Breaking Changes Require the new delete ability, or root, for every delete through the API and the MCP server, an API token with write alone can no longer delete resources, environment variables, storages, backups, scheduled tasks or tags, or detach a tag Security Harden the CI workflows Require every action to be pinned to a full-length commit SHA, with an Actions setting on GitHub that enforces…
Fixes Kept the Dockerfile HEALTHCHECK of existing applications. Since v4.5.1, the Coolify healthcheck replaced it. Fixed Docker Compose builds that failed with "required variable is missing a value" when a required variable was set only for runtime. (#12363) Fixed Railpack builds that failed when they started at the same time as another build. Removed orphaned SSH connection processes that collect…
Fixes Fixed pull request previews that existed before the upgrade breaking on redeploy. They keep the production values they were first deployed with. New previews use only their own variables. Fixed 503 errors from Traefik during the first rolling update after you saved application settings. The retry proxy labels from v4.5.1 were removed, so the proxy labels are the same as in v4.5.0. Fixed SSH…
Breaking Changes Removed the "Remove from Coolify only" service delete option. A normal delete now works when the server is unreachable, and the services API rejects delete_from_coolify_only with 422. Removed the Highlight log drain because the service ended. Coolify stops its running containers. Features (Self-hosted only) Limited first root account registration to ten minutes after Coolify start…
Features Added Gitea App sources to deploy private Gitea repositories (#12234) Added server patching (beta) with automatic security updates per server, reboot and risky package warnings, and patch status in the server list Added a fleet Metrics page with server and container tables, trend charts, and one-click enable (#11867, #12162) Added disk, network, and load charts to the server metrics page…
ImportantThis release backports the v4.4.7 security fixes to this release line. It is the same security release as v4.4.7, not a separate one. It fixes multiple critical CVEs in dependencies that Coolify uses, so update immediately. TipRun this on your server to update to the security fix release of your line: curl -fsSL https://cdn.coollabs.io/coolify/patch.sh | sudo bash Running Security fix rel…
ImportantThis release backports the v4.4.7 security fixes to this release line. It is the same security release as v4.4.7, not a separate one. It fixes multiple critical CVEs in dependencies that Coolify uses, so update immediately. TipRun this on your server to update to the security fix release of your line: curl -fsSL https://cdn.coollabs.io/coolify/patch.sh | sudo bash Running Security fix rel…
ImportantThis release backports the v4.4.7 security fixes to this release line. It is the same security release as v4.4.7, not a separate one. It fixes multiple critical CVEs in dependencies that Coolify uses, so update immediately. TipRun this on your server to update to the security fix release of your line: curl -fsSL https://cdn.coollabs.io/coolify/patch.sh | sudo bash Running Security fix rel…
ImportantThis release backports the v4.4.7 security fixes to this release line. It is the same security release as v4.4.7, not a separate one. It fixes multiple critical CVEs in dependencies that Coolify uses, so update immediately. TipRun this on your server to update to the security fix release of your line: curl -fsSL https://cdn.coollabs.io/coolify/patch.sh | sudo bash Running Security fix rel…
ImportantThis release fixes multiple critical CVEs in dependencies that Coolify uses. Update immediately. TipEvery v4 line has a security fix release. On v4.4, update from the dashboard: Settings → Update → Check now → Update. We recommend that everyone moves to v4.4.7, because the v4.1, v4.2, v4.3, v4.4 minior releases also include other security fixes that are not backported. To update to a patc…
Fixes Fixed self-hosted startup failures caused by an incompatible PHP base image by pinning it to a stable version (#12141). Full Changelog: v4.4.5...v4.4.6
Fixes Removed the 5 GB free disk space requirement that blocked manual and automatic updates. Full Changelog: v4.4.4...v4.4.5
Features Added optional Cloudflare proxy mode for new DNS records. Added support for public IPv4 and IPv6 addresses in Git repository URLs. Fixes Fixed IPv6 server addresses across connections, URLs, routing, and Hetzner provisioning. Fixed IPv6 connections to public database TCP proxies on IPv6-enabled networks (#12133). Fixed database proxy connections after database IP addresses changed. Preven…
Fixes Fixed static-site pull request previews that failed with a missing Dockerfile error. (#8238) Fixed the empty terminal container picker for resources with multiple containers. (#12110) Fixed nested Base64 custom labels in API updates and deployments. (PR #11473, #11435) Prevented DNS polling from filling the queue with duplicate file-sync jobs and delaying DNS checks and deployments. (#12098)…
Features Added settings search to the command palette, with Global and This page scopes. (#12111) Added GitHub Actions runner support for servers used for both deployments and builds, with shared-resource warnings. (#12109) Added per-server controls to store full, anonymized, or no client IP addresses in traffic analytics through the UI and API. Added Cloudflare Tunnel updates from server settings…
Features Added volume backup success, failure, and warning notifications through team backup notification channels. Added configurable alerts for missing volume backups in the UI and API, with alerts disabled by default. Fixes Fixed deployment progress checks that stayed active after missing queue jobs exceeded the deployment timeout. Included running scheduled tasks and database and volume backup…
This release adds built in traffic analytics for Traefik and Caddy, experimental support for SQLite as a database, readable container names with a configurable container prefix, third-party secret managers, Cloudflare DNS management, OpenID Connect sign-in, GitHub Actions runners on build servers, and Docker registry logins. It also includes many fixes. Added Traffic analytics for Traefik and Cadd…
Features Added a read-only API endpoint to retrieve preview deployment runtime logs by application UUID and pull request ID, with line limits and optional timestamps. (#11884) Fixes Fixed deployment status and metadata processing when remote command output contained leading or trailing whitespace. What's Changed feat(api): expose runtime logs for preview deployments by @andrasbacsai in #11884 Full…
Breaking Changes Removed host-path configuration for persistent volumes from the UI and API. API requests that include host_path are now rejected. Features Added a pull request settings modal with refresh and deployment controls for preview deployments. Added real-time Sentinel synchronization status across server and application views. Added separate options to delete local and S3 archives when a…
Features Made restart limits opt-in for applications, preview deployments, and service applications. Existing resources that still used the previous limit of 10 restarts were reset to unlimited. Fixes Hid application names, server names, deployment URLs, team member emails, and job IDs from the Helper deployment check unless detailed output was explicitly requested. Improvements Updated the suppor…
Features Added an All option to the log viewer and accepted lines=all across application, database, and service log APIs. The existing -1 value remained available for compatibility. Fixes Fixed scheduled backup deletion for service databases so it kept the database context and returned to the correct backup page. Preserved each service component’s stored application or database type when generatin…
Breaking Changes (well not breaking, but kinda, not sure haha) Made Sentinel mandatory on regular servers. Existing regular servers were enabled automatically, and the enable or disable setting became read-only in the UI and API. This is mandatory for upcoming features. Sentinel will have a bigger responsibility. Features Restored each user's last active team after login and added a team picker wh…
Features Added configurable alerts when scheduled database backups missed a set number of days. #11433 closed #11425. Streamed S3-only volume archives directly to S3 so those backups no longer needed temporary local disk space. #11642 Added an instance setting for the CDN URL used to serve stored images such as profile avatars and project icons. Improvements Refreshed the UI with WCAG-compliant co…
Fixes Corrected notification and deployment log links to use the configured instance URL. #11623 Cleaned up orphaned helper containers when helper images used unqualified names, nested registry paths, tags, or digests. #11540 closed #11511. Preserved Docker restart policies when applications, previews, databases, and service applications were stopped without removing their containers. Fixed type e…
Fixes Corrected internal routing and proxy labels for Docker Compose applications and previews to use each service's configured port, with the application port as a fallback. Restored the unsaved-changes indicator when switching label management to manual mode by updating Livewire. (#11612, closes #11265) Routed Telegram alerts for outdated Traefik versions to the configured topic instead of the m…
Features Added per-domain internal port overrides for applications, Docker Compose services, and preview deployments across Traefik and Caddy. Public domain URLs remained portless, while the UI showed effective ports and warned about unrecognized ports. (#11594) Consolidated service database, volume, and directory backups into one page with schedule editing, on-demand runs, combined history, live…
Fixes Fixed standalone Docker destination setup on non-Swarm servers by creating networks with Docker's default bridge driver instead of the Swarm-only overlay driver. Full Changelog: v4.3.13...v4.3.14
Features Added a one-click Executor service template with persistent storage and health checks (#11530). Improvements Served profile avatars and project icons directly from configured S3 storage or an optional CDN, with local routes as a fallback. Fixes Fixed missing service logos in global search and the service catalog by retrying a remote source before showing the default icon. Gave Sentinel st…
Fixes Applied authentication rate limits per real client behind reverse proxies and Cloudflare, preventing visitors from sharing one rate-limit bucket (#11515). Reset a server's unreachable counter after a successful connection check, preventing stale failures and false unreachable alerts (#11417, closes #11416). Corrected placeholder alignment in code editor fields (#11514, closes #11420). Queued…
Features Added asynchronous DNS validation for application and service domains. Added one-click service templates for HashiCorp Vault and Obsidian LiveSync CouchDB. Fixes Restored proxy connections to project networks after host reboots (#11476, fixes #11436). Applied custom Docker options when applications used custom container names, honored selected rollback tags, and respected Compose stop gra…