---
title: "Update"
description: "Update AppSec Portal to a new release with Docker Compose or Helm, by hand or from a CI pipeline."
url: https://whitespots.io/docs/appsec-portal/get-started/update
slug: appsec-portal/get-started/update
publish_date: 2026-10-30T19:42:15.000Z
last_modified: 2026-10-30T19:42:15.000Z
---

# Update

Each release is listed in the install repository with its tag, for example `release_v26.10.1`.
What changed in each release is in the [Release notes](https://whitespots.io/docs/appsec-portal/release-notes).

Updates keep your data. The database migrations run by themselves when the new version starts.
Before a big jump, back up the database (see [Move the database](https://whitespots.io/docs/appsec-portal/get-started/move-database)).

## Docker Compose

In the folder you installed from:

1. Download the new install files:

   ```bash verify
   git pull
   ```

2. Update to the latest release:

   ```bash verify
   sh update.sh
   ```

   The script finds the latest release, downloads its images, saves the version to `.env` and
   restarts Portal. Portal is unavailable for a few
   minutes. The data in `data/` stays. **Update** in `sh launcher.sh` does the same.

To install a specific release instead, open `sh launcher.sh`, then **Settings** → **Danger zone**
→ **Pull and run custom image tag**, and enter the release, for example `release_v26.10.1`.

## Helm

Update the chart repository and upgrade with the same values files you installed with:

```bash verify
helm repo update portal
helm upgrade portal portal/portal -n portal -f values.yaml -f secrets.yaml
```

This installs the latest release. To install a specific one, add `--version`, for example
`--version 26.10.1` for `release_v26.10.1`.

If you installed with `--set` options instead of values files, repeat all of them: settings you
leave out go back to their defaults.

## Update from a CI pipeline

You can run the same steps from any CI tool, for example to update on a schedule or with a
manual button. The pipeline needs access to the server or the cluster, and it keeps your
configuration as secret variables.

For Docker Compose, the job connects to the server over SSH. In GitLab CI:

```yaml
update-portal:
  image: alpine
  when: manual
  before_script:
    - apk add --no-cache openssh-client
    - eval $(ssh-agent -s) && echo "$SSH_PRIVATE_KEY" | ssh-add -
  script:
    - >
      ssh -o StrictHostKeyChecking=accept-new "$SERVER"
      "cd /opt/portal && git pull && sh update.sh"
```

Set `SERVER` (for example `deploy@portal.example.com`) and `SSH_PRIVATE_KEY` as CI/CD
variables, and replace `/opt/portal` with your install folder.

For Helm, the job runs `helm upgrade` against the cluster:

```yaml
update-portal:
  image: alpine/helm
  when: manual
  script:
    - helm repo add portal https://gitlab.com/api/v4/projects/37960926/packages/helm/stable
    - helm upgrade portal portal/portal -n portal -f "$VALUES_FILE" -f "$SECRETS_FILE"
```

Set `KUBECONFIG`, `VALUES_FILE` and `SECRETS_FILE` as CI/CD variables of the **File** type.

---

## Navigation

- Location: [Docs](https://whitespots.io/docs) > [Application Security Portal](https://whitespots.io/docs/appsec-portal) > [Get started](https://whitespots.io/docs/appsec-portal/get-started)
- Previous: [First steps](https://whitespots.io/docs/appsec-portal/get-started/first-steps)
- Next: [Move the database](https://whitespots.io/docs/appsec-portal/get-started/move-database)