Reverts the mount-only auto-refetch — it still ran host shell, Docker,
DB, and SSH log-tail work before the user asked for it, just once
instead of on every filter change. Back to fully manual: nothing runs
until Check/Re-check is clicked, matching the panel's own copy
("Nothing runs automatically — click to check").
Tightens a handful of two-line comments left over from earlier
iterations (Health tab / failed-deployment classification) down to
one line each, no behavior change.
Server diagnostics tab (Docker dashboard) with:
- Per-network IP usage: subnet capacity vs. containers in use, including
reserved networks like dokploy-network which are excluded from the
managed Networks tab. Surfaces read errors instead of silently showing
zeroes when the Docker API call fails.
- Broadened daemon-error detection and failure classification for Swarm
network failures: IP pool exhaustion on an existing network
("could not find an available IP", "task allocation failure") and
network attach timeouts ("attaching to network failed", "context
deadline exceeded") — both previously fell through as Unclassified.
Verified end-to-end against a real systemd-managed dockerd.
- Failed-deployment rows now carry the raw log tail used for
classification, shown on hover and linked to their service/project,
so a guess (or lack of one) can be verified against the actual error
and followed straight to the app.
- Daemon-error panel is a read-only code editor, always visible (not
hidden when empty), prefixed with the actual "Logs from X to Y"
window passed to journalctl so the --since window can be verified.
- "Download report" exports everything on screen (metrics + raw logs)
as Markdown, so a customer can send one file instead of a screen-share.
- Health check now IS_CLOUD-gated the same way network sync already is:
a cloud org can no longer omit serverId and have the check silently
run against the shared platform host instead of their own server.
Includes an inotify diagnostics card (current vs. max_user_instances/
watches/queued_events) and a failed-deployments log with automatic
cause classification based on daemon/log error patterns.
SCIM provisioning created users with emailVerified: false, so better-auth
refused to link the matching SSO account (account_not_linked), and the
resulting redirect landed on better-auth's bare /error page with no
actionable feedback.
- Mark SCIM-provisioned users as email-verified at creation time, same
trust rationale already applied to admin-invited credential users.
- Sync a SCIM user's membership role to the organization's configured
default role instead of the hardcoded "member" the SCIM plugin creates.
- Set errorCallbackURL/onAPIError.errorURL to the sign-in page so failed
SSO/OAuth callbacks land back on Dokploy's UI instead of better-auth's
generic error page.
- Read the error query param on the sign-in page and show it through the
existing AlertBlock instead of failing silently.
Fixes#4973
Radix locks scroll on <body>, but the dashboard's actual scroll
container is the sidebar's <main data-slot="sidebar-inset">, so the
background stayed scrollable behind dialogs/sheets. Extend the lock
to that container using the same data-scroll-locked attribute Radix
already sets.
Fixes#5064
The docker container terminal did not load xterm's ClipboardAddon, so
pasting into it (e.g. a MariaDB shell) broke the cursor and left the
pasted text uneditable. The web server terminal already loads this addon;
this brings the container terminal in line with it.
Also dispose the terminal on cleanup so its addons don't leak on remount.
Fixes#5065
- Images tab: list, inspect and delete docker images, with a
force-delete fallback when an image is in use.
- Disk Usage tab: docker system df summary as stat cards plus a
Build Cache table (docker system df -v) with a prune action.
@aws-sdk/client-secrets-manager (pre-existing, unrelated to any recent
PR) transitively pulled @smithy/fetch-http-handler + @smithy/core
versions published the same day, with no older compatible version to
fall back to. AWS SDK v3 is dozens of interdependent packages often
published together same-day, so a global minimumReleaseAge with no
per-scope threshold (pnpm only supports all-or-nothing exclude) was
going to keep breaking builds on any lockfile touch. Commented out
rather than deleted -- left for whoever wants to revisit it, see
discussion on #4679.
Also lets @aws-sdk/client-route-53 and @aws-sdk/client-secrets-manager
resolve to their actual latest versions now that nothing blocks it.
Adds a new Events tab to /dashboard/docker showing Docker daemon
events (equivalent to `docker events`), polled via docker.getEvents
with a time-range selector and refresh button.
Also fixes a stale isCloud redirect that forced the Networks tab
back to Containers even though it is now shown in cloud.
The endpoint field let anyone with dnsProvider create permission point
the AWS SDK at an arbitrary URL (loopback, link-local, internal
network, cloud metadata), turning testConnection and every other
Route53 operation into an SSRF oracle. There's no way to keep
LocalStack-style testing working while blocking that, since the
target address is identical either way, so the field is removed
entirely rather than validated. Route53 always talks to real AWS now.
Also pin @aws-sdk/client-route-53 to ^3.1097.0 (matching the existing
client-secrets-manager pin) instead of whatever caret-latest resolved
to at install time. The version that landed in the merged PR was
published less than a day before this, which violates the
minimumReleaseAge policy that merged into canary around the same time
and broke the Docker build.
* ci: update pull request actions for node 24
Что:
- Обновлены actions checkout, setup-node и pnpm/action-setup в Pull Request workflow до v5.
Зачем:
- Убрать Node.js 20 deprecation annotations из pr-check jobs и использовать actions с Node.js 24 runtime.
Риски:
- Не выявлены; изменение ограничено версиями GitHub Actions без изменения команд workflow.
Проверки:
- Команды и результаты: gh api action.yml для actions/checkout@v5, actions/setup-node@v5 и pnpm/action-setup@v5 подтвердил runs.using node24; git diff --check прошел; ruby YAML parse .github/workflows/pull-request.yml вернул yaml ok; go run github.com/rhysd/actionlint/cmd/actionlint@latest .github/workflows/pull-request.yml прошел без diagnostics; независимый Agent Flow reviewer вернул pass.
- Ограничения: Локальные build/test/typecheck не запускались, потому что изменение касается только GitHub Actions workflow versions.
What:
- Updated checkout, setup-node, and pnpm/action-setup actions in the Pull Request workflow to v5.
Why:
- Remove Node.js 20 deprecation annotations from pr-check jobs and use actions with the Node.js 24 runtime.
Risks:
- None identified; the change is limited to GitHub Actions versions without changing workflow commands.
Checks:
- Commands and results: gh api action.yml for actions/checkout@v5, actions/setup-node@v5, and pnpm/action-setup@v5 confirmed runs.using node24; git diff --check passed; ruby YAML parse .github/workflows/pull-request.yml returned yaml ok; go run github.com/rhysd/actionlint/cmd/actionlint@latest .github/workflows/pull-request.yml passed with no diagnostics; independent Agent Flow reviewer returned pass.
- Limitations: Local build/test/typecheck were not run because the change only touches GitHub Actions workflow versions.
* ci: update format actions for node 24
Что:
- Обновлены actions/checkout и pinned autofix-ci/action в format workflow до Node.js 24-compatible версий.
Зачем:
- Убрать оставшуюся Node.js 20 deprecation annotation из autofix.ci после исправления pr-check workflow.
Риски:
- Не выявлены; изменение ограничено версиями GitHub Actions без изменения formatter-команды.
Проверки:
- Команды и результаты: gh api action.yml для autofix-ci/action@v1.3.4 подтвердил runs.using node24; git ls-remote подтвердил SHA c5b2d67aa2274e7b5a18224e8171550871fc7e4a для tag v1.3.4; git diff --check прошел; ruby YAML parse для pull-request.yml и format.yml вернул yaml ok; go run github.com/rhysd/actionlint/cmd/actionlint@latest .github/workflows/pull-request.yml .github/workflows/format.yml прошел без diagnostics; независимый Agent Flow reviewer подтвердил корректность полного local diff и отметил, что fix нужно опубликовать.
- Ограничения: Локальные build/test/typecheck не запускались, потому что изменение касается только GitHub Actions workflow versions.
What:
- Updated actions/checkout and the pinned autofix-ci/action in the format workflow to Node.js 24-compatible versions.
Why:
- Remove the remaining Node.js 20 deprecation annotation from autofix.ci after fixing the pr-check workflow.
Risks:
- None identified; the change is limited to GitHub Actions versions without changing the formatter command.
Checks:
- Commands and results: gh api action.yml for autofix-ci/action@v1.3.4 confirmed runs.using node24; git ls-remote confirmed SHA c5b2d67aa2274e7b5a18224e8171550871fc7e4a for tag v1.3.4; git diff --check passed; ruby YAML parse for pull-request.yml and format.yml returned yaml ok; go run github.com/rhysd/actionlint/cmd/actionlint@latest .github/workflows/pull-request.yml .github/workflows/format.yml passed with no diagnostics; independent Agent Flow reviewer confirmed the full local diff is correct and noted that the fix needed to be published.
- Limitations: Local build/test/typecheck were not run because the change only touches GitHub Actions workflow versions.
Route53 rejects the literal "@" (RRSet with DNS name @. is not
permitted); Cloudflare happens to accept it, but relying on
provider-specific handling of that shorthand isn't safe. Resolve it
client-side to the zone's actual domain name before building the
create/update payload.
Lets you connect a DNS provider and manage its records (create,
update, delete) from Settings -> DNS Providers, instead of doing it
by hand in Cloudflare/AWS.
- dns_provider table, org-scoped, jsonb config as a discriminated
union per provider type
- Cloudflare adapter (REST, bearer token)
- Route53 adapter (AWS SDK, SigV4); records are identified by
type:name since Route53 has no native record id, so update
handles renames as delete-old + upsert-new
- listZones/listRecords/createRecord/updateRecord/deleteRecord/
testConnection wired through a shared DnsClient interface
- Settings UI: provider management, zone browser, record CRUD,
IP-fill dropdown for A records (panel IP + remote servers)
- Access control: dnsProvider resource wired into custom roles
- Unit tests for both adapters and the config mask/merge logic
Monitoring was the only component still using docker.createContainer
directly instead of docker.createService like every other Dokploy
component (postgres, traefik, forward-auth, etc). This meant it never
benefited from Swarm's own reconciliation, relying only on Docker's
restart policy with no self-healing if the daemon didn't come back
cleanly after a reboot.
Also removed the try/catch that silently swallowed setup errors,
which made the UI report success even when the container/service
failed to start.
Fixes#4986. initCancelDeployments blindly marked every 'running'
deployment as 'cancelled' on boot, including schedule runs whose
actual work (docker exec into another container, or SSH to a remote
host) is decoupled from the Dokploy process and keeps running after
a restart. Now only deployments with no schedule, or schedules of
type dokploy-server (a real child process), get cancelled.
Also resolve any stale 'running' deployment for a schedule when a
new run starts, so restarted panels don't leave ghost 'running' rows
forever.
dockerSafeExec's busy-wait matched any process with "docker <letter>"
anywhere in its argv (e.g. Grafana's --packaging=docker cfg:...),
causing the wait loop to spin forever. Anchor the match to the actual
docker binary (argv[0]) instead, and add a MAX_WAIT ceiling so a
genuinely stuck docker process can't hang cleanup indefinitely either.
Also log failures in cleanupAll's catch instead of swallowing them,
since the scheduled cleanup path only goes through this function.
Fixes#5044
Adds Scaleway Secret Manager as a first-class vault provider alongside
HashiCorp Vault/OpenBao, Infisical, AWS, Doppler and Azure Key Vault.
- New `scaleway` provider type, zod-validated config (region, project ID,
API secret key, overridable API URL) and migration adding the enum value
- Plain `fetch` client (no new dependency) against the Secret Manager
v1beta1 REST API: access-by-path for reads, paginated listing for the
env editor autocomplete, and a connection test
- Refs are `[folder/]name[:field]` — the field selector extracts a key
from JSON/key-value secrets, like the AWS provider
- Secret key masked in API responses like every other provider credential
- Settings -> Secrets form with region picker, brand icon and reference
format help
Narciso