Finsys Release Notes

What's new in v1.0.46

✨ restart a stack in depends_on order, keeping the same containers (#1480)

✨ allow secret-less git webhooks via the ALLOW_WEBHOOKS_WITHOUT_SECRET env var

✨ optional STACKS_DIR flat layout for local stacks (#514, #778, PR#1482, @xd003)

🐛 faster incremental backups when multiple stacks share one repository (#1494)

🐛 "disable build cache" no longer errors on deploy (#1479, PR#1020, @He-Is-HaZaRdOuS)

🐛 test connection on a saved environment without re-entering the token (#1483)

🐛 populate environment variables again finds the repo's .env file (#1495)

🐛 POST /api/stacks honors the target environment in the body (#1491)

🐛 large image scans no longer fail when the scanner log rotates (#1496)

🐛 Compose Validate no longer false-flags a valid env_file (#1497)

🐛 cache app icons in one request so the containers and stacks pages load faster

🐛 upgrade svelte to 5.56.10 (#1476, PR#1477, @ThanatosDi)

🐛 refresh the bundled docker-compose (5.5.0-r2)

🐛 stricter per-environment access and permission checks across the API

🐛 redact secret values from compose command output and restrict backup restore targets

🐛 local-path backup destinations now reject a host path that isn't a Dockhand bind mount (#1506)

🐛 escape $ in env values when generating a compose file from a container (#1507)

🐛 clearer git permission errors that match the credential type (token vs SSH key) (#1509)

Docker image

docker pull fnsys/dockhand:v1.0.46

Also available as fnsys/dockhand:latest

View on Docker Hub

⚠️This is important security upgrade with a number of API hardenings.

What's new in v1.0.45

• 🐛 security hardening across the API
• ✨ KeePassXC as a secret provider - pull secrets from a .kdbx via keepassxc-cli, bulk or inline refs (#1460)
• ✨ compose generated from a container now captures network config and resource limits (#1464)
• ✨ compose validate flags a service with no healthcheck and a defined-but-unused named volume
• ✨ optional Webhook column on the stacks list with a git stack's webhook id and copy-URL button (#845)
• ✨ sort by Disk I/O and Net I/O - the header cycles read/write and down/up (#1111)
• ✨ option to disable the session timeout (#1302)
• 🐛 pausing or resuming a backup schedule no longer clears the retention policy (#1462)
• 🐛 emergency script to relocate stack paths after moving DATA_DIR (#651, #904)
• 🐛 git stacks can now set a custom icon (#1473)

Docker image

docker pull fnsys/dockhand:v1.0.45

Also available as fnsys/dockhand:latest

View on Docker Hub

What's new in v1.0.44

✨ generate a compose file from any container - save as new or append to existing stack (#489)

✨ MQTT notification channel - publish events to a broker (#280)

✨ TLS backup repositories with a private CA and optional mutual TLS (#1451)

✨ custom stack and container icons, plus automatic container icons (#31)

✨ Azure Key Vault as a secret provider (bulk pull or inline azurekv:// references)

✨ Proton Pass inline references accept vault and item names, not just ids (pass://vault/item/field) (#1449)

✨ branch selector on git stack, with per-stack branch override (#649, PR#1343, @brx19)

✨ click the update icon in the image column to update a container (#1435)

✨ Pushover notifications can target specific devices (#1411)

✨ keep specific images from being pruned with a dockhand.prune=false label (#1391)

🐛 Infisical secret references now resolve to their value instead of the raw reference (#1447)

🐛 the version-update dialog no longer duplicates the old tag when the running image is digest-pinned (#1437)

🐛 a compose stack with a restarting container now shows a Stop action instead of Start (#1438)

🐛 optimize 1Password API calls on deploy (#1436)

🐛 direct-remote staging pulls the alpine helper image instead of failing when it's missing (#1442)

🐛 Proton Pass secrets now resolve on headless hosts with no system keyring (#1440)

🐛 fix switching an Infisical provider back to a static token (#1448)

🐛 fix backpressure in Docker streaming responses (PR#1445, @StefanSa)

🐛 sort IPv6 subnets and addresses numerically instead of randomly (#1453)

Docker image

docker pull fnsys/dockhand:v1.0.44

Also available as fnsys/dockhand:latest

View on Docker Hub

What's new in v1.0.43

• 🐛 registry auth survives an http to https token realm redirect behind a TLS proxy (#1428)
• 🐛 security: update Go to 1.25.13 (8 HIGH stdlib CVEs) and update docker-compose to 5.5.0
• ✨ Compose validate - a preflight linter & validator for compose files
• ✨ Bitwarden Secrets Manager as a secret provider via an operator-installed bws client (PR#1416, @StefanSa)
• ✨ Proton Pass as a secret provider via an operator-installed pass-cli client
• ✨ Infisical: Universal Auth (Machine Identity) as well as a static token (#1398, @strausmann)
• ✨ detect newer version tags for pinned images and show them as a badge with release notes (#1176)
• ✨ OpenAPI spec at /api/docs with a Scalar viewer, opt-in via FEAT_API_DOCS (#814, PR#1342, @strausmann)
• ✨ Zabbix notification channel via the history.push API (PR#1419, @snesterkov)
• 🐛 concurrent git syncs sharing an SSH credential no longer fail on a missing temp key (#1413, PR#1143, @HoroTW)
• 🐛 backup notifications show a real title and message instead of "undefined" (#1414)
• 🐛 git stacks accept a compose/env path with a leading slash (#1355)
• 🐛 container update notifications now fire properly (#1424)
• 🐛 Infisical: the project ID is optional when using a service token - it's taken from the token (#1398)
• 🐛 API: adopting a stack rejects a compose path not on Dockhand's filesystem (#1375)
• 🐛 API: validating a stack's env vars no longer drops the environment id (#1423)
• 🐛 editing a secret provider no longer wipes its stored token (#1432)

Docker image

docker pull fnsys/dockhand:v1.0.43

Also available as fnsys/dockhand:latest

View on Docker Hub

What's new in v1.0.42

• ✨ optional indentation guides in the compose/YAML editor (#1410)
• ✨ support caddy-docker-proxy labels (#1390)
• 🐛 updating a compose file over the API now saves it, not just deploys it (#1383)
• 🐛 reopening the MFA setup screen while MFA is enabled no longer wipes the secret and backup codes (#1399)
• ✨ upload a Docker image .tar through the UI (docker load) for air-gapped hosts (#88, #1389)
• 🐛 stack deploys no longer leak Dockhand's own DOCKER_HOST into services (#1393)
• ✨ stack secrets from external providers (1Password, HashiCorp Vault, Infisical and Doppler) (PR#1360, @wintech147, @GooRoo)
• 🐛 container update no longer fails on Podman when CPU limits are set (#1381)
• 🐛 container update no longer fails on Podman for containers using userns_mode: keep-id (#1409)
• 🐛 stack deploy now respects DOCKER_CONFIG when pulling private images (#1376)
• 🐛 start, stop or restart on Hawser updates its files on the remote host, not only on redeploy (#1240)
• 🐛 grouped container logs now show one merged timeline sorted by time (#1406)
• 🐛 multi-arch images no longer show false "update available" (#1367)

Docker image

docker pull fnsys/dockhand:v1.0.42

Also available as fnsys/dockhand:latest

View on Docker Hub

What's new in v1.0.41

✨ configurable default homepage (#1354)
✨ direct remote environments - remote stacks dir configurable, for putting the whole stack onto the remote
✨ S3 backup destinations take an AWS region with a region quick-pick
✨ registry browser shows tag size and date for self-hosted registries, loaded on expand (#876)
🐛 activity log times now honor the configured timezone (#1183)
🐛 container updates respect the new image's command/entrypoint (#1371)
🐛 deleting a stack shows which folders will be removed, with a choice to keep/delete folders (#675)
🐛 fixed an LDAP filter parsing issue that could break group-based role assignment with some AD DNs
🐛 child containers using network_mode: service/container reconnect when their parent is updated (#570)
🐛 dashboard pending-update count now matches the containers list (#1006)
🐛 more room between settings/editor content and the scrollbar (#1171)
🐛 GitLab and Harbor registries no longer report a misleading auth error when browsing (#873)
🐛 backup volume picker shows every bind mount when two containers share a container path (#1373)
🐛 Google Cloud backup destinations now use a service-account JSON key
🐛 backup and restore helper containers no longer emit a "container died" notification when they finish
🐛 snapshots from another Dockhand instance sharing the repo now appear as restorable orphans (#1351)
🐛 a stack restored to new locations always keeps its compose file and stays internal (#1351)
🐛 improved restic repository operations log (prune, check, repair index etc.)
🐛 Azure Blob destinations no longer fail with 'invalid format' on init
🐛 backup destinations now have separate extra backup and restore flags (#1349)

Docker image

docker pull fnsys/dockhand:v1.0.41
Also available as fnsys/dockhand:latest
View on Docker Hub

What's new in v1.0.40

• 🐛 git stack stop/down/remove now resolve panel environment variables (#1313, PR#1339, @strausmann)
• 🐛 the header clock falls back to the default TZ instead of UTC when the environment has none (#1340)
• 🐛 deleting a git stack no longer clears a same-named stack's variables on other environments (#1335)
• 🐛 Pangolin public URLs now default to https, honoring the ssl label (#1331)
• 🐛 disconnected environments can be deleted without timeout (#1319, PR#1320, @Solaris-star)
• ✨ Git stack source badge shows the deployed short commit hash, and git url, branch in tooltip (PR#1325, @brx19)
• 🐛 container and stack modals are centered with consistent margins, no longer shifting with the sidebar (#1308)
• 🐛 git stack webhooks now require a configured secret
• 🐛 local-path backup repos now work on a co-located socket-proxy env, and fail loudly on a remote host (#1316)
• 🐛 restoring a stack from a backup no longer drops its database-backed secret env vars (#1329)
• 🐛 restoring a stack now recreates it as a internal stack in the stacks dir, not from a tmp path
• 🐛 local-path backups are readable when Dockhand runs with a non-root PUID
• 🐛 bump docker-compose to 5.3.1-r3 (CVE-2026-56852, GHSA-hrxh-6v49-42gf, GHSA-jpjm-c3r5-q96r)
• 🐛 self-update check works on socket-proxy setups (#1203)

Docker image

docker pull fnsys/dockhand:v1.0.40

Also available as fnsys/dockhand:latest

View on Docker Hub

What's new in v1.0.38

• ✨ container/stacks backups (beta), gated with FEAT_BACKUPS_ENABLED
• ✨ view a Git stack's compose YAML and dependency graph read-only by clicking its name (PR#1294, @nenad)
• 🐛 deploy on a plain internal stack no longer 500s when the request has no body (#1271)
• 🐛 wider Activity event details modal (#1277)
• 🐛 container updates refresh image-provided env vars and labels, overrides are kept (#1226, #1256)
• 🐛 private repos with a token credential and no username now authenticate (#1273)
• 🐛 dashboard CPU history no longer spikes past 100% on busy/churny hosts (#1279)
• 🐛 failed updates (e.g. Docker Hub limits) show a 'check failed' instead of silently reporting no update (#1255)
• 🐛 git stacks reject uppercase names upfront instead of leaving an orphaned clone (#1284)
• 🐛 scan all images now covers untagged digest-pinned images instead of skipping them (#1286)
• 🐛 registry containers stuck on a moved tag are no longer misread as "local" and skipped from updates (#1288)
• 🐛 bump docker-compose 5.2.0-r0 -> 5.3.1-r1 (CVE-2026-42505)
• 🐛 bump Go 1.25.11 -> 1.25.12 (patches 4 stdlib CVEs)
• 🐛 volume prune now removes named unused volumes, keeping scanner caches (#1289)
• ✨ DNS_RESULT_ORDER=verbatim enables IPv6 fallback for outbound requests on IPv4-broken hosts (#1293)
• 🐛 OIDC/network errors now show the underlying cause instead of a bare "fetch failed" (#1293)
• 🐛 ntfy webhook with a trailing slash on the topic no longer fails with a 404 (#1300)
• 🐛 stack deploy and git sync notifications now actually fire on real deploys (#1295)

Docker image

docker pull fnsys/dockhand:v1.0.38

Also available as fnsys/dockhand:latest

View on Docker Hub

What's new in v1.0.37

• ✨ Prometheus metrics at /metrics for env state and internals, gated by EXPORT_METRICS (#339)
• ✨ export scan results as SARIF 2.1.0, manual export and API for DefectDojo/Dependency-Track/GitHub (#415)
• ✨ bump bundled docker-compose to 5.2.0-r0 to clear known CVEs
• ✨ Vulnerabilities dashboard: aggregated CVE findings (#1038)
• ✨ update container images directly from the Stack view (#1073)
• ✨ stacks list shows an update indicator for stacks with image updates (#504)
• 🐛 copying an image to another registry keeps its tag instead of defaulting to latest (#1243)
• 🐛 more-than-current image re-scans the current image so a stale cached scan doesn't block (#1022)
• ✨ application logs now include the log level (INFO/WARN/ERROR) in the prefix (#1166)
• ✨ option to suppress the "What's New" popup (#1235)
• 🐛 ntfy notifications now forward the email query parameter so ntfy can send email (#1231)
• ✨ default scanner images bumped to grype v0.115.0 and trivy 0.71.2 (#1241)
• 🐛 the "Latest" update-check result now stays visible and doesn't revert (#1019)
• ✨ a stack with container label dockhand.adopt=false excluded from adoption (#998)
• 🐛 dashboard daemon info shows the real host hostname, not Dockhand's container id (#1265)
• ✨ file editor prompts to save/discard unsaved changes before closing (#1264)
• 🐛 GET /api/containers/check-updates now lists pending updates (POST still triggers a check) (#1266)
• ✨ sidebar menu customizable (order and visibility of items) (#1252)
• 🐛 activity and audit date filters respect the configured timezone instead of UTC (#1269)
• ✨ git deploy progress shows the changed files before the deploy starts (#1260)

Docker image

docker pull fnsys/dockhand:v1.0.37

Also available as fnsys/dockhand:latest

View on Docker Hub

What's new in v1.0.36

• ✨ sidebar shows an amber update indicator when a newer Dockhand image is available (#1146)
• 🐛 Tag image modal too narrow for images identified only by SHA (#1205)
• 🐛 self-hosted ntfy: accept raw tk_... access tokens in ?auth= (#1209)
• 🐛 dashboard: a single failed DB stats query no longer poisons the whole environment tile (#1210)
• 🐛 UI dates and times now honor the configured default timezone instead of the browser's timezone (#1183)
• 🐛 add missing reset-mfa.sh emergency script referenced by the manual (#1214)
• 🐛 registry browser: copy between registries no longer duplicates the host (#1220)
• ⚡ published image carries standard OCI annotations (source, url, title, description, vendor, licenses) (#1217)
• ✨ scanner: configurable network mode and DNS servers for vulnerability scans (#1219)
• ✨ template tiles now show a Project link that opens the upstream project page (#1211)
• ⚡ cron picker: hour shows just HH (was HH:00), minute granularity bumped from 15 to 5 (#1198)
• ✨ grid buttons: configurable size and optional semantic colors (#1072)
• 🐛 copy buttons (git deploy logs, API tokens) now work over plain HTTP (#1222)
• 🐛 Podman pod-infra containers no longer trigger update-check warnings (#1221)
• 🐛 terminal exec works even when the browser sends a cookie with stray % characters (#1224)

Docker image

docker pull fnsys/dockhand:v1.0.36

Also available as fnsys/dockhand:latest

View on Docker Hub

What's new in v1.0.35

• ✨ image prune skips Dockhand's scanner images (grype, trivy), configurable (#625)
• 🐛 "No archive" download format selection not persisted (#1180)
• 🐛 regression: vulnerability scans on direct-TCP envs (#1195)
• 🐛 Pangolin labels — recognise the real public-resources / private-resources namespaces (#2)
• 🐛 healthcheck uses HTTPS probe when HTTPS_MODE=on (#1191)
• 🐛 shell detection improved for containers with non-standard PATH or shell locations (#1189)

Docker image

docker pull fnsys/dockhand:v1.0.35

Also available as fnsys/dockhand:latest

View on Docker Hub

What's new in v1.0.34

Important

This release closes GHSA-f6q3-chhc-4hxm

• ✨ raw file download — no tar wrapping (#1180)
• 🐛 update modal stuck after closing mid-pull (#1094)
• 🐛 vulnerability scans on Podman hosts (direct TCP and Hawser) (#1076)
• 🐛 crash-looping containers now appear in the logs page list (#227)
• ✨ filter containers by "Update available" (#1063)
• ✨ show hostname / IP of the selected environment in the top header (#962)
• ✨ internal auth and validation hardening and dependency bumps
• ✨ Traefik and Pangolin integration — surface proxy URLs on container and stack panels (#2)
• ✨ release-notes link next to images with updates available (#538)
• ✨ lifecycle action buttons in the container details modal (#461)
• ✨ template library — browse and deploy compose templates from configurable sources (#48)
• 🐛 file browser fails on containers with ls in /usr/sbin (#1185)

Docker image

docker pull fnsys/dockhand:v1.0.34

Also available as fnsys/dockhand:latest

View on Docker Hub

What's new in v1.0.33

• ✨ in-place container property updates without restart — restart policy, CPU/memory limits (#1153)
• ✨ clickable stack badge in container and volume inspect modals (#1121)
• ✨ clickable stack badge in volumes list row (#1122)
• ✨ volumes list shows driver_opts type (NFS, CIFS, etc.) with sort and filter (#1123)
• ✨ Bark iOS notifications (#1095, PR#1097, @undirectlookable)
• ✨ Signal notifications via signal-cli-rest-api (#1099)
• ✨ Apprise passthrough — forward to a self-hosted caronc/apprise-api server (#1099)
• 🐛 env editor flagged Docker/Compose built-ins as MISSING (#141)
• 🐛 YAML editor indentation was inconsistent when pressing Enter (#1156)
• ✨ dockhand.update=false, dockhand.hidden=true and localhost/* images skip registry polling (#1083)
• 🐛 registry authentication for image pulls (#1105)
• ✨ native HTTPS listener, off by default (#1102)
• 🐛 environments stuck "Failed" after VPN/Tailscale tunnel drops until agent restart (#1160)
• 🐛 health_status events flooding container_events table (#1165)
• 🐛 git stack sync removes files deleted from the repo (hash-verified) (#966, #1162)
• ✨ upload TLS/mTLS certificate files in environment editor (#125)
• ✨ syntax highlighting for shell, Dockerfile, TOML, INI/conf and .env files in the file browser viewer (#1055)
• ✨ Animated icons now configurable (#1169)
• 🐛 stack deploys ignored the env's configured socket path (#1172)
• 🐛 environment names with characters that break path resolution (e.g. *) are now rejected (#1179)

Docker image

docker pull fnsys/dockhand:v1.0.33

Also available as fnsys/dockhand:latest

View on Docker Hub

What's new in v1.0.32

• ✨ container details tweaks: process count, label filter, copy all labels (#812)
• ✨ log improvements (#1130)
• 🐛 cleared Resources fields not persisted on container edit (#1119)
• 🐛 long container names overflowed in activity event details dialog (#1129)
• 🐛 git stack recreate and start operations ignored Dockhand-stored env vars (#1132)
• 🐛 dashboard stopped count reset to 0 after refresh for gracefully stopped containers (#1133)
• 🐛 auto-update preserves runtime -e env and -l label overrides (#1135)
• 🐛 git stack volume binds resolved to wrong host path when compose was in a subdirectory (#1139)
• 🐛 git stacks: subdir compose files now find their adjacent env files (#1136)
• ✨ env editor doesn't flag Docker/Compose built-in variables as unused (#141)
• ✨ container network mode: share another container's network namespace (#161)

Docker image

docker pull fnsys/dockhand:v1.0.32

Also available as fnsys/dockhand:latest

View on Docker Hub