TautWeekly for Plex v0.23.0

Released: 2026-08-26

Unified container platform

v0.23.0 consolidates Docker Desktop, generic Docker Compose, NAS, QNAP,
Unraid, FreeBSD/Podman, and compatible container systems on one public
multi-architecture OCI image:

ghcr.io/sparkmoxie/tautweekly:0.23.0

The manifest supports linux/amd64 and linux/arm64. New deployments select one
validated profile:

• desktop keeps Mac Docker Desktop's loopback-first Manager, named-volume
  default, host.docker.internal guidance, embedded schedule, health, graceful
  stop, and host-owned pull/recreate/rollback behavior.
• server keeps the NAS/generic trusted-LAN Manager, bind-mounted /data,
  PUID/PGID/UMASK, Compose/QNAP lifecycle, and networking guidance.
• unraid keeps appdata, trusted-LAN Manager access, Community Applications
  metadata, and Docker/Apps-owned updates.

Unknown profiles and incompatible package/profile combinations refuse startup
before the Manager or scheduler runs. Existing v0.22.0 package identities retain
a bounded inference bridge for migration.

Installation assets

• TautWeekly-compose.yaml is the preferred checksummed no-clone Compose asset
  for server-profile hosts.
• TautWeekly-mac-compose.yaml is a transitional desktop-profile asset pointing
  to the same unified image.
• The NAS and Mac archives remain supported host-adapter, recovery, and
  local-build fallbacks.
• Windows remains a native Manager package. Native systemd Linux remains
  available, and FreeBSD keeps its documented Podman beta route.

Use the full 0.23.0 tag for reviewed deployments or append the published
manifest digest for an immutable automation pin. Minor, latest, and edge are
mutable and are not recommended CI/CD promotion references.

Manager update status

Authenticated Settings > Updates now reports the active runtime profile,
unified image repository, recommended semver reference, immutable digest
policy, migration state, stable version, host-adapter state, and package-owned
recovery guidance. The non-root Manager still has no Docker socket, engine
credentials, privileged helper, or ability to install a container update.

Migration and compatibility

Existing /data configuration, credentials, pairing state, schedules, state,
history, output, backups, named volumes, bind mounts, and PUID/PGID/UMASK
settings remain compatible when the new container is recreated against the
same mount.

For the complete preflight, commands, health acceptance, Manager
authentication, networking, interrupted-pull/recreate recovery, and rollback
steps, read the
unified container migration guide.

The old ghcr.io/sparkmoxie/tautweekly-mac:0.22.0 image remains pullable for
rollback and receives no v0.23.0 or later tags. TautWeekly-mac-compose.yaml
remains through v0.24.x and may be retired no earlier than v0.25.0 with
release-note notice. Never use docker compose down -v or delete Unraid appdata
during migration, update, reinstall, rollback, or access recovery.

Security and lifecycle preservation

All profiles retain the read-only image, non-root identity, root refusal,
capability drop, no-new-privileges, credential privacy, authenticated Manager,
minimal unauthenticated liveness endpoint, persistent /data, independent
scheduler, operation lock, and bounded 30-minute graceful stop. Container
updates remain under the host administrator or platform UI.

Validation boundary

Repository and release CI exercise selector refusal, amd64 server/desktop/Unraid
boot and health, arm64 server boot through Buildx/QEMU, Manager pairing and
credential privacy, restart/recreate persistence, named and bind-mounted data,
permissions, image/profile reporting, hardening, graceful lifecycle, artifacts,
checksums, and release gating. These are emulated CI environments, not physical
Intel/Apple-silicon Macs, NAS/QNAP appliances, Unraid hardware, or FreeBSD
hosts. Administrators must complete final acceptance on their real platform
before enabling production delivery.