Shipped · DevOps and infrastructure

What Dokploy/dokploy shipped

The public repository of Dokploy · github.com/Dokploy/dokploy

Written by FoxPlug from the repository's own releases; not affiliated with Dokploy. Paste your own repository in the box below and FoxPlug writes the same weekly update for your product. This page is an automatic summary of the releases, pull requests and commits in github.com/Dokploy/dokploy; Dokploy did not write it and does not use or endorse FoxPlug. Every line links to the change it describes.

Get a weekly update like this for your product, free

Or Use it as a GitHub Action

See the update FoxPlug writes for dokploy, free

Week of November 2, 2026

What shipped

Why it matters

This week brings a broad security pass: stricter authorization boundaries, hardened HTTP headers, and a new security section for remote servers. Deploy and schedule reliability also improved, so failed Swarm scheduling is reported and cron jobs are not lost on cloud. The v0.31.0 release collects these changes for users upgrading.

Changelog entry

Example posts FoxPlug drafted from these changes. Not written or posted by the project.

Post for X

V0.31.0 is out. This week: tighter org and role checks across routers, webhooks and auth, hardened HTTP security headers, and a new Security dialog for remote servers with Fail2ban setup. Also: terminal SSH sessions close properly, deploys fail when Swarm can't schedule, and cron

Post for LinkedIn

Dokploy v0.31.0 is out. This week's work focused on security and reliability. Authorization and input checks were tightened across routers, websockets, webhooks and the auth layer, HTTP security headers were hardened, and remote servers gained a Security dialog that installs and configures Fail2ban over SSH. On reliability, closing a remote terminal now closes its SSH session, Swarm deployments fail when the new task cannot be scheduled instead of reporting success, cron jobs are no longer lost on cloud with large queues, and access.log is rewritten in place so bind-mounted log readers keep working. A pasted Phase service account token is also cleaned up, and 2FA setup now completes for users with a leftover setup row.

Week of October 26, 2026

What shipped

Why it matters

This week fixed several ways deploys and tooling could leave people stuck: remote deploys that hung when a server died, services that lost network access when a compose domain was disabled, and Traefik being pruned while stopped. The new audit log export and the virtualized log viewer make large amounts of log and audit data usable. PostHog analytics is added for Dokploy Cloud only, gated so self-hosted instances load and send nothing.

Changelog entry

Example posts FoxPlug drafted from these changes. Not written or posted by the project.

Post for X

This week: remote deploys now fail fast when a server dies mid-deploy, env vars stay readable after leaving the legacy auth secret, log viewers are virtualized, audit logs export as CSV, TSV or JSON, and domain config writes are serialized.

Post for LinkedIn

This week's changes include several fixes to how deploys behave when something goes wrong: remote deploys no longer hang when a server freezes mid-deploy, and Docker cleanup no longer prunes a stopped dokploy-traefik. Env vars remain readable after moving off the legacy auth secret, and concurrent domain writes no longer overwrite an app's Traefik config. Audit logs can now be exported as CSV, TSV or JSON for every entry matching the current filters, and the deployment, volume backup, drawer and container log viewers share one virtualized list so large logs no longer freeze the tab.

Week of October 19, 2026

What shipped

Why it matters

This week fixes several things that quietly went wrong on real installs: deploys dropping labels and merge-keyed compose settings, webhook jobs landing on the wrong server, and previews building without the configured build server and registry. It also tightens secrets handling so registry passwords stop showing up in errors and commands, and closes cross-tenant access gaps. Alongside that, Traefik moves to a supported release with a safe update path, and backups can now be downloaded.

Changelog entry

Example posts FoxPlug drafted from these changes. Not written or posted by the project.

Post for X

New releases v0.30.9 and v0.30.10. Security fixes for cross-tenant access and secret leaks in errors and docker login. Deploys keep service labels and YAML merge keys. Traefik bumped to v3.7.16 with a safe update. Webhook jobs keep their serverId and backups can be downloaded.

Post for LinkedIn

Two releases this week, v0.30.9 and v0.30.10. Security work: access checks now require the target service or project to belong to the active organization, ExecError no longer carries the executed command so registry passwords and build secrets stay out of logs and notifications, and docker login receives registry passwords via stdin. Deploy fixes: service-level labels are kept on application updates, YAML merge keys and anchors are resolved when rewriting compose files, and webhook deployment jobs on self-hosted setups keep the remote serverId. Previews now use the configured build server and registry, and compose delete defaults deleteVolumes to false. Traefik is bumped to v3.7.16 with a version check and safe update, the swarm provider is disabled on worker servers, cron jobs register on

Week of October 12, 2026

What shipped

Why it matters

This week's changes fix several failures developers hit while deploying: expired GitLab tokens breaking concurrent deployments, dropped Telegram error notifications and members unable to pick a server. It also adds container log and metric shipping to external providers, which makes running services easier to observe from existing tooling.

Changelog entry

Example posts FoxPlug drafted from these changes. Not written or posted by the project.

Post for X

This week: Logs & Metrics ships container logs and metrics to external providers via Vector. GitLab token refresh is shared across concurrent deployments. Traefik file access is confined to the config directory. Telegram notifications escape HTML and truncate long messages.

Post for LinkedIn

This week's changes for Dokploy: Logs & Metrics ships a server's container logs and metrics to external providers via Vector. GitLab token refresh is now shared between concurrent callers, so two deployments finding an expired token at once no longer cause one to fail. Traefik file read and write procedures are confined to the Traefik config directory. Telegram notifications escape HTML and truncate long messages, so build error alerts are delivered instead of dropped. Members with service creation permission can now list servers in server pickers, and the OVH DNS provider accepts an optional zone.

Week of September 28, 2026

What shipped

Why it matters

This week includes security fixes for cookies and credential redaction, reliability improvements for webhooks and websockets, and UX polish that prevents data loss. Together they address authentication safety, silent failures in deployment flows, and user friction in common workflows.

Changelog entry

Example posts FoxPlug drafted from these changes. Not written or posted by the project.

Post for X

V0.30.8 shipped: secure session cookies over HTTPS, account deletion for compliance, fixed credential redaction in backups, and deployments that don't reset when you edit Git settings.

Post for LinkedIn

Dokploy v0.30.8 is out with security and reliability improvements. Highlights: secure session cookies over HTTPS, self-service account deletion for GDPR/CCPA, S3 credentials properly redacted in logs, webhook payloads up to 25 MB, and application status preserved when updating provider settings. Also fixed deployment log websockets leaking resources and Block I/O stats double-counting partitions.

More from Dokploy/dokploy on GitHub

Merged pull requests

Weeks with too little public activity are left out rather than filled in. Last updated 2026-11-09.

Is this your repo? Ask us to remove this page.