Install

Docs / Known limitations

Known limitations in 0.0.1

What this release does not do, or has not yet proven in every environment. Each item says what to do about it.

Validation on managed clouds

  • The EKS, GKE and AKS profiles render and install the same manifests that pass our acceptance tests on local Kubernetes with S3-compatible storage, but they have not yet been certified in those managed services. Before production on a managed cloud, run your own acceptance: create, suspend and wake a branch, branch and restore it, check that each project’s identity can reach only its own bucket prefix, drain a node, and run a recovery drill.
  • Recovery time and data-loss objectives are design targets measured locally. Measure yours with a drill (disaster-recovery.md).
  • Customer-managed encryption keys for disks and buckets depend on your cloud’s StorageClass and bucket settings; verify them in your account.

Platform

  • PostgreSQL 18 only.
  • One active controller per installation. While it is unavailable, running databases keep serving and stay routable for 5 minutes, but suspended branches cannot wake and no branch can be created, deleted or resized.
  • A new PostgreSQL image from a mismatched release is detected when its first compute starts, not before the rollout begins: that one branch stays down, data untouched, until the matching image is installed. The rollout stops there.
  • Object storage mode needs a certificate issuer that writes ca.crt into the Secrets it issues; a separate CA bundle is supported for dedicated disks only. ACME issuers cannot be used for internal certificates.
  • Object storage mode runs three WAL nodes per project on different nodes, plus a page server and two small helper databases. Their sizes are fixed in this release; include them when sizing your cluster.
  • Changing a running storage pool’s images is a coordinated maintenance procedure, not an automatic rollout (upgrade.md).
  • Replacing the certificate authority is a coordinated manual procedure (rotate-keys-and-certificates.md).
  • Base backups in dedicated disk mode run inside the branch’s compute and share its CPU and memory.
  • Disks grow but never shrink, and growing needs a StorageClass with volume expansion.
  • The controller’s memory limit (512 MiB) is sized for about 3,000 branches; raise it by 128 MiB per additional 1,000.
  • The Branch Kubernetes resource is v1alpha1: fields may be added in later releases (never removed or renamed). Automate through the platform or console API where you can.
  • Firecracker microVM isolation for computes is not part of the 0.0.1 bundle.
  • The columnar cold tier for agent-scale data is not part of 0.0.1.
  • In object storage mode a few PostgreSQL behaviours still differ from a local disk: pg_database_size and pg_tablespace_size count only files on the compute’s local disk, and a tablespace created with LOCATION reports an in-place path from pg_tablespace_location after the database restarts (its data is unaffected). Dedicated disks behave as stock PostgreSQL 18. Choose dedicated disks for workloads that depend on these until a later release.

Connections and security

  • Passwords must be SCRAM-SHA-256; MD5 is not supported. Client certificate, GSS and LDAP authentication are not supported.
  • In transaction pooling, session state that outlives a transaction (LISTEN, session SET, temporary tables) needs a session connection (connect.md).
  • A login attempt can wake a suspended branch before its password is checked; repeated failures are throttled per address.
  • A project identity can delete objects under its own bucket prefix, which backup retention needs. Turn on object lock to protect backups from a compromised workload.
  • Project API tokens can obtain the branch superuser through the platform API; treat them as administrative credentials.
  • License keys cannot be revoked before they expire.

Console

  • Sign-in requires WorkOS.
  • Readers’ SQL runs read-only as the database’s owner role; it cannot change data but can, for example, cancel that role’s own sessions.
  • Product mail uses Amazon SES or an SMTP relay; bounce handling for SMTP is up to your relay.
  • Imports from databases on the public internet are off until you enable them.
  • You operate the management database: backups, failover and key escrow are yours (backup-and-restore.md).
  • The self-hosted license agreement is published as a draft pending legal review (LICENSE-EULA.md). A signed agreement takes precedence.