CashPilot 2.0 closes the run of releases since 1.62. They changed what the worker can do on your host, how far an earner can reach into your network, and how many IPs one box can earn on. Several need a step from you, so they ship as one major version.
Why you should upgrade
What an older install leaves open:
- 1.70 and older: the worker holds the raw Docker socket. Whoever takes over the worker is root on your host.
- 1.72 and older, with the dashboard and a worker on one host: a compromised worker can read
.fernet_keyand decrypt every provider login you stored. - Anything deployed before 1.70: earners carrying strangers' traffic can reach your LAN, your router and your other machines.
2.0 closes all three. It also carries the fixes since 1.73: the in-app update works behind the socket proxy, confirmed identity backups stay confirmed through the migration, earners from the old pre-worker deploy path stay visible, Podman workers can deploy, and proxy traffic caps recover after a box was offline. Every fix from now on ships in 2.x; the 1.73 tag gets no more patches.
How to upgrade
The compose files pin a release series, so docker compose pull and the in-app Update button stay on 1.x until you do this.
- Back up. The dashboard's
/data(cashpilot.dbis your earnings history,.fernet_keydecrypts every stored login and cannot be recreated). The script is at https://geiserx.github.io/CashPilot/backup-restore/#backup. Then on the Payouts page, press Download backup for every box under Back these up: a Mysterium keystore or a Storj identity has no other copy. - Take the 2.0 compose file for each host:
docker-compose.yml,docker-compose.fleet.yml, ordocker-compose.worker.ymlon a worker-only host. Keep your.envand your own changes. If your old file already hascashpilot-socket-proxyandcashpilot-migrate, changing the image tags to2.0is enough. - Run
docker compose up -d --force-recreate(with-fand your file if it is notdocker-compose.yml), the dashboard host first, then every worker.
What the one-shot migrator does. Coming from before 1.73, cashpilot-migrate runs once before the proxy starts. Docker cannot add a label to an existing volume, so it copies each earner volume to a <volume>-pre-isolation backup, checks it by digest, recreates the volume with the cashpilot.deployed-by=worker label, copies the data back, checks again and recreates the earner as it was. A Mysterium identity keeps its address. The worker's own volumes move to cashpilot_worker_data_owned and cashpilot_fleet_owned. It deletes nothing. It can take a few minutes on a node with a large volume; if it is interrupted, run the same command again and it carries on.
What you see when it is done. docker logs cashpilot-migrate ends with "Migration complete: everything the worker uses carries cashpilot.deployed-by=worker." The worker's status page says "Docker access: socket proxy". Every earner shows as running, the Fleet page shows 2.0 on each worker, and a Mysterium node keeps its old address. Coming from 1.69 or older, press Turn on isolation on each worker's row, then Check isolation.
What works differently. On the host where the dashboard and a worker run together, the in-app update updates the worker only; update the dashboard with docker compose pull && docker compose up -d. Earners you started by hand no longer show in the dashboard; they keep running.
Rolling back. 2.0 uses the same database schema as every release since 1.67. To go back to 1.73, set the tags back to 1.73 and run docker compose up -d. To go further back, put your old compose file back: the migration kept your old volumes and backups. Run docker rm -f cashpilot-socket-proxy if that file predates the proxy, and restore your /data backup if you go back past 1.67.
What's new
Security
- The worker no longer holds the Docker socket. A socket proxy (sockguard 2.4.6, pinned by digest) holds it, passes only the calls the worker makes, and refuses privileged containers, binds of
/or of the socket, and unlisted capabilities, devices and runtimes. - Owner isolation: the worker reaches only containers, volumes and networks labelled
cashpilot.deployed-by=worker. A compromised worker cannot read the dashboard's data, its encryption key or the keys in its environment. Not yet a full root boundary if you setCASHPILOT_COMPOSE_DIRorCASHPILOT_PROXY_BIND_MOUNTS. - New installs fence earners off your LAN, the host, your tailnet and cloud metadata; upgraded installs turn it on with one button. Mysterium, which uses host networking, is not covered, and Podman cannot be fenced yet.
- An optional gVisor runtime for bridge earners, and encrypted backups of node identities from the Payouts page.
Proxied copies
Run an extra copy of a deployed earner through a SOCKS5, HTTP CONNECT or Tailscale exit-node proxy, so one box earns on several IPs. It fails closed: if the proxy dies, the copy stops instead of leaking out of your own IP. Optional traffic cap per proxy. Services that need host networking, ports, volumes or devices (Mysterium, Bitping, Storj) cannot use one, and UDP goes out only through a Tailscale exit node.
Also since 1.62
Provider ratings from ten sourced questions, Activity per container (opt-in), custom services by image name, import from money4band, CashFactory and InternetIncome, and CasaOS and Runtipi packages that run the socket proxy.
Companion apps
- CashPilot Desktop 1.0, the same catalog as an app for macOS, Windows and Linux: https://github.com/GeiserX/CashPilot-Desktop
- CashPilot for Android 1.0, which puts your phone's earning apps on the Fleet page, from GitHub releases and waiting for review on F-Droid: https://github.com/GeiserX/CashPilot-android
What's new, in full: https://geiserx.github.io/CashPilot/whats-new-2.0/
Every upgrade step and leftover: https://github.com/GeiserX/CashPilot/blob/main/UPGRADING.md