github coollabsio/coolify v4.5.1
on GitHub

3 hours ago

Breaking Changes

  • Removed the "Remove from Coolify only" service delete option. A normal delete now works when the server is unreachable, and the services API rejects delete_from_coolify_only with 422.
  • Removed the Highlight log drain because the service ended. Coolify stops its running containers.

Features

  • (Self-hosted only) Limited first root account registration to ten minutes after Coolify starts. Restart Coolify to open the window again.
  • Let team owners and admins require 2FA for all team members.
  • Skipped the Compose image build when the images match the build inputs, so runtime-only changes no longer rebuild.
  • Added a four-color custom theme dialog with presets and share codes.
  • Let admins drag project and server zones on the canvases.
  • Reworked the dashboard layout and showed live CPU and memory in the server table.
  • Synced metric chart tooltips across charts and added local or UTC tooltip times.
  • Made live refresh a toggle for every metrics and analytics range.
  • Added compact traffic metrics with scaled latency units.
  • Replaced native number spinners with a branded stepper.
  • Moved the file browser container picker to a header dropdown.
  • Added # coolify: flag directives (literal, buildtime, runtime) to the developer view of environment variables (#12349).
  • Added a "Use path-style URLs" setting to S3 storages for providers that need virtual-hosted-style URLs.

Improvements

  • Stopped 502 errors during rolling updates with proxy retries and a configurable drain time (#8627).
  • Made metrics faster with one Sentinel SSH command and Sentinel-side bucketing (#12300).
  • Stopped syncing file storages on every Compose parse.
  • Made canvas pan and zoom faster.
  • Added a confirmation when you clone with volume data, and stopped the source while data is copied.
  • Verified helper downloads by SHA256 and updated Docker CLI, Compose, Buildx, and Railpack.
  • Updated Sentinel images to 1.1.3.
  • Updated Laravel to 12.70.1, the PHP image to v5.0.3, and Nginx to 1.31.8.
  • Hid container tooling user agents in traffic analytics by default (#12335).
  • Added a DNS menu to the domains toolbar.
  • Explained what 100% CPU means in chart tooltips.
  • Retried connection failures of idempotent HTTP requests, including Cloudflare API calls.
  • Updated Fluent Bit for log drains from 2.0 to 5.1, and restarted running drains when their files change.
  • Fetched Sentinel analytics dashboards of all servers at the same time.
  • Validated new cloud servers automatically when they are running.

Fixes

  • Security: enforced resource permissions for stored secrets and hid locked and admin-only secrets in forms, Compose, and the API.
  • Security: closed holes in server transfer import, claim, and archives.
  • Security: blocked PostgreSQL restore scan bypasses and stopped restores on SQL errors (#12333).
  • Security: enforced GitHub App webhook signatures in the local environment.
  • Security: limited system-wide Gitea sources to instance admins and source app lists to the current team.
  • Security: hid database URLs in API create responses without sensitive access (#12297, fixes #11190).
  • Security: scoped database backup API endpoints to the database type (#12279).
  • Security: used the Cloudflare client IP for API allow-lists and audit logs (#12301).
  • Wrote the generated Compose file after the image build (#12331).
  • Wrote regular deployment files when the repository has symlinks (#12324).
  • Prevented Git fetches from hanging (#12321, fixes #10316).
  • Read the Compose file from Git objects and from Git submodules (#12320, fixes #11018).
  • Allowed safe percent-encoded repository paths (#12319).
  • Stripped paths and ports from COOLIFY_FQDN in env files (#12245, fixes #9649).
  • Used SSH user registry credentials for host image pulls (#12216, fixes #12205).
  • Rebuilt when a build secret value changed.
  • Replaced the Dockerfile HEALTHCHECK when the healthcheck was enabled (#10974).
  • Kept the healthy new container when a rolling update failed late (#12253).
  • Stopped false pending changes (#11101, #12284).
  • Found the current rollback image for containers with any name (#12296).
  • Reported a failed application stop (#11063).
  • Parsed mode suffixes in long-form bind targets.
  • Created one Compose service on repeated submits and rejected Compose without services (#11078).
  • Skipped the PORT mismatch warning when readonly labels were disabled (#10941).
  • Deployed previews with their own environment variables (#12325).
  • Kept custom preview domains on redeploy (#6536).
  • Built the PR commit on manual Bitbucket preview redeploys (#10806).
  • Keyed preview Docker tags by preview ID and stopped the DNS poll from re-queuing sync jobs.
  • Kept open preview volumes out of stale Compose volumes (#10855).
  • Kept locked variables and their preview copies locked with their values (#12299).
  • Kept omitted values and flags when patching env variables through the API (#12240, fixes #9977).
  • Included Infisical imported secrets (#12267).
  • Regenerated proxy labels when the API changed exposed ports (#12334, fixes #11074).
  • Saved is_auto_deploy_enabled for Docker image and Dockerfile apps created by the API (#12339).
  • Wrote file storage content to the server on API PATCH (#12248, fixes #11759).
  • Accepted API settings that the UI can change (#11092).
  • Showed only permitted MCP tools and actions in help and hints (#12295).
  • Kept privileges in PostgreSQL backups (#12244).
  • Signed S3 uploads with the storage region (#12264).
  • Saved removed databases in the backup list (#11548) and explained dumps that stopped without an error (#11549).
  • Identified the instance database backup by ID.
  • Used the instance URL in volume backup notifications (#12285).
  • Kept the proxy status current and stopped auto-start during proxy restarts.
  • Validated servers without a proxy (#11048) and explained Docker Engine version check failures (#11089).
  • Blocked server migration when the target proxy is not running.
  • Replaced wedged SSH multiplexing masters (#12241, fixes #10077, #11130).
  • Proxied realtime and terminal WebSockets on the dashboard port (#11707).
  • Kept new images during Docker cleanup (#11069) and skipped scheduled cleanups during deployments (#12183).
  • Removed orphaned legacy realtime containers.
  • Kept a detected public IP when the other IP family's lookup timed out (#12275).
  • Quoted root credentials in the installer .env (#12276) and kept operator SSH keys that mention coolify (#12278).
  • Reported a failed manual update check (#12266).
  • Passed the cloudflared Access service token to the terminal SSH (#12312).
  • Browsed files in containers without a shell (#12305).
  • Trimmed Telegram bot tokens and chat IDs (#12323).
  • Showed the server timezone in scheduled task help (#10904).
  • Listed production, staging, and development environments first (#12317).
  • Hid deleted resources on the environment page after the redirect.
  • Showed held-back package updates separately.
  • Fixed the filtered tag count in pagination.
  • Recreated the Mosquitto password file on each start (#11691).
  • Updated the Reactive Resume template to v6 (#12282).
  • Fixed server online status (#12289), disk detection (#12315), chart density (#12281), and loading on slow servers in metrics.
  • Fixed checkbox clicks in confirmation dialogs (#12338).
  • Fixed the database image picker (#12337) and server IDs in the new resource wizard (#12327).
  • Floated listbox panels over modals (#11529) and fell back to the default for invalid theme colors (#12287).
  • Fixed sidebar, tooltip, canvas, chart, list, and Compose loading issues in the UI.
  • Kept member API tokens when a member is promoted (#12342).
  • Returned success: false on API access denied responses (#12343).
  • Documented database and resource list responses in OpenAPI, and stopped requiring both environment_name and environment_uuid on create endpoints (#10449).
  • Allowed environment variable references in image tags (#10642).
  • Kept quoted values when saving the developer view of environment variables (#10406).
  • Reported Compose files with no parsed services during deployments.
  • Stopped containers again while they restart past their restart limit (#10761).
  • Showed container logs that contain invalid UTF-8 (#10628).
  • Fixed terminal connections that closed with "Missing required tokens" when the session cookie name was custom.
  • Updated breadcrumb names after a rename (#12341).
  • Showed why Hetzner, DigitalOcean, and Vultr API requests fail, stopped duplicate Hetzner create requests, and deleted unsaved VPS instances.
  • Recreated database TCP proxies that run an outdated configuration.
  • Skipped Git LFS downloads when Git LFS is disabled (#10360).
  • Kept the base directory in new repository applications (#10319).
  • Kept saving applications with unchanged legacy build commands.
  • Used the owner/repo slug for GitHub API calls with SSH repository URLs (#10175).
  • Showed GitHub App errors when loading repositories (#10174).
  • Fixed terminal authentication when a sibling subdomain sets another XSRF-TOKEN cookie.
  • Added an Axiom edge domain setting to log drains, so EU datasets work.
  • Hid out-of-stock and deprecated Hetzner server types, or showed them as disabled.
  • Let password managers autofill the confirmation password (#9963).
  • Checked out short commit SHAs with shallow clones (#9926).
  • Replaced the clone suffix instead of adding one for each clone (#9976).
  • Kept port-suffixed SERVICE_URL and SERVICE_FQDN variables in sync with the domain (#9877).
  • Returned logs of stopped containers through the API, like the UI.
  • Renamed the old Security labels to Keys & Tokens.

What's Changed

Full Changelog: v4.5.0...v4.5.1

Check out latest releases or
releases around coollabsio/coolify v4.5.1

Don't miss a new coolify release

NewReleases is sending notifications on new releases.

Get notifications