Require deploy permission for API changes that trigger server side effects, including resource deletion, storage access, provider operations, and database imports. Also escape Docker cleanup filters and sanitize log drain server names.
oldRawParser made the bind directory of a long-syntax source like
../data at {workdir}./data, next to the path that Docker Compose uses.
Resolve the source with replaceLocalSource(), as the compose parsers do,
so Coolify makes the directory that the container mounts. A source that
resolves above / now stops the deployment before remote work.
Closes#4055
Generate now stores the new secret at once. The unsaved bar compares
fields with the saved secrets, so other drafts stay marked as unsaved.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Call updateCompose() after saving an application's fqdn in the services
API urls handler so the domain is written back to the compose file.
Without this, StartService re-parsing the compose before deploy would
drop the domain and its SERVICE_URL_*/SERVICE_FQDN_* variables.
Add a feature test covering persistence after a second parse.
GNU tar exits with 1 when a file changes while it is read. The archive
is still valid, so only exit codes above 1 fail the backup.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
All instances share the same default update cron, so they request the
CDN at the same second and Cloudflare rejects the burst (error 1200).
Queue the CDN fetching jobs with a random 0-600s delay to spread the load.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Add a per-task overlap lock to ScheduledTaskJob that outlives the worker
timeout, so a long or killed run cannot overlap the next cron run.
- Mark the dropped occurrence as skipped instead of releasing the job.
Closes#11648
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A single service deploy with an unchanged config keeps the running
container, which is already on the network. The connect then logged a
false "already exists" error and a warning. Check the container's
networks first.
Closes#11295
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A custom config file written with tee gets the server umask. With umask
027 or 077 the file is not readable by the container user, so MySQL and
MariaDB ignored the whole config without an error.
- Set mode 644 on the MySQL, MariaDB, PostgreSQL, and MongoDB custom
config files after each write.
- Close the multiplexed SSH connection when the server user, IP, or port
changes, so the next command does not run as the old user.
Closes#11600
Docker Engine 27.0 to 28.0.0 reports an IPv6 network gateway with its
prefix length (fd00::1/64) until the daemon restarts (moby/moby#49520).
The Docker CLI 29 and Compose 5 in the helper image reject it, so
deployments failed and the upgrade left Coolify stopped.
- Stop the upgrade before it changes containers when the coolify network
has such a gateway, and tell the user to restart or upgrade Docker.
- Create a new coolify network again without IPv6 when Docker reports
its gateway with a prefix.
- Report an error, not "Upgrade complete", when the new Coolify
containers do not start.
- Add the fix to deployment errors that contain this ParseAddr failure.
Fixes#11583
Create the containers with --no-start, connect them to the destination
network, then start them. A container that crashed before the late
connect was restarting, the connect failed silently, and it never
joined the network.
Closes#11371
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The executions list polled with the task stored as a model, so a poll
after the delete failed to load it and showed a 404. Load the task by id
on each request and skip the refresh when it is gone. Return true from
delete so the confirmation modal does not refresh the deleted task.
Closes#11814
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Skip the pre-stop pull when a custom build command runs without a build server, and pull only services whose image does not come from a build, including services that reuse the image of a build service.
Closes#11773
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Andras Bacsai
