MFConsole Downloads

What's New — 1.3.0-rc12 (2026-10-07)

• Safer failback. Failback checks the protected site before it changes anything and stops, listing what would be lost, instead of overwriting it; to go ahead anyway you have to choose to discard it. It also refuses a VM that has started again at the source, and a replica host that can’t run KVM guests is flagged before a run, not during it.
• Safer console restore. Any recovery plan change queues a control-plane backup, so a standby console has the latest plans. Restoring into a new database cluster creates missing roles and checks the TimescaleDB version before it starts. After you update, the console pushes the new compute-node code to every active node on its own.
• AI Workers. Hand a job to AI agents, one per task, each on its own short-lived VM. Every worker clones the repo, runs Claude Code, runs your tests and sends back a patch for you to review; nothing is pushed. Workers never hold the API key, and the console stops each job at its budget. Off by default.
• AI alarm triage and bulk VM actions. A read-only agent (beta, off by default) diagnoses alarms with a likely cause, evidence and next steps, and admins rate each one. The AI assistant can act on up to 200 VMs from one approval card.
• NIC teaming and live backups. Bond idle NICs as Active / Standby or LACP and use the team as a bridge, OVN or VLAN uplink. Backups of running VMs no longer pause them, NIC bandwidth limits apply live, and live migrations can be capped. It rolls up 1.3.0-rc7 to rc11.4; after you update, the console pushes the new compute-node code to every active node on its own.
• Container, Kubernetes and HA fixes. Enrolling one container-cluster member no longer locks the console out of the others (click Re-Enroll on affected members), dissolving a container cluster is safe, deleting a Kubernetes cluster no longer frees nodes it couldn’t reach, SNAT deletes reach OVN, and a control-plane reboot no longer leaves a host without its database.
• Sign-in and update fixes. The MFA code prompt no longer opens behind the sign-in form, Settings → Node Updates works again, background tasks no longer fail for a minute after a worker start, and a Content Library publish no longer sticks at “Queued” or reports a copy it didn’t make. It rolls up 1.3.0-rc6.4 and rc6.5; after you update, the console pushes the new compute-node code to every active node on its own.
• Recovery plans. Fail VMs over to a standby site in boot order and back again, rehearse it any time with a test failover that doesn't touch production, and see the measured RTO of every run. ZFS replication to the other site is relayed through the console, so the sites' hosts need no access to each other.
• Standby console. Restore the console from its backup at the standby site with CONSOLE_STANDBY=true and it stays passive until you promote it. Also: Move to Datacenter…, the release channel at dl.mfcloud.io, loading placeholders and a Hardware page fix. It rolls up 1.3.0-rc5.6 to rc6.2; after you update, the console pushes the new compute-node code to every active node on its own.
• Kubernetes and images with no internet. Signed content bundles carry k3s and RKE2 with their images, Helm, Ceph CSI and MetalLB, or cloud templates, ISOs and LXD images. Clusters install from them with no node reaching the internet, and the Content Library copies the images to the nodes you pick. Tested on an HA cluster whose nodes had no internet access.
• Kubernetes node fixes. Node VMs now use the disk size you ask for (the template's /var was a fixed 5 GB), and MetalLB setup waits for its webhook. It rolls up 1.3.0-rc5 to rc5.4.
• Update channel, online or offline. Signed release bundles you can import with no internet access, an online release channel that downloads them for you, and rolling node updates that patch a cluster one host at a time from the console's own repository, with a health check before each host takes its VMs back.
• Migration fixes. A VM can no longer end up running on two hosts unnoticed, and a long migration no longer leaves its VM stuck at “migrating”. The deploy dialog now sends its placement rules and has a resource pool picker. It rolls up 1.3.0-rc2, rc3 and rc3.1.
• Also in 1.3: costs and showback. Rate cards price vCPU, RAM, disk, GPU and per-VM use for a tenant, cluster, cost center or the whole fleet. A new Costs tab shows each month and downloads per-tenant statements as CSV or JSON.
• Partner white-label. Your own name, colours, logo and favicon, stored by the console. Partner mode also hides version badges, release notes and vendor links.
• Sovereign mode. Keep the console and its nodes to private addresses and an allowlist. Anything else fails at once with a clear error instead of timing out at a firewall.
• Sites and AI sandboxes. Place datacenters at physical sites and spread affinity groups across them. AI sandboxes, off by default, give an AI agent short-lived VMs to run commands in. It rolls up 1.2.0-rc6, rc6.1 and 1.3.0-rc1; after you update, the console pushes the new compute-node code to every active node on its own.
• Also in 1.2: security fixes. urllib3 2.8.0 (CVE-2026-97689, -97687, -97688), read-only API keys that can't fetch credentials, and VM consoles that need a password at the VNC port (run Repair Worker once per node when coming from 1.2.0-rc2 or earlier).
• Scoped, expiring API keys. Make a key full, read-only or sandbox, with an expiry of up to 365 days. Existing keys keep working unchanged.
• Also in 1.2. The first public 1.2 release, rc2, added everything below on top of 1.1. After you update, the console pushes the new compute-node code to every active node on its own.
• Resource pools. Give a group of VMs in a cluster CPU shares, an optional CPU limit and a memory reservation. VMs keep their pool through migration, load balancing and HA restart.
• 3-host HA fixes. LINSTOR stays reachable when the VIP moves (new LINSTOR_CONTROLLER_IP setting), and control-plane containers keep their logs and restart protection after a host reboot.
• Also in 1.1: change hardware on a running VM. Add a disk, network adapter or SCSI controller, or grow a disk, and the guest sees it right away. VMs created before this release need one power off and start first.
• Notifications and alarms. Alerts to webhooks, Discord/Slack, Teams, email and syslog/SIEM, each with its own events and severity. Alarms can be acknowledged or muted, with a 90-day history. Prometheus metrics export.
• Safer backups and VMs. Immutable cloud backups with S3 Object Lock, weekly restore checks, delete protection for VMs and containers, and security keys and passkeys for sign-in.
• More VM options. Linked clones, USB passthrough, device mappings, CPU type with a cluster baseline for live migration, nested virtualization, hugepages, guest NUMA, shared host folders and automation triggers.
• Fixes. Node ISO installs are recognised by Add Host and get LINSTOR, the firewall and a storage pool; HA Manager rolling updates no longer leave hosts without a console; and the dashboard rides out dropped database connections.
• Known issue (3-node HA only): losing a control-plane host can still freeze the surviving console replicas for a few minutes. The infrastructure layer fails over correctly every time — VIP, database promotion and workers all recover in seconds. Restarting the affected app container restores service in about 10 seconds. Single-node installs are unaffected.

Full per-release detail is on the changelog page.