.mjs",
+    "db:local:stop": "node --env-file-if-exists=.env scripts/postgres-local.mjs --stop",
+    "setup:local": "node scripts/setup-local.mjs",
+    "dev": "npm run dev -w @naviyra/panel",
+    "agent": "npm run start -w @naviyra/agent",
+    "build": "npm run build -w @naviyra/panel",
+    "start": "npm run start -w @naviyra/panel",
+    "db:migrate": "node --env-file-if-exists=.env scripts/migrate.mjs",
+    "db:seed": "node --env-file-if-exists=.env scripts/seed.mjs",
+    "test": "node --test tests/*.test.mjs",
+    "test:e2e": "playwright test"
+  },
+  "dependencies": {
+    "bcryptjs": "^3.0.2",
+    "dotenv": "^17.2.3",
+    "pg": "^8.16.3"
+  },
+  "engines": {
+    "node": ">=22.9.0"
+  },
+  "devDependencies": {
+    "@playwright/test": "^1.63.0",
+    "prettier": "^3.9.9"
+  }
+}

package/packages/runtime/artifacts.json

@@ -0,0 +1,32 @@
+{
+  "docker-x86_64": {
+    "file": "docker-29.8.2-x86_64.tgz",
+    "url": "https://download.docker.com/linux/static/stable/x86_64/docker-29.8.2.tgz",
+    "sha256": "995d1ef289677f74fd58d8d2c35727b6a4ee389c69db8638a3e42d0487aa5b0f"
+  },
+  "docker-rootless-extras-x86_64": {
+    "file": "docker-rootless-extras-29.8.2-x86_64.tgz",
+    "url": "https://download.docker.com/linux/static/stable/x86_64/docker-rootless-extras-29.8.2.tgz",
+    "sha256": "707ebf6a5afd88104086e7b6749997b2366e816aeaf2c3ef2305b08fde9ee007"
+  },
+  "alpine-x86_64": {
+    "file": "alpine-minirootfs-3.23.6-x86_64.tar.gz",
+    "url": "https://dl-cdn.alpinelinux.org/alpine/v3.23/releases/x86_64/alpine-minirootfs-3.23.6-x86_64.tar.gz",
+    "sha256": "6fc0e3639a1c01f156970d7626aab90bc90697117069dbc39ad880b84efa319a"
+  },
+  "docker-aarch64": {
+    "file": "docker-29.8.2-aarch64.tgz",
+    "url": "https://download.docker.com/linux/static/stable/aarch64/docker-29.8.2.tgz",
+    "sha256": "76a624e4a8e5da654d1150e808175125efb5a6f1b6aa1cbd9caee18f51047a50"
+  },
+  "docker-rootless-extras-aarch64": {
+    "file": "docker-rootless-extras-29.8.2-aarch64.tgz",
+    "url": "https://download.docker.com/linux/static/stable/aarch64/docker-rootless-extras-29.8.2.tgz",
+    "sha256": "f8f759dfeecb5bbe2c963232a1b9380e133f677dc0579263e4ca04c69f40aa47"
+  },
+  "alpine-aarch64": {
+    "file": "alpine-minirootfs-3.23.6-aarch64.tar.gz",
+    "url": "https://dl-cdn.alpinelinux.org/alpine/v3.23/releases/aarch64/alpine-minirootfs-3.23.6-aarch64.tar.gz",
+    "sha256": "b17a57958e29735ff0e6e64254d958e65903687a70ca30cc430b33a965ad49d7"
+  }
+}