feat: add upgrade instructions for transitioning to K3s + gVisor

Author: krish-kant

deploy/docker/README.md

@@ -124,6 +124,18 @@ This installs the execution sandbox, creates the `supercheck-execution` namespac
 
 ---
 
+## Upgrading
+
+```bash
+docker compose pull && \
+KUBECONFIG_FILE=/etc/rancher/k3s/supercheck-worker.kubeconfig \
+docker compose up -d
+```
+
+> **Upgrading to 1.3.3 from earlier versions:** This release replaces Docker socket-based execution with K3s + gVisor. Before upgrading, back up your database and run `sudo bash setup-k3s.sh` to install the execution sandbox. See the [deployment guide](https://supercheck.io/docs/app/deployment/self-hosted) for details.
+
+---
+
 ## Backups
 
 ```bash

deploy/docker/setup-k3s.sh

@@ -11,7 +11,7 @@
 #   chmod +x setup-k3s.sh && sudo ./setup-k3s.sh
 #
 # Prerequisites:
-#   - Ubuntu 22.04+ or Debian 12+ (amd64)
+#   - Ubuntu 22.04+ or Debian 12+ (amd64/arm64)
 #   - Root/sudo access
 #   - Internet connectivity
 #

docs/content/docs/app/deployment/self-hosted.mdx

@@ -317,6 +317,31 @@ KUBECONFIG_FILE=/etc/rancher/k3s/supercheck-worker.kubeconfig \
 docker compose -f docker-compose-secure.yml up -d
 ```
 
+<Callout type="error">
+**Upgrading to 1.3.3 from earlier versions** — Version 1.3.3 replaces Docker socket-based test execution with a sandboxed model powered by K3s and gVisor. Before upgrading, you must run the setup script:
+
+```bash
+# 1. Back up your database first
+docker compose exec postgres pg_dump -U postgres supercheck > backup-pre-133.sql
+
+# 2. Install K3s + gVisor execution sandbox
+sudo bash setup-k3s.sh
+
+# 3. Pull new images and restart with kubeconfig
+# Quick Start (HTTP):
+docker compose pull && \
+KUBECONFIG_FILE=/etc/rancher/k3s/supercheck-worker.kubeconfig \
+docker compose up -d
+
+# Production (HTTPS):
+docker compose -f docker-compose-secure.yml pull && \
+KUBECONFIG_FILE=/etc/rancher/k3s/supercheck-worker.kubeconfig \
+docker compose -f docker-compose-secure.yml up -d
+```
+
+The worker container no longer requires the Docker socket. Existing tests and monitors continue to work without modification. If you have remote workers ([Multi-Location](/docs/app/deployment/multi-location)), run `setup-k3s.sh` on each remote server as well.
+</Callout>
+
 ---
 
 ## Architecture