Platform Updates: Autumn/2026

Two topics shaped our autumn. The first one is not a feature at all: security updates. September, October and November brought wave after wave of new CVEs, and patching took a large part of our time. The second one is Caddy — our Caddy distribution now has a dashboard, proper docs, and a clear path away from Traefik.

Keeping the lights on

#

In our summer update we called 2026 the year of supply chain security. Autumn proved the point. New vulnerabilities landed almost every week — in the operating system, in the container stack, in the Go toolchain, PHP, NodeJS and in libraries we and you depend on. Some of them (supposedly) allowed remote code execution.

For the last three weeks, patching and updating was close to a full-time job for our team.

What we do when a CVE lands

#

Every new CVE starts the same loop:

1. Evaluate. Does it affect our platform or your clusters? How bad is it, and can it be reached from the outside?
2. Notify. If you are affected, you hear from us — with what it means for you and what happens next.
3. Patch. We update, roll out, and reboot where needed.
4. Verify. We check that everything runs as before.

Most of this work is invisible. When it goes well, nothing happens — and that is the point.

What we shipped

#

• Flatcar updates on every node. We updated the nodes across all customer clusters to the latest Flatcar Container Linux release, reboots included. Nothing to do on your end. Also shout out to the team maintaining the distribution and critical pieces such as Nebraska which make our life easier!
• Patched releases of our tools. In response to a TLS-related security issue, we rebuilt and re-released quantum-cli, quantum-caddy, and Caddyscope with a patched Go version and updated dependencies.
• Quantum Console updates (e.g. Portainer)!
• Three quantum-caddy releases in one month, following upstream Caddy from 2.11.7 to 2.11.9. The latest is v2.11.9+pq.0.

When the update is the problem

#

Not every update goes as planned — and this is where a managed platform earns its keep.

The new Flatcar release came with Docker 28.2.2. Soon after the rollout we saw that the overlay network — the part that lets containers talk to each other across nodes — was unreliable on multi-node clusters. It did not fail all the time: it showed up mostly after service updates, which made it hard to pin down. Single-node clusters were fine.

We tracked it down to the Docker version: a batch of fixes for exactly this had gone into Docker 28.3, one step ahead of what the release shipped (upstream issue).

So we did not wait for the next OS release:

1. we built a workaround to run a newer Docker on the same Flatcar release
2. we tested it on a staging cluster
3. we rolled out Docker 28.3.3 to the affected multi-node clusters

Your part

#

We patch the platform. Your stacks and images are yours, so please keep them current too:

• upgrade quantum-cli and your Caddy stack to the latest release
• rebuild your images on fresh base images
• let Dependabot or Renovate open the update pull requests for you

Not sure if something affects you? Ask us.

This is what you pay for

#

A server is cheap. Keeping it safe is not.

Someone has to read the advisories, judge the risk, test the fix, and roll it out — on short notice, and often more than once a week. With a managed platform, that someone is us. This work is a large part of what we casually call “included”: people who watch, decide, and act, so your team can keep building its product instead of chasing CVEs.

Caddy, front and center

#

quantum-caddy is our Caddyserver distribution. It handles routing and TLS for your stacks, and you configure it with service labels.

Caddyscope: a dashboard for Caddy

#

New since v2.11.7+pq.0: Caddyscope, a dashboard for your ingress. It is read-only and renders in the browser from Caddy’s own Prometheus metrics. Turn on per-host metrics and you can see each of your hosts on its own.

Caddyscope ships as its own image flavor — add the -caddyscope suffix to the image tag, set a password hash, and add a few labels. The dashboard guide has the full setup.

Better docs

#

We reworked the Caddy section of our docs:

• Deployment — an example stack to copy and deploy. Deploy it with quantum-cli and you can update it like any other workload.
• Custom certificates — bring your own TLS certificates, or swap Let’s Encrypt for another ACME provider such as ZeroSSL, globally or per site.
• Migration — how to move from Traefik to Caddy.

Moving from Traefik to Caddy

#

We believe Caddy is the best way forward, and this autumn we continued to move customer clusters from Traefik to Caddy.

The move is close to zero downtime. Caddy labels are prefixed with caddy., so they sit next to your existing traefik. labels without getting in each other’s way:

1. add the Caddy labels to your services
2. deploy the Caddy stack
3. remove the old ingress
4. clean up the old labels

If we maintain your ingress for you, get in touch — we are happy to plan and support the rollout.

quantum-cli updates

#

Two releases since summer: v3.4.0 and v3.5.0.

• stack show — a new command to show the details of a single stack.
• Masked credentials — quantum-cli stack ls -o json no longer prints credentials in clear text. Safer for logs, CI output, and AI agents.
• Refreshed Docker images with the latest Docker CLI and dependencies.

Upgrade with Homebrew:

brew upgrade --cask quantum-cli

Monitoring

#

We rolled out changes to our monitoring stack: updated components and new metrics. Together they enable additional monitoring of system services at the node level for customers.

Also fixed: the CPU cores panel sometimes showed NaN.

As always, feedback and questions are welcome. Get in touch.