Goliash watches what actually runs, builds a service × environment matrix with the running and the newest
upstream version, and tells you when a new release ships or when environments drift apart — staging on 1.5.0 while
prod is still on 1.3.2, or two prod clusters disagreeing.
Documentation: goliash.dev
Status: stable. From 1.0 the REST API, the agent protocol, MCP tools, CLI, configuration and metrics keep
working within 1.x; see Versions and compatibility. Security
reports: SECURITY.md.
Try it
docker run --rm -p 8080:8080 ghcr.io/pipozzz/goliash try
A throwaway server with three weeks of example data: open the link it prints and you are signed in. Nothing is
kept when you stop it. Or look around the live demo first, no install. To run it
for real, see Getting started.
Features
- One matrix for every orchestrator. Kubernetes (watch), Amazon ECS, AWS Lambda (per alias), Nomad, Docker Swarm
and plain Docker/Compose hosts, side by side, per environment — with replicas, targets and rollouts in progress,
grouped by application, team, target (a cluster or cloud account) or status.
- Connected in two clicks. Pick the platform, copy one command: the agent registers itself with an enrollment
code and finds what to watch — the cluster, the Docker host, every ECS cluster and Lambda function of the region.
One code for a whole fleet works too.
- Applications, not just containers. Workloads grouped by application from Kubernetes, Helm and Compose labels or
Nomad jobs; Dokploy and Nomploy projects come together under one name. A database image shared by several apps is
compared within each app.
- Upstream awareness. Tags from Docker Hub, GHCR, Quay, registry.k8s.io, ECR, Google Artifact Registry, Azure ACR
and private registries (read access given once under Settings → Private registries, or credentials from the
agent's environment,
docker login, pull secrets or the pod's cloud identity), compared with per-service semver policies (track minor only, pin a major, ignore -alpine noise).
Moving tags resolved by digest (1 = 1.27.3). A built-in catalog of popular images, release dates and
release-notes links from GitHub.
- Tiles. The matrix drawn like the logo: every application a cell, coloured by how current it is, warm where
something needs attention; open a cell for its services, compare environments side by side, or put it on a wall
screen. The browser tab's icon shows the workspace's state too. Show one team alone as its own board, and save
any view (a team, production, the TV board, a team's upgrade list) as a tab or as your home page. Click the
legend to pick out what is behind or unknown; open a service to upgrade it with a pull request, or to read why its
newest release is unknown and what would fix that.
- Find anything. ⌘K (Ctrl+K) jumps to a service by its name, the image or version it runs, its workload or the
GitOps application that deploys it; to a team, a page, or where a pasted CVE runs. Every page filters with
/, and
Search everywhere looks through services, vulnerabilities, packages, pull requests, history and notifications at
once — also for scripts (/api/v1/search) and assistants (the MCP search tool), or hand the words to Goli.
The tiles move with the arrow keys.
- Know what to upgrade first. The Updates page lists every upgrade with its target version: an exploited
vulnerability first, then a release the project says fixes vulnerabilities, end of life, production first; put items
off, copy it as a checklist, or get it weekly as an upgrade plan per team. Filter it (
nginx), Tick all shown and
open the pull requests together: an upgrade campaign in three clicks.
- Goli, the assistant inside.
Ask in plain words: "what will this upgrade break?", "is Log4Shell running anywhere?", "what changed in prod in the
last two hours?". Goli looks it up in live data as you, only reads, and links to the pages that show it. Brief
on every upgrade and promotion reads the release notes of every release in between and turns them into a checklist;
Explain on every vulnerability, exposure and hygiene finding says what it means here; Around this in History
finds what else changed when something broke. Ask in the app, with
/goli in Slack, from an alert, or with
goliash ask in a terminal. Claude, OpenAI or a model on your own hardware; off until you choose one.
Try it on the demo.
- Drift that matters. An environment behind the one before it, a version behind upstream, targets that
disagree — shown at once, announced only when it lasts.
- Argo CD and Flux, next to what runs. Each service shows the Git repository, path and commit its Argo CD
application or Flux Kustomization/HelmRelease deploys, whether it is in sync and healthy and since when, with alerts
when it is not: Git pins 1.7.0, 1.6.0 runs for one out of sync, the version change and Git diff just before one
that degraded. One page lists every application on every cluster, those in trouble first. Sync windows, suspended
Flux objects and applications Argo CD syncs only by hand are marked, because a merge is not a deploy: a merged
pull request whose version does not run is shown, with why it waits, and announced an hour later.
- Upgrades as pull requests. Upgrades, promotions and rollbacks open as pull requests (GitHub, GitHub Enterprise,
GitLab, Gitea and Forgejo) that change the tag where manifests, Kustomize, Helm values, Nomad jobs, Compose files,
ECS task definitions or Terraform pin it — with Argo CD or Flux, or without, from
goliash.git.* labels. Each
is previewed first and says why, what it fixes and which licenses it brings. Open one from the service page, the tiles, the
matrix, Updates, Security, the alert or the weekly plan; tick several to open them together, or one per repository;
promote a whole application in one; let a version policy open them by itself. Renovate's and Dependabot's are
linked, not duplicated; reviewers, labels, CI checks and reminders included. You review, GitOps deploys; the
Delivery page measures how long from opening, and from merging, to running.
- Change freezes. Holidays, a big sale, Friday afternoons: automatic pull requests wait, the ones opened by hand
say so, and every page shows it. Argo CD's sync windows are honoured the same way, per application.
- Did the deploy go out? Rollouts stuck half way (two versions side by side for half an hour), services running
none of their replicas, and rollbacks to an older version, read from Kubernetes, ECS, Nomad, Swarm and Compose:
first on the Delivery page, announced, and counted against deploys as a change failure rate. Each version waiting
for production says which known vulnerabilities promoting it fixes and which it brings.
- What the image is made of. What pulling each image costs, charted per environment over 90 days, the layers the
last deploy added with the Dockerfile step of each (
RUN apt-get install -y chromium, +145 MB), a size budget per
service, and images built on an older build of their FROM image than the base has now (docker build --pull
forgotten), with an alert when an image grows a lot.
- History without CI. Every deploy, rollout, retag and removal, read from the runtime itself. Scrub a timeline
back through 400 days and watch versions change, or play the deployments back one by one.
- An SBOM of what actually runs. Not one image at build time: every running image in every environment, with its
digest, where it runs and the packages of its SBOM (BuildKit, cosign or OCI referrers), as CycloneDX 1.6 for now
or any past moment, per environment, straight into Dependency-Track.
- Is CVE-X running? Packages from those SBOMs checked daily against OSV (Debian, Ubuntu, Alpine, Wolfi,
Chainguard and language ecosystems), exploited-in-the-wild (CISA KEV) first, with the version that fixes each, how
long each has run, past due once CISA's date for fixing it passes, and an alert when one starts running.
- Findings you can act on, not noise. Where the distribution has no fix, Goliash says whether a newer release of
it has one (fixed in Debian 13 (trixie)) or upstream fixed it, and which version to run (· latest 1.31.8).
Kernel packages in containers, packages past upstream's fix (nginx.org's nginx against Debian's advisory) and what
the image's publisher rules out in VEX are left out, each listed with its reason; people mark the rest not
affected, with a review date, for the monthly report.
- Fixed before scanners know. A project ships the fix before its CVE reaches OSV and the distributions: Goliash
reads release notes (a CVE, GHSA or GO id, security release) and project feeds (php.net) and announces a security
release to every service running an older version the hour it appears — PHP built from source included, which
scanners often miss. After an advance notice (PHP: two critical fixes on Oct 21), a security watch on
php
lists what runs it at once and announces its next release.
- Licenses and signers. The license of every package in running images, sorted by what it asks: AGPL and SSPL,
source-available terms, GPL and unknown licenses first. And who signed each image, as its keyless (Sigstore)
signature names the CI workflow or person, with an expected signer per service.
- Notifications with less noise. Slack, Microsoft Teams, Google Chat, Discord, Telegram, ntfy, webhooks (signed), e-mail, browser push and Grafana annotations, instant or as daily/weekly digests, with
dedup and ack/snooze, and a scheduled upgrade plan.
- Software outside containers too. Add a database on a VM or a managed service by hand, with where it runs and
its version: it counts in the matrix, updates, end of life and the security posture. Or only watch a tool's
releases.
- Security posture for whoever answers for the risk. How long production has run behind an available release
(median, 90th percentile, 30+ and 90+ days), what is past its end of life, accepted risk, supply-chain findings and
blind spots (each service whose newest release is unknown says why:
latest, a refused registry, no comparable
tag…), with a CSV and a PDF for risk registers and audits (NIS2, DORA, SOC 2, ISO 27001).
- On the dashboards you already have. Ready-made Grafana and SigNoz dashboards (versions, drift, delivery speed
and change failure rate, rollouts, GitOps applications and pull requests, image sizes and budgets, vulnerabilities,
licenses, image hygiene, Goliash's own health), deploy markers on your graphs, Prometheus alert rules, and a ServiceMonitor,
PrometheusRule and dashboard from the Helm chart. Settings → Integrations fills in the scrape settings and creates
the token in one click.
- Ask your own AI assistant too. A built-in MCP server gives Claude, Cursor and others the same read-only tools
Goli uses: "what runs in prod?", "what should we upgrade first?", answered from live data. They sign in with OAuth,
no token to copy; try it on the demo:
claude mcp add --transport http goliash https://demo.goliash.dev/mcp.
- Built for teams and MSPs. Every service has a team, picked or created as you type; each team's card is a
scorecard (exploited, end of life, stuck rollouts, behind) with a one-click brief from Goli. Workspaces per client,
roles, passkeys, two-factor, magic-link and OIDC sign-in, audit log, REST API, Prometheus metrics, and CSV exports
of exposure, licenses and vulnerabilities for audits.
- Read-only and easy to run. Collectors only ever read; the agent sends data out over HTTPS, credentials stay
in your network. One binary each, SQLite or PostgreSQL (several servers for high availability), Helm, Compose,
Swarm, Nomad, CloudFormation and Terraform manifests included. A newer Goliash is announced, and called out when
it brings security fixes.
Out of scope: deploying or upgrading services (that is CI's or Renovate's job), CVE scanning, library versions in code.
How it works
your network Goliash server
┌────────────────────────────────┐ ┌──────────────────────────────────┐
│ Kubernetes / ECS / Nomad / │ │ ingest → mapping → versions │
│ Swarm ──read-only──► agent ───┼──HTTPS────► │ │ │ │
│ private registries ──► agent │ snapshots │ ▼ ▼ │
└────────────────────────────────┘ │ events, matrix notifier ──► Slack, webhook, e-mail
│ UI, REST API SQLite / Postgres│
└──────────────────────────────────┘
- goliash-agent reads orchestrators and private registries and sends full snapshots, heartbeats and registry
results. Snapshots, not events: an agent outage loses nothing.
- goliash (server) turns snapshots into events, maps containers to services and environments, compares them
with upstream releases and sends notifications. It can also collect targets itself, without an agent.
Quickstart
curl -fsSLO https://raw.githubusercontent.com/pipozzz/goliash/main/docker-compose.yml
docker compose up -d
docker compose logs goliash | grep link= # open it to create your account
docker compose exec goliash goliash demo # optional: three weeks of example data
Open the setup link, create your account, then Connect: pick Kubernetes, Docker, Swarm, Nomad, ECS or Compose
files, fill in one form, and run the command it shows where the agent can reach your orchestrator. The page follows
the agent connecting and its first report.
To watch the Docker host the quickstart runs on, no agent is needed:
docker compose --profile watch-host up -d # adds a read-only docker-socket-proxy
docker compose exec goliash goliash env create -name prod -position 30
docker compose exec goliash goliash target create -env prod -platform docker -name this-host \
-settings '{"docker":{"docker_host":"tcp://socket-proxy:2375"}}'
Ready-made manifests for Kubernetes (Helm), Nomad, Docker Swarm, plain Docker hosts and ECS are in
deploy/. The Helm charts are also published as oci://ghcr.io/pipozzz/charts/goliash and
oci://ghcr.io/pipozzz/charts/goliash-agent.
Without an agent: a target created without an agent (goliash target create without -agent, or "the server
itself" in the UI) is collected by the server, with the same read-only collectors. That suits a self-hosted server
next to what it watches, e.g. the Kubernetes cluster it runs in (helm … --set collectInCluster=true) or a Swarm or
Docker host through a socket proxy. Turn it off with -collect=false.
Install
- Images:
ghcr.io/pipozzz/goliash and ghcr.io/pipozzz/goliash-agent (linux/amd64, linux/arm64; distroless,
non-root). Images and release archives are signed with cosign (keyless) and come with SPDX SBOMs.
- Binaries: archives for Linux, macOS and Windows on the GitHub releases page.
- From source:
make build, or docker build --target server . / --target agent.
Notification channel secrets (Slack and webhook URLs, signing secrets) are encrypted at rest with AES-256-GCM. The
key comes from GOLIASH_SECRET_KEY or GOLIASH_SECRET_KEY_FILE (32 bytes, base64 or hex: openssl rand -base64 32);
with SQLite and neither set, the server creates goliash.key next to the database. Back the key up with the
database: without it, channels must be created again. With PostgreSQL, set the key explicitly.
The server keeps its SQLite database in /data (set GOLIASH_DATABASE_URL=postgres://… for PostgreSQL) and
deletes processed snapshots beyond the newest 20 per target every hour (-keep-snapshots); history lives in events.
Releases are published by pushing a v* tag.
Usage
Web UI
Open GOLIASH_PUBLIC_URL (default http://localhost:8080) and sign in with a link from
goliash login-link -email [email protected]. The UI is server-rendered (templ + htmx), works without a build step
and updates live over server-sent events.
| Page | What it is for |
|---|
| Matrix | service × environment with versions, replicas, targets, drift badges and the latest upstream; filter (/) and "only with drift"; a time travel timeline to scrub, step or play back deployments; CSV and CycloneDX SBOM export; cards on phones; a first-run checklist when empty |
| Service | where it runs, upstream releases, history, version policy, acknowledgements, "check upstream now"; delete once it runs nowhere |
| Inbox | unmapped workloads with a suggested name; mapping creates a rule for that image; the list of mapping rules |
| Hygiene | moving tags, tags pushed again, untrusted registries and images without a digest, summarised by kind |
| Delivery | versions waiting for the next environment with the releases they bring; deploys and lead times per environment; a printable monthly report per workspace |
| History | every event, filterable by service, environment and type |
| Settings → Agents and targets | agents and targets with collector health; environments (rename, reorder); edit targets; add agents with install commands, rotate or revoke tokens, rename and delete agents, move or delete targets |
| Settings → Notifications | channels (test, edit, delete) and rules (pause, delete) |
| Settings → Workspace settings | invite people, change roles, sign-in links, sign out, remove passwords, API tokens with roles and expiry, the audit log (admins) |
| Settings → Workspaces | one workspace per team or client (organization admins) |
| Account (your avatar) | name, password, and every browser you are signed in on |
Sign-in, API and metrics
bin/goliash login-link -email [email protected] # first user becomes owner; prints a one-time link
bin/goliash user create -email [email protected] -role member
bin/goliash user password -email [email protected] # optional: sign in with a password too
bin/goliash token create -name prometheus # glsh_api_… for /api/v1, /metrics and /mcp (viewer)
- Passwords (argon2id, at least 12 characters): everyone sets one on their account page, or an admin runs
goliash user password. Repeated failures pause sign-in for an address for 15 minutes. Turn passwords off with
GOLIASH_PASSWORD_LOGIN=false when everyone uses OIDC. The account page also lists where you are signed in.
- Two-factor sign-in (TOTP from any authenticator app, recovery codes) on the account page; it also guards
sign-in links. Admins reset it for someone who lost their phone.
- Magic links are e-mailed when SMTP is configured (
GOLIASH_SMTP_*); goliash login-link works without it.
- OIDC:
GOLIASH_OIDC_ISSUER, GOLIASH_OIDC_CLIENT_ID, GOLIASH_OIDC_CLIENT_SECRET, optional GOLIASH_OIDC_NAME
and GOLIASH_OIDC_DOMAINS (people from these e-mail domains are created as viewers on first sign-in; others
need an account). Redirect URI: <public URL>/auth/oidc/callback.
- Set
GOLIASH_PUBLIC_URL to the address people use; with https:// cookies are marked Secure.
- Roles: viewer reads; member maps services, edits policies and acks; admin manages agents, targets, channels,
tokens and users; owner can do everything. Viewer, member and admin are per workspace; admin and owner of the
organization reach every workspace. Organization admins change roles under Settings → Workspace settings; only owners grant or
take the owner role, and the last owner cannot be removed.
- REST API (session or
Authorization: Bearer glsh_api_…): GET /api/v1/matrix, /services, /environments,
/targets, /events?service=&environment=&type=&before=&limit=, /drifts, /updates, /vulnerabilities,
/inventory?format=json|csv|cyclonedx&environment=&at=; POST /api/v1/acks. The OpenAPI
description is api/public-v1.yaml, also served at /api/v1/openapi.yaml; every response
is tested against it.
- AI assistants (MCP): every server serves the Model Context Protocol at
/mcp (Streamable HTTP, API token),
and goliash mcp runs it on stdio for Claude Desktop or Cursor. Tools: matrix, service, drifts, updates, changes,
promotions, delivery, inventory, hygiene, vulnerabilities and acknowledge.
Versions, upstream and drift
bin/goliash matrix # service × environment, latest upstream, drift markers
bin/goliash matrix -at 2026-09-12T14:00 # what ran then (history is kept for 400 days)
bin/goliash inventory -csv # every running container with image and digest, for audits
bin/goliash hygiene # moving tags, retagged images, untrusted registries (GOLIASH_ALLOWED_REGISTRIES)
bin/goliash drift # open drifts
bin/goliash promotions # versions waiting for the next environment, with the releases they bring
bin/goliash delivery # deploys per environment and lead times between environments, last 30 days
bin/goliash events # history: deployed, version_changed, removed, new_release, drift_*
bin/goliash events -env prod -since 2h # what changed before an incident
bin/goliash check # check upstream registries now (the server does it hourly)
bin/goliash service set -name postgres -track minor -pin-major 15
bin/goliash rule create -match image_repo -pattern 'ghcr\.io/acme/pay.*' -service payments
- Mapping: labels
goliash.service / app.kubernetes.io/name (and goliash.env), then rules, then unmapped
workloads wait in the inbox with a suggested name.
- Upstream: public registries (Docker Hub, GHCR, Quay, registry.k8s.io, …) are checked by the server, and so are
private ones an admin gave read access under Settings → Private registries (stored encrypted); other registries by
the agent, with credentials from
GOLIASH_CREDENTIAL_<REGISTRY_HOST> (user:password or a
token). Private Amazon ECR repositories go through the ECR API with the agent's AWS credentials (IAM
ecr:ListImages; IRSA, task role or instance profile), where the credential, if set, names an AWS profile.
New services are checked within a minute, then hourly.
- Policy per service:
tag_filter, track (patch/minor/major), pin_major, prerelease. Without a filter,
tags are compared like with like (same -alpine variant, same number of version parts).
- Catalog:
catalog/images.yaml holds default policies for popular public images
(postgres, redis, nginx, keycloak, traefik, grafana, prometheus, …) and where their release notes live. A service
without its own policy uses the catalog's; additions are welcome as pull requests.
- Release notes: releases get their publication date and a release notes link from GitHub or GitLab releases
(the catalog's
github/gitlab, "github": "owner/repo" or "gitlab": "gitlab.com/group/project" in a
service's own policy, or the image's own org.opencontainers.image.source label) or a changelog URL template.
GitLab means gitlab.com and one self-hosted instance in GOLIASH_GITLAB_URL (token: GOLIASH_GITLAB_TOKEN). The label is read from the registry once a
week, so most images built with GitHub Actions get release notes without any setup. Links appear in the UI and in
new-release notifications. Set GOLIASH_GITHUB_TOKEN to raise GitHub's rate limit.
- Drift:
env (an environment runs an older version than the one before it), upstream (behind the newest
release by at least the tracked jump), inconsistent (targets of one environment disagree), declared (what runs
differs from what Compose files in Git declare, when an environment has both), (the running release cycle
reaches its end of life within 60 days, from ; turns it
off, for servers without internet access). Drift shows in the UI
at once but is announced () only after it lasts: 7 days, immediately,
15 minutes, 30 minutes. Override per service, e.g. .
Workspaces (MSPs, teams)
Each workspace has its own agents, targets, services, history, notifications and API tokens.
bin/goliash workspace create -name "Client A" -slug client-a -envs
bin/goliash user create -email [email protected] -role member -workspace client-a
bin/goliash user grant -email [email protected] -role admin -workspace client-a
bin/goliash matrix -workspace client-a # every command takes -workspace (or GOLIASH_WORKSPACE)
Organization owners and admins reach every workspace and switch between them in the top bar. Everyone else only
sees the workspaces they were invited to, as viewer, member or workspace admin; a workspace admin manages the
people of that workspace only. Clients of an MSP therefore never see each other.
Notifications
bin/goliash channel create -type slack -name ops -url https://hooks.slack.com/services/…
bin/goliash channel create -type webhook -name ci -url https://example.com/goliash -secret s3cret
bin/goliash channel create -type discord -name releases -url https://discord.com/api/webhooks/…
bin/goliash channel create -type telegram -name team -token 123456:ABC… -chat-id -1001234567890
bin/goliash channel create -type ntfy -name phone -url https://ntfy.sh/my-goliash
bin/goliash channel create -type email -name oncall -to [email protected] # GOLIASH_SMTP_* or -smtp-addr/-smtp-from
bin/goliash channel test -name ops
bin/goliash notify create -channel ops -events new_release,drift_detected,agent_stale -mode daily -min-jump minor
bin/goliash ack -service postgres -kind release -until-version 17.0 # "we know about 16, quiet until 17"
bin/goliash ack -service web -kind drift -for 336h # quiet for 14 days
Rules match event types and optionally services, owners, environments and the size of a release jump. instant
rules deliver within seconds (items arriving together are batched); daily and weekly rules collect a digest
sent at digest_hour (UTC). A release is announced once per service and version. Failed deliveries are retried
with backoff. Webhook bodies are signed: X-Goliash-Signature: sha256=HMAC(secret, X-Goliash-Timestamp + "." + body).
Collectors and credentials
| Platform | Reads | Needs | Credentials |
|---|
| Kubernetes | Deployments, StatefulSets, DaemonSets, CronJobs and their running pods (watch) | ClusterRole with get, list, watch | in-cluster service account, else kubeconfig (kubeconfig_context optional) |
| ECS | clusters → services → running tasks → task definitions | IAM ecs:List*, ecs:Describe* | default AWS chain; credentials_ref = AWS profile name |
| Nomad | jobs, job versions, allocations | ACL token with list-jobs and read-job | credentials_ref → token, else NOMAD_TOKEN |
| Docker Swarm | services and running tasks | Docker API GET only (docker-socket-proxy) | none |
| Docker | running containers, grouped into Compose services (optionally only some projects); registry digests | Docker API GET on containers and images (docker-socket-proxy) | none |
| Compose files | services and images declared in Compose files, without a Docker engine | an HTTP(S) URL, or for an agent a file in GOLIASH_COMPOSE_DIRS | credentials_ref → bearer token for the URL |
The server only sends a credentials_ref name. The agent resolves it from the environment variable
GOLIASH_CREDENTIAL_<NAME> (upper-cased, non-alphanumerics as _) or the file
$GOLIASH_CREDENTIALS_DIR/<name> (default /etc/goliash-agent/credentials).
The agent registers, follows its configuration (polled every minute with an ETag), sends a heartbeat every minute
and buffers snapshots in -data-dir while the server is unreachable (the oldest are dropped beyond 200).
The protocol is in api/agent-v1.yaml; the server validates every request against it.
Development
Repository layout
| Path | What | License |
|---|
cmd/goliash | Server binary | AGPL-3.0-only |
cmd/goliash-agent | Agent binary | Apache-2.0 |
internal/agent | Agent loop | Apache-2.0 |
internal/collectors/{kubernetes,ecs,nomad,swarm,docker,compose} | Read-only collectors | Apache-2.0 |
internal/registry | OCI Distribution API client | Apache-2.0 |
internal/pkgscan | Application packages from their manifests (images without an SBOM, Lambda code) | Apache-2.0 |
api/agent-v1.yaml | Agent protocol (OpenAPI 3.0) | Apache-2.0 |
pkg/agentproto | Protocol types and client, generated from the spec | Apache-2.0 |
pkg/buildinfo | Build metadata | Apache-2.0 |
internal/{api,ingest,mapping,versions,notifier,store,ui} | Server | AGPL-3.0-only |
internal/store/migrations/{sqlite,postgres} | Database migrations (goose), embedded in the server | AGPL-3.0-only |
deploy/{helm,nomad,swarm,docker,ecs} | Deployment manifests | AGPL-3.0-only |
Building
Requires Go (version in go.mod) and, for linting, golangci-lint v2.
make build # bin/goliash and bin/goliash-agent
make generate # regenerate pkg/agentproto after editing api/agent-v1.yaml
make test # SQLite; set GOLIASH_TEST_POSTGRES_DSN to also run against PostgreSQL
make lint # license boundary check + golangci-lint
scripts/lab/up.sh # k3s, Swarm and Nomad in Docker with a server and agent; prints a sign-in link
The documentation site lives in website/ (Astro Starlight): cd website && npm install && npm run dev.
License
The agent and the code it is built from are licensed under Apache-2.0; the server is
licensed under AGPL-3.0-only. Each source file states its license in an SPDX header.
See LICENSING.md for details.
Contributing
Contributions are welcome. Please read CONTRIBUTING.md; external contributions require signing
the CLA.
