coollabsio/coolify v4.5.0 on GitHub

Features

Added Gitea App sources to deploy private Gitea repositories (#12234)
Added server patching (beta) with automatic security updates per server, reboot and risky package warnings, and patch status in the server list
Added a fleet Metrics page with server and container tables, trend charts, and one-click enable (#11867, #12162)
Added disk, network, and load charts to the server metrics page (#11867)
Added a Canvas view on the dashboard with interactive resource views, active deployments, and team avatars (#12160)
Added a file browser for applications, services, and databases (#11518, fixes #6519)
Added passkey sign-in (#12154)
Added custom proxy error pages and maintenance mode for applications and services (#12112)
Added hashing options for HTTP basic authentication on the proxy (#12086)
Added optional permanent redirects for applications and services (#12233, closes #6032)
Added a configurable Traefik certificate resolver per server, with an override per resource
Added server creation on Hostinger VPS (#11176)
Added Cloudflare tunnel setup with stored API tokens (#12157)
Added an automatic backup of the Coolify database before an update (#12093)
Server transfers to another Coolify instance now run in the background (#12180)
Added deployments from GitLab system hooks, so each project no longer needs its own webhook (#12185)
Added MCP tools to manage resources (#12163, closes #11281, #11881)
Added Smart scan to detect the build pack, Dockerfiles, and environment variables for new Git projects (#8502)
Added a cache flush for Redis, KeyDB, and Dragonfly databases (#11513)
Added city-level traffic analytics with sortable tables (#12158)
Added rollback to Docker registry images of recent deployments
Added an interactive console mode (docker attach) to container terminals (#11538)
Added an AWS CloudWatch (awslogs) log drain (#11972)
Added opt-in commit details to deployment emails (#12030)
Added a per-resource option to restore the Coolify default environment variables
Added a configurable request timeout for Infisical and Vault secret managers (#12270)
Added the app-key:reencrypt command to re-encrypt stored secrets after an APP_KEY rotation
Added server GPU detection in the GPU settings
Added a Detect button for the instance public IPs
Added connecting resources to a tag from the tag page
Added a text view for logs and grouped the log toolbar into menus
Added a compact deployment history beside the deployment logs, with switching between deployments without a page load
Added log exports with secrets hidden, and redacted application secrets in the full log download
Added Deployment and Service selectors for runtime logs, with replica containers merged into one stream (discussion #12176)
Added YAML syntax highlighting for dynamic proxy configurations and file mounts
Added pagination with an adjustable page size for Docker images on a server
Added a copy button to password inputs

Fixes

Security

Plaintext secrets are now encrypted at rest
PHP-based service templates were disabled for CVE-2026-109618 and CVE-2026-109619, then enabled again with patched images (#12268)
System-wide Git sources are now restricted to instance admins (#12164)
Deployment queries are now scoped to the applications of the team (#12195)
The MCP endpoint now enforces the allowed IPs
Server transfer bundle exports now require update access
Read-only credentials are no longer saved from client input
S3-compatible avatars and icons no longer use unauthenticated public URLs (#11865, fixes #11806)
Custom log drain configurations are now validated (#12197)
URL redaction no longer spans multiple log lines (#12238, fixes #11066)

Deployments and builds

Railpack builds no longer leave an idle BuildKit builder running (#12097, fixes #11770, #12077)
Environment variable values are now passed to containers exactly as entered, and existing variables keep the old escaping (#12024, fixes #7635)
Build pack variables set at start time are kept in the runtime environment (#12025, fixes #11628)
Transient GitHub token and clone failures are now retried
Same-repository PR previews deploy regardless of the author association
GitHub watch paths now use the net change of a push and paginate PR files
GitHub webhooks are routed to the source of their app installation
Closed Bitbucket, GitLab, and Gitea pull requests are cleaned up after a target branch change (#12008, #12012, #12013, fixes #12007, #12010, #12011)
Compose preview storage records are deleted on cleanup (#12006, fixes #12005)
Preview URL templates no longer have a doubled scheme
Locally built Compose images are no longer pulled before a stop
A deployment timeout now logs the configured timeout
Deploy key setup works with a custom SSH username, and ssh:// repository URLs accept custom ports
GPU settings now work in Docker Compose deployments

Docker Compose and storage

Compose environment variable semantics are preserved (#11794, fixes #12057)
Long bind options and non-creating bind sources are preserved (#12135, fixes #11882, #12036, #12079)
${VAR:-default} bind sources are resolved, and long-form bind sources with variable or vault references are kept (#12227, fixes #8854)
../ bind sources are resolved in raw Compose mode
A UTF-8 BOM is removed before Compose YAML is parsed (#12223, fixes #6777)
Compose commands use explicit file paths and remove volumes by name (#12199)
Quoted and hyphenated custom Docker option values are parsed correctly (#12208, fixes #8173)
SERVICE_URL_* stays on the named service domain, and a SERVICE_FQDN_ twin is treated as a copy
Service URLs set through the API persist across Compose re-parses

Proxy and domains

Running proxy status from Sentinel push updates is saved (#12237, fixes #11539)
Server-Sent Events streams are excluded from Traefik compression (#12229, fixes #5586)
The proxy check requires the coolify-proxy container name outside Swarm (#12225, fixes #7083)
sslip.io domains resolve the server hostname to an IP
noindex is applied to domains that include a port
Absent Let's Encrypt resolvers are cleared during migration

Backups and scheduled tasks

PostgreSQL healthchecks and backups set PGPASSWORD (#12224, fixes #6353)
Backups use the configured databases when the container environment is missing (#12212, fixes #9417)
S3-only volume backups send Content-MD5 for Object Lock buckets (#12215, fixes #12211) and no longer panic in the mc pipe
Volume backups accept tar exit code 1 and skip containers removed during the scan
Scheduled tasks run only in running application containers (#12226, fixes #7377) and skip a run while the previous run is still active
Deleting a scheduled task no longer shows a 404
Backup tables show exact execution times and sort again

API

The fqdn field rejection now points to domains on application writes (#12217, fixes #9502)
force_domain_override is honored for docker_compose_domains on create (#12032, fixes #12031)
Application updates accept dockerfile and github_app_uuid
Database updates apply redis_password and instant_deploy
Service creation accepts connect_to_docker_network
API token creation for MCP works when the REST API is disabled

Servers, Sentinel, and upgrades

Upgrades keep Coolify running when Docker reports IPv6 gateways with a prefix
Rate-limited image pulls are retried and automatic updates are spread over time
The installer no longer restarts Docker with running containers, handles a stopped Docker daemon, and changes data directories only after checks and downloads (#12050)
Sentinel starts on servers with a userns-remap Docker daemon
OS derivatives are accepted through ID_LIKE in server validation
SSH multiplexing orphans are reaped by socket ownership
Docker cleanup removes old Coolify images on Docker 29 and fails executions orphaned by a killed worker
Unreachable servers no longer block dashboard metrics charts
Manually set instance public IPs are kept on restart
Failed server validations are rate limited on Coolify Cloud

Services

Fixed or updated the Appwrite, Forgejo, Hatchet, Hermes, Homepage (#12221, fixes #11758), Huly (#12209, fixes #11004), Langfuse (#12207, fixes #8797), Mixpost, Odoo (#12231, fixes #3441), RabbitMQ, Seafile, SigNoz, Supabase (#12001, #12002, fixes #11998, #11999), Sure (#12228, fixes #11756), Trigger (#12214, fixes #8638), Twenty (#12222, fixes #8381), and Weblate (#12220, fixes #4513) templates
Templates that used removed MinIO images now use pgsty/silo
Containers connect to the predefined network before they start
The container terminal works for degraded services
The Website button links to the project page

Other

Interactive terminal programs no longer leak CPU after close (#12230, fixes #6125)
Telegram test notifications show API errors (#12219, fixes #9978)
Notification and log drain fields are required only when enabled (#12232, fixes #5631, #6123)
Notification channels are disabled after repeated configuration failures
Server names with whitespace work in log drains (#12239, fixes #6406)
The manual Git webhook form is hidden for non-Git resources (#12218, fixes #7514), and GitLab App sources show the webhook setup
Switched teams persist when concurrent requests save the session
Database custom configurations apply on servers with a strict umask
Firefox tab restore no longer switches the theme to custom
Log deployment and service menus stay open on live updates
Fullscreen logs now show above the sidebar and top bar

Improvements

Refreshed the dark mode with the coolLabs purple brand (#12277)
Strengthened secret redaction in logs, with admin controls (#12151)
Reorganized resource settings and domain port editing
Showed the full file path inline and warned about a repeated base directory (#12081)
Backup views now refresh live
Marked Nixpacks as deprecated and recommended Railpack
Added a Projects page to the sidebar and refreshed cards, sidebar, and canvas layouts
Linked to the related settings where a disabled API or a missing GitHub App blocks a feature
Updated Traefik to 3.7.16 and 2.11.60
Removed the Sentry integration

Breaking Changes

API tokens now need the deploy ability to run scheduled tasks, change the proxy or custom log drains, and trigger server side effects such as resource deletion, storage access, provider operations, and database imports (#12194, #12198)
API backup execution messages are hidden unless the token has the read:sensitive or root ability (#12151)
Removed the POST /api/v1/enable API endpoint (#12163)
Docker Compose files with scale or replicas greater than one are now rejected (#12213, fixes #5480)

New Contributors

@johandenhollander made their first contribution in #12013
@anakafeel made their first contribution in #11865
@praetoros made their first contribution in #12032

Full Changelog: v4.4.7...v4.5.0