Mauricio Siu d48037a802 fix(security): escape compose path and validate custom compose command
- composePath / appName are now passed through shell-quote in createCommand,
  getCreateEnvFileCommand and services/compose.ts deploy commands, instead of
  being interpolated raw into 'docker compose'/'docker stack' shell commands.
- compose.command: sanitizeCommand was cosmetic (trim + strip quotes). It now
  rejects shell control characters (; & | ` $ () {} <> newline), which a normal
  docker compose CLI line never contains, blocking breakout into host commands.

Closes GHSA-8r5w-vqjr-8c44, GHSA-5xv2-7f8w-9j5c, GHSA-qh6h-669j-77rw
2026-07-19 23:06:53 -06:00
2026-01-19 08:59:19 +01:00
2025-06-02 01:09:48 -06:00

Dokploy - Open Source Alternative to Vercel, Heroku and Netlify.

Join us on Discord for help, feedback, and discussions!

Discord Shield

Dokploy is a free, self-hostable Platform as a Service (PaaS) that simplifies the deployment and management of applications and databases.

Features

Dokploy includes multiple features to make your life easier.

  • Applications: Deploy any type of application (Node.js, PHP, Python, Go, Ruby, etc.).
  • Databases: Create and manage databases with support for MySQL, PostgreSQL, MongoDB, MariaDB, libsql, and Redis.
  • Backups: Automate backups for databases to an external storage destination.
  • Docker Compose: Native support for Docker Compose to manage complex applications.
  • Multi Node: Scale applications to multiple nodes using Docker Swarm to manage the cluster.
  • Templates: Deploy open-source templates (Plausible, Pocketbase, Calcom, etc.) with a single click.
  • Traefik Integration: Automatically integrates with Traefik for routing and load balancing.
  • Real-time Monitoring: Monitor CPU, memory, storage, and network usage for every resource.
  • Docker Management: Easily deploy and manage Docker containers.
  • CLI/API: Manage your applications and databases using the command line or through the API.
  • Notifications: Get notified when your deployments succeed or fail (via Slack, Discord, Telegram, Email, etc.).
  • Multi Server: Deploy and manage your applications remotely to external servers.
  • Self-Hosted: Self-host Dokploy on your VPS.

🚀 Getting Started

To get started, run the following command on a VPS:

Want to skip the installation process? Try the Dokploy Cloud.

curl -sSL https://dokploy.com/install.sh | bash

For detailed documentation, visit docs.dokploy.com.

Github Sponsors

Contributors 🤝

Contributors

📺 Video Tutorial

Watch the video

🤝 Contributing

Check out the Contributing Guide for more information.

Description
Languages
TypeScript 99%
Go 0.7%
CSS 0.2%