Update compose-command-injection.test.ts

apps/dokploy/__test__/cluster/registry-node-injection.test.ts

@@ -1,70 +0,0 @@
-import { execSync } from "node:child_process";
-import { existsSync, rmSync } from "node:fs";
-import { getRegistryTag } from "@dokploy/server/utils/cluster/upload";
-import { parse, quote } from "shell-quote";
-import { describe, expect, it } from "vitest";
-
-const MARK = `/tmp/dokploy_regnode_pwned_${process.pid}`;
-
-const runsSafely = (command: string) => {
-	if (existsSync(MARK)) rmSync(MARK);
-	try {
-		execSync(command, { shell: "/bin/sh", stdio: "ignore" });
-	} catch {}
-	const fired = existsSync(MARK);
-	if (existsSync(MARK)) rmSync(MARK);
-	return !fired;
-};
-
-const PAYLOADS = (m: string) => [
-	`$(touch ${m})`,
-	"`touch " + m + "`",
-	`x; touch ${m}`,
-	`x | touch ${m}`,
-];
-
-describe("cluster removeWorker nodeId injection", () => {
-	// docker node update/rm ${quote([nodeId])} — replace `docker node` with `:`.
-	it("escapes nodeId in drain/remove commands", () => {
-		for (const nodeId of PAYLOADS(MARK)) {
-			const drain = `: node update --availability drain ${quote([nodeId])}`;
-			const remove = `: node rm ${quote([nodeId])} --force`;
-			expect(runsSafely(drain)).toBe(true);
-			expect(runsSafely(remove)).toBe(true);
-		}
-	});
-});
-
-describe("swarm upload registry tag/push injection", () => {
-	// registryTag is built from registryUrl/username/imagePrefix (username and
-	// imagePrefix have no schema regex). Assert docker tag/push stay safe.
-	it("escapes a malicious imagePrefix flowing into the registry tag", () => {
-		for (const payload of PAYLOADS(MARK)) {
-			const registryTag = getRegistryTag(
-				{
-					registryUrl: "registry.example.com",
-					imagePrefix: payload,
-					username: "user",
-				} as any,
-				"app:latest",
-			);
-			const tagCmd = `: tag ${quote(["app:latest"])} ${quote([registryTag])}`;
-			const pushCmd = `: push ${quote([registryTag])}`;
-			expect(runsSafely(tagCmd)).toBe(true);
-			expect(runsSafely(pushCmd)).toBe(true);
-		}
-	});
-
-	it("keeps a legitimate registry tag intact", () => {
-		const tag = getRegistryTag(
-			{
-				registryUrl: "registry.example.com",
-				imagePrefix: "team",
-				username: "user",
-			} as any,
-			"myapp:1.2.3",
-		);
-		expect(tag).toBe("registry.example.com/team/myapp:1.2.3");
-		expect(parse(quote([tag]))).toEqual([tag]);
-	});
-});

apps/dokploy/__test__/compose/compose-command-injection.test.ts

@@ -5,7 +5,6 @@ import { parse, quote } from "shell-quote";
 import { describe, expect, it } from "vitest";
 
 const MARK = `/tmp/dokploy_compose_pwned_${process.pid}`;
-
 const base = {
 	composeType: "docker-compose" as const,
 	appName: "compose-app",

apps/dokploy/__test__/git-provider/git-clone-command-injection.test.ts

@@ -1,10 +1,8 @@
 import { cloneGitRepository } from "@dokploy/server/utils/providers/git";
-import { parse, quote } from "shell-quote";
+import { shellWord } from "@dokploy/server/utils/providers/utils";
+import { parse } from "shell-quote";
 import { describe, expect, it } from "vitest";
 
-// How git-provider commands escape a single user value before it reaches the shell.
-const shellArg = (value: string) => quote([String(value ?? "")]);
-
 // Payloads that, if reached a shell unescaped, would execute commands.
 const INJECTION_PAYLOADS = [
 	"$(touch /tmp/pwned)",
@@ -26,10 +24,10 @@ const LEGIT_VALUES = [
 	"https://gitlab.example.com/group/sub/project.git",
 ];
 
-describe("git provider shell escaping (quote)", () => {
+describe("shellWord (git provider shell escaping)", () => {
 	it("collapses every injection payload into a single literal token (no shell operators)", () => {
 		for (const payload of INJECTION_PAYLOADS) {
-			const parsed = parse(shellArg(payload));
+			const parsed = parse(shellWord(payload));
 			// A safely escaped value parses back to exactly the original string,
 			// as ONE token. If escaping failed, parse() would emit operator
 			// objects such as { op: ";" } or { op: "$(" } instead.
@@ -39,7 +37,7 @@ describe("git provider shell escaping (quote)", () => {
 
 	it("leaves legitimate URLs and branch names intact", () => {
 		for (const value of LEGIT_VALUES) {
-			expect(parse(shellArg(value))).toEqual([value]);
+			expect(parse(shellWord(value))).toEqual([value]);
 		}
 	});
 });

apps/dokploy/__test__/wss/authorize.test.ts

@@ -1,104 +0,0 @@
-import { beforeEach, describe, expect, it, vi } from "vitest";
-
-// Mock the permission + server helpers the wss authorizer composes.
-const mockHasPermission = vi.hoisted(() => vi.fn());
-const mockFindMember = vi.hoisted(() => vi.fn());
-const mockCheckServiceAccess = vi.hoisted(() => vi.fn());
-vi.mock("@dokploy/server/services/permission", () => ({
-	hasPermission: mockHasPermission,
-	findMemberByUserId: mockFindMember,
-	checkServiceAccess: mockCheckServiceAccess,
-}));
-
-const mockGetAccessibleServerIds = vi.hoisted(() => vi.fn());
-vi.mock("@dokploy/server", () => ({
-	getAccessibleServerIds: mockGetAccessibleServerIds,
-}));
-
-import {
-	canAccessDockerOverWss,
-	canAccessTerminalOverWss,
-} from "@/server/wss/authorize";
-
-const USER = { id: "user-1" };
-const SESSION = { activeOrganizationId: "org-1" };
-
-beforeEach(() => {
-	vi.clearAllMocks();
-});
-
-describe("canAccessDockerOverWss", () => {
-	it("denies when there is no user or session", async () => {
-		expect(await canAccessDockerOverWss(null, SESSION)).toBe(false);
-		expect(await canAccessDockerOverWss(USER, null)).toBe(false);
-	});
-
-	it("denies a member without docker permission", async () => {
-		mockHasPermission.mockResolvedValue(false);
-		expect(await canAccessDockerOverWss(USER, SESSION)).toBe(false);
-	});
-
-	it("allows when the caller has docker permission (no server)", async () => {
-		mockHasPermission.mockResolvedValue(true);
-		expect(await canAccessDockerOverWss(USER, SESSION)).toBe(true);
-	});
-
-	it("denies a remote server the caller cannot access, even with docker permission", async () => {
-		mockHasPermission.mockResolvedValue(true);
-		mockGetAccessibleServerIds.mockResolvedValue(new Set(["other-server"]));
-		expect(await canAccessDockerOverWss(USER, SESSION, "srv-1")).toBe(false);
-	});
-
-	it("allows a remote server the caller can access", async () => {
-		mockHasPermission.mockResolvedValue(true);
-		mockGetAccessibleServerIds.mockResolvedValue(new Set(["srv-1"]));
-		expect(await canAccessDockerOverWss(USER, SESSION, "srv-1")).toBe(true);
-	});
-
-	it("denies when the container belongs to a service the caller cannot access", async () => {
-		mockCheckServiceAccess.mockRejectedValue(new Error("no access"));
-		expect(await canAccessDockerOverWss(USER, SESSION, null, "svc-1")).toBe(
-			false,
-		);
-	});
-
-	it("allows service access even without docker permission or server access", async () => {
-		// A member granted the service but without canAccessToDocker, whose
-		// service runs on a server they were not individually granted, must still
-		// read its logs — matches application.readLogs (service access only).
-		mockHasPermission.mockResolvedValue(false);
-		mockGetAccessibleServerIds.mockResolvedValue(new Set());
-		mockCheckServiceAccess.mockResolvedValue(undefined);
-		expect(
-			await canAccessDockerOverWss(USER, SESSION, "srv-remote", "svc-1"),
-		).toBe(true);
-		// Service path is authoritative — it must not fall through to docker/server.
-		expect(mockHasPermission).not.toHaveBeenCalled();
-		expect(mockGetAccessibleServerIds).not.toHaveBeenCalled();
-	});
-});
-
-describe("canAccessTerminalOverWss", () => {
-	it("denies the local host terminal to a plain member", async () => {
-		mockFindMember.mockResolvedValue({ role: "member" });
-		expect(await canAccessTerminalOverWss(USER, SESSION, "local")).toBe(false);
-	});
-
-	it("allows the local host terminal to an owner", async () => {
-		mockFindMember.mockResolvedValue({ role: "owner" });
-		expect(await canAccessTerminalOverWss(USER, SESSION, "local")).toBe(true);
-	});
-
-	it("allows the local host terminal to an admin", async () => {
-		mockFindMember.mockResolvedValue({ role: "admin" });
-		expect(await canAccessTerminalOverWss(USER, SESSION, "local")).toBe(true);
-	});
-
-	it("gates a remote server terminal on server access", async () => {
-		mockGetAccessibleServerIds.mockResolvedValue(new Set(["srv-1"]));
-		expect(await canAccessTerminalOverWss(USER, SESSION, "srv-1")).toBe(true);
-		expect(await canAccessTerminalOverWss(USER, SESSION, "srv-2")).toBe(false);
-		// role lookup must not be needed for the remote path
-		expect(mockFindMember).not.toHaveBeenCalled();
-	});
-});

apps/dokploy/components/dashboard/application/general/show.tsx

@@ -271,7 +271,6 @@ export const ShowGeneralApplication = ({ applicationId }: Props) => {
 					<DockerTerminalModal
 						appName={data?.appName || ""}
 						serverId={data?.serverId || ""}
-						serviceId={applicationId}
 					>
 						<Button
 							variant="outline"

apps/dokploy/components/dashboard/application/logs/show.tsx

@@ -50,10 +50,9 @@ export const badgeStateColor = (state: string) => {
 interface Props {
 	appName: string;
 	serverId?: string;
-	serviceId?: string;
 }
 
-export const ShowDockerLogs = ({ appName, serverId, serviceId }: Props) => {
+export const ShowDockerLogs = ({ appName, serverId }: Props) => {
 	const [containerId, setContainerId] = useState<string | undefined>();
 	const [option, setOption] = useState<"swarm" | "native">("native");
 
@@ -183,7 +182,6 @@ export const ShowDockerLogs = ({ appName, serverId, serviceId }: Props) => {
 					serverId={serverId || ""}
 					containerId={containerId || "select-a-container"}
 					runType={option}
-					serviceId={serviceId}
 				/>
 			</CardContent>
 		</Card>

apps/dokploy/components/dashboard/compose/containers/show-compose-containers.tsx

@@ -55,14 +55,12 @@ interface Props {
 	appName: string;
 	serverId?: string;
 	appType: "stack" | "docker-compose";
-	serviceId?: string;
 }
 
 export const ShowComposeContainers = ({
 	appName,
 	appType,
 	serverId,
-	serviceId,
 }: Props) => {
 	const { data, isPending, refetch } =
 		api.docker.getContainersByAppNameMatch.useQuery(
@@ -124,7 +122,6 @@ export const ShowComposeContainers = ({
 										key={container.containerId}
 										container={container}
 										serverId={serverId}
-										serviceId={serviceId}
 										onActionComplete={() => refetch()}
 									/>
 								))}
@@ -145,14 +142,12 @@ interface ContainerRowProps {
 		status: string;
 	};
 	serverId?: string;
-	serviceId?: string;
 	onActionComplete: () => void;
 }
 
 const ContainerRow = ({
 	container,
 	serverId,
-	serviceId,
 	onActionComplete,
 }: ContainerRowProps) => {
 	const [logsOpen, setLogsOpen] = useState(false);
@@ -241,7 +236,6 @@ const ContainerRow = ({
 							<DockerTerminalModal
 								containerId={container.containerId}
 								serverId={serverId || ""}
-								serviceId={serviceId}
 							>
 								Terminal
 							</DockerTerminalModal>
@@ -286,7 +280,6 @@ const ContainerRow = ({
 								containerId={container.containerId}
 								serverId={serverId}
 								runType="native"
-								serviceId={serviceId}
 							/>
 						</div>
 					</DialogContent>

apps/dokploy/components/dashboard/compose/general/actions.tsx

@@ -206,7 +206,6 @@ export const ComposeActions = ({ composeId }: Props) => {
 				appName={data?.appName || ""}
 				serverId={data?.serverId || ""}
 				appType={data?.composeType || "docker-compose"}
-				serviceId={data?.composeId}
 			>
 				<Button
 					variant="outline"

apps/dokploy/components/dashboard/compose/logs/show-stack.tsx

@@ -35,14 +35,9 @@ export const DockerLogs = dynamic(
 interface Props {
 	appName: string;
 	serverId?: string;
-	serviceId?: string;
 }
 
-export const ShowDockerLogsStack = ({
-	appName,
-	serverId,
-	serviceId,
-}: Props) => {
+export const ShowDockerLogsStack = ({ appName, serverId }: Props) => {
 	const [option, setOption] = useState<"swarm" | "native">("native");
 	const [containerId, setContainerId] = useState<string | undefined>();
 
@@ -172,7 +167,6 @@ export const ShowDockerLogsStack = ({
 					serverId={serverId || ""}
 					containerId={containerId || "select-a-container"}
 					runType={option}
-					serviceId={serviceId}
 				/>
 			</CardContent>
 		</Card>

apps/dokploy/components/dashboard/compose/logs/show.tsx

@@ -35,14 +35,12 @@ interface Props {
 	appName: string;
 	serverId?: string;
 	appType: "stack" | "docker-compose";
-	serviceId?: string;
 }
 
 export const ShowDockerLogsCompose = ({
 	appName,
 	appType,
 	serverId,
-	serviceId,
 }: Props) => {
 	const { data, isPending } = api.docker.getContainersByAppNameMatch.useQuery(
 		{
@@ -106,7 +104,6 @@ export const ShowDockerLogsCompose = ({
 					serverId={serverId || ""}
 					containerId={containerId || "select-a-container"}
 					runType="native"
-					serviceId={serviceId}
 				/>
 			</CardContent>
 		</Card>

apps/dokploy/components/dashboard/docker/logs/docker-logs-id.tsx

@@ -23,7 +23,6 @@ interface Props {
 	containerId: string;
 	serverId?: string | null;
 	runType: "swarm" | "native";
-	serviceId?: string;
 }
 
 export const priorities = [
@@ -53,7 +52,6 @@ export const DockerLogsId: React.FC<Props> = ({
 	containerId,
 	serverId,
 	runType,
-	serviceId,
 }) => {
 	const { data } = api.docker.getConfig.useQuery(
 		{
@@ -159,10 +157,6 @@ export const DockerLogsId: React.FC<Props> = ({
 			params.append("serverId", serverId);
 		}
 
-		if (serviceId) {
-			params.append("serviceId", serviceId);
-		}
-
 		const wsUrl = `${protocol}//${
 			window.location.host
 		}/docker-container-logs?${params.toString()}`;
@@ -228,7 +222,7 @@ export const DockerLogsId: React.FC<Props> = ({
 				ws.close();
 			}
 		};
-	}, [containerId, serverId, serviceId, lines, search, since]);
+	}, [containerId, serverId, lines, search, since]);
 
 	const handleDownload = () => {
 		const logContent = filteredLogs

apps/dokploy/components/dashboard/docker/terminal/docker-terminal-modal.tsx

@@ -23,14 +23,12 @@ interface Props {
 	containerId: string;
 	serverId?: string;
 	children?: React.ReactNode;
-	serviceId?: string;
 }
 
 export const DockerTerminalModal = ({
 	children,
 	containerId,
 	serverId,
-	serviceId,
 }: Props) => {
 	const [mainDialogOpen, setMainDialogOpen] = useState(false);
 	const [confirmDialogOpen, setConfirmDialogOpen] = useState(false);
@@ -76,7 +74,6 @@ export const DockerTerminalModal = ({
 					id="terminal"
 					containerId={containerId}
 					serverId={serverId || ""}
-					serviceId={serviceId}
 				/>
 				<Dialog open={confirmDialogOpen} onOpenChange={setConfirmDialogOpen}>
 					<DialogContent onEscapeKeyDown={(event) => event.preventDefault()}>

apps/dokploy/components/dashboard/docker/terminal/docker-terminal.tsx

@@ -10,14 +10,12 @@ interface Props {
 	id: string;
 	containerId?: string;
 	serverId?: string;
-	serviceId?: string;
 }
 
 export const DockerTerminal: React.FC<Props> = ({
 	id,
 	containerId,
 	serverId,
-	serviceId,
 }) => {
 	const termRef = useRef(null);
 	const [activeWay, setActiveWay] = React.useState<string | undefined>("bash");
@@ -40,7 +38,7 @@ export const DockerTerminal: React.FC<Props> = ({
 		const addonFit = new FitAddon();
 		const protocol = window.location.protocol === "https:" ? "wss:" : "ws:";
 
-		const wsUrl = `${protocol}//${window.location.host}/docker-container-terminal?containerId=${containerId}&activeWay=${activeWay}${serverId ? `&serverId=${serverId}` : ""}${serviceId ? `&serviceId=${serviceId}` : ""}`;
+		const wsUrl = `${protocol}//${window.location.host}/docker-container-terminal?containerId=${containerId}&activeWay=${activeWay}${serverId ? `&serverId=${serverId}` : ""}`;
 
 		const ws = new WebSocket(wsUrl);
 

apps/dokploy/components/dashboard/libsql/general/show-general-libsql.tsx

@@ -229,7 +229,6 @@ export const ShowGeneralLibsql = ({ libsqlId }: Props) => {
 						)}
 						<DockerTerminalModal
 							appName={data?.appName || ""}
-							serviceId={data?.libsqlId}
 							serverId={data?.serverId || ""}
 						>
 							<Button

apps/dokploy/components/dashboard/mariadb/general/show-general-mariadb.tsx

@@ -236,7 +236,6 @@ export const ShowGeneralMariadb = ({ mariadbId }: Props) => {
 							))}
 						<DockerTerminalModal
 							appName={data?.appName || ""}
-							serviceId={data?.mariadbId}
 							serverId={data?.serverId || ""}
 						>
 							<Button

apps/dokploy/components/dashboard/mongo/general/show-general-mongo.tsx

@@ -230,7 +230,6 @@ export const ShowGeneralMongo = ({ mongoId }: Props) => {
 						</TooltipProvider>
 						<DockerTerminalModal
 							appName={data?.appName || ""}
-							serviceId={data?.mongoId}
 							serverId={data?.serverId || ""}
 						>
 							<Button

apps/dokploy/components/dashboard/mysql/general/show-general-mysql.tsx

@@ -228,7 +228,6 @@ export const ShowGeneralMysql = ({ mysqlId }: Props) => {
 						</TooltipProvider>
 						<DockerTerminalModal
 							appName={data?.appName || ""}
-							serviceId={data?.mysqlId}
 							serverId={data?.serverId || ""}
 						>
 							<Button

apps/dokploy/components/dashboard/postgres/general/show-general-postgres.tsx

@@ -234,7 +234,6 @@ export const ShowGeneralPostgres = ({ postgresId }: Props) => {
 						</TooltipProvider>
 						<DockerTerminalModal
 							appName={data?.appName || ""}
-							serviceId={data?.postgresId}
 							serverId={data?.serverId || ""}
 						>
 							<Button

apps/dokploy/components/dashboard/redis/general/show-general-redis.tsx

@@ -229,7 +229,6 @@ export const ShowGeneralRedis = ({ redisId }: Props) => {
 						</TooltipProvider>
 						<DockerTerminalModal
 							appName={data?.appName || ""}
-							serviceId={data?.redisId}
 							serverId={data?.serverId || ""}
 						>
 							<Button

apps/dokploy/components/dashboard/settings/web-server/docker-terminal-modal.tsx

@@ -40,7 +40,6 @@ interface Props {
 	children?: React.ReactNode;
 	serverId?: string;
 	appType?: "stack" | "docker-compose";
-	serviceId?: string;
 }
 
 export const DockerTerminalModal = ({
@@ -48,7 +47,6 @@ export const DockerTerminalModal = ({
 	appName,
 	serverId,
 	appType,
-	serviceId,
 }: Props) => {
 	const { data, isPending } = api.docker.getContainersByAppNameMatch.useQuery(
 		{
@@ -133,7 +131,6 @@ export const DockerTerminalModal = ({
 					serverId={serverId || ""}
 					id="terminal"
 					containerId={containerId || "select-a-container"}
-					serviceId={serviceId}
 				/>
 				<Dialog open={confirmDialogOpen} onOpenChange={setConfirmDialogOpen}>
 					<DialogContent onEscapeKeyDown={(event) => event.preventDefault()}>

apps/dokploy/components/layouts/side.tsx

@@ -648,7 +648,7 @@ function SidebarLogo() {
 								</SidebarMenuButton>
 							</DropdownMenuTrigger>
 							<DropdownMenuContent
-								className="w-64 rounded-lg max-h-[min(70vh,28rem)] flex flex-col"
+								className="rounded-lg max-h-[min(70vh,28rem)] flex flex-col"
 								align="start"
 								side={isMobile ? "bottom" : "right"}
 								sideOffset={4}

apps/dokploy/pages/api/providers/github/setup.ts

@@ -1,6 +1,5 @@
-import { createGithub, validateRequest } from "@dokploy/server";
+import { createGithub } from "@dokploy/server";
 import { db } from "@dokploy/server/db";
-import { hasPermission } from "@dokploy/server/services/permission";
 import { eq } from "drizzle-orm";
 import type { NextApiRequest, NextApiResponse } from "next";
 import { Octokit } from "octokit";
@@ -22,22 +21,18 @@ export default async function handler(
 	if (!code) {
 		return res.status(400).json({ error: "Missing code parameter" });
 	}
-
-	const { user, session } = await validateRequest(req);
-	if (!user || !session?.activeOrganizationId) {
-		return res.status(401).json({ error: "Unauthorized" });
-	}
-	const ctx = {
-		user: { id: user.id },
-		session: { activeOrganizationId: session.activeOrganizationId },
-	};
-
-	const [action] = state?.split(":") ?? [];
-	if (!(await hasPermission(ctx, { gitProviders: ["create"] }))) {
-		return res.status(403).json({ error: "Forbidden" });
-	}
+	const [action, ...rest] = state?.split(":");
+	// For gh_init: rest[0] = organizationId, rest[1] = userId
+	// For gh_setup: rest[0] = githubProviderId
 
 	if (action === "gh_init") {
+		const organizationId = rest[0];
+		const userId = rest[1] || (req.query.userId as string);
+
+		if (!userId) {
+			return res.status(400).json({ error: "Missing userId parameter" });
+		}
+
 		const octokit = new Octokit({});
 		const { data } = await octokit.request(
 			"POST /app-manifests/{code}/conversions",
@@ -56,32 +51,16 @@ export default async function handler(
 				githubWebhookSecret: data.webhook_secret,
 				githubPrivateKey: data.pem,
 			},
-			session.activeOrganizationId,
-			user.id,
+			organizationId as string,
+			userId,
 		);
 	} else if (action === "gh_setup") {
-		const githubId = state?.split(":")[1];
-		if (!githubId) {
-			return res.status(400).json({ error: "Missing github provider id" });
-		}
-
-		const provider = await db.query.github.findFirst({
-			where: eq(github.githubId, githubId),
-			with: { gitProvider: true },
-		});
-		if (
-			!provider ||
-			provider.gitProvider.organizationId !== session.activeOrganizationId
-		) {
-			return res.status(404).json({ error: "Github provider not found" });
-		}
-
 		await db
 			.update(github)
 			.set({
 				githubInstallationId: installation_id,
 			})
-			.where(eq(github.githubId, githubId))
+			.where(eq(github.githubId, rest[0] as string))
 			.returning();
 	}
 

apps/dokploy/pages/dashboard/project/[projectId]/environment/[environmentId]/services/application/[applicationId].tsx

@@ -347,7 +347,6 @@ const Service = (
 												<ShowDockerLogs
 													appName={data?.appName || ""}
 													serverId={data?.serverId || ""}
-													serviceId={data?.applicationId}
 												/>
 											</div>
 										</TabsContent>

apps/dokploy/pages/dashboard/project/[projectId]/environment/[environmentId]/services/compose/[composeId].tsx

@@ -312,7 +312,6 @@ const Service = (
 													serverId={data?.serverId || undefined}
 													appName={data?.appName || ""}
 													appType={data?.composeType || "docker-compose"}
-													serviceId={data?.composeId}
 												/>
 											</div>
 										</TabsContent>
@@ -381,13 +380,11 @@ const Service = (
 														serverId={data?.serverId || ""}
 														appName={data?.appName || ""}
 														appType={data?.composeType || "docker-compose"}
-														serviceId={data?.composeId}
 													/>
 												) : (
 													<ShowDockerLogsStack
 														serverId={data?.serverId || ""}
 														appName={data?.appName || ""}
-														serviceId={data?.composeId}
 													/>
 												)}
 											</div>

apps/dokploy/pages/dashboard/project/[projectId]/environment/[environmentId]/services/libsql/[libsqlId].tsx

@@ -269,7 +269,6 @@ const Libsql = (
 											<ShowDockerLogs
 												serverId={data?.serverId || ""}
 												appName={data?.appName || ""}
-												serviceId={data?.libsqlId}
 											/>
 										</div>
 									</TabsContent>

apps/dokploy/pages/dashboard/project/[projectId]/environment/[environmentId]/services/mariadb/[mariadbId].tsx

@@ -299,7 +299,6 @@ const Mariadb = (
 												<ShowDockerLogs
 													serverId={data?.serverId || ""}
 													appName={data?.appName || ""}
-													serviceId={data?.mariadbId}
 												/>
 											</div>
 										</TabsContent>

apps/dokploy/pages/dashboard/project/[projectId]/environment/[environmentId]/services/mongo/[mongoId].tsx

@@ -299,7 +299,6 @@ const Mongo = (
 												<ShowDockerLogs
 													serverId={data?.serverId || ""}
 													appName={data?.appName || ""}
-													serviceId={data?.mongoId}
 												/>
 											</div>
 										</TabsContent>

apps/dokploy/pages/dashboard/project/[projectId]/environment/[environmentId]/services/mysql/[mysqlId].tsx

@@ -276,7 +276,6 @@ const MySql = (
 													<ShowDockerLogs
 														serverId={data?.serverId || ""}
 														appName={data?.appName || ""}
-														serviceId={data?.mysqlId}
 													/>
 												</div>
 											</TabsContent>

apps/dokploy/pages/dashboard/project/[projectId]/environment/[environmentId]/services/postgres/[postgresId].tsx

@@ -284,7 +284,6 @@ const Postgresql = (
 												<ShowDockerLogs
 													serverId={data?.serverId || ""}
 													appName={data?.appName || ""}
-													serviceId={data?.postgresId}
 												/>
 											</div>
 										</TabsContent>

apps/dokploy/pages/dashboard/project/[projectId]/environment/[environmentId]/services/redis/[redisId].tsx

@@ -297,7 +297,6 @@ const Redis = (
 												<ShowDockerLogs
 													serverId={data?.serverId || ""}
 													appName={data?.appName || ""}
-													serviceId={data?.redisId}
 												/>
 											</div>
 										</TabsContent>

apps/dokploy/server/api/routers/backup.ts

@@ -49,7 +49,6 @@ import {
 	restoreWebServerBackup,
 } from "@dokploy/server/utils/restore";
 import { TRPCError } from "@trpc/server";
-import { quote } from "shell-quote";
 import { z } from "zod";
 import {
 	createTRPCRouter,
@@ -511,7 +510,7 @@ export const backupRouter = createTRPCRouter({
 						: input.search;
 
 				const searchPath = baseDir ? `${bucketPath}/${baseDir}` : bucketPath;
-				const listCommand = `rclone lsjson ${rcloneFlags.join(" ")} ${quote([searchPath])} --no-mimetype --no-modtime 2>/dev/null`;
+				const listCommand = `rclone lsjson ${rcloneFlags.join(" ")} "${searchPath}" --no-mimetype --no-modtime 2>/dev/null`;
 
 				let stdout = "";
 

apps/dokploy/server/api/routers/cluster.ts

@@ -6,7 +6,6 @@ import {
 	getRemoteDocker,
 } from "@dokploy/server";
 import { TRPCError } from "@trpc/server";
-import { quote } from "shell-quote";
 import { z } from "zod";
 import { audit } from "@/server/api/utils/audit";
 import { getLocalServerIp } from "@/server/wss/terminal";
@@ -52,8 +51,8 @@ export const clusterRouter = createTRPCRouter({
 				}
 			}
 			try {
-				const drainCommand = `docker node update --availability drain ${quote([input.nodeId])}`;
-				const removeCommand = `docker node rm ${quote([input.nodeId])} --force`;
+				const drainCommand = `docker node update --availability drain ${input.nodeId}`;
+				const removeCommand = `docker node rm ${input.nodeId} --force`;
 
 				if (input.serverId) {
 					await execAsyncRemote(input.serverId, drainCommand);

apps/dokploy/server/api/routers/destination.ts

@@ -10,7 +10,6 @@ import {
 import { db } from "@dokploy/server/db";
 import { TRPCError } from "@trpc/server";
 import { desc, eq } from "drizzle-orm";
-import { quote } from "shell-quote";
 import { createTRPCRouter, withPermission } from "@/server/api/trpc";
 import { audit } from "@/server/api/utils/audit";
 import {
@@ -59,10 +58,10 @@ export const destinationRouter = createTRPCRouter({
 			} = input;
 			try {
 				const rcloneFlags = [
-					`--s3-access-key-id=${quote([accessKey])}`,
-					`--s3-secret-access-key=${quote([secretAccessKey])}`,
-					`--s3-region=${quote([region])}`,
-					`--s3-endpoint=${quote([endpoint])}`,
+					`--s3-access-key-id="${accessKey}"`,
+					`--s3-secret-access-key="${secretAccessKey}"`,
+					`--s3-region="${region}"`,
+					`--s3-endpoint="${endpoint}"`,
 					"--s3-no-check-bucket",
 					"--s3-force-path-style",
 					"--retries 1",
@@ -71,13 +70,13 @@ export const destinationRouter = createTRPCRouter({
 					"--contimeout 5s",
 				];
 				if (provider) {
-					rcloneFlags.unshift(`--s3-provider=${quote([provider])}`);
+					rcloneFlags.unshift(`--s3-provider="${provider}"`);
 				}
 				if (additionalFlags?.length) {
 					rcloneFlags.push(...additionalFlags);
 				}
 				const rcloneDestination = `:s3:${bucket}`;
-				const rcloneCommand = `rclone ls ${rcloneFlags.join(" ")} ${quote([rcloneDestination])}`;
+				const rcloneCommand = `rclone ls ${rcloneFlags.join(" ")} "${rcloneDestination}"`;
 
 				if (IS_CLOUD && !input.serverId) {
 					throw new TRPCError({

apps/dokploy/server/api/routers/registry.ts

@@ -5,7 +5,6 @@ import {
 	findRegistryById,
 	IS_CLOUD,
 	removeRegistry,
-	safeDockerLoginCommand,
 	updateRegistry,
 } from "@dokploy/server";
 import { db } from "@dokploy/server/db";
@@ -123,11 +122,7 @@ export const registryRouter = createTRPCRouter({
 				if (input.serverId && input.serverId !== "none") {
 					await execAsyncRemote(
 						input.serverId,
-						safeDockerLoginCommand(
-							input.registryUrl,
-							input.username,
-							input.password,
-						),
+						`echo ${input.password} | docker ${args.join(" ")}`,
 					);
 				} else {
 					await execFileAsync("docker", args, {
@@ -187,11 +182,7 @@ export const registryRouter = createTRPCRouter({
 				if (input.serverId && input.serverId !== "none") {
 					await execAsyncRemote(
 						input.serverId,
-						safeDockerLoginCommand(
-							registryData.registryUrl,
-							registryData.username,
-							registryData.password,
-						),
+						`echo ${registryData.password} | docker ${args.join(" ")}`,
 					);
 				} else {
 					await execFileAsync("docker", args, {

apps/dokploy/server/api/routers/schedule.ts

@@ -13,7 +13,6 @@ import {
 	findMemberByUserId,
 } from "@dokploy/server/services/permission";
 import {
-	assertHostScheduleAccess,
 	createSchedule,
 	deleteSchedule,
 	findScheduleById,
@@ -32,8 +31,6 @@ export const scheduleRouter = createTRPCRouter({
 	create: protectedProcedure
 		.input(createScheduleSchema)
 		.mutation(async ({ input, ctx }) => {
-			await assertHostScheduleAccess(ctx, input.scheduleType, input.serverId);
-
 			const serviceId = input.applicationId || input.composeId;
 			if (serviceId) {
 				await checkServicePermissionAndAccess(ctx, serviceId, {
@@ -47,14 +44,51 @@ export const scheduleRouter = createTRPCRouter({
 					);
 				}
 			} else {
+				if (input.scheduleType === "dokploy-server" && IS_CLOUD) {
+					throw new TRPCError({
+						code: "FORBIDDEN",
+						message:
+							"Host-level schedules are not available in the cloud version.",
+					});
+				}
+
 				await checkPermission(ctx, { schedule: ["create"] });
 
-				if (IS_CLOUD && input.scheduleType === "server" && input.serverId) {
-					await assertScheduledJobLimit(
+				if (
+					input.scheduleType === "server" ||
+					input.scheduleType === "dokploy-server"
+				) {
+					const member = await findMemberByUserId(
+						ctx.user.id,
 						ctx.session.activeOrganizationId,
-						"server",
-						input.serverId,
 					);
+					if (member.role !== "owner" && member.role !== "admin") {
+						throw new TRPCError({
+							code: "FORBIDDEN",
+							message:
+								"Only owners and admins can manage server-level schedules.",
+						});
+					}
+				}
+
+				if (input.scheduleType === "server" && input.serverId) {
+					const targetServer = await findServerById(input.serverId);
+					if (
+						targetServer.organizationId !== ctx.session.activeOrganizationId
+					) {
+						throw new TRPCError({
+							code: "UNAUTHORIZED",
+							message: "You don't have access to this server.",
+						});
+					}
+
+					if (IS_CLOUD) {
+						await assertScheduledJobLimit(
+							ctx.session.activeOrganizationId,
+							"server",
+							input.serverId,
+						);
+					}
 				}
 			}
 			const newSchedule = await createSchedule({
@@ -101,22 +135,6 @@ export const scheduleRouter = createTRPCRouter({
 				});
 			}
 
-			await assertHostScheduleAccess(
-				ctx,
-				existingSchedule.scheduleType,
-				existingSchedule.serverId,
-			);
-			if (
-				input.scheduleType &&
-				input.scheduleType !== existingSchedule.scheduleType
-			) {
-				await assertHostScheduleAccess(
-					ctx,
-					input.scheduleType,
-					input.serverId ?? existingSchedule.serverId,
-				);
-			}
-
 			const serviceId =
 				existingSchedule.applicationId || existingSchedule.composeId;
 			if (serviceId) {
@@ -124,7 +142,47 @@ export const scheduleRouter = createTRPCRouter({
 					schedule: ["update"],
 				});
 			} else {
+				if (existingSchedule.scheduleType === "dokploy-server" && IS_CLOUD) {
+					throw new TRPCError({
+						code: "FORBIDDEN",
+						message:
+							"Host-level schedules are not available in the cloud version.",
+					});
+				}
+
 				await checkPermission(ctx, { schedule: ["update"] });
+
+				if (
+					existingSchedule.scheduleType === "server" ||
+					existingSchedule.scheduleType === "dokploy-server"
+				) {
+					const member = await findMemberByUserId(
+						ctx.user.id,
+						ctx.session.activeOrganizationId,
+					);
+					if (member.role !== "owner" && member.role !== "admin") {
+						throw new TRPCError({
+							code: "FORBIDDEN",
+							message:
+								"Only owners and admins can manage server-level schedules.",
+						});
+					}
+				}
+
+				if (
+					existingSchedule.scheduleType === "server" &&
+					existingSchedule.serverId
+				) {
+					const targetServer = await findServerById(existingSchedule.serverId);
+					if (
+						targetServer.organizationId !== ctx.session.activeOrganizationId
+					) {
+						throw new TRPCError({
+							code: "UNAUTHORIZED",
+							message: "You don't have access to this server.",
+						});
+					}
+				}
 			}
 			const updatedSchedule = await updateSchedule(input);
 
@@ -164,19 +222,50 @@ export const scheduleRouter = createTRPCRouter({
 		.input(z.object({ scheduleId: z.string() }))
 		.mutation(async ({ input, ctx }) => {
 			const scheduleItem = await findScheduleById(input.scheduleId);
-			await assertHostScheduleAccess(
-				ctx,
-				scheduleItem.scheduleType,
-				scheduleItem.serverId,
-			);
-
 			const serviceId = scheduleItem.applicationId || scheduleItem.composeId;
 			if (serviceId) {
 				await checkServicePermissionAndAccess(ctx, serviceId, {
 					schedule: ["delete"],
 				});
 			} else {
+				if (scheduleItem.scheduleType === "dokploy-server" && IS_CLOUD) {
+					throw new TRPCError({
+						code: "FORBIDDEN",
+						message:
+							"Host-level schedules are not available in the cloud version.",
+					});
+				}
+
 				await checkPermission(ctx, { schedule: ["delete"] });
+
+				if (
+					scheduleItem.scheduleType === "server" ||
+					scheduleItem.scheduleType === "dokploy-server"
+				) {
+					const member = await findMemberByUserId(
+						ctx.user.id,
+						ctx.session.activeOrganizationId,
+					);
+					if (member.role !== "owner" && member.role !== "admin") {
+						throw new TRPCError({
+							code: "FORBIDDEN",
+							message:
+								"Only owners and admins can manage server-level schedules.",
+						});
+					}
+				}
+
+				if (scheduleItem.scheduleType === "server" && scheduleItem.serverId) {
+					const targetServer = await findServerById(scheduleItem.serverId);
+					if (
+						targetServer.organizationId !== ctx.session.activeOrganizationId
+					) {
+						throw new TRPCError({
+							code: "UNAUTHORIZED",
+							message: "You don't have access to this server.",
+						});
+					}
+				}
 			}
 			await deleteSchedule(input.scheduleId);
 
@@ -300,19 +389,50 @@ export const scheduleRouter = createTRPCRouter({
 		.input(z.object({ scheduleId: z.string().min(1) }))
 		.mutation(async ({ input, ctx }) => {
 			const scheduleItem = await findScheduleById(input.scheduleId);
-			await assertHostScheduleAccess(
-				ctx,
-				scheduleItem.scheduleType,
-				scheduleItem.serverId,
-			);
-
 			const serviceId = scheduleItem.applicationId || scheduleItem.composeId;
 			if (serviceId) {
 				await checkServicePermissionAndAccess(ctx, serviceId, {
 					schedule: ["create"],
 				});
 			} else {
+				if (scheduleItem.scheduleType === "dokploy-server" && IS_CLOUD) {
+					throw new TRPCError({
+						code: "FORBIDDEN",
+						message:
+							"Host-level schedules are not available in the cloud version.",
+					});
+				}
+
 				await checkPermission(ctx, { schedule: ["create"] });
+
+				if (
+					scheduleItem.scheduleType === "server" ||
+					scheduleItem.scheduleType === "dokploy-server"
+				) {
+					const member = await findMemberByUserId(
+						ctx.user.id,
+						ctx.session.activeOrganizationId,
+					);
+					if (member.role !== "owner" && member.role !== "admin") {
+						throw new TRPCError({
+							code: "FORBIDDEN",
+							message:
+								"Only owners and admins can manage server-level schedules.",
+						});
+					}
+				}
+
+				if (scheduleItem.scheduleType === "server" && scheduleItem.serverId) {
+					const targetServer = await findServerById(scheduleItem.serverId);
+					if (
+						targetServer.organizationId !== ctx.session.activeOrganizationId
+					) {
+						throw new TRPCError({
+							code: "UNAUTHORIZED",
+							message: "You don't have access to this server.",
+						});
+					}
+				}
 			}
 			try {
 				await runCommand(input.scheduleId);

apps/dokploy/server/api/routers/server.ts

@@ -413,14 +413,6 @@ export const serverRouter = createTRPCRouter({
 		.input(apiRemoveServer)
 		.mutation(async ({ input, ctx }) => {
 			try {
-				const currentServer = await findServerById(input.serverId);
-				if (currentServer.organizationId !== ctx.session.activeOrganizationId) {
-					throw new TRPCError({
-						code: "UNAUTHORIZED",
-						message: "You are not authorized to delete this server",
-					});
-				}
-
 				const activeServers = await haveActiveServices(input.serverId);
 
 				if (activeServers) {
@@ -429,6 +421,7 @@ export const serverRouter = createTRPCRouter({
 						message: "Server has active services, please delete them first",
 					});
 				}
+				const currentServer = await findServerById(input.serverId);
 				await audit(ctx, {
 					action: "delete",
 					resourceType: "server",

apps/dokploy/server/api/routers/volume-backups.ts

@@ -13,8 +13,6 @@ import { db } from "@dokploy/server/db";
 import {
 	createVolumeBackupSchema,
 	updateVolumeBackupSchema,
-	VOLUME_NAME_MESSAGE,
-	VOLUME_NAME_REGEX,
 	volumeBackups,
 } from "@dokploy/server/db/schema";
 import { findDestinationById } from "@dokploy/server/services/destination";
@@ -277,10 +275,7 @@ export const volumeBackupsRouter = createTRPCRouter({
 			z.object({
 				backupFileName: z.string().min(1),
 				destinationId: z.string().min(1),
-				volumeName: z
-					.string()
-					.min(1)
-					.regex(VOLUME_NAME_REGEX, VOLUME_NAME_MESSAGE),
+				volumeName: z.string().min(1),
 				id: z.string().min(1),
 				serviceType: z.enum(["application", "compose"]),
 				serverId: z.string().optional(),

apps/dokploy/server/wss/authorize.ts

@@ -1,89 +0,0 @@
-import { getAccessibleServerIds } from "@dokploy/server";
-import {
-	checkServiceAccess,
-	findMemberByUserId,
-	hasPermission,
-} from "@dokploy/server/services/permission";
-
-type WssUser = { id: string } | null | undefined;
-type WssSession = { activeOrganizationId?: string | null } | null | undefined;
-
-const buildCtx = (user: { id: string }, activeOrganizationId: string) => ({
-	user: { id: user.id },
-	session: { activeOrganizationId },
-});
-
-// Authorizes docker/container operations opened over a WebSocket (container
-// terminal, container logs, container stats). Requires the docker permission
-// (owner/admin, or a member explicitly granted canAccessToDocker) and, for a
-// remote server, that the server is accessible to the caller. Previously these
-// handlers only checked session + organization, so any member could reach a
-// root shell / logs of any container.
-export const canAccessDockerOverWss = async (
-	user: WssUser,
-	session: WssSession,
-	serverId?: string | null,
-	serviceId?: string | null,
-): Promise<boolean> => {
-	if (!user || !session?.activeOrganizationId) return false;
-
-	const ctx = buildCtx(user, session.activeOrganizationId);
-
-	// When the container belongs to a specific Dokploy service (opened from a
-	// service page, so serviceId is present), access to that service is the
-	// authoritative gate — matching the service tRPC endpoints (e.g.
-	// application.readLogs, which check service access only). A member granted
-	// the service can read its logs / open its terminal even without the broad
-	// "docker" permission or explicit access to the server it runs on.
-	if (serviceId) {
-		try {
-			await checkServiceAccess(ctx, serviceId, "read");
-			return true;
-		} catch {
-			return false;
-		}
-	}
-
-	// Generic Docker overview (no service context): mirror the docker tRPC router
-	// — require the docker permission and access to the target server.
-	if (!(await hasPermission(ctx, { docker: ["read"] }))) return false;
-
-	if (serverId && serverId !== "local") {
-		const accessible = await getAccessibleServerIds({
-			userId: user.id,
-			activeOrganizationId: session.activeOrganizationId,
-		});
-		if (!accessible.has(serverId)) return false;
-	}
-
-	return true;
-};
-
-// Authorizes the host/server SSH terminal opened over a WebSocket. The local
-// host terminal is a root shell on the control-plane host, so it is restricted
-// to owner/admin. A remote server terminal is gated on server access.
-export const canAccessTerminalOverWss = async (
-	user: WssUser,
-	session: WssSession,
-	serverId?: string | null,
-): Promise<boolean> => {
-	if (!user || !session?.activeOrganizationId) return false;
-
-	if (serverId && serverId !== "local") {
-		const accessible = await getAccessibleServerIds({
-			userId: user.id,
-			activeOrganizationId: session.activeOrganizationId,
-		});
-		return accessible.has(serverId);
-	}
-
-	try {
-		const member = await findMemberByUserId(
-			user.id,
-			session.activeOrganizationId,
-		);
-		return member?.role === "owner" || member?.role === "admin";
-	} catch {
-		return false;
-	}
-};

apps/dokploy/server/wss/docker-container-logs.ts

@@ -3,7 +3,6 @@ import { findServerById, IS_CLOUD, validateRequest } from "@dokploy/server";
 import { spawn } from "node-pty";
 import { Client } from "ssh2";
 import { WebSocketServer } from "ws";
-import { canAccessDockerOverWss } from "./authorize";
 import {
 	getShell,
 	isValidContainerId,
@@ -42,7 +41,6 @@ export const setupDockerContainerLogsWebSocketServer = (
 		const since = url.searchParams.get("since") ?? "all";
 		const serverId = url.searchParams.get("serverId");
 		const runType = url.searchParams.get("runType");
-		const serviceId = url.searchParams.get("serviceId");
 		const { user, session } = await validateRequest(req);
 
 		if (!containerId) {
@@ -76,11 +74,6 @@ export const setupDockerContainerLogsWebSocketServer = (
 			return;
 		}
 
-		if (!(await canAccessDockerOverWss(user, session, serverId, serviceId))) {
-			ws.close(4003, "Not authorized");
-			return;
-		}
-
 		// Set up keep-alive ping mechanism to prevent timeout
 		// Send ping every 45 seconds to keep connection alive
 		const pingInterval = setInterval(() => {

apps/dokploy/server/wss/docker-container-terminal.ts

@@ -3,7 +3,6 @@ import { findServerById, IS_CLOUD, validateRequest } from "@dokploy/server";
 import { spawn } from "node-pty";
 import { Client } from "ssh2";
 import { WebSocketServer } from "ws";
-import { canAccessDockerOverWss } from "./authorize";
 import { isValidContainerId, isValidShell } from "./utils";
 
 export const setupDockerContainerTerminalWebSocketServer = (
@@ -33,7 +32,6 @@ export const setupDockerContainerTerminalWebSocketServer = (
 		const containerId = url.searchParams.get("containerId");
 		const activeWay = url.searchParams.get("activeWay");
 		const serverId = url.searchParams.get("serverId");
-		const serviceId = url.searchParams.get("serviceId");
 		const { user, session } = await validateRequest(req);
 
 		if (!containerId) {
@@ -60,11 +58,6 @@ export const setupDockerContainerTerminalWebSocketServer = (
 			ws.close();
 			return;
 		}
-
-		if (!(await canAccessDockerOverWss(user, session, serverId, serviceId))) {
-			ws.close(4003, "Not authorized");
-			return;
-		}
 		try {
 			if (serverId) {
 				const server = await findServerById(serverId);

apps/dokploy/server/wss/docker-stats.ts

@@ -9,7 +9,6 @@ import {
 	validateRequest,
 } from "@dokploy/server";
 import { WebSocketServer } from "ws";
-import { canAccessDockerOverWss } from "./authorize";
 
 export const setupDockerStatsMonitoringSocketServer = (
 	server: http.Server<typeof http.IncomingMessage, typeof http.ServerResponse>,
@@ -45,7 +44,6 @@ export const setupDockerStatsMonitoringSocketServer = (
 			| "application"
 			| "stack"
 			| "docker-compose";
-		const serviceId = url.searchParams.get("serviceId");
 		const { user, session } = await validateRequest(req);
 
 		if (!appName) {
@@ -57,11 +55,6 @@ export const setupDockerStatsMonitoringSocketServer = (
 			ws.close();
 			return;
 		}
-
-		if (!(await canAccessDockerOverWss(user, session, null, serviceId))) {
-			ws.close(4003, "Not authorized");
-			return;
-		}
 		const intervalId = setInterval(async () => {
 			try {
 				// Special case: when monitoring "dokploy", get host system stats instead of container stats

apps/dokploy/server/wss/terminal.ts

@@ -9,7 +9,6 @@ import { publicIpv4, publicIpv6 } from "public-ip";
 import { Client, type ConnectConfig } from "ssh2";
 import { WebSocketServer } from "ws";
 import { getDockerHost } from "../utils/docker";
-import { canAccessTerminalOverWss } from "./authorize";
 import { setupLocalServerSSHKey } from "./utils";
 
 const COMMAND_TO_ALLOW_LOCAL_ACCESS = `
@@ -94,11 +93,6 @@ export const setupTerminalWebSocketServer = (
 			return;
 		}
 
-		if (!(await canAccessTerminalOverWss(user, session, serverId))) {
-			ws.close(4003, "Not authorized");
-			return;
-		}
-
 		let connectionDetails: ConnectConfig = {};
 
 		const isLocalServer = serverId === "local";

packages/server/src/db/schema/schedule.ts

@@ -57,7 +57,6 @@ export const schedules = pgTable("schedule", {
 });
 
 export type Schedule = typeof schedules.$inferSelect;
-export type ScheduleType = Schedule["scheduleType"];
 
 export const schedulesRelations = relations(schedules, ({ one, many }) => ({
 	application: one(applications, {
@@ -79,9 +78,7 @@ export const schedulesRelations = relations(schedules, ({ one, many }) => ({
 	deployments: many(deployments),
 }));
 
-export const createScheduleSchema = createInsertSchema(schedules, {
-	scheduleType: z.enum(["application", "compose", "server", "dokploy-server"]),
-});
+export const createScheduleSchema = createInsertSchema(schedules);
 
 export const updateScheduleSchema = createScheduleSchema.extend({
 	scheduleId: z.string().min(1),

packages/server/src/db/schema/utils.ts

@@ -41,12 +41,6 @@ export const APP_NAME_REGEX = /^[a-zA-Z0-9._-]+$/;
 export const APP_NAME_MESSAGE =
 	"App name can only contain letters, numbers, dots, underscores and hyphens";
 
-/** Docker volume name: must start alphanumeric, then letters/numbers/._- only. Safe for shell. */
-export const VOLUME_NAME_REGEX = /^[a-zA-Z0-9][a-zA-Z0-9_.-]*$/;
-
-export const VOLUME_NAME_MESSAGE =
-	"Volume name must start with a letter or number and contain only letters, numbers, dots, underscores and hyphens";
-
 /** Database password: blocks shell-dangerous characters like $ ! ' " \ / and spaces. */
 export const DATABASE_PASSWORD_REGEX =
 	/^[a-zA-Z0-9@#%^&*()_+\-=[\]{}|;:,.<>?~`]*$/;

packages/server/src/db/schema/volume-backups.ts

@@ -14,11 +14,7 @@ import { serviceType } from "./mount";
 import { mysql } from "./mysql";
 import { postgres } from "./postgres";
 import { redis } from "./redis";
-import {
-	generateAppName,
-	VOLUME_NAME_MESSAGE,
-	VOLUME_NAME_REGEX,
-} from "./utils";
+import { generateAppName } from "./utils";
 
 export const volumeBackups = pgTable("volume_backup", {
 	volumeBackupId: text("volumeBackupId")
@@ -117,9 +113,7 @@ export const volumeBackupsRelations = relations(
 	}),
 );
 
-export const createVolumeBackupSchema = createInsertSchema(volumeBackups, {
-	volumeName: z.string().regex(VOLUME_NAME_REGEX, VOLUME_NAME_MESSAGE),
-}).omit({
+export const createVolumeBackupSchema = createInsertSchema(volumeBackups).omit({
 	volumeBackupId: true,
 });
 

packages/server/src/services/certificate.ts

@@ -9,7 +9,6 @@ import {
 import { removeDirectoryIfExistsContent } from "@dokploy/server/utils/filesystem/directory";
 import { TRPCError } from "@trpc/server";
 import { eq } from "drizzle-orm";
-import { quote } from "shell-quote";
 import { stringify } from "yaml";
 import type { z } from "zod";
 import { encodeBase64 } from "../utils/docker/utils";
@@ -64,7 +63,7 @@ export const removeCertificateById = async (certificateId: string) => {
 	const certDir = path.join(CERTIFICATES_PATH, certificate.certificatePath);
 
 	if (certificate.serverId) {
-		await execAsyncRemote(certificate.serverId, `rm -rf ${quote([certDir])}`);
+		await execAsyncRemote(certificate.serverId, `rm -rf ${certDir}`);
 	} else {
 		await removeDirectoryIfExistsContent(certDir);
 	}
@@ -109,10 +108,10 @@ const createCertificateFiles = async (certificate: Certificate) => {
 		const certificateData = encodeBase64(certificate.certificateData);
 		const privateKey = encodeBase64(certificate.privateKey);
 		const command = `
-			mkdir -p ${quote([certDir])};
-			echo "${certificateData}" | base64 -d > ${quote([crtPath])};
-			echo "${privateKey}" | base64 -d > ${quote([keyPath])};
-			echo "${yamlConfig}" > ${quote([configFile])};
+			mkdir -p ${certDir};
+			echo "${certificateData}" | base64 -d > "${crtPath}";
+			echo "${privateKey}" | base64 -d > "${keyPath}";
+			echo "${yamlConfig}" > "${configFile}";
 		`;
 
 		await execAsyncRemote(certificate.serverId, command);

packages/server/src/services/mount.ts

@@ -18,7 +18,6 @@ import {
 } from "@dokploy/server/utils/process/execAsync";
 import { TRPCError } from "@trpc/server";
 import { eq, type SQL, sql } from "drizzle-orm";
-import { quote } from "shell-quote";
 import type { z } from "zod";
 
 export type Mount = typeof mounts.$inferSelect;
@@ -318,7 +317,7 @@ export const updateFileMount = async (mountId: string) => {
 	try {
 		const serverId = await getServerId(mount);
 		const encodedContent = encodeBase64(mount.content || "");
-		const command = `echo "${encodedContent}" | base64 -d > ${quote([fullPath])}`;
+		const command = `echo "${encodedContent}" | base64 -d > ${fullPath}`;
 		if (serverId) {
 			await execAsyncRemote(serverId, command);
 		} else {
@@ -338,7 +337,7 @@ export const deleteFileMount = async (mountId: string) => {
 	try {
 		const serverId = await getServerId(mount);
 		if (serverId) {
-			const command = `rm -rf ${quote([fullPath])}`;
+			const command = `rm -rf ${fullPath}`;
 			await execAsyncRemote(serverId, command);
 		} else {
 			await removeFileOrDirectory(fullPath);

packages/server/src/services/patch-repo.ts

@@ -1,7 +1,6 @@
 import { join } from "node:path";
 import { paths } from "@dokploy/server/constants";
 import { TRPCError } from "@trpc/server";
-import { quote } from "shell-quote";
 import { execAsync, execAsyncRemote } from "../utils/process/execAsync";
 import { cloneBitbucketRepository } from "../utils/providers/bitbucket";
 import { cloneGitRepository } from "../utils/providers/git";
@@ -86,7 +85,7 @@ export const readPatchRepoDirectory = async (
 	serverId?: string | null,
 ): Promise<DirectoryEntry[]> => {
 	// Use git ls-tree to get tracked files only
-	const command = `cd ${quote([repoPath])} && git ls-tree -r --name-only HEAD`;
+	const command = `cd "${repoPath}" && git ls-tree -r --name-only HEAD`;
 
 	let stdout: string;
 	try {
@@ -169,7 +168,7 @@ export const readPatchRepoFile = async (
 	const repoPath = join(PATCH_REPOS_PATH, type, application.appName);
 	const fullPath = join(repoPath, filePath);
 
-	const command = `cat ${quote([fullPath])}`;
+	const command = `cat "${fullPath}"`;
 
 	if (serverId) {
 		const result = await execAsyncRemote(serverId, command);

packages/server/src/services/schedule.ts

@@ -2,7 +2,7 @@ import path from "node:path";
 import { TRPCError } from "@trpc/server";
 import { eq } from "drizzle-orm";
 import type { z } from "zod";
-import { IS_CLOUD, paths } from "../constants";
+import { paths } from "../constants";
 import { db } from "../db";
 import type {
 	createScheduleSchema,
@@ -11,51 +11,9 @@ import type {
 import { type Schedule, schedules } from "../db/schema/schedule";
 import { encodeBase64 } from "../utils/docker/utils";
 import { execAsync, execAsyncRemote } from "../utils/process/execAsync";
-import { findMemberByUserId } from "./permission";
-import { findServerById } from "./server";
 
 export type ScheduleExtended = Awaited<ReturnType<typeof findScheduleById>>;
 
-// Host-level schedules (server / dokploy-server) run their script as root on the
-// host and must stay restricted to owners/admins, regardless of whether the
-// request is also tied to a service. Attaching an accessible applicationId must
-// not downgrade this to a service-access check.
-export const assertHostScheduleAccess = async (
-	ctx: { user: { id: string }; session: { activeOrganizationId: string } },
-	scheduleType: Schedule["scheduleType"] | null | undefined,
-	serverId: string | null | undefined,
-) => {
-	if (scheduleType !== "server" && scheduleType !== "dokploy-server") return;
-
-	if (scheduleType === "dokploy-server" && IS_CLOUD) {
-		throw new TRPCError({
-			code: "FORBIDDEN",
-			message: "Host-level schedules are not available in the cloud version.",
-		});
-	}
-
-	const member = await findMemberByUserId(
-		ctx.user.id,
-		ctx.session.activeOrganizationId,
-	);
-	if (member.role !== "owner" && member.role !== "admin") {
-		throw new TRPCError({
-			code: "FORBIDDEN",
-			message: "Only owners and admins can manage server-level schedules.",
-		});
-	}
-
-	if (scheduleType === "server" && serverId) {
-		const targetServer = await findServerById(serverId);
-		if (targetServer.organizationId !== ctx.session.activeOrganizationId) {
-			throw new TRPCError({
-				code: "UNAUTHORIZED",
-				message: "You don't have access to this server.",
-			});
-		}
-	}
-};
-
 export const createSchedule = async (
 	input: z.infer<typeof createScheduleSchema>,
 ) => {

packages/server/src/utils/backups/utils.ts

@@ -72,16 +72,16 @@ export const getS3Credentials = (destination: Destination) => {
 	const { accessKey, secretAccessKey, region, endpoint, provider } =
 		destination;
 	const rcloneFlags = [
-		`--s3-access-key-id=${quote([accessKey])}`,
-		`--s3-secret-access-key=${quote([secretAccessKey])}`,
-		`--s3-region=${quote([region])}`,
-		`--s3-endpoint=${quote([endpoint])}`,
+		`--s3-access-key-id="${accessKey}"`,
+		`--s3-secret-access-key="${secretAccessKey}"`,
+		`--s3-region="${region}"`,
+		`--s3-endpoint="${endpoint}"`,
 		"--s3-no-check-bucket",
 		"--s3-force-path-style",
 	];
 
 	if (provider) {
-		rcloneFlags.unshift(`--s3-provider=${quote([provider])}`);
+		rcloneFlags.unshift(`--s3-provider="${provider}"`);
 	}
 
 	if (destination.additionalFlags?.length) {

packages/server/src/utils/cluster/upload.ts

@@ -5,7 +5,6 @@ import {
 	safeDockerLoginCommand,
 } from "@dokploy/server/services/registry";
 import { createRollback } from "@dokploy/server/services/rollbacks";
-import { quote } from "shell-quote";
 import type { ApplicationNested } from "../builders";
 
 export const uploadImageRemoteCommand = async (
@@ -125,18 +124,18 @@ const getRegistryCommands = (
 		registry.password,
 	);
 	return `
-echo ${quote([`📦 [Enabled Registry] Uploading image to '${registry.registryType}' | '${registryTag}'`])} ;
+echo "📦 [Enabled Registry] Uploading image to '${registry.registryType}' | '${registryTag}'" ;
 ${loginCmd} || {
 	echo "❌ DockerHub Failed" ;
 	exit 1;
 }
 echo "✅ Registry Login Success" ;
-docker tag ${quote([imageName])} ${quote([registryTag])} || {
+docker tag ${imageName} ${registryTag} || {
 	echo "❌ Error tagging image" ;
 	exit 1;
 }
 echo "✅ Image Tagged" ;
-docker push ${quote([registryTag])} || {
+docker push ${registryTag} || {
 	echo "❌ Error pushing image" ;
 	exit 1;
 }

packages/server/src/utils/databases/rebuild.ts

@@ -14,7 +14,6 @@ import { deployMySql } from "@dokploy/server/services/mysql";
 import { deployPostgres } from "@dokploy/server/services/postgres";
 import { deployRedis } from "@dokploy/server/services/redis";
 import { eq } from "drizzle-orm";
-import { quote } from "shell-quote";
 import { removeService } from "../docker/utils";
 import { execAsync, execAsyncRemote } from "../process/execAsync";
 
@@ -41,7 +40,7 @@ export const rebuildDatabase = async (
 
 	for (const mount of database.mounts) {
 		if (mount.type === "volume") {
-			const command = `docker volume rm ${quote([mount?.volumeName ?? ""])} --force`;
+			const command = `docker volume rm ${mount?.volumeName} --force`;
 			if (database.serverId) {
 				await execAsyncRemote(database.serverId, command);
 			} else {

packages/server/src/utils/docker/utils.ts

@@ -712,14 +712,14 @@ export const getCreateFileCommand = (
 ) => {
 	const fullPath = path.join(outputPath, filePath);
 	if (fullPath.endsWith(path.sep) || filePath.endsWith("/")) {
-		return `mkdir -p ${quote([fullPath])};`;
+		return `mkdir -p ${fullPath};`;
 	}
 
 	const directory = path.dirname(fullPath);
 	const encodedContent = encodeBase64(content);
 	return `
-		mkdir -p ${quote([directory])};
-		echo "${encodedContent}" | base64 -d > ${quote([fullPath])};
+		mkdir -p ${directory};
+		echo "${encodedContent}" | base64 -d > "${fullPath}";
 	`;
 };
 

packages/server/src/utils/gpu-setup.ts

@@ -1,5 +1,4 @@
 import * as fs from "node:fs/promises";
-import { quote } from "shell-quote";
 import { execAsync, execAsyncRemote, sleep } from "../utils/process/execAsync";
 
 interface GPUInfo {
@@ -323,7 +322,7 @@ const setupLocalServer = async (daemonConfig: any) => {
 };
 
 const addGpuLabel = async (nodeId: string, serverId?: string) => {
-	const labelCommand = `docker node update --label-add gpu=true ${quote([nodeId])}`;
+	const labelCommand = `docker node update --label-add gpu=true ${nodeId}`;
 	if (serverId) {
 		await execAsyncRemote(serverId, labelCommand);
 	} else {
@@ -336,7 +335,7 @@ const verifySetup = async (nodeId: string, serverId?: string) => {
 
 	if (!finalStatus.swarmEnabled) {
 		const diagnosticCommands = [
-			`docker node inspect ${quote([nodeId])}`,
+			`docker node inspect ${nodeId}`,
 			'nvidia-smi -a | grep "GPU UUID"',
 			"cat /etc/docker/daemon.json",
 			"cat /etc/nvidia-container-runtime/config.toml",

packages/server/src/utils/providers/bitbucket.ts

@@ -10,8 +10,8 @@ import {
 } from "@dokploy/server/services/bitbucket";
 import type { InferResultType } from "@dokploy/server/types/with";
 import { TRPCError } from "@trpc/server";
-import { quote } from "shell-quote";
 import type { z } from "zod";
+import { shellWord } from "./utils";
 
 export type ApplicationWithBitbucket = InferResultType<
 	"applications",
@@ -125,8 +125,8 @@ export const cloneBitbucketRepository = async ({
 	const repoToUse = entity.bitbucketRepositorySlug || bitbucketRepository;
 	const repoclone = `bitbucket.org/${bitbucketOwner}/${repoToUse}.git`;
 	const cloneUrl = getBitbucketCloneUrl(bitbucket, repoclone);
-	command += `echo ${quote([`Cloning Repo ${repoclone} to ${outputPath}: ✅`])};`;
-	command += `git clone --branch ${quote([String(bitbucketBranch ?? "")])} --depth 1 ${enableSubmodules ? "--recurse-submodules" : ""} ${quote([String(cloneUrl ?? "")])} ${quote([String(outputPath ?? "")])} --progress;`;
+	command += `echo ${shellWord(`Cloning Repo ${repoclone} to ${outputPath}: ✅`)};`;
+	command += `git clone --branch ${shellWord(bitbucketBranch)} --depth 1 ${enableSubmodules ? "--recurse-submodules" : ""} ${shellWord(cloneUrl)} ${shellWord(outputPath)} --progress;`;
 	return command;
 };
 

packages/server/src/utils/providers/git.ts

@@ -4,8 +4,8 @@ import {
 	findSSHKeyById,
 	updateSSHKeyById,
 } from "@dokploy/server/services/ssh-key";
-import { quote } from "shell-quote";
 import { execAsync, execAsyncRemote } from "../process/execAsync";
+import { shellWord } from "./utils";
 
 interface CloneGitRepository {
 	appName: string;
@@ -62,7 +62,7 @@ export const cloneGitRepository = async ({
 	}
 	command += `rm -rf ${outputPath};`;
 	command += `mkdir -p ${outputPath};`;
-	command += `echo ${quote([`Cloning Repo Custom ${customGitUrl} to ${outputPath}: ✅`])};`;
+	command += `echo ${shellWord(`Cloning Repo Custom ${customGitUrl} to ${outputPath}: ✅`)};`;
 
 	if (customGitSSHKeyId) {
 		await updateSSHKeyById({
@@ -79,8 +79,8 @@ export const cloneGitRepository = async ({
 		command += "chmod 600 /tmp/id_rsa;";
 		command += `export GIT_SSH_COMMAND="${gitSshCommand}";`;
 	}
-	command += `if ! git clone --branch ${quote([String(customGitBranch ?? "")])} --depth 1 ${enableSubmodules ? "--recurse-submodules" : ""} --progress ${quote([String(customGitUrl ?? "")])} ${quote([String(outputPath ?? "")])}; then
-				echo ${quote([`❌ [ERROR] Fail to clone the repository ${customGitUrl}`])};
+	command += `if ! git clone --branch ${shellWord(customGitBranch)} --depth 1 ${enableSubmodules ? "--recurse-submodules" : ""} --progress ${shellWord(customGitUrl)} ${shellWord(outputPath)}; then
+				echo ${shellWord(`❌ [ERROR] Fail to clone the repository ${customGitUrl}`)};
 				exit 1;
 			fi
 			`;
@@ -115,7 +115,7 @@ const addHostToKnownHostsCommand = (repositoryURL: string) => {
 	// ssh-keyscan is best-effort: some Git hosts (e.g. Hugging Face) never answer
 	// it, and its exit code must not abort the clone under `set -e`. The clone's
 	// own host-key check (StrictHostKeyChecking=accept-new) is the real boundary.
-	return `ssh-keyscan -p ${Number(port)} ${quote([String(domain ?? "")])} >> ${knownHostsPath} || true;`;
+	return `ssh-keyscan -p ${Number(port)} ${shellWord(domain)} >> ${knownHostsPath} || true;`;
 };
 const sanitizeRepoPathSSH = (input: string) => {
 	const SSH_PATH_RE = new RegExp(

packages/server/src/utils/providers/gitea.ts

@@ -7,7 +7,7 @@ import {
 } from "@dokploy/server/services/gitea";
 import type { InferResultType } from "@dokploy/server/types/with";
 import { TRPCError } from "@trpc/server";
-import { quote } from "shell-quote";
+import { shellWord } from "./utils";
 
 export const getErrorCloneRequirements = (entity: {
 	giteaRepository?: string | null;
@@ -177,8 +177,8 @@ export const cloneGiteaRepository = async ({
 		giteaRepository!,
 	);
 
-	command += `echo ${quote([`Cloning Repo ${repoClone} to ${outputPath}: ✅`])};`;
-	command += `git clone --branch ${quote([String(giteaBranch ?? "")])} --depth 1 ${enableSubmodules ? "--recurse-submodules" : ""} ${quote([String(cloneUrl ?? "")])} ${quote([String(outputPath ?? "")])} --progress;`;
+	command += `echo ${shellWord(`Cloning Repo ${repoClone} to ${outputPath}: ✅`)};`;
+	command += `git clone --branch ${shellWord(giteaBranch)} --depth 1 ${enableSubmodules ? "--recurse-submodules" : ""} ${shellWord(cloneUrl)} ${shellWord(outputPath)} --progress;`;
 	return command;
 };
 

packages/server/src/utils/providers/github.ts

@@ -6,8 +6,8 @@ import type { InferResultType } from "@dokploy/server/types/with";
 import { createAppAuth } from "@octokit/auth-app";
 import { TRPCError } from "@trpc/server";
 import { Octokit } from "octokit";
-import { quote } from "shell-quote";
 import type { z } from "zod";
+import { shellWord } from "./utils";
 
 export const authGithub = (githubProvider: Github): Octokit => {
 	if (!haveGithubRequirements(githubProvider)) {
@@ -167,8 +167,8 @@ export const cloneGithubRepository = async ({
 	command += `mkdir -p ${outputPath};`;
 	const cloneUrl = `https://oauth2:${token}@${repoclone}`;
 
-	command += `echo ${quote([`Cloning Repo ${repoclone} to ${outputPath}: ✅`])};`;
-	command += `git clone --branch ${quote([String(branch ?? "")])} --depth 1 ${enableSubmodules ? "--recurse-submodules" : ""} ${quote([String(cloneUrl ?? "")])} ${quote([String(outputPath ?? "")])} --progress;`;
+	command += `echo ${shellWord(`Cloning Repo ${repoclone} to ${outputPath}: ✅`)};`;
+	command += `git clone --branch ${shellWord(branch)} --depth 1 ${enableSubmodules ? "--recurse-submodules" : ""} ${shellWord(cloneUrl)} ${shellWord(outputPath)} --progress;`;
 
 	return command;
 };

packages/server/src/utils/providers/gitlab.ts

@@ -8,8 +8,8 @@ import {
 } from "@dokploy/server/services/gitlab";
 import type { InferResultType } from "@dokploy/server/types/with";
 import { TRPCError } from "@trpc/server";
-import { quote } from "shell-quote";
 import type { z } from "zod";
+import { shellWord } from "./utils";
 
 export const refreshGitlabToken = async (gitlabProviderId: string) => {
 	const gitlabProvider = await findGitlabById(gitlabProviderId);
@@ -152,8 +152,8 @@ export const cloneGitlabRepository = async ({
 	command += `mkdir -p ${outputPath};`;
 	const repoClone = getGitlabRepoClone(gitlab, gitlabPathNamespace);
 	const cloneUrl = getGitlabCloneUrl(gitlab, repoClone);
-	command += `echo ${quote([`Cloning Repo ${repoClone} to ${outputPath}: ✅`])};`;
-	command += `git clone --branch ${quote([String(gitlabBranch ?? "")])} --depth 1 ${enableSubmodules ? "--recurse-submodules" : ""} ${quote([String(cloneUrl ?? "")])} ${quote([String(outputPath ?? "")])} --progress;`;
+	command += `echo ${shellWord(`Cloning Repo ${repoClone} to ${outputPath}: ✅`)};`;
+	command += `git clone --branch ${shellWord(gitlabBranch)} --depth 1 ${enableSubmodules ? "--recurse-submodules" : ""} ${shellWord(cloneUrl)} ${shellWord(outputPath)} --progress;`;
 	return command;
 };
 

packages/server/src/utils/providers/utils.ts

@@ -0,0 +1,10 @@
+import { quote } from "shell-quote";
+
+/**
+ * Escapes a single value so it can be safely interpolated as one argument into
+ * a `/bin/sh -c` command string (both local `execAsync` and remote SSH
+ * `execAsyncRemote`). User-controlled fields such as git URLs, branch names,
+ * repository owners and SSH hostnames must never reach a shell unescaped.
+ */
+export const shellWord = (value: string | number | null | undefined): string =>
+	quote([String(value ?? "")]);

packages/server/src/utils/restore/compose.ts

@@ -1,7 +1,6 @@
 import type { apiRestoreBackup } from "@dokploy/server/db/schema";
 import type { Compose } from "@dokploy/server/services/compose";
 import type { Destination } from "@dokploy/server/services/destination";
-import { quote } from "shell-quote";
 import type { z } from "zod";
 import { getS3Credentials } from "../backups/utils";
 import { execAsync, execAsyncRemote } from "../process/execAsync";
@@ -27,10 +26,10 @@ export const restoreComposeBackup = async (
 		const rcloneFlags = getS3Credentials(destination);
 		const bucketPath = `:s3:${destination.bucket}`;
 		const backupPath = `${bucketPath}/${backupInput.backupFile}`;
-		let rcloneCommand = `rclone cat ${rcloneFlags.join(" ")} ${quote([backupPath])} | gunzip`;
+		let rcloneCommand = `rclone cat ${rcloneFlags.join(" ")} "${backupPath}" | gunzip`;
 
 		if (backupInput.metadata?.mongo) {
-			rcloneCommand = `rclone copy ${rcloneFlags.join(" ")} ${quote([backupPath])}`;
+			rcloneCommand = `rclone copy ${rcloneFlags.join(" ")} "${backupPath}"`;
 		}
 
 		let credentials: DatabaseCredentials = {};

packages/server/src/utils/restore/libsql.ts

@@ -1,7 +1,6 @@
 import type { apiRestoreBackup } from "@dokploy/server/db/schema";
 import type { Destination } from "@dokploy/server/services/destination";
 import type { Libsql } from "@dokploy/server/services/libsql";
-import { quote } from "shell-quote";
 import type { z } from "zod";
 import { getS3Credentials, getServiceContainerCommand } from "../backups/utils";
 import { execAsync, execAsyncRemote } from "../process/execAsync";
@@ -20,7 +19,7 @@ export const restoreLibsqlBackup = async (
 
 		const backupPath = `${bucketPath}/${backupInput.backupFile}`;
 
-		const rcloneCommand = `rclone cat ${rcloneFlags.join(" ")} ${quote([backupPath])}`;
+		const rcloneCommand = `rclone cat ${rcloneFlags.join(" ")} "${backupPath}"`;
 
 		const containerSearch = getServiceContainerCommand(appName);
 		const restoreCommand = `docker exec -i $CONTAINER_ID sh -c "tar xzf - -C /var/lib/sqld"`;

packages/server/src/utils/restore/mariadb.ts

@@ -1,7 +1,6 @@
 import type { apiRestoreBackup } from "@dokploy/server/db/schema";
 import type { Destination } from "@dokploy/server/services/destination";
 import type { Mariadb } from "@dokploy/server/services/mariadb";
-import { quote } from "shell-quote";
 import type { z } from "zod";
 import { getS3Credentials } from "../backups/utils";
 import { execAsync, execAsyncRemote } from "../process/execAsync";
@@ -20,7 +19,7 @@ export const restoreMariadbBackup = async (
 		const bucketPath = `:s3:${destination.bucket}`;
 		const backupPath = `${bucketPath}/${backupInput.backupFile}`;
 
-		const rcloneCommand = `rclone cat ${rcloneFlags.join(" ")} ${quote([backupPath])} | gunzip`;
+		const rcloneCommand = `rclone cat ${rcloneFlags.join(" ")} "${backupPath}" | gunzip`;
 
 		const command = getRestoreCommand({
 			appName,

packages/server/src/utils/restore/mongo.ts

@@ -1,7 +1,6 @@
 import type { apiRestoreBackup } from "@dokploy/server/db/schema";
 import type { Destination } from "@dokploy/server/services/destination";
 import type { Mongo } from "@dokploy/server/services/mongo";
-import { quote } from "shell-quote";
 import type { z } from "zod";
 import { getS3Credentials } from "../backups/utils";
 import { execAsync, execAsyncRemote } from "../process/execAsync";
@@ -19,7 +18,7 @@ export const restoreMongoBackup = async (
 		const rcloneFlags = getS3Credentials(destination);
 		const bucketPath = `:s3:${destination.bucket}`;
 		const backupPath = `${bucketPath}/${backupInput.backupFile}`;
-		const rcloneCommand = `rclone copy ${rcloneFlags.join(" ")} ${quote([backupPath])}`;
+		const rcloneCommand = `rclone copy ${rcloneFlags.join(" ")} "${backupPath}"`;
 
 		const command = getRestoreCommand({
 			appName,

packages/server/src/utils/restore/mysql.ts

@@ -1,7 +1,6 @@
 import type { apiRestoreBackup } from "@dokploy/server/db/schema";
 import type { Destination } from "@dokploy/server/services/destination";
 import type { MySql } from "@dokploy/server/services/mysql";
-import { quote } from "shell-quote";
 import type { z } from "zod";
 import { getS3Credentials } from "../backups/utils";
 import { execAsync, execAsyncRemote } from "../process/execAsync";
@@ -20,7 +19,7 @@ export const restoreMySqlBackup = async (
 		const bucketPath = `:s3:${destination.bucket}`;
 		const backupPath = `${bucketPath}/${backupInput.backupFile}`;
 
-		const rcloneCommand = `rclone cat ${rcloneFlags.join(" ")} ${quote([backupPath])} | gunzip`;
+		const rcloneCommand = `rclone cat ${rcloneFlags.join(" ")} "${backupPath}" | gunzip`;
 
 		const command = getRestoreCommand({
 			appName,

packages/server/src/utils/restore/postgres.ts

@@ -1,7 +1,6 @@
 import type { apiRestoreBackup } from "@dokploy/server/db/schema";
 import type { Destination } from "@dokploy/server/services/destination";
 import type { Postgres } from "@dokploy/server/services/postgres";
-import { quote } from "shell-quote";
 import type { z } from "zod";
 import { getS3Credentials } from "../backups/utils";
 import { execAsync, execAsyncRemote } from "../process/execAsync";
@@ -21,7 +20,7 @@ export const restorePostgresBackup = async (
 
 		const backupPath = `${bucketPath}/${backupInput.backupFile}`;
 
-		const rcloneCommand = `rclone cat ${rcloneFlags.join(" ")} ${quote([backupPath])} | gunzip`;
+		const rcloneCommand = `rclone cat ${rcloneFlags.join(" ")} "${backupPath}" | gunzip`;
 
 		const command = getRestoreCommand({
 			appName,

packages/server/src/utils/restore/utils.ts

@@ -92,8 +92,8 @@ rm -rf ${tempDir} && \
 mkdir -p ${tempDir} && \
 ${rcloneCommand} ${tempDir} && \
 cd ${tempDir} && \
-gunzip -f ${quote([fileName])} && \
-${restoreCommand} < ${quote([decompressedName])} && \
+gunzip -f "${fileName}" && \
+${restoreCommand} < "${decompressedName}" && \
 rm -rf ${tempDir}
 	`;
 };

packages/server/src/utils/restore/web-server.ts

@@ -3,7 +3,6 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { IS_CLOUD, paths } from "@dokploy/server/constants";
 import type { Destination } from "@dokploy/server/services/destination";
-import { quote } from "shell-quote";
 import { getS3Credentials } from "../backups/utils";
 import { execAsync } from "../process/execAsync";
 
@@ -36,7 +35,7 @@ export const restoreWebServerBackup = async (
 			// Download backup from S3
 			emit("Downloading backup from S3...");
 			await execAsync(
-				`rclone copyto ${rcloneFlags.join(" ")} ${quote([backupPath])} ${quote([`${tempDir}/${backupFile}`])}`,
+				`rclone copyto ${rcloneFlags.join(" ")} "${backupPath}" "${tempDir}/${backupFile}"`,
 			);
 
 			// List files before extraction
@@ -46,9 +45,7 @@ export const restoreWebServerBackup = async (
 
 			// Extract backup
 			emit("Extracting backup...");
-			await execAsync(
-				`cd ${quote([tempDir])} && unzip ${quote([backupFile])} > /dev/null 2>&1`,
-			);
+			await execAsync(`cd ${tempDir} && unzip ${backupFile} > /dev/null 2>&1`);
 
 			// Restore filesystem first
 			emit("Restoring filesystem...");

packages/server/src/utils/schedules/utils.ts

@@ -9,7 +9,6 @@ import {
 } from "@dokploy/server/services/deployment";
 import { findScheduleById } from "@dokploy/server/services/schedule";
 import { scheduledJobs, scheduleJob as scheduleJobNode } from "node-schedule";
-import { quote } from "shell-quote";
 import { getComposeContainer, getServiceContainer } from "../docker/utils";
 import { execAsyncRemote } from "../process/execAsync";
 import { spawnAsync } from "../process/spawnAsync";
@@ -78,12 +77,12 @@ export const runCommand = async (scheduleId: string) => {
 					serverId,
 					`
 					set -e
-					echo "Running scheduled command" >> ${quote([deployment.logPath])};
-					docker exec ${quote([containerId])} ${quote([shellType])} -c ${quote([command])} >> ${quote([deployment.logPath])} 2>> ${quote([deployment.logPath])} || {
-						echo "❌ Command failed" >> ${quote([deployment.logPath])};
+					echo "Running command: docker exec ${containerId} ${shellType} -c '${command}'" >> ${deployment.logPath};
+					docker exec ${containerId} ${shellType} -c '${command}' >> ${deployment.logPath} 2>> ${deployment.logPath} || { 
+						echo "❌ Command failed" >> ${deployment.logPath};
 						exit 1;
 					}
-					echo "✅ Command executed successfully" >> ${quote([deployment.logPath])};
+					echo "✅ Command executed successfully" >> ${deployment.logPath};
 					`,
 				);
 			} catch (error) {

packages/server/src/utils/traefik/application.ts

@@ -3,7 +3,6 @@ import path from "node:path";
 import { createInterface } from "node:readline";
 import { paths } from "@dokploy/server/constants";
 import type { Domain } from "@dokploy/server/services/domain";
-import { quote } from "shell-quote";
 import { parse, stringify } from "yaml";
 import { encodeBase64 } from "../docker/utils";
 import { execAsync, execAsyncRemote } from "../process/execAsync";
@@ -58,7 +57,7 @@ export const removeTraefikConfig = async (
 	try {
 		const { DYNAMIC_TRAEFIK_PATH } = paths(!!serverId);
 		const configPath = path.join(DYNAMIC_TRAEFIK_PATH, `${appName}.yml`);
-		const command = `rm -f ${quote([configPath])}`;
+		const command = `rm -f ${configPath}`;
 
 		if (serverId) {
 			await execAsyncRemote(serverId, command);
@@ -77,7 +76,7 @@ export const removeTraefikConfigRemote = async (
 	try {
 		const { DYNAMIC_TRAEFIK_PATH } = paths(true);
 		const configPath = path.join(DYNAMIC_TRAEFIK_PATH, `${appName}.yml`);
-		await execAsyncRemote(serverId, `rm -f ${quote([configPath])}`);
+		await execAsyncRemote(serverId, `rm -f ${configPath}`);
 	} catch (error) {
 		console.error(
 			`Error removing remote traefik config for ${appName}:`,
@@ -107,10 +106,7 @@ export const loadOrCreateConfigRemote = async (
 	const fileConfig: FileConfig = { http: { routers: {}, services: {} } };
 	const configPath = path.join(DYNAMIC_TRAEFIK_PATH, `${appName}.yml`);
 	try {
-		const { stdout } = await execAsyncRemote(
-			serverId,
-			`cat ${quote([configPath])}`,
-		);
+		const { stdout } = await execAsyncRemote(serverId, `cat ${configPath}`);
 
 		if (!stdout) return fileConfig;
 
@@ -137,10 +133,7 @@ export const readRemoteConfig = async (serverId: string, appName: string) => {
 	const { DYNAMIC_TRAEFIK_PATH } = paths(true);
 	const configPath = path.join(DYNAMIC_TRAEFIK_PATH, `${appName}.yml`);
 	try {
-		const { stdout } = await execAsyncRemote(
-			serverId,
-			`cat ${quote([configPath])}`,
-		);
+		const { stdout } = await execAsyncRemote(serverId, `cat ${configPath}`);
 		if (!stdout) return null;
 		return stdout;
 	} catch {
@@ -196,10 +189,7 @@ export const readConfigInPath = async (pathFile: string, serverId?: string) => {
 	const configPath = path.join(pathFile);
 
 	if (serverId) {
-		const { stdout } = await execAsyncRemote(
-			serverId,
-			`cat ${quote([configPath])}`,
-		);
+		const { stdout } = await execAsyncRemote(serverId, `cat ${configPath}`);
 		if (!stdout) return null;
 		return stdout;
 	}
@@ -231,7 +221,7 @@ export const writeConfigRemote = async (
 		const encoded = encodeBase64(traefikConfig);
 		await execAsyncRemote(
 			serverId,
-			`echo "${encoded}" | base64 -d > ${quote([configPath])}`,
+			`echo "${encoded}" | base64 -d > "${configPath}"`,
 		);
 	} catch (e) {
 		console.error("Error saving the YAML config file:", e);
@@ -249,7 +239,7 @@ export const writeTraefikConfigInPath = async (
 			const encoded = encodeBase64(traefikConfig);
 			await execAsyncRemote(
 				serverId,
-				`echo "${encoded}" | base64 -d > ${quote([configPath])}`,
+				`echo "${encoded}" | base64 -d > "${configPath}"`,
 			);
 		} else {
 			fs.writeFileSync(configPath, traefikConfig, "utf8");
@@ -282,11 +272,7 @@ export const writeTraefikConfigRemote = async (
 		const { DYNAMIC_TRAEFIK_PATH } = paths(true);
 		const configPath = path.join(DYNAMIC_TRAEFIK_PATH, `${appName}.yml`);
 		const yamlStr = stringify(traefikConfig);
-		const encoded = encodeBase64(yamlStr);
-		await execAsyncRemote(
-			serverId,
-			`echo "${encoded}" | base64 -d > ${quote([configPath])}`,
-		);
+		await execAsyncRemote(serverId, `echo '${yamlStr}' > ${configPath}`);
 	} catch (e) {
 		console.error("Error saving the YAML config file:", e);
 	}

packages/server/src/utils/volume-backups/restore.ts

@@ -1,5 +1,4 @@
 import path from "node:path";
-import { quote } from "shell-quote";
 import {
 	findApplicationById,
 	findComposeById,
@@ -24,7 +23,7 @@ export const restoreVolume = async (
 	const backupPath = `${bucketPath}/${backupFileName}`;
 
 	// Command to download backup file from S3
-	const downloadCommand = `rclone copyto ${rcloneFlags.join(" ")} ${quote([backupPath])} ${quote([`${volumeBackupPath}/${backupFileName}`])}`;
+	const downloadCommand = `rclone copyto ${rcloneFlags.join(" ")} "${backupPath}" "${volumeBackupPath}/${backupFileName}"`;
 
 	// Base restore command that creates the volume and restores data
 	const baseRestoreCommand = `
@@ -41,7 +40,7 @@ export const restoreVolume = async (
 		-v ${volumeName}:/volume_data \
 		-v ${volumeBackupPath}:/backup \
 		ubuntu \
-		bash -c "cd /volume_data && tar xvf /backup/${quote([backupFileName])} ."
+		bash -c "cd /volume_data && tar xvf /backup/${backupFileName} ."
 	echo "Volume restore completed ✅"
 	`;