Replies: 19 comments 31 replies
-
|
Hey @rj10rd, sorry for the late response — this slipped past us and we apologize for not catching it sooner. This is the same issue tracked in #91. A fix has been merged and will ship in v1.3.7, which is going out today. The root cause: when only the image digest changed (same tag, new image hash), the compose trigger was skipping the update because the image string in the compose file hadn't changed. The fix ensures the container is still recreated for digest-only updates, even though no compose file write is needed. Please update to v1.3.7 once it's released and let us know if the issue persists. Thanks for reporting this! |
Beta Was this translation helpful? Give feedback.
-
|
v1.3.7 is now released! Please update and let us know if the issue persists. Thank you for your patience and for using drydock — we really appreciate the report. |
Beta Was this translation helpful? Give feedback.
-
|
In version 1.3.9 docker compose trigger successfully working but after update image prune not working |
Beta Was this translation helpful? Give feedback.
-
|
Hey @rj10rd! Great news that the compose trigger is working for you on v1.3.9 — that makes our day! You're absolutely right though — the image prune feature got caught up in a larger trigger refactor and isn't behaving properly right now. That's totally on us and we're sorry about that. The good news is we're deep into v1.4 right now, which brings a shiny new dashboard UI AND wraps up the trigger refactor that will get prune (and a few other things) back to full health. It's a big one and we're really excited about it. Thank you so much for sticking with us and for taking the time to report back — users like you make drydock better. We'll get this sorted! |
Beta Was this translation helpful? Give feedback.
-
|
Image prune after compose updates is fixed in v1.4.0. The release candidate is available now: Make sure |
Beta Was this translation helpful? Give feedback.
-
|
Ok sir i test it and report you back 🙂 |
Beta Was this translation helpful? Give feedback.
-
|
Thank you sir i am searching this in changelog . 👍🏼 |
Beta Was this translation helpful? Give feedback.
-
|
DD_AUTH_ANONYMOUS_CONFIRM=true not working sir . After add this environment variable and then recreate container i am still required auth method |
Beta Was this translation helpful? Give feedback.
-
|
Good catch @rj10rd — you found a real bug! 🐛
We've renamed it to services:
drydock:
image: codeswhat/drydock:1.4.0-rc.4
environment:
- DD_ANONYMOUS_AUTH_CONFIRM=trueThat said — if you're upgrading from v1.3.9, rc.4 will detect your existing install automatically and allow anonymous access with a startup warning. You shouldn't need the env var at all unless you want to silence the warning. If you do want to set up authentication (recommended), here's the quickest path: environment:
- DD_AUTH_BASIC_ADMIN_USER=admin
- "DD_AUTH_BASIC_ADMIN_HASH={SHA}your-sha1-hash-here="Thank you for reporting this — your testing caught something we missed. Really appreciate it! |
Beta Was this translation helpful? Give feedback.
-
|
When i excute docker compose trigger i get this error |
Beta Was this translation helpful? Give feedback.
-
EBUSY compose file errorThe This is fixed in the upcoming rc.6 with a two-layer defense:
Please update to rc.6 when it's available and let us know if the issue persists. |
Beta Was this translation helpful? Give feedback.
-
|
One more problem i successfully mounted all dockercompe file in drydock but without running root it say permission denied. And on mobile ui not show full page some options are hidden at bottom at dashboard page |
Beta Was this translation helpful? Give feedback.
-
|
Hey @rj10rd — this is expected behavior and it's by design for security. Drydock runs as the Recommended fix — match file ownershipOn your host, set the compose file(s) to be owned by UID 1000 (the # Change ownership of your compose file(s) to UID 1000
sudo chown 1000:1000 /path/to/your/docker-compose.yml
# Or if you mount a whole directory:
sudo chown -R 1000:1000 /path/to/compose-dir/Alternative — break-glass root modeIf changing file ownership is not practical in your setup, you can run Drydock as root. This requires both env vars as an explicit safety acknowledgment: services:
drydock:
image: codeswhat/drydock:1.4.0-rc.6
environment:
- DD_RUN_AS_ROOT=true
- DD_ALLOW_INSECURE_ROOT=trueThis disables the privilege drop entirely. It works but is less secure — we recommend the Quick diagnosticCould you share the output of these commands so we can confirm the exact issue? # What user is drydock running as?
docker exec <drydock-container> id
# What are the permissions on your mounted compose file(s)?
ls -la /path/to/your/docker-compose.yml
# What does the drydock log say?
docker logs <drydock-container> --tail 20This will tell us whether it's a file ownership mismatch or something else (like a read-only mount). Thanks for your patience — you're really putting rc.6 through its paces! |
Beta Was this translation helpful? Give feedback.
-
Mobile dashboard scrollingThanks for flagging this @rj10rd — we reproduced it. The dashboard content (widgets at the bottom like Host Status and Update Breakdown) is there but gets clipped on small screens. The root cause is how the layout handles overflow on mobile. The scroll container is nested inside fixed-height parents, and touch events on some mobile browsers don't reach the inner scrollable area properly. Desktop mouse-wheel scrolling works fine because the event targeting is different. We'll get a fix into the v1.4.0 stable release. In the meantime, the content is accessible if you rotate to landscape or use a tablet-sized viewport. Could you tell us:
This helps us prioritize the right fix. Thank you! |
Beta Was this translation helpful? Give feedback.
-
|
I am using Android 16 chrome. Sorry for my mistake all compose file owner is root and my containers are running with root permission |
Beta Was this translation helpful? Give feedback.
-
|
Thanks for the info @rj10rd! Mobile scrolling (Android 16 Chrome)Perfect — that confirms it. We've already fixed this and it'll ship in v1.4.0 stable. The issue was a CSS overflow clipping that prevented touch scrolling on mobile browsers. Compose file permissionsThat's the issue — since your compose files are owned by Option A — Change file ownership (recommended): sudo chown 1000:1000 /path/to/your/docker-compose.ymlOption B — Run Drydock as root: environment:
- DD_RUN_AS_ROOT=true
- DD_ALLOW_INSECURE_ROOT=trueSince your containers already run as root, Option B is the path of least resistance. Just add those two env vars to your Drydock service and the permission denied errors will go away. Let us know if that resolves it! |
Beta Was this translation helpful? Give feedback.
-
|
Great question! This is definitely planned and it's one of the features we're most excited about. Right now, yes — labels have to go in your compose file and triggers require environment variables + a container restart. We know that's not ideal. In v1.8.0 we're building Live UI Configuration Panels that will let you do exactly what you're describing:
Hot-reloadable settings take effect immediately — no container restart needed. Only infrastructure-level config (Docker socket, registry credentials, auth providers) will still require env vars. It's a few releases away (v1.5 → v1.6 → v1.7 → v1.8), but it's a high priority because it's the single biggest UX improvement on our roadmap. Thank you for asking — it's great to know users want this! |
Beta Was this translation helpful? Give feedback.
-
|
Thank you sir for this awesome app. I more question you know about casaos and dockge. |
Beta Was this translation helpful? Give feedback.
-
|
Thanks for using it! What questions do you have and we can try to answer them. |
Beta Was this translation helpful? Give feedback.
-
|
Add option to manage compose file directly from drydock ui like dockge or casaos. It very helpful if drydock have these features. Because dockge development not in active stage. These features make drydock all in one place for docker update and docker compose management app. |
Beta Was this translation helpful? Give feedback.
-
|
We will be adding this in the later releases mentioned above! |
Beta Was this translation helpful? Give feedback.
-
|
All issues raised in this thread have been addressed:
Thanks for all the testing and reports @rj10rd — closing this one out! |
Beta Was this translation helpful? Give feedback.
-
|
Sirr see this |
Beta Was this translation helpful? Give feedback.
-
|
Hey @rj10rd — good catch, this is a real bug! The This is already fixed and will ship in v1.4.0-rc.8. The fix allows absolute paths from Docker labels to bypass the boundary check (they represent explicit operator configuration), while still blocking relative path traversal. We will get rc.8 out shortly — thank you for continuing to test and report back! |
Beta Was this translation helpful? Give feedback.
-
|
Update: This fix shipped in v1.4.0-rc.10 (not rc.8 as originally estimated — we needed additional fixes for host path remapping and trigger affinity filtering that were discovered during testing). Upgrade to rc.10 and the boundary enforcement error should be gone. |
Beta Was this translation helpful? Give feedback.
-
|
Sir please tell me all newly added environment variable and there use. |
Beta Was this translation helpful? Give feedback.
-
|
Hey @rj10rd! Here are all the new environment variables added in v1.4.0, organized by category. Authentication & Security
Server & HTTP
Security Scanning
Webhook Tokens
Docker Compose Trigger
Lifecycle Hooks
Logging
Monitoring
Total: 24 new environment variables across 8 categories. All of these have sensible defaults, so you only need to set them if you want to change the behavior. The only one you might need on upgrade is Full documentation for each variable is at the configuration docs. Let us know if you have questions about any of them! |
Beta Was this translation helpful? Give feedback.
-
|
Sir your mentioned link not working https://drydock.dev/docs/configuration |
Beta Was this translation helpful? Give feedback.
-
|
Apologies @rj10rd — that was a typo on our part! The correct link is: drydock.codeswhat.com/docs/configuration That will take you to the full configuration reference. Sorry about that! |
Beta Was this translation helpful? Give feedback.
-
|
Now in latest dev version docker compose trigger working?? |
Beta Was this translation helpful? Give feedback.
-
|
Yes! The compose trigger has received several fixes across rc.10 through rc.12:
If you upgrade to the latest rc.12, your compose trigger configuration should work as-is. Let us know if you hit any issues! |
Beta Was this translation helpful? Give feedback.
-
|
@rj10rd Correction: |
Beta Was this translation helpful? Give feedback.
-
|
I am already using DD_SERVER_TRUSTPROXY=1 but trigger not worked |
Beta Was this translation helpful? Give feedback.
-
|
@rj10rd Can you help us narrow this down?
This will tell us whether the issue is CSRF still blocking the request, or if the trigger fires but fails to update the compose file. |
Beta Was this translation helpful? Give feedback.
-
|
Update: We just finished a full QA test of the compose trigger behind a TLS-terminating reverse proxy (nginx). Here's what we confirmed: What works
What fails
Troubleshooting checklistSince you're already using
If your proxy is Nginx Proxy Manager, make sure the advanced config includes: proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Host $http_host;If it's Traefik, these headers are sent automatically. If it's Caddy, the Once we see which error you're getting and what proxy you're using, we can pinpoint the exact fix. |
Beta Was this translation helpful? Give feedback.
-
|
I am using pangolin with traefik reverse proxy When you click the compose trigger button, do you see any error in the UI (like a red toast or 403)? Or does it say success but nothing actually updates? Ans- it say successfully trigger executed but nothing actually update. |
Beta Was this translation helpful? Give feedback.
-
|
@rj10rd Thanks for checking — that's really helpful! The fact that the UI says "successfully trigger executed" means the CSRF issue is not the problem here. The trigger is firing and returning 200 OK. The issue is somewhere between the trigger executing and the actual container getting updated. A few things to check: 1. Drydock logs right after clicking the triggerdocker logs drydock --tail 30Look for any lines mentioning 2. Compose file pathWhat is your 3. Volume mountThe directory containing your compose file must be mounted into the drydock container. Something like: volumes:
- /opt/stacks:/stacksThen your trigger file path would be 4. Check if the compose file was actually modifiedAfter clicking the trigger, check the compose file on the host: cat /path/to/your/docker-compose.ymlDid the image tag actually change? If not, drydock either can't find the file or can't write to it. The logs from step 1 will almost certainly reveal the root cause — please paste them here and we'll get this sorted out. |
Beta Was this translation helpful? Give feedback.
-
|
See this sir |
Beta Was this translation helpful? Give feedback.
-
|
@rj10rd Thank you for running that — this is exactly what we needed. And apologies for the confusion about WUD, we see now that's just your DNS name for Drydock! What the logs tell usThe filtered logs show zero compose-specific messages between the trigger execution lines. No "Processing compose file", no "No compose file found", no "permission denied", no "already up to date" — nothing. This means the trigger fires but silently skips your filebrowser container before it even attempts to update the compose file. The most likely cause: the compose file path that drydock detects from the container doesn't match your trigger configuration. This skip is logged at To confirm: please run these two commands1. Check your compose trigger config: docker exec drydock env | grep -i DD_TRIGGER_DOCKERCOMPOSE2. Check what compose file path drydock detects for filebrowser: docker inspect filebrowser --format '{{index .Config.Labels "com.docker.compose.project.config_files"}} | {{index .Config.Labels "com.docker.compose.project.working_dir"}}'What we're looking forIf you have For example, if your compose file is at If you don't have Quick test: enable debug logging temporarilyAdd this to your drydock environment and recreate the container: environment:
- DD_LOG_LEVEL=debugThen click the trigger button once and run the same filtered log command. The debug output will show us exactly why the container is being skipped. Once we see the debug output, we'll have the exact fix for you. |
Beta Was this translation helpful? Give feedback.
-
|
|
Beta Was this translation helpful? Give feedback.
-
|
Thanks for sharing the full config @rj10rd — we found the root cause. The problemYour That's a directory, not a file. The compose trigger expects a path to the actual compose file (e.g., The fix (shipping in rc.12)
So your existing config ( rc.12 also adds a no-op guard: if the trigger fires but no compose updates are actually applied, it now throws an error instead of silently reporting success. This means you'll see a clear error message instead of a false "success" going forward. Immediate workaround (before rc.12)Change your config to point directly to the compose file: - DD_TRIGGER_DOCKERCOMPOSE_Filebrowser_FILE=/home/ubuntu/docker/dockge/stacks/fb/compose.yaml(Or We'll tag rc.12 shortly — thanks for the patience and the debug output! |
Beta Was this translation helpful? Give feedback.
-
|
Thanks sir thats worked. One more question if i using tag like x.xx.xx then dd.watch.digest labels is required. |
Beta Was this translation helpful? Give feedback.
-
|
Glad to hear it worked! No, Here's when you need each:
So for your filebrowser ( You'd only add |
Beta Was this translation helpful? Give feedback.
-
|
Maintainer security note: The original diagnostic comment was removed because it contained a publicly exposed Telegram bot token. The configuration is reproduced below with the token, chat ID, and public host redacted. @rj10rd, please revoke/rotate the exposed token immediately through Telegram BotFather and update the value in your deployment. Do not post the replacement token here. Reply once rotation is complete so we can close the security alert. My drydock compose file services: |
Beta Was this translation helpful? Give feedback.
-
|
Hey @rj10rd, quick follow-up on the security note above: can you confirm you've revoked/rotated that Telegram bot token? It was publicly visible here, so anyone could use it to read or send messages as your bot until it's rotated. Takes 30 seconds: message @Botfather, send /revoke, pick the bot, and it issues a fresh token. Once you confirm, we'll close out the alert on our side. |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
-
When an update available and i hit docker compose trigger it say trigger successfully executed but nothing change in compose file and app not updated
Beta Was this translation helpful? Give feedback.
All reactions