Summary
- Running containers can now declare scheduled volume backups through Docker labels. Administrators configure trusted defaults in VolumeVault, while labels override non-secret settings. Generated jobs remain visible and operational but read-only, and are safely disabled when declarations disappear or conflict with manual configuration.
- Backup runs retain their original source, destination, filename, and execution options. Durable dispatch leases recover lost queue handoffs, and completion notifications are retried independently per channel.
- Restore safety is strengthened with locked source-volume validation, secure local archive reads, and exact Dropbox file identity checks. Docker-volume archives are filtered and sorted newest first before the listing limit is applied, and listing failures are reported reliably.
- The restore UI now explains unverifiable Dropbox runs and rejects unsupported Dropbox safety backups before any restore is queued.
Upgrade Notes
- This release includes database migrations for Docker-label configuration, run snapshots, dispatch leases, and durable finalizations. They run through the normal VolumeVault startup process.
- An asynchronous queue connection is required;
QUEUE_CONNECTION=syncis no longer supported for run dispatch. The default remainsdatabase. - Queue retry-after defaults are now 360 seconds. The example environment documents
DB_QUEUE_RETRY_AFTER,BEANSTALKD_QUEUE_RETRY_AFTER, andREDIS_QUEUE_RETRY_AFTER; no new environment variables are required with the defaults. - Dropbox backups without a proven exact file ID cannot be restored from run history. This includes newly successful Offen uploads, because Offen does not expose the exact uploaded file ID to VolumeVault. Identity is never inferred afterward by filename. Existing proven IDs remain usable after renames or moves.
- A requested backup before overwriting is rejected when the job's current backup destination is Dropbox, since a verifiable safety backup cannot be guaranteed. The form explains the restriction and preserves the requested choice.
- Rebuild and restart the VolumeVault container after upgrading. The image includes the native helper required for secure local archive reads.
Verification
- Release preparation:
php artisan changelog:validate v1.23.0 --release --no-interactionand changelog tests (15 tests, 52 assertions) passed. - Feature verification before merge: full PHPUnit suite passed with 1,032 tests and 5,117 assertions; five engine-specific cases were skipped under SQLite.
- Migration recovery was tested against live MySQL 8.4 (30 passed) and PostgreSQL 17 (31 passed), with cases for other engines skipped.
- Frontend tests (21 tests),
npm run build,vendor/bin/pint --dirty --format agent, andgit diff --checkpassed. - Live cloud-provider/Offen-image integration tests and MariaDB-specific execution were not run.
Full Changelog: v1.22.0...v1.23.0