coollabsio/coolify v4.6.0 on GitHub

Breaking Changes

Require the new delete ability, or root, for every delete through the API and the MCP server, an API token with write alone can no longer delete resources, environment variables, storages, backups, scheduled tasks or tags, or detach a tag

Security

Harden the CI workflows
- Require every action to be pinned to a full-length commit SHA, with an Actions setting on GitHub that enforces it
- Lock every action and the actions it calls to a commit in .github/workflows/actions.lock, together with the IDs of its owner and repository, which a commit SHA alone does not check
- Require every workflow to use the lockfile, with an Actions policy on GitHub that enforces it
- Keep the Docker Hub credentials and the CDN token in the release environment, which only the branches that release can use
- Run without the GitHub Actions cache, layer caches and cached tool binaries, so no run restores what another run wrote
- Grant every job the least permissions it needs and state the reason for every write permission
- Keep the tokens that delete images in the cleanup environment, which only main can use
- Fix every finding of jactionlint pedantic
Refuse to update, force-push or delete the git tag of a release, with a tag protection rule on GitHub
Refuse to delete or force-push main, next, release and maintenance branches, with branch protection rules on GitHub
Hide locked environment variable values in the resource lists of GET /api/v1/resources and GET /api/v1/projects/{uuid}/{environment}, like the other endpoints already do
Require an instance admin to disable the API, or to enable or disable the MCP server, through the API
Route only the Reverb WebSocket path /app/ through the domain of the Coolify dashboard, the generated Traefik and Caddy configurations no longer expose the Reverb HTTP API under /apps
Require the deploy ability for the registry check and the registry logout of the API and the MCP server, like the registry login
Keep the file names of PostgreSQL init scripts inside the init script directory
Protect archive branches from updates, deletions and force-pushing, with branch protection rules on GitHub

Added

Limit a team member or an API token to selected projects, environments or resources, with the access levels read, read sensitive, deploy, write, delete and root, where a higher level includes the lower ones
- Give an API token access to the whole team or to selected projects, environments or resources, a token never gets more access than its owner and stops working when its owner loses that access
- Set the access of a member when you invite them, or later with a preset (viewer, developer, operator or full access) or per scope
- Show members and tokens limited to some scopes only the projects, environments, resources, deployments and search results they can access, and keep them out of the team-wide pages and API endpoints
- Set a member back to read-only to clear their grants and revoke their API tokens
- See a summary of the access of every member under their email in the members list
Choose the update channel of an instance on the update page: stable, preview with betas and release candidates, nightly with a warning that breaking changes are possible, or a custom image such as pr-1234
Publish prereleases from next and the release branches, tagged like 4.6.0-beta.1, and the moving preview tag
Publish a nightly version twice a day, tagged like 4.6.0-alpha.0.20261026.1, with the moving nightly tag and the nightly channel of the CDN, from next or from the release branch while one is in progress
Keep the updates of the old channel after a switch to a more stable channel, until the stable release of the installed version is out
Install the newest preview or nightly version with install.sh --preview or install.sh --nightly, which also switches the update channel of the instance
Switch the update channel from the command line with php artisan app:update-channel
Manage DNS records, integration tokens and secret managers through the API and the MCP server
- View, create, replace and release the Cloudflare DNS records of the domains of applications and services
- Create the DNS records of the domains that PATCH /applications/{uuid} and PATCH /services/{uuid} add, when exactly one zone with automatic DNS manages them, like the Domains page does
- List, update, rotate and delete integration tokens, sync their DNS zones, and create Cloudflare tokens with DNS and tunnel capabilities
- Set, remove and import the secret manager of applications, services and databases, key names are listed and values are never returned
- Add the MCP tools manage_dns, manage_integration_tokens, manage_secret_manager and manage_cloudflare_tunnel
Edit the description, permissions, access and expiry of an API token, its value stays the same
Pause and resume an API token, a paused token cannot authenticate to the API or the MCP server
Roll an API token to replace its secret and keep its description, permissions, access and expiry
Clone private repositories from custom Git hosts over HTTPS with a username and a password or access token, set on the Source page or through the API, instead of a token in the repository URL
Open the console of the main process of a container from the terminal, next to the shell, for containers that keep stdin open, such as game servers and REPLs, with the last 200 log lines and a command box that sends whole lines to the process
Keep the stdin of a Docker image application open with -i or -it in its custom Docker options, so its terminal can open the console
Send the logs of a server to Amazon CloudWatch Logs with the Docker awslogs log driver as a log drain
Include the commit SHA, branch and message in deployment emails, with an opt-in setting of the email notifications
Filter a table by clicking a type, status, server, source or role value in a row, and sort it by clicking a column header, also the projects and servers of the dashboard
Show the Compose default of an empty environment variable in the developer view
Add the Hi.Events one-click service
Attach an SBOM attestation to every image, which lists every package of the image
Publish the image of every pull request from a branch of this repository as ghcr.io/coollabsio/coolify:pr-<number>, so a change can be tried before it is merged
Build main twice a day when it changed and move the main tag on ghcr.io to it, versioned like 4.5.0.20261028.1, to test fixes before their patch release
Add OCI labels to the image, such as its version, commit, creation date, license and base image, instead of the labels it took over from its serversideup/php base image
Copy the labels of the image to the annotations of its index, ghcr.io reads the description and the license of an image of several platforms from there
Send a reminder email with a recovery link to the admin who started a subscription checkout on Coolify Cloud and did not finish it

Changed

Replace the release process, RELEASE.md describes it
- Keep the Coolify versions in release.json, stable.coolify for main and the maintenance branches and preview.coolify for next and the release branches
- Pin the helper, Sentinel and Traefik versions in upstream.json instead of versions.json, the CDN writes versions.json from it
- Release from main, next, release branches such as release/v4.6 and maintenance branches such as v4.x and v4.4.x
- Select the stage and the version with scripts/release.sh, which offers the versions the branch allows and preselects the bump the commits need
- Publish the version a push of release.json sets, unless it is published already, instead of a reviewed draft release
- Move latest and preview to their place among all published tags, so a release of an older version never moves a tag back
- Plan the version, the releases, the moving tags and the nightlies with scripts/plan-version.sh, which also reports what a push publishes
- Take the release commit back before the push with scripts/undo-release.sh
Take the Coolify version from the image alone, the upgrade script removes COOLIFY_VERSION from .env
Compress the image layers with zstd instead of gzip, it compresses better and compresses and decompresses faster, pulling needs Docker Engine 23.0 or later and Coolify requires 24.0
Fetch the Fleet Metrics of all servers at the same time, with one SSH command per server instead of one per metric, so the page loads 10 to 19 times faster with 1 to 10 servers in our benchmark
Move the helper image to coollabsio/coolify-helper, which releases it
Bump the SQLite image to 3.54.1-v0.2.0 with SQLite 3.54.1, which lets any user ID write the database files, so a connected application no longer has to run as 65532 or root
- Replace the user ID note on the connect page with a warning that a bind mount opens the database files to every user on the host
Streamline the CDN
- Sync every channel with the install and upgrade scripts and the compose files of the commit it releases, instead of the copies in other/nightly
- List the Coolify, helper, Sentinel and Traefik versions of every channel in /coolify/versions.json, older instances keep reading its coolify and traefik keys
- Add a preview channel for the betas and release candidates
- Sync it with scripts/sync-cdn.sh instead of php artisan sync:cdn, from the release workflow when latest or preview moves and from the nightly workflow
- Open a pull request for the stable channel and push the preview and nightly channels directly
- Clear the Cloudflare cache of the CDN with scripts/sync-cdn.sh --purge
Rework the CI workflows for the new release process
- Build each platform once and publish exactly that build, not a second build
- Split the build and release workflows, the release, nightly, main and pull request workflows call the build workflow
- Write the notes of the GitHub release from CHANGELOG.md instead of git-cliff
- Queue release runs instead of cancelling them, so no two runs publish or move tags at the same time
- Mark the GitHub release that latest points at as the latest release
- Run every step with bash, so a failing command in a pipe fails the step
- Skip the build of a push to a pull request from main, next, a release branch or a patch branch that changes release.json, the release workflow builds it
Merge main forward into next and the release branches only after a release, instead of every 10 minutes, which cluttered the commit history of next with merge commits
Warn about an expiring API token 7 days before it expires instead of 1 day, a token that lives 7 days or less gets the warning 1 day before
Show a new or rolled API token in a modal of its own until you close it
Show the actions of a table row with two or more actions in one ... menu, and ask for confirmation before you remove a team member or revoke an invitation
Enter the two-factor code in separate digit boxes
Show a spinner on deployments that are in progress
Refresh the status at the cloud provider with the server details action of a server

Removed

Remove the Windows support with Docker Desktop, docker-compose.windows.yml and .env.windows-docker-desktop.example, and the testing host image on Docker Hub, which only it used
Remove the next, sha-<commit> and <version>-rc.N.<commit> image tags, prereleases and nightlies take their place, and the main tag on docker.io, it moves on ghcr.io alone
Remove the workflow that deleted every untagged image on ghcr.io, one run would delete the platform images and attestations of every release
Remove the new team button from the team settings
Remove the git-cliff workflow that generated CHANGELOG.md, it is written by hand
Remove the temporary hotfix release workflow, patch branches release hotfixes
Remove the workflow that moved pull requests to main or next by their category, for now
Remove the Claude workflow and the temporary workflow and image of the PHP base image

Fixed

Quote root user values with spaces in .env during the upgrade, unquoted values from older installers made every page return HTTP 500 after the upgrade
Keep the values that the variables of Docker Compose applications had before the upgrade to 4.5, backslashes in them were doubled inside the containers
Reject a Docker image name that another application of the team builds, two applications that build the same image name could run each other's image
Clear the forced password reset after a password reset, so a new invitation no longer replaces the password and a revoked or expired invitation no longer deletes the account
Store the Compose default of a variable that a service references without a default, so one-click services such as Umami start again
Keep build secret values out of the runtime of Docker Compose applications, so containers get their runtime values, and give build secrets the stored value without the quotes of the .env file
Pass the SERVICE_URL_<NAME>_<PORT> and SERVICE_FQDN_<NAME>_<PORT> variables to Docker Compose applications, for production and preview deployments, at runtime and build time
Remove only the helper containers of finished deployments during the helper cleanup, it also removed the helpers of running backups, imports and file browsers
Upload S3 backups from IPv6-only servers and restore them there, Coolify pins the first IP of the S3 host that connects instead of always its IPv4 address
Let the databases of services choose the databases to back up
Stop unreachable servers from blocking web workers when a page loads metrics, with a short timeout, one fetch per server at a time and a pause of 60 seconds after a failed fetch
Speed up slow queries on large instances
- Index the lookups of team deployments, the Docker cleanup history, server settings, team memberships, the deployment history and active servers by private key
- Load the server settings without the patch check results, and the servers of the server manager and interrupted Docker cleanups in batches
- Load only the commit details for the application heading, and skip the payload columns in deployment lists
- Limit the recent deployments of the dashboard per application
- Select the servers of GitHub runners and the applications of manual webhooks in SQL
Stop the helper container on the build server when a deployment that builds there is cancelled
Send working invitation links to invited users who have no password, and keep your session when you change the password of another user
Start a stopped Docker daemon in install.sh when Docker is installed already, the installer stopped without an error before
Count only the scheduled jobs that run on this host when the upgrade waits for running jobs
Push nothing but the release index, its images and their attestations, the old workflows pushed every platform image with an index of its own, which stayed behind unused next to the release index on ghcr.io and docker.io
Resolve the host names of IPv6-only servers in the domain check of the server transfer checklist and in the SSH check of Coolify Cloud
Accept the same port mappings in the API as in the UI, such as UDP, port ranges and IP bindings
Add the Compose labels to the volumes of a cloned Docker Compose service
Accept a base directory without a leading slash for new applications from a Git repository
Fall back to a usable shell in the terminal when the shell of the user is nologin or false
Show the watch paths of applications with a deploy key
Keep the order of preview environment variables when sorting is disabled
Show whether a scheduled task or backup is disabled in their lists
Show SQLite in the database engines of the canvas
Document the request bodies of the shared environment variable endpoints in the OpenAPI specification, and remove the is_preview field of service environment variables and the Highlight log drain fields from it, the API does not accept them
Start the Locations card and the table pagers on the analytics tabs of resources
Style log lines by their declared level instead of by error keywords
Change the avatar URL when an avatar is replaced, so the new picture shows
Open the patches page from the patches badge of a server
Restore the main menu row that reopens the resource menu, and name it after the deepest menu
Keep unsaved GitHub runner settings during Sysbox checks
Keep the .gitignore files of the storage directories in the image
Skip the broadcast of a Docker cleanup of a deleted server
Show the deletion of unused private keys in red

Maintenance

Add scripts/clean-manifests.sh and a workflow that delete the unused manifests from ghcr.io and docker.io, such as the leftovers of the old workflows and the images of closed pull requests, and keep every release, every moving tag, the nightlies of the last 14 days and the images of open pull requests
Add scripts/size.sh to measure the compressed and the on-disk size of every platform
Comment the size change of every pull request compared with the latest release
Give every job a name, a timeout, a fixed runner image and a concurrency group
Bump actions/stale to v11, GitHub Actions removed the Node.js 20 it ran on
Describe the new release process in AGENTS.md