Release history
dokku releases
A docker-powered PaaS that helps you build and manage the lifecycle of applications
All releases
24 shown
Upgrade now
v0.38.7
Breaking risk
RCE / SSRF
Shell‑injection fix + image recovery + HTTP/2 deprecation warning
v0.38.3
Breaking risk
Breaking changes
- Reject per-app sets for global-only proxy properties (#8602)
Notable features
- Add Docker healthcheck to dokku container (#8599)
Full changelog
Install/update via the bootstrap script:
wget -NP . https://dokku.com/install/v0.38.3/bootstrap.sh
sudo DOKKU_TAG=v0.38.3 bash bootstrap.sh
Bug Fixes
- #8602: @josegonzalez Reject per-app sets for global-only proxy properties
- #8601: @josegonzalez Rename app-json:report flags to match property
- #8600: @josegonzalez Report info-flag should not error when app undeployed
New Features
- #8599: @josegonzalez Add docker healthcheck to dokku container
v0.38.2
Security relevant
Security fixes
- #8590: Restrict app names to prevent command injection
- #8591: Harden archive extraction against symlink traversal
- #8589: Enforce 0600 permissions on .netrc credentials file
Full changelog
Install/update via the bootstrap script:
wget -NP . https://dokku.com/install/v0.38.2/bootstrap.sh
sudo DOKKU_TAG=v0.38.2 bash bootstrap.sh
Security
- #8590: @josegonzalez Restrict app names to prevent command injection
- #8591: @josegonzalez Harden archive extraction against symlink traversal
- #8589: @josegonzalez Enforce 0600 permissions on .netrc credentials file
- #8588: @josegonzalez Sanitize openresty include filenames to prevent eval injection
Bug Fixes
- #8593: @josegonzalez Gate ssl_reject_handshake behind nginx 1.19.4
- #8578: @josegonzalez Reference SOURCECODE_WORK_DIR in builder core-post-extract
Documentation
- #8592: @josegonzalez Add security section to release changelog
- #8587: @vixalien Correct buildkit builder code block syntax
- #8580: @othercorey Set issue type in bug report template
Dependencies
- #8579: @josegonzalez Use type prefix for dokku-bot dependency label
Tests
- #8586: @josegonzalez Count assert_output_contains matches as fixed strings
- #8581: @dependabot[bot] chore(deps): bump golang from 1.26.2 to 1.26.3 in /tests/apps/go-fail-predeploy
- #8582: @dependabot[bot] chore(deps): bump golang from 1.26.2 to 1.26.3 in /tests/apps/gogrpc
- #8584: @dependabot[bot] chore(deps): bump golang from 1.26.2 to 1.26.3 in /tests/apps/go-fail-postdeploy
- #8583: @dependabot[bot] chore(deps): bump golang from 1.26.2 to 1.26.3 in /tests/apps/zombies-dockerfile-tini
- #8585: @dependabot[bot] chore(deps): bump golang from 1.26.2 to 1.26.3 in /tests/apps/zombies-dockerfile-no-tini
- #8574: @dependabot[bot] chore(deps): bump node from 25-alpine to 26-alpine in /tests/apps/dockerfile-noexpose
- #8575: @dependabot[bot] chore(deps): bump node from 25-alpine to 26-alpine in /tests/apps/dockerfile-procfile-bad
- #8577: @dependabot[bot] chore(deps): bump node from 25-alpine to 26-alpine in /tests/apps/dockerfile-app-json-formations
- #8576: @dependabot[bot] chore(deps): bump node from 25-alpine to 26-alpine in /tests/apps/dockerfile
- #8573: @dependabot[bot] chore(deps): bump node from 25-alpine to 26-alpine in /tests/apps/dockerfile-procfile
v0.38.1
Bug fix
Fixed source property-functions handling and migrated legacy storage ownership.
Full changelog
Install/update via the bootstrap script:
wget -NP . https://dokku.com/install/v0.38.1/bootstrap.sh
sudo DOKKU_TAG=v0.38.1 bash bootstrap.sh
Bug Fixes
- #8563: @josegonzalez Source property-functions where fn-plugin-property-* helpers are used
- #8559: @josegonzalez Install cnb pack from github releases instead of ppa
- #8558: @josegonzalez Chown migrated legacy storage entries to dokku
- #8545: @josegonzalez Deflake haproxy bats tests
Refactors
- #8546: @josegonzalez Consolidate nginx.conf.sigil server blocks
Documentation
- #8548: @josegonzalez Use explicit type property in proxy:set examples
- #8547: @josegonzalez Document plugin properties migrated from env vars
- #8544: @josegonzalez Fix reference to when the build plugin was introduced
Tests
- #8565: @dependabot[bot] chore(deps): bump google.golang.org/grpc from 1.80.0 to 1.81.0 in /tests/apps/gogrpc
- #8568: @dependabot[bot] chore(deps): bump gunicorn from 25.3.0 to 26.0.0 in /tests/apps/multi
- #8572: @dependabot[bot] chore(deps): bump django from 5.2.13 to 5.2.14 in /tests/apps/dockerfile-release
- #8570: @dependabot[bot] chore(deps): bump gunicorn from 25.3.0 to 26.0.0 in /tests/apps/dockerfile-release
- #8567: @dependabot[bot] chore(deps): bump gunicorn from 25.3.0 to 26.0.0 in /tests/apps/python-flask
Dependencies
- #8571: @dependabot[bot] chore(deps): bump traefik from v3.6.15 to v3.7.0 in /plugins/traefik-vhosts
- #8569: @dependabot[bot] chore(deps): bump github.com/traefik/traefik/v2 from 2.11.44 to 2.11.45 in /plugins/scheduler-k3s
- #8561: @dokku-bot chore: bump pack to 0.40.4
- #8555: @dependabot[bot] chore(deps): bump github.com/mattn/go-isatty from 0.0.20 to 0.0.22 in /plugins/app-json
- #8556: @dependabot[bot] chore(deps): bump github.com/Masterminds/semver/v3 from 3.4.0 to 3.5.0 in /plugins/scheduler-k3s
- #8550: @dokku-bot chore: bump docker-container-healthchecker to 0.15.2
- #8553: @dokku-bot chore: bump dokku-event-listener to 0.19.1
- #8552: @dokku-bot chore: bump lambda-builder to 0.9.3
- #8551: @dokku-bot chore: bump procfile-util to 0.20.7
- #8554: @dependabot[bot] chore(deps): bump peter-evans/create-pull-request from 7 to 8
v0.38.0
Bug fix
Notable features
- Scheduler‑aware named storage entries (#8538)
- Global flag support for :report subcommands (--global) (#8527)
- Pre‑validation of custom nginx.conf.sigil during core-post-extract (#8524)
Full changelog
Install/update via the bootstrap script:
wget -NP . https://dokku.com/install/v0.38.0/bootstrap.sh
sudo DOKKU_TAG=v0.38.0 bash bootstrap.sh
See the 0.38.0 migration guide for more information on migrating to 0.38.0.
Bug Fixes
- #8533: @josegonzalez Split env config and image pull secret into separate helm releases
- #8530: @josegonzalez Split multi-flag input in docker-options
- #8528: @josegonzalez Skip retiring images still in use by app containers
- #8525: @josegonzalez Add launcher entrypoint for CNB images on dokku run and cron:run
- #8522: @josegonzalez Only emit keda fallback when a non-cpu/memory trigger exists
- #8515: @josegonzalez Fix vector mount directory config
- #8508: @josegonzalez Preserve all domains when renaming an app
- #8507: @josegonzalez Retire orphaned containers when scaling down
New Features
- #8538: @josegonzalez Add scheduler-aware named storage entries
- #8527: @josegonzalez Accept --global on :report subcommands
- #8524: @josegonzalez Pre-validate custom nginx.conf.sigil during core-post-extract
- #8523: @josegonzalez Support resource limits on the build container
- #8517: @josegonzalez Send SIGTERM to old containers immediately on deploy
- #8516: @josegonzalez Scope docker-options to specific procfile processes
- #8509: @josegonzalez Ship default catch-all site on fresh apt install
- #8506: @josegonzalez Add --format json to git:report and nginx:report
- #8505: @josegonzalez Add git:auth-status to check netrc match
- #8493: @josegonzalez Generate 502 config for apps without web listeners
- #8404: @josegonzalez Upgrade vector chart from 0.42.0 to 0.52.0
- #8403: @josegonzalez Upgrade ingress-nginx chart from 4.10.0 to 4.15.1
- #8402: @josegonzalez Upgrade keda to 2.19.0 and keda-add-ons-http to 0.12.2
- #8259: @josegonzalez Add post-create support for env key in app.json
- #8157: @josegonzalez Add support for specifying buildpacks via app.json
- #8154: @josegonzalez Enable live-restore by default when installing Dokku
- #3697: @josegonzalez Migrate builds plugin to go and track per-build records
Refactors
- #8514: @josegonzalez Migrate docker-options subcommands to go
- #6716: @josegonzalez Move app and global ENV files to consolidated config path
Dependencies
- #8541: @dependabot[bot] chore(deps): bump traefik from v3.6.14 to v3.6.15 in /plugins/traefik-vhosts
- #8537: @dependabot[bot] chore(deps): bump github.com/traefik/traefik/v2 from 2.11.43 to 2.11.44 in /plugins/scheduler-k3s
- #8535: @dependabot[bot] chore(deps): bump github.com/onsi/gomega from 1.39.1 to 1.40.0 in /plugins/common
- #8529: @josegonzalez chore: bump dokku/netrc to v0.11.0
- #8520: @dependabot[bot] chore(deps): bump packaging from 26.1 to 26.2 in /docs/_build
- #8510: @dependabot[bot] chore(deps): bump packaging from 26.1 to 26.2 in /docs/_build
- #8503: @josegonzalez Bump dependency versions and add daily updater workflow
- #8502: @josegonzalez Bump go version to 1.26.2
- #8495: @dependabot[bot] chore(deps): bump k8s.io/apimachinery from 0.35.4 to 0.36.0 in /plugins/scheduler-k3s
- #8494: @dependabot[bot] chore(deps): bump dokku/openresty-docker-proxy from 0.9.3 to 0.10.0 in /plugins/openresty-vhosts
- #8490: @dependabot[bot] chore(deps): bump k8s.io/kubernetes from 1.35.4 to 1.36.0 in /plugins/scheduler-k3s
v0.37.9
Maintenance
Minor fixes and improvements.
Full changelog
Install/update via the bootstrap script:
wget -NP . https://dokku.com/install/v0.37.9/bootstrap.sh
sudo DOKKU_TAG=v0.37.9 bash bootstrap.sh
Dependencies
- #8473: @dependabot[bot] chore(deps): bump k8s.io/api from 0.35.2 to 0.35.4 in /plugins/scheduler-k3s
- #8474: @dependabot[bot] chore(deps): bump github.com/go-openapi/jsonpointer from 0.22.5 to 0.23.0 in /plugins/scheduler-k3s
- #8476: @dependabot[bot] chore(deps): bump github.com/go-acme/lego/v4 from 4.25.2 to 4.34.0 in /plugins/scheduler-k3s
- #8475: @dependabot[bot] chore(deps): bump github.com/moby/spdystream from 0.5.0 to 0.5.1 in /plugins/scheduler-k3s
v0.37.8
Mixed
Notable features
- Add application/graphql-response+json to nginx gzip_types
- Fix client prepending `--app` for non-app commands
v0.37.7
Maintenance
Notable features
- Debian 13 docker package support
- Traefik readiness healthchecks configuration
- Custom entrypoint support for API and dashboard
v0.37.6
Bug fix
Notable features
- Architecture documentation
- Docs folder README
v0.37.5
New feature
Notable features
- Per-app registry login capability
- DNS-01 challenge mode with Traefik
- K3s certificate integration from certs plugin