Updates and rollback

Cerberon is never updated without you. An instance checks once a day whether a new release is available and tells administrators once per release, in the notifications. Updating is your decision, from the app or from the machine.

Update from the app

Settings → Licence and updates → Update and restart (administrators only).

1. Cerberon checks it can update: a valid licence that covers the release, enough disk, and no scan running. A running scan blocks the update; wait for it to finish or stop it.
2. Everyone is notified, and new scans are paused.
3. After about a minute everyone is signed out, and the update runs: a snapshot of your data, the new version, a restart.
4. If the new version does not start, the update is rolled back automatically to the snapshot it just took.
5. When Cerberon is back, administrators are told how the update ended.

During the update:

• Scheduled scans that come due wait, and run as soon as the update finishes, marked "ran late".
• Scans started through the API or from CI are refused with HTTP 503 and a Retry-After header; for about a minute during the restart Cerberon does not answer at all. Make your pipeline retry on both.
• People can sign in again once Cerberon is back.

Check now on the same page looks for a new release immediately.

Update from the machine

Run the installer again. On a machine that already has Cerberon it upgrades, keeping your data, settings and licence:

curl -fsSL https://license.cerberon.dev/install.sh | sh

It takes a snapshot of your data before changing anything. The scanner tools are rebuilt only when a release changes them.

Snapshots

Every update takes a snapshot first, and checks that the copy can be read back. Snapshots are kept in ~/.cerberon/backups; the newest three are kept and older ones removed.

Take one yourself at any time:

sh install.sh --backup

List them:

sh install.sh --backup-list

Rollback

To go back to a snapshot (the newest, or the one you name):

sh install.sh --rollback
sh install.sh --rollback 20261029T150701Z

It asks you to type rollback first, because anything added since the snapshot is lost: scans, findings and users created after it. Add --yes to skip the question in automation.

What updates never touch

Your data volume, your licence and this machine's identity, your settings, and your snapshots (other than removing ones older than the newest three).