Update to a new version

Use one of three update procedures to upgrade the Agent Identity Security self-hosted application: an easy update that preserves your data, a fresh install that starts clean, or a manual update that preserves data without using the script.
Important: Before you update, back up your config.env file and, if you use file-based encryption, your encryption.key file from the old version.
  • Easy update (preserves data).

    This is the recommended update method. The script detects your existing deployment, uses your current config.env settings, replaces the old container, and keeps your Vault instance, database, and encryption configuration intact.

    # Extract new version
unzip ais-dp-bundle-v1.0.x.zip
cd ais-dp-bundle-v1.0.x

# Copy your old config.env (required)
cp /path/to/old-version/config.env ./config.env

# If using file-based encryption, copy your key
cp /path/to/old-version/encryption.key ./encryption.key

# Run update — automatically preserves your data
sudo ./deploy-docker.sh up
  • Fresh install (deletes all existing data).
    Warning: This procedure deletes all data from the old version. Back up your configuration and encryption key before you proceed.
    # (Optional) Back up old config before cleanup
cd /path/to/old-version
cp config.env ~/config.env.backup
cp encryption.key ~/encryption.key.backup 2>/dev/null || true

# Clean up the old version — enter 'y' to remove data volumes
sudo ./deploy-docker.sh cleanup

# Deploy the new version
cd /path/to/new-version
sudo ./deploy-docker.sh up
  • Manual update (preserves data, no script). 
    # Extract new version
unzip ais-dp-bundle-v1.0.x.zip
cd ais-dp-bundle-v1.0.x

# Copy your old config.env (required)
cp /path/to/old-version/config.env ./config.env

# If using file-based encryption, copy your key
cp /path/to/old-version/encryption.key ./encryption.key

# Stop old container (keeps volumes intact)
docker stop ais-dp-bundle
docker rm ais-dp-bundle

# Load new image
sudo ./load-and-verify.sh

# Get the new image name
docker images | grep ais-dp-bundle

    Start the new container using the same volume names to preserve your database and logs. Replace ais-dp-bundle:v1.0.x with the image name from the previous command.

    For Vault-based encryption:

    docker run -d \
  --name ais-dp-bundle \
  --restart unless-stopped \
  --network ais-network \
  -p 8000:8000 \
  -p 3002:3002 \
  -v ais-dp-postgres-data:/var/lib/postgresql/data \
  -v ais-dp-logs:/var/log/supervisor \
  --env-file config.env \
  ais-dp-bundle:v1.0.x

    For file-based encryption:

    docker run -d \
  --name ais-dp-bundle \
  --restart unless-stopped \
  -p 8000:8000 \
  -p 3002:3002 \
  -v ais-dp-postgres-data:/var/lib/postgresql/data \
  -v ais-dp-logs:/var/log/supervisor \
  -v $(pwd)/encryption.key:/app/secrets/encryption.key:ro \
  --env-file config.env \
  ais-dp-bundle:v1.0.x
    Note: Using the same volume names (ais-dp-postgres-data and ais-dp-logs) preserves your database and logs across the update.