Reaching one application from another
Applications on the same Home Assistant reach each other over its internal network by hostname, never atlocalhost. Each one’s hostname is 2dd33fbd- followed by its slug: qBittorrent is http://2dd33fbd-qbittorrent:8080, NZBGet is http://2dd33fbd-nzbget:6789.
2dd33fbd is the hash Home Assistant takes of the repository’s address as it was added, ignoring case. It holds on every install that added the address as given. One added with a trailing slash or .git gets another prefix, and an application from another repository has its own. The Hostname on an application’s Info tab is always the right one.
A port only other applications use, such as Byparr’s or FlareSolverr’s, is left closed on your network. Applications reach it either way; open it under the application’s Network settings only if something outside Home Assistant needs it.
Updates
Home Assistant offers an update when an application’s version moves, and nothing else here changes one.1
Upstream releases
Renovate watches each upstream project’s releases and opens a pull request moving the pinned version.
2
The bump merges
A patch or a minor merges on its own once the image builds. A major, a minor of a project still below 1.0, and a feature release of Authentik wait for a person to read upstream’s notes.
3
A release is cut
release-please writes the changelog, with upstream’s own notes under Upstream changes, and raises the application’s version.
4
Home Assistant offers it
The image is published at the new version, and Home Assistant shows the update.
Authentik migrates only from its previous feature release, so its releases ship one feature release at a time. Update it when the update is offered rather than letting several pile up.
Two architectures, one image
Each application publishes a multi-architecture image,ghcr.io/kanso-labs/home-assistant-application- followed by its slug, covering aarch64 and amd64. Tdarr and Seadexerr publish none and are built on your Home Assistant.
Storage
An application is given write access only where it actually writes. Radarr and Sonarr get/media and /share, because moving and renaming files is their job. Prowlarr manages indexer definitions and gets neither. Every application’s documentation has a Storage table of each path it maps, the access it has and what it holds there.
The download clients write under /share, which Radarr and Sonarr see at the same path, so no remote path mapping is needed between them.

