v0.2.0

What's new in 0.2.0

Custom model adapter support
You can now run your own adapter alongside the network client. Add these to your .env and run the installer:

ADAPTER_SIDECAR_ENABLED="true"
ADAPTER_SIDECAR_IMAGE="your-registry/your-adapter:tag"

The client and your adapter talk to each other privately — nothing extra is exposed on your network. Needs client version 1.4.0 or newer.

Automatic health monitoring
On client 1.4.0+, Docker now shows a live health status for the container, so you can tell at a glance if it's running properly. Older versions are unchanged and still auto-restart if they stop.

---

How to upgrade

These features are part of this new installer script, so download it first:

curl -fLO https://github.com/PaloAltoNetworks/ai-redteam-network-client-docker/releases/latest/download/setup-panw-network-client.sh
chmod +x setup-panw-network-client.sh
./setup-panw-network-client.sh

The installer then pulls the latest client version for you.

v0.1.13

Added

• Japan region (jp). --init now offers Asia Pacific (Japan), resolving to registry-jp.ai-red-teaming.paloaltonetworks.com.

v0.1.12

Changed

• Tooling only, no behavior change. The script now passes ShellCheck clean and is formatted with shfmt (2-space indent). A CI lint workflow runs both on every push and pull request. Shebang switched to #!/usr/bin/env bash for portability, and three unused variables plus one fragile A && B || C idiom were removed.

v0.1.11

Fixed

• Same silent-exit class as 0.1.9/0.1.10, three more sites. Three command-substitution assignments ran grep under set -euo pipefail without guarding the exit code; when grep legitimately matched nothing, pipefail propagated non-zero and set -e aborted the script. The reported case: a fresh host that had only run --init (no action=install line in deploy.log yet) died right before the interactive version menu. Also hardened the bearer-challenge header parse and the --status image lookup; the latter now warns on a malformed docker-compose.yml instead of printing an empty value.

v0.1.10

Fixed

• The installer could still exit silently right after listing available versions. The 0.1.9 fix covered running_image_tag, but its twin list_local_tags ended in the same bare docker images pipe with no return 0; under set -euo pipefail, a failing docker images (e.g. under sudo) made the pipe non-zero and aborted the script. Both functions now return cleanly.

v0.1.9

Fixed

• The installer could exit silently (exit code 1) right after listing available versions, when a client container was already running from an image that had no local tag. Re-running the script now reaches the version menu as expected, and the --version TAG workaround is no longer needed. Thanks to Matt Zhang for reporting.

v0.1.8

Changed

• Release workflow now pins its GitHub Actions to immutable commit SHAs (actions/checkout v6.0.3, actions/attest v4.1.0) and uses actions/attest directly instead of the deprecated actions/attest-build-provenance wrapper. No change to the generated attestation.

v0.1.7

Added

• Releases are now built by a CI workflow on tag push, attaching a Sigstore build-provenance attestation to setup-panw-network-client.sh. Verify a downloaded copy with gh attestation verify setup-panw-network-client.sh --repo PaloAltoNetworks/ai-redteam-network-client-docker.

Changed

• Install now downloads the script from the latest release (curl -fLO .../releases/latest/download/setup-panw-network-client.sh) instead of cloning the repo. Running from source is documented in the reference guide.

v0.1.6

Fixed

• Removed the broken container healthcheck from the generated docker-compose.yml. The PANW client image is distroless (no /bin/sh or coreutils), so the CMD-SHELL procfs healthcheck could never execute and falsely marked every container unhealthy despite a working connection. restart: unless-stopped plus the client's built-in websocket auto-reconnect already cover resilience; docs now describe host-side log monitoring. (#35, #37)

v0.1.5

What's new in 0.1.5

Improved --debug diagnostics for version selection
Running the setup interactively with --debug now shows how many image versions matched the expected X.Y.Z numbering, plus a short sample of the tags the registry returned. This makes it clear why the script automatically picks the latest version when the registry uses tags that aren't standard version numbers.

Thanks to Koen Vanderpoorten for reporting this.