Zwall
Talk to an Engineer
Talk to an Engineer
Documentation
Docs Home › Upgrades › Compatibility

Compatibility

Upgrade compatibility

Status: NOT_VERIFIED as a matrix. This page records classifications rather than inventing one.

SharedAudience: operators, reviewers

Purpose

State what is known about mixing versions so operators do not assume an unpublished matrix.

Classifications

Scroll sideways to see the full table. Use the arrow keys when focused.

TopicClassificationOperator consequence
MIXED_VERSION_SUPPORTNOT_VERIFIEDDo not run new Agents against an old Manager (or the reverse) as a supported topology
AGENT_MANAGER_COMPATIBILITYNOT_VERIFIEDHeartbeat and rule sync exist; no certified skew window
DATABASE_BACKWARD_COMPATIBILITYNot supportedNew schema is not documented as readable by old Manager
DOWNGRADE_SUPPORTNot supported-migrate is forward-only
Hosting profile v1 ↔ v2 on one AgentNOT_VERIFIED per pairUse release-documented preflight only
Community Manager + Enterprise Hosting AgentNot supportedHosting is Enterprise-only
PostgreSQL majorNot a published customer matrixCommunity README 15+; Enterprise gates observed 16
OS/kernelNot a published customer matrixREADME 4.15+/5.4+ vs Agent example min_kernel_version 5.8.0
Path prefixes across releasesUnresolved product contract/etc/zcs vs /etc/zwall-manager vs /etc/zwall-hosting
Listen port vs zwallctlUnresolved product contract8443 example vs default 8080

Data/control flow that operators mix at their own risk

  • Agent JWT (auth.agent_token_ttl example 8h) against a Manager that rotated jwt_secret without Agent re-enroll
  • eBPF object SHA vs ebpf.verify_artifact_integrity
  • Hosting loader object SHA (ZWALL_HOSTING_EBPF_SHA256) vs Agent profile version
  • Rule protobuf/JSON types (BLOCK_IP_INBOUND, ALLOW_IP, …) if a new type is assigned to an old Agent

None of those have a published compatibility table.

Common misconceptions

  • “Canary updater is the Enterprise upgrade.” It is implemented and not the production path.
  • “I can leave half the fleet on the previous Agent.” Not certified.
  • "UID/GID filtering is a versioned customer contract." That contract is unresolved — do not include it in upgrade acceptance.