Upgrade with a recovery path
Pin releases, drain active work, preserve a consistent backup set, and verify the new instance.
On this page
Prepare
Read the release notes supplied with your licensed image. Record the current full image reference, including its digest. Take and verify a complete recovery set before changing the image.
Database migrations can make a newer database incompatible with an older binary. A rollback therefore uses the older image with its matching database, identities, and file-volume snapshots.
Drain transfers
Stop issuing new request and delivery links for the maintenance period. Watch active sessions and streaming downloads until they finish. A five-minute Compose stop grace period is useful for a normal shutdown, but does not guarantee enough time for a very large transfer.
Warn users about the maintenance window and preserve the configured resume window. Avoid forcibly killing the service while it is writing or serving files.
Replace the image
Update VOTPORT_IMAGE to the approved version and published digest, then:
docker compose pull
docker compose up -d
docker compose logs --tail 100 votport
curl --fail http://127.0.0.1:8321/healthz
Check startup logs for migration, ownership, storage-probe, identity, and listener errors. Do not rebuild from an arbitrary branch as a substitute for the released image.
Verify
Confirm HTTPS access, local and SSO sign-in, tenant selection, a small receive, a delivery download, receipt verification, metrics, and scheduled backup status. If native transfers are enabled, verify the advertised UDP addresses and expected certificate digest.
Retain the prior recovery set until the upgraded service is accepted. If rollback is needed, restore that complete set and its pinned image rather than starting an older binary against the newer live database.
Check receiving and workflow changes
When upgrading an older NAS deployment, qualify the exact receiving mount in Storage > Receiving storage before reopening uploads. Do not rely on the former Fast-profile fallback or heartbeat-expiry takeover rules. Keep SQLite and control state on local storage and follow writer ownership requirements.
Update installed senders as well as the server for parallel small-file HTTP sending. Check reception-project assignment, destination release rules, workplace notification connections, and a representative routed upload before accepting the upgraded service.