What's Changed

Polling local Repositories

Some stacks cannot be deployed without a running SCM available (e.g. a self-hosted Gitea/Forgejo instance that should be deployed via doco-cd (hence a chicken-and-egg problem), or a stack that is deployed from a local Git repository that is not hosted on any remote SCM). This release adds support for polling local Git repositories to solve this problem.

Mount the directory containing your local Git repo into the doco-cd container, then use a poll config with the url: value being the absolute path to the Git repo inside the container.

More info in the wiki at Polling Local Filesystem Repositories.

Watcher for local Repositories

In addition to interval-based polling, doco-cd watches the local repository's git directory for changes and triggers a deployment check immediately when new commits land, without waiting for the next interval. This is enabled by default; set watch: false to disable it and rely on interval only. Set interval: 0 (with watch left enabled) to rely on the watcher exclusively, with no periodic fallback polling at all.

See the watch poll option in the wiki.

⚠️ Dotenv parsing changed

.env files (env_files) are now parsed with compose-go's dotenv engine (the same one Docker Compose uses) instead of godotenv. Variables set in one env_files entry are now correctly available for ${VAR} substitution in later entries.

Reference docs:

• Compose variable interpolation: https://docs.docker.com/compose/how-tos/environment-variables/variable-interpolation/
• Compose .env syntax (.env file section): https://docs.docker.com/compose/how-tos/environment-variables/variable-interpolation/#env-file
• Compose interpolation operators (Interpolation syntax): https://docs.docker.com/reference/compose-file/interpolation/

✨ Features

• feat(git): add support for local filesystem Git repositories by @kimdre in #1717

🌟 Improvements

• feat(git): implement local filesystem watcher for repository changes by @kimdre in #1723
• fix(compose): switch to compose-go dotenv parser for improved variable resolution by @kimdre in #1724

📦 Dependencies

• chore(deps): update gcr.io/distroless/base-debian13 docker digest to 20dc7ed by @renovate[bot] in #1719
• chore(deps): update docker/github-builder digest to 58cb9f5 by @renovate[bot] in #1718
• chore(deps): update github/codeql-action digest to db488dd by @renovate[bot] in #1720
• chore(deps): update dependency zensical to v0.0.57 by @renovate[bot] in #1721

Full Changelog: v0.110.1...v0.111.0

v0.111.0 Latest

Latest

Compare

Choose a tag to compare

What's Changed

Fixed a bug that caused the job API to not return the last_run_at field anymore.

🐛 Bug Fixes

• fix(scheduler): preserve manual last run during state updates by @kimdre in #1716

📦 Dependencies

• fix(deps): update aws-sdk-go-v2 monorepo by @renovate[bot] in #1715

Full Changelog: v0.110.0...v0.110.1

v0.110.1

Compare

Choose a tag to compare

What's Changed

Direct TLS/SSL Support for web server

Set the new environment variables HTTP_TLS_CERT_FILE and HTTP_TLS_KEY_FILE to enable HTTPS for the API and metrics server, and healthcheck.

OpenBao pki/cert rotartion

Added automatic OpenBao certificate rotation, see the wiki for more info.

Examples

Set these env vars for doco-cd to enable and configure the cert rotation watcher:

CERT_ROTATION_ENABLED=true
CERT_ROTATION_THRESHOLD=72h
CERT_ROTATION_CHECK_INTERVAL=1h

Use pki-role:

external_secrets:
  CERT: "pki-role:pki:my-role:app.example.com"

• pki-role:certs:myapp-role:myapp.example.com -> Issues a new certificate for the common name myapp.example.com using the myapp-role PKI role in the certs secret engine in the root namespace.
• pki-role:my-namespace:certs:myapp-role:myapp.example.com -> Same as above but in the my-namespace namespace.

pki-role: issues a fresh certificate and matching private key on deploy. When rotation is enabled, doco-cd will watch the deployed cert’s expiry and redeploy the affected service before it expires.

Use CERT for the certificate and CERT_KEY for the private key in your compose file.

See the OpenBao Provider documentation in the PR.

✨ Features

• feat(external-secrets): implement automatic certificate rotation for deployments by @kimdre in #1690
• feat(api): add HTTPS support with TLS certificate configuration by @kimdre in #1704

🌟 Improvements

• feat(docker): normalize env vars for stable project hash during certificate rotation by @kimdre in #1697
• feat(notification): report image digest drifted services in ChangedServices by @dennislapchenko in #1692
• fix(commit-status): add support for GitHub Apps to report commit statuses by @kimdre in #1707
• fix(ssh-agent): simplify error handling in ServeAgent function by @kimdre in #1714
• fix(docker): reload registry auth from docker config on every lookup by @dennislapchenko in #1709

🐛 Bug Fixes

• fix(compose): fail start wait on crashlooping services by @dennislapchenko in #1695

📦 Dependencies

• fix(deps): update module github.com/moby/buildkit to v0.32.2 by @renovate[bot] in #1685
• fix(deps): update aws-sdk-go-v2 monorepo by @renovate[bot] in #1688
• chore(deps): update dependency zensical to v0.0.54 by @renovate[bot] in #1687
• chore(deps): update module golang.org/x/tools to v0.49.0 by @renovate[bot] in #1686
• chore(deps): update golang:1.26.6 docker digest to 0d1d3a7 by @renovate[bot] in #1693
• chore(deps): update dependency zensical to v0.0.55 by @renovate[bot] in #1694
• chore(deps): update codespell-project/actions-codespell digest to 8f01853 by @renovate[bot] in #1698
• fix(deps): update module github.com/docker/compose/v5 to v5.5.0 by @renovate[bot] in #1699
• chore(deps): update dependency zensical to v0.0.56 by @renovate[bot] in #1708
• chore(deps): update docker/setup-buildx-action digest to 37fe631 by @renovate[bot] in #1712

📚 Miscellaneous

• fix(notification): stop repeating and duplicating failure notifications by @dennislapchenko in #1700

Full Changelog: v0.109.2...v0.110.0

v0.110.0

Compare

Choose a tag to compare

What's Changed

Added automatic OpenBao certificate rotation

To test the new feature, switch your OpenBao secret reference from pki: to pki-role: and enable the rotation watcher:

external_secrets:
  CERT: "pki-role:pki:my-role:app.example.com"

Examples:

• pki-role:certs:myapp-role:myapp.example.com -> Issues a new certificate for the common name myapp.example.com using the myapp-role PKI role in the certs secret engine in the root namespace.
• pki-role:my-namespace:certs:myapp-role:myapp.example.com -> Same as above but in the my-namespace namespace.

Then set these env vars for doco-cd:

CERT_ROTATION_ENABLED=true
CERT_ROTATION_THRESHOLD=72h
CERT_ROTATION_CHECK_INTERVAL=1h

pki-role: issues a fresh certificate and matching private key on deploy. When rotation is enabled, doco-cd will watch the deployed cert’s expiry and redeploy the affected service before it expires.
Use CERT for the certificate and CERT_KEY for the private key in your compose file.

See the OpenBao Provider documentation in the PR.

✨ Features

• feat(external-secrets): implement automatic certificate rotation for deployments by @kimdre in #1690

📦 Dependencies

• fix(deps): update module github.com/moby/buildkit to v0.32.2 by @renovate[bot] in #1685
• fix(deps): update aws-sdk-go-v2 monorepo by @renovate[bot] in #1688
• chore(deps): update dependency zensical to v0.0.54 by @renovate[bot] in #1687
• chore(deps): update module golang.org/x/tools to v0.49.0 by @renovate[bot] in #1686

Full Changelog: v0.109.2...v0.110.0

What's Changed

📦 Dependencies

• fix(deps): update module github.com/moby/buildkit to v0.32.2 by @renovate[bot] in #1685
• fix(deps): update aws-sdk-go-v2 monorepo by @renovate[bot] in #1688
• chore(deps): update dependency zensical to v0.0.54 by @renovate[bot] in #1687
• chore(deps): update module golang.org/x/tools to v0.49.0 by @renovate[bot] in #1686

Full Changelog: v0.109.2...v0.110.0-rc.1

v0.110.0-rc.1 Pre-release

Pre-release

Compare

Choose a tag to compare

What's Changed

Added TRUSTED_PROXY_NETWORKS and TRUSTED_PROXY_HEADER env vars to configure trusted proxies for real client ip logging in API logs.

✨ Features

• feat(config): add support for trusted proxy networks and headers by @kimdre in #1680

🌟 Improvements

• feat(api): enhance trusted proxy handling by @kimdre in #1681

🐛 Bug Fixes

• fix(api): add external secrets resolution to scheduled job execution by @kimdre in #1682

📚 Miscellaneous

• ci: improve image build by @kimdre in #1679

Full Changelog: v0.109.1...v0.109.2

v0.109.2

Compare

Choose a tag to compare

What's Changed

A change in release v0.107.0 broke variable interpolation with values in environment in the deployment configuration. This release fixes this.

One-off job containers now also have the default docker compose labels, for example:

• com.docker.compose.project
• com.docker.compose.service
• com.docker.compose.project.working_dir

🌟 Improvements

• fix(scheduler): add compose labels to one-off job containers by @kimdre in #1677
• fix(api): improve logging for manually triggered scheduled job runs by @kimdre in #1678

🐛 Bug Fixes

• fix(scheduler): restore compose interpolation for scheduled jobs by @kimdre in #1675

📦 Dependencies

• chore(deps): update github/codeql-action digest to ff2f1c6 by @renovate[bot] in #1671
• chore(deps): update dependency golang to v1.26.6 by @renovate[bot] in #1672

Full Changelog: v0.109.0...v0.109.1

v0.109.1

Compare

Choose a tag to compare

What's Changed

If a docker config is provided/mounted inside the container, doco-cd will now verify the configuration and throw errors if the config is invalid or requires a credential helper binary, that is not available in $PATH.

🌟 Improvements

• fix(oci): reject absolute paths and directory traversal attempts in target path construction by @kimdre in #1658
• fix(docker): check docker config file is readable and valid by @kimdre in #1660
• fix(docker): add check for missing credential helper binaries in config by @kimdre in #1661
• fix(docker): improve handling of missing credential helper binaries in config validation by @kimdre in #1665
• fix(autodiscovery): do not force recreate on inert config label drift by @dennislapchenko in #1670

📦 Dependencies

• chore(deps): update docker/dockerfile:1 docker digest to ecfaec9 by @renovate[bot] in #1663
• chore(deps): update golang:1.26.5 docker digest to 5822931 by @renovate[bot] in #1664
• fix(deps): update aws-sdk-go-v2 monorepo by @renovate[bot] in #1666
• fix(deps): update module golang.org/x/crypto to v0.55.0 by @renovate[bot] in #1669
• fix(deps): update module github.com/docker/cli to v29.7.2+incompatible by @renovate[bot] in #1667
• fix(deps): update module github.com/docker/compose/v5 to v5.4.0 by @renovate[bot] in #1668

📚 Miscellaneous

• docs: add Renovate setup guide and configuration examples by @kimdre in #1654
• docs: rename page "Private Container Registries" to "Container Registry Authentication" by @kimdre in #1662

Full Changelog: v0.108.0...v0.109.0

v0.109.0

Compare

Choose a tag to compare

What's Changed

This release adds support for including Git repos and OCI artifacts in Docker Compose's include top-level section as described in their documentation:

include allows you to reference Compose files from remote sources, such as OCI artifacts or Git repositories.
Here serviceB is defined in a Compose file stored on Docker Hub.

include:
  - oci://docker.io/username/my-compose-app:latest # use a Compose file stored as an OCI artifact
services:
  serviceA:
    build: .
    depends_on:
      - serviceB 

Use the new OCI_INSECURE_REGISTRIES environment variable to set a comma-seperated allowlist of OCI registries to treat as insecure (HTTP or self-signed certs). Entries are deduplicated and normalized to lowercase. Each entry must be a hostname with optional port (no URL schemes allowed).

Example: registry.example:5000,localhost:5000

To use includes:

1. Add include: section to a Compose file:

   include:
     - path: https://github.com/user/repo.git#main:docker-compose.yml  # use a relative path if the compose file is in a subdirectory: docker/compose.yml
     - path: oci://docker.io/namespace/config:latest

2. If using private Git repos, ensure GIT_ACCESS_TOKEN or domain-scoped credentials are configured (see wiki).
3. If pulling from self-signed OCI registries, set OCI_INSECURE_REGISTRIES.

🌟 Improvements

• fix(compose): support remote git and OCI artifact includes by @kimdre in #1655

Full Changelog: v0.107.0...v0.108.0

v0.108.0

Compare

Choose a tag to compare

What's Changed

New configuration options:

• DATA_HOST_PATH: Optional source path of the deployment data mount as seen by the target Docker daemon (See Remote Docker daemons). Automatically detected by default.
• Added configurable retention for rotated Docker Swarm configs and secrets, including an option to disable automatic pruning. See Docker Settings and Deploy Settings in the wiki.

Improvements, fixes and changes

• (Swarm) Rollbacks are detected and reported correctly now.
• (Swarm) Fixed a bug that caused all tasks/services of a stack to be recreated on every deployment. This fix required some bigger changes under the hood, that requires users to take action (see the boxes below).

• Compose secrets and configs and external secrets are now supported in scheduled jobs.
• A message gets send when a deployment starts and APPRISE_NOTIFY_LEVEL is set to info.
• Diagnostics and troubleshooting for registry authentication has been improved. See Private Container Registries in the wiki.
• doco-cd is now able to recover from missing deployed commits (e.g. after a force push)
• Added more granular labeling for Prometheus metrics by allowing deployment metric labels (e.g. errors and durations) to be tracked per repository and deployment.

✨ Features

• feat: support explicit data host path by @nosovk in #1639
• feat(swarm): add configuration options for config and secret revisions retention by @kimdre in #1652

🌟 Improvements

• feat(notification): notify on started deployment by @kimdre in #1633
• fix(notification): log Apprise response body on notification request failures by @kimdre in #1634
• fix(autodiscovery): change default value of delete option to false by @kimdre in #1637
• fix(scheduler): support Compose secrets and configs in scheduled jobs by @kimdre in #1640
• fix(metrics): include deployment names in repository metrics labels by @kimdre in #1643
• fix(docker): detect Swarm rollbacks as deployment failures by @kimdre in #1644
• fix(docker): improve registry auth diagnostics by @kimdre in #1647
• feat(git): recover gracefuly from missing deployed commits after force push by @kimdre in #1650
• refactor(git): replace ZeroSHA with plumbing.ZeroHash in payload handling by @kimdre in #1651

🐛 Bug Fixes

• fix(log): decode localized server error messages by @kimdre in #1632

📦 Dependencies

• chore(deps): update docker/github-builder digest to a492c6d by @renovate[bot] in #1630
• chore(deps): update golang:1.26.5 docker digest to 2005724 by @renovate[bot] in #1631
• fix(deps): update module github.com/google/go-containerregistry to v0.21.9 by @renovate[bot] in #1642
• fix(deps): update aws-sdk-go-v2 monorepo by @renovate[bot] in #1641
• fix(deps): update module github.com/compose-spec/compose-go/v2 to v2.14.0 by @renovate[bot] in #1646
• fix(deps): update module github.com/sigstore/cosign/v3 to v3.1.3 by @renovate[bot] in #1645

📚 Miscellaneous

• fix: do not require a C compiler for the test-nobitwarden target by @nosovk in #1627
• docs: document the Docker API permissions required for each feature by @nosovk in #1626
• fix(swarm): stop recreating all tasks of a stack on every deployment by @nosovk in #1629
• test(swarm): update container name retrieval to use stack name prefix by @kimdre in #1648
• test(docker): improve log retrieval timing in Compose signal tests by @kimdre in #1649

New Contributors

• @nosovk made their first contribution in #1627

Full Changelog: v0.106.0...v0.107.0

v0.107.0

Compare

Choose a tag to compare

What's Changed

This release adds an option to rewrite source URLs for deployments.

SOURCE_URL_REWRITES (and SOURCE_URL_REWRITES_FILE) let you rewrite git source URLs before doco-cd clones them. Rules apply to both webhook- and poll-triggered deployments.

This is useful when your Git provider advertises a public URL (in webhook payloads or poll configs) but doco-cd should clone through an internal network path instead — for example when your Forgejo instance is behind a reverse proxy with a public domain, but is reachable directly over a Docker network.

More info in the wiki:

• App Settings
• Source URL Rewrites

✨ Features

• feat: add option to rewrite source URLs in deployments by @kimdre in #1609

📦 Dependencies

• chore(deps): update github/codeql-action digest to 5595cca by @renovate[bot] in #1610
• chore(deps): update dependency zensical to v0.0.53 by @renovate[bot] in #1611
• chore(deps): update docker/buildx-bin docker tag to v0.36.1 by @renovate[bot] in #1613
• chore(deps): update debian:trixie-slim docker digest to 3a39a05 by @renovate[bot] in #1612

📚 Miscellaneous

• docs: add usage of multiline YAML options in env vars to app settings page by @kimdre in #1614

Full Changelog: v0.105.2...v0.106.0

v0.106.0

Compare

Choose a tag to compare