OS security updates
PlusPanel OS is the operating system every PlusPanel server runs. We maintain it centrally: you never patch it yourself. Security fixes reach your servers as new, signed images that are applied atomically and can be rolled back.
What we watch
Section titled “What we watch”Every day we compare the exact package list of the PlusPanel OS images we ship (their signed software bill of materials, SBOM) with:
- the security advisories of AlmaLinux, the distribution PlusPanel OS is built from, and
- the Trivy vulnerability database, which also covers the PlusPanel agent’s Go dependencies.
The PlusPanel agent and our distribution registry are also scanned daily with govulncheck.
Express and routine updates
Section titled “Express and routine updates”| Class | What it means | Target |
|---|---|---|
| Express | A fix is available for a critical or high vulnerability (AlmaLinux: Critical or Important) in the image | a new signed image on Preview within 48 hours of the fix being available upstream for critical issues, 5 days for high ones |
| Routine | Fixes for medium and low vulnerabilities, package updates, base refreshes | the monthly release (early each month) |
| Tracked | A vulnerability with no fix available upstream yet | shipped in the first release after the fix exists |
“Available upstream” means published by AlmaLinux in its errata and in the AlmaLinux bootc base image. If a vulnerability cannot be reached in PlusPanel OS (for example, the vulnerable feature is not present), we may record a reviewed, time-limited exception; exceptions expire after at most 90 days and are reviewed at every monthly release.
Channels
Section titled “Channels”- Preview · Early Access receives every new image first, including express security images, after it has passed our gates.
- Stable · Production (the default) receives an image after it has been validated on Preview, through a staged rollout: our own servers, a 2 % canary ring, then waves of 10 %, 50 % and 100 %, each ring only after the previous one stayed healthy, inside each server’s maintenance window, with automatic rollback of a server whose health checks fail (and a halt of the rollout).
- Express security images use the same rings and health checks with shorter observation periods and a 1-hour client notice; no check is skipped.
You choose the channel per server in the panel, or a default for your organization. Details: How updates work.
What every image goes through
Section titled “What every image goes through”Before an image reaches Preview it must:
- build from pinned sources (base image by digest, agent by version);
- have no fixable high or critical vulnerability, except reviewed exceptions;
- pass the image smoke tests, a container boot test and a virtual-machine boot test;
- boot as a fresh server from its own installation image in our lab, enroll with our control plane and run a signed job;
- be signed, with its SBOMs (SPDX and CycloneDX) and its build provenance (SLSA) attached as signed attestations.
What your server checks
Section titled “What your server checks”A PlusPanel server installs or updates only to an image that is signed by the PlusPanel release key for exactly that image and carries a signed SBOM for exactly that image. The agent refuses anything else before downloading it, and so does the installer when it converts an existing server. The running system is never touched by a refused update.
Machine-readable feed
Section titled “Machine-readable feed”The current version of each channel and the vulnerabilities closed by each release are published as JSON at
https://pluspanel.net/security/os-updates.json. The changelog lists the same releases in plain
words.
Reporting a vulnerability
Section titled “Reporting a vulnerability”Write to ops@pluspanel.net with “security” in the subject. Please do not open public issues for vulnerabilities.