# Brume roadmap: what comes next > What alpha 0.1 leaves out on purpose, and what each piece brings. The order after 0.1 is a direction, not a promise. Alpha 0.1 · in progress. This is https://brume.dev/roadmap in Markdown, for agents and terminals. Details: https://github.com/brumecloud/brume/blob/main/docs/content/docs/how-it-works/roadmap.mdx ## At a glance ### Alpha 0.1 (Now · in progress) - One server, one owner - Containers, static sites, databases - Deploy on push from GitHub - A CLI and an MCP server for agents - Backups and full restore from S3 ### Developer workflow (Next) - Pull request previews - A web shell into containers - Deploys from CI ### More servers (Later) - Several servers, one panel - A highly available engine ### Hardening (All along) - Builds in a gVisor sandbox - Rootless Docker - Tailnet Lock and Headscale ## Everything planned. A badge places an item on the timeline above. The others are not placed yet. ### Access and isolation - **Tailnet Lock** (All along): Neither Tailscale's coordination server nor an account stolen from your identity provider can add a device to your tailnet. - **Disposable gVisor builder, or builds off the server** (All along): A build can no longer reach root through a kernel or runc flaw, or tamper with later builds. - **Secrets as files on tmpfs**: An option: files don't leak to child processes, error reports or /proc, as environment variables do. - **Rootless Docker, gVisor for apps** (All along): Stronger isolation of the host and the containers, beyond userns-remap. - **systemd-analyze security in CI**: Scores the exposure of each systemd unit. CI fails if the score gets worse. ### Data and backups - **Hardened backups**: Object Lock retention headers on every upload, so a bucket without Object Lock fails instead of accepting it. - **Master key rotation**: New blobs on S3 use the new key. Old blobs stay readable through their key ID. - **Authenticated events on S3**: Signed or encrypted log segments: whoever holds the S3 credential can no longer write fake events a restore would replay. - **Built images on S3**: Restores with the exact images and no rebuilds, and rollbacks past the last 10 revisions. - **Backups of volumes outside templates**: Backups for every volume. In 0.1, only the databases created from templates are backed up. - **Major database upgrades**: Backup, dump, then restore into the new version. The engine then refuses a rollback to the old version. - **Database replicas and point-in-time recovery**: Backups are dumps: writes since the last one can be lost. Postgres WAL archiving cuts that to a few seconds. ### Detection and recovery - **External heartbeat**: An outside service alerts you when Brume goes silent: a dead server, an attacker with root, or stopped S3 uploads. - **Point-in-time restore, and recovery after a compromise**: Restore up to a date, an audit view from a date, and which secrets to revoke, in what order. ### Features - **Web shell into containers** (Next): A shell into your containers, from the panel. Its most powerful feature, so it needs careful design. - **Tokens for CI, deploys from GitHub Actions** (Next): A CI runner has no tailnet identity, so it needs its own access from outside Tailscale, with its own rules. - **Remote MCP server**: Served by brume api, for AI agents that can't run a local command. It needs OAuth. - **PR previews** (Next): A preview of each pull request. Already decided: a pull request from a fork is never built with secrets. - **Outbound internet filtering by domain**: Let a service reach only the domains it needs, such as api.stripe.com. It needs an egress proxy. ### Hosting - **Multi-server** (Later): Agents on other machines connect outbound to the master, over the tailnet. Never a central root SSH key. - **A highly available engine** (Later): The log is replicated with Raft, so the control plane is no longer a single point of failure. - **Agent start without the engine**: The agent restarts your apps at boot from its last desired state, even if the engine doesn't start. - **Red Hat family (Alma, Rocky, RHEL)**: SELinux instead of AppArmor, dnf instead of apt. Alpha 0.1 runs on Debian and Ubuntu. - **Headscale** (All along): Full self-hosting of the admin layer. Leaving it out of 0.1 is still a proposal. ## Still open. Design decisions not made yet. Until one is settled, the docs describe the options, not an answer. - **A contributor license agreement:** A CLA that keeps the option of changing the license, or none. - **Automatic updates:** Before the first release: when to install them, a fallback to the previous binary, a progressive rollout. - **Checking the signing key:** A way to verify it outside GitHub, since brume.dev deploys from the same repository. - **Local Cloudflare tunnel config:** Cloudflare's docs must confirm that it stops the dashboard from adding routes, and that the API can create it. - **Headscale:** Leaving it out of 0.1 is a proposal, to confirm later. - **A domain for your apps:** Apart from your email domain, so a stolen Cloudflare account can't redirect your MX records. Advice at install, or nothing. - **Panel frontend:** How the panel decodes API responses, and which library draws the metrics charts. - **After brume deploy from a folder:** Whether the service follows its branch on each push, or stays on the deployed commit. --- ## More from brume.dev Every page in Markdown. The whole site in one file: https://brume.dev/llms-full.txt. The index: https://brume.dev/llms.txt - [Home](https://brume.dev/index.md) - [Architecture](https://brume.dev/architecture/index.md) - [Roadmap](https://brume.dev/roadmap/index.md) - [Compare](https://brume.dev/vs/index.md) - Brume vs [Coolify](https://brume.dev/vs/coolify/index.md), [Dokploy](https://brume.dev/vs/dokploy/index.md), [CapRover](https://brume.dev/vs/caprover/index.md), [Portainer](https://brume.dev/vs/portainer/index.md), [Kamal](https://brume.dev/vs/kamal/index.md), [Dokku](https://brume.dev/vs/dokku/index.md), [Easypanel](https://brume.dev/vs/easypanel/index.md), [Railway](https://brume.dev/vs/railway/index.md), [Render](https://brume.dev/vs/render/index.md), [Fly.io](https://brume.dev/vs/fly/index.md), [Vercel](https://brume.dev/vs/vercel/index.md), [Heroku](https://brume.dev/vs/heroku/index.md)