From c5e364dbcb8a08f2323a422e3996a650fe02de6d Mon Sep 17 00:00:00 2001
From: Yash Kumar <hello@yash.run>
Date: Thu, 22 Oct 2026 20:30:53 +0530
Subject: [PATCH] fix(monitoring): gate host monitoring on docker access and
 let docker readers see disk usage

---
 .../components/dashboard/search-command.tsx   | 21 ++++++++++++-------
 apps/dokploy/components/layouts/side.tsx      |  6 ++++--
 apps/dokploy/components/layouts/user-nav.tsx  | 18 +++++++++-------
 apps/dokploy/pages/dashboard/monitoring.tsx   | 17 ++++++++-------
 apps/dokploy/server/api/routers/settings.ts   |  3 ++-
 5 files changed, 39 insertions(+), 26 deletions(-)

diff --git a/apps/dokploy/components/dashboard/search-command.tsx b/apps/dokploy/components/dashboard/search-command.tsx
index 2d066992a..5ff7eccab 100644
--- a/apps/dokploy/components/dashboard/search-command.tsx
+++ b/apps/dokploy/components/dashboard/search-command.tsx
@@ -60,6 +60,9 @@ export const SearchCommand = () => {
 		enabled: !!session,
 	});
 	const { data: isCloud } = api.settings.isCloud.useQuery();
+	const { data: permissions } = api.user.getPermissions.useQuery(undefined, {
+		enabled: !!session,
+	});
 
 	React.useEffect(() => {
 		const down = (e: KeyboardEvent) => {
@@ -183,14 +186,16 @@ export const SearchCommand = () => {
 						</CommandItem>
 						{!isCloud && (
 							<>
-								<CommandItem
-									onSelect={() => {
-										router.push("/dashboard/monitoring");
-										setOpen(false);
-									}}
-								>
-									Monitoring
-								</CommandItem>
+								{permissions?.monitoring.read && permissions?.docker.read && (
+									<CommandItem
+										onSelect={() => {
+											router.push("/dashboard/monitoring");
+											setOpen(false);
+										}}
+									>
+										Monitoring
+									</CommandItem>
+								)}
 								<CommandItem
 									onSelect={() => {
 										router.push("/dashboard/traefik");
diff --git a/apps/dokploy/components/layouts/side.tsx b/apps/dokploy/components/layouts/side.tsx
index 9cbc187b6..c1037d6db 100644
--- a/apps/dokploy/components/layouts/side.tsx
+++ b/apps/dokploy/components/layouts/side.tsx
@@ -192,9 +192,11 @@ const MENU: Menu = {
 			title: "Monitoring",
 			url: "/dashboard/monitoring",
 			icon: BarChartHorizontalBigIcon,
-			// Only enabled in non-cloud environments and if user has monitoring.read
+			// Host stats also need docker.read, which the stats socket requires
 			isEnabled: ({ isCloud, permissions }) =>
-				!isCloud && !!permissions?.monitoring.read,
+				!isCloud &&
+				!!permissions?.monitoring.read &&
+				!!permissions?.docker.read,
 		},
 		{
 			isSingle: true,
diff --git a/apps/dokploy/components/layouts/user-nav.tsx b/apps/dokploy/components/layouts/user-nav.tsx
index aa9747cfb..1a68544f6 100644
--- a/apps/dokploy/components/layouts/user-nav.tsx
+++ b/apps/dokploy/components/layouts/user-nav.tsx
@@ -87,14 +87,16 @@ export const UserNav = () => {
 					</DropdownMenuItem>
 					{!isCloud ? (
 						<>
-							<DropdownMenuItem
-								className="cursor-pointer"
-								onClick={() => {
-									router.push("/dashboard/monitoring");
-								}}
-							>
-								Monitoring
-							</DropdownMenuItem>
+							{permissions?.monitoring.read && permissions?.docker.read && (
+								<DropdownMenuItem
+									className="cursor-pointer"
+									onClick={() => {
+										router.push("/dashboard/monitoring");
+									}}
+								>
+									Monitoring
+								</DropdownMenuItem>
+							)}
 							{permissions?.traefikFiles.read && (
 								<DropdownMenuItem
 									className="cursor-pointer"
diff --git a/apps/dokploy/pages/dashboard/monitoring.tsx b/apps/dokploy/pages/dashboard/monitoring.tsx
index 8ab58e2eb..ba0bf1956 100644
--- a/apps/dokploy/pages/dashboard/monitoring.tsx
+++ b/apps/dokploy/pages/dashboard/monitoring.tsx
@@ -109,13 +109,16 @@ export async function getServerSideProps(
 		};
 	}
 
-	const canView = await hasPermission(
-		{
-			user: { id: user.id },
-			session: { activeOrganizationId: session?.activeOrganizationId || "" },
-		},
-		{ monitoring: ["read"] },
-	);
+	const permissionCtx = {
+		user: { id: user.id },
+		session: { activeOrganizationId: session?.activeOrganizationId || "" },
+	};
+	// Host stats come from the docker stats socket, which requires docker.read.
+	// Checked separately because a member's "Access to Docker" is a legacy
+	// override that only applies when every requested resource has one.
+	const canView =
+		(await hasPermission(permissionCtx, { monitoring: ["read"] })) &&
+		(await hasPermission(permissionCtx, { docker: ["read"] }));
 
 	if (!canView) {
 		return {
diff --git a/apps/dokploy/server/api/routers/settings.ts b/apps/dokploy/server/api/routers/settings.ts
index 504d2ca8e..552860b1c 100644
--- a/apps/dokploy/server/api/routers/settings.ts
+++ b/apps/dokploy/server/api/routers/settings.ts
@@ -80,6 +80,7 @@ import {
 	enterpriseProcedure,
 	protectedProcedure,
 	publicProcedure,
+	withPermission,
 } from "../trpc";
 
 /**
@@ -284,7 +285,7 @@ export const settingsRouter = createTRPCRouter({
 		});
 		return true;
 	}),
-	getDockerDiskUsage: adminProcedure.query(async () => {
+	getDockerDiskUsage: withPermission("docker", "read").query(async () => {
 		if (IS_CLOUD) {
 			return [];
 		}