Skip to navigation
Reference

Limitations

Rivet is experimental. This page collects the current gaps in one place.

Platform

  • Managed hosts must run Ubuntu 24.04 on x86_64 or ARM64 with systemd. Applying changes requires root.
  • There are no packaged releases. Build from source; to drive Linux hosts over SSH from a Mac, also build a Linux binary yourself. See installation.

Language

  • No variable validation blocks, --var flag, or environment-variable inputs. Variable files and data hierarchies are never discovered automatically; pass them with --vars-file or --data-hierarchy.
  • Variable defaults must be integers, not fractions. Fractional numbers work in expressions.
  • These Terraform functions are excluded because they depend on the clock, randomness, or the home directory: timestamp, plantimestamp, uuid, bcrypt, pathexpand. Also excluded: ephemeralasnull, type, the deprecated list and map, and provider:: namespaced functions. See functions.
  • There is no cron resource. Use timers.

Releases and agents

  • Releases include only the top-level *.hcl files and resource assets. Modules, extra files read by file() or templatefile(), --vars-file, and data hierarchies are not supported there, so variables need defaults. Use direct rivet compile when you need those features.
  • Releases are not signed. Anyone who can write to the storage bucket can change what hosts receive.
  • There is no secret lookup service, certificate issuance or renewal, staged fleet rollout, cache quota, or garbage collection of old releases and cached files.

Compatibility

  • Bundles, the configuration language, journals, and the SSH runner protocol each have exactly one supported version. Other versions are refused, never migrated. There is no backward-compatibility promise yet.
  • Plugins are pinned by exact implementation identity, so changing a plugin release means recompiling.

By design

These are deliberate, not gaps:

  • No rollback or host-wide transaction. Each resource is applied and verified individually. A failure blocks dependent resources; unrelated ones continue. See plan and apply.
  • Refreshes are delivered at least once. After an interrupted run, a restart or refresh-only command can run again. See recovery.
  • Removing a declaration doesn’t remove the object. Deleting a resource from your configuration stops managing it. To remove something from the host, declare it with ensure = "absent".
  • Sensitive values are redacted, not encrypted. Bundles contain secrets in plain text; protect them like the secrets themselves. See bundles.
  • Commands are not sandboxed. Exec commands, guards, and file validators run with the runner’s authority. Review configuration as you would any root-level script.