Traefik and Caddy routes of applications now retry a failed connection
on another container, and the rolling update waits a configurable drain
time (default 5 seconds) after the new container is healthy before it
stops the old containers. The wait is skipped when no old container runs
or when the proxy labels changed, because the proxy drops a route that
two containers define differently.
Fixes#8627
A normal delete now removes a resource from Coolify also when its server
is not reachable, so the separate option only left untracked containers
running. The danger zone button is gone, and the services API rejects
delete_from_coolify_only with 422 instead of ignoring it, so old clients
do not delete Docker resources they asked to keep.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Bring back the #120e1a sidebar with its brand wash, lavender tiles, edges,
Search, section labels, and account menu in the default dark theme.
- Keep the neutral sidebar rules for custom themes.
- Set the Coolify preset sidebar to #1a0f2d, the color the dark sidebar shows.
- Update DESIGN.md to match.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The Compose file read uses a sparse clone without a checkout, so submodules
were never cloned. Now only the submodule that contains the Compose file is
cloned, with the credentials of the clone.
Closes#11018
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Do not ignore errors of the docker stop and rm commands, so a failed SSH call
does not mark a running application as exited.
- Log the failure and broadcast ApplicationStopFailed; the application page
shows an error toast.
Closes#11063
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Each Docker Compose service image now has its own retention, images used by
any container count as in use, and applications with an active deployment
keep all their images.
Closes#11069
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Regression test for #11065. Since v4.3.15 (#11594) preview domains are
stored without the internal port, and every deployment regenerates them
before the ready comment is posted.
The preview Domains component parsed the compose file on every render,
also on the 2-second DNS poll. Each parse queues a ServerFilesFromServerJob,
so a new file sync ran each time a worker started the previous one.
- Parse the compose services once on mount and on save, and keep them in
a locked property.
Refs #11062
- Applications: is_container_label_readonly_enabled (turning it back on
regenerates labels), include_coolify_default_variables, and
dockerfile_target_build on create.
- Databases: save is_log_drain_enabled on update instead of dropping it,
include_coolify_default_variables, and disable_local_backup on backups
(only with save_s3).
- Services: include_coolify_default_variables, and redirect on service
applications (www/non-www needs both hosts).
- Servers: wildcard_domain, server_timezone,
backup_compression_cpu_percentage, and the proxy error page.
Closes#11092
Position every listbox panel with position: fixed so overflow containers
such as modal bodies no longer clip it or add a scrollbar. The portal
prop now only teleports the panel to the body.
Closes#11529
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
When "docker version --format json" did not return clean JSON (for
example, text from a shell startup file), validation stored 0.0.0 and
said that Docker was older than version 24. Validation now stores no
version and tells the user to run the command on the server. When the
version is too old, the message shows the detected version.
Closes#11089
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The legacy configuration hash encoded serialized environment variable rows,
so hashes from older versions never matched after an upgrade, and the
fallback compared the configuration with an empty one. Apps without a
deployment snapshot now report no pending changes, and their next
deployment rebuilds the image.
Closes#11101
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The rollback image list inspected a container named after the bare
application UUID, so `current` was null for timestamped, prefixed, and
custom-named containers. Find the running production containers by their
owner labels instead.
Closes#12296
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A reverse proxy that forwards only port 8000 (for example Tailscale Serve or a Cloudflare Tunnel without path rules) sent /app/ and /terminal/ws to Laravel. Proxy them to Reverb (6001) and the terminal server (6002) in the container.
Closes#11707
Laravel runs failed() on a fresh copy of the job, so the in-memory
newVersionIsHealthy flag was always false there and a failure after the
old container stopped removed the only running container. Keep the flag
in the cache, keyed by the deployment UUID.
Closes#12253
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Mosquitto 2.1 opens the file for `mosquitto_passwd -c` with O_EXCL, so
the template failed with "File exists" after `touch`. Delete the file
before `-c`, so each start writes a new file with only the current user.
Closes#11691
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
pg_dump ran with --no-acl --no-owner, so single-database backups lost
all GRANTs and a restored Supabase database did not work. The import
already skips owners and privileges unless "Keep owners and privileges"
is selected, so the backup now keeps them.
Closes#12244
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Sentinel keeps raw samples for the last 24-48 hours and one-minute
averages before that. LTTB buckets by point count, so 7-day and 30-day
charts gave most points to the raw part. Average those ranges per
minute before LTTB.
Closes#12281
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Drop chrome, minio, and redis, which v6 no longer uses. Switch to the
v6 variables (APP_URL, AUTH_SECRET, ENCRYPTION_SECRET, FLAG_*), store
uploads in a volume at /app/data, use Postgres 18, and check /api/health.
Closes#12282
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Wait for each ifconfig.io lookup alone instead of through
Process::concurrently(), which throws on the first timeout and discards
the sibling result. Add --max-time 10 so a stalled lookup ends early.
Closes#12275
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ROOT_USERNAME with a space (or a password with #, $ or quotes) was written
unquoted, so phpdotenv failed to parse .env and Coolify returned HTTP 500.
Closes#12276
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
On a fresh install, install.sh removed every authorized_keys line that
contained "coolify", including unrelated operator keys such as one
commented "coolify-disposable". Remove only lines whose comment is
exactly "coolify", the comment of the installer's own key.
Closes#12278
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Dashboard: projects and servers fill the left, recent deployments sit in a
fixed-width right column; cards stretch to fill rows; the server table shows
live CPU and memory usage when metrics are on.
- Deploy canvas: purple accent in dark mode, the Steps panel floats over the
canvas, and both canvases use the flask beta icon.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Do not check database port mappings in a bundle: the UI checks them
only since March 2026, so older servers could not be transferred, and
the values stay on the server owner's own host.
- The dev .env runs Cloud mode, where the import check refuses private
addresses. reset.sh now allows the VM network of A on both instances.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Import:
- Check every uuid in a bundle against a strict id format before any
write, and quote the SSH mux socket and key paths in local shell
commands. A bundle uuid could run commands in the Coolify container.
- Validate bundle fqdns, git source URLs, paths, networks, cron
expressions, and database ports; cap the number of items.
- Do not confirm that another team has a uuid.
- Refuse a project icon path with a uuid that is not a plain id.
Claim, finish, and migrate:
- Pass checklist step keys to wire:click with Js::from (stored XSS).
- Link only to https target server URLs.
- Validate target_instance_url in /transfer/complete; never prefill an
unverified URL for a transfer back; scope the transfer-back token to
write+deploy for 1 hour.
- Release on an owner marker only when it is newer than the own claim.
- Do not touch apps that only use the server as an additional
destination when an archive is released or deleted.
- Give Sentinel a new token on claim.
- Add a checklist step to remove the previous instance's SSH key.
- Block a transfer while backups or scheduled tasks run.
- Authorize refreshMigration and PrivateKey checkConnection, clear
tokens from Livewire state, hide migration log/error from members.
Archives:
- Refuse ip, user, port, private key, and Cloudflare tunnel changes.
- Throttle Enable management and require a free server slot for it and
for a transfer back.
- Skip cloud provider calls.
- Re-read force_disabled before each SSH command, so running jobs stop.
- Probe the import check target at the resolved address only.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
