github getsentry/self-hosted 26.10.0
on GitHub

3 hours ago

Caution

This version upgrades Postgres 14 to 18. If you are very concerned about your data, make sure to take a snapshot of your server before upgrading!

Postgres 18 Upgrade

We've finally moved off our very old Postgres 14 and onto Postgres 18. This upgrade includes a breaking change in how Postgres data is stored. See docker-library/postgres#1259 for the details.

If you ever encountered a problem, come to Discord for direct help.

Going Distroless

Distroless images are even more minimal (in terms of image size and included packages) than debian:slim, and in some cases than Alpine. They contain only the application and its runtime dependencies, with no OS shell or package manager. That leaves far less to flag when you scan with Trivy or similar tools. They’re also smaller, which means faster image downloads and less disk space used on your host.

Sentry's RFC process is how this work got started. Alex, our security engineer, submitted an RFC for distroless, and the changes below follow from it:

  • Sentry runs as the sentry user directly. Containers no longer start as root and drop privileges through gosu. This removes a moving part, and there's no root process to worry about (self-hosted#4535).
  • Sentry and Snuba share a healthcheck approach. Both now use a Python script for healthchecks (self-hosted#4539). We've confirmed these work on our self-hosted-lol setup, as shown here.
  • The base image moved from Debian 12 to Debian 13 (sentry#126031). The size and CVE comparison between the two is in the PR comments.
  • We started building a -distroless image variant (sentry#126030). For a comparison against the standard Debian 13 image, see this comment.

We ran a quick test of the distroless variant from a throwaway branch. That branch sidestepped a few minor bash entrypoint issues we haven’t settled on yet, and the run itself had no problems. The distroless sentry image isn’t the default yet, so you’ll need to opt in via :nightly-distroless to use it.

Here’s where each service stands:

  • Relay and Symbolicator: distroless since 2025.
  • Snuba: distroless.
  • Vroom: distroless starting with the next release, 26.11.0.
  • Launchpad, Taskbroker, Uptime-checker, and Sentry: in progress.

Experimental Features to Try

  • organizations:attribute-management enables the Settings > Attributes browser and editor page.
  • organizations:relay-automatic-json-expansion and organizations:explore-automatic-json-expansion-ui control the expansion config. The flag names don't say much, but they let you expand JSON logs, which is worth a look.

Other Notable Things

  • The login page has a new design. Enjoy it.
  • Log search now supports regular expressions. See the changelog entry.
  • We no longer build the jq image ourselves. We use the official one now (self-hosted#4547).
  • Breaking change: Vroom's SENTRY_BUCKET_PROFILES has changed. If you use external storage (S3-compatible or GCS), update your configuration before upgrading.

We're always happy to chat about setups, upgrades, or whatever's giving you trouble. Come find us on Discord.

New Features ✨

Bug Fixes 🐛

Vroom

Other

  • (external-kafka) Refresh patches so they apply to master again by @oioki in #4553
  • (healthcheck) Let Docker enforce HEALTHCHECK_TIMEOUT in check_http.py by @oioki in #4546
  • (seaweedfs) Use compose mounts in migrate by @aminvakil in #4531
  • (tests) Expect React login page in integration tests by @oioki in #4551

Documentation 📚

Internal Changes 🔧

Deps

Sentry

  • Exec the sentry image's Python entrypoint by @oioki in #4536
  • Prepare for a non-root sentry image by @oioki in #4535

Other

  • (healthcheck) Share one python3 HTTP healthcheck for sentry web and snuba api by @oioki in #4539
  • (install) Read the JS SDK loader registry with json.tool instead of cat by @oioki in #4540
  • (integration) Check the enhance-image marker with python instead of bash by @oioki in #4541
  • (profiles) Drop the sentry-vroom volume migration by @oioki in #4552
  • (vroom) Remove ensure-correct-permissions-profiles-dir.sh by @oioki in #4554

Other

Check out latest releases or
releases around getsentry/self-hosted 26.10.0

Don't miss a new self-hosted release

NewReleases is sending notifications on new releases.

Get notifications