The longest `ps:report` flag is now `--ps-computed-stop-timeout-seconds` (34 chars), which pushes the per-plugin stdout column width past the 31-char floor used by `common.ReportSingleApp`. The `(report) report` test's literal-string assertion for `Deployed:` needs three extra spaces to match the new alignment.
The `ps` and `cron` plugins emitted `:report --format json` keys that
skipped the `<plugin>-` prefix or `-global-` infix used by every other
plugin, forcing external consumers to special-case those names. Rename
the affected report flags so they match the `<plugin>-global-<property>`
and `<plugin>-computed-<property>` convention introduced in 0.38.0, and
add the previously missing `computed-` siblings to both the per-app and
`--global` reports so the shape lines up with caddy, haproxy, and
traefik.
Three plugins still leaked the built-in default through `<plugin>-global-<property>` after the broader raw/computed split in #8640. External tooling reading `:report --format json` for drift detection could not distinguish "set to default" from "never set" - after a `:set --global` followed by an unset, the JSON still reported the default value. The `<plugin>-global-<property>` keys now hold the raw stored value (empty when nothing has been set) and `<plugin>-computed-<property>` keys hold the effective value with per-app, global, and built-in default fallback. Every global property now has a computed sibling for shape consistency, including those whose default is empty. Internal callers in `scheduler-k3s` that previously read the default-applied global helpers now consume new `getComputed*` helpers, keeping deploy-time behavior unchanged.
The `openresty:report --format json` payload emitted bare property names for the four global-only properties (`image`, `letsencrypt-email`, `letsencrypt-server`, `allowed-letsencrypt-domains-func-base64`), while `hsts` already used the `global-`/`computed-` convention adopted by the other proxy plugins. External tooling consuming the report had to maintain a per-property naming map within a single plugin. The global flag map now emits `--openresty-global-<X>` (raw stored value, empty when unset) and `--openresty-computed-<X>` (effective value with the built-in default applied) for those four properties plus `hsts`, and the per-app map gains the same pair for the global-only properties. The compose template and the two non-report callers consume the `computed-` accessors so the runtime behavior is unchanged.
nginx 1.25.1 deprecated the `listen ... http2` parameter in favor of a standalone `http2 on;` directive. Apps that ship a custom `nginx.conf.sigil` forked from an old default still hardcode `listen ... ssl http2;` and trigger `nginx: [warn]` lines from `nginx -t`. Surface a deprecation warning during `nginx_build_config` whenever the active template is app- or plugin-supplied and still contains the deprecated parameter, matching the existing warnings for `DOKKU_APP_LISTENERS`, `NGINX_SSL_PORT`, and `NGINX_PORT`, and point users at the `HTTP2_DIRECTIVE_SUPPORTED` variable already used by the default template.
The docker-local scheduler wrote each app.json cron command verbatim into the dokku user's crontab, where cron's `bash -c` interpreted any shell metacharacters in the command on the host as the dokku user rather than inside the container. The crontab line is now `dokku cron:run <app> <cron-id>`, and the command is resolved from app.json and exec'd inside the container at run time. Commands containing shell operators are also rejected when app.json is validated at deploy time.
The Traefik 26.0.0 chart registers CRDs under both `traefik.containo.us` and `traefik.io`, so a bare `kubectl get ingressroute` resolves against the legacy group where no resources exist and returns NotFound. Querying `ingressroutes.traefik.io` targets the group Dokku's chart actually writes to.
# History
## 0.38.6
Install/update via the bootstrap script:
```shell
wget -NP . https://dokku.com/install/v0.38.6/bootstrap.sh
sudo DOKKU_TAG=v0.38.6 bash bootstrap.sh
```
### Bug Fixes
- #8633: @Mordred Correctly redirect http traffic to https when using scheduler-k3s
- #8665: @josegonzalez Clarify byte-preserving behavior of config:set --encoded
- #8666: @josegonzalez Depend on cron | cron-daemon to allow alternatives
- #8638: @josegonzalez Support --global on cron:set
### Refactors
- #8668: @josegonzalez Hash scheduler-k3s cron-id label to fit Kubernetes' 63-byte cap
- #8664: @josegonzalez Convert filesystem migration markers to plugin properties
### Documentation
- #8645: @zenspider Removed outdated warning about dokku-update not being able to upgrade to specific versions.
### Tests
- #8667: @josegonzalez Rename logs:report vector key test and guard old keys
- #8662: @dependabot[bot] chore(deps): bump qs from 6.15.0 to 6.15.2 in /tests/apps/checks-root
- #8661: @dependabot[bot] chore(deps): bump sass from 1.99.0 to 1.100.0 in /tests/apps/multi
- #8658: @dependabot[bot] chore(deps-dev): bump heroku/heroku-buildpack-php from 288 to 290 in /tests/apps/php
- #8657: @dependabot[bot] chore(deps): bump slim/slim from 4.15.1 to 4.15.2 in /tests/apps/php
- #8654: @dependabot[bot] chore(deps): bump ruby from 4.0.4 to 4.0.5 in /tests/apps/dockerfile-entrypoint
- #8642: @dependabot[bot] chore(deps): bump google.golang.org/grpc from 1.81.0 to 1.81.1 in /tests/apps/gogrpc
### Dependencies
- #8652: @dependabot[bot] chore(deps): bump github.com/onsi/gomega from 1.40.0 to 1.41.0 in /plugins/common
- #8663: @dokku-bot chore: bump herokuish to 0.11.13
- #8646: @dokku-bot chore: bump pack to 0.40.6
- #8659: @dependabot[bot] chore(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0 in /plugins/common
- #8660: @dependabot[bot] chore(deps): bump click from 8.4.0 to 8.4.1 in /docs/_build
- #8655: @dependabot[bot] chore(deps): bump github.com/containerd/containerd from 1.7.30 to 1.7.32 in /plugins/scheduler-k3s
- #8651: @dependabot[bot] chore(deps): bump click from 8.3.3 to 8.4.0 in /docs/_build
- #8649: @dependabot[bot] chore(deps): bump github.com/onsi/gomega from 1.40.0 to 1.41.0 in /plugins/buildpacks
- #8650: @dependabot[bot] chore(deps): bump github.com/onsi/gomega from 1.40.0 to 1.41.0 in /plugins/config
- #8648: @dependabot[bot] chore(deps): bump zipp from 3.23.1 to 4.1.0 in /docs/_build
- #8644: @dokku-bot chore: bump pack to 0.40.5
- #8641: @dependabot[bot] chore(deps): bump traefik from v3.7.0 to v3.7.1 in /plugins/traefik-vhosts
- #8634: @dependabot[bot] chore(deps): bump pymdown-extensions from 10.21.2 to 10.21.3 in /docs/_build
### Other
- #8640: @josegonzalez Split report global keys into raw and computed
The `dokku.com/cron-id` label could exceed Kubernetes' 63-byte cap because the cron ID is `base36(appName === command === schedule)`, which expands roughly 1.5x per byte. The label is now keyed `dokku.com/cron-hash` and holds the `sha1` hex digest of the cron-id, a fixed 40-character value that always fits the cap. The same hex digest is mirrored into the `dokku.com/cron-hash` annotation, and the original base36 cron-id stays in the `dokku.com/cron-id` annotation that `cron:list` reads when surfacing user-facing IDs. Per-task lookups stay server-side via label selectors, so `cron:set --maintenance` and the forbid/replace concurrency checks on `dokku run --cron-id` keep working without any in-memory filtering.
Adds four Go template tests for ingress-route.yaml covering the imported-cert secret name, multiple domains per IngressRoute, the non-traefik ingress_class guard, and the https port_map dedup when an http port_map already covers the same container port. Also adds a bats integration test that deploys a TLS-enabled app under traefik and asserts both IngressRoute manifests and live http-to-https redirect plus https serving.
The canonical encode pipeline `echo "value" | base64` silently appends `\n` to the value, which round-trips through base64 and ends up stored in the env. Document that decoded values are stored byte-for-byte, recommend `printf '%s'` or `echo -n` for short inline values, and show `cat | base64 -w 0` for files. Adds a bats test asserting all four encoding patterns produce the expected stored bytes.
Closes#8647.
The asymmetric --logs-vector-global-image and --logs-vector-global-networks flags were renamed to --logs-global-vector-image and --logs-global-vector-networks in #8640 so they match the standard `--<plugin>-global-<property>` shape used by every other report. The bats description string at tests/unit/logs.bats:533 was still pinned to the old asymmetric phrasing, and there was no assertion that the deprecated JSON keys had actually been removed. Updates the test description to match its assertions and adds a regression guard that fails if logs-vector-global-image or logs-vector-global-networks ever reappear in the --global JSON report. Closes#8632.
The bare `cron` dependency caused `apt` to remove `dokku` whenever a user installed an alternative cron daemon such as `systemd-cron`. Listing the virtual `cron-daemon` package as an alternative keeps the default install behaviour (fresh installs still pull in `cron`) while letting any provider of `cron-daemon` satisfy the dependency, so swapping cron daemons no longer takes `dokku` with it.
The docker-options DOCKER_OPTIONS_<PHASE>.migrated sentinels and the storage data/storage-registry/migrations/<app> flag files are now stored as per-app properties (`migrated-<phase>` and `legacy-mounts-migrated` respectively), so they survive a property-store backup/restore and align with the existing `migrated-from-files`, `env-migrated`, and `nginx-conf-sigil-migrated` patterns. The new markers are written only when a non-empty legacy source was actually migrated, distinguishing apps that never had legacy state from apps that did and were drained. A one-cycle upgrade-cycle conversion drains any leftover filesystem sentinels into the new properties and removes the files; for docker-options the conversion deliberately runs before the global `migrated-from-files` short-circuit so installs upgrading from the previous release still get their `.migrated` files converted.
Renames the existing `## Internal properties` umbrella section to `## Properties` across all plugin docs and adds a new `### Settable properties` subsection enumerating every property accepted by each plugin's `:set` command. Each row lists scope, default, the actual `:report` flag shapes that surface the value, and a one-line description. The buildpacks plugin is included even though it uses `:set-property`, with a note in the subsection clarifying the legacy command name. Property lists, scopes, and report flags were verified against plugin source and the live dokku binary.
After the report rename made --logs-global-vector-image return the raw
stored value (empty when unset) and split --logs-computed-vector-image
out as the default-resolved key, the (logs:report)
vector-global-image and vector-global-networks raw test still pinned
assert_output_exists on the raw key in the unset state. The raw key is
correctly empty after dokku logs:set --global vector-image runs, and
the bundled vector image default is exposed via the computed key now.
The internal-properties tables on builds.md (8 --build-* flags),
ssl.md (8 --ssl-* flags), and process-management.md (4 ps flags) each
crammed all the flags into a single comma-separated table row with one
umbrella description. Splits each into a row per flag with a specific
description and the actual code-path source (the build record write
path, the openssl x509 parse target, the ps inspection helper).
The previous commit renamed --logs-vector-global-image and
--logs-vector-global-networks to --logs-global-vector-image and
--logs-global-vector-networks, and added --logs-computed-vector-image,
--logs-computed-vector-networks, and --logs-computed-vector-sink. The
logs.bats per-app Invalid-flag listing was still pinned to the old
10-flag set and the vector-global JSON keys and CLI flags still used
the old names, so the (logs) logs:report app, (logs:report)
vector-global-image and vector-global-networks raw, and (logs)
logs:set --global vector-networks tests failed - the latter cascaded
because the failing assertion ran before its vector-image cleanup.
Updates the per-app Invalid-flag string to the 13-flag sorted listing,
renames every stale jq key and CLI flag reference, adds a parallel
(logs) logs:report --global invalid flag test covering the 10-flag
global-scope listing, and adds dokku logs:set --global vector-image
to teardown so a future failing test doesn't leak the property.
Addresses review feedback on #8640. fn-archive-max-size,
fn-archive-max-files, fn-git-deploy-branch, and fn-git-keep-git-dir are
renamed with `computed` in the function name so the names match the
resolved-with-default semantic they implement, and every caller is
updated in lockstep. logs:report renames the misordered
--logs-vector-global-image and --logs-vector-global-networks to
--logs-global-vector-image and --logs-global-vector-networks, makes the
global getters return the raw stored value, and adds
--logs-computed-vector-image, --logs-computed-vector-networks, and
--logs-computed-vector-sink. network:report --global gains the
computed-* keys for attach-post-create, attach-post-deploy,
initial-network, and tld so external tooling can read the resolved
value at global scope. The --quiet flag is dropped from every
:report --format json | jq invocation across the PR's bats files; the
report's --format json output is the only stdout and the flag is
redundant.
The nginx-property binary's globalValue() switch returned ComputedX for
client-body-timeout, client-header-timeout, keepalive-timeout, and
lingering-timeout, leaking the per-app value into nginx:report's
global-<prop> key. Other properties in the same switch already call
GlobalX. Aligns the four with the rest. Also tightens
tests/unit/nginx-vhosts_properties.bats so the helper preserves values
containing whitespace or literal \$ across the inner /bin/bash -c, and
switches proxy-keepalive to integer values since the set subcommand
validates it via is_number.
Fixes CI failures from the prior commit's bats additions.
storage report mounts are prefixed with `-v `, logs.bats setup does not
auto-create the test app, the nginx-vhosts shell report emits JSON keys
without the `nginx-` plugin prefix, registry computed-image-repo falls
back to the default `dokku/<app>` repo name when no template is set,
cron computed-maintenance follows OR-not-override semantics so a per-app
`false` does not override a global `true`, the scheduler subcommand
help string is `Manage scheduler settings`, and bringing ps procfile-path
into the #8640 raw convention required updating the pre-existing
`(ps:set) procfile` assertion. Also extends fn-git-keep-git-dir to fall
back through the global property before the built-in default so global
keep-git-dir actually takes effect at deploy time.
