Dockhand Updates & Release Notes

What's new in v1.0.54

• 🐛 a version pattern with four or five parts is no longer refused, and an ignored pattern says why (#1702)
• 🐛 reading pages no longer fails behind an nginx reverse proxy that uses an upstream block (#1707)
• 🐛 image scans work again when the Docker daemon compresses its logs (PR#1715, @santacruz-usa)
• 🐛 a container with a long stop_grace_period updates instead of being left stopped
• ✨ the interface follows your language - translation engine and German (#494, PR#1706, PR#1709, PR#1718, PR#1719, PR#1722, PR#1726, PR#1734, PR#1736, PR#1738, PR#1742, @Hellraiser28)
• ✨ Simplified Chinese translation (#494, PR#1708, PR#1716, PR#1720, PR#1721, PR#1730, PR#1733, PR#1741, PR#1749, @maicent)
• ✨ French translations, for France and Canada (#494, PR#1714, PR#1717, PR#1727, PR#1728, PR#1729, PR#1732, PR#1735, PR#1746, PR#1747, PR#1748, @MagnanGG)
• ✨ Polish translation (#494)
• 🐛 a wider sidebar so translated labels fit (PR#1731, @MagnanGG)
• 🐛 a scheduled update is no longer blocked by a failed scan of an image the registry cannot name (#1737)
• ✨ Psono as a secret provider, with bulk pull and inline psono:// references
• ✨ the secret-provider banner collapses its key list when a stack loads many secrets (#1771)
• ✨ filter containers and stacks by "Untagged" (#1704, PR#1763, @Totopo27)
• 🐛 bulk operations on stacks over the API no longer fail every item (#1745)
• 🐛 a quoted value from a .env file no longer keeps its quotes in the form (#1750)
• 🐛 a dockhand.tags label stays on the container that carries it (#1740, PR#1743, @Totopo27)
• 🐛 the update check now reports a newer release on Kubernetes instead of giving up (#1710)
• 🐛 a moved digest on a pinned tag is now reported instead of silently ignored (#1755)
• 🐛 an unreachable environment no longer fills the log with errors for its own health checks (#1739, PR#1752, @Totopo27)
• 🐛 a git stack no longer recreates every container when a commit only touched files that do not affect them (#1761, #419, #364)

Docker image

docker pull fnsys/dockhand:v1.0.54

Also available as fnsys/dockhand:latest

View on Docker Hub

What's new in v1.0.52

• ✨ back up to an SFTP server with a dedicated SSH key and verified host keys (#1478, PR#1693, @ddeitterick)
• 🐛 a container started with PUID=1001 runs as that user instead of root (#1669)
• ✨ offer the compose file detected from container labels when adopting an external stack (#1612, PR#1617, @ondras)
• ✨ hold off automatic updates until a new image is older than a configurable minimum image age (#918, #1365, PR#1643, @TheDuffman85)
• ✨ a dockhand.name label sets the name a container is shown under (#1623)
• ✨ redeploy a stack without recreating every service, and choose how it redeploys (#148)
• ✨ sign in with a passkey instead of a password (#1431, PR#1431, @StefanSa, @timcappalli)
• 🐛 skip newer-version tags whose image is older than the one running (#1673)
• ✨ filter newer-version candidates per container (#1674)
• ✨ read per-stack resource totals from the API (#1626)
• ✨ show stack health on the stacks page, and filter by it (#1678)
• 🐛 find the stack folder when a nested bind shares a name with one at the root (#1679)
• 🐛 ordering one container with dockhand.order now moves it ahead of the unlabelled ones (#1117)
• 🐛 restore preview no longer reports an empty target for a stack whose files are there (#1681)
• 🐛 updating a Podman container started by podman-compose no longer leaves it stopped (#1692)
• 🐛 the next compose deploy no longer recreates a container Dockhand just updated (#1687)
• 🐛 a stack's bind directories are no longer left out of a backup when no volume covers them (#1696)

Docker image

docker pull fnsys/dockhand:v1.0.52

Also available as fnsys/dockhand:latest

View on Docker Hub

What's new in v1.0.51

• ✨ drag to reorder environments (#1638)
• ✨ drag to reorder tags, and the grid groups follow that order (#1651)
• 🐛 compose validate no longer reports a volume path built from a variable as undefined (#1653)
• 🐛 sorting containers by uptime now orders an hour-old container correctly (#1652)
• 🐛 the vulnerability scan retention schedule saves and reloads correctly
• 🐛 the stack editor no longer re-queries the secret provider while it sits idle (#1646)
• 🐛 keepass:// and azurekv:// references are recognised in the stack editor
• 🐛 a git stack whose deploy fails is retried on the next sync instead of being marked in sync (#1660)
• 🐛 the scanner check now finds newer grype and trivy releases, not just a rebuild of the pinned tag (#1658)
• 🐛 default scanner images bumped to grype v0.119.0 and trivy 0.75.0 (#1658)
• ✨ containers can be tagged with a dockhand.tags label, with a colour and icon (#1655)
• ✨ containers optionally show the tags their stack carries (#1665)
• ✨ drag files onto the file browser to upload them (#1661, PR#1662, @Wardrop)
• 🐛 update docker-compose 5.5.1-r2, undici 7.30.0, devalue 5.9.3 and nodemailer 10.0.10 for security fixes

Docker image

docker pull fnsys/dockhand:v1.0.51

Also available as fnsys/dockhand:latest

View on Docker Hub

What's new in v1.0.50

✨ update a container straight from its details view when a newer image is available (#1588)
✨ duplicate a backup schedule to reuse its settings for another destination (#1578)
✨ mark a secret provider as default so new stacks start with it selected (#1609)
✨ optionally skip the login form, and sign out at the identity provider (#563, #562, #1318)
✨ dashboard disk usage segments link straight to images, volumes or containers (#1314)
✨ the container file browser opens at the container's working directory (#1285)
✨ mattermost notifications arrive as colour-coded cards, like the discord ones (#1607)
✨ container icons fall back to the image namespace when the name has none (#1624)
✨ tag groups are ordered alphabetically by tag name (#1625)
🐛 oidc sign-in survives a restart and works across multiple replicas (#1601)
🐛 cleaner image scan logs, and the real registry error (#1486, #1628, #1629)
🐛 compose validate no longer flags variables a secret provider supplies (#1621)
🐛 updating a container through the API keeps its secondary networks and their aliases
🐛 recreating a container no longer reuses its old auto-assigned MAC address (#1618)
🐛 podman's default bridge is no longer shown as an extra network on containers (#1619)
🐛 a scheduled container update clears its pending row, so update all no longer fails on it (#1632)
🐛 image prune no longer times out after 30s when filters are set (#1630)
🐛 exporting an image whose name contains a slash no longer fails (#1635)
🐛 percentage disk warnings are marked as unusable on hosts that report no total (#1631)
🐛 https now starts with certificates that have no subject, like newer let's encrypt ones (#1622)
🐛 dashboard keeps its top containers and recent events after a container event (#1608)
🐛 the secret provider selector is no longer lost on save in the env text view (#1620)
🐛 a git stack .env value can be quoted and refer to another variable (#1018)
🐛 update docker-compose 5.5.1-r1, devalue 5.9.2 and nodemailer 9.1.1 for security fixes

Docker image

docker pull fnsys/dockhand:v1.0.50
Also available as fnsys/dockhand:latest
View on Docker Hub

What's new in v1.0.49

• 🐛 select-all checkbox shows a partial state, not a full tick, for a partial selection (#1605)
• 🐛 a long backup no longer crashes the app when its log stream goes quiet (#1610)
• ✨ tag containers and stacks, then filter and group the grid by tag (#781, #870)
• 🐛 removing all of a stack's environment variables no longer leaves stale entries (#1598)
• 🐛 templates with duplicate names no longer stop the templates page from rendering
• 🐛 the container toolbar no longer clips its buttons on mobile (#1586)
• 🐛 use webp or png for selfh.st icons that have no svg (#1596)
• 🐛 don't report a newer version tag that resolves to the image you already run (#1572)
• 🐛 fix vulnerability scans failing on the containerd image store (#1569, #1350)
• 🐛 show CPU and memory for containers on Windows Docker hosts (#1574)
• 🐛 don't send container died/killed notifications for a container being updated (#68)
• 🐛 stop, start, restart and remove stacks that use secret providers, e.g. stop-during-backup (#1579)
• 🐛 check for image updates on a plain-HTTP registry (#1580)
• 🐛 send you to the login page when your session expires (#1577)
• 🐛 skip hidden folders like .snapshots when scanning for stacks to adopt (#1251)
• 🐛 updating a Podman container managed by a systemd Quadlet unit now works (#1529, #1559)
• 🐛 option to skip bind mounts when scheduling backups for a whole environment (#1570)
• 🐛 git stack env vars stay visible in the editor after saving (#1112)
• ✨ search and filter containers by label (#1372)
• ✨ editor themes: select from 40 themes with live preview (#1309)
• ✨ command palette searches stacks and containers across all hosts (#670)
• ✨ clear a search field with the X button in it (#1321)
• 🐛 clearing a container's command now reverts it to the image default (#1489)
• ✨ one-shot container exec API returning stdout, stderr and exit code (#1380)
• ✨ set and change file ownership in the container file browser (#224)
• 🐛 cut backup read transactions on S3/B2 by caching the restic index between runs (#1600)
• 🐛 dashboard no longer flashes zero running containers on a remote host (#1608)

Docker image

docker pull fnsys/dockhand:v1.0.49

Also available as fnsys/dockhand:latest

View on Docker Hub

What's new in v1.0.48

• ✨ bulk-delete snapshots, and optionally forget a config's snapshots when you delete it (#1556)
• ✨ option to choose which stack operations show the full log (#1558)
• ✨ show the stack icon and name in stack action popups (#1526)
• 🐛 log in to registries over TLS on remote HTTPS environments (#1557)
• 🐛 vulnerability scans and alerts show the image tag, not just its digest (#1528)
• 🐛 resolve secret provider references when restoring a stack from a backup (#1521)
• 🐛 stop password managers from offering to save stack secret env-var fields (#1517)
• 🐛 repository stats no longer fail on the backups screen (#1561)
• 🐛 dashboard image disk usage no longer counts shared layers multiple times (PR#1461, @omggga)
• ✨ add a docker attach terminal mode (#1078, PR#1377, @ivanjx)
• 🐛 stack action buttons show for stopped and freshly created stacks, regression (#1565)
• 🐛 the update dialog no longer shows an unreleased version as the target (#1566)
• 🐛 update Go 1.26.8, docker-compose 5.5.0-r5, nodemailer 9.1.0, js-yaml 4.3.2 for security fixes

Docker image

docker pull fnsys/dockhand:v1.0.48

Also available as fnsys/dockhand:latest

View on Docker Hub

What's new in v1.0.47

✨ live compose output during deploys, plus a per-stack deploy history tab (#506, #1292, #1540, PR#1499, @strausmann)
🐛 back up stacks whose folder is bind-mounted over the data volume (#1533)
🐛 backup restore preview now works for view-only roles (#1534)
✨ warn before saving a stack whose compose file location won't survive a container recreate (#1524)
🐛 OpenAPI spec accuracy fixes (#1531, #1530, PR#1532, @strausmann)
🐛 "always redeploy" git stacks now force-recreate so config changes take effect (#1523)
🐛 resolve secret references (op://, keepass://, ...) pasted with surrounding quotes (#1521)
🐛 deleting a secret provider now warns which stacks it unbinds (#1522)
🐛 deploy a 1:1-mounted local stack by file so its compose path label is preserved (#1514)
🐛 store the compose path when a stack is created via the API without one (#1515)
🐛 Microsoft Teams (via Workflows) accepts the new Power Automate webhook URL format (#1512)
🐛 container shell sessions each keep their own live terminal when you switch between them (#1516)
🐛 sort container uptimes under a minute correctly instead of tying them (PR#1395, @wrlee)
🐛 load the web manifest through a Cloudflare tunnel by sending credentials (PR#1513, @Macleykun)
🐛 copy the restic password over plain HTTP (#1488)
🐛 scope stack backup snapshots to their own environment (#1546)
🐛 theme defaults in General settings now save and display correctly when auth is on (#1547)
✨ warn when a host's kernel has cgroup memory accounting disabled (#1549)
🐛 self-update no longer fails at the updater step on baseline (old x86_64) images (#1500)

Docker image

docker pull fnsys/dockhand:v1.0.47
Also available as fnsys/dockhand:latest
View on Docker Hub

What's new in v1.0.46

✨ restart a stack in depends_on order, keeping the same containers (#1480)

✨ allow secret-less git webhooks via the ALLOW_WEBHOOKS_WITHOUT_SECRET env var

✨ optional STACKS_DIR flat layout for local stacks (#514, #778, PR#1482, @xd003)

🐛 faster incremental backups when multiple stacks share one repository (#1494)

🐛 "disable build cache" no longer errors on deploy (#1479, PR#1020, @He-Is-HaZaRdOuS)

🐛 test connection on a saved environment without re-entering the token (#1483)

🐛 populate environment variables again finds the repo's .env file (#1495)

🐛 POST /api/stacks honors the target environment in the body (#1491)

🐛 large image scans no longer fail when the scanner log rotates (#1496)

🐛 Compose Validate no longer false-flags a valid env_file (#1497)

🐛 cache app icons in one request so the containers and stacks pages load faster

🐛 upgrade svelte to 5.56.10 (#1476, PR#1477, @ThanatosDi)

🐛 refresh the bundled docker-compose (5.5.0-r2)

🐛 stricter per-environment access and permission checks across the API

🐛 redact secret values from compose command output and restrict backup restore targets

🐛 local-path backup destinations now reject a host path that isn't a Dockhand bind mount (#1506)

🐛 escape $ in env values when generating a compose file from a container (#1507)

🐛 clearer git permission errors that match the credential type (token vs SSH key) (#1509)

Docker image

docker pull fnsys/dockhand:v1.0.46

Also available as fnsys/dockhand:latest

View on Docker Hub

⚠️This is important security upgrade with a number of API hardenings.

What's new in v1.0.45

• 🐛 security hardening across the API
• ✨ KeePassXC as a secret provider - pull secrets from a .kdbx via keepassxc-cli, bulk or inline refs (#1460)
• ✨ compose generated from a container now captures network config and resource limits (#1464)
• ✨ compose validate flags a service with no healthcheck and a defined-but-unused named volume
• ✨ optional Webhook column on the stacks list with a git stack's webhook id and copy-URL button (#845)
• ✨ sort by Disk I/O and Net I/O - the header cycles read/write and down/up (#1111)
• ✨ option to disable the session timeout (#1302)
• 🐛 pausing or resuming a backup schedule no longer clears the retention policy (#1462)
• 🐛 emergency script to relocate stack paths after moving DATA_DIR (#651, #904)
• 🐛 git stacks can now set a custom icon (#1473)

Docker image

docker pull fnsys/dockhand:v1.0.45

Also available as fnsys/dockhand:latest

View on Docker Hub

What's new in v1.0.44

✨ generate a compose file from any container - save as new or append to existing stack (#489)

✨ MQTT notification channel - publish events to a broker (#280)

✨ TLS backup repositories with a private CA and optional mutual TLS (#1451)

✨ custom stack and container icons, plus automatic container icons (#31)

✨ Azure Key Vault as a secret provider (bulk pull or inline azurekv:// references)

✨ Proton Pass inline references accept vault and item names, not just ids (pass://vault/item/field) (#1449)

✨ branch selector on git stack, with per-stack branch override (#649, PR#1343, @brx19)

✨ click the update icon in the image column to update a container (#1435)

✨ Pushover notifications can target specific devices (#1411)

✨ keep specific images from being pruned with a dockhand.prune=false label (#1391)

🐛 Infisical secret references now resolve to their value instead of the raw reference (#1447)

🐛 the version-update dialog no longer duplicates the old tag when the running image is digest-pinned (#1437)

🐛 a compose stack with a restarting container now shows a Stop action instead of Start (#1438)

🐛 optimize 1Password API calls on deploy (#1436)

🐛 direct-remote staging pulls the alpine helper image instead of failing when it's missing (#1442)

🐛 Proton Pass secrets now resolve on headless hosts with no system keyring (#1440)

🐛 fix switching an Infisical provider back to a static token (#1448)

🐛 fix backpressure in Docker streaming responses (PR#1445, @StefanSa)

🐛 sort IPv6 subnets and addresses numerically instead of randomly (#1453)

Docker image

docker pull fnsys/dockhand:v1.0.44

Also available as fnsys/dockhand:latest

View on Docker Hub

What's new in v1.0.43

• 🐛 registry auth survives an http to https token realm redirect behind a TLS proxy (#1428)
• 🐛 security: update Go to 1.25.13 (8 HIGH stdlib CVEs) and update docker-compose to 5.5.0
• ✨ Compose validate - a preflight linter & validator for compose files
• ✨ Bitwarden Secrets Manager as a secret provider via an operator-installed bws client (PR#1416, @StefanSa)
• ✨ Proton Pass as a secret provider via an operator-installed pass-cli client
• ✨ Infisical: Universal Auth (Machine Identity) as well as a static token (#1398, @strausmann)
• ✨ detect newer version tags for pinned images and show them as a badge with release notes (#1176)
• ✨ OpenAPI spec at /api/docs with a Scalar viewer, opt-in via FEAT_API_DOCS (#814, PR#1342, @strausmann)
• ✨ Zabbix notification channel via the history.push API (PR#1419, @snesterkov)
• 🐛 concurrent git syncs sharing an SSH credential no longer fail on a missing temp key (#1413, PR#1143, @HoroTW)
• 🐛 backup notifications show a real title and message instead of "undefined" (#1414)
• 🐛 git stacks accept a compose/env path with a leading slash (#1355)
• 🐛 container update notifications now fire properly (#1424)
• 🐛 Infisical: the project ID is optional when using a service token - it's taken from the token (#1398)
• 🐛 API: adopting a stack rejects a compose path not on Dockhand's filesystem (#1375)
• 🐛 API: validating a stack's env vars no longer drops the environment id (#1423)
• 🐛 editing a secret provider no longer wipes its stored token (#1432)

Docker image

docker pull fnsys/dockhand:v1.0.43

Also available as fnsys/dockhand:latest

View on Docker Hub

What's new in v1.0.42

• ✨ optional indentation guides in the compose/YAML editor (#1410)
• ✨ support caddy-docker-proxy labels (#1390)
• 🐛 updating a compose file over the API now saves it, not just deploys it (#1383)
• 🐛 reopening the MFA setup screen while MFA is enabled no longer wipes the secret and backup codes (#1399)
• ✨ upload a Docker image .tar through the UI (docker load) for air-gapped hosts (#88, #1389)
• 🐛 stack deploys no longer leak Dockhand's own DOCKER_HOST into services (#1393)
• ✨ stack secrets from external providers (1Password, HashiCorp Vault, Infisical and Doppler) (PR#1360, @wintech147, @GooRoo)
• 🐛 container update no longer fails on Podman when CPU limits are set (#1381)
• 🐛 container update no longer fails on Podman for containers using userns_mode: keep-id (#1409)
• 🐛 stack deploy now respects DOCKER_CONFIG when pulling private images (#1376)
• 🐛 start, stop or restart on Hawser updates its files on the remote host, not only on redeploy (#1240)
• 🐛 grouped container logs now show one merged timeline sorted by time (#1406)
• 🐛 multi-arch images no longer show false "update available" (#1367)

Docker image

docker pull fnsys/dockhand:v1.0.42

Also available as fnsys/dockhand:latest

View on Docker Hub

What's new in v1.0.41

✨ configurable default homepage (#1354)
✨ direct remote environments - remote stacks dir configurable, for putting the whole stack onto the remote
✨ S3 backup destinations take an AWS region with a region quick-pick
✨ registry browser shows tag size and date for self-hosted registries, loaded on expand (#876)
🐛 activity log times now honor the configured timezone (#1183)
🐛 container updates respect the new image's command/entrypoint (#1371)
🐛 deleting a stack shows which folders will be removed, with a choice to keep/delete folders (#675)
🐛 fixed an LDAP filter parsing issue that could break group-based role assignment with some AD DNs
🐛 child containers using network_mode: service/container reconnect when their parent is updated (#570)
🐛 dashboard pending-update count now matches the containers list (#1006)
🐛 more room between settings/editor content and the scrollbar (#1171)
🐛 GitLab and Harbor registries no longer report a misleading auth error when browsing (#873)
🐛 backup volume picker shows every bind mount when two containers share a container path (#1373)
🐛 Google Cloud backup destinations now use a service-account JSON key
🐛 backup and restore helper containers no longer emit a "container died" notification when they finish
🐛 snapshots from another Dockhand instance sharing the repo now appear as restorable orphans (#1351)
🐛 a stack restored to new locations always keeps its compose file and stays internal (#1351)
🐛 improved restic repository operations log (prune, check, repair index etc.)
🐛 Azure Blob destinations no longer fail with 'invalid format' on init
🐛 backup destinations now have separate extra backup and restore flags (#1349)

Docker image

docker pull fnsys/dockhand:v1.0.41
Also available as fnsys/dockhand:latest
View on Docker Hub

What's new in v1.0.40

• 🐛 git stack stop/down/remove now resolve panel environment variables (#1313, PR#1339, @strausmann)
• 🐛 the header clock falls back to the default TZ instead of UTC when the environment has none (#1340)
• 🐛 deleting a git stack no longer clears a same-named stack's variables on other environments (#1335)
• 🐛 Pangolin public URLs now default to https, honoring the ssl label (#1331)
• 🐛 disconnected environments can be deleted without timeout (#1319, PR#1320, @Solaris-star)
• ✨ Git stack source badge shows the deployed short commit hash, and git url, branch in tooltip (PR#1325, @brx19)
• 🐛 container and stack modals are centered with consistent margins, no longer shifting with the sidebar (#1308)
• 🐛 git stack webhooks now require a configured secret
• 🐛 local-path backup repos now work on a co-located socket-proxy env, and fail loudly on a remote host (#1316)
• 🐛 restoring a stack from a backup no longer drops its database-backed secret env vars (#1329)
• 🐛 restoring a stack now recreates it as a internal stack in the stacks dir, not from a tmp path
• 🐛 local-path backups are readable when Dockhand runs with a non-root PUID
• 🐛 bump docker-compose to 5.3.1-r3 (CVE-2026-56852, GHSA-hrxh-6v49-42gf, GHSA-jpjm-c3r5-q96r)
• 🐛 self-update check works on socket-proxy setups (#1203)

Docker image

docker pull fnsys/dockhand:v1.0.40

Also available as fnsys/dockhand:latest

View on Docker Hub