runtipi

Home Automation

A personal homeserver orchestrator that simplifies managing multiple services on a single server using Docker and a web interface

Track releases GitHub Website

TypeScript Latest v4.10.1 · 1mo ago Security brief →

Features

Orchestrates multiple services via a simple web UI
Built on Docker for containerized service deployment
Provides an App Store with community-contributed apps
Allows users to create custom app stores

Recent releases

View all 11 releases →

Upgrade now

v4.10.1 Breaking risk 1mo

RCE / SSRF Breaking upgrade

Restore validation

Open

v4.9.3 New feature 2mo

⚠ Upgrade required

For upgrades from version 3.x or lower, follow the migration guide: https://runtipi.io/docs/reference/breaking-updates#update-from-3xx-to-400
Use `./runtipi-cli update v4.9.3` to perform the update

Notable features

Trusted IP/CIDR configuration for forwarded headers enables Cloudflare tunnel and similar setups

Full changelog

Release notes

Improvements

Add an option to add trusted IP/CIDRs for forwarded headers. This makes Cloudflare tunnels and other VPN setups possible when the link between the proxy and runtipi is not using the same protocol. Error: Invalid request origin See docs

How to update

From the root folder of your runtipi install

./runtipi-cli update v4.9.3

If you are coming from version 3 or lower please follow the migration guide

View release on GitHub

v4.9.1 Breaking risk 3mo

Breaking changes

Swagger API documentation no longer exposed in production

Notable features

Sensitive value redaction from application logs
Marketplace app image API throttling fix

Full changelog

Release notes

Improvements

Sensitive values are now automatically redacted from application logs
Swagger API documentation is no longer exposed in production environments, reducing unnecessary production surface area.
Set maxResponseBodySize in traefik forward auth middleware

Bug fixes

Marketplace app images no longer count against API throttling limits. This should prevent app store images from failing to load or returning rate-limit errors when browsing many apps.

How to update

From the root folder of your runtipi install

./runtipi-cli update v4.9.1

If you are coming from version 3 or lower please follow the migration guide

View release on GitHub

v4.9.0 Bug fix 3mo

Notable features

Safe HTML rendering in markdown descriptions
Custom cron implementation avoiding daylight saving time bugs
Dedicated Traefik forward-auth cookie for session isolation

Full changelog

Release notes

Improvements

Markdown descriptions now render safe embedded HTML while sanitizing unsafe content, improving app description rendering without allowing scripts or unsafe links.
Replaced our cron library with a custom implementation to avoid an upstream bug making the server crash during daylight saving time changes
Protected apps behind Traefik now use a dedicated forward-auth cookie instead of reusing the dashboard session cookie, improving session isolation.

Bug fixes

Fixed a race condition during first admin/operator registration that could allow multiple operators to be created concurrently.
Fixed an issue cause by an outdated RabbitMQ configuration.

How to update

From the root folder of your runtipi install

./runtipi-cli update v4.9.0

If you are coming from version 3 or lower please follow the migration guide

View release on GitHub

v4.8.2 Bug fix 3mo

Fixed custom app compose editing to preserve Docker root-level sections like volumes and networks, corrected breadcrumb routing, fixed yaml serialization for empty volumes.

View release on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.