Hostveil / Docs / Roadmap

Roadmap

Where detection coverage is headed, and what is deliberately staying out of scope. Not a schedule — a tool that will not publish a figure it has not measured is not going to publish a date it cannot keep.

How coverage has grown so far

A new detection domain is a bigger change than it looks from the outside: a new axis, funded by taking weight from every existing domain, so it does not ship often or quietly. Every one that has shipped is a named release, not a line in a patch note.

1. 3.1.0 — self-hosted AI agent runtimes (OpenClaw, Hermes Agent): a reachable gateway, a disabled sandbox, credentials readable by more than their owner.
2. 3.6.0 — kernel hardening: eight sysctl values read straight from /proc/sys.
3. 3.8.0 — the Docker daemon itself: an unauthenticated TCP API is root for anyone who can reach the port, and nothing before this domain looked at the daemon underneath your containers.
4. 3.9.0 — service hardening: the units you installed yourself, read as systemd’s own effective configuration rather than what a file says.
5. 3.22.0 — a reverse-proxy domain: nginx read out of /etc/nginx, Traefik read out of the Compose files the container domain already discovers — the component in front of everything else hostveil checks, and the one nothing had looked at.

Everything between those releases — and there is a lot of it — is new findings, fixes and interface work inside the domains that already exist. That is the far more common kind of change, and it is what most releases in the changelog are.

Next up

Low cost, same shape as what is already there — an entry in an existing registry, not a new domain or a new axis weight.

1. More self-hosted AI agent runtimes. The agent domain is built to name a runtime as data, not code — adding a third one is an entry in a registry, the same shape as OpenClaw and Hermes Agent are today.
2. More reverse proxies. The proxy domain reads nginx and Traefik configuration today; Caddy is the next name self-hosters ask for.
3. Wider distro coverage for the measurement harness. scripts/measure/seed.sh seeds Debian, Fedora and Alpine today through one distribution seam; a distro that resolves through that seam is one that can be measured, not just claimed to work.

Under exploration

Bigger changes, still being designed rather than committed to a release. Listed here so a duplicate feature request has somewhere to look first, not as a promise.

1. Proxmox VE host hardening. A hypervisor host is still a Linux host with a config surface — pveproxy, cluster join secrets, storage permissions — architecturally the same shape as the Docker daemon or systemd domains above. The most likely next whole domain.
2. Single-node k3s/k0s hardening. Not a Kubernetes cluster manager — the common homelab pattern of one box running one node — scoped to the kubelet and API server flags a single-host audit can actually see.
3. A fleet view across hosts you already reach over SSH. The read on “multi-host management” that does not require an account, a server, or a database: one local Hostveil calling hostveil scan --json on each host over SSH you already trust, and laying the scores side by side in the TUI or the dashboard. No new service to run, because that is the one line this project will not cross — see below.
4. Languages beyond English and Korean. The Korean site carries its own font subset and a test that checks every glyph on the page has one; a third language needs the same rigor, not just a translated string table.

Not planned, on purpose

Ruled out by what Hostveil is, not missing because nobody got to it yet — the same standard the product itself is held to.