Released September 24, 2026
Tainer 2.0
Open to everyone. Smarter, faster and safer for everyone who runs it.
Open source
Now open source.
Every line of Tainer is now on GitHub under the GNU Affero General Public License v3.0. The dashboard, the load balancer, Tainy and every fix in this release. Read it, run it, change it, and send the good parts back.
Load balancer
Looks before it leaps.
Every load balancer change in 2.0 follows one idea: never surprise the person who runs the cluster. It starts in dry run, leaves containers alone until you say so, plans whole-cluster moves you can preview, and can see an overload coming.
Node scores
Dry runWould migrate
Dry run first
Auto-migration logs every move it would make, using the same pipeline and pacing, without touching anything. It's on by default until you trust it.
No surprise downtime
Containers can't live-migrate, so they stay out of automatic balancing unless you allow them, always or only inside windows like 22:00-06:00.
Maintenance drain
Put a node in maintenance and its guests move off one at a time to healthy nodes. Guests that can't move raise a warning.
Whole-cluster plans
Preview the fewest moves that even out the cluster, with projected imbalance before and after. Nothing moves until you click Apply.
Predictive balancing
An opt-in forecast over the last 30 minutes moves a workload before a node crosses the threshold, and logs its evidence.
Pressure-aware scores
On Proxmox VE 9, kernel pressure stall data catches contention that plain utilization hides.
Smaller, smarter moves
The balancer moves the smallest guest that fixes the overload, VMs before containers, and counts ballooned VMs by what they really use.
No migration storms
Max Concurrent Migrations defaults to one and tracks moves to completion through the Proxmox task API.
Control each guest with a Proxmox tag.
Tags are compatible with ProxLB, so rules you already wrote keep working. Excluded nodes and VMIDs can now be edited in the settings form too.
How the load balancer worksplb_ignoreNever moved by anythingplb_manualOnly by drains and plans you applyplb_pin_<node>Stays on that nodeplb_affinity_<group>Group members stay togetherplb_anti_affinity_<group>Group members stay apart
Tainy
Your assistant. Your model.
The assistant has a new name and a new home. Tainy can run on any OpenAI-compatible endpoint you host, and it can now take a request from a sentence to a running container, asking for your approval at every step that changes something.
Air-gap friendly
Point Tainy at vLLM, Ollama, LM Studio or your company LLM gateway. Prompts and cluster data stay on your network.
Tool policy per group
Hide write or destructive tools from a group. Helpdesk can look without touching.
Operator notes
Site guidance every Tainy follows, like never restarting CT 105 during business hours.
Usage and cost
Per-user tokens and tool calls for today and 30 days, with optional cost estimates.
ISOs to VMs
Tainy downloads an installer ISO from a URL you give it and creates a VM that boots from it.
Streams and thinks out loud
Replies stream word by word. Reasoning models get a collapsed Thought process block.
run pihole on node 1
search_docker_imagespihole/piholepull_docker_imageCT template readyget_task_statustask finishedcreate_container_from_image
- image
- pihole/pihole
- node
- node1
- network
- static IP from pool
- password
- ••••••••
Real-time
Live. Not refreshed.
The dashboard, the deployments list and every deployment page now follow a live event stream. Start a guest in the Proxmox UI, and Tainer shows it within seconds, for everyone who has the page open.
Deployments
live- runninggiteaCT 101
- stoppedpiholeCT 108
- runninggrafanaCT 112
- runningbuild-runnerCT 214
One watcher per site
However many browsers are connected, Tainer runs a single watcher per site, and stops when nobody is looking.
Buttons that keep up
Start, stop and restart show their spinner and flip the status the moment the Proxmox task finishes.
A fallback that stays
Periodic refresh still runs underneath, so a dropped stream never leaves a stale page.
Automation and admin
Script it. Scope it. Sleep well.
API tokens let Terraform, CI and your own scripts call Tainer without a browser session. Each token has its own permissions and site scope, is shown once, stored only as a hash, and can expire.
# token scoped to one site, stored only as a hash
curl https://tainer.example.com/api/... \
-H "Authorization: Bearer tnr_…"Firewall on every deployment
See and edit the guest-level Proxmox firewall from the deployment page: policies, rules and a one-click toggle.
Tainer backs itself up
Users, 2FA, encrypted credentials, the audit log and policies in one passphrase-encrypted file (AES-256-GCM), daily or on demand.
Operators run their own site
Site permissions now cover delete, migrate, recreate, backup policies, updates and the CVE scanner. Before, those were admin only.
Reset a user's 2FA
Lost the authenticator and the recovery codes? An admin clears it from the Users page, and the reset is audited.
Security
Locked down, line by line.
2.0 closes gaps across sign-in, SSO, API tokens, Tainy, webhooks and SSH, and every site page now checks access on its own.
security fixes and hardening changes in a single release.
Every site page checks access
Pages, consoles and read endpoints verify the session and site access themselves.
No privilege escalation
Only admins create admins. Group managers can only grant what they hold.
Hardened SSO
Tainer 2FA on SSO sign-in, verified email for account matching, same-origin redirects only.
An audit log that can't be flooded
More events recorded. Repeated failures from unknown callers are throttled and summarized.
Tighter SSRF guard
Webhooks don't follow redirects and are checked against the address actually connected to.
Fair lockouts
Lockout is tied to email and client address, so nobody can lock an admin out.
And so much more.
- Deploy forms pick the Automatic node from live balancer scores
- The balancer activity log records breakers, errors and settings changes
- Default score weights are now memory first
- Every load balancer setting explains itself inline
- The assistant is now called Tainy
- Tainy can deploy a Docker image without a template
- Tainy waits for long Proxmox tasks before moving on
- Deployment activity is no longer lost on concurrent writes
- Docker image library path is set in Settings
- Recovery codes work when the 2FA secret can't be read
- A wrong 2FA code keeps you on the code form
- The Docker image now runs on Node 24
Before you upgrade
A major version, with major-version care.
Most installs only need an AUTH_SECRET. Read the list before you pull, and back up the data volume first.
openssl rand -base64 32- 01
Set AUTH_SECRET before you upgrade.
Tainer checks it at boot and will not start without it. If you ran without one, the first start re-encrypts everything under the new key. Everyone is signed out once.
- 02
Behind a reverse proxy, set APP_URL or TAINER_TRUST_PROXY_HEADERS=true.
SSO no longer trusts forwarded headers by default.
- 03
API tokens are limited to their site scope.
Scripts that used a token for global actions will be refused.
- 04
Providers without email_verified need a checkbox.
For Entra ID and similar, enable Trust email without email_verified claim to keep email matching.
- 05
Password reset no longer turns off 2FA.
Users who lost everything need an admin to use Reset 2FA.
- 06
Strict SSH host key policy is enforced everywhere.
Sites set to strict need a known_hosts file.
- Five more notes cover site connection edits, group permissions, AIA certificates, webhooks and the Node 24 image. They are all in the upgrade guide.
Get Tainer 2.0.
Free, open source and yours to run. Pull the image or build it from source.
docker pull tainersh/tainer:2.0.0