Merge pull request #8954 from dokku/dependabot/pip/tests/apps/dockerfile-release/gunicorn-26.1.0

chore(deps): bump gunicorn from 26.0.0 to 26.1.0 in /tests/apps/dockerfile-release

.codacy.yml

@@ -1,10 +0,0 @@
----
-engines:
-  duplication:
-    exclude_paths:
-      - "*"
-exclude_paths:
-  - vendor/**/*
-  - tests/**/*
-  - "**_test.go"
-  - contrib/*

.devcontainer/Dockerfile

@@ -2,13 +2,16 @@ FROM dokku/dokku:latest
 
 RUN apt-get update
 RUN apt-get install --no-install-recommends -y build-essential file nano && \
-  apt-get install --no-install-recommends -y help2man shellcheck uuid-runtime wget xmlstarlet && \
+  apt-get install --no-install-recommends -y software-properties-common help2man shellcheck uuid-runtime wget xmlstarlet && \
   apt-get clean autoclean && \
   apt-get autoremove --yes && \
   rm -rf /var/lib/apt/lists/*
 
-RUN wget https://dl.google.com/go/go1.17.9.linux-amd64.tar.gz && \
-  tar -xvf go1.17.9.linux-amd64.tar.gz && \
+ARG TARGETARCH
+COPY common.mk common.mk
+RUN GOLANG_VERSION=$(grep BUILD_IMAGE common.mk | cut -d' ' -f3 | cut -d':' -f2) && \
+  wget https://dl.google.com/go/go${GOLANG_VERSION}.linux-${TARGETARCH}.tar.gz && \
+  tar -xvf go${GOLANG_VERSION}.linux-${TARGETARCH}.tar.gz && \
   mv go /usr/local
 
 RUN GOROOT=/usr/local/go /usr/local/go/bin/go install golang.org/x/tools/gopls@latest 2>&1

.devcontainer/bin/bump-modules

@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+
+export GOWORK=off
+pushd /root/go/src/github.com/dokku/dokku/plugins/ >/dev/null || exit 1
+for plugin in *; do
+  if [[ ! -f "/root/go/src/github.com/dokku/dokku/plugins/$plugin/go.mod" ]]; then continue; fi
+  echo "$plugin"
+  pushd /root/go/src/github.com/dokku/dokku/plugins/$plugin || exit 1
+  echo "running go mod tidy for $plugin"
+  if ! go mod tidy; then
+    echo "go mod tidy failed for $plugin"
+    exit 1
+  fi
+  echo "running go mod download for $plugin"
+  if ! go mod download; then
+    echo "go mod download failed for $plugin"
+    exit 1
+  fi
+  popd >/dev/null || exit 1
+done
+popd >/dev/null || exit 1

.devcontainer/bin/deploy-test-app

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+
+main() {
+  declare APP="${1:-test}"
+
+  if ! dokku apps:exists $APP; then
+    dokku apps:create $APP
+  fi
+
+  dokku builder-herokuish:set $APP allowed true
+  dokku git:sync --build $APP https://github.com/dokku/smoke-test-app.git
+}
+
+main "$@"

.devcontainer/bin/setup-dev-env

@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+
+install-go-devtools() {
+  go install github.com/go-delve/delve/cmd/dlv@latest
+  go install honnef.co/go/tools/cmd/staticcheck@latest
+  go install github.com/golangci/golangci-lint/cmd/golangci-lint@latest
+}
+
+setup-ci() {
+  local dokku_root="/root/go/src/github.com/dokku/dokku"
+  pushd "$plugin_root" >/dev/null || true
+  make ci-dependencies setup-deploy-tests
+  popd >/dev/null || true
+}
+
+main() {
+  install-go-devtools
+  setup-ci
+}
+
+main "$@"

.devcontainer/devcontainer.json

@@ -4,22 +4,37 @@
     "context": ".."
   },
   "containerEnv": {
+    "DOKKU_HOSTNAME": "dokku.me",
     "DOKKU_HOST_ROOT": "${localWorkspaceFolder}/tmp/data/home/dokku",
+    "DOKKU_LIB_HOST_ROOT": "${localWorkspaceFolder}/tmp/data/var/lib/dokku",
     "GO_ROOT_MOUNT": "${localWorkspaceFolder}:/go/src/github.com/dokku/dokku"
   },
-  "extensions": [
-    "golang.go",
-    "mads-hartmann.bash-ide-vscode",
-    "ms-vscode.makefile-tools"
+  "customizations": {
+    "vscode": {
+      "extensions": [
+        "golang.go",
+        "mads-hartmann.bash-ide-vscode",
+        "ms-vscode.makefile-tools",
+        "sleistner.vscode-fileutils",
+        "ms-azuretools.vscode-docker"
+      ]
+    }
+  },
+  "initializeCommand": [
+    "mkdir",
+    "-p",
+    "tmp/data"
   ],
-  "initializeCommand": ["mkdir", "-p", "tmp/data"],
   "mounts": [
     "source=/var/run/docker.sock,target=/var/run/docker.sock,type=bind",
     "source=${localWorkspaceFolder}/tmp/data/,target=/mnt/dokku/,type=bind"
   ],
   "overrideCommand": false,
-  "postCreateCommand": "make setup-deploy-tests",
-  "runArgs": ["--init"],
+  "postCreateCommand": "setup-dev-env",
+  "postStartCommand": "printenv > .vscode/devcontainer.env",
+  "runArgs": [
+    "--init"
+  ],
   "workspaceFolder": "/root/go/src/github.com/dokku/dokku",
   "workspaceMount": "type=bind,source=${localWorkspaceFolder},target=/root/go/src/github.com/dokku/dokku,consistency=cached"
-}
+}

.dockerignore

@@ -7,7 +7,12 @@ build
 docs
 tests
 !build/package/*
+!docs/_build/entrypoint
+!docs/_build/hooks.py
+!docs/_build/requirements.txt
 !tests/dhparam.pem
 !contrib/bash-completion
+!contrib/dependencies.json
 !contrib/docker
+!contrib/update-deb-dependencies
 vendor

.editorconfig

@@ -19,3 +19,6 @@ indent_size = 4
 insert_final_newline = true
 indent_style = tab
 indent_size = 4
+
+[*.md]
+tab_width = 4

.github/ISSUE_TEMPLATE/bug_report.yaml

@@ -1,7 +1,8 @@
 ---
 name: Bug Report
 description: File a bug report
-labels: ["needs: investigation", "type: bug"]
+labels: ["needs: investigation"]
+type: Bug
 body:
   - type: markdown
     attributes:

.github/ISSUE_TEMPLATE/documentation.yaml

@@ -0,0 +1,26 @@
+---
+name: Documentation Issue
+description: Let us know that something in the docs needs clarification
+labels: ["needs: investigation", "type: documentation"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Consider [sponsoring Dokku](https://github.com/sponsors/dokku). Sponsorship goes directly to supporting activities such as fixing bugs and general maintenance.
+  - type: input
+    id: docs-link
+    attributes:
+      label: Link to the documentation page
+      description: Which docs page is impacted?
+  - type: textarea
+    id: description
+    attributes:
+      label: Documentation problem
+      description: Describe what you think is incorrect, not well documented, or missing from the documentation
+    validations:
+      required: true
+  - type: textarea
+    id: report-output
+    attributes:
+      label: dokku report
+      description: Please paste the output of the command `dokku report` so we know what systems any issue might apply to

.github/actions/build-image/action.yml

@@ -0,0 +1,37 @@
+---
+name: 'build-image'
+
+description: 'builds a dokku docker image'
+
+inputs:
+  architecture:
+    description: 'platform to build'
+    required: true
+    default: 'linux/amd64'
+
+runs:
+  using: "composite"
+  steps:
+    - name: download packages
+      uses: actions/download-artifact@v8
+      with:
+        name: build
+        path: build
+
+    - name: set up docker buildx
+      id: buildx
+      uses: docker/setup-buildx-action@v4
+
+    - name: build docker image
+      shell: bash
+      run: |
+        docker buildx build \
+                --load \
+                --progress plain \
+                --tag "dokku/dokku:latest" \
+                .
+
+    - name: smoke test image
+      shell: bash
+      run: |
+        make test-image-healthcheck IMAGE_TAG=dokku/dokku:latest

.github/commands/bump-azure

@@ -18,7 +18,11 @@ main() {
 
   cd tmp
 
-  $GH_FOLDER/bin/gh auth login --with-token <<<"$BOT_GITHUB_API_TOKEN"
+  if [[ -n "$BOT_GITHUB_API_TOKEN" ]]; then
+    $GH_FOLDER/bin/gh auth login --with-token <<<"$BOT_GITHUB_API_TOKEN"
+  else
+    echo "BOT_GITHUB_API_TOKEN is not set, skipping gh auth login"
+  fi
 
   echo "=====> Cloning quickstart templates"
   rm -rf azure-quickstart-templates >/dev/null
@@ -35,15 +39,29 @@ main() {
   contents="$(jq --arg VERSION "$VERSION" '.parameters.dokkuVersion.defaultValue = $VERSION' application-workloads/dokku/dokku-vm/azuredeploy.json)"
   echo "${contents}" >application-workloads/dokku/dokku-vm/azuredeploy.json
 
+  # update the version in main.bicep
+  # the line being updated looks like this:
+  # param dokkuVersion string = '0.28.4'
+  # we need to update the value of dokkuVersion to the new version
+  sed -i "s/param dokkuVersion string = '[^']*'/param dokkuVersion string = '$VERSION'/" application-workloads/dokku/dokku-vm/main.bicep
+
   echo "=====> Updating remote repository"
   git add application-workloads/dokku/dokku-vm
   git checkout -b dokku-$VERSION
   git commit -m "Update dokku-vm dokku version to $VERSION"
-  git remote set-url origin "https://$BOT_GITHUB_USERNAME:$BOT_GITHUB_API_TOKEN@github.com/dokku/azure-quickstart-templates.git"
-  git push -f origin dokku-$VERSION
+  if [[ -z "$BOT_GITHUB_API_TOKEN" ]] || [[ -z "$BOT_GITHUB_USERNAME" ]]; then
+    echo "BOT_GITHUB_API_TOKEN or BOT_GITHUB_USERNAME is not set, skipping git remote set-url"
+  else
+    git remote set-url origin "https://$BOT_GITHUB_USERNAME:$BOT_GITHUB_API_TOKEN@github.com/dokku/azure-quickstart-templates.git"
+    git push -f origin dokku-$VERSION
+  fi
 
-  echo "=====> Creating upstream pull request"
-  ../$GH_FOLDER/bin/gh pr create --head dokku:dokku-$VERSION --repo Azure/azure-quickstart-templates --title "Update dokku-vm dokku version to $VERSION" --body ''
+  if [[ -z "$BOT_GITHUB_API_TOKEN" ]] || [[ -z "$BOT_GITHUB_USERNAME" ]]; then
+    echo "BOT_GITHUB_API_TOKEN or BOT_GITHUB_USERNAME is not set, skipping gh pr create"
+  else
+    echo "=====> Creating upstream pull request"
+    ../$GH_FOLDER/bin/gh pr create --head dokku:dokku-$VERSION --repo Azure/azure-quickstart-templates --title "Update dokku-vm dokku version to $VERSION" --body ''
+  fi
 
   popd &>/dev/null
 }

.github/commands/ci-setup

@@ -1,20 +1,24 @@
 #!/usr/bin/env bash
 set -eo pipefail
-set -x
+
+DOKKU_DOMAIN=${DOKKU_DOMAIN:="dokku.me"}
 
 echo "=====> set hostname"
 hostname
 internal_ip="$(ifconfig eth0 | grep 'inet ' | awk '{print $2}')"
-sudo hostname "dokku.me"
-echo "dokku.me" | sudo tee /etc/hostname
+echo "CI_SERVER_IP=${internal_ip}" >>"$GITHUB_ENV"
+sudo hostname "$DOKKU_DOMAIN"
+echo "$DOKKU_DOMAIN" | sudo tee /etc/hostname
 hostname
 sudo cat /etc/hostname
 
-echo "=====> resolve dokku.me"
+echo "=====> resolve $DOKKU_DOMAIN"
 sudo apt -qq -y --no-install-recommends install net-tools
-# dokku.me now resolves to 10.0.0.2. add 10.0.0.2/24 to eth0
-ifconfig
-sudo ip addr add 10.0.0.2/24 broadcast 10.0.0.255 dev eth0
+if [[ "$DOKKU_DOMAIN" == "dokku.me" ]]; then
+  # dokku.me now resolves to 10.0.0.2. add 10.0.0.2/24 to eth0
+  ifconfig
+  sudo ip addr add 10.0.0.2/24 broadcast 10.0.0.255 dev eth0
+fi
 
 echo "=====> install ci-dependencies"
 make ci-dependencies

.github/dependabot.yml

@@ -1,112 +1,449 @@
 ---
 version: 2
 updates:
+  - package-ecosystem: pip
+    directory: "/docs/_build"
+    schedule:
+      interval: daily
+    open-pull-requests-limit: 10
+    labels:
+      - "type: dependencies"
+  - package-ecosystem: gomod
+    directory: "/plugins/app-json"
+    schedule:
+      interval: daily
+    open-pull-requests-limit: 2
+    labels:
+      - "type: dependencies"
+  - package-ecosystem: gomod
+    directory: "/plugins/apps"
+    schedule:
+      interval: daily
+    open-pull-requests-limit: 2
+    labels:
+      - "type: dependencies"
+  - package-ecosystem: gomod
+    directory: "/plugins/builder"
+    schedule:
+      interval: daily
+    open-pull-requests-limit: 2
+    labels:
+      - "type: dependencies"
+  - package-ecosystem: gomod
+    directory: "/plugins/buildpacks"
+    schedule:
+      interval: daily
+    open-pull-requests-limit: 2
+    labels:
+      - "type: dependencies"
+  - package-ecosystem: gomod
+    directory: "/plugins/common"
+    schedule:
+      interval: daily
+    open-pull-requests-limit: 2
+    labels:
+      - "type: dependencies"
+  - package-ecosystem: gomod
+    directory: "/plugins/config"
+    schedule:
+      interval: daily
+    open-pull-requests-limit: 2
+    labels:
+      - "type: dependencies"
+  - package-ecosystem: gomod
+    directory: "/plugins/cron"
+    schedule:
+      interval: daily
+    open-pull-requests-limit: 2
+    labels:
+      - "type: dependencies"
+  - package-ecosystem: gomod
+    directory: "/plugins/docker-options"
+    schedule:
+      interval: daily
+    open-pull-requests-limit: 2
+    labels:
+      - "type: dependencies"
+  - package-ecosystem: gomod
+    directory: "/plugins/logs"
+    schedule:
+      interval: daily
+    open-pull-requests-limit: 2
+    labels:
+      - "type: dependencies"
+  - package-ecosystem: gomod
+    directory: "/plugins/network"
+    schedule:
+      interval: daily
+    open-pull-requests-limit: 2
+    labels:
+      - "type: dependencies"
+  - package-ecosystem: gomod
+    directory: "/plugins/nginx-vhosts"
+    schedule:
+      interval: daily
+    open-pull-requests-limit: 2
+    labels:
+      - "type: dependencies"
+  - package-ecosystem: gomod
+    directory: "/plugins/ports"
+    schedule:
+      interval: daily
+    open-pull-requests-limit: 2
+    labels:
+      - "type: dependencies"
+  - package-ecosystem: gomod
+    directory: "/plugins/proxy"
+    schedule:
+      interval: daily
+    open-pull-requests-limit: 2
+    labels:
+      - "type: dependencies"
+  - package-ecosystem: gomod
+    directory: "/plugins/ps"
+    schedule:
+      interval: daily
+    open-pull-requests-limit: 2
+    labels:
+      - "type: dependencies"
+  - package-ecosystem: gomod
+    directory: "/plugins/registry"
+    schedule:
+      interval: daily
+    open-pull-requests-limit: 2
+    labels:
+      - "type: dependencies"
+  - package-ecosystem: gomod
+    directory: "/plugins/repo"
+    schedule:
+      interval: daily
+    open-pull-requests-limit: 2
+    labels:
+      - "type: dependencies"
+  - package-ecosystem: gomod
+    directory: "/plugins/resource"
+    schedule:
+      interval: daily
+    open-pull-requests-limit: 2
+    labels:
+      - "type: dependencies"
+  - package-ecosystem: gomod
+    directory: "/plugins/scheduler-docker-local"
+    schedule:
+      interval: daily
+    open-pull-requests-limit: 2
+    labels:
+      - "type: dependencies"
+  - package-ecosystem: gomod
+    directory: "/plugins/scheduler-k3s"
+    schedule:
+      interval: daily
+    open-pull-requests-limit: 2
+    labels:
+      - "type: dependencies"
+  - package-ecosystem: gomod
+    directory: "/plugins/scheduler"
+    schedule:
+      interval: daily
+    open-pull-requests-limit: 2
+    labels:
+      - "type: dependencies"
+  - package-ecosystem: "docker"
+    directory: "/plugins/caddy-vhosts"
+    schedule:
+      interval: daily
+    open-pull-requests-limit: 10
+    labels:
+      - "type: dependencies"
+  - package-ecosystem: "docker"
+    directory: "/plugins/haproxy-vhosts"
+    schedule:
+      interval: daily
+    open-pull-requests-limit: 10
+    labels:
+      - "type: dependencies"
+  - package-ecosystem: "docker"
+    directory: "/plugins/logs"
+    schedule:
+      interval: daily
+    open-pull-requests-limit: 10
+    labels:
+      - "type: dependencies"
+  - package-ecosystem: "docker"
+    directory: "/plugins/openresty-vhosts"
+    schedule:
+      interval: daily
+    open-pull-requests-limit: 10
+    labels:
+      - "type: dependencies"
+  - package-ecosystem: "docker"
+    directory: "/plugins/traefik-vhosts"
+    schedule:
+      interval: daily
+    open-pull-requests-limit: 10
+    labels:
+      - "type: dependencies"
   - package-ecosystem: bundler
     directory: "/tests/apps/ruby"
     schedule:
       interval: daily
     open-pull-requests-limit: 10
+    labels:
+      - "type: tests"
   - package-ecosystem: bundler
     directory: "/tests/apps/multi"
     schedule:
       interval: daily
     open-pull-requests-limit: 10
+    labels:
+      - "type: tests"
   - package-ecosystem: npm
     directory: "/tests/apps/checks-root"
     schedule:
       interval: daily
     open-pull-requests-limit: 10
+    labels:
+      - "type: tests"
   - package-ecosystem: npm
     directory: "/tests/apps/config"
     schedule:
       interval: daily
     open-pull-requests-limit: 10
+    labels:
+      - "type: tests"
   - package-ecosystem: npm
-    directory: "/tests/apps/dockerfile-dokku-scale"
+    directory: "/tests/apps/dockerfile-app-json-formations"
     schedule:
       interval: daily
     open-pull-requests-limit: 10
+    labels:
+      - "type: tests"
   - package-ecosystem: npm
     directory: "/tests/apps/dockerfile-noexpose"
     schedule:
       interval: daily
     open-pull-requests-limit: 10
+    labels:
+      - "type: tests"
   - package-ecosystem: npm
     directory: "/tests/apps/dockerfile-procfile-bad"
     schedule:
       interval: daily
     open-pull-requests-limit: 10
+    labels:
+      - "type: tests"
   - package-ecosystem: npm
     directory: "/tests/apps/dockerfile-procfile"
     schedule:
       interval: daily
     open-pull-requests-limit: 10
+    labels:
+      - "type: tests"
   - package-ecosystem: npm
     directory: "/tests/apps/dockerfile"
     schedule:
       interval: daily
     open-pull-requests-limit: 10
+    labels:
+      - "type: tests"
   - package-ecosystem: npm
     directory: "/tests/apps/gitsubmodules"
     schedule:
       interval: daily
     open-pull-requests-limit: 10
+    labels:
+      - "type: tests"
   - package-ecosystem: gomod
     directory: "/tests/apps/gogrpc"
     schedule:
       interval: daily
     open-pull-requests-limit: 10
-    ignore:
-      - dependency-name: google.golang.org/grpc
-        versions:
-          - "> 1.29.1"
+    labels:
+      - "type: tests"
   - package-ecosystem: pip
     directory: "/tests/apps/multi"
     schedule:
       interval: daily
     open-pull-requests-limit: 10
+    labels:
+      - "type: tests"
   - package-ecosystem: maven
     directory: "/tests/apps/java"
     schedule:
       interval: daily
     open-pull-requests-limit: 10
+    labels:
+      - "type: tests"
+  - package-ecosystem: npm
+    directory: "/tests/apps/multi"
+    schedule:
+      interval: daily
+    open-pull-requests-limit: 10
+    labels:
+      - "type: tests"
   - package-ecosystem: npm
     directory: "/tests/apps/nodejs-express"
     schedule:
       interval: daily
     open-pull-requests-limit: 10
+    labels:
+      - "type: tests"
   - package-ecosystem: npm
     directory: "/tests/apps/nodejs-worker"
     schedule:
       interval: daily
     open-pull-requests-limit: 10
+    labels:
+      - "type: tests"
   - package-ecosystem: npm
     directory: "/tests/apps/nodejs-express-noappjson"
     schedule:
       interval: daily
     open-pull-requests-limit: 10
+    labels:
+      - "type: tests"
   - package-ecosystem: npm
     directory: "/tests/apps/nodejs-express-noprocfile"
     schedule:
       interval: daily
     open-pull-requests-limit: 10
+    labels:
+      - "type: tests"
   - package-ecosystem: composer
     directory: "/tests/apps/php"
     schedule:
       interval: daily
     open-pull-requests-limit: 10
+    labels:
+      - "type: tests"
   - package-ecosystem: pip
     directory: "/tests/apps/python-flask"
     schedule:
       interval: daily
     open-pull-requests-limit: 10
-  - package-ecosystem: npm
-    directory: "/tests/apps/.websocket.disabled"
-    schedule:
-      interval: daily
-    open-pull-requests-limit: 10
+    labels:
+      - "type: tests"
   - package-ecosystem: github-actions
     directory: "/"
     schedule:
       interval: daily
     open-pull-requests-limit: 10
+    labels:
+      - "type: dependencies"
+    ignore:
+      - dependency-name: "*"
+        update-types:
+          - "version-update:semver-minor"
+          - "version-update:semver-patch"
+  - package-ecosystem: "docker"
+    directory: "/"
+    schedule:
+      interval: daily
+    open-pull-requests-limit: 10
+    labels:
+      - "type: dependencies"
+  - package-ecosystem: "docker"
+    directory: "/tests/apps/dockerfile-noexpose"
+    schedule:
+      interval: daily
+    open-pull-requests-limit: 10
+    labels:
+      - "type: tests"
+  - package-ecosystem: "docker"
+    directory: "/tests/apps/dockerfile"
+    schedule:
+      interval: daily
+    open-pull-requests-limit: 10
+    labels:
+      - "type: tests"
+  - package-ecosystem: "docker"
+    directory: "/tests/apps/dockerfile-procfile"
+    schedule:
+      interval: daily
+    open-pull-requests-limit: 10
+    labels:
+      - "type: tests"
+  - package-ecosystem: "docker"
+    directory: "/tests/apps/dockerfile-entrypoint"
+    schedule:
+      interval: daily
+    open-pull-requests-limit: 10
+    labels:
+      - "type: tests"
+  - package-ecosystem: "docker"
+    directory: "/tests/apps/dockerfile-procfile-bad"
+    schedule:
+      interval: daily
+    open-pull-requests-limit: 10
+    labels:
+      - "type: tests"
+  - package-ecosystem: "docker"
+    directory: "/tests/apps/go-fail-predeploy"
+    schedule:
+      interval: daily
+    open-pull-requests-limit: 10
+    labels:
+      - "type: tests"
+  - package-ecosystem: "docker"
+    directory: "/tests/apps/zombies-dockerfile-no-tini"
+    schedule:
+      interval: daily
+    open-pull-requests-limit: 10
+    labels:
+      - "type: tests"
+  - package-ecosystem: "docker"
+    directory: "/tests/apps/dockerfile-release"
+    schedule:
+      interval: daily
+    open-pull-requests-limit: 10
+    labels:
+      - "type: tests"
+  - package-ecosystem: pip
+    directory: "/tests/apps/dockerfile-release"
+    schedule:
+      interval: daily
+    open-pull-requests-limit: 10
+    labels:
+      - "type: tests"
+  - package-ecosystem: "docker"
+    directory: "/tests/apps/dockerfile-app-json-formations"
+    schedule:
+      interval: daily
+    open-pull-requests-limit: 10
+    labels:
+      - "type: tests"
+  - package-ecosystem: "docker"
+    directory: "/tests/apps/gogrpc"
+    schedule:
+      interval: daily
+    open-pull-requests-limit: 10
+    labels:
+      - "type: tests"
+  - package-ecosystem: "docker"
+    directory: "/tests/apps/zombies-dockerfile-tini"
+    schedule:
+      interval: daily
+    open-pull-requests-limit: 10
+    labels:
+      - "type: tests"
+  - package-ecosystem: "docker"
+    directory: "/tests/apps/go-fail-postdeploy"
+    schedule:
+      interval: daily
+    open-pull-requests-limit: 10
+    labels:
+      - "type: tests"
+  - package-ecosystem: "docker"
+    directory: "/docs/_build"
+    schedule:
+      interval: daily
+    open-pull-requests-limit: 10
+    labels:
+      - "type: dependencies"
+  - package-ecosystem: "docker"
+    directory: "/.devcontainer"
+    schedule:
+      interval: daily
+    open-pull-requests-limit: 10
+    labels:
+      - "type: dependencies"

.github/linters/.markdown-lint.yml

@@ -8,3 +8,30 @@ MD013: false
 # Inline HTML
 # https://github.com/DavidAnson/markdownlint/blob/main/doc/Rules.md#md033
 MD033: false
+
+# List indentation
+# 2 spaces breaks list formatting in mkdocs
+# https://github.com/DavidAnson/markdownlint/blob/main/doc/Rules.md#md007
+MD007:
+  indent: 4
+
+# Fenced code blocks should have a language specified
+# We use a second, un-languaged code block to denote the output
+# https://github.com/DavidAnson/markdownlint/blob/main/doc/Rules.md#md040
+MD040: false
+
+# Blank line inside blockquote
+# This is typically done when a section has a "New as of" or "Warning" in addition to a note
+# May wish to take advantage of github-style admonitions
+# https://github.com/DavidAnson/markdownlint/blob/main/doc/Rules.md#md028
+MD028: false
+
+# No duplicate headers
+# HISTORY.md has a ton of these
+# https://github.com/DavidAnson/markdownlint/blob/main/doc/Rules.md#md024
+MD024: false
+
+# First line h1
+# The issue template doesn't have one
+# https://github.com/DavidAnson/markdownlint/blob/main/doc/Rules.md#md041
+MD041: false

.github/linters/.yamllint.yml

@@ -3,3 +3,6 @@ extends: default
 
 rules:
   line-length: disable
+
+ignore:
+  - plugins/scheduler-k3s/templates/*

.github/workflows/ci.yml

@@ -10,56 +10,120 @@ on:
     branches:
       - 'master'
 
+concurrency:
+  group: build-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+env:
+  INSTALL_DOCKER_REPO: 1
+
 jobs:
+  check-commit:
+    runs-on: ubuntu-24.04
+    outputs:
+      skip: ${{ steps.check-commit.outputs.skip }}
+
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+
+      - name: check if message contain keywords ace scopeid
+        id: check-commit
+        run: |
+          # checking for "docs" or "[ci skip]" messages
+          message=$(git log -1 --pretty=format:'%s')
+          if [[ "$message" =~ "\[(ci skip)\]" ]]; then
+            echo "Skipping tests due to [ci skip] message"
+            echo "skip=true" >> $GITHUB_OUTPUT
+          elif [[ "$message" =~ "^docs:" ]]; then
+            echo "Skipping tests due to "docs:" prefix on message"
+            echo "skip=true" >> $GITHUB_OUTPUT
+          fi
+
   build:
     name: build
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-24.04
+    needs: check-commit
+    if: ${{ needs.check-commit.outputs.skip != 'true' }}
     outputs:
       matrix: ${{ steps.set-matrix.outputs.matrix }}
     strategy:
       fail-fast: true
+    timeout-minutes: 45
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v7
 
       - name: set up qemu
-        uses: docker/setup-qemu-action@v2
+        uses: docker/setup-qemu-action@v4
 
       - name: set up docker buildx
         id: buildx
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@v4
 
       - name: build package
         run: ./tests/ci/setup.sh build
+        env:
+          SKIP_IMAGE_BUILD: true
 
       - name: set matrix for build
         id: set-matrix
         run: |
-          json=$(python .github/commands/matrix)
+          json=$(python3 .github/commands/matrix)
           echo $json
-          echo "::set-output name=matrix::$(echo "$json")"
+          echo "matrix=$json" >> $GITHUB_OUTPUT
 
       - name: upload packages
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v7
         with:
           name: build
           path: build
 
+  build-image-amd64:
+    name: build-image.linux/amd64
+    needs: build
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: build-image
+        uses: ./.github/actions/build-image
+        with:
+          architecture: linux/amd64
+
+  build-image-arm64:
+    name: build-image.linux/arm64
+    needs: build
+    runs-on: ubuntu-24.04-arm
+    timeout-minutes: 20
+
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: build-image
+        uses: ./.github/actions/build-image
+        with:
+          architecture: linux/arm64
+
   unit-tests:
     name: unit.${{ matrix.index }}
     needs: build
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-24.04
     strategy:
       fail-fast: false
       matrix: ${{fromJson(needs.build.outputs.matrix)}}
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v7
 
       - name: download packages
-        uses: actions/download-artifact@v1
+        uses: actions/download-artifact@v8
         with:
           name: build
+          path: build
 
       - name: ci-setup
         run: ./.github/commands/ci-setup
@@ -68,7 +132,7 @@ jobs:
       #   uses: luchihoratiu/debug-via-ssh@main
       #   with:
       #     NGROK_AUTH_TOKEN: ${{ secrets.NGROK_AUTH_TOKEN }}
-      #     SSH_PASS: ${{ secrets.SSH_PASS }}
+      #     SSH_PASS: ${{ secrets.NGROK_SSH_PASS }}
 
       - name: run ci
         timeout-minutes: 30
@@ -79,7 +143,7 @@ jobs:
           SYNC_GITHUB_PASSWORD: ${{ secrets.SYNC_GITHUB_PASSWORD }}
           SYNC_GITHUB_USERNAME: ${{ secrets.SYNC_GITHUB_USERNAME }}
 
-      - uses: actions/upload-artifact@v3
+      - uses: actions/upload-artifact@v7
         with:
           name: test-results-${{ matrix.index }}
           path: test-results
@@ -87,32 +151,37 @@ jobs:
   docker-deploy-tests:
     name: docker
     needs: build
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-24.04
     strategy:
       fail-fast: false
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v7
 
       - name: download packages
-        uses: actions/download-artifact@v1
+        uses: actions/download-artifact@v8
         with:
           name: build
+          path: build
 
       - name: ci-setup
         run: ./.github/commands/ci-setup
 
+      - name: docker-container-setup
+        run: |
+          ./tests/ci/setup.sh docker
+
       - name: test docker deploys
         shell: bash
         timeout-minutes: 20
         run: |
-          ./tests/ci/setup.sh docker
+          docker exec dokku bash -c "cat /etc/sudoers.d/dokku-nginx"
           DOKKU_SSH_PORT=3022 sudo -E make -e test-ci-docker
 
   go-tests:
     name: go.${{ matrix.index }}
     needs: build
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-24.04
     strategy:
       fail-fast: false
       matrix:
@@ -121,12 +190,13 @@ jobs:
       GITHUB_NODE_INDEX: ${{ matrix.index }}
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v7
 
       - name: download packages
-        uses: actions/download-artifact@v1
+        uses: actions/download-artifact@v8
         with:
           name: build
+          path: build
 
       - name: ci-setup
         run: ./.github/commands/ci-setup
@@ -144,7 +214,7 @@ jobs:
             2) sudo -E make -e deploy-test-multi ;;
             3) sudo -E make -e deploy-test-go-fail-predeploy deploy-test-go-fail-postdeploy ;;
           esac
-      - uses: actions/upload-artifact@v3
+      - uses: actions/upload-artifact@v7
         with:
           name: coverage.${{ matrix.index }}
           path: test-results/coverage
@@ -152,20 +222,22 @@ jobs:
   publish-test-results:
     name: publish-test-results
     needs: unit-tests
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-24.04
+    permissions:
+      checks: write
     # the build-and-test job might be skipped, we don't need to run this job then
     if: success() || failure()
 
     steps:
       - name: download test-results
-        uses: actions/download-artifact@v2
+        uses: actions/download-artifact@v8
         with:
           path: test-results
 
       - name: Publish Unit Test Results
-        uses: docker://ghcr.io/enricomi/publish-unit-test-result-action:v1
+        uses: EnricoMi/publish-unit-test-result-action@v2
         with:
           check_name: Unit Test Results
           github_token: ${{ secrets.GITHUB_TOKEN }}
           files: test-results/**/*.xml
-          comment_on_pr: false
+          comment_mode: "off"

.github/workflows/codeql-analysis.yml

@@ -23,10 +23,14 @@ on:
   schedule:
     - cron: '18 22 * * 2'
 
+concurrency:
+  group: codeql-analysis-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   analyze:
     name: Analyze
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
 
     strategy:
       fail-fast: false
@@ -38,11 +42,15 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@v7
+
+      # workaround for https://github.com/github/codeql/issues/14235
+      - name: Remove go.work file
+        run: rm go.work
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v2
+        uses: github/codeql-action/init@v4
         with:
           languages: ${{ matrix.language }}
           # If you wish to specify custom queries, you can do so here or in a config file.
@@ -53,7 +61,7 @@ jobs:
       # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
       # If this step fails, then you should remove it and run the build manually (see below)
       - name: Autobuild
-        uses: github/codeql-action/autobuild@v2
+        uses: github/codeql-action/autobuild@v4
 
       # ℹ️ Command-line programs to run using the OS shell.
       # 📚 https://git.io/JvXDl
@@ -62,9 +70,5 @@ jobs:
       #    and modify them (or add more) to build your code if your project
       #    uses a compiled language
 
-      # - run: |
-      #   make bootstrap
-      #   make release
-
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v2
+        uses: github/codeql-action/analyze@v4

.github/workflows/dependency-updates.yml

@@ -0,0 +1,110 @@
+---
+name: 'dependency-updates'
+
+# yamllint disable-line rule:truthy
+on:
+  schedule:
+    - cron: '0 6 * * *'
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  prepare:
+    name: prepare
+    runs-on: ubuntu-24.04
+    outputs:
+      matrix: ${{ steps.matrix.outputs.matrix }}
+    steps:
+      - name: Clone
+        uses: actions/checkout@v7
+
+      - name: Build dependency matrix
+        id: matrix
+        run: |
+          matrix=$(jq -c '
+            [
+              (.dependencies[]      | {section: "dependencies",      name, version, url: .urls.amd64}),
+              (.predependencies[]   | {section: "predependencies",   name, version, url: .urls.amd64}),
+              (.recommendations[]   | {section: "recommendations",   name, version, url: .urls.amd64})
+            ]
+            | map(. + {repo: (.url | capture("https://github.com/(?<r>[^/]+/[^/]+)/releases").r)})
+            | map(del(.url))
+            | {include: .}
+          ' contrib/dependencies.json)
+          echo "matrix=${matrix}" >> "$GITHUB_OUTPUT"
+
+  update:
+    name: 'update / ${{ matrix.name }}'
+    runs-on: ubuntu-24.04
+    needs: prepare
+    strategy:
+      fail-fast: false
+      matrix: ${{ fromJson(needs.prepare.outputs.matrix) }}
+    concurrency:
+      group: dependency-updates-${{ matrix.name }}
+      cancel-in-progress: false
+    steps:
+      - name: Clone
+        uses: actions/checkout@v7
+
+      - name: Resolve latest release
+        id: latest
+        env:
+          GH_TOKEN: ${{ secrets.HOMEBREW_GITHUB_API_TOKEN }}
+          REPO: ${{ matrix.repo }}
+          CURRENT: ${{ matrix.version }}
+        run: |
+          tag=$(gh release view --repo "$REPO" --json tagName -q .tagName)
+          latest="${tag#v}"
+          echo "latest=${latest}" >> "$GITHUB_OUTPUT"
+          if dpkg --compare-versions "$latest" gt "$CURRENT"; then
+            echo "outdated=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "outdated=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Bump dependency entry
+        if: steps.latest.outputs.outdated == 'true'
+        env:
+          SECTION: ${{ matrix.section }}
+          NAME: ${{ matrix.name }}
+          OLD: ${{ matrix.version }}
+          NEW: ${{ steps.latest.outputs.latest }}
+        run: |
+          tmp=$(mktemp)
+          jq --arg section "$SECTION" \
+             --arg name "$NAME" \
+             --arg old "$OLD" \
+             --arg new "$NEW" '
+            ($old) as $oldv |
+            ($new) as $newv |
+            (.[$section]) |= map(
+              if .name == $name then
+                .version = $newv
+                | .urls.amd64 |= (gsub("v" + $oldv; "v" + $newv) | gsub($oldv; $newv))
+                | .urls.arm64 |= (gsub("v" + $oldv; "v" + $newv) | gsub($oldv; $newv))
+              else . end
+            )
+          ' contrib/dependencies.json > "$tmp"
+          mv "$tmp" contrib/dependencies.json
+
+      - name: Open pull request
+        if: steps.latest.outputs.outdated == 'true'
+        uses: peter-evans/create-pull-request@v8
+        with:
+          token: ${{ secrets.HOMEBREW_GITHUB_API_TOKEN }}
+          branch: chore/bump-${{ matrix.name }}-${{ steps.latest.outputs.latest }}
+          base: ${{ github.ref_name }}
+          delete-branch: true
+          committer: 'Dokku Bot <no-reply@dokku.com>'
+          author: 'Dokku Bot <no-reply@dokku.com>'
+          commit-message: 'chore: bump ${{ matrix.name }} to ${{ steps.latest.outputs.latest }}'
+          title: 'chore: bump ${{ matrix.name }} to ${{ steps.latest.outputs.latest }}'
+          body: |
+            Bumps `${{ matrix.name }}` from `${{ matrix.version }}` to `${{ steps.latest.outputs.latest }}`.
+
+            Release notes: https://github.com/${{ matrix.repo }}/releases/tag/v${{ steps.latest.outputs.latest }}
+          labels: 'type: dependencies'

.github/workflows/docs.yml

@@ -0,0 +1,43 @@
+---
+name: 'docs'
+
+# yamllint disable-line rule:truthy
+on:
+  push:
+    branches:
+      - master
+
+concurrency:
+  group: docs-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  deploy:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Cloning repo
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - name: "Setup python 3.10"
+        uses: actions/setup-python@v7
+        with:
+          python-version: '3.10'
+
+      - name: Generate documentation
+        env:
+          BOT_GITHUB_USERNAME: ${{ secrets.HOMEBREW_GITHUB_USERNAME }}
+          BOT_GITHUB_API_TOKEN: ${{ secrets.HOMEBREW_GITHUB_API_TOKEN }}
+        run: |
+          git config --global user.name 'Dokku Bot'
+          git config --global user.email no-reply@dokku.com
+
+          curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | sudo dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg
+          sudo chmod go+r /usr/share/keyrings/githubcli-archive-keyring.gpg
+          echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | sudo tee /etc/apt/sources.list.d/github-cli.list > /dev/null
+          sudo apt update
+          sudo apt install gh -y
+
+          gh auth login --with-token <<<"$BOT_GITHUB_API_TOKEN"
+          contrib/build-docs

.github/workflows/lint.yml

@@ -10,52 +10,77 @@ on:
     branches:
       - 'master'
 
+concurrency:
+  group: lint-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   hadolint:
     name: hadolint
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-24.04
     steps:
       - name: Clone
-        uses: actions/checkout@v3
+        uses: actions/checkout@v7
       - name: Run hadolint
-        uses: hadolint/hadolint-action@f988afea3da57ee48710a9795b6bb677cc901183
-        # v1.6.0 => d7b38582334d9ac11c12021c16f21d63015fa250
+        uses: hadolint/hadolint-action@2332a7b74a6de0dda2e2221d575162eba76ba5e5
+        # v3.0.0 => 4b5806eb9c6bee4954fc0e0cc3ad6175fc9782c1
 
   markdown-lint:
     name: markdown-lint
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-24.04
     steps:
       - name: Clone
-        uses: actions/checkout@v3
-      - name: Run markdown-lint
-        uses: avto-dev/markdown-lint@04d43ee9191307b50935a753da3b775ab695eceb
-        # v1.5.0 => 04d43ee9191307b50935a753da3b775ab695eceb
+        uses: actions/checkout@v7
+      - name: Setup node
+        uses: actions/setup-node@v7
         with:
-          config: '.github/linters/.markdown-lint.yml'
-          args: './README.md'
+          node-version: '20'
+          cache: 'npm'
+          cache-dependency-path: '.github/workflows/lint.yml'
+      - name: Install markdownlint-cli
+        run: npm install -g markdownlint-cli@0.35.0
+      - name: Run markdown-lint
+        run: markdownlint -c .github/linters/.markdown-lint.yml *.md **/*.md
+
+  packer:
+    name: packer
+    runs-on: ubuntu-24.04
+    if: github.event.pull_request.user.login != 'dependabot[bot]'
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+      - name: Setup packer
+        uses: hashicorp/setup-packer@main
+        with:
+          version: latest
+      - name: Run packer init
+        run: "make image/init/digitalocean"
+        env:
+          PACKER_GITHUB_API_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: Run `packer validate`
+        env:
+          DIGITALOCEAN_TOKEN: ${{ secrets.DIGITALOCEAN_TOKEN }}
+        run: "make image/validate/digitalocean"
 
   shellcheck:
     name: shellcheck
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-24.04
     steps:
       - name: Clone
-        uses: actions/checkout@v3
+        uses: actions/checkout@v7
       - name: Run shellcheck
-        uses: ludeeus/action-shellcheck@94e0aab03ca135d11a35e5bfc14e6746dc56e7e9
+        uses: ludeeus/action-shellcheck@00cae500b08a931fb5698e11e79bfbd38e612a38
         # 1.1.0 => 94e0aab03ca135d11a35e5bfc14e6746dc56e7e9
-        env:
-          # keep in sync with tests/shellcheck-exclude
-          SHELLCHECK_OPTS: -e SC1001 -e SC1003 -e SC1090 -e SC1091 -e SC1117 -e SC2029 -e SC2030 -e SC2031 -e SC2034 -e SC2046 -e SC2064 -e SC2068 -e SC2086 -e SC2119 -e SC2120 -e SC2128 -e SC2148 -e SC2153 -e SC2154 -e SC2155 -e SC2162 -e SC2174 -e SC2179 -e SC2191 -e SC2199 -e SC2207 -e SC2219 -e SC2220 -e SC2230 -e SC2231 -e SC2235 -e SC2267 -e SC2295
 
   shfmt:
     name: shfmt
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-24.04
     steps:
       - name: Clone
-        uses: actions/checkout@v3
+        uses: actions/checkout@v7
       - name: Run shfmt
-        uses: luizm/action-sh-checker@38985be9e872ef709f8ffca07af3ff88572fe429
-        # v0.3.0 => 7f44869033b40ee4ffe7dc76c87a1bc66e3d025a
+        uses: luizm/action-sh-checker@883217215b11c1fabbf00eb1a9a041f62d74c744
+        # v0.5.0 => edd0e45ecff35b05f162052b50df50976c1b74fc
         env:
           SHFMT_OPTS: -l -bn -ci -i 2 -d
         with:
@@ -63,12 +88,12 @@ jobs:
 
   yamllint:
     name: yamllint
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-24.04
     steps:
       - name: Clone
-        uses: actions/checkout@v3
+        uses: actions/checkout@v7
       - name: Run yamllint
-        uses: ibiqlik/action-yamllint@81e214fd484713882ce4237cb7cd264d550856cf
-        # v3.0.4 => ed2b6e911569708ed121c14b87d513860a7e36a7
+        uses: ibiqlik/action-yamllint@2576378a8e339169678f9939646ee3ee325e845c
+        # v3.1.1 => 2576378a8e339169678f9939646ee3ee325e845c
         with:
           config_file: '.github/linters/.yamllint.yml'

.github/workflows/release.yml

@@ -1,44 +1,50 @@
 ---
-name: 'release'
+name: "release"
 
 # yamllint disable-line rule:truthy
 on:
   workflow_dispatch:
     inputs:
       release_type:
-        description: 'Release type [build, betafish, patch, minor, major]'
+        description: "Release type"
+        default: "patch"
         required: true
-        default: 'build'
-
+        type: choice
+        options:
+          - patch
+          - minor
+          - major
+          - build
+          - betafish
 jobs:
   release:
     name: release
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-24.04
     env:
       PACKAGECLOUD_TOKEN: ${{ secrets.PACKAGECLOUD_TOKEN }}
     outputs:
       version: ${{ steps.version.outputs.version }}
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
       - uses: ruby/setup-ruby@v1
         with:
-          ruby-version: 2.6
+          ruby-version: 2.7
 
       - name: login to docker hub
-        uses: docker/login-action@v2
+        uses: docker/login-action@v4
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: set up qemu
-        uses: docker/setup-qemu-action@v2
+        uses: docker/setup-qemu-action@v4
 
       - name: set up docker buildx
         id: buildx
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@v4
 
       - name: inspect builder
         run: |
@@ -57,25 +63,64 @@ jobs:
           git config --global user.email no-reply@dokku.com
 
       - name: build package
+        env:
+          RELEASE_GITHUB_USERNAME: ${{ secrets.HOMEBREW_GITHUB_USERNAME }}
+          RELEASE_GITHUB_API_TOKEN: ${{ secrets.HOMEBREW_GITHUB_API_TOKEN }}
         run: contrib/release-dokku ${{ github.event.inputs.release_type }}
 
       - name: output version
         id: version
-        run: echo "::set-output name=version::$(cat build/next-version)"
+        run: echo "version=$(cat build/next-version)" >> $GITHUB_OUTPUT
 
       - name: upload packages
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v7
         with:
           name: build
           path: build
 
-  bump-azure:
-    name: bump-azure
-    runs-on: ubuntu-20.04
+  build-digitalocean:
+    name: build-digitalocean
+    runs-on: ubuntu-24.04
     needs: release
     steps:
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v7
+
+      - name: Setup packer
+        uses: hashicorp/setup-packer@main
+        with:
+          version: latest
+
+      - name: Run packer init
+        run: "make image/init/digitalocean"
+
+      - name: Run `packer validate`
+        env:
+          DIGITALOCEAN_TOKEN: ${{ secrets.DIGITALOCEAN_TOKEN }}
+        run: |
+          VERSION=${{ needs.release.outputs.version }}
+          PKR_VAR_dokku_version="${VERSION:1}" make image/validate/digitalocean
+
+      - name: Bump Digitalocean Image
+        env:
+          DIGITALOCEAN_TOKEN: ${{ secrets.DIGITALOCEAN_TOKEN }}
+        run: |
+          VERSION=${{ needs.release.outputs.version }}
+          PKR_VAR_dokku_version="${VERSION:1}" make image/build/digitalocean
+
+      - name: upload packages
+        uses: actions/upload-artifact@v7
+        with:
+          name: digitalocean-manifest.json
+          path: digitalocean-manifest.json
+
+  bump-azure:
+    name: bump-azure
+    runs-on: ubuntu-24.04
+    needs: release
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
       - name: Bump Azure Template
         env:
           BOT_GITHUB_USERNAME: ${{ secrets.HOMEBREW_GITHUB_USERNAME }}
@@ -91,6 +136,31 @@ jobs:
     runs-on: macos-latest
     needs: release
     steps:
+      - name: Brew doctor
+        run: |
+          brew doctor || true
+      - name: Brew cleanup
+        run: |
+          echo "====> Running brew cleanup"
+          brew cleanup || true
+          echo "====> Untapping homebrew/core"
+          brew untap homebrew/core || true
+          echo "====> Untapping homebrew/cask"
+          brew untap homebrew/cask || true
+          echo "====> Untapping aws/tap"
+          brew untap aws/tap || true
+          echo "====> Untapping hashicorp/tap"
+          brew untap hashicorp/tap || true
+          echo "====> Uninstalling openssl@1.1"
+          brew uninstall openssl@1.1 || true
+          echo "====> Uninstalling ruby@3.0"
+          brew uninstall ruby@3.0 || true
+          echo "====> Running brew cleanup"
+          brew cleanup || true
+      - name: Brew doctor
+        run: brew doctor || true
+      - name: Brew config
+        run: brew config
       - name: Bump Homebrew Formula
         env:
           HOMEBREW_GITHUB_USERNAME: ${{ secrets.HOMEBREW_GITHUB_USERNAME }}

.gitignore

@@ -11,3 +11,6 @@ test-results/
 stack.tgz
 tmp
 coverage.out
+site
+go.work.sum
+node_modules

.golangci-lint.yml

@@ -0,0 +1,24 @@
+---
+run:
+  timeout: 5m
+
+linters:
+  disable-all: true
+
+  enable:
+    - errcheck
+    - goconst
+    - gocyclo
+    - gofumpt
+    - gosec
+    - gosimple
+    - govet
+    - ineffassign
+    - misspell
+    - revive
+    - staticcheck
+    - typecheck
+    - unconvert
+    - unparam
+    - unused
+    - whitespace

.prettierignore

@@ -0,0 +1 @@
+*.md

.shellcheckrc

@@ -1,9 +1,33 @@
+# SC1001 - This \/ will be a regular '/' in this context - https://github.com/koalaman/shellcheck/wiki/SC1001
+# SC1003 - Want to escape a single quote? echo 'This is how it'\''s done' - https://github.com/koalaman/shellcheck/wiki/SC1003
+# SC1090 - Can't follow non-constant source. Use a directive to specify location - https://github.com/koalaman/shellcheck/wiki/SC1090
 # SC1091 - Not following: FILE: does not exist (No such file or directory) - https://github.com/koalaman/shellcheck/wiki/SC1091
-#        - used for sourcing function files throughout the codebase
+# SC1117 - Backslash is literal in "\n". Prefer explicit escaping: "\\n" - https://github.com/koalaman/shellcheck/wiki/SC1117
+# SC2029 - Note that, unescaped, this expands on the client side - https://github.com/koalaman/shellcheck/wiki/SC2029
+# SC2030 - Modification of var is local (to subshell caused by pipeline). - https://github.com/koalaman/shellcheck/wiki/SC2030
+# SC2031 - var was modified in a subshell. That change might be lost. - https://github.com/koalaman/shellcheck/wiki/SC2031
 # SC2034 - VAR appears unused - https://github.com/koalaman/shellcheck/wiki/SC2034
-#        - used for declaring desc and deprecated function variables
+# SC2046 - Quote this to prevent word splitting - https://github.com/koalaman/shellcheck/wiki/SC2046
 # SC2064 - Use single quotes, otherwise this expands now rather than when signalled. - https://github.com/koalaman/shellcheck/wiki/SC2064
-#        - used for traps
+# SC2068 - Double quote array expansions to avoid re-splitting elements - https://github.com/koalaman/shellcheck/wiki/SC2068
+# SC2086 - Double quote to prevent globbing and word splitting - https://github.com/koalaman/shellcheck/wiki/SC2086
+# SC2119 - Use 'function "$@"' if function's $1 should mean script's $1 - https://github.com/koalaman/shellcheck/wiki/SC2119
+# SC2120 - Function references arguments, but none are ever passed - https://github.com/koalaman/shellcheck/wiki/SC2120
+# SC2128 - Expanding an array without an index only gives the first element - https://github.com/koalaman/shellcheck/wiki/SC2128
+# SC2148 - Tips depend on target shell and yours is unknown. Add a shebang - https://github.com/koalaman/shellcheck/wiki/SC2148
+# SC2153 - Possible misspelling: DOKKU_ROOT may not be assigned, but DOKKU_PORT is - https://github.com/koalaman/shellcheck/wiki/SC2153
+# SC2154 - Var is referenced but not assigned - https://github.com/koalaman/shellcheck/wiki/SC2154
 # SC2155 - Declare and assign separately to avoid masking return values - https://github.com/koalaman/shellcheck/wiki/SC2155
-#        - used throughout the codebase
-disable=SC1091,SC2034,SC2064,SC2155
+# SC2162 - read without -r will mangle backslashes - https://github.com/koalaman/shellcheck/wiki/SC2162
+# SC2174 - When used with -p, -m only applies to the deepest directory - https://github.com/koalaman/shellcheck/wiki/SC2174
+# SC2179 - Use array+=("item") to append items to an array - https://github.com/koalaman/shellcheck/wiki/SC2179
+# SC2191 - The = here is literal. To assign by index, use ( [index]=value ) with no spaces. To keep as literal, quote it - https://github.com/koalaman/shellcheck/wiki/SC2191
+# SC2199 - Arrays implicitly concatenate in [[ ]]. Use a loop (or explicit * instead of @) - https://github.com/koalaman/shellcheck/wiki/SC2199
+# SC2207 - Prefer mapfile or read -a to split command output (or quote to avoid splitting) - https://github.com/koalaman/shellcheck/wiki/SC2207
+# SC2219 - Instead of 'let expr', prefer (( expr ))  - https://github.com/koalaman/shellcheck/wiki/SC2219
+# SC2220 - Invalid flags are not handled. Add a *) case - https://github.com/koalaman/shellcheck/wiki/SC2220
+# SC2231 - Quote expansions in this for loop glob to prevent wordsplitting, e.g. "$dir"/*.txt  - https://github.com/koalaman/shellcheck/wiki/SC2231
+# SC2235 - Use { ..; } instead of (..) to avoid subshell overhead - https://github.com/koalaman/shellcheck/wiki/SC2235
+# SC2267 - GNU xargs -i is deprecated in favor of -I{} - https://github.com/koalaman/shellcheck/wiki/SC2267
+# SC2295 - Expansions inside ${..} need to be quoted separately, otherwise they match as patterns - https://github.com/koalaman/shellcheck/wiki/SC2295
+disable=SC1001,SC1003,SC1090,SC1091,SC1117,SC2029,SC2030,SC2031,SC2034,SC2046,SC2064,SC2068,SC2086,SC2119,SC2120,SC2128,SC2148,SC2153,SC2154,SC2155,SC2162,SC2174,SC2179,SC2191,SC2199,SC2207,SC2219,SC2220,SC2231,SC2235,SC2267,SC2295

.stickler.yml

@@ -1,13 +0,0 @@
----
-linters:
-  shellcheck:
-    shell: bash
-    exclude: SC2034,SC1090,SC2191
-  golint:
-
-files:
-  ignore:
-    - 'debian/*'
-    - 'docs/*'
-    - 'tests/*'
-    - '*/vendor/*'

.well-known/funding-manifest-urls

@@ -0,0 +1 @@
+https://dokku.com/funding.json

CONTRIBUTING.md

@@ -19,11 +19,11 @@ a chance of keeping on top of things.
 - [Reporting Security Issues](#reporting-security-issues)
 - [Reporting Issues](#reporting-other-issues)
 - [Contributing](#contributing)
-  - [Making Changes](#making-changes)
-  - [Which branch to base the work](#which-branch-to-base-the-work)
-  - [Submitting Changes](#submitting-changes)
-  - [When will my change be merged?](#when-will-my-change-be-merged)
-  - [Running tests locally](#running-tests-locally)
+    - [Making Changes](#making-changes)
+    - [Which branch to base the work](#which-branch-to-base-the-work)
+    - [Submitting Changes](#submitting-changes)
+    - [When will my change be merged?](#when-will-my-change-be-merged)
+    - [Running tests locally](#running-tests-locally)
 - [Additional Resources](#additional-resources)
 
 ## Reporting security issues
@@ -65,24 +65,24 @@ need to do
 
 - Make sure you have a [GitHub account](https://github.com/signup/free).
 - Submit an [issue](https://github.com/dokku/dokku/issues), assuming one does not already exist.
-  - Clearly describe the issue including steps to reproduce when it is a bug.
-  - Make sure you fill in the earliest version that you know has the issue.
+    - Clearly describe the issue including steps to reproduce when it is a bug.
+    - Make sure you fill in the earliest version that you know has the issue.
 - Fork the repository on GitHub.
 
 ### Making Changes
 
 - Create a topic branch from where you want to base your work.
-  - This is usually the master branch.
-  - Only target an existing branch if you are certain your fix must be on that
-    branch.
-  - To quickly create a topic branch based on master; `git checkout -b my_contribution origin/master`.
-    It is best to avoid working directly on the `master` branch. Doing so will
+    - This is usually the master branch.
+    - Only target an existing branch if you are certain your fix must be on that
+      branch.
+    - To quickly create a topic branch based on master; `git checkout -b my_contribution origin/master`.
+      It is best to avoid working directly on the `master` branch. Doing so will
     help avoid conflicts if you pull in updates from origin.
 - Make commits of logical units. Implementing a new function and calling it in
   another file constitute a single logical unit of work.
-  - Before you make a pull request, squash your commits into logical units of work
-    using `git rebase -i` and `git push -f`.
-  - A majority of submissions should have a single commit, so if in doubt,
+    - Before you make a pull request, squash your commits into logical units of work
+      using `git rebase -i` and `git push -f`.
+    - A majority of submissions should have a single commit, so if in doubt,
     squash your commits down to one commit.
 - Check for unnecessary whitespace with `git diff --check` before committing.
 - Use descriptive commit messages and reference the #issue number.
@@ -92,12 +92,12 @@ need to do
 - Your work should apply the [Dokku coding standards](https://github.com/progrium/bashstyle)
 - Pull requests must be cleanly rebased on top of master without multiple branches
   mixed into the PR.
-  - **Git tip**: If your PR no longer merges cleanly, use `rebase master` in your
+    - **Git tip**: If your PR no longer merges cleanly, use `rebase master` in your
     feature branch to update your pull request rather than `merge master`.
 
 ### Which branch to base the work
 
-All changes should be be based on the latest master commit.
+All changes should be based on the latest master commit.
 
 ### Submitting Changes
 
@@ -135,4 +135,4 @@ which contains test setup information as well as tips for running tests.
 - [Existing issues](https://github.com/dokku/dokku/issues)
 - [General GitHub documentation](https://help.github.com/)
 - [GitHub pull request documentation](https://help.github.com/send-pull-requests/)
-- [Gliderlabs Slack in the #dokku channel](https://glider-slackin.herokuapp.com/)
+- [Gliderlabs Slack in the #dokku channel](https://slack.dokku.com/)

Dockerfile

@@ -1,4 +1,4 @@
-FROM phusion/baseimage:focal-1.2.0
+FROM phusion/baseimage:noble-1.0.3
 
 CMD ["/sbin/my_init"]
 
@@ -15,20 +15,44 @@ RUN addgroup --gid $DOKKU_GID dokku \
 
 COPY ./tests/dhparam.pem /tmp/dhparam.pem
 COPY ./build/package/ /tmp
+COPY ./contrib/dependencies.json /tmp/dependencies.json
+
+ENV DOKKU_INIT_SYSTEM=sv
 
 SHELL ["/bin/bash", "-o", "pipefail", "-c"]
 # hadolint ignore=DL3005,DL3008
-RUN echo "dokku dokku/hostname string $DOKKU_HOSTNAME" | debconf-set-selections \
+RUN mkdir -p /etc/apt/keyrings \
+  && mkdir -p /etc/apt/keyrings \
+  && apt-get remove -y systemd && apt-get autoremove -y && apt-get update && apt-get -y --no-install-recommends install gpg jq lsb-release openssl openssh-server rsync software-properties-common \
+  && curl -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg \
+  && echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" | tee /etc/apt/sources.list.d/docker.list > /dev/null \
+  && apt-get update \
+  && apt-get -y --no-install-recommends install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin \
+  && PACK_URL="$(jq -r --arg arch "$(dpkg --print-architecture)" '.dependencies[] | select(.name == "pack") | .urls[$arch]' /tmp/dependencies.json)" \
+  && curl -fsSL "$PACK_URL" | tar -C /usr/bin/ --no-same-owner -xzf - pack \
+  && chmod +x /usr/bin/pack \
+  && test -x /usr/bin/pack \
+  && curl -o /tmp/nixpacks.bash -sSL https://nixpacks.com/install.sh \
+  && chmod +x /tmp/nixpacks.bash \
+  && NIXPACKS_BIN_DIR=/usr/bin BIN_DIR=/usr/bin /tmp/nixpacks.bash \
+  && test -x /usr/bin/nixpacks \
+  && rm -rf /tmp/nixpacks.bash \
+  && curl -o /tmp/railpack.bash -sSL https://railpack.com/install.sh \
+  && chmod +x /tmp/railpack.bash \
+  && RAILPACK_BIN_DIR=/usr/bin BIN_DIR=/usr/bin /tmp/railpack.bash \
+  && test -x /usr/bin/railpack \
+  && rm -rf /tmp/railpack.bash \
+  && echo "dokku dokku/hostname string $DOKKU_HOSTNAME" | debconf-set-selections \
   && echo "dokku dokku/skip_key_file boolean $DOKKU_SKIP_KEY_FILE" | debconf-set-selections \
   && echo "dokku dokku/vhost_enable boolean $DOKKU_VHOST_ENABLE" | debconf-set-selections \
+  && echo "dokku dokku/install_default_site boolean true" | debconf-set-selections \
   && curl -sSL https://packagecloud.io/dokku/dokku/gpgkey | apt-key add - \
-  && echo "deb https://packagecloud.io/dokku/dokku/ubuntu/ focal main" | tee /etc/apt/sources.list.d/dokku.list \
+  && echo "deb https://packagecloud.io/dokku/dokku/ubuntu/ noble main" | tee /etc/apt/sources.list.d/dokku.list \
   && mkdir -p /etc/nginx/ \
   && cp /tmp/dhparam.pem /etc/nginx/dhparam.pem \
   && apt-get update \
   && apt-get upgrade -y \
-  && apt-get -y --no-install-recommends --only-upgrade install openssl openssh-server \
-  && apt-get -y --no-install-recommends install rsync "/tmp/dokku-$(dpkg --print-architecture).deb" \
+  && apt-get -y --no-install-recommends install lambda-builder "/tmp/dokku-$(dpkg --print-architecture).deb" \
   && apt-get purge -y syslog-ng-core \
   && apt-get autoremove -y \
   && apt-get clean && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
@@ -39,6 +63,7 @@ COPY ./docker .
 
 RUN \
   rsync -a /tmp/ / \
+  && chmod +x /usr/local/bin/* \
   && rm -rf /tmp/* \
   && rm /etc/runit/runsvdir/default/sshd/down \
   && chown -R dokku:dokku /home/dokku/ \
@@ -51,8 +76,12 @@ RUN \
   && ln -sf /mnt/dokku/home/dokku /home/dokku \
   && ln -sf /mnt/dokku/var/lib/dokku/config /var/lib/dokku/config \
   && ln -sf /mnt/dokku/var/lib/dokku/data /var/lib/dokku/data \
+  && ln -sf /mnt/dokku/var/lib/dokku/services /var/lib/dokku/services \
   && mv /etc/my_init.d/00_regen_ssh_host_keys.sh /etc/my_init.d/15_regen_ssh_host_keys \
   && rm -f /etc/nginx/sites-enabled/default /usr/share/nginx/html/index.html /etc/my_init.d/10_syslog-ng.init \
   && rm -f /usr/local/openresty/nginx/conf/sites-enabled/default /usr/share/openresty/html/index.html \
   && sed -i '/imklog/d' /etc/rsyslog.conf \
   && rm -f /var/log/btmp /var/log/wtmp /var/log/*log /var/log/apt/* /var/log/dokku/*.log /var/log/nginx/* /var/log/openresty/*
+
+HEALTHCHECK --interval=30s --timeout=10s --start-period=5m --retries=3 \
+  CMD curl -fsS http://127.0.0.1:18080/_dokku/health || exit 1

ISSUE_TEMPLATE.md

@@ -31,7 +31,7 @@
 > For problems affecting all applications, the report output for a broken application is useful for our debugging.
 > In these cases, you may run `dokku report` without any arguments to display the top-level reporting information.
 
-### How (deb/make/rpm) and where (AWS, VirtualBox, physical, etc.) was Dokku installed?
+### How (deb/make) and where (AWS, VirtualBox, physical, etc.) was Dokku installed?
 
 ### Additional information
 
@@ -39,10 +39,10 @@
 - The nginx configuration (if applicable) via `dokku nginx:show-config APP_NAME`
 - Link to the exact repository being deployed (if possible/applicable):
 - If a deploy is failing or behaving unexpectedly:
-  - Application name
-  - The type of application being deployed (node, php, python, ruby, etc.)
-  - If using buildpacks, which custom buildpacks are in use
-  - If using a `Dockerfile`, the contents of that file
-  - If it exists, the contents of your `Procfile`.
+    - Application name
+    - The type of application being deployed (node, php, python, ruby, etc.)
+    - If using buildpacks, which custom buildpacks are in use
+    - If using a `Dockerfile`, the contents of that file
+    - If it exists, the contents of your `Procfile`.
 - Output of failing Dokku commands after running `dokku trace:on`
   (BEWARE: `trace:on` will print environment variables for some commands, be sure you're not exposing any sensitive information when posting issues. You may replace these values with XXXXXX):

Makefile

@@ -1,20 +1,17 @@
 DOKKU_VERSION ?= master
 
-DOCKER_IMAGE_LABELER_VERSION ?= 0.4.1
-HEROKUISH_VERSION ?= 0.5.34
-NETRC_VERSION ?= 0.5.1
-PLUGN_VERSION ?= 0.8.2
-PROCFILE_VERSION ?= 0.14.1
-SIGIL_VERSION ?= 0.8.1
-SSHCOMMAND_VERSION ?= 0.15.0
-DOCKER_IMAGE_LABELER_URL ?= https://github.com/dokku/docker-image-labeler/releases/download/v${DOCKER_IMAGE_LABELER_VERSION}/docker-image-labeler_${DOCKER_IMAGE_LABELER_VERSION}_linux_amd64.tgz
-NETRC_URL ?= https://github.com/dokku/netrc/releases/download/v${NETRC_VERSION}/netrc_${NETRC_VERSION}_linux_amd64.tgz
-PLUGN_URL ?= https://github.com/dokku/plugn/releases/download/v${PLUGN_VERSION}/plugn_${PLUGN_VERSION}_linux_amd64.tgz
-PROCFILE_UTIL_URL ?= https://github.com/josegonzalez/go-procfile-util/releases/download/v${PROCFILE_VERSION}/procfile-util_${PROCFILE_VERSION}_linux_amd64.tgz
-SIGIL_URL ?= https://github.com/gliderlabs/sigil/releases/download/v${SIGIL_VERSION}/gliderlabs-sigil_${SIGIL_VERSION}_linux_amd64.tgz
-SSHCOMMAND_URL ?= https://github.com/dokku/sshcommand/releases/download/v${SSHCOMMAND_VERSION}/sshcommand_${SSHCOMMAND_VERSION}_linux_x86_64.tgz
+TARGETARCH ?= amd64
+
+DOCKER_IMAGE_LABELER_URL ?= $(shell jq -r --arg name docker-image-labeler --arg arch $(TARGETARCH) '.dependencies[] | select(.name == $$name) | .urls[$$arch]' contrib/dependencies.json)
+DOCKER_CONTAINER_HEALTHCHECKER_URL ?= $(shell jq -r --arg name docker-container-healthchecker  --arg arch $(TARGETARCH) '.dependencies[] | select(.name == $$name) | .urls[$$arch]' contrib/dependencies.json)
+LAMBDA_BUILDER_URL ?= $(shell jq -r --arg name lambda-builder  --arg arch $(TARGETARCH) '.dependencies[] | select(.name == $$name) | .urls[$$arch]' contrib/dependencies.json)
+NETRC_URL ?= $(shell jq -r --arg name netrc  --arg arch $(TARGETARCH) '.dependencies[] | select(.name == $$name) | .urls[$$arch]' contrib/dependencies.json)
+PLUGN_URL ?= $(shell jq -r --arg name plugn  --arg arch $(TARGETARCH) '.predependencies[] | select(.name == $$name) | .urls[$$arch]' contrib/dependencies.json)
+PROCFILE_UTIL_URL ?= $(shell jq -r --arg name procfile-util  --arg arch $(TARGETARCH) '.dependencies[] | select(.name == $$name) | .urls[$$arch]' contrib/dependencies.json)
+SIGIL_URL ?= $(shell jq -r --arg name gliderlabs-sigil  --arg arch $(TARGETARCH) '.predependencies[] | select(.name == $$name) | .urls[$$arch]' contrib/dependencies.json)
+SSHCOMMAND_URL ?= $(shell jq -r --arg name sshcommand  --arg arch $(TARGETARCH) '.dependencies[] | select(.name == $$name) | .urls[$$arch]' contrib/dependencies.json)
 STACK_URL ?= https://github.com/gliderlabs/herokuish.git
-PREBUILT_STACK_URL ?= gliderlabs/herokuish:latest-20
+PREBUILT_STACK_URL ?= gliderlabs/herokuish:latest-24
 DOKKU_LIB_ROOT ?= /var/lib/dokku
 PLUGINS_PATH ?= ${DOKKU_LIB_ROOT}/plugins
 CORE_PLUGINS_PATH ?= ${DOKKU_LIB_ROOT}/core-plugins
@@ -36,12 +33,12 @@ endif
 
 include common.mk
 
-.PHONY: all apt-update install version copyfiles copyplugin man-db plugins dependencies docker-image-labeler netrc sshcommand procfile-util plugn docker aufs stack count vagrant-acl-add vagrant-dokku go-build
+.PHONY: all apt-update install version copyfiles copyplugin man-db plugins dependencies docker-image-labeler lambda-builder netrc sshcommand procfile-util plugn docker aufs stack count vagrant-acl-add vagrant-dokku go-build
 
+include docs.mk
 include tests.mk
 include package.mk
 include deb.mk
-include rpm.mk
 include arch.mk
 
 all:
@@ -57,7 +54,7 @@ go-build:
 	basedir=$(PWD); \
 	for dir in plugins/*; do \
 		if [ -e $$dir/Makefile ]; then \
-			$(MAKE) -e -C $$dir $(PLUGIN_MAKE_TARGET) || exit $$? ;\
+			GO_ARGS='$(GO_ARGS)' CGO_ENABLED=0 GOOS=linux GOARCH=$(GOARCH) GOWORK=off $(MAKE) -e -C $$dir $(PLUGIN_MAKE_TARGET) || exit $$? ;\
 		fi ;\
 	done
 
@@ -67,7 +64,7 @@ ifndef PLUGIN_NAME
 	$(error PLUGIN_NAME not specified)
 endif
 	if [ -e plugins/$(PLUGIN_NAME)/Makefile ]; then \
-		$(MAKE) -e -C plugins/$(PLUGIN_NAME) $(PLUGIN_MAKE_TARGET) || exit $$? ;\
+		GO_ARGS='$(GO_ARGS)' CGO_ENABLED=0 GOOS=linux GOARCH=$(GOARCH) GOWORK=off $(MAKE) -e -C plugins/$(PLUGIN_NAME) $(PLUGIN_MAKE_TARGET) || exit $$? ;\
 	fi
 
 go-clean:
@@ -78,9 +75,12 @@ go-clean:
 		fi ;\
 	done
 
-copyfiles:
-	$(MAKE) go-build || exit 1
+copydokku:
 	cp dokku /usr/local/bin/dokku
+	chmod 0755 /usr/local/bin/dokku
+
+copyfiles: copydokku
+	$(MAKE) go-build || exit 1
 	mkdir -p ${CORE_PLUGINS_PATH} ${PLUGINS_PATH}
 	rm -rf ${CORE_PLUGINS_PATH}/*
 	test -d ${CORE_PLUGINS_PATH}/enabled || PLUGIN_PATH=${CORE_PLUGINS_PATH} plugn init
@@ -131,7 +131,7 @@ plugin-dependencies: plugn procfile-util
 plugins: plugn procfile-util docker
 	sudo -E dokku plugin:install --core
 
-dependencies: apt-update docker-image-labeler netrc sshcommand plugn procfile-util docker help2man man-db sigil dos2unix jq parallel
+dependencies: apt-update jq docker-image-labeler docker-container-healthchecker lambda-builder netrc sshcommand plugn procfile-util docker help2man man-db sigil dos2unix parallel
 	$(MAKE) -e stack
 
 apt-update:
@@ -153,33 +153,36 @@ man-db:
 	apt-get -qq -y --no-install-recommends install man-db
 
 docker-image-labeler:
-	wget -qO /tmp/docker-image-labeler_latest.tgz ${DOCKER_IMAGE_LABELER_URL}
-	tar xzf /tmp/docker-image-labeler_latest.tgz -C /usr/local/bin
-	mv /usr/local/bin/docker-image-labeler-amd64 /usr/local/bin/docker-image-labeler
+	wget -qO /usr/local/bin/docker-image-labeler ${DOCKER_IMAGE_LABELER_URL}
+	chmod +x /usr/local/bin/docker-image-labeler
+
+docker-container-healthchecker:
+	wget -qO /usr/local/bin/docker-container-healthchecker ${DOCKER_CONTAINER_HEALTHCHECKER_URL}
+	chmod +x /usr/local/bin/docker-container-healthchecker
+
+lambda-builder:
+	wget -qO /usr/local/bin/lambda-builder ${LAMBDA_BUILDER_URL}
+	chmod +x /usr/local/bin/lambda-builder
 
 netrc:
-	wget -qO /tmp/netrc_latest.tgz ${NETRC_URL}
-	tar xzf /tmp/netrc_latest.tgz -C /usr/local/bin
-	mv /usr/local/bin/netrc-amd64 /usr/local/bin/netrc
+	wget -qO /usr/local/bin/netrc ${NETRC_URL}
+	chmod +x /usr/local/bin/netrc
 
 procfile-util:
-	wget -qO /tmp/procfile-util_latest.tgz ${PROCFILE_UTIL_URL}
-	tar xzf /tmp/procfile-util_latest.tgz -C /usr/local/bin
-	mv /usr/local/bin/procfile-util-amd64 /usr/local/bin/procfile-util
+	wget -qO /usr/local/bin/procfile-util ${PROCFILE_UTIL_URL}
+	chmod +x /usr/local/bin/procfile-util
 
 plugn:
-	wget -qO /tmp/plugn_latest.tgz ${PLUGN_URL}
-	tar xzf /tmp/plugn_latest.tgz -C /usr/local/bin
-	mv /usr/local/bin/plugn-amd64 /usr/local/bin/plugn
+	wget -qO /usr/local/bin/plugn ${PLUGN_URL}
+	chmod +x /usr/local/bin/plugn
 
 sigil:
-	wget -qO /tmp/sigil_latest.tgz ${SIGIL_URL}
-	tar xzf /tmp/sigil_latest.tgz -C /usr/local/bin
-	mv /usr/local/bin/gliderlabs-sigil-amd64 /usr/local/bin/sigil
+	wget -qO /usr/local/bin/sigil ${SIGIL_URL}
+	chmod +x /usr/local/bin/sigil
 
 sshcommand:
-	wget -qO /tmp/sshcommand_latest.tgz ${SSHCOMMAND_URL}
-	tar xzf /tmp/sshcommand_latest.tgz -C /usr/local/bin
+	wget -qO /usr/local/bin/sshcommand ${SSHCOMMAND_URL}
+	chmod +x /usr/local/bin/sshcommand
 	sshcommand create dokku /usr/local/bin/dokku
 
 docker:
@@ -223,3 +226,8 @@ vagrant-acl-add:
 
 vagrant-dokku:
 	vagrant ssh -- "sudo -H -u root bash -c 'dokku $(RUN_ARGS)'"
+
+IMAGE_TAG ?= dokku/dokku:latest
+
+test-image-healthcheck:
+	IMAGE_TAG=$(IMAGE_TAG) ./tests/image/healthcheck.sh

README.md

@@ -1,9 +1,9 @@
 # Dokku
 
-[![Build Status](https://github.com/dokku/dokku/workflows/CI/badge.svg)](https://github.com/dokku/dokku/actions?query=workflow%3ACI)
+[![Build Status](https://github.com/dokku/dokku/actions/workflows/ci.yml/badge.svg?branch=master)](https://github.com/dokku/dokku/actions?query=branch%3Amaster)
 [![Ubuntu Package](https://img.shields.io/badge/package-ubuntu-brightgreen.svg?style=flat-square "Ubuntu Package")](https://packagecloud.io/dokku/dokku)
 [![Arch Package](https://img.shields.io/badge/package-arch-brightgreen.svg?style=flat-square "Arch Package")](https://aur.archlinux.org/packages/dokku/)
-[![Slack Group](https://img.shields.io/badge/irc-slack-blue.svg?style=flat-square "Slack Group")](https://glider-slackin.herokuapp.com/)
+[![Slack Group](https://img.shields.io/badge/irc-slack-blue.svg?style=flat-square "Slack Group")](https://slack.dokku.com/)
 [![Documentation](https://img.shields.io/badge/docs-site-blue.svg?style=flat-square "Site")](https://dokku.com/docs/getting-started/installation/)
 [![OpenCollective](https://opencollective.com/dokku/sponsors/badge.svg?style=flat-square)](#sponsors)
 [![OpenCollective](https://opencollective.com/dokku/backers/badge.svg?style=flat-square)](#backers)
@@ -74,10 +74,8 @@ Support us with a monthly donation and help us continue our activities. [[Become
 
 A fresh VM running any of the following operating systems:
 
-- Ubuntu 18.04/20.04 x64 - Any currently supported release
-- Debian 9+ x64
-- CentOS 7 x64 *(experimental)*
-- Arch Linux x64 *(experimental)*
+- Ubuntu 22.04 / 24.04 (amd64/arm64) - Any currently supported release
+- Debian 11+ (amd64/arm64)
 
 An SSH keypair that can be used for application deployment. If this exists before installation, it will be automatically imported into dokku.
 Otherwise, you will need to import the keypair manually after installation using `dokku ssh-keys:add`.
@@ -87,8 +85,8 @@ Otherwise, you will need to import the keypair manually after installation using
 To install the latest stable release, run the following commands as a user who has access to `sudo`:
 
 ```shell
-wget https://raw.githubusercontent.com/dokku/dokku/v0.27.6/bootstrap.sh
-sudo DOKKU_TAG=v0.27.6 bash bootstrap.sh
+wget -NP . https://dokku.com/install/v0.38.27/bootstrap.sh
+sudo DOKKU_TAG=v0.38.27 bash bootstrap.sh
 ```
 
 You can then proceed to configure your server domain (via `dokku domains:set-global`) and user access (via `dokku ssh-keys:add`) to complete the installation.
@@ -105,11 +103,11 @@ Full documentation - including advanced installation docs - are available online
 
 ## Support
 
-You can use [GitHub Issues](https://github.com/dokku/dokku/issues), check [Troubleshooting](https://dokku.com/docs/getting-started/troubleshooting/) in the documentation, or join us on [Gliderlabs Slack in the #dokku channel](https://glider-slackin.herokuapp.com/).
+You can use [GitHub Issues](https://github.com/dokku/dokku/issues), check [Troubleshooting](https://dokku.com/docs/getting-started/troubleshooting/) in the documentation, or join us on [Gliderlabs Slack in the #dokku channel](https://slack.dokku.com/).
 
 ## Contribution
 
-After checking [GitHub Issues](https://github.com/dokku/dokku/issues), the [Troubleshooting Guide](https://dokku.com/docs/getting-started/troubleshooting/) or having a chat with us on [Gliderlabs Slack in the #dokku channel](https://glider-slackin.herokuapp.com/), feel free to fork and create a Pull Request.
+After checking [GitHub Issues](https://github.com/dokku/dokku/issues), the [Troubleshooting Guide](https://dokku.com/docs/getting-started/troubleshooting/) or having a chat with us on [Gliderlabs Slack in the #dokku channel](https://slack.dokku.com/), feel free to fork and create a Pull Request.
 
 While we may not merge your PR as is, they serve to start conversations and improve the general Dokku experience for all users.
 

Vagrantfile

@@ -1,16 +1,15 @@
 # -*- mode: ruby -*-
 # vi: set ft=ruby :
 
-BOX_NAME = ENV["BOX_NAME"] || "bento/ubuntu-18.04"
+BOX_NAME = ENV["BOX_NAME"] || "bento/ubuntu-24.04"
 BOX_CPUS = ENV["BOX_CPUS"] || "1"
 BOX_MEMORY = ENV["BOX_MEMORY"] || "1024"
 DOKKU_DOMAIN = ENV["DOKKU_DOMAIN"] || "dokku.me"
 DOKKU_IP = ENV["DOKKU_IP"] || "10.0.0.2"
-FORWARDED_PORT = (ENV["FORWARDED_PORT"] || '8080').to_i
 PREBUILT_STACK_URL = File.exist?("#{File.dirname(__FILE__)}/stack.tgz") ? 'file:///root/dokku/stack.tgz' : nil
 PUBLIC_KEY_PATH = "#{Dir.home}/.ssh/id_rsa.pub"
 
-make_cmd = "DEBIAN_FRONTEND=noninteractive make -e install"
+make_cmd = "TARGETARCH=$(dpkg --print-architecture) DEBIAN_FRONTEND=noninteractive make -e install"
 if PREBUILT_STACK_URL
   make_cmd = "PREBUILT_STACK_URL='#{PREBUILT_STACK_URL}' #{make_cmd}"
 end
@@ -40,10 +39,11 @@ Vagrant::configure("2") do |config|
   end
 
   config.vm.define "empty", autostart: false
+  config.vm.synced_folder ".", "/vagrant", type: "nfs", nfs_version: 4, nfs_udp: false
+
 
   config.vm.define "dokku", primary: true do |vm|
-    vm.vm.synced_folder File.dirname(__FILE__), "/root/dokku"
-    vm.vm.network :forwarded_port, guest: 80, host: FORWARDED_PORT
+    vm.vm.synced_folder File.dirname(__FILE__), "/root/dokku", type: "nfs", nfs_version: 4, nfs_udp: false
     vm.vm.hostname = "#{DOKKU_DOMAIN}"
     vm.vm.network :private_network, ip: DOKKU_IP
 
@@ -55,7 +55,7 @@ Vagrant::configure("2") do |config|
       vb.customize ["modifyvm", :id, "--cableconnected1", "on"]
     end
 
-    vm.vm.provision :shell, :inline => "export DEBIAN_FRONTEND=noninteractive && apt-get update -qq >/dev/null && apt-get -qq -y --no-install-recommends install git build-essential >/dev/null && cd /root/dokku && #{make_cmd}"
+    vm.vm.provision :shell, :inline => "export DEBIAN_FRONTEND=noninteractive && apt-get update -qq >/dev/null && apt-get -qq -y --no-install-recommends install git build-essential jq nginx >/dev/null && cd /root/dokku && #{make_cmd}"
     vm.vm.provision :shell do |s|
       s.inline = <<-EOT
         echo '"\e[5~": history-search-backward' > /root/.inputrc
@@ -72,46 +72,33 @@ Vagrant::configure("2") do |config|
 
   # For windows users. Sharing folder from windows creates problem with sym links and so, sync the repo instead from GOS.
   config.vm.define "dokku-windows", autostart: false do |vm|
-    vm.vm.network :forwarded_port, guest: 80, host: FORWARDED_PORT
     vm.vm.hostname = "#{DOKKU_DOMAIN}"
     vm.vm.network :private_network, ip: DOKKU_IP
-    vm.vm.provision :shell, :inline => "export DEBIAN_FRONTEND=noninteractive && apt-get update -qq >/dev/null && apt-get -qq -y --no-install-recommends install git dos2unix >/dev/null"
+    vm.vm.provision :shell, :inline => "export DEBIAN_FRONTEND=noninteractive && apt-get update -qq >/dev/null && apt-get -qq -y --no-install-recommends install git dos2unix nginx >/dev/null"
     vm.vm.provision :shell, :inline => "cd /vagrant/ && export DOKKU_BRANCH=`git symbolic-ref -q --short HEAD 2>/dev/null` && export DOKKU_TAG=`git describe --tags --exact-match 2>/dev/null` && cd /root/ && cp /vagrant/bootstrap.sh ./ && dos2unix bootstrap.sh && bash bootstrap.sh"
   end
 
   config.vm.define "dokku-deb", autostart: false do |vm|
-    vm.vm.synced_folder File.dirname(__FILE__), "/root/dokku"
-    vm.vm.network :forwarded_port, guest: 80, host: FORWARDED_PORT
+    vm.vm.synced_folder File.dirname(__FILE__), "/root/dokku", type: "nfs", nfs_version: 4, nfs_udp: false
     vm.vm.hostname = "#{DOKKU_DOMAIN}"
     vm.vm.network :private_network, ip: DOKKU_IP
     vm.vm.provision :shell, :inline => "cd /root/dokku && make install-from-deb"
   end
 
-  config.vm.define "dokku-rpm", autostart: false do |vm|
-    vm.vm.box = "centos/7"
-    vm.vm.synced_folder File.dirname(__FILE__), "/root/dokku"
-    vm.vm.network :forwarded_port, guest: 80, host: FORWARDED_PORT
-    vm.vm.hostname = "#{DOKKU_DOMAIN}"
-    vm.vm.network :private_network, ip: DOKKU_IP
-    vm.vm.provision :shell, :inline => "cd /root/dokku && bash bootstrap.sh"
-  end
-
   config.vm.define "build", autostart: false do |vm|
-    vm.vm.synced_folder File.dirname(__FILE__), "/root/dokku"
-    vm.vm.network :forwarded_port, guest: 80, host: FORWARDED_PORT
+    vm.vm.synced_folder File.dirname(__FILE__), "/root/dokku", type: "nfs", nfs_version: 4, nfs_udp: false
     vm.vm.hostname = "#{DOKKU_DOMAIN}"
     vm.vm.network :private_network, ip: DOKKU_IP
     vm.vm.provision :shell, :inline => "export DEBIAN_FRONTEND=noninteractive && apt-get update -qq >/dev/null && apt-get -qq -y --no-install-recommends install git >/dev/null && cd /root/dokku && #{make_cmd}"
-    vm.vm.provision :shell, :inline => "export IS_RELEASE=true && cd /root/dokku && make deb-all rpm-all"
+    vm.vm.provision :shell, :inline => "export IS_RELEASE=true && cd /root/dokku && make deb-all"
   end
 
   config.vm.define "build-arch", autostart: false do |vm|
     vm.vm.box = "bugyt/archlinux"
-    vm.vm.synced_folder File.dirname(__FILE__), "/dokku"
+    vm.vm.synced_folder File.dirname(__FILE__), "/dokku", type: "nfs", nfs_version: 4, nfs_udp: false
     if Pathname.new("#{File.dirname(__FILE__)}/../dokku-arch").exist?
-      vm.vm.synced_folder "#{File.dirname(__FILE__)}/../dokku-arch", "/dokku-arch"
+      vm.vm.synced_folder "#{File.dirname(__FILE__)}/../dokku-arch", "/dokku-arch", type: "nfs", nfs_version: 4, nfs_udp: false
     end
-    vm.vm.network :forwarded_port, guest: 80, host: FORWARDED_PORT
     vm.vm.hostname = "#{DOKKU_DOMAIN}"
     vm.vm.network :private_network, ip: DOKKU_IP
     vm.vm.provision :shell, :inline => "cd /dokku && make arch-all", privileged: false

bootstrap.sh

@@ -3,7 +3,7 @@ set -eo pipefail
 [[ $TRACE ]] && set -x
 
 # A script to bootstrap dokku.
-# It expects to be run on Ubuntu 18.04/20.04, or CentOS 7 via 'sudo'
+# It expects to be run on Ubuntu 22.04/24.04 via 'sudo`
 # If installing a tag higher than 0.3.13, it may install dokku via a package (so long as the package is higher than 0.3.13)
 # It checks out the dokku source code from GitHub into ~/dokku and then runs 'make install' from dokku source.
 
@@ -12,7 +12,7 @@ set -eo pipefail
 # That's good because it prevents our output overlapping with wget's.
 # It also means that we can't run a partially downloaded script.
 
-SUPPORTED_VERSIONS="Debian [9, 10, 11], CentOS [7], Fedora (partial) [33, 34], Ubuntu [18.04, 20.04, 22.04]"
+SUPPORTED_VERSIONS="Debian [11, 12, 13], Ubuntu [22.04, 24.04]"
 
 log-fail() {
   declare desc="log fail formatter"
@@ -28,7 +28,7 @@ ensure-environment() {
     echo "Preparing to install $DOKKU_TAG from $DOKKU_REPO..."
   fi
 
-  hostname -f >/dev/null 2>&1 || {
+  hostname -f &>/dev/null || {
     log-fail "This installation script requires that you have a hostname set for the instance. Please set a hostname for 127.0.0.1 in your /etc/hosts"
   }
 
@@ -48,9 +48,15 @@ install-requirements() {
         apt-get update -qq >/dev/null
         apt-get -qq -y --no-install-recommends install gpg-agent
       fi
-      if ! dpkg -l | grep -q software-properties-common; then
+      if ! command -v lsb_release &>/dev/null; then
         apt-get update -qq >/dev/null
-        apt-get -qq -y --no-install-recommends install software-properties-common
+        apt-get -qq -y --no-install-recommends install lsb-release
+      fi
+      if [[ "$DOKKU_DISTRO_VERSION" -lt "13" ]]; then
+        if ! dpkg -l | grep -q software-properties-common; then
+          apt-get update -qq >/dev/null
+          apt-get -qq -y --no-install-recommends install software-properties-common
+        fi
       fi
       ;;
     ubuntu)
@@ -122,7 +128,22 @@ install-dokku-from-source() {
     log-fail "This installation script requires apt-get. For manual installation instructions, consult https://dokku.com/docs/getting-started/advanced-installation/"
   fi
 
-  apt-get -qq -y --no-install-recommends install sudo git make software-properties-common
+  apt-get -qq -y --no-install-recommends install sudo git make
+  case "$DOKKU_DISTRO" in
+    debian)
+      if [[ "$DOKKU_DISTRO_VERSION" -lt "13" ]]; then
+        if ! dpkg -l | grep -q software-properties-common; then
+          apt-get -qq -y --no-install-recommends install software-properties-common
+        fi
+      fi
+      ;;
+    ubuntu)
+      if ! dpkg -l | grep -q software-properties-common; then
+        apt-get -qq -y --no-install-recommends install software-properties-common
+      fi
+      ;;
+  esac
+
   cd /root
   if [[ ! -d /root/dokku ]]; then
     git clone "$DOKKU_REPO" /root/dokku
@@ -139,9 +160,6 @@ install-dokku-from-package() {
     debian | ubuntu)
       install-dokku-from-deb-package "$@"
       ;;
-    centos | fedora | rhel)
-      install-dokku-from-rpm-package "$@"
-      ;;
     *)
       log-fail "Unsupported Linux distribution. For manual installation instructions, consult https://dokku.com/docs/getting-started/advanced-installation/"
       ;;
@@ -163,7 +181,7 @@ install-dokku-from-deb-package() {
   local NO_INSTALL_RECOMMENDS=${DOKKU_NO_INSTALL_RECOMMENDS:=""}
   local OS_ID
 
-  if ! in-array "$DOKKU_DISTRO_VERSION" "18.04" "20.04" "22.04" "9" "10" "11"; then
+  if ! in-array "$DOKKU_DISTRO_VERSION" "22.04" "24.04" "10" "11" "12" "13"; then
     log-fail "Unsupported Linux distribution. Only the following versions are supported: $SUPPORTED_VERSIONS"
   fi
 
@@ -171,10 +189,6 @@ install-dokku-from-deb-package() {
     NO_INSTALL_RECOMMENDS=" --no-install-recommends "
   fi
 
-  echo "--> Initial apt-get update"
-  apt-get update -qq >/dev/null
-  apt-get -qq -y --no-install-recommends install apt-transport-https
-
   if ! command -v docker &>/dev/null; then
     echo "--> Installing docker"
     if uname -r | grep -q linode; then
@@ -188,31 +202,31 @@ install-dokku-from-deb-package() {
     wget -nv -O - https://get.docker.com/ | sh
   fi
 
-  OS_ID="$(lsb_release -cs 2>/dev/null || echo "bionic")"
+  OS_ID="$(lsb_release -cs 2>/dev/null || echo "noble")"
   if ! in-array "$DOKKU_DISTRO" "debian" "ubuntu" "raspbian"; then
     DOKKU_DISTRO="ubuntu"
-    OS_ID="bionic"
+    OS_ID="noble"
   fi
 
   if [[ "$DOKKU_DISTRO" == "ubuntu" ]]; then
-    OS_IDS=("bionic" "focal" "jammy")
+    OS_IDS=("jammy" "noble")
     if ! in-array "$OS_ID" "${OS_IDS[@]}"; then
-      OS_ID="bionic"
+      OS_ID="noble"
     fi
   elif [[ "$DOKKU_DISTRO" == "debian" ]]; then
-    OS_IDS=("stretch" "buster" "bullseye")
+    OS_IDS=("bullseye" "bookworm" "trixie")
     if ! in-array "$OS_ID" "${OS_IDS[@]}"; then
-      OS_ID="bullseye"
+      OS_ID="bookworm"
     fi
   elif [[ "$DOKKU_DISTRO" == "raspbian" ]]; then
-    OS_IDS=("buster" "bullseye")
+    OS_IDS=("bullseye" "bookworm" "trixie")
     if ! in-array "$OS_ID" "${OS_IDS[@]}"; then
-      OS_ID="bullseye"
+      OS_ID="bookworm"
     fi
   fi
 
   echo "--> Installing dokku"
-  wget -nv -O - https://packagecloud.io/dokku/dokku/gpgkey | apt-key add -
+  wget -qO- https://packagecloud.io/dokku/dokku/gpgkey | sudo tee /etc/apt/trusted.gpg.d/dokku.asc
   echo "deb https://packagecloud.io/dokku/dokku/$DOKKU_DISTRO/ $OS_ID main" | tee /etc/apt/sources.list.d/dokku.list
   apt-get update -qq >/dev/null
 
@@ -223,48 +237,15 @@ install-dokku-from-deb-package() {
   [[ -n $DOKKU_NGINX_ENABLE ]] && echo "dokku dokku/nginx_enable string $DOKKU_NGINX_ENABLE" | sudo debconf-set-selections
 
   if [[ -n $DOKKU_CHECKOUT ]]; then
-    # shellcheck disable=SC2086
     apt-get -qq -y $NO_INSTALL_RECOMMENDS install "dokku=$DOKKU_CHECKOUT"
   else
-    # shellcheck disable=SC2086
     apt-get -qq -y $NO_INSTALL_RECOMMENDS install dokku
   fi
 }
 
-install-dokku-from-rpm-package() {
-  local DOKKU_CHECKOUT="$1"
-
-  if ! in-array "$DOKKU_DISTRO_VERSION" "7"; then
-    log-fail "Unsupported Linux distribution. Only the following versions are supported: $SUPPORTED_VERSIONS"
-  fi
-
-  echo "--> Installing docker"
-  curl -fsSL https://get.docker.com/ | sh
-
-  echo "--> Installing epel for nginx packages to be available"
-  yum install -y epel-release
-
-  echo "--> Installing herokuish and dokku"
-  curl -s https://packagecloud.io/install/repositories/dokku/dokku/script.rpm.sh | bash
-  if [[ -n $DOKKU_CHECKOUT ]]; then
-    yum -y install herokuish "dokku-$DOKKU_CHECKOUT"
-  else
-    yum -y install herokuish dokku
-  fi
-
-  echo "--> Enabling docker and nginx on system startup"
-  systemctl enable docker
-  systemctl enable nginx
-
-  echo "--> Starting nginx"
-  systemctl start nginx
-}
-
 main() {
   export DOKKU_DISTRO DOKKU_DISTRO_VERSION
-  # shellcheck disable=SC1091
   DOKKU_DISTRO=$(. /etc/os-release && echo "$ID")
-  # shellcheck disable=SC1091
   DOKKU_DISTRO_VERSION=$(. /etc/os-release && echo "$VERSION_ID")
 
   export DEBIAN_FRONTEND=noninteractive

common.mk

@@ -1,7 +1,7 @@
 GO_ARGS ?=
 GO_PLUGIN_MAKE_TARGET ?= build
 GO_REPO_ROOT := /go/src/github.com/dokku/dokku
-BUILD_IMAGE := golang:1.17.9
+BUILD_IMAGE := golang:1.26.2
 GO_BUILD_CACHE ?= /tmp/dokku-go-build-cache
 GO_MOD_CACHE   ?= /tmp/dokku-go-mod-mod
 GO_ROOT_MOUNT  ?= $$PWD/../..:$(GO_REPO_ROOT)
@@ -21,17 +21,17 @@ build-in-docker: clean
 		-e GO111MODULE=on \
 		-w $(GO_REPO_ROOT)/plugins/$(PLUGIN_NAME) \
 		$(BUILD_IMAGE) \
-		bash -c "GO_ARGS='$(GO_ARGS)' CGO_ENABLED=0 GOOS=linux GOARCH=$(GOARCH) make -j4 $(GO_PLUGIN_MAKE_TARGET)" || exit $$?
+		bash -c "GO_ARGS='$(GO_ARGS)' CGO_ENABLED=0 GOOS=linux GOARCH=$(GOARCH) GOWORK=off make -j4 $(GO_PLUGIN_MAKE_TARGET)" || exit $$?
 
 clean:
 	rm -rf $(BUILD)
 	find . -xtype l -delete
 
 commands: **/**/commands.go
-	go build -ldflags="-s -w" $(GO_ARGS) -o commands src/commands/commands.go
+	GOARCH=$(GOARCH) go build -mod=readonly -ldflags="-s -w" $(GO_ARGS) -o commands src/commands/commands.go
 
 subcommands:
-	go build -ldflags="-s -w" $(GO_ARGS) -o subcommands/subcommands src/subcommands/subcommands.go
+	GOARCH=$(GOARCH) go build -mod=readonly -ldflags="-s -w" $(GO_ARGS) -o subcommands/subcommands src/subcommands/subcommands.go
 	$(MAKE) $(SUBCOMMANDS)
 
 subcommands/%:
@@ -41,7 +41,7 @@ src-clean:
 	rm -rf .gitignore src vendor Makefile *.go glide.* go.sum go.mod
 
 triggers:
-	go build -ldflags="-s -w" $(GO_ARGS) -o triggers src/triggers/triggers.go
+	GOARCH=$(GOARCH) go build -mod=readonly -ldflags="-s -w" $(GO_ARGS) -o triggers src/triggers/triggers.go
 	$(MAKE) $(TRIGGERS)
 
 triggers/%:

contrib/build-base.Dockerfile

@@ -1,6 +1,24 @@
-FROM ubuntu:18.04
+FROM ubuntu:24.04
 
 ENV DEBIAN_FRONTEND=noninteractive
 
-RUN apt-get update -qq && apt-get -qq -y --no-install-recommends install gcc git build-essential wget ruby-dev ruby1.9.1 lintian rpm help2man man-db
-RUN command -v fpm >/dev/null || sudo gem install fpm --no-ri --no-rdoc
+RUN apt-get update -qq && apt-get -qq -y --no-install-recommends install \
+    adduser \
+    build-essential \
+    ca-certificates \
+    coreutils \
+    curl \
+    gcc \
+    git \
+    help2man \
+    jq \
+    libc-bin \
+    lintian \
+    man-db \
+    openssh-client \
+    python3 \
+    rpm \
+    ruby-dev \
+    sudo \
+    wget
+RUN command -v fpm || gem install fpm

contrib/build-docs

@@ -0,0 +1,167 @@
+#!/usr/bin/env bash
+set -eo pipefail
+
+readonly ROOT_DIR="$(cd "$(dirname "$(dirname "${BASH_SOURCE[0]}")")" && pwd)"
+
+main() {
+  pushd "$ROOT_DIR" >/dev/null || return 1
+  rm -rf docs-main tmp/docs-source tmp/docs-build # tmp/docs-build
+  cp -r docs docs-main
+
+  echo "====> Generating docs image"
+  make docs-build-image
+
+  echo "====> Fetching latest docs"
+  git clone -q https://github.com/dokku/docs.git tmp/docs-build
+
+  echo "====> Processing version: latest"
+  rm -rf tmp/docs-build/docs
+  git clone -q https://github.com/dokku/dokku.git tmp/docs-source
+
+  rm -rf docs/assets
+  mkdir -p docs/assets
+  cp -r docs-main/assets/extra.css docs/assets/extra.css
+  cp -r docs-main/assets/favicons docs/assets/favicons
+  cp -r docs-main/assets/dokku-logo.svg docs/assets/dokku-logo.svg
+
+  rm -rf tmp/docs-build/assets
+  cp -r docs-main/assets tmp/docs-build/assets
+  cp docs-main/_build/app-nginx.conf.sigil tmp/docs-build/app-nginx.conf.sigil
+  mkdir -p tmp/docs-build/nginx.conf.d
+  touch tmp/docs-build/.static
+  echo "[]" >tmp/docs-build/versions.json
+
+  sed -i.bak "s/outdated/outdated_hidden/g" docs/_overrides/main.html && rm docs/_overrides/main.html.bak
+  echo "----> Generating docs"
+  make docs-build
+  if [[ -n "$GITHUB_ACTION" ]]; then
+    sudo chown -R "$(whoami)" site
+  fi
+
+  rm -rf site/_build
+  mv site tmp/docs-build/docs
+  mv docs/home.html tmp/docs-build/index.html
+  sed -i.bak "s/{{NAME}}~{{REF}}/docs/g" tmp/docs-build/index.html && rm tmp/docs-build/index.html.bak
+  sed -i.bak "s/{{NAME}}/docs/g" tmp/docs-build/index.html && rm tmp/docs-build/index.html.bak
+  sed -i.bak 's/="\/docs\/"/="\/"/g' tmp/docs-build/index.html && rm tmp/docs-build/index.html.bak
+
+  jq -C -r '.["max-versions"][]' docs-main/assets/versions.json | while read -r current_version; do
+    major="$(echo "$current_version" | cut -d'.' -f1)"
+    minor="$(echo "$current_version" | cut -d'.' -f2)"
+    patch="$(echo "$current_version" | cut -d'.' -f3)"
+    while true; do
+      if [[ "$patch" -lt 0 ]]; then
+        break
+      fi
+      version="${major}.${minor}.${patch}"
+      echo "====> Processing version: ${major}.${minor}.${patch}"
+
+      if [[ "$major" -lt 1 ]]; then
+        if [[ "$current_version" != "$version" ]]; then
+          echo "      Writing rewrite rule"
+          echo "rewrite ^/docs~v$version/(.*)$ /docs~v$current_version/\$1 redirect;" >"tmp/docs-build/nginx.conf.d/$version.conf"
+          echo "      Removing old docs"
+          rm -rf "tmp/docs-build/docs~v${version}"
+          patch=$((patch - 1))
+          continue
+        fi
+      fi
+
+      jq --arg title "v$version" --arg version "docs~v$version" '. += [{"title": $title, "version": $version, "aliases": []}]' tmp/docs-build/versions.json >tmp/docs-build/versions.json.bak
+      mv tmp/docs-build/versions.json.bak tmp/docs-build/versions.json
+      if [[ -d "tmp/docs-build/docs~v${version}" ]]; then
+        echo " !    Docs exist, skipping regeneration"
+        rm -rf "tmp/docs-build/docs~v${version}/assets/favicons"
+        cp -r docs-main/assets/favicons "tmp/docs-build/docs~v${version}/assets/favicons"
+        cp -r docs-main/assets/dokku-logo.svg "tmp/docs-build/docs~v${version}/assets/dokku-logo.svg"
+        cp -r docs-main/assets/extra.css "tmp/docs-build/docs~v${version}/assets/extra.css"
+        patch=$((patch - 1))
+        continue
+      fi
+
+      git -C tmp/docs-source checkout -q -- .
+      git -C tmp/docs-source checkout -q "tags/v${version}" -b "v${version}-branch"
+      rm -rf docs
+      mv tmp/docs-source/docs docs
+
+      rm -rf docs/assets
+      mkdir -p docs/assets
+      cp -r docs-main/assets/favicons docs/assets/favicons
+      cp -r docs-main/assets/dokku-logo.svg docs/assets/dokku-logo.svg
+      cp -r docs-main/assets/extra.css docs/assets/extra.css
+
+      cp -r docs-main/_build docs/_build
+      cp -r docs-main/_overrides docs/_overrides
+      git checkout -q -- mkdocs.yml
+      sed -i.bak "s/site_dir: site/site_dir: docs~v$version/g" mkdocs.yml && rm mkdocs.yml.bak
+      if [[ ! -f docs/template.html ]]; then
+        if [[ "$patch" -eq 0 ]]; then
+          break
+        fi
+
+        continue
+      fi
+
+      echo "----> Generating docs"
+      if ! make docs-build; then
+        continue
+      fi
+
+      if [[ -d "docs~v${version}" ]]; then
+        if [[ -n "$GITHUB_ACTION" ]]; then
+          sudo chown -R "$(whoami)" "docs~v${version}"
+        fi
+
+        rm -rf "docs~v${version}/_build"
+        mv "docs~v${version}" "tmp/docs-build/docs~v${version}"
+      fi
+
+      if [[ "$patch" -eq 0 ]]; then
+        break
+      fi
+      patch=$((patch - 1))
+    done
+  done
+
+  echo "====> Rebuild versions"
+  if [[ -f "tmp/docs-build/versions.json" ]]; then
+    python3 contrib/sort-mkdocs-versions
+  else
+    echo "      No version file exists"
+  fi
+
+  echo "====> Cleanup main repo"
+  rm -rf docs
+  mv docs-main docs
+  git checkout -- mkdocs.yml docs
+
+  echo "====> Checking for file changes"
+  changes=$(git -C tmp/docs-build ls-files -dmo)
+  if [[ -z "$changes" ]]; then
+    echo " !    No doc changes found"
+    exit 0
+  fi
+
+  if [[ "$changes" == "docs/sitemap.xml.gz" ]]; then
+    echo " !    No doc changes found"
+    git -C tmp/docs-build checkout -- docs/sitemap.xml.gz
+    exit 0
+  fi
+
+  echo "====> Changes found"
+  echo "$changes"
+
+  echo "====> Committing changes"
+  git -C tmp/docs-build add .
+  git -C tmp/docs-build commit -m "chore: regenerate docs"
+
+  echo "====> Pushing changes"
+  if [[ -n "$BOT_GITHUB_USERNAME" ]] && [[ -n "$BOT_GITHUB_API_TOKEN" ]]; then
+    git -C tmp/docs-build remote set-url origin "https://$BOT_GITHUB_USERNAME:$BOT_GITHUB_API_TOKEN@github.com/dokku/docs.git"
+  fi
+
+  git -C tmp/docs-build push origin master
+
+}
+
+main "$@"

contrib/build-dokku.Dockerfile

@@ -1,30 +1,29 @@
-FROM dokku/build-base:0.0.1 AS builder
+FROM dokku/build-base:0.1.2 AS builder
 
 ENV DEBIAN_FRONTEND=noninteractive
 
-RUN apt-get update -qq && apt-get -qq -y --no-install-recommends install gcc git build-essential wget ruby-dev ruby1.9.1 lintian rpm help2man man-db
-RUN command -v fpm >/dev/null || sudo gem install fpm --no-ri --no-rdoc
-
 ARG GOLANG_VERSION
-
-RUN wget -qO /tmp/go${GOLANG_VERSION}.linux-amd64.tar.gz https://storage.googleapis.com/golang/go${GOLANG_VERSION}.linux-amd64.tar.gz \
-  && tar -C /usr/local -xzf /tmp/go${GOLANG_VERSION}.linux-amd64.tar.gz \
-  && cp /usr/local/go/bin/* /usr/local/bin
-
 ARG WORKDIR=/go/src/github.com/dokku/dokku
 
 WORKDIR ${WORKDIR}
 
+RUN wget -qO /tmp/go${GOLANG_VERSION}.linux.tar.gz "https://go.dev/dl/go${GOLANG_VERSION}.linux-$(dpkg --print-architecture).tar.gz" \
+  && tar -C /usr/local -xzf /tmp/go${GOLANG_VERSION}.linux.tar.gz \
+  && cp /usr/local/go/bin/* /usr/local/bin \
+  && mkdir -p ${WORKDIR}/contrib
+
 COPY Makefile ${WORKDIR}/
 COPY *.mk ${WORKDIR}/
+COPY contrib/dependencies.json ${WORKDIR}/contrib/dependencies.json
 
-RUN make deb-setup rpm-setup sshcommand plugn
+RUN make deb-setup sshcommand plugn
 
 COPY . ${WORKDIR}
 
 ENV GOPATH=/go
+ENV GOROOT=/usr/local/go
 
-FROM builder as amd64
+FROM builder AS amd64
 
 ARG PLUGIN_MAKE_TARGET
 ARG DOKKU_VERSION=master
@@ -37,9 +36,9 @@ RUN PLUGIN_MAKE_TARGET=${PLUGIN_MAKE_TARGET} \
   IS_RELEASE=${IS_RELEASE} \
   SKIP_GO_CLEAN=true \
   make version copyfiles \
-  && make deb-dokku rpm-dokku
+  && make deb-dokku
 
-FROM builder as armhf
+FROM builder AS arm64
 
 COPY --from=amd64 /tmp /tmp
 COPY --from=amd64 /usr/local/share/man/man1/dokku.1 /usr/local/share/man/man1/dokku.1-generated
@@ -51,26 +50,6 @@ ARG DOKKU_VERSION=master
 ARG DOKKU_GIT_REV
 ARG IS_RELEASE=false
 
-RUN PLUGIN_MAKE_TARGET=${PLUGIN_MAKE_TARGET} \
-  DOKKU_VERSION=${DOKKU_VERSION} \
-  DOKKU_GIT_REV=${DOKKU_GIT_REV} \
-  IS_RELEASE=${IS_RELEASE} \
-  SKIP_GO_CLEAN=true \
-  GOARCH=arm make version copyfiles \
-  && DOKKU_ARCHITECTURE=armhf GOARCH=arm make deb-dokku
-
-FROM builder as arm64
-
-COPY --from=armhf /tmp /tmp
-COPY --from=amd64 /usr/local/share/man/man1/dokku.1 /usr/local/share/man/man1/dokku.1-generated
-
-RUN rm -rf /tmp/build-dokku
-
-ARG PLUGIN_MAKE_TARGET
-ARG DOKKU_VERSION=master
-ARG DOKKU_GIT_REV
-ARG IS_RELEASE=false
-
 RUN PLUGIN_MAKE_TARGET=${PLUGIN_MAKE_TARGET} \
   DOKKU_VERSION=${DOKKU_VERSION} \
   DOKKU_GIT_REV=${DOKKU_GIT_REV} \

contrib/copy-packages

@@ -15,7 +15,7 @@ def download_file(filename, url):
 
 
 def upload_file(filename):
-    versions = ["jammy"]
+    versions = ["noble"]
     cmd_template = "package_cloud push dokku/dokku/ubuntu/{0} {1}"
     for version in versions:
         cmd = cmd_template.format(version, filename)
@@ -25,7 +25,7 @@ def upload_file(filename):
 def main():
     auth = HTTPBasicAuth(PACKAGECLOUD_TOKEN, "")
     base = requests.get(
-        "https://packagecloud.io/api/v1/repos/dokku/dokku/packages/deb/ubuntu/focal.json",
+        "https://packagecloud.io/api/v1/repos/dokku/dokku/packages/deb/ubuntu/jammy.json",
         auth=auth,
     )
     data = base.json()

contrib/dependencies.json

@@ -0,0 +1,104 @@
+{
+  "dependencies": [
+    {
+      "name": "docker-container-healthchecker",
+      "version": "0.16.0",
+      "urls": {
+        "amd64": "https://github.com/dokku/docker-container-healthchecker/releases/download/v0.16.0/docker-container-healthchecker-linux-amd64",
+        "arm64": "https://github.com/dokku/docker-container-healthchecker/releases/download/v0.16.0/docker-container-healthchecker-linux-arm64"
+      }
+    },
+    {
+      "name": "docker-image-labeler",
+      "version": "0.10.0",
+      "urls": {
+        "amd64": "https://github.com/dokku/docker-image-labeler/releases/download/v0.10.0/docker-image-labeler-linux-amd64",
+        "arm64": "https://github.com/dokku/docker-image-labeler/releases/download/v0.10.0/docker-image-labeler-linux-arm64"
+      }
+    },
+    {
+      "name": "lambda-builder",
+      "version": "0.9.4",
+      "urls": {
+        "amd64": "https://github.com/dokku/lambda-builder/releases/download/v0.9.4/lambda-builder-linux-amd64",
+        "arm64": "https://github.com/dokku/lambda-builder/releases/download/v0.9.4/lambda-builder-linux-arm64"
+      }
+    },
+    {
+      "name": "netrc",
+      "version": "0.11.1",
+      "urls": {
+        "amd64": "https://github.com/dokku/netrc/releases/download/v0.11.1/netrc-linux-amd64",
+        "arm64": "https://github.com/dokku/netrc/releases/download/v0.11.1/netrc-linux-arm64"
+      }
+    },
+    {
+      "name": "pack",
+      "version": "0.40.9",
+      "urls": {
+        "amd64": "https://github.com/buildpacks/pack/releases/download/v0.40.9/pack-v0.40.9-linux.tgz",
+        "arm64": "https://github.com/buildpacks/pack/releases/download/v0.40.9/pack-v0.40.9-linux-arm64.tgz"
+      }
+    },
+    {
+      "name": "procfile-util",
+      "version": "0.20.8",
+      "urls": {
+        "amd64": "https://github.com/dokku/procfile-util/releases/download/v0.20.8/procfile-util-linux-amd64",
+        "arm64": "https://github.com/dokku/procfile-util/releases/download/v0.20.8/procfile-util-linux-arm64"
+      }
+    },
+    {
+      "name": "sshcommand",
+      "version": "0.20.2",
+      "urls": {
+        "amd64": "https://github.com/dokku/sshcommand/releases/download/v0.20.2/sshcommand",
+        "arm64": "https://github.com/dokku/sshcommand/releases/download/v0.20.2/sshcommand"
+      }
+    }
+  ],
+  "predependencies": [
+    {
+      "name": "gliderlabs-sigil",
+      "version": "0.12.1",
+      "urls": {
+        "amd64": "https://github.com/gliderlabs/sigil/releases/download/v0.12.1/sigil-linux-amd64",
+        "arm64": "https://github.com/gliderlabs/sigil/releases/download/v0.12.1/sigil-linux-arm64"
+      }
+    },
+    {
+      "name": "plugn",
+      "version": "0.17.1",
+      "urls": {
+        "amd64": "https://github.com/dokku/plugn/releases/download/v0.17.1/plugn-linux-amd64",
+        "arm64": "https://github.com/dokku/plugn/releases/download/v0.17.1/plugn-linux-arm64"
+      }
+    }
+  ],
+  "recommendations": [
+    {
+      "name": "dokku-event-listener",
+      "version": "0.20.1",
+      "urls": {
+        "amd64": "https://github.com/dokku/dokku-event-listener/releases/download/v0.20.1/dokku-event-listener-linux-amd64",
+        "arm64": "https://github.com/dokku/dokku-event-listener/releases/download/v0.20.1/dokku-event-listener-linux-arm64"
+      }
+    },
+    {
+      "name": "dokku-update",
+      "version": "0.10.0",
+      "urls": {
+        "amd64": "https://github.com/dokku/dokku-update/releases/download/v0.10.0/dokku-update",
+        "arm64": "https://github.com/dokku/dokku-update/releases/download/v0.10.0/dokku-update"
+      }
+    },
+    {
+      "name": "herokuish",
+      "version": "0.11.16",
+      "urls": {
+        "amd64": "https://github.com/gliderlabs/herokuish/releases/download/v0.11.16/herokuish_0.11.16_linux_x86_64.tgz",
+        "arm64": "https://github.com/gliderlabs/herokuish/releases/download/v0.11.16/herokuish_0.11.16_linux_x86_64.tgz"
+      }
+    }
+  ]
+}

contrib/dokku-docker-bin.sh

@@ -4,5 +4,4 @@ set -eo pipefail
 DOKKU_DOCKER_CONTAINER_NAME=${DOKKU_DOCKER_CONTAINER_NAME:=dokku}
 
 # TODO: handle cases where we need a tty
-# shellcheck disable=SC2086
 docker exec $DOKKU_DOCKER_ENV -i "$DOKKU_DOCKER_CONTAINER_NAME" dokku "$@"

contrib/dokku_client.sh

@@ -1,8 +1,9 @@
 #!/usr/bin/env bash
 set -eo pipefail
 [[ $DOKKU_TRACE ]] && set -x
-export DOKKU_PORT=${DOKKU_PORT:=22}
+export DOKKU_PORT=${DOKKU_PORT:=}
 export DOKKU_HOST=${DOKKU_HOST:=}
+export DOKKU_APP_PATH=${DOKKU_APP_PATH:=}
 
 fn-random-number() {
   [[ -n "$1" ]] && RANGE="$1"
@@ -49,7 +50,7 @@ fn-dokku-host() {
   declare DOKKU_GIT_REMOTE="$1" DOKKU_HOST="$2"
 
   if [[ -z "$DOKKU_HOST" ]]; then
-    if [[ -d .git ]] || git rev-parse --git-dir >/dev/null 2>&1; then
+    if [[ -d .git ]] || git rev-parse --git-dir &>/dev/null; then
       DOKKU_HOST=$(git remote -v 2>/dev/null | grep -Ei "^${DOKKU_GIT_REMOTE}\s" | head -n 1 | cut -f1 -d' ' | cut -f2 -d '@' | cut -f1 -d':' 2>/dev/null || true)
     fi
   fi
@@ -61,9 +62,43 @@ fn-dokku-host() {
   echo "$DOKKU_HOST"
 }
 
+fn-dokku-app() {
+  declare DOKKU_GIT_REMOTE="$1" DOKKU_REMOTE_HOST="$2"
+  remote_output="$(git remote -v 2>/dev/null | grep -Ei "^${DOKKU_GIT_REMOTE}\s" | head -n 1 | awk '{print $2}')"
+
+  # check if there is a scheme
+  if echo "$remote_output" | grep -qEi "ssh://"; then
+    echo "$remote_output" | grep -Ei "ssh://dokku@$DOKKU_REMOTE_HOST" | cut -f2 -d'@' | cut -f2 -d'/' 2>/dev/null
+  else
+    echo "$remote_output" | grep -Ei "dokku@$DOKKU_REMOTE_HOST" | cut -f2 -d'@' | cut -f2 -d':' 2>/dev/null
+  fi
+}
+
+fn-dokku-port() {
+  declare DOKKU_GIT_REMOTE="$1" DOKKU_REMOTE_HOST="$2"
+  remote_output="$(git remote -v 2>/dev/null | grep -Ei "^${DOKKU_GIT_REMOTE}\s" | head -n 1 | awk '{print $2}')"
+
+  if echo "$remote_output" | grep -qEi "ssh://"; then
+    local output="$(echo "$remote_output" | grep -Ei "ssh://dokku@$DOKKU_REMOTE_HOST" | cut -f2 -d'@' | cut -f1 -d'/' 2>/dev/null)"
+    # check if output has a : and if so, get the port
+    if echo "$output" | grep -qEi ":"; then
+      echo "$output" | cut -f2 -d':' 2>/dev/null
+    else
+      echo "22"
+    fi
+  else
+    echo "22"
+  fi
+}
+
+fn-get-remote() {
+  git config dokku.remote 2>/dev/null || echo "dokku"
+}
+
 main() {
   declare CMD="$1" APP_ARG="$2"
-  local APP="" DOKKU_GIT_REMOTE="dokku" DOKKU_REMOTE_HOST=""
+
+  local APP="" DOKKU_GIT_REMOTE="$(fn-get-remote)" DOKKU_REMOTE_HOST=""
   local cmd_set=false next_index=1 skip=false args=("$@")
 
   for arg in "$@"; do
@@ -80,6 +115,10 @@ main() {
       APP=${args[$next_index]}
       skip=true
       shift 2
+    elif [[ "$arg" == "--app-path" ]]; then
+      DOKKU_APP_PATH=${args[$next_index]}
+      skip=true
+      shift 2
     elif [[ "$arg" == "--remote" ]]; then
       DOKKU_GIT_REMOTE=${args[$next_index]}
       skip=true
@@ -99,22 +138,41 @@ main() {
     next_index=$((next_index + 1))
   done
 
+  if [[ -n "$DOKKU_APP_PATH" ]]; then
+    pushd "$DOKKU_APP_PATH" &>/dev/null || exit 1
+    trap 'popd &>/dev/null || true' RETURN INT TERM
+  fi
+
   DOKKU_REMOTE_HOST="$(fn-dokku-host "$DOKKU_GIT_REMOTE" "$DOKKU_HOST")"
-  if [[ -z "$DOKKU_REMOTE_HOST" ]]; then
+  if [[ -z "$DOKKU_REMOTE_HOST" ]] && [[ "$CMD" != remote ]] && [[ "$CMD" != remote:* ]]; then
     fn-client-help-msg
   fi
 
   if [[ -z "$APP" ]]; then
-    if [[ -d .git ]] || git rev-parse --git-dir >/dev/null 2>&1; then
+    if [[ -d .git ]] || git rev-parse --git-dir &>/dev/null; then
       set +e
-      APP=$(git remote -v 2>/dev/null | grep -Ei "^${DOKKU_GIT_REMOTE}\s" | grep -Ei "dokku@$DOKKU_REMOTE_HOST" | head -n 1 | cut -f2 -d'@' | cut -f1 -d' ' | cut -f2 -d':' 2>/dev/null)
+      APP="$(fn-dokku-app "$DOKKU_GIT_REMOTE" "$DOKKU_REMOTE_HOST")"
       set -e
     else
       echo " !     This is not a git repository" 1>&2
     fi
   fi
 
+  if [[ -z "$DOKKU_PORT" ]]; then
+    DOKKU_PORT="$(fn-dokku-port "$DOKKU_GIT_REMOTE" "$DOKKU_REMOTE_HOST")"
+  fi
+
   case "$CMD" in
+    remote:show)
+      echo "dokku-app: $APP"
+      echo "dokku-git-remote: $DOKKU_GIT_REMOTE"
+      echo "dokku-host: $DOKKU_HOST"
+      echo "dokku-port: $DOKKU_PORT"
+      echo "dokku-remote-host: $DOKKU_REMOTE_HOST"
+      echo "dokku-ssh-user: dokku"
+      echo "dokku-constructed-remote: ssh://dokku@$DOKKU_REMOTE_HOST:$DOKKU_PORT/$APP"
+      exit 0
+      ;;
     apps:create)
       if [[ -z "$APP" ]] && [[ -z "$APP_ARG" ]]; then
         APP=$(fn-random-name)
@@ -125,7 +183,7 @@ main() {
             ssh -p "$DOKKU_PORT" "dokku@$DOKKU_REMOTE_HOST" apps
             exit 1
           else
-            APP=$(random_name)
+            APP=$(fn-random-name)
             counter=$((counter + 1))
           fi
         done
@@ -143,16 +201,60 @@ main() {
     apps:destroy)
       fn-is-git-repo && fn-has-dokku-remote && git remote remove "$DOKKU_GIT_REMOTE"
       ;;
+    remote)
+      echo "$DOKKU_GIT_REMOTE"
+      exit 0
+      ;;
+    remote:add)
+      shift 1
+      git remote add "$@"
+      exit "$?"
+      ;;
+    remote:list)
+      git remote
+      exit "$?"
+      ;;
+    remote:set)
+      shift 1
+      git config dokku.remote "$@"
+      exit "$?"
+      ;;
+    remote:remove)
+      shift 1
+      git remote remove "$@"
+      local exit_code="$?"
+      if [[ "$(git config dokku.remote)" == "$1" ]]; then
+        git config --unset dokku.remote
+      fi
+      exit "$exit_code"
+      ;;
+    remote:unset)
+      if [[ -n "$(git config dokku.remote)" ]]; then
+        git config --unset dokku.remote
+        exit "$?"
+      fi
+      exit 0
+      ;;
   esac
 
   [[ " apps certs help ls nginx shell storage trace version " == *" $CMD "* ]] && unset APP
-  [[ " certs:chain domains:add-global domains:remove-global domains:set-global ps:restore " == *" $CMD "* ]] && unset APP
+  [[ " certs:chain domains:add-global domains:clear-global domains:remove-global domains:set-global ps:restore " == *" $CMD "* ]] && unset APP
+  [[ " storage:ensure-directory " == *" $CMD "* ]] && unset APP
+  [[ " network:create network:destroy network:exists network:info network:list network:rebuildall " == *" $CMD "* ]] && unset APP
+  [[ " logs:vector-logs logs:vector-start logs:vector-stop " == *" $CMD "* ]] && unset APP
+  [[ " scheduler-k3s:cluster:add scheduler-k3s:cluster:list scheduler-k3s:cluster:remove " == *" $CMD "* ]] && unset APP
+  [[ " scheduler-k3s:ensure-charts scheduler-k3s:initialize scheduler-k3s:show-kubeconfig scheduler-k3s:uninstall " == *" $CMD "* ]] && unset APP
+  [[ " scheduler-k3s:profiles:add scheduler-k3s:profiles:list scheduler-k3s:profiles:remove " == *" $CMD "* ]] && unset APP
   [[ "$CMD" =~ events*|plugin*|ssh-keys* ]] && unset APP
   [[ -n "$APP_ARG" ]] && [[ "$APP_ARG" == "--global" ]] && unset APP
-  [[ -n "$@" ]] && [[ -n "$APP" ]] && app_arg="--app $APP"
+  if [[ -n "$@" ]] && [[ -n "$APP" ]]; then
+    set -- "$APP" "$@"
+    set -- "--app" "$@"
+  fi
   # echo "ssh -o LogLevel=QUIET -p $DOKKU_PORT -t dokku@$DOKKU_REMOTE_HOST -- $app_arg $@"
-  # shellcheck disable=SC2068,SC2086
-  ssh -o LogLevel=QUIET -p $DOKKU_PORT -t dokku@$DOKKU_REMOTE_HOST -- $app_arg $@ || {
+  local ssh_args=("-o" "LogLevel=QUIET" "-p" "$DOKKU_PORT" "-t" "dokku@$DOKKU_REMOTE_HOST" "--")
+  ssh_args+=("$@")
+  ssh "${ssh_args[@]}" || {
     ssh_exit_code="$?"
     echo " !     Failed to execute dokku command over ssh: exit code $?" 1>&2
     echo " !     If there was no output from Dokku, ensure your configured SSH Key can connect to the remote server" 1>&2

contrib/images/digitalocean/files/etc/nginx/sites-available/digitalocean

@@ -0,0 +1,95 @@
+# You may add here your
+# server {
+#	...
+# }
+# statements for each of your virtual hosts to this file
+
+##
+# You should look at the following URL's in order to grasp a solid understanding
+# of Nginx configuration files in order to fully unleash the power of Nginx.
+# http://wiki.nginx.org/Pitfalls
+# http://wiki.nginx.org/QuickStart
+# http://wiki.nginx.org/Configuration
+#
+# Generally, you will want to move this file somewhere, and start with a clean
+# file but keep this around for reference. Or just disable in sites-enabled.
+#
+# Please see /usr/share/doc/nginx-doc/examples/ for more detailed examples.
+##
+
+server {
+	listen 80 default_server;
+	listen [::]:80 default_server ipv6only=on;
+
+	root /var/www/html;
+	index index.php index.html index.htm;
+
+	# Make site accessible from http://localhost/
+	server_name localhost;
+
+	location / {
+		# First attempt to serve request as file, then
+		# as directory, then fall back to displaying a 404.
+		try_files $uri $uri/ =404;
+		# Uncomment to enable naxsi on this location
+		# include /etc/nginx/naxsi.rules
+	}
+
+	error_page 404 /404.html;
+	error_page 500 502 503 504 /50x.html;
+	location = /50x.html {
+		root /usr/share/nginx/html;
+	}
+
+	location ~ \.php$ {
+        include snippets/fastcgi-php.conf;
+        fastcgi_pass unix:/run/php/php7.4-fpm.sock;
+	}
+
+	# deny access to .htaccess files, if Apache's document root
+	# concurs with nginx's one
+	#
+	#location ~ /\.ht {
+	#	deny all;
+	#}
+}
+
+
+# another virtual host using mix of IP-, name-, and port-based configuration
+#
+#server {
+#	listen 8000;
+#	listen somename:8080;
+#	server_name somename alias another.alias;
+#	root html;
+#	index index.html index.htm;
+#
+#	location / {
+#		try_files $uri $uri/ =404;
+#	}
+#}
+
+
+# HTTPS server
+#
+#server {
+#	listen 443;
+#	server_name localhost;
+#
+#	root html;
+#	index index.html index.htm;
+#
+#	ssl on;
+#	ssl_certificate cert.pem;
+#	ssl_certificate_key cert.key;
+#
+#	ssl_session_timeout 5m;
+#
+#	ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;
+#	ssl_ciphers "HIGH:!aNULL:!MD5 or HIGH:!aNULL:!MD5:!3DES";
+#	ssl_prefer_server_ciphers on;
+#
+#	location / {
+#		try_files $uri $uri/ =404;
+#	}
+#}

contrib/images/digitalocean/files/etc/update-motd.d/99-one-click

@@ -0,0 +1,21 @@
+#!/bin/sh
+#
+# Configured as part of the DigitalOcean 1-Click Image build process
+
+myip=$(hostname -I | awk '{print$1}')
+cat <<EOF
+********************************************************************************
+
+Welcome to DigitalOcean's 1-Click Dokku Droplet.
+To keep this Droplet secure, the UFW firewall is enabled. 
+All ports are BLOCKED except 22 (SSH), 80 (HTTP), 443 (HTTPS).
+
+In a web browser, you can view:
+ * The Dokku One-Click Quickstart guide: https://do.co/dokku1804#start
+
+For help and more information, visit https://do.co/dokku1804
+
+********************************************************************************
+To delete this message of the day: rm -rf $(readlink -f ${0})
+To remove the default web landing page: rm -rf /etc/nginx/sites-available/digitalocean
+EOF

contrib/images/digitalocean/files/var/lib/cloud/scripts/per-once/001_setup

@@ -0,0 +1,25 @@
+#!/bin/bash -x
+set +e
+exec > >(tee /var/log/one_click_setup.log) 2>&1
+
+ufw --force enable
+printf "dokku dokku/hostname string %s" hostname | debconf-set-selections
+
+export DEBIAN_FRONTEND=noninteractive
+export LANG=C
+export LC_ALL=C
+
+# Install Dokku....
+for count in {1..30}; do
+  dpkg -i /var/lib/digitalocean/debs/*deb || /bin/true
+  apt-get -f install || /bin/true
+
+  version=$(dpkg-query --showformat='${Version}' -W dokku)
+  if [[ -n "$version" ]]; then
+    ran=0
+    exit 0
+  else
+    count=$((count + 1))
+  fi
+  sleep 5
+done

contrib/images/digitalocean/files/var/lib/cloud/scripts/per-once/002_enable_ssh

@@ -0,0 +1,9 @@
+#!/bin/bash
+exec > >(tee /var/log/one_click_setup.log) 2>&1
+
+# Remove the force command
+sed -e '/Match user root/d' \
+  -e '/.*ForceCommand.*droplet.*/d' \
+  -i /etc/ssh/sshd_config
+
+systemctl restart ssh

contrib/images/digitalocean/files/var/www/html/index.html

@@ -0,0 +1,169 @@
+<html>
+
+<head>
+  <style>
+    body {
+      font-family: ProximaNova;
+      font-size: 15px;
+      font-style: normal;
+      font-stretch: normal;
+      line-height: 1;
+      letter-spacing: normal;
+      margin: 0;
+    }
+
+    .button {
+      border-radius: 3px;
+      background-color: #0069ff;
+      color: #ffffff;
+      display: flex;
+      flex-direction: column;
+      height: 48px;
+      justify-content: center;
+      text-decoration: none;
+      width: 148px;
+    }
+
+    .content {
+      align-items: center;
+      border: solid 2px #f1f1f1;
+      border-radius: 3px;
+      display: flex;
+      flex-direction: column;
+      margin: 32px auto;
+      padding: 32px;
+      text-align: center;
+      width: 960px;
+      ;
+    }
+
+    .copyright {
+      color: #99999999;
+      font-size: 13px;
+      margin-left: 10px;
+    }
+
+    .description {
+      color: #676767;
+    }
+
+    .empty-access {
+      height: 220px;
+      margin-bottom: -20px;
+    }
+
+    .header {
+      align-items: center;
+      display: flex;
+      margin: 15px;
+    }
+
+    .logo {
+      height: 30px;
+      color: #999999;
+      width: 30px;
+    }
+
+    .title {
+      font-family: ProximaNova;
+      font-size: 21px;
+      font-weight: 600;
+      color: #444444;
+    }
+  </style>
+</head>
+
+<body>
+  <div class="header">
+    <svg class="logo" version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg"
+      xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px" viewBox="0 0 30 30" enable-background="new 0 0 30 30"
+      xml:space="preserve">
+      <g id="XMLID_17_">
+        <g id="XMLID_18_">
+          <g>
+            <g id="XMLID_225_">
+              <g id="XMLID_233_">
+                <path id="XMLID_234_" fill="#0080FF"
+                  d="M15,30v-5.8c6.2,0,10.9-6.1,8.6-12.6c-0.9-2.4-2.8-4.3-5.2-5.2
+                    C11.9,4.1,5.8,8.8,5.8,15l0,0L0,15C0,5.2,9.5-2.5,19.8,0.7c4.5,1.4,8.1,5,9.5,9.5C32.5,20.5,24.8,30,15,30z" />
+              </g>
+              <polygon id="XMLID_232_" fill="#0080FF" points="15,24.2 9.2,24.2 9.2,18.4 9.2,18.4 15,18.4 15,18.4" />
+              <polygon id="XMLID_228_" fill="#0080FF" points="9.2,28.7 4.8,28.7 4.8,28.7 4.8,24.2 9.2,24.2" />
+              <polygon id="XMLID_226_" fill="#0080FF" points="4.8,24.2 1,24.2 1,24.2 1,20.5 1,20.5 4.8,20.5 4.8,20.5" />
+            </g>
+          </g>
+        </g>
+      </g>
+    </svg>
+    <div class="copyright">&copy; 2023 DigitalOcean, LLC. All rights reserved.</div>
+  </div>
+
+  <div class="content">
+    <svg width="89" height="62" viewBox="0 0 89 62" fill="none" xmlns="http://www.w3.org/2000/svg">
+      <path
+        d="M78.4046 17.1912C84.738 21.1608 86.2188 20.7419 87.6794 19.9955C88.5202 19.5664 88.8496 18.5392 88.4243 17.6985C86.4622 13.818 78.212 0.118992 59.5364 0.118992C43.8588 0.118992 34.4377 13.3435 31.5684 18.0766C31.0067 19.0027 31.4447 20.2158 32.4755 20.5543C34.1357 21.0995 35.9508 21.216 39.8333 18.8625C52.5306 11.8038 78.4046 17.1912 78.4046 17.1912Z"
+        fill="#F15B55" />
+      <mask id="mask0_55_415" style="mask-type:alpha" maskUnits="userSpaceOnUse" x="31" y="0" width="58" height="21">
+        <path
+          d="M78.4212 17.0723C84.7546 21.0418 86.2354 20.6229 87.696 19.8766C88.5368 19.4474 88.8662 18.4202 88.4409 17.5795C86.4788 13.699 78.2286 3.8147e-06 59.553 3.8147e-06C43.8754 3.8147e-06 34.4543 13.2245 31.585 17.9576C31.0233 18.8837 31.4613 20.0969 32.4921 20.4353C34.1523 20.9805 35.9674 21.097 39.8499 18.7436C52.5472 11.6848 78.4212 17.0723 78.4212 17.0723Z"
+          fill="#F15B55" />
+      </mask>
+      <g mask="url(#mask0_55_415)">
+        <path d="M43.7907 2.62413C49.4945 9.99967 33.5952 13.8544 45.8049 22.3539" stroke="#FF9580" stroke-width="1.5"
+          stroke-miterlimit="10" />
+        <path d="M56.7977 -1.62458C62.8837 6.0383 46.832 8.92189 53.8305 19.6981" stroke="#FF9580" stroke-width="1.5"
+          stroke-miterlimit="10" />
+        <path d="M72.3168 -0.867853C76.7291 7.02473 58.5477 8.73199 64.5571 18.3322" stroke="#FF9580" stroke-width="1.5"
+          stroke-miterlimit="10" />
+        <path d="M84.2603 7.02465C84.2603 15.1449 71.708 10.5128 72.3169 19.6982" stroke="#FF9580" stroke-width="1.5"
+          stroke-miterlimit="10" />
+      </g>
+      <g opacity="0.399994">
+        <g opacity="0.399994">
+          <path opacity="0.399994"
+            d="M31.3365 18.747C31.2415 19.5146 31.6815 20.2937 32.4751 20.5544C34.1353 21.0993 35.9508 21.2158 39.8333 18.8623C52.5302 11.8039 78.4042 17.1914 78.4042 17.1914C84.7377 21.1606 86.2184 20.7416 87.6795 19.9957C88.3903 19.6328 88.7337 18.8419 88.5657 18.0976C78.1555 10.8635 54.5866 3.8145 31.3365 18.747Z"
+            fill="black" />
+        </g>
+      </g>
+      <path
+        d="M67.274 14.8087H56.4204C44.6233 14.8087 38.4193 18.2775 33.8378 24.2005L29.4542 29.8671L27.7038 32.1805C26.3653 33.9491 24.2728 34.9885 22.0517 34.9885C18.6867 34.9885 15.8194 32.6685 15.0623 29.48C15.0512 29.433 15.0385 29.359 15.025 29.2679C14.9103 28.4884 15.5203 27.7899 16.3099 27.7899H18.4798C22.2049 27.7899 25.2246 24.7776 25.2246 21.0614V20.5325C25.2246 19.8467 24.667 19.2904 23.979 19.2904H17.6005C15.0492 19.2904 13.2669 20.6106 12.6674 22.0612C12.0676 20.6106 10.2853 19.2904 7.73397 19.2904H1.35542C0.667492 19.2904 0.109863 19.8467 0.109863 20.5325V21.0614C0.109863 24.7776 3.12951 27.7899 6.85471 27.7899H9.05492C9.75186 27.7899 10.3443 28.2988 10.4476 28.9867L10.6905 30.604C13.3361 48.2223 28.5057 61.2576 46.3638 61.2576H47.2697H59.4081C71.7445 61.2576 82.2727 52.3616 84.302 40.2227L85.8397 31.0254C87.259 22.5369 81.2902 14.8087 67.274 14.8087Z"
+        fill="#07CBCF" />
+      <path
+        d="M81.4705 48.3116C79.3404 48.386 77.5986 49.0698 75.2239 51.4388C72.2001 54.4552 67.1794 57.8702 59.4197 57.8702H45.0417C39.2224 57.8702 35.1162 53.5434 35.1162 53.5434C35.1162 53.5434 31.7479 53.7154 24.4261 49.5603C12.4254 41.9906 11.9501 29.2979 11.7788 27.7043C11.6076 26.1106 10.7517 25.2568 9.04025 25.2568H6.70074C2.34293 25.2568 1.16088 23.1183 0.893741 19.3792C0.434853 19.5628 0.110352 20.0095 0.110352 20.5327V21.0612C0.110352 24.7773 3.13 27.7897 6.85479 27.7897H9.055C9.75235 27.7897 10.3448 28.2986 10.4481 28.9864L10.6906 30.6038C13.3362 48.2221 28.5062 61.2573 46.3643 61.2573H47.2698H59.4086C68.7888 61.2573 77.1226 56.113 81.4705 48.3116Z"
+        fill="#05B7BF" />
+      <path
+        d="M15.0249 29.2677C14.9102 28.4883 15.5203 27.7898 16.3098 27.7898H18.4797C22.2049 27.7898 25.2246 24.7774 25.2246 21.0617V20.5328C25.2246 20.0092 24.8997 19.5624 24.4404 19.3793V19.3797C24.1728 23.1184 22.9908 25.2569 18.633 25.2569H16.8376C14.4411 25.2569 14.7549 27.9512 15.0249 29.2677Z"
+        fill="#05B7BF" />
+      <path
+        d="M24.4257 49.5606C27.1262 52.1789 25.7188 53.2412 21.2307 53.2412H14.3327C13.2428 53.2412 12.697 54.5557 13.4677 55.3245L14.322 56.1767C16.9737 58.8224 20.5707 60.3085 24.3213 60.3085H24.9584C32.4133 60.3085 37.929 52.8239 37.929 52.8239L24.4257 49.5606Z"
+        fill="#07CBCF" />
+      <path
+        d="M35.1162 53.544C32.9984 55.5574 29.4485 58.1536 25.2235 58.1536H24.6339C21.1631 58.1536 17.8345 56.7783 15.3807 54.33L14.59 53.5415C14.497 53.4488 14.4257 53.3474 14.3728 53.2411H14.3327C13.2428 53.2411 12.697 54.5556 13.4677 55.3244L14.322 56.1766C16.9741 58.8223 20.5711 60.3085 24.3213 60.3085H24.9584C29.8025 60.3085 33.8281 57.1482 36.0533 54.9349L36.3528 54.6312L35.1162 53.544Z"
+        fill="#05B7BF" />
+      <mask id="mask1_55_415" style="mask-type:alpha" maskUnits="userSpaceOnUse" x="0" y="15" width="86" height="47">
+        <path
+          d="M67.1641 15.1884H56.3106C44.5134 15.1884 38.3094 18.6572 33.7279 24.5802L29.3443 30.2468L27.594 32.5602C26.2554 34.3288 24.163 35.3682 21.9419 35.3682C18.5768 35.3682 15.7096 33.0482 14.9524 29.8597C14.9413 29.8127 14.9286 29.7387 14.9151 29.6476C14.8004 28.8681 15.4105 28.1696 16.2 28.1696H18.3699C22.0951 28.1696 25.1147 25.1573 25.1147 21.4411V20.9122C25.1147 20.2264 24.5571 19.6701 23.8692 19.6701H17.4906C14.9393 19.6701 13.157 20.9903 12.5576 22.4409C11.9577 20.9903 10.1755 19.6701 7.62411 19.6701H1.24555C0.557629 19.6701 0 20.2264 0 20.9122V21.4411C0 25.1573 3.01965 28.1696 6.74484 28.1696H8.94506C9.64199 28.1696 10.2344 28.6785 10.3377 29.3664L10.5807 30.9837C13.2262 48.602 28.3958 61.6373 46.2539 61.6373H47.1598H59.2983C71.6346 61.6373 82.1628 52.7413 84.1922 40.6024L85.7299 31.4051C87.1491 22.9166 81.1803 15.1884 67.1641 15.1884Z"
+          fill="#07CBCF" />
+      </mask>
+      <g mask="url(#mask1_55_415)">
+        <path
+          d="M48.2573 43.0378C50.1929 48.5818 55.4426 52.9185 61.7015 52.9185C72.2568 52.9185 71.2993 45.7048 82.7326 45.7048H84.3526"
+          stroke="#00576C" stroke-width="1.46" stroke-miterlimit="10" stroke-linecap="round" />
+        <path d="M50.1195 43.0151H46.9814" stroke="#00576C" stroke-width="1.46" stroke-miterlimit="10"
+          stroke-linecap="round" />
+        <path
+          d="M65.353 42.7305C65.353 41.096 64.0247 39.7709 62.3862 39.7709C60.7478 39.7709 59.4194 41.096 59.4194 42.7305"
+          stroke="#00576C" stroke-width="1.46" stroke-miterlimit="10" stroke-linecap="round" />
+      </g>
+      <path
+        d="M77.4491 19.774C80.7847 21.9824 82.0434 23.4419 85.095 23.7701C82.9402 18.5919 77.0788 14.8087 67.2741 14.8087H56.4206C45.0819 14.8087 38.9111 18.0148 34.3804 23.5229C37.2443 23.5229 40.3812 21.1661 43.0628 19.698C46.182 17.9907 50.3669 16.3586 59.4197 16.3586C68.4725 16.3586 73.2651 17.004 77.4491 19.774Z"
+        fill="#05B7BF" />
+    </svg>
+
+    <h1 class="title">Please log into your Droplet with SSH to configure the Dokku installation.</h1>
+    <p class="description">See the Dokku 1-Click Quickstart guide for detailed assistance.</p>
+    <a class="button" href="https://do.co/dokku1804#start">Quickstart Guide</a>
+  </div>
+</body>
+
+</html>

contrib/images/digitalocean/in_parts/011-docker

@@ -0,0 +1,45 @@
+#!/bin/bash
+set -eo pipefail
+set -o errexit
+
+export DEBIAN_FRONTEND=noninteractive
+
+pkgs=(ca-certificates
+  curl
+  jq
+  linux-image-extra-virtual
+)
+
+echo '--> Updating apt repositories'
+apt-get -qqy update
+
+echo '--> Updating all packages'
+apt-get -qqy -o Dpkg::Options::='--force-confdef' -o Dpkg::Options::='--force-confold' full-upgrade
+
+echo "--> Installing basic dependencies: ${pkgs[*]}"
+apt-get -qqy install "${pkgs[@]}"
+
+echo '--> Setting up docker apt repository'
+curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
+
+cat >/etc/apt/sources.list.d/docker.list <<EOM
+deb [arch=amd64 signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu $(lsb_release -c -s) stable
+EOM
+
+echo '--> Installing docker-ce'
+apt-get -y update
+apt-get -y install docker-ce docker-buildx-plugin docker-compose-plugin
+
+echo '--> Enabling docker-ce'
+systemctl enable docker
+systemctl start docker
+
+echo '--> Enabling docker live-restore'
+if [[ ! -f /etc/docker/daemon.json ]]; then
+  echo "{}" >/etc/docker/daemon.json
+fi
+
+config="$(jq '. + {"live-restore": true}' /etc/docker/daemon.json)"
+echo "$config" >/etc/docker/daemon.json
+systemctl reload docker
+docker info | grep -i live

contrib/images/digitalocean/in_parts/011-ssh-message

@@ -0,0 +1,10 @@
+#!/bin/bash
+set -eo pipefail
+set -o errexit
+
+echo '--> Prevent login until after setup is complete'
+# Be a bit of a dork about login in
+cat >>/etc/ssh/sshd_config <<EOM
+Match User root
+        ForceCommand echo "Please wait while we get your droplet ready..."
+EOM

contrib/images/digitalocean/in_parts/012-dokku-packages

@@ -0,0 +1,66 @@
+#!/bin/bash
+set -eo pipefail
+set -o errexit
+
+export DEBIAN_FRONTEND=noninteractive
+
+pkgs=(apache2-utils
+  bash-completion
+  locales
+  git
+  cpio
+  curl
+  man-db
+
+  netcat-traditional
+  net-tools
+
+  parallel
+  python3-software-properties
+  rsync
+  rsyslog
+  dos2unix
+  jq
+  unzip
+
+  nginx
+  bind9-dnsutils
+  cgroupfs-mount
+  cgroup-lite
+  sudo
+  python3
+  debconf
+)
+
+dokku_pkgs=(docker-container-healthchecker
+  docker-image-labeler
+  gliderlabs-sigil
+  lambda-builder
+  netrc
+  plugn
+  procfile-util
+  sshcommand
+)
+
+echo '--> Install core dependencies for dokku'
+apt-get -y install "${pkgs[@]}"
+
+echo '--> Setting up dokku apt repository'
+curl -fsSL https://packagecloud.io/dokku/dokku/gpgkey -o /etc/apt/keyrings/dokku.asc
+
+cat >/etc/apt/sources.list.d/dokku.list <<EOM
+deb [arch=amd64 signed-by=/etc/apt/keyrings/dokku.asc]  https://packagecloud.io/dokku/dokku/ubuntu/ noble main
+EOM
+
+echo '--> Install dependencies for dokku from new repository'
+apt-get -y clean
+apt-get -y update
+apt-get -y install "${dokku_pkgs[@]}"
+rm -f /etc/nginx/sites-enabled/default
+
+echo '--> Pre-cache dokku bits that are must run on boot'
+apt-get -y clean
+apt-get -y install --download-only "dokku=${DOKKU_VERSION}" dokku-event-listener herokuish
+
+mkdir -p /var/lib/digitalocean/debs
+cp -au /var/cache/apt/archives/*deb /var/lib/digitalocean/debs

contrib/images/digitalocean/in_parts/012-grub-opts

@@ -0,0 +1,9 @@
+#!/bin/bash
+set -eo pipefail
+set -o errexit
+
+echo '--> Update grub boot loader'
+sed -e 's|GRUB_CMDLINE_LINUX="|GRUB_CMDLINE_LINUX="cgroup_enable=memory swapaccount=1|g' \
+  -i /etc/default/grub
+
+update-grub

contrib/images/digitalocean/in_parts/014-docker-dns

@@ -0,0 +1,7 @@
+#!/bin/bash
+set -eo pipefail
+set -o errexit
+
+echo '--> Enable Google DNS for Docker'
+sed -e 's|#DOCKER_OPTS|DOCKER_OPTS|g' \
+  -i /etc/default/docker

contrib/images/digitalocean/in_parts/014-ufw-rules

@@ -0,0 +1,12 @@
+#!/bin/bash
+set -eo pipefail
+set -o errexit
+
+echo '--> Enable and configure UFW'
+sed -e 's|DEFAULT_FORWARD_POLICY=.*|DEFAULT_FORWARD_POLICY="ACCEPT"|g' \
+  -i /etc/default/ufw
+
+ufw limit ssh
+ufw allow 'Nginx Full'
+
+ufw --force enable

contrib/images/digitalocean/in_parts/099-application_tag

@@ -0,0 +1,21 @@
+#!/bin/bash
+set -eo pipefail
+set -o errexit
+
+echo '--> Write the application info'
+application_version="$DOKKU_VERSION"
+build_date="$(date -I)"
+distro_arch="$(uname -m)"
+distro_codename="$(lsb_release -sc)"
+distro_release="$(lsb_release -sr)"
+distro="$(lsb_release -si)"
+
+cat >/var/lib/digitalocean/application.info <<EOM
+appiication_name="Dokku"
+build_date="${build_date}"
+distro="${distro}"
+distro_release="${distro_release}"
+distro_codename="${distro_codename}"
+distro_arch="${distro_arch}"
+application_version="${application_version}"
+EOM

contrib/images/digitalocean/in_parts/099-cleanup

@@ -0,0 +1,52 @@
+#!/bin/bash
+set -eo pipefail
+set -o errexit
+
+echo '--> Cleaning up tmp dir'
+# Ensure /tmp exists and has the proper permissions before
+# checking for security updates
+# https://github.com/digitalocean/marketplace-partners/issues/94
+if [[ ! -d /tmp ]]; then
+  mkdir /tmp
+fi
+chmod 1777 /tmp
+rm -rf /tmp/* /var/tmp/*
+
+echo '--> Cleaning up apt'
+export DEBIAN_FRONTEND=noninteractive
+apt-get -y update
+apt-get -o Dpkg::Options::="--force-confold" upgrade -q -y --force-yes
+apt-get -y autoremove
+apt-get -y autoclean
+apt-get -y purge droplet-agent
+
+echo '--> Clearing history'
+history -c
+cat /dev/null >/root/.bash_history
+unset HISTFILE
+
+echo '--> Clearing log files'
+find /var/log -mtime -1 -type f -exec truncate -s 0 {} \;
+rm -rf /var/log/*.gz /var/log/*.[0-9] /var/log/*-????????
+cat /dev/null >/var/log/lastlog
+cat /dev/null >/var/log/wtmp
+rm -rf /var/lib/cloud/instances/*
+rm -rf /tmp/* /var/tmp/*
+
+echo '--> Removing keys'
+rm -f /root/.ssh/authorized_keys /etc/ssh/*key*
+touch /etc/ssh/revoked_keys
+chmod 600 /etc/ssh/revoked_keys
+
+echo '--> DO Directory contents'
+ls -lah /opt/digitalocean || true
+
+echo '--> Securely erase the unused portion of the filesystem'
+printf "\n\033[0;32mWriting zeros to the remaining disk space to securely
+erase the unused portion of the file system.
+Depending on your disk size this may take several minutes.
+The secure erase will complete successfully when you see:\033[0m
+    dd: writing to '/zerofile': No space left on device\n
+Beginning secure erase now\n"
+
+dd if=/dev/zero of=/zerofile bs=4096 || rm /zerofile

contrib/images/digitalocean/in_parts/100-image-check

@@ -0,0 +1,631 @@
+#!/bin/bash
+
+# DigitalOcean Marketplace Image Validation Tool
+# © 2021-2022 DigitalOcean LLC.
+# This code is licensed under Apache 2.0 license (see LICENSE.md for details)
+
+VERSION="v. 1.8.1"
+RUNDATE=$(date)
+
+# Script should be run with SUDO
+if [ "$EUID" -ne 0 ]; then
+  echo "[Error] - This script must be run with sudo or as the root user."
+  exit 1
+fi
+
+STATUS=0
+PASS=0
+WARN=0
+FAIL=0
+
+# $1 == command to check for
+# returns: 0 == true, 1 == false
+cmdExists() {
+  if command -v "$1" >/dev/null 2>&1; then
+    return 0
+  else
+    return 1
+  fi
+}
+
+function getDistro {
+  if [ -f /etc/os-release ]; then
+    # freedesktop.org and systemd
+    . /etc/os-release
+    OS=$NAME
+    VER=$VERSION_ID
+  elif type lsb_release >/dev/null 2>&1; then
+    # linuxbase.org
+    OS=$(lsb_release -si)
+    VER=$(lsb_release -sr)
+  elif [ -f /etc/lsb-release ]; then
+    # For some versions of Debian/Ubuntu without lsb_release command
+    . /etc/lsb-release
+    OS=$DISTRIB_ID
+    VER=$DISTRIB_RELEASE
+  elif [ -f /etc/debian_version ]; then
+    # Older Debian/Ubuntu/etc.
+    OS=Debian
+    VER=$(cat /etc/debian_version)
+  elif [ -f /etc/SuSe-release ]; then
+    # Older SuSE/etc.
+    :
+  elif [ -f /etc/redhat-release ]; then
+    # Older Red Hat, CentOS, etc.
+    VER=$(cut -d" " -f3 </etc/redhat-release | cut -d "." -f1)
+    d=$(cut -d" " -f1 </etc/redhat-release | cut -d "." -f1)
+    if [[ $d == "CentOS" ]]; then
+      OS="CentOS Linux"
+    fi
+  else
+    # Fall back to uname, e.g. "Linux <version>", also works for BSD, etc.
+    OS=$(uname -s)
+    VER=$(uname -r)
+  fi
+}
+function loadPasswords {
+  SHADOW=$(cat /etc/shadow)
+}
+
+function checkAgent {
+  # Check for the presence of the DO directory in the filesystem
+  if [ -d /opt/digitalocean ]; then
+    echo -en "\e[41m[FAIL]\e[0m DigitalOcean directory detected.\n"
+    ((FAIL++))
+    STATUS=2
+    if [[ $OS == "CentOS Linux" ]] || [[ $OS == "CentOS Stream" ]] || [[ $OS == "Rocky Linux" ]] || [[ $OS == "AlmaLinux" ]]; then
+      echo "To uninstall the agent: 'sudo yum remove droplet-agent'"
+      echo "To remove the DO directory: 'find /opt/digitalocean/ -type d -empty -delete'"
+    elif [[ $OS == "Ubuntu" ]] || [[ $OS == "Debian" ]]; then
+      echo "To uninstall the agent and remove the DO directory: 'sudo apt-get purge droplet-agent'"
+    fi
+  else
+    echo -en "\e[32m[PASS]\e[0m DigitalOcean Monitoring agent was not found\n"
+    ((PASS++))
+  fi
+}
+
+function checkLogs {
+  cp_ignore="/var/log/cpanel-install.log"
+  echo -en "\nChecking for log files in /var/log\n\n"
+  # Check if there are log archives or log files that have not been recently cleared.
+  for f in /var/log/*-????????; do
+    [[ -e $f ]] || break
+    if [ "${f}" != "${cp_ignore}" ]; then
+      echo -en "\e[93m[WARN]\e[0m Log archive ${f} found; Contents:\n"
+      cat "${f}"
+      ((WARN++))
+      if [[ $STATUS != 2 ]]; then
+        STATUS=1
+      fi
+    fi
+  done
+  for f in /var/log/*.[0-9]; do
+    [[ -e $f ]] || break
+    echo -en "\e[93m[WARN]\e[0m Log archive ${f} found; Contents:\n"
+    cat "${f}"
+    ((WARN++))
+    if [[ $STATUS != 2 ]]; then
+      STATUS=1
+    fi
+  done
+  for f in /var/log/*.log; do
+    [[ -e $f ]] || break
+    if [[ "${f}" = '/var/log/lfd.log' && "$(grep -E -v '/var/log/messages has been reset| Watching /var/log/messages' "${f}" | wc -c)" -gt 50 ]]; then
+      if [ "${f}" != "${cp_ignore}" ]; then
+        echo -en "\e[93m[WARN]\e[0m un-cleared log file, ${f} found; Contents:\n"
+        cat "${f}"
+        ((WARN++))
+        if [[ $STATUS != 2 ]]; then
+          STATUS=1
+        fi
+      fi
+    elif [[ "${f}" != '/var/log/lfd.log' && "$(wc -c <"${f}")" -gt 50 ]]; then
+      if [ "${f}" != "${cp_ignore}" ]; then
+        echo -en "\e[93m[WARN]\e[0m un-cleared log file, ${f} found; Contents:\n"
+        cat "${f}"
+        ((WARN++))
+        if [[ $STATUS != 2 ]]; then
+          STATUS=1
+        fi
+      fi
+    fi
+  done
+}
+function checkTMP {
+  # Check the /tmp directory to ensure it is empty.  Warn on any files found.
+  if [[ -n "$(ls -A /tmp)" ]]; then
+    echo -en "\e[93m[WARN]\e[0m /tmp directory is not empty; Contents\n"
+    ls -A /tmp
+    ((WARN++))
+    return 1
+  fi
+
+  echo -en "\e[32m[PASS]\e[0m /tmp directory is empty\n"
+  return 0
+}
+function checkRoot {
+  user="root"
+  uhome="/root"
+  for usr in $SHADOW; do
+    IFS=':' read -r -a u <<<"$usr"
+    if [[ "${u[0]}" == "${user}" ]]; then
+      if [[ ${u[1]} == "!" ]] || [[ ${u[1]} == "!!" ]] || [[ ${u[1]} == "*" ]]; then
+        echo -en "\e[32m[PASS]\e[0m User ${user} has no password set.\n"
+        ((PASS++))
+      else
+        echo -en "\e[41m[FAIL]\e[0m User ${user} has a password set on their account.\n"
+        ((FAIL++))
+        STATUS=2
+      fi
+    fi
+  done
+  if [ -d ${uhome}/ ]; then
+    if [ -d ${uhome}/.ssh/ ]; then
+      if ls ${uhome}/.ssh/* >/dev/null 2>&1; then
+        for key in "${uhome}"/.ssh/*; do
+          if [ "${key}" == "${uhome}/.ssh/authorized_keys" ]; then
+
+            if [ "$(wc -c <"${key}")" -gt 50 ]; then
+              echo -en "\e[41m[FAIL]\e[0m User \e[1m${user}\e[0m has a populated authorized_keys file in \e[93m${key}\e[0m\n"
+              akey=$(cat "${key}")
+              echo "File Contents:"
+              echo "$akey"
+              echo "--------------"
+              ((FAIL++))
+              STATUS=2
+            fi
+          elif [ "${key}" == "${uhome}/.ssh/id_rsa" ]; then
+            if [ "$(wc -c <"${key}")" -gt 0 ]; then
+              echo -en "\e[41m[FAIL]\e[0m User \e[1m${user}\e[0m has a private key file in \e[93m${key}\e[0m\n"
+              akey=$(cat "${key}")
+              echo "File Contents:"
+              echo "$akey"
+              echo "--------------"
+              ((FAIL++))
+              STATUS=2
+            else
+              echo -en "\e[93m[WARN]\e[0m User \e[1m${user}\e[0m has empty private key file in \e[93m${key}\e[0m\n"
+              ((WARN++))
+              if [[ $STATUS != 2 ]]; then
+                STATUS=1
+              fi
+            fi
+          elif [ "${key}" != "${uhome}/.ssh/known_hosts" ]; then
+            echo -en "\e[93m[WARN]\e[0m User \e[1m${user}\e[0m has a file in their .ssh directory at \e[93m${key}\e[0m\n"
+            ((WARN++))
+            if [[ $STATUS != 2 ]]; then
+              STATUS=1
+            fi
+          else
+            if [ "$(wc -c <"${key}")" -gt 50 ]; then
+              echo -en "\e[93m[WARN]\e[0m User \e[1m${user}\e[0m has a populated known_hosts file in \e[93m${key}\e[0m\n"
+              ((WARN++))
+              if [[ $STATUS != 2 ]]; then
+                STATUS=1
+              fi
+            fi
+          fi
+        done
+      else
+        echo -en "\e[32m[ OK ]\e[0m User \e[1m${user}\e[0m has no SSH keys present\n"
+      fi
+    else
+      echo -en "\e[32m[ OK ]\e[0m User \e[1m${user}\e[0m does not have an .ssh directory\n"
+    fi
+    if [ -f /root/.bash_history ]; then
+
+      BH_S=$(wc -c </root/.bash_history)
+
+      if [[ $BH_S -lt 200 ]]; then
+        echo -en "\e[32m[PASS]\e[0m ${user}'s Bash History appears to have been cleared\n"
+        ((PASS++))
+      else
+        echo -en "\e[41m[FAIL]\e[0m ${user}'s Bash History should be cleared to prevent sensitive information from leaking\n"
+        ((FAIL++))
+        STATUS=2
+      fi
+
+      return 1
+    else
+      echo -en "\e[32m[PASS]\e[0m The Root User's Bash History is not present\n"
+      ((PASS++))
+    fi
+  else
+    echo -en "\e[32m[ OK ]\e[0m User \e[1m${user}\e[0m does not have a directory in /home\n"
+  fi
+  echo -en "\n\n"
+  return 1
+}
+
+function checkUsers {
+  # Check each user-created account
+  awk -F: '$3 >= 1000 && $1 != "nobody" {print $1}' </etc/passwd | while IFS= read -r user; do
+    # Skip some other non-user system accounts
+    if [[ $user == "centos" ]]; then
+      :
+    elif [[ $user == "nfsnobody" ]]; then
+      :
+    else
+      echo -en "\nChecking user: ${user}...\n"
+      for usr in $SHADOW; do
+        IFS=':' read -r -a u <<<"$usr"
+        if [[ "${u[0]}" == "${user}" ]]; then
+          if [[ ${u[1]} == "!" ]] || [[ ${u[1]} == "!!" ]] || [[ ${u[1]} == "*" ]]; then
+            echo -en "\e[32m[PASS]\e[0m User ${user} has no password set.\n"
+            ((PASS++))
+          else
+            echo -en "\e[41m[FAIL]\e[0m User ${user} has a password set on their account. Only system users are allowed on the image.\n"
+            ((FAIL++))
+            STATUS=2
+          fi
+        fi
+      done
+      #echo "User Found: ${user}"
+      uhome="/home/${user}"
+      if [ -d "${uhome}/" ]; then
+        if [ -d "${uhome}/.ssh/" ]; then
+          if ls "${uhome}/.ssh/*" >/dev/null 2>&1; then
+            for key in "${uhome}"/.ssh/*; do
+              if [ "${key}" == "${uhome}/.ssh/authorized_keys" ]; then
+                if [ "$(wc -c <"${key}")" -gt 50 ]; then
+                  echo -en "\e[41m[FAIL]\e[0m User \e[1m${user}\e[0m has a populated authorized_keys file in \e[93m${key}\e[0m\n"
+                  akey=$(cat "${key}")
+                  echo "File Contents:"
+                  echo "$akey"
+                  echo "--------------"
+                  ((FAIL++))
+                  STATUS=2
+                fi
+              elif [ "${key}" == "${uhome}/.ssh/id_rsa" ]; then
+                if [ "$(wc -c <"${key}")" -gt 0 ]; then
+                  echo -en "\e[41m[FAIL]\e[0m User \e[1m${user}\e[0m has a private key file in \e[93m${key}\e[0m\n"
+                  akey=$(cat "${key}")
+                  echo "File Contents:"
+                  echo "$akey"
+                  echo "--------------"
+                  ((FAIL++))
+                  STATUS=2
+                else
+                  echo -en "\e[93m[WARN]\e[0m User \e[1m${user}\e[0m has empty private key file in \e[93m${key}\e[0m\n"
+                  ((WARN++))
+                  if [[ $STATUS != 2 ]]; then
+                    STATUS=1
+                  fi
+                fi
+              elif [ "${key}" != "${uhome}/.ssh/known_hosts" ]; then
+
+                echo -en "\e[93m[WARN]\e[0m User \e[1m${user}\e[0m has a file in their .ssh directory named \e[93m${key}\e[0m\n"
+                ((WARN++))
+                if [[ $STATUS != 2 ]]; then
+                  STATUS=1
+                fi
+
+              else
+                if [ "$(wc -c <"${key}")" -gt 50 ]; then
+                  echo -en "\e[93m[WARN]\e[0m User \e[1m${user}\e[0m has a known_hosts file in \e[93m${key}\e[0m\n"
+                  ((WARN++))
+                  if [[ $STATUS != 2 ]]; then
+                    STATUS=1
+                  fi
+                fi
+              fi
+
+            done
+          else
+            echo -en "\e[32m[ OK ]\e[0m User \e[1m${user}\e[0m has no SSH keys present\n"
+          fi
+        else
+          echo -en "\e[32m[ OK ]\e[0m User \e[1m${user}\e[0m does not have an .ssh directory\n"
+        fi
+      else
+        echo -en "\e[32m[ OK ]\e[0m User \e[1m${user}\e[0m does not have a directory in /home\n"
+      fi
+
+      # Check for an uncleared .bash_history for this user
+      if [ -f "${uhome}/.bash_history" ]; then
+        BH_S=$(wc -c <"${uhome}/.bash_history")
+
+        if [[ $BH_S -lt 200 ]]; then
+          echo -en "\e[32m[PASS]\e[0m ${user}'s Bash History appears to have been cleared\n"
+          ((PASS++))
+        else
+          echo -en "\e[41m[FAIL]\e[0m ${user}'s Bash History should be cleared to prevent sensitive information from leaking\n"
+          ((FAIL++))
+          STATUS=2
+
+        fi
+        echo -en "\n\n"
+      fi
+    fi
+  done
+}
+function checkFirewall {
+
+  if [[ $OS == "Ubuntu" ]]; then
+    fw="ufw"
+    ufwa=$(ufw status | head -1 | sed -e "s/^Status:\ //")
+    if [[ $ufwa == "active" ]]; then
+      FW_VER="\e[32m[PASS]\e[0m Firewall service (${fw}) is active\n"
+      ((PASS++))
+    else
+      FW_VER="\e[93m[WARN]\e[0m No firewall is configured. Ensure ${fw} is installed and configured\n"
+      ((WARN++))
+    fi
+  elif [[ $OS == "CentOS Linux" ]] || [[ $OS == "CentOS Stream" ]] || [[ $OS == "Rocky Linux" ]] || [[ $OS == "AlmaLinux" ]]; then
+    if [ -f /usr/lib/systemd/system/csf.service ]; then
+      fw="csf"
+      if systemctl status $fw >/dev/null 2>&1; then
+
+        FW_VER="\e[32m[PASS]\e[0m Firewall service (${fw}) is active\n"
+        ((PASS++))
+      elif cmdExists "firewall-cmd"; then
+        if [[ $(systemctl is-active firewalld >/dev/null 2>&1 && echo 1 || echo 0) ]]; then
+          FW_VER="\e[32m[PASS]\e[0m Firewall service (${fw}) is active\n"
+          ((PASS++))
+        else
+          FW_VER="\e[93m[WARN]\e[0m No firewall is configured. Ensure ${fw} is installed and configured\n"
+          ((WARN++))
+        fi
+      else
+        FW_VER="\e[93m[WARN]\e[0m No firewall is configured. Ensure ${fw} is installed and configured\n"
+        ((WARN++))
+      fi
+    else
+      fw="firewalld"
+      if [[ $(systemctl is-active firewalld >/dev/null 2>&1 && echo 1 || echo 0) ]]; then
+        FW_VER="\e[32m[PASS]\e[0m Firewall service (${fw}) is active\n"
+        ((PASS++))
+      else
+        FW_VER="\e[93m[WARN]\e[0m No firewall is configured. Ensure ${fw} is installed and configured\n"
+        ((WARN++))
+      fi
+    fi
+  elif [[ "$OS" =~ Debian.* ]]; then
+    # user could be using a number of different services for managing their firewall
+    # we will check some of the most common
+    if cmdExists 'ufw'; then
+      fw="ufw"
+      ufwa=$(ufw status | head -1 | sed -e "s/^Status:\ //")
+      if [[ $ufwa == "active" ]]; then
+        FW_VER="\e[32m[PASS]\e[0m Firewall service (${fw}) is active\n"
+        ((PASS++))
+      else
+        FW_VER="\e[93m[WARN]\e[0m No firewall is configured. Ensure ${fw} is installed and configured\n"
+        ((WARN++))
+      fi
+    elif cmdExists "firewall-cmd"; then
+      fw="firewalld"
+      if [[ $(systemctl is-active --quiet $fw) ]]; then
+        FW_VER="\e[32m[PASS]\e[0m Firewall service (${fw}) is active\n"
+        ((PASS++))
+      else
+        FW_VER="\e[93m[WARN]\e[0m No firewall is configured. Ensure ${fw} is installed and configured\n"
+        ((WARN++))
+      fi
+    else
+      # user could be using vanilla iptables, check if kernel module is loaded
+      fw="iptables"
+      if lsmod | grep -q '^ip_tables' 2>/dev/null; then
+        FW_VER="\e[32m[PASS]\e[0m Firewall service (${fw}) is active\n"
+        ((PASS++))
+      else
+        FW_VER="\e[93m[WARN]\e[0m No firewall is configured. Ensure ${fw} is installed and configured\n"
+        ((WARN++))
+      fi
+    fi
+  fi
+
+}
+function checkUpdates {
+  if [[ $OS == "Ubuntu" ]] || [[ "$OS" =~ Debian.* ]]; then
+    # Ensure /tmp exists and has the proper permissions before
+    # checking for security updates
+    # https://github.com/digitalocean/marketplace-partners/issues/94
+    if [[ ! -d /tmp ]]; then
+      mkdir /tmp
+    fi
+    chmod 1777 /tmp
+
+    echo -en "\nUpdating apt package database to check for security updates, this may take a minute...\n\n"
+    apt-get -y update >/dev/null
+
+    uc=$(apt-get --just-print upgrade | grep -i "security" -c)
+    if [[ $uc -gt 0 ]]; then
+      update_count=$((uc / 2))
+    else
+      update_count=0
+    fi
+
+    if [[ $update_count -gt 0 ]]; then
+      echo -en "\e[41m[FAIL]\e[0m There are ${update_count} security updates available for this image that have not been installed.\n"
+      echo -en
+      echo -en "Here is a list of the security updates that are not installed:\n"
+      sleep 2
+      apt-get --just-print upgrade | grep -i security | awk '{print $2}' | awk '!seen[$0]++'
+      echo -en
+      ((FAIL++))
+      STATUS=2
+    else
+      echo -en "\e[32m[PASS]\e[0m There are no pending security updates for this image.\n\n"
+      ((PASS++))
+    fi
+  elif [[ $OS == "CentOS Linux" ]] || [[ $OS == "CentOS Stream" ]] || [[ $OS == "Rocky Linux" ]] || [[ $OS == "AlmaLinux" ]]; then
+    echo -en "\nChecking for available security updates, this may take a minute...\n\n"
+
+    update_count=$(yum check-update --security --quiet | wc -l)
+    if [[ $update_count -gt 0 ]]; then
+      echo -en "\e[41m[FAIL]\e[0m There are ${update_count} security updates available for this image that have not been installed.\n"
+      ((FAIL++))
+      STATUS=2
+    else
+      echo -en "\e[32m[PASS]\e[0m There are no pending security updates for this image.\n"
+      ((PASS++))
+    fi
+  else
+    echo "Error encountered"
+    exit 1
+  fi
+
+  return 1
+}
+function checkCloudInit {
+
+  if hash cloud-init 2>/dev/null; then
+    CI="\e[32m[PASS]\e[0m Cloud-init is installed.\n"
+    ((PASS++))
+  else
+    CI="\e[41m[FAIL]\e[0m No valid verison of cloud-init was found.\n"
+    ((FAIL++))
+    STATUS=2
+  fi
+  return 1
+}
+
+clear
+echo "DigitalOcean Marketplace Image Validation Tool ${VERSION}"
+echo "Executed on: ${RUNDATE}"
+echo "Checking local system for Marketplace compatibility..."
+
+getDistro
+
+echo -en "\n\e[1mDistribution:\e[0m ${OS}\n"
+echo -en "\e[1mVersion:\e[0m ${VER}\n\n"
+
+ost=0
+osv=0
+
+if [[ $OS == "Ubuntu" ]]; then
+  ost=1
+  if [[ $VER == "24.04" ]] || [[ $VER == "22.10" ]] || [[ $VER == "22.04" ]] || [[ $VER == "20.04" ]] || [[ $VER == "18.04" ]] || [[ $VER == "16.04" ]]; then
+    osv=1
+  fi
+
+elif [[ "$OS" =~ Debian.* ]]; then
+  ost=1
+  case "$VER" in
+    9)
+      osv=1
+      ;;
+    10)
+      osv=1
+      ;;
+    11)
+      osv=1
+      ;;
+    12)
+      osv=1
+      ;;
+    *)
+      osv=2
+      ;;
+  esac
+
+elif [[ $OS == "CentOS Linux" ]]; then
+  ost=1
+  if [[ $VER == "8" ]]; then
+    osv=1
+  elif [[ $VER == "7" ]]; then
+    osv=1
+  elif [[ $VER == "6" ]]; then
+    osv=1
+  else
+    osv=2
+  fi
+elif [[ $OS == "CentOS Stream" ]]; then
+  ost=1
+  if [[ $VER == "8" ]]; then
+    osv=1
+  else
+    osv=2
+  fi
+elif [[ $OS == "Rocky Linux" ]]; then
+  ost=1
+  if [[ $VER =~ 8\. ]] || [[ $VER =~ 9\. ]]; then
+    osv=1
+  else
+    osv=2
+  fi
+elif [[ $OS == "AlmaLinux" ]]; then
+  ost=1
+  if [[ "$VERSION" =~ 8.* ]] || [[ "$VERSION" =~ 9.* ]]; then
+    osv=1
+  else
+    osv=2
+  fi
+else
+  ost=0
+fi
+
+if [[ $ost == 1 ]]; then
+  echo -en "\e[32m[PASS]\e[0m Supported Operating System Detected: ${OS}\n"
+  ((PASS++))
+else
+  echo -en "\e[41m[FAIL]\e[0m ${OS} is not a supported Operating System\n"
+  ((FAIL++))
+  STATUS=2
+fi
+
+if [[ $osv == 1 ]]; then
+  echo -en "\e[32m[PASS]\e[0m Supported Release Detected: ${VER}\n"
+  ((PASS++))
+elif [[ $ost == 1 ]]; then
+  echo -en "\e[41m[FAIL]\e[0m ${OS} ${VER} is not a supported Operating System Version\n"
+  ((FAIL++))
+  STATUS=2
+else
+  echo "Exiting..."
+  exit 1
+fi
+
+checkCloudInit
+
+echo -en "${CI}"
+
+checkFirewall
+
+echo -en "${FW_VER}"
+
+checkUpdates
+
+loadPasswords
+
+checkLogs
+
+echo -en "\n\nChecking all user-created accounts...\n"
+checkUsers
+
+echo -en "\n\nChecking the root account...\n"
+checkRoot
+
+echo -en "\n\nChecking the /tmp directory...\n"
+checkTMP
+
+checkAgent
+
+# Summary
+echo -en "\n\n---------------------------------------------------------------------------------------------------\n"
+
+if [[ $STATUS == 0 ]]; then
+  echo -en "Scan Complete.\n\e[32mAll Tests Passed!\e[0m\n"
+elif [[ $STATUS == 1 ]]; then
+  echo -en "Scan Complete. \n\e[93mSome non-critical tests failed.  Please review these items.\e[0m\e[0m\n"
+else
+  echo -en "Scan Complete. \n\e[41mOne or more tests failed.  Please review these items and re-test.\e[0m\n"
+fi
+echo "---------------------------------------------------------------------------------------------------"
+echo -en "\e[1m${PASS} Tests PASSED\e[0m\n"
+echo -en "\e[1m${WARN} WARNINGS\e[0m\n"
+echo -en "\e[1m${FAIL} Tests FAILED\e[0m\n"
+echo -en "---------------------------------------------------------------------------------------------------\n"
+
+if [[ $STATUS == 0 ]]; then
+  echo -en "We did not detect any issues with this image. Please be sure to manually ensure that all software installed on the base system is functional, secure and properly configured (or facilities for configuration on first-boot have been created).\n\n"
+  exit 0
+elif [[ $STATUS == 1 ]]; then
+  echo -en "Please review all [WARN] items above and ensure they are intended or resolved.  If you do not have a specific requirement, we recommend resolving these items before image submission\n\n"
+  exit 0
+else
+  echo -en "Some critical tests failed.  These items must be resolved and this scan re-run before you submit your image to the DigitalOcean Marketplace.\n\n"
+  exit 1
+fi

contrib/images/digitalocean/packer.pkr.hcl

@@ -0,0 +1,71 @@
+packer {
+  required_plugins {
+    digitalocean = {
+      version = ">= 1.0.4"
+      source  = "github.com/digitalocean/digitalocean"
+    }
+  }
+}
+
+variable "dokku_version" {
+  type    = string
+}
+
+source "digitalocean" "ubuntu" {
+  image         = "ubuntu-24-04-x64"
+  region        = "nyc1"
+  size          = "s-1vcpu-512mb-10gb"
+  ssh_username  = "root"
+  snapshot_name = "dokku-${var.dokku_version}-snapshot-{{timestamp}}"
+}
+
+build {
+  name = "dokku"
+  sources = [
+    "source.digitalocean.ubuntu"
+  ]
+
+  provisioner "shell" {
+    inline = [
+      "echo '--> Waiting until cloud-init is complete'",
+      "/usr/bin/cloud-init status --wait",
+    ]
+    valid_exit_codes = [0, 2]
+  }
+
+  provisioner "file" {
+    source      = "${path.root}/files/etc/"
+    destination = "/etc/"
+  }
+
+  provisioner "file" {
+    source      = "${path.root}/files/var/"
+    destination = "/var/"
+  }
+
+  provisioner "shell" {
+    environment_vars = [
+      "DOKKU_VERSION=${var.dokku_version}",
+      "DEBIAN_FRONTEND=noninteractive",
+      "LC_ALL=C",
+      "LANG=en_US.UTF-8",
+      "LC_CTYPE=en_US.UTF-8",
+    ]
+
+    scripts = [
+      "${path.root}/in_parts/011-docker",
+      "${path.root}/in_parts/011-ssh-message",
+      "${path.root}/in_parts/012-dokku-packages",
+      "${path.root}/in_parts/012-grub-opts",
+      "${path.root}/in_parts/014-docker-dns",
+      "${path.root}/in_parts/014-ufw-rules",
+      "${path.root}/in_parts/099-application_tag",
+      "${path.root}/in_parts/099-cleanup",
+      "${path.root}/in_parts/100-image-check",
+    ]
+  }
+
+  post-processor "manifest" {
+    output = "digitalocean-manifest.json"
+  }
+}

contrib/packer.json

@@ -1,32 +0,0 @@
-{
-  "builders": [
-    {
-      "type": "digitalocean",
-      "region": "nyc3",
-      "image": "ubuntu-14-04-x64"
-    }
-  ],
-  "provisioners": [
-    {
-      "type": "file",
-      "source": "deb.mk",
-      "destination": "/tmp/Makefile"
-    },
-    {
-      "type": "shell",
-      "inline": [
-        "echo '--> Waiting 30 seconds for core services to be available'",
-        "sleep 30",
-
-        "echo '--> Updating apt repositories'",
-        "sudo apt-get update -qq >/dev/null",
-
-        "echo '--> Installing make requirement'",
-        "sudo apt-get -qq -y --no-install-recommends install build-essential",
-
-        "cd /tmp && make install-from-deb",
-        "rm /root/.ssh/authorized_keys"
-      ]
-    }
-  ]
-}

contrib/release-dokku

@@ -9,19 +9,16 @@ readonly DOKKU_GIT_REV="$(git rev-parse HEAD)"
 trap "rm -rf '$TMP_WORK_DIR' >/dev/null" RETURN INT TERM EXIT
 
 log-info() {
-  # shellcheck disable=SC2034
   declare desc="Log info formatter"
   echo "$*"
 }
 
 log-error() {
-  # shellcheck disable=SC2034
   declare desc="Log error formatter"
   echo "!   $*" 1>&2
 }
 
 log-fail() {
-  # shellcheck disable=SC2034
   declare desc="Log fail formatter"
   log-error "$*"
   exit 1
@@ -134,11 +131,10 @@ fn-publish-package() {
   local OS_ID ex
 
   [[ "$IS_RELEASE" == "true" ]] && REPOSITORY=dokku/dokku
-  [[ "$RELEASE_TYPE" == "rpm" ]] && DIST=el/7
   [[ "$RELEASE_TYPE" == "raspbian" ]] && DIST=raspbian
 
   if [[ "$RELEASE_TYPE" == "raspbian" ]]; then
-    OS_IDS=("buster" "bullseye")
+    OS_IDS=("bullseye" "bookworm" "trixie")
     for OS_ID in "${OS_IDS[@]}"; do
       log-info "(release-dokku) pushing deb to packagecloud.com/${REPOSITORY}/${DIST}"
       package_cloud push "${REPOSITORY}/${DIST}/${OS_ID}" "$PACKAGE_NAME"
@@ -148,7 +144,7 @@ fn-publish-package() {
       fi
     done
   elif [[ "$DIST" == "ubuntu" ]]; then
-    OS_IDS=("bionic" "focal" "jammy")
+    OS_IDS=("jammy" "noble")
     for OS_ID in "${OS_IDS[@]}"; do
       log-info "(release-dokku) pushing ${RELEASE_TYPE} to packagecloud.com/${REPOSITORY}/${DIST}"
       package_cloud push "${REPOSITORY}/${DIST}/${OS_ID}" "$PACKAGE_NAME"
@@ -159,7 +155,7 @@ fn-publish-package() {
     done
 
     DIST=debian
-    OS_IDS=("stretch" "buster" "bullseye")
+    OS_IDS=("bullseye" "bookworm" "trixie")
     for OS_ID in "${OS_IDS[@]}"; do
       log-info "(release-dokku) pushing ${RELEASE_TYPE} to packagecloud.com/${REPOSITORY}/${DIST}"
       package_cloud push "${REPOSITORY}/${DIST}/${OS_ID}" "$PACKAGE_NAME"
@@ -187,8 +183,12 @@ fn-replace-version() {
 
 fn-repo-merged-requests() {
   declare desc="Retrieves all pull request ids since a given release of dokku"
-  declare TAG="$1"
-  git log "v${TAG}..HEAD" --oneline | grep "Merge pull request" | cut -d' ' -f 5 | cut -d '#' -f2
+  declare CURRENT_VERSION="$1" NEXT_VERSION="$2" IS_PATCH="$3"
+  if [[ "$IS_PATCH" == "true" ]]; then
+    git log "v${CURRENT_VERSION}..HEAD" --oneline | grep "Merge pull request" | cut -d' ' -f 5 | cut -d '#' -f2
+  else
+    curl -u "$RELEASE_GITHUB_USERNAME:$RELEASE_GITHUB_API_TOKEN" --fail -sS "https://api.github.com/search/issues?q=repo:dokku/dokku+milestone:v${NEXT_VERSION}+is:pr&per_page=100" | jq '.items[].number'
+  fi
 }
 
 fn-repo-push-tags() {
@@ -205,7 +205,7 @@ fn-repo-push-tags() {
 
 fn-repo-update() {
   declare desc="Updates files within the repository for a given release"
-  declare IS_RELEASE="$1" CURRENT_VERSION="$2" NEXT_VERSION="$3"
+  declare IS_RELEASE="$1" CURRENT_VERSION="$2" NEXT_VERSION="$3" IS_PATCH="$4"
 
   log-info "(release-dokku) Replacing ${CURRENT_VERSION} with ${NEXT_VERSION}"
   for f in plugins/*/plugin.toml; do
@@ -224,15 +224,15 @@ fn-repo-update() {
   fn-replace-version "$CURRENT_VERSION" "$NEXT_VERSION" docs/assets/style.css
   fn-replace-version "$CURRENT_VERSION" "$NEXT_VERSION" docs/development/release-process.md
   fn-replace-version "$CURRENT_VERSION" "$NEXT_VERSION" docs/getting-started/install/docker.md
-  fn-replace-version "$CURRENT_VERSION" "$NEXT_VERSION" docs/getting-started/installation.md
-  fn-replace-version "$CURRENT_VERSION" "$NEXT_VERSION" docs/home.html
+  fn-replace-version "$CURRENT_VERSION" "$NEXT_VERSION" docs/getting-started/installation/index.md
+  fn-replace-version "v$CURRENT_VERSION" "v$NEXT_VERSION" docs/home.html
   fn-replace-version "$CURRENT_VERSION" "$NEXT_VERSION" docs/template.html
   fn-replace-version "$CURRENT_VERSION" "$NEXT_VERSION" README.md
 
   if [[ "$RELEASE" == 'patch' ]]; then
     fn-replace-version "$CURRENT_VERSION" "$NEXT_VERSION" docs/assets/versions.json
   else
-    versions=$(python -c 'import json,sys;d=json.load(sys.stdin);d["max-versions"].append("'"${NEXT_VERSION}"'"); print(json.dumps(d, indent=2, sort_keys=True))' <docs/assets/versions.json)
+    versions=$(python3 -c 'import json,sys;d=json.load(sys.stdin);d["max-versions"].append("'"${NEXT_VERSION}"'"); print(json.dumps(d, indent=2, sort_keys=True))' <docs/assets/versions.json)
     echo "$versions" >docs/assets/versions.json
     git add docs/assets/versions.json
   fi
@@ -242,24 +242,34 @@ fn-repo-update() {
   fi
 
   log-info "(release-dokku) Adding HISTORY.md, committing and tagging"
-  fn-repo-update-history-and-commit "$CURRENT_VERSION" "$NEXT_VERSION"
+  fn-repo-update-history-and-commit "$CURRENT_VERSION" "$NEXT_VERSION" "$IS_PATCH"
   git tag "v${NEXT_VERSION}"
 }
 
 fn-repo-update-history-and-commit() {
   declare desc="Updates the history file and commits the changes"
-  declare CURRENT_VERSION="$1" NEXT_VERSION="$2"
+  declare CURRENT_VERSION="$1" NEXT_VERSION="$2" IS_PATCH="$3"
   local PULL_REQUEST_ID TITLE AUTHOR TYPE CHANGELOG_TEXT
-  local COMMIT_MESSAGE HISTORY HISTORY_CONTENTS HISTORY_DOCUMENTATION HISTORY_ENHANCEMENT HISTORY_BC_BREAK HISTORY_REFACTOR HISTORY_BUG HISTORY_OTHER HISTORY_TESTS ISSUE_FILE
+  local COMMIT_MESSAGE HISTORY HISTORY_CONTENTS HISTORY_BUG HISTORY_DEPENDENCY HISTORY_DEPRECATION HISTORY_DOCUMENTATION HISTORY_ENHANCEMENT HISTORY_BC_BREAK HISTORY_REFACTOR HISTORY_REMOVAL HISTORY_SECURITY HISTORY_OTHER HISTORY_TESTS ISSUE_FILE
 
   pushd "$ROOT_DIR" >/dev/null
 
   mkdir -p /tmp/github-data
 
-  for PULL_REQUEST_ID in $(fn-repo-merged-requests "$CURRENT_VERSION"); do
+  for PULL_REQUEST_ID in $(fn-repo-merged-requests "$CURRENT_VERSION" "$NEXT_VERSION" "$IS_PATCH"); do
     ISSUE_FILE="/tmp/github-data/${PULL_REQUEST_ID}.json"
     if [[ ! -f "$ISSUE_FILE" ]]; then
-      curl -sS "https://api.github.com/repos/dokku/dokku/issues/${PULL_REQUEST_ID}" >"$ISSUE_FILE"
+      while true; do
+        if OUTPUT=$(curl -u "$RELEASE_GITHUB_USERNAME:$RELEASE_GITHUB_API_TOKEN" --fail -sS "https://api.github.com/repos/dokku/dokku/issues/${PULL_REQUEST_ID}" 2>&1); then
+          echo "$OUTPUT" >"$ISSUE_FILE"
+          break
+        fi
+
+        log-error "Error while fetching info for pull/$PULL_REQUEST_ID, sleeping for 5 seconds"
+        log-error "$OUTPUT"
+        sleep 5
+        log-info "    Retrying pull/$PULL_REQUEST_ID"
+      done
     fi
 
     TITLE="$(jq -r '.title' "$ISSUE_FILE")"
@@ -267,16 +277,26 @@ fn-repo-update-history-and-commit() {
     TYPE="$(jq -r '.labels[] | select( .name | contains("type") ) | .name' "$ISSUE_FILE" | cut -d' ' -f2)"
     CHANGELOG_TEXT="- #${PULL_REQUEST_ID}: @${AUTHOR} ${TITLE}"
 
-    if [[ "$TYPE" == "bc-break" ]]; then
+    if [[ "$TYPE" == "release" ]]; then
+      continue
+    elif [[ "$TYPE" == "bc-break" ]]; then
       HISTORY_BC_BREAK="${HISTORY_BC_BREAK}"$'\n'"$CHANGELOG_TEXT"
     elif [[ "$TYPE" == "bug" ]]; then
       HISTORY_BUG="${HISTORY_BUG}"$'\n'"$CHANGELOG_TEXT"
+    elif [[ "$TYPE" == "dependencies" ]]; then
+      HISTORY_DEPENDENCY="${HISTORY_DEPENDENCY}"$'\n'"$CHANGELOG_TEXT"
+    elif [[ "$TYPE" == "deprecation" ]]; then
+      HISTORY_DEPRECATION="${HISTORY_DEPRECATION}"$'\n'"$CHANGELOG_TEXT"
     elif [[ "$TYPE" == "documentation" ]]; then
       HISTORY_DOCUMENTATION="${HISTORY_DOCUMENTATION}"$'\n'"$CHANGELOG_TEXT"
     elif [[ "$TYPE" == "enhancement" ]]; then
       HISTORY_ENHANCEMENT="${HISTORY_ENHANCEMENT}"$'\n'"$CHANGELOG_TEXT"
     elif [[ "$TYPE" == "refactor" ]]; then
       HISTORY_REFACTOR="${HISTORY_REFACTOR}"$'\n'"$CHANGELOG_TEXT"
+    elif [[ "$TYPE" == "removal" ]]; then
+      HISTORY_REMOVAL="${HISTORY_REMOVAL}"$'\n'"$CHANGELOG_TEXT"
+    elif [[ "$TYPE" == "security" ]]; then
+      HISTORY_SECURITY="${HISTORY_SECURITY}"$'\n'"$CHANGELOG_TEXT"
     elif [[ "$TYPE" == "tests" ]]; then
       HISTORY_TESTS="${HISTORY_TESTS}"$'\n'"$CHANGELOG_TEXT"
     else
@@ -288,7 +308,7 @@ fn-repo-update-history-and-commit() {
   HISTORY="${HISTORY}"$'\n\n'"## ${NEXT_VERSION}"
   HISTORY="${HISTORY}"$'\n\n'"Install/update via the bootstrap script:"
   HISTORY="${HISTORY}"$'\n\n'"\`\`\`shell"
-  HISTORY="${HISTORY}"$'\n'"wget https://raw.githubusercontent.com/dokku/dokku/v${NEXT_VERSION}/bootstrap.sh"
+  HISTORY="${HISTORY}"$'\n'"wget -NP . https://dokku.com/install/v${NEXT_VERSION}/bootstrap.sh"
   HISTORY="${HISTORY}"$'\n'"sudo DOKKU_TAG=v${NEXT_VERSION} bash bootstrap.sh"
   HISTORY="${HISTORY}"$'\n'"\`\`\`"
 
@@ -296,6 +316,11 @@ fn-repo-update-history-and-commit() {
     HISTORY="${HISTORY}"$'\n\n'"See the [${NEXT_VERSION} migration guide](/docs/appendices/${NEXT_VERSION}-migration-guide.md) for more information on migrating to ${NEXT_VERSION}."
   fi
 
+  if [[ "$HISTORY_SECURITY" ]]; then
+    HISTORY="${HISTORY}"$'\n\n'"### Security"
+    HISTORY="${HISTORY}"$'\n'"$HISTORY_SECURITY"
+  fi
+
   if [[ "$HISTORY_BC_BREAK" ]]; then
     HISTORY="${HISTORY}"$'\n\n'"### Backwards Compatibility Breaks"
     HISTORY="${HISTORY}"$'\n'"$HISTORY_BC_BREAK"
@@ -311,6 +336,16 @@ fn-repo-update-history-and-commit() {
     HISTORY="${HISTORY}"$'\n'"$HISTORY_ENHANCEMENT"
   fi
 
+  if [[ "$HISTORY_REMOVAL" ]]; then
+    HISTORY="${HISTORY}"$'\n\n'"### Removals"
+    HISTORY="${HISTORY}"$'\n'"$HISTORY_REMOVAL"
+  fi
+
+  if [[ "$HISTORY_DEPRECATION" ]]; then
+    HISTORY="${HISTORY}"$'\n\n'"### Deprecations"
+    HISTORY="${HISTORY}"$'\n'"$HISTORY_DEPRECATION"
+  fi
+
   if [[ "$HISTORY_REFACTOR" ]]; then
     HISTORY="${HISTORY}"$'\n\n'"### Refactors"
     HISTORY="${HISTORY}"$'\n'"$HISTORY_REFACTOR"
@@ -326,6 +361,11 @@ fn-repo-update-history-and-commit() {
     HISTORY="${HISTORY}"$'\n'"$HISTORY_TESTS"
   fi
 
+  if [[ "$HISTORY_DEPENDENCY" ]]; then
+    HISTORY="${HISTORY}"$'\n\n'"### Dependencies"
+    HISTORY="${HISTORY}"$'\n'"$HISTORY_DEPENDENCY"
+  fi
+
   if [[ "$HISTORY_OTHER" ]]; then
     HISTORY="${HISTORY}"$'\n\n'"### Other"
     HISTORY="${HISTORY}"$'\n'"$HISTORY_OTHER"
@@ -354,15 +394,17 @@ fn-build-docker-image() {
 
   if [[ "$IS_RELEASE" == "true" ]]; then
     docker buildx build \
-      --platform linux/arm,linux/arm64,linux/amd64 \
+      --platform linux/arm64,linux/amd64 \
       --progress plain \
       --push \
+      --label "org.opencontainers.image.version=$VERSION" \
       --tag "dokku/dokku:latest" \
       --tag "dokku/dokku:$VERSION" .
-  else
+  elif [[ "$SKIP_IMAGE_BUILD" != "true" ]]; then
     docker buildx build \
-      --platform linux/arm,linux/arm64,linux/amd64 \
+      --platform linux/arm64,linux/amd64 \
       --progress plain \
+      --label "org.opencontainers.image.version=$VERSION" \
       --tag "dokku/dokku:latest" \
       --tag "dokku/dokku:$(echo "$VERSION" | tr + -)" .
   fi
@@ -370,7 +412,7 @@ fn-build-docker-image() {
 
 main() {
   declare RELEASE="$1"
-  local CURRENT_VERSION NEXT_VERSION IS_RELEASE
+  local CURRENT_VERSION NEXT_VERSION IS_PATCH IS_RELEASE
   local VALID_RELEASE_LEVELS=("major" "minor" "patch" "betafish" "build")
 
   if [[ "$RELEASE" == '--trace' ]]; then
@@ -401,25 +443,24 @@ main() {
   NEXT_VERSION="$(fn-version-next "$CURRENT_VERSION" "$RELEASE")"
   IS_RELEASE="$(fn-is-release "$RELEASE")"
 
+  IS_PATCH="false"
+  if [[ "$RELEASE" == "patch" ]]; then
+    IS_PATCH="true"
+  fi
+
   echo "v${NEXT_VERSION}" >build/next-version
 
-  fn-repo-update "$IS_RELEASE" "$CURRENT_VERSION" "$NEXT_VERSION"
+  fn-repo-update "$IS_RELEASE" "$CURRENT_VERSION" "$NEXT_VERSION" "$IS_PATCH"
   fn-build-dokku "$IS_RELEASE" "$NEXT_VERSION" || log-fail "Error building package"
-  fn-extract-package "$IS_RELEASE" "dokku_${NEXT_VERSION}_armhf.deb" || log-fail "Error extracting deb package"
   fn-extract-package "$IS_RELEASE" "dokku_${NEXT_VERSION}_arm64.deb" || log-fail "Error extracting deb package"
   fn-extract-package "$IS_RELEASE" "dokku_${NEXT_VERSION}_amd64.deb" || log-fail "Error extracting deb package"
-  fn-extract-package "$IS_RELEASE" "dokku-${NEXT_VERSION}-1.x86_64.rpm" || log-fail "Error extracting rpm package"
   mkdir -p build/package
   cp -f "build/dokku_${NEXT_VERSION}_amd64.deb" build/package/dokku-amd64.deb
   cp -f "build/dokku_${NEXT_VERSION}_arm64.deb" build/package/dokku-arm64.deb
-  cp -f "build/dokku_${NEXT_VERSION}_armhf.deb" build/package/dokku-armhf.deb
-  cp -f "build/dokku-${NEXT_VERSION}-1.x86_64.rpm" build/package/dokku-amd64.rpm
 
   if [[ "$RELEASE" != "build" ]]; then
-    fn-publish-package "$IS_RELEASE" "raspbian" "build/dokku_${NEXT_VERSION}_armhf.deb" || log-fail "Error publishing deb package"
     fn-publish-package "$IS_RELEASE" "deb" "build/dokku_${NEXT_VERSION}_arm64.deb" || log-fail "Error publishing deb package"
     fn-publish-package "$IS_RELEASE" "deb" "build/dokku_${NEXT_VERSION}_amd64.deb" || log-fail "Error publishing deb package"
-    fn-publish-package "$IS_RELEASE" "rpm" "build/dokku-${NEXT_VERSION}-1.x86_64.rpm" || log-fail "Error publishing rpm package"
     fn-build-docker-image "$NEXT_VERSION" "$IS_RELEASE" || log-fail "Error building docker image"
 
     fn-repo-push-tags "$IS_RELEASE"

contrib/release-plugin

@@ -7,19 +7,16 @@ readonly TMP_WORK_DIR="$(mktemp -d "/tmp/dokku-plugin-release.XXXXXX")"
 trap "rm -rf '$TMP_WORK_DIR' >/dev/null" RETURN INT TERM EXIT
 
 log-info() {
-  # shellcheck disable=SC2034
   declare desc="Log info formatter"
   echo "$*"
 }
 
 log-error() {
-  # shellcheck disable=SC2034
   declare desc="Log error formatter"
   echo "!   $*" 1>&2
 }
 
 log-fail() {
-  # shellcheck disable=SC2034
   declare desc="Log fail formatter"
   log-error "$*"
   exit 1

contrib/sort-mkdocs-versions

@@ -0,0 +1,38 @@
+#!/usr/bin/env python
+import json
+
+
+def main():
+    version_file = "tmp/docs-build/versions.json"
+    data = []
+    with open(version_file) as f:
+        data = json.load(f)
+
+    versions = []
+    for info in data:
+        if info["title"] == "latest":
+            continue
+        versions.append(info["title"].removeprefix("v"))
+
+    versions.sort(key=lambda x: list(map(int, x.split('.'))), reverse=True)
+    data = [
+        {
+            "aliases": ["latest"],
+            "title": "latest",
+            "version": "docs",
+        }
+    ]
+
+    for version in versions:
+        data.append({
+            "aliases": [],
+            "title": f"v{version}",
+            "version": f"docs~v{version}",
+        })
+
+    with open(version_file, "w") as f:
+        json.dump(data, f, indent=4)
+
+
+if __name__ == "__main__":
+    main()

contrib/update-deb-dependencies

@@ -0,0 +1,31 @@
+#!/usr/bin/env python3
+import json
+import re
+
+
+def main():
+    """
+    updates the control file with the tested debian dependencies
+    """
+    deps = {}
+    with open("contrib/dependencies.json", encoding="utf-8") as handle:
+        deps = json.load(handle)
+
+    control_lines = []
+    with open("debian/control", encoding="utf-8") as handle:
+        control_lines = [line for line in handle.readlines()]
+
+    for key in ["dependencies", "predependencies", "recommendations"]:
+        for dependency in deps[key]:
+            name = dependency["name"]
+            version = dependency["version"]
+            pattern = re.compile(rf"(?<![\w-]){re.escape(name)}(?![\w-])")
+            for i, line in enumerate(control_lines):
+                control_lines[i] = pattern.sub(f"{name} (>= {version})", line)
+
+    with open("debian/control", mode="w", encoding="utf-8") as handle:
+        handle.writelines(control_lines)
+
+
+if __name__ == "__main__":
+    main()

contrib/write-mkdocs

@@ -0,0 +1,147 @@
+#!/usr/bin/env python
+import os
+import pathlib
+import shutil
+import sys
+
+import yaml
+from bs4 import BeautifulSoup
+
+
+def get_nav_from_selector(soup: BeautifulSoup, selector: str, docs_dir: str):
+    """
+    Generates navigation from template file
+    """
+    navigation = []
+    header_name = ""
+    for anchor in soup.select(selector):
+        classes = anchor.get("class", [])
+        if classes is None:
+            continue
+
+        if "disabled" in classes:
+            header_name = anchor.text
+            navigation.append({header_name: []})
+
+        href = anchor.get("href", "")
+        if href is None:
+            continue
+
+        href = str(href)
+        if href == "#":
+            continue
+
+        url = href.replace("{{NAME}}", "")
+        filename = url.replace("http://progrium.viewdocs.io/dokku/", "")
+        filename = filename.replace("http://dokku.viewdocs.io/dokku/", "")
+        filename = filename.strip("/") + ".md"
+        filename = filename.removeprefix("dokku/")
+
+        ignore_errors_for = [
+            "getting-started/installation.md",
+            "getting-started/upgrading.md",
+        ]
+        if not os.path.exists(docs_dir + "/" + filename):
+            if filename not in ignore_errors_for:
+                print("error fetching markdown file:", filename)
+                continue
+
+        for nav in navigation:
+            if header_name in nav:
+                if filename == "getting-started/installation.md":
+                    child_dir = "getting-started/install/"
+                    children = os.listdir(docs_dir + "/" + child_dir)
+                    children = [child_dir + c for c in children]
+                    children.sort()
+                    children.insert(0, "getting-started/advanced-installation.md")
+                    if os.path.exists(docs_dir + "/" + filename):
+                        children.insert(0, filename)
+                    else:
+                        children.insert(0, "getting-started/installation/index.md")
+                    nav[header_name].append(
+                        {
+                            "Getting Started with Dokku": children,
+                        }
+                    )
+                    continue
+
+                if filename == "getting-started/upgrading.md":
+                    child_dir = "appendices/"
+                    children = os.listdir(docs_dir + "/" + child_dir)
+
+                    children.sort(
+                        key=lambda x: list(map(int, x.split("-")[0].split("."))) if "." in x else [-1, -1, -1],
+                        reverse=True,
+                    )
+                    children = [child_dir + c for c in children]
+                    if os.path.exists(docs_dir + "/" + filename):
+                        children.insert(0, filename)
+                    else:
+                        children.insert(0, "getting-started/upgrading/index.md")
+                    nav[header_name].append(
+                        {
+                            "Upgrading": children,
+                        }
+                    )
+                    continue
+
+                nav[header_name].append(filename)
+    return navigation
+
+
+def generate_nav(src: str, dest: str) -> None:
+    """
+    Writes out navigation information to the mkdocs yaml file
+    """
+    navigation = []
+    repo_dir = pathlib.Path(__file__).parent.parent.resolve()
+    docs_dir = str(repo_dir) + "/docs"
+    with open(docs_dir + "/template.html", encoding="utf-8") as response:
+        soup = BeautifulSoup(response, "html.parser")
+        selectors = [
+            ".container .row .list-group a",
+            ".container-fluid .row .list-group a",
+        ]
+        for selector in selectors:
+            navigation = get_nav_from_selector(soup, selector, docs_dir)
+            if len(navigation) > 0:
+                break
+
+        if len(navigation) == 0:
+            print("No navigation found")
+            sys.exit(1)
+
+    with open(src, encoding="utf-8") as handler:
+        data = yaml.unsafe_load(handler)
+        data["nav"] = [
+            {"Docs": navigation},
+            {"Pro": "https://pro.dokku.com/docs/getting-started/"},
+            {"Blog": "https://dokku.com/blog/"},
+            {"Tutorials": "https://dokku.com/tutorials/"},
+            {
+                "Purchase Dokku Pro": "https://dokku.dpdcart.com/cart/add?product_id=217344&method_id=236878"
+            },
+        ]
+
+    with open(dest, mode="wt", encoding="utf-8") as handler:
+        yaml.dump(data, handler)
+
+
+def main():
+    """
+    Main command that performs doc manipulation
+    """
+    print("----> Copying mkdocs.yml")
+    print("      Generating navigation")
+    generate_nav("/usr/src/source/mkdocs.yml", "/usr/src/app/mkdocs.yml")
+
+    if os.path.exists("/usr/src/app/docs"):
+        print("      Removing old docs folder")
+        shutil.rmtree("/usr/src/app/docs")
+
+    print("      Performing copy")
+    shutil.copytree("/usr/src/source/docs", "/usr/src/app/docs")
+
+
+if __name__ == "__main__":
+    main()

deb.mk

@@ -11,16 +11,12 @@ endif
 .PHONY: install-from-deb deb-all deb-dokku deb-setup
 
 install-from-deb:
-	@echo "--> Initial apt-get update"
-	sudo apt-get update -qq >/dev/null
-	sudo apt-get -qq -y --no-install-recommends install apt-transport-https
-
 	@echo "--> Installing docker"
 	wget -nv -O - https://get.docker.com/ | sh
 
 	@echo "--> Installing dokku"
-	wget -nv -O - https://packagecloud.io/dokku/dokku/gpgkey | apt-key add -
-	@echo "deb https://packagecloud.io/dokku/dokku/ubuntu/ $(shell lsb_release -cs 2>/dev/null || echo "bionic") main" | sudo tee /etc/apt/sources.list.d/dokku.list
+	wget -qO- https://packagecloud.io/dokku/dokku/gpgkey | sudo tee /etc/apt/trusted.gpg.d/dokku.asc
+	@echo "deb https://packagecloud.io/dokku/dokku/ubuntu/ $(shell lsb_release -cs 2>/dev/null || echo "noble") main" | sudo tee /etc/apt/sources.list.d/dokku.list
 	sudo apt-get update -qq >/dev/null
 	sudo DEBIAN_FRONTEND=noninteractive DEBCONF_NONINTERACTIVE_SEEN=true apt-get -qq -y --no-install-recommends install dokku
 
@@ -31,7 +27,7 @@ deb-all: deb-setup deb-dokku
 deb-setup:
 	@echo "-> Updating deb repository and installing build requirements"
 	@sudo apt-get update -qq >/dev/null
-	@sudo DEBIAN_FRONTEND=noninteractive DEBCONF_NONINTERACTIVE_SEEN=true apt-get -qq -y --no-install-recommends install gcc git build-essential wget ruby-dev ruby1.9.1 lintian >/dev/null 2>&1
+	@sudo DEBIAN_FRONTEND=noninteractive DEBCONF_NONINTERACTIVE_SEEN=true apt-get -qq -y --no-install-recommends install gcc git build-essential wget ruby-dev lintian >/dev/null 2>&1
 	@command -v fpm >/dev/null || sudo gem install fpm --no-ri --no-rdoc
 	@ssh -o StrictHostKeyChecking=no git@github.com || true
 
@@ -43,6 +39,7 @@ ifneq (,$(findstring false,$(IS_RELEASE)))
 	sed -i.bak -e "s/^/`date +%s`:/" /tmp/build-dokku/var/lib/dokku/STABLE_VERSION && rm /tmp/build-dokku/var/lib/dokku/STABLE_VERSION.bak
 endif
 
+	contrib/update-deb-dependencies
 	cp -r debian /tmp/build-dokku/DEBIAN
 	sed -i.bak "s/^Architecture: .*/Architecture: $(DOKKU_ARCHITECTURE)/g" /tmp/build-dokku/DEBIAN/control && rm  /tmp/build-dokku/DEBIAN/control.bak
 	rm -f /tmp/build-dokku/DEBIAN/lintian-overrides

debian/config

@@ -3,7 +3,6 @@ set -eo pipefail
 [[ $TRACE ]] && set -x
 
 if [[ -e /usr/share/debconf/confmodule ]]; then
-  # shellcheck disable=SC1091
   . /usr/share/debconf/confmodule
 fi
 
@@ -15,5 +14,6 @@ db_input "high" "dokku/hostname" || true
 db_input "high" "dokku/vhost_enable" || true
 if [ "$ACTION" != "reconfigure" ]; then
   db_input "high" "dokku/key_file" || true
+  db_input "high" "dokku/install_default_site" || true
 fi
 db_go || true

debian/control

@@ -1,11 +1,11 @@
 Package: dokku
-Version: 0.27.6
+Version: 0.38.27
 Section: web
 Priority: optional
 Architecture: amd64
-Depends: locales, git, cpio, curl, man-db, netcat, sshcommand (>= 0.12.0), docker-engine-cs (>= 17.05.0) | docker-engine (>= 17.05.0) | docker-io (>= 17.05.0) | docker.io (>= 17.05.0) | docker-ce (>= 17.05.0) | docker-ee (>= 17.05.0) | moby-engine, docker-image-labeler (>= 0.2.2), net-tools, netrc, software-properties-common, parallel, procfile-util (>= 0.11.0), python-software-properties | python3-software-properties, rsync, rsyslog, dos2unix, jq, unzip
-Recommends: herokuish (>= 0.3.4), bash-completion, dokku-update, dokku-event-listener
-Pre-Depends: gliderlabs-sigil, nginx (>= 1.8.0) | openresty, dnsutils, cgroupfs-mount | cgroup-lite, plugn (>= 0.3.0), sudo, python3, debconf
+Depends: apache2-utils, locales, git, cpio, cron | cron-daemon, curl, logrotate, man-db, netcat, sshcommand, docker-engine-cs (>= 19.03.0) | docker-engine (>= 19.03.0) | docker-io (>= 19.03.0) | docker.io (>= 19.03.0) | docker-ce (>= 19.03.0) | docker-ee (>= 19.03.0) | moby-engine, docker-compose-plugin | moby-compose | docker-compose, docker-buildx-plugin | moby-buildx | docker-buildx, docker-container-healthchecker, docker-image-labeler, lambda-builder, net-tools, netrc, parallel, procfile-util, rsync, dos2unix, unzip, util-linux
+Recommends: herokuish, bash-completion, dokku-update, dokku-event-listener
+Pre-Depends: gliderlabs-sigil, jq, nginx (>= 1.8.0) | openresty, bind9-dnsutils, debconf, plugn, sudo, python3, rsyslog
 Maintainer: Jose Diaz-Gonzalez <dokku@josediazgonzalez.com>
 Description: Docker-powered PaaS that helps build and manage the lifecycle of applications
  Dokku is an extensible, open source Platform as a Service

debian/postinst

@@ -3,12 +3,10 @@ set -eo pipefail
 [[ $TRACE ]] && set -x
 
 if [[ -e /usr/share/debconf/confmodule ]]; then
-  # shellcheck disable=SC1091
   . /usr/share/debconf/confmodule
 fi
 
 if [[ -r /etc/default/dokku ]]; then
-  # shellcheck disable=SC1091
   source /etc/default/dokku
 fi
 
@@ -26,6 +24,40 @@ call-sshcommand() {
   fi
 }
 
+setup-docker-live-restore() {
+  # skip if running in docker-based installation
+  if [[ "$DOKKU_INIT_SYSTEM" == "sv" ]]; then
+    return
+  fi
+
+  # allow disabling via /etc/default/dokku
+  if [[ "$DOKKU_LIVE_RESTORE" == "false" ]]; then
+    return
+  fi
+
+  live_restore="$(docker info --format '{{ .LiveRestoreEnabled }}' || true)"
+  if [ "$live_restore" = "true" ]; then
+    echo "Docker live-restore is already enabled"
+    return
+  fi
+
+  echo "Enabling docker live-restore"
+  if [[ ! -f /etc/docker/daemon.json ]]; then
+    mkdir -p /etc/docker
+    echo "{}" >/etc/docker/daemon.json
+  fi
+
+  config="$(jq '. + {"live-restore": true}' /etc/docker/daemon.json)"
+  echo "$config" >/etc/docker/daemon.json
+  if command -v systemctl &>/dev/null; then
+    if ! systemctl reload docker; then
+      echo "Unable to reload docker, please reload manually" 1>&2
+    fi
+  else
+    echo "Unable to reload docker, please reload manually" 1>&2
+  fi
+}
+
 setup-user() {
   echo "Setting up dokku user"
   call-sshcommand create dokku /usr/bin/dokku
@@ -86,7 +118,8 @@ setup-plugins() {
       PLUGIN_PATH="${DOKKU_LIB_ROOT}/plugins" plugn enable "$plugin"
     fi
   done
-  find -L "${DOKKU_LIB_ROOT}" -type l -delete
+  find -L "${DOKKU_LIB_ROOT}/core-plugins" -type l -delete
+  find -L "${DOKKU_LIB_ROOT}/plugins" -type l -delete
   chown dokku:dokku -R "${DOKKU_LIB_ROOT}/plugins" "${DOKKU_LIB_ROOT}/core-plugins"
 
   echo "Install all core plugins"
@@ -102,6 +135,85 @@ setup-sshcommand() {
   fi
 }
 
+disable-default-vhost-path() {
+  local path="$1"
+  local backup_path="${path}.dokku-disabled"
+
+  if [ ! -e "$path" ] && [ ! -L "$path" ]; then
+    return
+  fi
+
+  if [ -e "$backup_path" ] || [ -L "$backup_path" ]; then
+    return
+  fi
+
+  case "$path" in
+    /etc/nginx/sites-enabled/*)
+      rm -f "$path"
+      echo "Removed conflicting nginx default at $path" 1>&2
+      return
+      ;;
+  esac
+
+  if [ -L "$path" ]; then
+    rm -f "$path"
+    echo "Removed conflicting nginx default symlink at $path" 1>&2
+    return
+  fi
+
+  mv -n "$path" "$backup_path"
+  echo "Disabled $path (renamed to $backup_path)" 1>&2
+}
+
+setup-default-site() {
+  db_get "dokku/install_default_site"
+  if [ "$RET" != "true" ]; then
+    return
+  fi
+
+  local nginx_bin nginx_version major minor patch
+  nginx_bin="$(command -v nginx || true)"
+  if [ -z "$nginx_bin" ]; then
+    return
+  fi
+
+  nginx_version="$("$nginx_bin" -v 2>&1 | cut -d'/' -f 2 | awk '{print $1}')"
+  major="$(echo "$nginx_version" | awk -F. '{print $1}')"
+  minor="$(echo "$nginx_version" | awk -F. '{print $2}')"
+  patch="$(echo "$nginx_version" | awk -F. '{print $3}')"
+
+  # ssl_reject_handshake requires nginx >= 1.19.4; older nginx gets the
+  # HTTP-only catch-all so the SSL listen lines do not require a cert.
+  local default_vhost_basename="default-site.conf"
+  if [ "${major:-0}" -lt 2 ]; then
+    if [ "${major:-0}" -lt 1 ] || [ "${minor:-0}" -lt 19 ] || { [ "${minor:-0}" -eq 19 ] && [ "${patch:-0}" -lt 4 ]; }; then
+      default_vhost_basename="default-site-legacy.conf"
+    fi
+  fi
+
+  local default_vhost_target="/etc/nginx/conf.d/00-default-vhost.conf"
+  local default_vhost_source="${DOKKU_LIB_ROOT}/core-plugins/available/nginx-vhosts/templates/${default_vhost_basename}"
+
+  if [ -e "$default_vhost_target" ]; then
+    return
+  fi
+
+  if [ ! -f "$default_vhost_source" ]; then
+    return
+  fi
+
+  for path in /etc/nginx/sites-enabled/default /etc/nginx/sites-available/default /etc/nginx/conf.d/default.conf; do
+    disable-default-vhost-path "$path"
+  done
+
+  echo "Installing nginx default catch-all site at $default_vhost_target"
+  install -m 0644 -o root -g root "$default_vhost_source" "$default_vhost_target"
+
+  if command -v dokku &>/dev/null; then
+    dokku nginx:reload || true
+  fi
+}
+
 dpkg-handling() {
   if [ -f "${DOKKU_ROOT}/VHOST" ]; then
     echo "VHOST file detected, skipping modification"
@@ -126,13 +238,9 @@ dpkg-handling() {
 case "$1" in
   abort-upgrade | abort-remove | abort-deconfigure) ;;
 
-  \
-    configure)
+  configure)
     mandb
     [ ! -x /usr/bin/docker.io ] || ln -sf /usr/bin/docker.io /usr/local/bin/docker
-    if [[ -f /sbin/modprobe ]]; then
-      modprobe aufs || echo "WARNING: Restart server to finish installing dokku!"
-    fi
 
     setup-user
     setup-storage
@@ -140,6 +248,10 @@ case "$1" in
     dpkg-handling
     setup-plugins
     setup-sshcommand
+    setup-docker-live-restore
+    if [ -z "$2" ]; then
+      setup-default-site
+    fi
     ;;
 
   *)

debian/postrm

@@ -3,7 +3,6 @@ set -eo pipefail
 [[ $TRACE ]] && set -x
 
 if [[ -e /usr/share/debconf/confmodule ]]; then
-  # shellcheck disable=SC1091
   . /usr/share/debconf/confmodule
 fi
 

debian/preinst

@@ -3,7 +3,6 @@ set -eo pipefail
 [[ $TRACE ]] && set -x
 
 if [[ -e /usr/share/debconf/confmodule ]]; then
-  # shellcheck disable=SC1091
   . /usr/share/debconf/confmodule
 fi
 
@@ -22,11 +21,9 @@ case "$1" in
 
   upgrade) ;;
 
-  \
-    abort-upgrade) ;;
+  abort-upgrade) ;;
 
-  \
-    *)
+  *)
     echo "preinst called with unknown argument \`$1'" >&2
     exit 1
     ;;

debian/prerm

@@ -11,39 +11,39 @@ ps_backtrace() {
     exit 1
   fi
 
-  declare -i pid=$1
+  declare -i pid="$1"
   ppid=0
   header_modifier=""
   while :; do
-    if [ $ppid -ne 0 ]; then
+    if [[ "$ppid" -ne 0 ]]; then
       header_modifier=h
     fi
-    ppid=$(ps -o ppid= $pid)
-    ps uww $header_modifier -p $pid
-    if [ $pid -eq 1 ]; then
+    ppid="$(ps -o ppid= "$pid")"
+    ps uww $header_modifier -p "$pid"
+    if [[ "$pid" -eq 1 ]] || [[ "$pid" -eq 0 ]]; then
       break
     fi
-    pid=$ppid
+    pid="$ppid"
   done
 }
 
 main() {
   # HACK: Ensure that we only delete data when purging dokku from the system
-  if ps_backtrace $BASHPID 2>/dev/null | grep dpkg | grep -- "--purge" >/dev/null; then
+  if ps_backtrace "$BASHPID" 2>/dev/null | grep dpkg | grep -- "--purge" >/dev/null; then
     echo "Processing purge"
 
     echo "Destroying deployed applications"
     for app in $(DOKKU_QUIET_OUTPUT=1 dokku apps:list); do
-      dokku --force apps:destroy $app
+      dokku --force apps:destroy "$app"
     done
 
     # HACK: Only disable core plugins, as we don't know what data users store in non-core plugin directories
     echo "Disabling all core plugins"
-    find ${DOKKU_LIB_ROOT}/core-plugins/available -mindepth 1 -maxdepth 1 -type d -printf '%f\n' | while read -r plugin; do
-      if [ ! -d ${DOKKU_LIB_ROOT}/plugins/available/$plugin ]; then
-        rm ${DOKKU_LIB_ROOT}/plugins/available/$plugin
-        PLUGIN_PATH=${DOKKU_LIB_ROOT}/core-plugins plugn disable $plugin
-        PLUGIN_PATH=${DOKKU_LIB_ROOT}/plugins plugn disable $plugin
+    find "${DOKKU_LIB_ROOT}/core-plugins/available" -mindepth 1 -maxdepth 1 -type d -printf '%f\n' | while read -r plugin; do
+      if [[ ! -d "${DOKKU_LIB_ROOT}/plugins/available/$plugin" ]]; then
+        rm "${DOKKU_LIB_ROOT}/plugins/available/$plugin"
+        PLUGIN_PATH="${DOKKU_LIB_ROOT}/core-plugins" plugn disable "$plugin"
+        PLUGIN_PATH="${DOKKU_LIB_ROOT}/plugins" plugn disable "$plugin"
       fi
     done
   else

debian/templates

@@ -22,3 +22,8 @@ Template: dokku/nginx_enable
 Description: Enable nginx-vhosts plugin?
 Type: boolean
 Default: true
+
+Template: dokku/install_default_site
+Description: Install a catch-all nginx default site on fresh install?
+Type: boolean
+Default: true

docker/etc/cron.d/docker-builder-prune

@@ -0,0 +1,4 @@
+PATH=/usr/local/bin:/usr/bin:/bin
+SHELL=/bin/bash
+
+5 4 * * * root /usr/local/bin/docker builder prune -f >>/var/log/dokku/builder-prune.log 2>&1

docker/etc/my_init.d/10_dokku_init

@@ -3,19 +3,28 @@ set -eo pipefail
 
 log-info() {
   declare desc="Log info formatter"
-  echo "    $*" 1>&2
+  echo "       $*" 1>&2
 }
 
 log-fail() {
   declare desc="Log fail formatter"
-  echo "!   $*" 1>&2
+  echo " !     $*" 1>&2
   exit 1
 }
 
+log-warn() {
+  declare desc="Log fail formatter"
+  echo " !     $*" 1>&2
+}
+
 support-userns() {
   chown 0:0 /usr/bin/sudo
   chmod 4755 /usr/bin/sudo
-  chown 0:0 /usr/lib/sudo/sudoers.so
+  if [[ -f /usr/lib/sudo/sudoers.so ]]; then
+    chown 0:0 /usr/lib/sudo/sudoers.so
+  elif [[ -f /usr/libexec/sudo/sudoers.so ]]; then
+    chown 0:0 /usr/libexec/sudo/sudoers.so
+  fi
   chown -R 0:0 /etc/sudoers
   chown -R 0:0 /etc/sudoers.d
   chown -R 0:0 /run/sshd
@@ -26,47 +35,70 @@ main() {
 
   support-userns
 
+  rm -f /var/run/dokku/ready
+  mkdir -p /var/run/dokku
+
   if [[ ! -d /mnt/dokku ]]; then
     log-info "Creating missing /mnt/dokku"
     mkdir -p /mnt/dokku
   fi
 
-  directories=("/etc/ssh" "/home/dokku" "/var/lib/dokku/config" "/var/lib/dokku/data")
+  directories=("/etc/ssh" "/home/dokku" "/var/lib/dokku/config" "/var/lib/dokku/data" "/var/lib/dokku/services")
   for dir in "${directories[@]}"; do
     if [[ ! -e "$dir" ]]; then
       log-info "Copying ${dir} skel into place"
       mkdir -p "/mnt/dokku${dir}"
-      rsync -a "/skel${dir}/" "${dir}/" || log-fail "Unable to copy ${dir} skel into place"
+      if [[ -d "/skel${dir}" ]]; then
+        rsync -a "/skel${dir}/" "${dir}/" || log-fail "Unable to copy ${dir} skel into place"
+      fi
     fi
 
     # chown mount directories to "dokku:dokku"
-    if [[ "$dir" != "/etc/ssh" ]]; then
+    if [[ "$dir" == "/var/lib/dokku/services" ]]; then
+      chown dokku:dokku /var/lib/dokku/services
+    elif [[ "$dir" != "/etc/ssh" ]]; then
       find "$dir" -print0 | xargs -0 chown -h dokku:dokku
     fi
   done
 
+  touch /etc/default/dokku
+  echo "export DOKKU_INIT_SYSTEM=sv" >>/etc/default/dokku
+  if [[ -x /usr/local/bin/docker ]]; then
+    echo "export DOCKER_BIN=/usr/local/bin/docker" >>/etc/default/dokku
+  fi
+
+  if [[ -n "$DOKKU_HOST_ROOT" ]]; then
+    echo "export DOKKU_HOST_ROOT=$DOKKU_HOST_ROOT" >>/etc/default/dokku
+    chown dokku:dokku /etc/default/dokku
+  fi
+
+  if [[ -n "$DOKKU_LIB_HOST_ROOT" ]]; then
+    echo "export DOKKU_LIB_HOST_ROOT=$DOKKU_LIB_HOST_ROOT" >>/etc/default/dokku
+    chown dokku:dokku /etc/default/dokku
+  fi
+
   if [[ -f /mnt/dokku/plugin-list ]]; then
     while read line; do
-      dokku plugin:install "$(echo "$line" | awk '{print $2}')" "$(echo "$line" | cut -d':' -f1)"
+      local plugin_name="$(echo "$line" | awk -F: '{print $1}')"
+      if dokku plugin:installed "$plugin_name"; then
+        log-warn "Skipping already installed plugin: $plugin_name"
+      else
+        dokku plugin:install "$(echo "$line" | awk -F': ' '{print $2}')" --name "$plugin_name"
+      fi
     done </mnt/dokku/plugin-list
   fi
 
+  # run core install triggers to force create any folders that may be missing
+  dokku plugin:install
+
   if [[ -n "$DOKKU_HOSTNAME" ]]; then
     echo "dokku dokku/hostname string $DOKKU_HOSTNAME" | debconf-set-selections
     echo "dokku dokku/vhost_enable boolean true" | debconf-set-selections
     dokku --quiet domains:set-global "$DOKKU_HOSTNAME"
   fi
 
-  if [[ -x /usr/local/bin/docker ]]; then
-    mkdir -p /home/dokku/.dokkurc
-    echo "export DOCKER_BIN=/usr/local/bin/docker" >"/home/dokku/.dokkurc/DOCKER_BIN"
-  fi
-
-  if [[ -n "$DOKKU_HOST_ROOT" ]]; then
-    touch /etc/default/dokku
-    echo "export DOKKU_HOST_ROOT=$DOKKU_HOST_ROOT" >>/etc/default/dokku
-    chown dokku:dokku /etc/default/dokku
-  fi
+  echo "dokku dokku/skip_key_file boolean true" | debconf-set-selections
+  echo "dokku dokku/key_file string /root/.ssh/id_rsa.pub" | debconf-set-selections
 
   NGINX_ROOT="/etc/nginx"
   if [[ -x /usr/bin/openresty ]]; then

docker/etc/nginx/conf.d/zz-dokku-health.conf

@@ -0,0 +1,16 @@
+# Internal health endpoint for the official dokku/dokku Docker image.
+# Bound to loopback so it is reachable only from inside the container
+# and never conflicts with user app vhosts on 80/443.
+server {
+    listen      127.0.0.1:18080;
+    server_name _;
+    access_log  off;
+    default_type text/plain;
+
+    location = /_dokku/health {
+        if (-f /var/run/dokku/ready) {
+            return 200 "ok\n";
+        }
+        return 503 "not ready\n";
+    }
+}

docker/etc/runit/runsvdir/default/dokku-restore/finish

@@ -10,6 +10,10 @@ if [[ "$1" -ne 0 ]]; then
 fi
 
 echo "Done restoring dokku apps."
-exec sleep infinity
 
-exit 0
+while ! (echo >/dev/tcp/127.0.0.1/22) >/dev/null 2>&1; do sleep 1; done
+while ! (echo >/dev/tcp/127.0.0.1/80) >/dev/null 2>&1; do sleep 1; done
+touch /var/run/dokku/ready
+echo "Dokku is ready."
+
+exec sleep infinity

docker/etc/ssh/sshd_config

@@ -0,0 +1,133 @@
+#       $OpenBSD: sshd_config,v 1.80 2008/07/02 02:24:18 djm Exp $
+
+# This is the sshd server system-wide configuration file.  See
+# sshd_config(5) for more information.
+
+# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin
+
+# The strategy used for options in the default sshd_config shipped with
+# OpenSSH is to specify options with their default value where
+# possible, but leave them commented.  Uncommented options change a
+# default value.
+
+UseDNS no
+
+Port 22 
+Port 22333
+#AddressFamily any
+#ListenAddress 0.0.0.0
+#ListenAddress ::
+
+# Disable legacy (protocol version 1) support in the server for new
+# installations. In future the default will change to require explicit
+# activation of protocol 1
+Protocol 2
+
+# HostKey for protocol version 1
+#HostKey /etc/ssh_host_key
+# HostKeys for protocol version 2
+#HostKey /etc/ssh_host_rsa_key
+#HostKey /etc/ssh_host_dsa_key
+
+# Lifetime and size of ephemeral version 1 server key
+#KeyRegenerationInterval 1h
+#ServerKeyBits 1024
+
+# Logging
+# obsoletes QuietMode and FascistLogging
+SyslogFacility AUTHPRIV
+#LogLevel INFO
+
+# Authentication:
+
+#LoginGraceTime 2m
+#PermitRootLogin yes
+#StrictModes yes
+#MaxAuthTries 6
+#MaxSessions 10
+
+#RSAAuthentication yes
+#PubkeyAuthentication yes
+#AuthorizedKeysFile     .ssh/authorized_keys
+
+# For this to work you will also need host keys in /etc/ssh_known_hosts
+#RhostsRSAAuthentication no
+# similar for protocol version 2
+#HostbasedAuthentication no
+# Change to yes if you don't trust ~/.ssh/known_hosts for
+# RhostsRSAAuthentication and HostbasedAuthentication
+#IgnoreUserKnownHosts no
+# Don't read the user's ~/.rhosts and ~/.shosts files
+#IgnoreRhosts yes
+
+# To disable tunneled clear text passwords, change to no here! Also,
+# remember to set the UsePAM setting to 'no'.
+PasswordAuthentication no
+#PermitEmptyPasswords no
+
+# SACL options
+# The default for the SACLSupport option is now "no", as this option has been
+# depreciated in favor of SACL enforcement in the PAM configuration (/etc/pam.d/sshd).
+#SACLSupport no
+
+# Change to no to disable s/key passwords
+# Disabled for passenger-docker. We only allow key authentication.
+ChallengeResponseAuthentication no
+
+# Kerberos options
+#KerberosAuthentication no
+#KerberosOrLocalPasswd yes
+#KerberosTicketCleanup yes
+
+# GSSAPI options
+#GSSAPIAuthentication no
+#GSSAPICleanupCredentials yes
+#GSSAPIStrictAcceptorCheck yes
+#GSSAPIKeyExchange no
+
+# Set this to 'yes' to enable PAM authentication, account processing,
+# and session processing. If this is enabled, PAM authentication will
+# be allowed through the ChallengeResponseAuthentication and
+# PasswordAuthentication.  Depending on your PAM configuration,
+# PAM authentication via ChallengeResponseAuthentication may bypass
+# the setting of "PermitRootLogin without-password".
+# If you just want the PAM account and session checks to run without
+# PAM authentication, then enable this but set PasswordAuthentication
+# and ChallengeResponseAuthentication to 'no'.
+# Also, PAM will deny null passwords by default.  If you need to allow
+# null passwords, add the "     nullok" option to the end of the
+# securityserver.so line in /etc/pam.d/sshd.
+UsePAM yes
+
+#AllowAgentForwarding yes
+#AllowTcpForwarding yes
+#GatewayPorts no
+X11Forwarding yes
+#X11DisplayOffset 10
+#X11UseLocalhost yes
+#PrintMotd yes
+#PrintLastLog yes
+#TCPKeepAlive yes
+#UseLogin no
+#UsePrivilegeSeparation yes
+#PermitUserEnvironment no
+#Compression delayed
+#ClientAliveInterval 0
+#ClientAliveCountMax 3
+#UseDNS yes
+#PidFile /var/run/sshd.pid
+#MaxStartups 10
+#PermitTunnel no
+#ChrootDirectory none
+
+# no default banner path
+#Banner none
+
+# override default of no subsystems
+Subsystem       sftp    /usr/lib/openssh/sftp-server
+
+# Example of overriding settings on a per-user basis
+#Match User anoncvs
+#       X11Forwarding no
+#       AllowTcpForwarding no
+#       ForceCommand cvs server

docker/etc/sudoers.d/dokku-docker

@@ -1 +1 @@
-dokku    ALL=NOPASSWD:SETENV:/usr/bin/docker,/usr/bin/docker-image-labeler,/usr/bin/pack,/usr/bin/crontab
+dokku    ALL=NOPASSWD:SETENV:/usr/bin/docker,/usr/bin/docker-container-healthchecker,/usr/bin/docker-image-labeler,/usr/bin/lambda-builder,/usr/bin/nixpacks,/usr/bin/railpack,/usr/bin/pack

docker/usr/local/bin/lambda-builder

@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+set -eo pipefail
+[[ $TRACE ]] && set -x
+
+main() {
+  declare desc="re-runs lambda-builder commands as sudo"
+  local LAMBDA_BUILDER_BIN=""
+  if [[ -x "/usr/bin/lambda-builder" ]]; then
+    LAMBDA_BUILDER_BIN="/usr/bin/lambda-builder"
+  fi
+
+  if [[ -z "$LAMBDA_BUILDER_BIN" ]]; then
+    echo "!   No lambda-builder binary found" 1>&2
+    exit 1
+  fi
+
+  sudo -E "$LAMBDA_BUILDER_BIN" "$@"
+}
+
+main "$@"

docker/usr/local/bin/nixpacks

@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+set -eo pipefail
+[[ $TRACE ]] && set -x
+
+main() {
+  declare desc="re-runs nixpacks commands as sudo"
+  local NIXPACKS_BIN=""
+  if [[ -x "/usr/bin/nixpacks" ]]; then
+    NIXPACKS_BIN="/usr/bin/nixpacks"
+  fi
+
+  if [[ -z "$NIXPACKS_BIN" ]]; then
+    echo "!   No nixpacks binary found" 1>&2
+    exit 1
+  fi
+
+  sudo -E "$NIXPACKS_BIN" "$@"
+}
+
+main "$@"

docker/usr/local/bin/railpack

@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+set -eo pipefail
+[[ $TRACE ]] && set -x
+
+main() {
+  declare desc="re-runs railpack commands as sudo"
+  local RAILPACK_BIN=""
+  if [[ -x "/usr/bin/railpack" ]]; then
+    RAILPACK_BIN="/usr/bin/railpack"
+  fi
+
+  if [[ -z "$RAILPACK_BIN" ]]; then
+    echo "!   No railpack binary found" 1>&2
+    exit 1
+  fi
+
+  sudo -E "$RAILPACK_BIN" "$@"
+}
+
+main "$@"

docs.mk

@@ -0,0 +1,19 @@
+.PHONY: docs-build-image
+docs-build-image:
+	docker build -f docs/_build/Dockerfile --progress plain -t app/mkdocs .
+
+.PHONY: docs-build
+docs-build:
+	@docker run --rm -p 3487:3487 -v "$(PWD):/usr/src/source" --name docs-serve app/mkdocs build
+
+.PHONY: docs-serve
+docs-serve:
+	docker run --rm -p 3487:3487 -v "$(PWD):/usr/src/source" --name docs-serve app/mkdocs serve
+
+.PHONY: docs-deps
+docs-deps:
+	@docker run --rm -p 3487:3487 -v "$(PWD):/usr/src/app" app/mkdocs deps
+
+.PHONY: docs-enter
+docs-enter:
+	docker exec -it docs-serve bash

docs/README.md

@@ -0,0 +1,161 @@
+# Dokku Documentation
+
+This documentation covers the installation, configuration, and usage of Dokku - a Docker-powered PaaS that provides a Heroku-like experience.
+
+## Getting Started
+
+- [Installation](getting-started/installation/index.md) - Install Dokku on your server
+    - [Debian](getting-started/install/debian.md)
+    - [Docker](getting-started/install/docker.md)
+    - [DigitalOcean](getting-started/install/digitalocean.md)
+    - [Azure](getting-started/install/azure.md)
+    - [DreamHost](getting-started/install/dreamhost.md)
+    - [Vagrant](getting-started/install/vagrant.md)
+- [Advanced Installation](getting-started/advanced-installation.md) - Custom installation options
+- [Upgrading](getting-started/upgrading/index.md) - Upgrade to newer Dokku versions
+- [Uninstalling](getting-started/uninstalling.md) - Remove Dokku from your server
+- [Troubleshooting](getting-started/troubleshooting.md) - Common issues and solutions
+- [Where to Get Help](getting-started/where-to-get-help.md) - Support resources
+
+## Deployment
+
+- [Application Deployment](deployment/application-deployment.md) - Deploy your first app
+- [Application Management](deployment/application-management.md) - Manage deployed applications
+- [Logs](deployment/logs.md) - View application logs
+- [Remote Commands](deployment/remote-commands.md) - Run commands remotely
+- [User Management](deployment/user-management.md) - Manage SSH access
+- [Zero Downtime Deploys](deployment/zero-downtime-deploys.md) - Deploy without interruption
+
+### Deployment Methods
+
+- [Git](deployment/methods/git.md) - Deploy via git push
+- [Archive](deployment/methods/archive.md) - Deploy from tar/zip archives
+- [Image](deployment/methods/image.md) - Deploy from Docker images
+
+### Builders
+
+- [Builder Management](deployment/builders/builder-management.md) - Configure build systems
+- [Buildpack Management](deployment/builders/buildpack-management.md) - Manage buildpack settings
+- [Herokuish Buildpacks](deployment/builders/herokuish-buildpacks.md) - Heroku-compatible buildpacks
+- [Cloud Native Buildpacks](deployment/builders/cloud-native-buildpacks.md) - CNB support
+- [Dockerfiles](deployment/builders/dockerfiles.md) - Build from Dockerfile
+- [Nixpacks](deployment/builders/nixpacks.md) - Nixpacks builder
+- [Railpack](deployment/builders/railpack.md) - Railpack builder
+- [Lambda](deployment/builders/lambda.md) - Lambda-style functions
+- [Null Builder](deployment/builders/null.md) - Skip the build phase
+
+### Schedulers
+
+- [Scheduler Management](deployment/schedulers/scheduler-management.md) - Configure schedulers
+- [Docker Local](deployment/schedulers/docker-local.md) - Default Docker scheduler
+- [K3s](deployment/schedulers/k3s.md) - Lightweight Kubernetes
+- [Kubernetes](deployment/schedulers/kubernetes.md) - External Kubernetes clusters
+- [Nomad](deployment/schedulers/nomad.md) - HashiCorp Nomad
+- [Null Scheduler](deployment/schedulers/null.md) - Skip scheduling
+
+### Continuous Integration
+
+- [Generic CI](deployment/continuous-integration/generic.md) - General CI/CD setup
+- [GitHub Actions](deployment/continuous-integration/github-actions.md)
+- [GitLab CI](deployment/continuous-integration/gitlab-ci.md)
+- [Woodpecker CI](deployment/continuous-integration/woodpecker-ci.md)
+
+## Configuration
+
+- [Environment Variables](configuration/environment-variables.md) - Configure app environment
+- [Domains](configuration/domains.md) - Custom domain management
+- [SSL/TLS](configuration/ssl.md) - HTTPS and certificates
+
+## Networking
+
+- [Proxy Management](networking/proxy-management.md) - Reverse proxy configuration
+- [Port Management](networking/port-management.md) - Port mapping and exposure
+- [DNS](networking/dns.md) - DNS configuration
+- [Network](networking/network.md) - Docker network management
+
+### Proxies
+
+- [Nginx](networking/proxies/nginx.md) - Default proxy
+- [Caddy](networking/proxies/caddy.md)
+- [HAProxy](networking/proxies/haproxy.md)
+- [Traefik](networking/proxies/traefik.md)
+- [OpenResty](networking/proxies/openresty.md)
+
+## Processes
+
+- [Process Management](processes/process-management.md) - Scale and manage processes
+- [Scheduled Cron Tasks](processes/scheduled-cron-tasks.md) - Scheduled jobs
+- [One-off Tasks](processes/one-off-tasks.md) - Run one-time commands
+- [Entering Containers](processes/entering-containers.md) - Access running containers
+
+## Advanced Usage
+
+- [Persistent Storage](advanced-usage/persistent-storage.md) - Mount volumes
+- [Docker Options](advanced-usage/docker-options.md) - Custom Docker run arguments
+- [Resource Management](advanced-usage/resource-management.md) - CPU and memory limits
+- [Plugin Management](advanced-usage/plugin-management.md) - Install and manage plugins
+- [Registry Management](advanced-usage/registry-management.md) - Docker registry integration
+- [Repository Management](advanced-usage/repository-management.md) - Git repository settings
+- [Build Tracking](advanced-usage/builds.md) - Inspect, cancel, and manage builds
+- [Deployment Tasks](advanced-usage/deployment-tasks.md) - Pre/post deploy hooks
+- [Event Logs](advanced-usage/event-logs.md) - Dokku event history
+- [Backup and Recovery](advanced-usage/backup-recovery.md) - Data backup strategies
+
+## Development
+
+- [Architecture](development/architecture.md) - Internal architecture overview for contributors
+- [Plugin Creation](development/plugin-creation.md) - Build custom plugins
+- [Plugin Triggers](development/plugin-triggers.md) - Available plugin hooks
+- [Testing](development/testing.md) - Test Dokku and plugins
+- [Release Process](development/release-process.md) - How Dokku releases work
+
+## Community
+
+- [Plugins](community/plugins.md) - Community-maintained plugins
+- [Clients](community/clients.md) - API clients and tools
+
+## Enterprise
+
+- [Dokku Pro](enterprise/pro.md) - Commercial features and support
+
+## Appendices
+
+### Migration Guides
+
+- [0.38.0](appendices/0.38.0-migration-guide.md)
+- [0.37.0](appendices/0.37.0-migration-guide.md)
+- [0.36.0](appendices/0.36.0-migration-guide.md)
+- [0.35.0](appendices/0.35.0-migration-guide.md)
+- [0.34.0](appendices/0.34.0-migration-guide.md)
+- [0.33.0](appendices/0.33.0-migration-guide.md)
+- [0.32.0](appendices/0.32.0-migration-guide.md)
+- [0.31.0](appendices/0.31.0-migration-guide.md)
+- [0.30.0](appendices/0.30.0-migration-guide.md)
+- [0.29.0](appendices/0.29.0-migration-guide.md)
+- [0.28.0](appendices/0.28.0-migration-guide.md)
+- [0.27.0](appendices/0.27.0-migration-guide.md)
+- [0.26.0](appendices/0.26.0-migration-guide.md)
+- [0.25.0](appendices/0.25.0-migration-guide.md)
+- [0.24.0](appendices/0.24.0-migration-guide.md)
+- [0.23.0](appendices/0.23.0-migration-guide.md)
+- [0.22.0](appendices/0.22.0-migration-guide.md)
+- [0.21.0](appendices/0.21.0-migration-guide.md)
+- [0.20.0](appendices/0.20.0-migration-guide.md)
+- [0.10.0](appendices/0.10.0-migration-guide.md)
+- [0.9.0](appendices/0.9.0-migration-guide.md)
+- [0.8.0](appendices/0.8.0-migration-guide.md)
+- [0.7.0](appendices/0.7.0-migration-guide.md)
+- [0.6.0](appendices/0.6.0-migration-guide.md)
+- [0.5.0](appendices/0.5.0-migration-guide.md)
+
+### File Formats
+
+- [app.json](appendices/file-formats/app-json.md) - Application configuration
+- [Procfile](appendices/file-formats/procfile.md) - Process definitions
+- [Dockerfile](appendices/file-formats/dockerfile.md) - Docker build instructions
+- [.buildpacks](appendices/file-formats/buildpacks-file.md) - Buildpack configuration
+- [project.toml](appendices/file-formats/project-toml.md) - CNB configuration
+- [nixpacks.toml](appendices/file-formats/nixpacks-toml.md) - Nixpacks configuration
+- [railpack.json](appendices/file-formats/railpack-json.md) - Railpack configuration
+- [lambda.yml](appendices/file-formats/lambda-yml.md) - Lambda configuration
+- [nginx.conf.sigil](appendices/file-formats/nginx-conf-sigil.md) - Nginx template customization

docs/_build/Dockerfile

@@ -0,0 +1,12 @@
+FROM python:3.15.0rc1-alpine
+
+WORKDIR /usr/src/app
+
+COPY docs/_build/requirements.txt .
+
+RUN apk add --no-cache bash build-base yaml && \
+  pip install --no-cache-dir -r requirements.txt
+
+COPY docs/_build/entrypoint /bin/entrypoint
+
+ENTRYPOINT [ "/bin/entrypoint" ]

docs/_build/app-nginx.conf.sigil

@@ -0,0 +1,26 @@
+worker_processes 1;
+error_log stderr;
+pid nginx.pid;
+daemon off;
+
+events {
+  worker_connections 768;
+}
+
+http {
+  types_hash_max_size 2048;
+  include mime.types;
+  charset UTF-8;
+  server {
+    listen {{ $.PORT }};
+    server_name  _;
+    root /app/www;
+    index index.html;
+    port_in_redirect off;
+
+    include /app/www/nginx.conf.d/*.conf;
+    location / {
+      try_files $uri $uri/ =404;
+    }
+  }
+}

docs/_build/entrypoint

@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+set -eo pipefail
+
+write-mkdocs() {
+  if [[ -f /usr/src/source/contrib/write-mkdocs ]]; then
+    if ! python3 /usr/src/source/contrib/write-mkdocs; then
+      exit 0
+    fi
+  fi
+}
+
+main() {
+  declare CMD="$1" ARGS=("${@:2}")
+
+  if [[ "$CMD" == "build" ]]; then
+    write-mkdocs
+    echo "----> Executing mkdocs build"
+    mkdocs build
+    site_dir="$(grep site_dir mkdocs.yml | awk '{print $2}')"
+    cp -r "/usr/src/app/${site_dir}" "/usr/src/source/${site_dir}"
+
+    return $?
+  fi
+
+  if [[ "$CMD" == "deps" ]]; then
+    exec pip freeze
+  fi
+
+  if [[ "$CMD" == "serve" ]]; then
+    write-mkdocs
+    exec mkdocs serve -a 0.0.0.0:3487
+  fi
+
+  exec "$CMD" "${ARGS[@]}"
+}
+
+main "$@"

docs/_build/hooks.py

@@ -0,0 +1,407 @@
+#!/usr/bin/env python
+
+import posixpath
+import re
+
+from collections.abc import Callable
+from re import Match
+from mkdocs.config.defaults import MkDocsConfig
+from mkdocs.structure.files import File, Files
+from mkdocs.structure.pages import Page
+
+
+def on_page_markdown(markdown: str, *, page: Page, config: MkDocsConfig, files: Files) -> str | None:
+    resp = re_on_page_markdown(markdown, page=page, config=config, files=files)
+    if not resp:
+        return resp
+    
+
+    modifiers: list[Callable[[list[str], str], tuple[list[str], bool]]] = [
+        modify_content_noop,
+        modify_content_links,
+        modify_content_stripspace,
+        modify_content_admonition,
+        modify_content_terminal_example,
+    ]
+
+    is_modified = False
+    lines = resp.split("\n")
+    for modifier in modifiers:
+        lines, modified = modifier(lines, page.file.src_path)
+        if modified:
+            is_modified = True
+
+    if is_modified:
+        resp = "\n".join(lines)
+    
+    return resp
+
+
+def modify_content_noop(lines: list[str], _) -> tuple[list[str], bool]:
+    """
+    Simply returns the lines as is
+    """
+    modified = False
+    updated_lines = []
+    for line in lines:
+        updated_lines.append(line)
+    return updated_lines, modified
+
+
+def modify_content_links(lines: list[str], filename: str) -> tuple[list[str], bool]:
+    """
+    Modifies links to be relative instead of absolute
+    """
+    filename = filename.replace("/usr/src/source/docs/", "")
+    parts = filename.split("/")
+    parts.pop()
+    replacement = "](" + "/".join([".." for _ in parts]) + "/"
+    modified = False
+    updated_lines = []
+    for line in lines:
+        if "](/docs/" in line:
+            line = line.replace("](/docs/", replacement)
+            modified = True
+
+        updated_lines.append(line)
+    return updated_lines, modified
+
+
+def modify_content_stripspace(lines: list[str], _) -> tuple[list[str], bool]:
+    """
+    Removes trailing whitespace from each line
+    """
+    modified = False
+    updated_lines = []
+    for line in lines:
+        line = line.rstrip()
+        updated_lines.append(line)
+    return updated_lines, modified
+
+
+def is_github_new(line: str, next_line: str | None) -> bool:
+    """
+    Checks if a given line is a github "new as of" admonition
+    """
+    if not next_line:
+        return False
+
+    return line.startswith("> [!IMPORTANT]") and "new as of" in next_line.lower()
+
+
+def is_github_note(line: str) -> bool:
+    """
+    Checks if a given line is a github "note" admonition
+    """
+    return line.startswith("> [!NOTE]")
+
+
+def is_github_warning(line: str) -> bool:
+    """
+    Checks if a given line is a github "warning" admonition
+    """
+    return line.startswith("> [!WARNING]")
+
+
+def is_info(line: str) -> bool:
+    """
+    Checks if a given line is an "info" admonition
+    """
+    return line.startswith("> ")
+
+
+def is_new(line: str) -> bool:
+    """
+    Checks if a given line is a "new as of" admonition
+    """
+    return line.startswith("> ") and "new as of" in line.lower()
+
+
+def is_note(line: str) -> bool:
+    """
+    Checks if a given line is a "note" admonition
+    """
+    return line.startswith("> Note:")
+
+
+def is_warning(line: str) -> bool:
+    """
+    Checks if a given line is a "warning" admonition
+    """
+    return line.startswith("> Warning:")
+
+
+def modify_content_admonition(lines: list[str], filename: str) -> tuple[list[str], bool]:
+    """
+    Applies adminition info to each line in the output
+    """
+    modified = False
+    updated_lines = []
+    admonition_lines = []
+    is_admonition = False
+    replace_new_in_next_line = False
+    for index, line in enumerate(lines):
+        next_line: str | None = None
+        if index + 1 < len(lines):
+            next_line = lines[index + 1]
+
+        if replace_new_in_next_line:
+            line = line.replace("New as of", "Introduced in")
+            line = line.replace("new as of", "introduced in")
+            replace_new_in_next_line = False
+
+        if is_github_new(line, next_line):
+            line = line.replace("> [!IMPORTANT]", '!!! tip "New"')
+            is_admonition = True
+            admonition_lines.append(line)
+            admonition_lines.append("")
+            replace_new_in_next_line = True
+        elif is_github_note(line):
+            line = line.replace("> [!NOTE]", '!!! note "Note"')
+            is_admonition = True
+            admonition_lines.append(line)
+            admonition_lines.append("")
+        elif is_github_warning(line):
+            line = line.replace("> [!WARNING]", '!!! warning "Warning"')
+            is_admonition = True
+            admonition_lines.append(line)
+            admonition_lines.append("")
+        elif is_new(line):
+            print("is_new")
+            line = line.replace("> ", '!!! tip "New"\n\n    ')
+            line = line.replace("New as of", "Introduced in")
+            line = line.replace("new as of", "introduced in")
+            is_admonition = True
+            admonition_lines.append(line)
+        elif is_note(line):
+            print("is_note")
+            line = line.replace("> Note: ", '!!! note "Note"\n\n    ')
+            is_admonition = True
+            admonition_lines.append(line)
+        elif is_warning(line):
+            print("is_warning")
+            line = line.replace("> Warning: ", '!!! warning "Warning"\n\n    ')
+            is_admonition = True
+            admonition_lines.append(line)
+        elif is_info(line):
+            if not is_admonition:
+                line = line.replace("> ", '!!! info "Info"\n\n    ')
+            elif line in [">", "> "]:
+                line = ""
+            else:
+                line = "    " + line.removeprefix("> ")
+            is_admonition = True
+            admonition_lines.append(line)
+        elif is_admonition and line in [">", "> "]:
+            line = ""
+            admonition_lines.append(line)
+        elif is_admonition and line.startswith("> "):
+            line = "    " + line.removeprefix("> ")
+            admonition_lines.append(line)
+        elif line == "":
+            is_admonition = False
+            if len(admonition_lines) > 0:
+                modified = True
+                updated_lines.extend(admonition_lines)
+                admonition_lines = []
+            updated_lines.append("")
+        else:
+            updated_lines.append(line)
+    return updated_lines, modified
+
+
+def is_shell_codeblock_start(line: str) -> bool:
+    """
+    Checks to see if a line starts a codeblock
+    """
+    return line == "```shell"
+
+
+def modify_content_terminal_example(lines: list[str], _) -> tuple[list[str], bool]:
+    """
+    Modifies content so that terminal output is shown appropriately
+    """
+    modified = False
+    updated_lines = []
+    command_block = []
+    example_block = []
+    in_command_block = False
+    in_example_block = False
+    previous_block = ""
+    next_line_must_be = None
+    for line in lines:
+        if is_shell_codeblock_start(line):
+            command_block.append(line)
+            modified = True
+            in_command_block = True
+            continue
+        elif in_command_block:
+            command_block.append(line)
+            if line == "```":
+                in_command_block = False
+                previous_block = "command_block"
+                next_line_must_be = ""
+            continue
+        elif line == "```":
+            if previous_block == "":
+                updated_lines.append(line)
+                continue
+            if previous_block == "command_block":
+                example_block.append(line)
+
+                if in_example_block:
+                    previous_block = ""
+                    in_example_block = False
+                    updated_lines.append('=== "Shell"')
+                    updated_lines.append("")
+                    for command_line in command_block:
+                        updated_lines.append(f"    {command_line}")
+                    command_block = []
+
+                    updated_lines.append("")
+                    updated_lines.append('=== "Output"')
+                    updated_lines.append("")
+                    for example_line in example_block:
+                        updated_lines.append(f"    {example_line}")
+                    example_block = []
+                else:
+                    in_example_block = True
+                continue
+        elif previous_block == "command_block":
+            if next_line_must_be is None:
+                if in_example_block:
+                    example_block.append(line)
+                else:
+                    updated_lines.extend(command_block)
+                    updated_lines.append("")
+                    updated_lines.append(line)
+                    command_block = []
+                    previous_block = ""
+                continue
+            if next_line_must_be == "":
+                if line == "":
+                    next_line_must_be = None
+                    continue
+
+        updated_lines.append(line)
+
+    if len(command_block) > 0:
+        updated_lines.extend(command_block)
+
+    return updated_lines, modified
+
+
+def re_on_page_markdown(markdown: str, *, page: Page, config: MkDocsConfig, files: Files) -> str | None:
+    """
+    This hook is called after the page's markdown is loaded from file and can be
+    """
+
+    def replace(match: Match):
+        badge_type, args = match.groups()
+        args = args.strip()
+        if badge_type == "version":
+            return _badge_for_version(args, page, files)
+        if badge_type == "scheduler":
+            return _badge_for_scheduler(args, page, files)
+        if type == "flag":
+            return flag(args, page, files)
+
+        # Otherwise, raise an error
+        raise RuntimeError(f"Unknown shortcode: {badge_type}")
+
+    return re.sub(r"<!-- md:(\w+)(.*?) -->", replace, markdown, flags=re.I | re.M)
+
+
+def _badge(icon: str, text: str = "", badge_type: str = ""):
+    """
+    Create badge
+    """
+    classes = f"mdx-badge mdx-badge--{badge_type}" if badge_type else "mdx-badge"
+    text = f"{text}{{ data-preview='' }}" if text.endswith(")") else text
+    return "".join(
+        [
+            f'<span class="{classes}">',
+            *([f'<span class="mdx-badge__icon">{icon}</span>'] if icon else []),
+            *([f'<span class="mdx-badge__text">{text}</span>'] if text else []),
+            "</span>",
+        ]
+    )
+
+
+def _badge_for_scheduler(text: str, page: Page, files: Files):
+    """
+    Create badge for scheduler
+    """
+
+    # Return badge
+    icon = "simple-docker"
+    if text in ["kubernetes", "k3s"]:
+        icon = "simple-kubernetes"
+        text = "k3s"
+    elif text == "nomad":
+        icon = "simple-nomad"
+    elif text in ["docker", "docker-local"]:
+        icon = "simple-docker"
+        text = "docker-local"
+
+    href = f"https://dokku.com/docs/deployment/schedulers/{text}/"
+    return _badge(
+        icon=f"[:{icon}:]({href} '{text}')",
+        text=f"[{text}]({href})",
+    )
+
+
+def _badge_for_version(text: str, page: Page, files: Files):
+    """
+    Create badge for version
+    """
+
+    # Return badge
+    icon = "material-tag-outline"
+    href = f"https://github.com/dokku/dokku/releases/tag/v{text}"
+    return _badge(
+        icon=f"[:{icon}:]({href} 'Since {text}')",
+        text=f"[{text}]({href})",
+    )
+
+
+def flag(args: str, page: Page, files: Files):
+    """
+    Create flag
+    """
+
+    flag_type, *_ = args.split(" ", 1)
+    if flag_type == "experimental":
+        return _badge_for_experimental(page, files)
+    raise RuntimeError(f"Unknown flag type: {flag_type}")
+
+
+def _badge_for_experimental(page: Page, files: Files):
+    """
+    Create badge for experimental
+    """
+
+    icon = "material-flask-outline"
+    href = _resolve_path("conventions.md#experimental", page, files)
+    return _badge(icon=f"[:{icon}:]({href} 'Experimental')")
+
+
+def _resolve_path(path: str, page: Page, files: Files):
+    """
+    Resolve path of file relative to given page - the posixpath always includes
+    one additional level of `..` which we need to remove
+    """
+
+    path, anchor, *_ = f"{path}#".split("#")
+    path = _resolve(files.get_file_from_path(path), page)
+    return "#".join([path, anchor]) if anchor else path
+
+
+def _resolve(file: File, page: Page):
+    """
+    Resolve path of file relative to given page - the posixpath always includes
+    one additional level of `..` which we need to remove
+    """
+
+    path = posixpath.relpath(file.src_uri, page.file.src_uri)
+    return posixpath.sep.join(path.split(posixpath.sep)[1:])

docs/_build/requirements.txt

@@ -0,0 +1,23 @@
+beautifulsoup4==4.15.0
+click==8.4.2
+ghp-import==2.1.0
+importlib-metadata==9.0.0
+Jinja2==3.1.6
+Markdown>=3.10.3,<3.11
+MarkupSafe==3.0.3
+mergedeep==1.3.4
+mkdocs==1.6.1
+mkdocs-exclude==1.0.2
+mkdocs-material==9.7.7
+mkdocs-material-extensions==1.3.1
+packaging==26.3
+Pygments==2.21.0
+pymdown-extensions==11.0.1
+pyparsing==3.3.2
+python-dateutil==2.9.0.post0
+PyYAML==6.0.3
+pyyaml_env_tag==1.1
+six==1.17.0
+soupsieve==2.9.2
+watchdog==6.0.0
+zipp==4.1.0

docs/_overrides/main.html

@@ -0,0 +1,56 @@
+<!--
+  Copyright (c) 2016-2022 Martin Donath <martin.donath@squidfunk.com>
+  Permission is hereby granted, free of charge, to any person obtaining a copy
+  of this software and associated documentation files (the "Software"), to
+  deal in the Software without restriction, including without limitation the
+  rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
+  sell copies of the Software, and to permit persons to whom the Software is
+  furnished to do so, subject to the following conditions:
+  The above copyright notice and this permission notice shall be included in
+  all copies or substantial portions of the Software.
+  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+  IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+  FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL THE
+  AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+  LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+  FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
+  IN THE SOFTWARE.
+-->
+
+{% extends "base.html" %}
+
+<!-- Custom front matter -->
+{% block extrahead %}
+
+  <!-- Extra style sheets (can't be set in mkdocs.yml due to content hash) -->
+  <link
+    rel="stylesheet"
+    href="{{ 'overrides/assets/stylesheets/main.css' | url }}"
+  />
+{% endblock %}
+
+<!-- Announcement bar -->
+{% block announce %}
+  <a href="https://twitter.com/dokku">
+    For updates follow <strong>@dokku</strong> on
+    <span class="twemoji twitter">
+      {% include ".icons/fontawesome/brands/twitter.svg" %}
+    </span>
+    <strong>Twitter</strong>
+  </a>
+{% endblock %}
+
+<!-- Theme-related JavaScript -->
+{% block scripts %}
+  {{ super() }}
+
+  <!-- Extra JavaScript (can't be set in mkdocs.yml due to content hash) -->
+  <script src="{{ 'overrides/assets/javascripts/bundle.js' | url }}"></script>
+{% endblock %}
+
+{% block outdated %}
+  You're not viewing the latest version.
+  <a href="{{ page.abs_url }}">
+    <strong>Click here to go to latest.</strong>
+  </a>
+{% endblock %}

docs/advanced-usage/backup-recovery.md

@@ -6,7 +6,8 @@ The best plan for disaster recovery is to always keep multiple (remote) copies o
 
 ## TLDR
 
-> Warning: This method has many caveats. Please read this entire document before assuming these backups work as expected, and test your backups on a regular basis.
+> [!WARNING]
+> This method has many caveats. Please read this entire document before assuming these backups work as expected, and test your backups on a regular basis.
 
 ### Creating a backup
 
@@ -95,6 +96,14 @@ System administrators are highly encouraged to store persistent data in app-spec
 
 See the [persistent storage documentation](/docs/advanced-usage/persistent-storage.md) for more information on how to attach persistent storage to your app.
 
+### Restoring on a machine with a different CPU Architecture
+
+When restoring a backup on a machine that has a different CPU architecture, you will need to clear out the `~/.basher`  as it's not portable across different CPU architectures. Do so with the following command immediately after restoring your dokku configs:
+
+```shell
+rm -rf /home/dokku/.basher
+```
+
 ## Recovering app code
 
 In case of an emergency when your git repo and backups are completely lost, you can recover the last pushed copy from your remote Dokku server (assuming you still have the ssh key).

docs/advanced-usage/builds.md

@@ -0,0 +1,197 @@
+# Build Tracking
+
+> [!IMPORTANT]
+> New as of 0.38.0
+
+Every deploy that flows through Dokku - whether triggered by `git push`, `ps:rebuild`, `ps:restart`, `config:set`, or `git:from-archive` / `git:from-image` / `git:sync` / `git:load-image` - is recorded as a structured build record on disk. The `builds` plugin lets operators inspect what is currently deploying, look up the result of an old deploy, and stream the captured build log without depending on `journalctl`.
+
+```
+builds:cancel <app>                               # Cancel a running build for an app
+builds:info <app> <build-id> [--format json]      # Show details for a single build
+builds:list [<app>] [--format json] [--kind ...] [--status ...]
+                                                  # List builds (running across all apps, or running + history for one)
+builds:output <app> [<build-id>|current]          # Show build output (tail for live, cat for finished)
+builds:prune <app> [--all-apps]                   # Reap abandoned records and apply retention
+builds:report [<app>] [<flag>]                    # Display a build report
+builds:set [--global|<app>] <key> [<value>]       # Set or clear a builds property
+```
+
+## Build records
+
+Every build is identified by a sortable base36 ULID-style id (`DOKKU_BUILD_ID`) generated at deploy start. For each build, Dokku writes:
+
+- `$DOKKU_LIB_ROOT/data/builds/<app>/<build-id>.json` - the structured record
+- `$DOKKU_LIB_ROOT/data/builds/<app>/<build-id>.log` - the captured stdout/stderr of the deploy
+
+Output is also tagged into syslog as `dokku-<build-id>` so `journalctl -t dokku-<build-id>` continues to work. The on-disk log file is the durable source of truth and is read for `builds:output` even when journald has rotated old entries away.
+
+### Record schema
+
+```json
+{
+  "id": "01j8c4xv7bk5w3",
+  "app": "myapp",
+  "kind": "build",
+  "pid": 12345,
+  "started_at": "2026-04-30T13:50:00Z",
+  "finished_at": "2026-04-30T13:51:14Z",
+  "status": "succeeded",
+  "source": "git-hook",
+  "exit_code": 0
+}
+```
+
+- **kind** - `build` for paths that produce a new image (`git push`, `git:*`, `ps:rebuild`); `deploy` for paths that re-deploy an existing image (`ps:restart`, `ps:start`, `dokku deploy`, `config:set`).
+- **status** - on-disk values are `running | succeeded | failed | canceled`. `abandoned` is a fifth display-only value computed at read time for `running` records whose PID is no longer alive; it is never persisted to the record.
+- **source** - the user-typed command that originated the deploy (e.g. `git-hook`, `ps:restart`, `config-redeploy`, `git:sync`).
+
+## Listing builds
+
+Without an app argument, `builds:list` shows currently-running builds across every app on the host:
+
+```shell
+dokku builds:list
+```
+
+```
+=====> Currently running builds
+App        Build ID        Kind   PID    Source     Started
+myapp      01j8c4xv7bk5w3  build  12345  git-hook   2026-04-30T13:50:00Z
+```
+
+With an app, `builds:list` returns running builds plus the most recent finalized records up to the configured retention:
+
+```shell
+dokku builds:list myapp
+```
+
+Filter by kind or status:
+
+```shell
+dokku builds:list myapp --kind build
+dokku builds:list myapp --status running
+dokku builds:list --format json
+```
+
+## Inspecting a single build
+
+```shell
+dokku builds:info myapp 01j8c4xv7bk5w3
+```
+
+```
+=====> Build 01j8c4xv7bk5w3
+       Build ID:   01j8c4xv7bk5w3
+       App:        myapp
+       Kind:       build
+       Status:     succeeded
+       PID:        12345
+       Source:     git-hook
+       Started:    2026-04-30T13:50:00Z
+       Finished:   2026-04-30T13:51:14Z
+       Duration:   1m14s
+       Exit Code:  0
+       Log:        /var/lib/dokku/data/builds/myapp/01j8c4xv7bk5w3.log
+```
+
+JSON output includes the same fields plus a computed `log_path`:
+
+```shell
+dokku builds:info myapp 01j8c4xv7bk5w3 --format json | jq .
+```
+
+## Streaming build output
+
+```shell
+# tail -f the live build, or cat the log for a finished one
+dokku builds:output myapp 01j8c4xv7bk5w3
+
+# resolve "current" from the in-flight deploy
+dokku builds:output myapp current
+```
+
+If the on-disk log file is missing (for example, a build from before this plugin was installed), `builds:output` falls back to `journalctl -t dokku-<build-id>`.
+
+## Cancelling a build
+
+`builds:cancel` reads the active `.deploy.lock` for an app, looks up the matching build record, and sends `SIGQUIT` to the deploy's process group. The record is finalized as `canceled` (or `failed` if the process had already exited without finalizing - in that case Dokku marks the record so it doesn't sit in `running` forever).
+
+```shell
+dokku builds:cancel myapp
+```
+
+If the record is already finalized when cancel runs, no signal is sent and the record is left untouched.
+
+## Retention
+
+Build records are pruned by count, not by age. The default retention is **20** records per app. Live in-flight deploys are never pruned regardless of count.
+
+Set a per-app retention:
+
+```shell
+dokku builds:set myapp retention 50
+```
+
+Set the global default:
+
+```shell
+dokku builds:set --global retention 10
+```
+
+Clear an override (falls back to the global value, then the default):
+
+```shell
+dokku builds:set myapp retention
+```
+
+## Manual pruning
+
+`builds:prune` invokes the same logic that runs at the end of every deploy - it reaps abandoned records (status=running with a dead PID, finalized as `failed`) and trims the directory to the configured retention. Useful after lowering retention via `builds:set` or to clean up after a host reboot:
+
+```shell
+dokku builds:prune myapp
+dokku builds:prune --all-apps
+```
+
+## Reports
+
+```shell
+dokku builds:report
+dokku builds:report myapp
+dokku builds:report myapp --build-status
+```
+
+Available flags:
+
+- `--build-id`, `--build-kind`, `--build-status`, `--build-pid`, `--build-source`, `--build-started-at`, `--build-finished-at`, `--build-exit-code`: details of the most recent build for the app
+- `--builds-retention`: per-app retention override (empty if none)
+- `--builds-global-retention`: global retention override (empty if none)
+- `--builds-computed-retention`: the resolved retention applied to this app
+
+`--build-status` returns the **display** status, so an abandoned in-flight build shows `abandoned` rather than `running`. The raw on-disk status is only visible by reading the JSON record directly.
+
+## Properties
+
+### Settable properties
+
+> [!NOTE]
+> The `Report flags` column lists the CLI argument names accepted by `builds:report`. The JSON keys emitted by `builds:report --format json` are the same names with the leading `--builds-` stripped (e.g. `retention`, `global-retention`, `computed-retention`). Legacy keys with the `builds-` prefix (e.g. `builds-retention`) are also emitted during the 0.38.x deprecation window and will be removed in a future major release. Status keys (`build-id`, `build-status`, etc.) have no plugin prefix and are unaffected.
+
+| Property | Scope | Default | Report flags | Description |
+|---|---|---|---|---|
+| `retention` | app + global | `20` | `--builds-retention`, `--builds-global-retention`, `--builds-computed-retention` | Number of recent build records kept per app; older finalized records are pruned at the end of each deploy |
+
+### Read-only flags
+
+The following flags surface in `builds:report` but are not managed by `builds:set` - they are derived metadata recorded during the build:
+
+| Flag | Description |
+|---|---|
+| `--build-id` | Unique identifier of the most recent build for the app |
+| `--build-kind` | Whether the record was a `build` or a `deploy` |
+| `--build-status` | Display status (`running`, `succeeded`, `failed`, `canceled`, `abandoned`); computed at read time |
+| `--build-source` | Trigger that started the build (e.g. `git-hook`, `ps:rebuild`, `ps:restart`) |
+| `--build-pid` | PID of the build process |
+| `--build-started-at` | UNIX timestamp the build started |
+| `--build-finished-at` | UNIX timestamp the build finished |
+| `--build-exit-code` | Exit code of the build process |

docs/advanced-usage/deployment-tasks.md

@@ -1,5 +1,6 @@
 # Deployment Tasks
 
+> [!IMPORTANT]
 > New as of 0.5.0
 
 ## Usage
@@ -17,30 +18,30 @@ To support this, Dokku provides support for a special `release` command within y
 Each "phase" has different expectations and limitations:
 
 - `app.json`: `scripts.dokku.predeploy`
-  - When to use: This should be used if your app does not support arbitrary build commands and you need to make changes to the built image.
-  - Are changes committed to the image at this phase: Yes
-  - Example use-cases
-    - Bundling assets in a slightly different way
-    - Installing a custom package from source or copying a binary into place
+    - When to use: This should be used if your app does not support arbitrary build commands and you need to make changes to the built image.
+    - Are changes committed to the image at this phase: Yes
+    - Example use-cases
+        - Bundling assets in a slightly different way
+        - Installing a custom package from source or copying a binary into place
 - `app.json`: `scripts.dokku.postdeploy`
-  - When to use: This should be used in conjunction with external systems to signal the completion of your deploy.
-  - Are changes committed to the image at this phase: No
-  - Example use-cases
-    - Notifying slack that your app is deployed
-    - Coordinating traffic routing with a central load balancer
+    - When to use: This should be used in conjunction with external systems to signal the completion of your deploy.
+    - Are changes committed to the image at this phase: No
+    - Example use-cases
+        - Notifying slack that your app is deployed
+        - Coordinating traffic routing with a central load balancer
 - `app.json`: `scripts.postdeploy`
-  - When to use: This should be used when you wish to run a command _once_, after the app is created and not on subsequent deploys to the app.
-  - Are changes committed to the image at this phase: No
-  - Example use-cases
-    - Setting up OAuth clients and DNS
-    - Loading seed/test data into the app’s test database
+    - When to use: This should be used when you wish to run a command _once_, after the app is created and not on subsequent deploys to the app.
+    - Are changes committed to the image at this phase: No
+    - Example use-cases
+        - Setting up OAuth clients and DNS
+        - Loading seed/test data into the app’s test database
 - `Procfile`: `release`
-  - When to use: This should be used in conjunction with external systems to signal the completion of your app image build.
-  - Are changes committed to the image at this phase: No
-  - Example use-cases
-    - Sending CSS, JS, and other assets from your app’s slug to a CDN or S3 bucket
-    - Priming or invalidating cache stores
-    - Running database migrations
+    - When to use: This should be used in conjunction with external systems to signal the completion of your app image build.
+    - Are changes committed to the image at this phase: No
+    - Example use-cases
+        - Sending CSS, JS, and other assets from your app’s slug to a CDN or S3 bucket
+        - Priming or invalidating cache stores
+        - Running database migrations
 
 Additionally, if using a Dockerfile with an `ENTRYPOINT`, the deployment task is passed to that entrypoint as is. The exceptions are if the entrypoint is one of the following:
 
@@ -55,12 +56,19 @@ Please keep the above in mind when utilizing deployment tasks.
 
 ### Changing the `app.json` location
 
-When deploying a monorepo, it may be desirable to specify the specific path of the `app.json` file to use for a given app. This can be done via the `app-json:set` command. If a value is specified and that file does not exist within the repository, Dokku will continue the build process as if the repository has no `app.json` file.
+The `app.json` is expected to be found in a specific directory, depending on the deploy approach:
+
+- The `WORKDIR` of the Docker image for deploys resulting from `git:from-image` and `git:load-image` commands.
+- The root of the source code tree for all other deploys (git push, `git:from-archive`, `git:sync`).
+
+Sometimes it may be desirable to set a different path for a given app, e.g. when deploying from a monorepo. This can be done via the `appjson-path` property:
 
 ```shell
-dokku app-json:set node-js-app appjson-path second-app.json
+dokku app-json:set node-js-app appjson-path .dokku/app.json
 ```
 
+The value is the path to the desired file *relative* to the base search directory, and will never be treated as absolute paths in any context. If that file does not exist within the repository, Dokku will continue the build process as if the repository has no `app.json`.
+
 The default value may be set by passing an empty value for the option:
 
 ```shell
@@ -81,6 +89,7 @@ dokku app-json:set --global appjson-path
 
 ### Displaying app-json reports for an app
 
+> [!IMPORTANT]
 > New as of 0.25.0
 
 You can get a report about the app's storage status using the `app-json:report` command:
@@ -92,18 +101,20 @@ dokku app-json:report
 ```
 =====> node-js-app app-json information
        App-json computed appjson path: app2.json
-       App-json global appjson path:   app.json
+       App-json global appjson path:
        App-json appjson path:          app2.json
 =====> python-sample app-json information
        App-json computed appjson path: app.json
-       App-json global appjson path:   app.json
+       App-json global appjson path:
        App-json appjson path:
 =====> ruby-sample app-json information
        App-json computed appjson path: app.json
-       App-json global appjson path:   app.json
+       App-json global appjson path:
        App-json appjson path:
 ```
 
+The `appjson-path` and `global-appjson-path` keys hold the raw per-app and global value respectively, and are empty when nothing has been set. The `computed-appjson-path` key holds the effective value used at deploy time, falling back to the global value (where one has been set) and then to the built-in default of `app.json`.
+
 You can run the command for a specific app also.
 
 ```shell
@@ -113,7 +124,7 @@ dokku app-json:report node-js-app
 ```
 =====> node-js-app app-json information
        App-json computed appjson path: app2.json
-       App-json global appjson path:   app.json
+       App-json global appjson path:
        App-json appjson path:          app2.json
 ```
 
@@ -137,9 +148,8 @@ Dokku provides limited support for the `app.json` manifest from Heroku (document
 - `scripts.dokku.postdeploy`: This is run _after_ an app's containers are scheduled. Changes made to your image are _not_ committed at this phase.
 - `scripts.postdeploy`: This is run _after_ an app's containers are scheduled. Changes made to your image are _not_ committed at this phase.
 
-For buildpack-based deployments, the location of the `app.json` file should be at the root of your repository. Dockerfile-based app deploys should have the `app.json` in the configured `WORKDIR` directory; otherwise Dokku defaults to the buildpack app behavior of looking in `/app`.
-
-> Warning: Any failed `app.json` deployment task will fail the deploy. In the case of either phase, a failure will not affect any running containers.
+> [!WARNING]
+> Any failed `app.json` deployment task will fail the deploy. In the case of either phase, a failure will not affect any running containers.
 
 The following is an example `app.json` file. Please note that only the `scripts.dokku.predeploy` and `scripts.dokku.postdeploy` tasks are supported by Dokku at this time. All other fields will be ignored and can be omitted.
 
@@ -157,6 +167,7 @@ The following is an example `app.json` file. Please note that only the `scripts.
 
 #### Procfile Release command
 
+> [!IMPORTANT]
 > New as of 0.14.0
 
 The `Procfile` also supports a special `release` command which acts in a similar way to the [Heroku Release Phase](https://devcenter.heroku.com/articles/release-phase). This command is executed _after_ an app's docker image is built, but _before_ any containers are scheduled. This is also run _after_ any command executed by `scripts.dokku.predeploy`.
@@ -169,4 +180,5 @@ release: curl https://some.external.api.service.com/deployment?state=built
 
 Unlike the `scripts.dokku.predeploy` command, changes made during by the `release` command are _not_ persisted to disk.
 
-> Warning: scaling the release command up will likely result in unspecified issues within your deployment, and is highly discouraged.
+> [!WARNING]
+> scaling the release command up will likely result in unspecified issues within your deployment, and is highly discouraged.

docs/advanced-usage/docker-options.md

@@ -1,57 +1,128 @@
 # Docker Container Options
 
+> [!IMPORTANT]
 > New as of 0.3.17
 
-Pass [container options](https://docs.docker.com/engine/reference/run/) to the `docker run` command  during Dokku's `build`, `deploy` and `run` phases
-
 ```
-docker-options:add <app> <phase(s)> OPTION    # Add Docker option to app for phase (comma-separated phase list)
-docker-options:clear <app> [<phase(s)>...]    # Clear a docker options from application
-docker-options:remove <app> <phase(s)> OPTION # Remove Docker option from app for phase (comma-separated phase list)
-docker-options:report [<app>] [<flag>]        # Displays a docker options report for one or more apps
+docker-options:add [--process PROC...] <app> <phase(s)> OPTION    # Add Docker option to app for phase
+docker-options:clear [--process PROC...] <app> [<phase(s)>...]    # Clear docker options from app
+docker-options:list <app> [--process PROC] --phase PHASE          # List docker options for one process+phase pair
+docker-options:remove [--process PROC...] <app> <phase(s)> OPTION # Remove Docker option from app for phase
+docker-options:report [<app>] [<flag>] [--format json|stdout]     # Displays a docker options report for one or more apps
 ```
 
-> When specifying multiple phases, they **must** be comma-separated _without_ spaces in between each phase, like so:
->
-> ```shell
-> dokku docker-options:add node-js-app deploy,run "-v /var/log/node-js-app:/app/logs"
-> ```
+The `docker-options` plugin allows users to specify custom [container options](https://docs.docker.com/engine/reference/run/) for containers created by Dokku at various phases.
 
-## About Dokku phases
+## Usage
 
-Dokku deploys your application in multiple "phases" and the `docker-options` plugin allows you to pass arguments to their underlying docker container:
+### Background
 
-- `build`: the container that executes the appropriate buildpack
-- `deploy`: the container that executes your running/deployed application
-- `run`: the container that executes any arbitrary command via `dokku run`
+#### Phases
 
-Manipulation of docker options will not restart running containers. This enables multiple options to be set/unset before final application. As such, changing an app's docker options must be followed by a `dokku ps:rebuild` in order to take effect.
+Dokku deploys your app in multiple "phases" and the `docker-options` plugin allows you to pass arguments to their underlying docker container:
 
-More information on supported Docker options can be found here: https://docs.docker.com/engine/reference/commandline/run/.
+- `build`: The `build` phase is used to provide container options that are available during the build process for use by the various builders.
+    - A given builder may strip out or ignore options that are unsupported by the builder in question - as an example, the `dockerfile` builder does not support mounted volumes.
+- `deploy`: The `deploy` phase is used to provide container options that are set on _deployed_ process types. This covers every process type specified in an app `Procfile` as well as any default processes your app may deploy.
+    - The `deploy` phase is usually the correct phase to add options for running containers.
+- `run`: The `run` phase is used to provide container options to one-off containers created by `dokku run`, `dokku run:detached`, and any cron tasks specified in your `app.json`.
+
+> [!IMPORTANT]
+> The `run` phase does _not_ correspond 1-to-1 to `docker run` or `docker container run` commands. Specifying a container option at the `run` phase will only be invoked on containers created by the `run` plugin and cron tasks. Please be sure to specify options at the correct phase for your use-case.
+
+Adding or removing docker-options will not apply to any running containers, and only applies to containers created _after_ the options have been modified. As such, changing an app's docker options must be followed by a `dokku ps:rebuild` or a deploy in order to take effect.
+
+#### Supported Docker Options
+
+More information on supported Docker options can be found [here](https://docs.docker.com/engine/reference/commandline/run/).
 
 Container options configured via the `docker-options` plugin are not used to modify the process a container runs. Container options are the `[OPTIONS]` portion of the following, where `[CONTAINER_COMMAND]` and `[ARG]` are the process and the arguments passed to it that are launched in the created container: `docker run [OPTIONS] [CONTAINER_COMMAND] [ARG...]`. Please see the documentation for [customizing the run command](/docs/deployment/builders/dockerfiles.md#customizing-the-run-command) or use a [Procfile](/docs/deployment/builders/dockerfiles.md#procfiles-and-multiple-processes) to modify the command used by a Dockerfile-based container.
 
-## Examples
+#### Scheduler support
 
-### Add Docker options
+Docker options are written in Docker's own vocabulary and are passed verbatim to `docker run` by the `docker-local` scheduler. Other schedulers translate only the subset that has an equivalent in their own runtime, and ignore the rest.
 
-Add some options for the deployed/running app and when executing [`dokku run`](/docs/processes/one-off-tasks.md):
+The `k3s` scheduler translates `--cap-add`, `--cap-drop`, `--privileged`, and `--sysctl` into their Kubernetes equivalents. See the [k3s scheduler documentation](/docs/deployment/schedulers/k3s.md) for details, including the restriction that only namespaced sysctls can be set on a pod.
 
 ```shell
-# Mount a host volume in a Docker container: "-v /host/path:/container/path"
-dokku docker-options:add node-js-app deploy "-v /var/log/node-js-app:/app/logs"
-dokku docker-options:add node-js-app run "-v /var/log/node-js-app:/app/logs"
+dokku docker-options:add node-js-app deploy "--sysctl net.ipv4.ip_unprivileged_port_start=1024"
 ```
 
-> Note: When [mounting a host directory](https://docs.docker.com/engine/reference/run/#volume-shared-filesystems) in a Dokku app you should first create that directory as user `dokku` and then mount the directory under `/app` in the container using `docker-options` as above. Otherwise the app will lack write permission in the directory.
+#### Mounting volumes and host directories
 
-### Remove a Docker option
+Docker supports volume and host directory mounting via the `-v` or `--volume` flags. In order to simplify usage, Dokku provides a `storage` plugin as an abstraction to interact with persistent storage. In most cases, the Dokku project recommends using the persistent storage plugin over directly manipulating docker options at different phases. See the [persistent storage documentation](/docs/advanced-usage/persistent-storage.md) for more information on how to attach persistent storage to your app.
+
+### Commands
+
+#### Add Docker options
+
+To add a docker option to an app, use the `docker-options:add` command. This takes an app name, a comma-separated list of phases, and the docker-option to add.
 
 ```shell
-dokku docker-options:remove node-js-app run "-v /var/log/node-js-app:/app/logs"
+dokku docker-options:add node-js-app deploy "--ulimit nofile=12"
 ```
 
-### Clear all Docker options for an app
+Multiple phases can be specified by using a comma when specifying phases:
+
+```shell
+dokku docker-options:add node-js-app deploy,run "--ulimit nofile=12"
+```
+
+Multiple docker options can also be specified in a single call. Each `--flag [value]` group is detected on flag boundaries, shell-tokenized for quoting safety, and stored as its own entry so it round-trips through `docker-options:report` and `docker-options:list`:
+
+```shell
+dokku docker-options:add node-js-app deploy "--ulimit nofile=12" "--shm-size 256m"
+```
+
+Option values are stored and passed to the container verbatim. Quoting only controls how a value is split into words - no shell expansion is performed, so `$(...)`, backticks, `$VAR`, and globs are treated literally rather than being interpreted by the shell. This is what lets values such as a Traefik router rule be applied as-is:
+
+```shell
+dokku docker-options:add node-js-app deploy '--label "traefik.http.routers.web.rule=Host(`node-js-app.example.com`) && PathPrefix(`/api`)"'
+```
+
+> [!WARNING]
+> Options added before 0.38.25 were expanded by the shell when a container was created. Any such option that relied on shell expansion - `$(...)`, backticks, or `$VAR` - is treated as a literal string after upgrading and must be re-added with the value already resolved:
+>
+> ```shell
+> dokku docker-options:remove node-js-app deploy "--group-add \$(getent group docker | cut -d: -f3)"
+> dokku docker-options:add node-js-app deploy "--group-add $(getent group docker | cut -d: -f3)"
+> ```
+
+A misplaced `--process PROC` (i.e. one specified after the app name instead of before it) is honored as a subcommand flag rather than stored as a docker option, so the two invocations below behave identically:
+
+```shell
+dokku docker-options:add --process web node-js-app deploy "--ulimit nofile=12" "--shm-size 256m"
+dokku docker-options:add node-js-app deploy "--ulimit nofile=12" "--shm-size 256m" --process web
+```
+
+#### Remove a Docker option
+
+To remove docker options from an app, use the `docker-options:remove` command. This takes an app name, a comma-separated list of phases, and the docker-option to remove.
+
+```shell
+dokku docker-options:remove node-js-app run "--ulimit nofile=12"
+```
+
+Multiple phases can be specified by using a comma when specifying phases:
+
+```shell
+dokku docker-options:remove node-js-app deploy,run "--ulimit nofile=12"
+```
+
+Multiple docker options can also be removed in a single call, mirroring the splitting that `docker-options:add` performs:
+
+```shell
+dokku docker-options:remove node-js-app deploy "--ulimit nofile=12" "--shm-size 256m"
+```
+
+A stored option is matched by shell word rather than by exact string, so the value only has to be equivalent to the stored one, not byte-identical. Quoting an option one way removes an option that was stored quoted another way:
+
+```shell
+dokku docker-options:add node-js-app deploy "--label 'com.example.owner=platform team'"
+dokku docker-options:remove node-js-app deploy '--label "com.example.owner=platform team"'
+```
+
+#### Clear all Docker options for an app
 
 Docker options can be removed for a specific app using the `docker-options:clear` command.
 
@@ -82,8 +153,9 @@ dokku docker-options:clear node-js-app build,run
 -----> Clearing docker-options for node-js-app on phase run
 ```
 
-### Displaying docker-options reports for an app
+#### Displaying docker-options reports for an app
 
+> [!IMPORTANT]
 > New as of 0.8.1
 
 You can get a report about the app's docker-options status using the `docker-options:report` command:
@@ -95,8 +167,8 @@ dokku docker-options:report
 ```
 =====> node-js-app docker options information
        Docker options build:
-       Docker options deploy: -v /var/log/node-js-app:/app/logs
-       Docker options run:  -v /var/log/node-js-app:/app/logs
+       Docker options deploy: --ulimit nofile=12 --shm-size 256m
+       Docker options run:  --ulimit nofile=12 --shm-size 256m
 =====> python-sample docker options information
        Docker options build:
        Docker options deploy:
@@ -125,3 +197,101 @@ You can pass flags which will output only the value of the specific information
 ```shell
 dokku docker-options:report node-js-app --docker-options-build
 ```
+
+When process-specific options are configured (see below), the report exposes one additional dynamic flag per configured `process.deploy` pair, named `--docker-options-deploy.<process>`:
+
+```shell
+dokku docker-options:report node-js-app --docker-options-deploy.web
+```
+
+A machine-readable JSON view is available via `--format json`:
+
+```shell
+dokku docker-options:report node-js-app --format json
+```
+
+The JSON report includes the existing string keys (`build`, `deploy`, `run`, and `deploy.<process>` when configured) plus parallel `-list` keys for the same shorthand keys. Each `-list` value is a JSON array with one element per option as originally stored via `docker-options:add`, which allows export tooling to round-trip options that contain spaces without splitting the legacy space-joined strings. Empty phases emit an empty array (`[]`). The deprecated `docker-options-*` prefixed keys are unchanged and do not gain `-list` companions.
+
+```json
+{
+  "build": "",
+  "build-list": [],
+  "deploy": "-v /logs:/logs --memory=512m",
+  "deploy-list": ["-v /logs:/logs", "--memory=512m"],
+  "run": "",
+  "run-list": [],
+  "deploy.web": "-p 8080:5000",
+  "deploy.web-list": ["-p 8080:5000"],
+  "docker-options-build": "",
+  "docker-options-deploy": "-v /logs:/logs --memory=512m",
+  "docker-options-run": "",
+  "docker-options-deploy.web": "-p 8080:5000"
+}
+```
+
+### Process-Specific Options
+
+> [!IMPORTANT]
+> New as of 0.38.0
+
+Docker options can be scoped to specific process types declared in the app's `Procfile` by passing one or more `--process` flags. This is useful when a deploy-phase option (for example a port mapping) makes sense for one process type but would conflict with another - the canonical case being a `web` process that needs `-p 6789:5000` published while the `worker` process must not bind that port.
+
+Process scoping is supported only for the `deploy` phase. The `build` phase runs once per app and the `run` phase covers ad-hoc commands and cron tasks where no Procfile process type is in play; both reject `--process`.
+
+There is no `--global` flag. Omitting `--process` keeps the historical behavior of applying the option to every container in the app. Avoiding a `--global` flag here is intentional: elsewhere in Dokku `--global` means "across all apps" (e.g. `dokku config:set --global`), which would be misleading in this plugin where the scope is always one app.
+
+#### Setting process-specific options
+
+```shell
+# Add a port mapping only to the web process
+dokku docker-options:add --process web node-js-app deploy "-p 6789:5000"
+
+# Add a GPU mount only to the worker process
+dokku docker-options:add --process worker node-js-app deploy "--gpus all"
+```
+
+Multiple `--process` flags can be combined to apply the same option to several process types in one call:
+
+```shell
+dokku docker-options:add --process web --process api node-js-app deploy "-v /shared:/shared"
+```
+
+If `--process` names a process type that is not currently declared in the app's `Procfile`, the command succeeds but emits a warning. This allows configuring options ahead of a deploy that adds the new process type.
+
+The `_default_` value is reserved internally and cannot be passed to `--process`.
+
+#### Removing and clearing process-specific options
+
+```shell
+# Remove a single option from one process
+dokku docker-options:remove --process web node-js-app deploy "-p 6789:5000"
+
+# Clear every option for a process+phase
+dokku docker-options:clear --process worker node-js-app deploy
+```
+
+Without `--process`, `:remove` and `:clear` operate on the default scope only - per-process lists are left untouched.
+
+#### Listing options for a process and phase
+
+The `docker-options:list` command prints the options stored for a single process+phase pair, one option per line. Omitting `--process` lists the default scope.
+
+```shell
+dokku docker-options:list node-js-app --process web --phase deploy
+dokku docker-options:list node-js-app --phase deploy
+```
+
+## Properties
+
+### Internal properties
+
+The following properties are recorded internally by the docker-options plugin and are not exposed via `docker-options:report`:
+
+| Property | Scope | Description | Source |
+|---|---|---|---|
+| `migrated-from-files` | global | Global migration sentinel that records that the legacy `DOCKER_OPTIONS_<PHASE>` flat-file store has been drained into plugin properties | `plugins/docker-options/functions.go` writes `"true"` once the install-time migration runs |
+| `migrated-build` | per-app | Per-app marker recording that the app's legacy `DOCKER_OPTIONS_BUILD` file was drained into the `_default_.build` property list. Only set when the legacy file contained non-empty content | `plugins/docker-options/functions.go` writes `"true"` after the per-phase drain |
+| `migrated-deploy` | per-app | Per-app marker recording that the app's legacy `DOCKER_OPTIONS_DEPLOY` file was drained into the `_default_.deploy` property list. Only set when the legacy file contained non-empty content | `plugins/docker-options/functions.go` writes `"true"` after the per-phase drain |
+| `migrated-run` | per-app | Per-app marker recording that the app's legacy `DOCKER_OPTIONS_RUN` file was drained into the `_default_.run` property list. Only set when the legacy file contained non-empty content | `plugins/docker-options/functions.go` writes `"true"` after the per-phase drain |
+| `migrated-traefik-backticks` | global | Global sentinel recording that stored Traefik labels whose backticks carried a stray backslash have been repaired | `plugins/docker-options/functions.go` writes `"true"` once the install-time repair runs |
+| `migrated-canonical-options` | global | Global sentinel recording that stored options have been rewritten into the canonical form, quoting values whose shell metacharacters were left bare by an older legacy-file drain and splitting entries that carried several flags | `plugins/docker-options/functions.go` writes `"true"` once the install-time rewrite runs |

docs/advanced-usage/event-logs.md

@@ -1,5 +1,6 @@
 # Dokku Event Logs
 
+> [!IMPORTANT]
 > New as of 0.3.21
 
 Docker provides an _events_ command to show system's real time events. Likewise, Dokku can record events as syslog entries and also provides a plugin to display the last ones.
@@ -33,7 +34,6 @@ dokku events
 Jul  3 16:09:48 dokku.me dokku[127630]: INVOKED: pre-release-buildpack( pythonapp )
 Jul  3 16:10:02 dokku.me dokku[128095]: INVOKED: docker-args-run( rubyapp )
 Jul  3 16:10:02 dokku.me dokku[128114]: INVOKED: docker-args-run( nhl )
-Jul  3 16:10:03 dokku.me dokku[128136]: INVOKED: post-release-buildpack( pythonapp )
 Jul  3 16:10:03 dokku.me dokku[128195]: INVOKED: pre-deploy( pythonapp )
 Jul  3 16:10:23 dokku.me dokku[129253]: INVOKED: docker-args-deploy( pythonapp )
 Jul  3 16:10:24 dokku.me dokku[129451]: INVOKED: check-deploy( pythonapp 6274ced0d4be11af4490cd18abaf77cdd593f025133f403d984e80d86a39acec web 5000 10.0.16.80 )
@@ -68,8 +68,6 @@ post-build-dockerfile
 post-delete
 post-deploy
 post-domains-update
-post-release-buildpack
-post-release-dockerfile
 pre-build-buildpack
 pre-build-dockerfile
 pre-delete
@@ -78,4 +76,4 @@ pre-release-buildpack
 pre-release-dockerfile
 receive-app
 update
-```
+```

docs/advanced-usage/persistent-storage.md

@@ -1,38 +1,100 @@
 # Persistent Storage
 
-> New as of 0.5.0
+> [!IMPORTANT]
+> New as of 0.5.0. Named storage entries new as of 0.38.0.
 
-The preferred method to mount external containers to a Dokku managed container, is to use the Dokku storage plugin.
+The preferred method to attach persistent storage to a Dokku-managed container is the Dokku storage plugin.
 
 ```
-storage:ensure-directory [--chown option] <directory>  # Creates a persistent storage directory in the recommended storage path
-storage:list <app>                                     # List bind mounts for app's container(s) (host:container)
-storage:mount <app> <host-dir:container-dir>           # Create a new bind mount
-storage:report [<app>] [<flag>]                        # Displays a checks report for one or more apps
-storage:unmount <app> <host-dir:container-dir>         # Remove an existing bind mount
+storage:annotations:report [<name>] [<flag>]           # Display annotations for one or more storage entries
+storage:annotations:set <name> <key> [<value>]         # Set or clear a single annotation on a storage entry
+storage:create <name> [<path>] [flags]                 # Register a named storage entry
+storage:destroy <name> [--force] [--destroy-host-dir]  # Remove a named storage entry (must be unmounted from every app first)
+storage:ensure-directory [--chown option] <directory>  # [DEPRECATED] use storage:create instead
+storage:exec <name> [-- <cmd>...]                      # Run a command (or shell) in a temporary container that mounts the entry
+storage:info <name> [--format text|json]               # Show details for one storage entry
+storage:labels:report [<name>] [<flag>]                # Display labels for one or more storage entries
+storage:labels:set <name> <key> [<value>]              # Set or clear a single label on a storage entry
+storage:list <app> [--format text|json]                # List bind mounts for an app's container(s) (legacy host:container view)
+storage:list-entries [--scheduler s] [--format text|json]  # List registered storage entries
+storage:mount <app> <name> --container-dir <path> [flags]  # Mount a named entry into an app
+storage:mount <app> <host-dir:container-dir>           # [LEGACY] colon-form mount, docker-local only
+storage:report [<app>] [<flag>]                        # Display a storage report for one or more apps
+storage:report --global                                # Display a cluster-wide entry inventory
+storage:set <name> <property> [<value>]                # Update a storage entry in place
+storage:unmount <app> <name> [--container-dir <path>]  # Remove an attachment
+storage:wait <name>                                    # Block until a k3s entry's PVC is bound
 ```
 
-> The storage plugin is compatible with storage mounts created with the docker-options. The storage plugin will only list mounts from the deploy/run phase.
+A storage entry is the source of truth for the underlying volume - a host directory on docker-local, or a PersistentVolumeClaim on k3s. Multiple apps can mount the same entry, and an attachment carries the per-app details (container path, phases, subpath, readonly, process type). Names are globally unique across the install and must be DNS-1123 labels (lowercase letters, digits, dashes) of 45 characters or less so they can be used verbatim as Helm release and PVC names.
+
+The legacy `storage:mount <app> <host>:<container>` form continues to work on docker-local. On a k3s app it is rejected; create a named entry with `storage:create --scheduler k3s` and mount it instead. Existing colon-form mounts are migrated automatically the first time the new code runs - they show up as `legacy-<hash>` entries in `storage:list-entries`.
 
 The storage plugin supports the following mount points:
 
-- explicit paths that exist on the host
-- docker volumes
+- explicit paths that exist on the host (docker-local)
+- docker volumes (docker-local)
+- PersistentVolumeClaims provisioned via a StorageClass (k3s)
+- hostPath-backed PVs (k3s)
 
 ## Usage
 
+### Listing persistent storage
+
+Persistent storage bind mounts are specified on a per-app basis, and can be listed with the `storage:list` command:
+
+```shell
+dokku storage:list node-js-app
+```
+
+```
+-----> node-js-app volume bind-mounts:
+       /var/lib/dokku/data/storage/node-js-app:/app/storage
+```
+
+The output format can also be set to `json` for programmatic access:
+
+```shell
+dokku storage:list node-js-app --format json
+```
+
+```
+[
+  {
+    "entry_name": "node-js-app",
+    "host_path": "/var/lib/dokku/data/storage/node-js-app",
+    "container_path": "/app/storage"
+  }
+]
+```
+
+Each entry mirrors the underlying attachment. `readonly` (boolean) and `volume_options` (string) reflect `Attachment.Readonly` and `Attachment.VolumeOptions` directly and are only present when set, so external tooling can drift-detect attachments against the raw attachment fields. For example, a mount created with `--volume-options noexec,nosuid --volume-readonly` renders as:
+
+```
+[
+  {
+    "entry_name": "node-js-data",
+    "host_path": "/var/lib/dokku/data/storage/node-js-data",
+    "container_path": "/app/storage",
+    "readonly": true,
+    "volume_options": "noexec,nosuid"
+  }
+]
+```
+
 ### Creating storage directories
 
+> [!IMPORTANT]
 > New as of 0.25.5
 
 A storage directory can be created with the `storage:ensure-directory` command. This command will create a subdirectory in the recommended `/var/lib/dokku/data/storage` path - created during Dokku installation - and prepare it for use with an app.
 
 ```shell
-dokku storage:ensure-directory lollipop
+dokku storage:ensure-directory node-js-app
 ```
 
 ```
------> Ensuring /var/lib/dokku/data/storage/lollipop exists
+-----> Ensuring /var/lib/dokku/data/storage/node-js-app exists
        Setting directory ownership to 32767:32767
        Directory ready for mounting
 ```
@@ -40,16 +102,137 @@ dokku storage:ensure-directory lollipop
 By default, permissions are set for usage with Herokuish buildpacks. These permissions can be changed via the `--chown` option according to the following table:
 
 - `--chown herokuish` (default): Use `32767:32767` as the folder permissions.
-  - This is used for apps deployed with Buildpacks via Herokuish.
+    - This is used for apps deployed with Buildpacks via Herokuish.
 - `--chown heroku`: Use `1000:1000` as the folder permissions.
-  - This is used for apps deployed with Cloud Native Buildpacks using the `heroku/buildpacks` builder.
-- `--chown packeto`: Use `2000:2000` as the folder permissions.
-  - This is used for apps deployed with Cloud Native Buildpacks using the `cloudfoundry/cnb` or `packeto` builders.
+    - This is used for apps deployed with Cloud Native Buildpacks using the `heroku/builder` builder.
+- `--chown paketo`: Use `2000:2000` as the folder permissions.
+    - This is used for apps deployed with Cloud Native Buildpacks using the `cloudfoundry/cnb` or `paketo` builders.
+- `--chown root`: Use `0:0` as the folder permissions.
+    - This is used for containers that run their processes as root, as is typical for most Dockerfile or Docker image deploys.
 - `--chown false`: Skips the `chown` call.
+- `--chown <uid>`: Use `<uid>:<uid>` as the folder permissions, where `<uid>` is a custom numeric user/group id.
+    - This is used for containers that run their processes as a uid/gid that doesn't correspond to any of the above named options.
 
 Users deploying via Dockerfile will want to specify `--chown false` and manually `chown` the created directory if the user and/or group id  of the runnning process in the deployed container do not correspond to any of the above options.
 
-> Warning: Failing to set the correct directory ownership may result in issues in persisting files written to the mounted storage directory.
+The `--chown` flag - whether on `storage:create` or `storage:ensure-directory` - only manages the default `/var/lib/dokku/data/storage/<name>` location. If a custom `<path>` is passed to `storage:create`, the chown call is refused and the operator must chown the path themselves.
+
+> [!WARNING]
+> Failing to set the correct directory ownership may result in issues in persisting files written to the mounted storage directory.
+
+### Setting directory permissions
+
+> [!IMPORTANT]
+> New as of 0.38.27
+
+Where `--chown` states who owns the host directory, `--mode` states its permission bits. It takes a 3 or 4 digit octal mode, and is a `--mode` flag on `storage:create` and a `mode` property on `storage:set`:
+
+```shell
+dokku storage:create node-js-data --mode 0777
+```
+
+```shell
+dokku storage:set node-js-data mode 0770
+```
+
+Omitting the value clears the mode, leaving the directory's permissions alone on subsequent runs:
+
+```shell
+dokku storage:set node-js-data mode
+```
+
+Without a mode, a newly created directory keeps the `0755` default and a pre-existing directory keeps whatever permissions it already had. The value is stored on the entry and re-applied every time `storage:create` or `storage:set` runs against it, so a declarative caller converges the directory by re-running the same command rather than reaching for `chmod` over SSH. The mode is shown by `storage:info`:
+
+```shell
+dokku storage:info node-js-data
+```
+
+```
+-----> Storage entry node-js-data
+       Scheduler:        docker-local
+       Host path:        /var/lib/dokku/data/storage/node-js-data
+       Mode:             0777
+```
+
+The mode is applied to the directory itself and does not recurse into its contents. Like `--chown`, it is docker-local only and only manages the default `/var/lib/dokku/data/storage/<name>` location - it is refused for k3s entries and for entries created with a custom `<path>`. That refusal also covers migrated `legacy-*` entries, whose host paths come from the original colon-form mount rather than the default location.
+
+### Updating a storage entry
+
+> [!IMPORTANT]
+> The property form is new as of 0.38.27. Prior versions used flags, which still work but emit a deprecation warning.
+
+An existing entry is edited with `storage:set`, which takes a property and a value. Omitting the value unsets the property, restoring whatever the entry defaults to:
+
+```shell
+dokku storage:set node-js-data chown herokuish
+dokku storage:set node-js-data chown
+```
+
+The following properties can be set:
+
+| Property | Description | Unsetting it means |
+|---|---|---|
+| `chown` | Ownership preset or numeric uid for the host directory | no chown is performed |
+| `mode` | Octal permissions for the host directory | permissions are left alone |
+| `namespace` | Namespace holding the PVC (k3s) | the `default` namespace |
+| `reclaim-policy` | Whether the underlying volume survives `storage:destroy` | `Retain` |
+| `size` | PVC size (k3s) | rejected, since k3s entries require a size |
+| `access-mode` | PVC access mode (k3s) | rejected, see below |
+| `storage-class-name` | PVC storage class (k3s) | rejected, see below |
+
+`access-mode` and `storage-class-name` cannot be changed on an entry that already exists, because Kubernetes cannot apply either to a bound PVC. Both a different value and an empty one are refused, since clearing is equally a change:
+
+```shell
+dokku storage:set node-js-data access-mode ReadWriteMany
+```
+
+```
+ !     storage:set cannot change access-mode in place; recreate the entry
+```
+
+Setting `chown` or `mode` on a docker-local entry applies the change to the host directory immediately. Every other property is a metadata write, and k3s entries re-apply their helm release so the cluster picks the change up.
+
+The older flag form - `dokku storage:set node-js-data --mode 0770` - continues to work and warns. It gained unset semantics too, so `--mode ""` clears the mode the same way omitting the positional value does.
+
+### Annotations and labels
+
+> [!IMPORTANT]
+> New as of 0.38.27
+
+Annotations and labels are attached to a storage entry one key at a time, matching the [scheduler-k3s equivalents](/docs/deployment/schedulers/k3s.md#setting-annotations). On k3s they propagate to both the PersistentVolumeClaim and the PersistentVolume, so backup tools like Velero and Longhorn can find the volume.
+
+```shell
+dokku storage:annotations:set node-js-data backup.velero.io/backup-volumes node-js-data
+dokku storage:labels:set node-js-data app.kubernetes.io/part-of billing
+```
+
+Keys may contain `/`, as the Kubernetes-style keys above do, and are stored verbatim. To clear a single key, omit the value. Other keys are left untouched, so a declarative caller does not need to re-send the whole set on every call:
+
+```shell
+dokku storage:annotations:set node-js-data backup.velero.io/backup-volumes
+```
+
+Configured annotations and labels can be inspected with the matching report commands. Without an entry name they cover every registered entry:
+
+```shell
+dokku storage:annotations:report
+dokku storage:annotations:report node-js-data
+dokku storage:labels:report node-js-data
+```
+
+```
+=====> node-js-data annotations information
+       Annotation backup.velero.io/backup-volumes: node-js-data
+```
+
+JSON output emits the keys flat, and a single value can be read directly with a flag of the form `--storage-annotations.<key>` (or `--storage-labels.<key>`), which requires an entry name:
+
+```shell
+dokku storage:annotations:report node-js-data --format json
+dokku storage:annotations:report node-js-data --storage-annotations.backup.velero.io/backup-volumes
+```
+
+`storage:create` still accepts repeatable `--annotation key=value` and `--label key=value` flags for setting the initial set at creation time. The same flags on `storage:set` are deprecated in favor of these commands, because they replace the entire map rather than a single key.
 
 ### Mounting storage into apps
 
@@ -69,6 +252,17 @@ In the first example, Dokku will then mount the shared contents of `/var/lib/dok
 
 > If the `/storage` path within the container had pre-existing content, the container files will be over-written. This may be an issue for users that create assets at build time but then mount a directory at the same place during runtime. Files are not merged.
 
+For named storage entries, additional Docker mount options can be passed via `--volume-options`. The value is a comma-separated mount-options string stored verbatim on the attachment and rendered into the `-v` flag at deploy time. This is useful for SELinux labels (`Z`, `z`) or hardening flags (`noexec,nosuid`):
+
+```shell
+dokku storage:create node-js-data
+dokku storage:mount node-js-app node-js-data --container-dir /app/storage --volume-options Z
+```
+
+When combined with `--volume-readonly`, the rendered options become `ro,<volume-options>` - for example, `--volume-options noexec,nosuid --volume-readonly` renders as `:ro,noexec,nosuid`.
+
+Re-running `storage:mount` against a named entry with the same `--container-dir` and `--process-type` updates the existing attachment's mount-time attributes (`--phase`, `--volume-subpath`, `--volume-readonly`, `--volume-chown`, `--volume-options`) in place rather than appending a duplicate. This is the idempotent equivalent of `storage:set` for entries, and lets declarative tooling change a mount-time attribute without an unmount-then-remount dance that would briefly drop the volume from `storage:report`. Mount-time fields are rewritten wholesale, not merged - omitting a flag on a re-mount clears any previously-set value. The legacy `host:container[:opts]` form still rejects duplicates with `Mount path already exists.`.
+
 Once persistent storage is mounted, the app requires a restart. See the [process scaling documentation](/docs/processes/process-management.md) for more information.
 
 ```shell
@@ -93,8 +287,68 @@ Once persistent storage is unmounted, the app requires a restart. See the [proce
 dokku ps:restart app-name
 ```
 
+### Destroying storage entries
+
+A named storage entry can be removed with the `storage:destroy` command. The entry must first be unmounted from every app that mounts it.
+
+```shell
+dokku storage:destroy rdmtest-entry
+```
+
+As the command is destructive - removing the registry entry and, depending on the scheduler and reclaim policy, the underlying volume - it will default to asking for confirmation before executing the removal.
+
+```
+ !     WARNING: Potentially Destructive Action
+ !     This command will destroy storage entry rdmtest-entry.
+ !     To proceed, type "rdmtest-entry"
+> rdmtest-entry
+-----> Storage entry rdmtest-entry destroyed
+```
+
+The confirmation may be avoided by providing the `--force` flag, which is useful for non-interactive or automated callers:
+
+```shell
+dokku storage:destroy rdmtest-entry --force
+```
+
+The global `--force` flag is also supported:
+
+```shell
+dokku --force storage:destroy rdmtest-entry
+```
+
+#### Removing the host directory
+
+> [!IMPORTANT]
+> New as of 0.38.27
+
+By default a docker-local entry's host directory survives `storage:destroy` - the entry is deregistered but the data stays on disk. The `--destroy-host-dir` flag removes the directory and everything in it:
+
+```shell
+dokku storage:destroy node-js-data --destroy-host-dir
+```
+
+```
+ !     Storage entry node-js-data is backed by /var/lib/dokku/data/storage/node-js-data, which will be removed along with its contents.
+ !     WARNING: Potentially Destructive Action
+ !     This command will destroy storage entry node-js-data.
+ !     To proceed, type "node-js-data"
+```
+
+The removal is recursive, so it succeeds whether or not the directory is empty. It is only permitted for entries at the default `/var/lib/dokku/data/storage/<name>` location; an entry created with a custom `<path>` is refused, and the operator removes the path themselves.
+
+The same removal can be declared ahead of time with `--reclaim-policy`, which behaves for a docker-local host directory the way it behaves for a k3s PersistentVolume. An entry created with `Delete` has its host directory removed on `storage:destroy` without any extra flag, while `Retain` - the default when unset - keeps it:
+
+```shell
+dokku storage:create node-js-data --reclaim-policy Delete
+dokku storage:destroy node-js-data --force
+```
+
+`--destroy-host-dir` is docker-local only. On a k3s entry the underlying volume is already governed by the reclaim policy recorded on the entry, so passing the flag is an error.
+
 ### Displaying storage reports for an app
 
+> [!IMPORTANT]
 > New as of 0.8.1
 
 You can get a report about the app's storage status using the `storage:report` command:
@@ -137,6 +391,60 @@ You can pass flags which will output only the value of the specific information
 dokku storage:report node-js-app --storage-deploy-mounts
 ```
 
+In addition to the aggregated `Storage build/deploy/run mounts:` lines, the report emits one flat dotted key per attachment field, indexed from `1`. The key shape is `--storage-attachment.<index>.<field>` for each of `entry-name`, `host-path`, `container-path`, `phases`, `process-type`, `subpath`, `readonly`, `volume-options`, and `volume-chown`. Fields render as empty strings when unset, and attachments are ordered by lex-sort of the index (so `10` sorts before `2`):
+
+```shell
+dokku storage:create node-js-data
+dokku storage:mount node-js-app node-js-data --container-dir /app/storage --volume-options Z --volume-chown herokuish --volume-subpath uploads
+dokku storage:report node-js-app
+```
+
+```
+=====> node-js-app storage information
+       Storage attachment 1 container path:  /app/storage
+       Storage attachment 1 entry name:      node-js-data
+       Storage attachment 1 host path:       /var/lib/dokku/data/storage/node-js-data
+       Storage attachment 1 phases:          deploy,run
+       Storage attachment 1 process type:    _default_
+       Storage attachment 1 readonly:        false
+       Storage attachment 1 subpath:         uploads
+       Storage attachment 1 volume chown:    herokuish
+       Storage attachment 1 volume options:  Z
+       Storage build mounts:
+       Storage deploy mounts: -v /var/lib/dokku/data/storage/node-js-data:/app/storage:Z
+       Storage run mounts:  -v /var/lib/dokku/data/storage/node-js-data:/app/storage:Z
+```
+
+The same keys are exposed in JSON output, both in the stripped (`attachment.1.volume-options`) and legacy (`storage-attachment.1.volume-options`) forms:
+
+```shell
+dokku storage:report node-js-app --format json | jq '. | with_entries(select(.key | startswith("attachment.")))'
+```
+
+```json
+{
+  "attachment.1.container-path": "/app/storage",
+  "attachment.1.entry-name": "node-js-data",
+  "attachment.1.host-path": "/var/lib/dokku/data/storage/node-js-data",
+  "attachment.1.phases": "deploy,run",
+  "attachment.1.process-type": "_default_",
+  "attachment.1.readonly": "false",
+  "attachment.1.subpath": "uploads",
+  "attachment.1.volume-chown": "herokuish",
+  "attachment.1.volume-options": "Z"
+}
+```
+
+A single attachment field can be fetched directly via the info-flag form:
+
+```shell
+dokku storage:report node-js-app --storage-attachment.1.volume-options
+```
+
+```
+Z
+```
+
 ## Use Cases
 
 ### Sharing storage across deploys
@@ -165,14 +473,27 @@ dokku docker-options:add node-js-app build "-v /tmp/python-test:/opt/test"
 
 You cannot use mounted volumes during the build phase of a Dockerfile deploy. This is because Docker does not support volumes when executing `docker build`.
 
-> Note: **This can cause data loss** if you bind a mount under `/app` in buildpack apps as herokuish will attempt to remove the original app path during the build phase.
+> [!WARNING]
+> **This can cause data loss** if you bind a mount under `/app` in buildpack apps as herokuish will attempt to remove the original app path during the build phase.
 
 ## App User and Persistent Storage file ownership (buildpack apps only)
 
+> [!IMPORTANT]
 > New as of 0.7.1
 
 By default, Dokku will execute your buildpack app processes as the `herokuishuser` user. You may override this by setting the `DOKKU_APP_USER` config variable.
 
-> NOTE: this user must exist in your herokuish image.
+> [!NOTE]
+> this user must exist in your herokuish image.
 
-Additionally, the default `docker-local` scheduler that comes with Dokku will ensure your storage mounts are owned by either `herokuishuser` or the overridden value you have set in `DOKKU_APP_USER`. See the [docker-local scheduler documentation](/docs/advanced-usage/schedulers/docker-local.md#disabling-chown-of-persistent-storage) docs for more information.
+Additionally, the default `docker-local` scheduler that comes with Dokku will ensure your storage mounts are owned by either `herokuishuser` or the overridden value you have set in `DOKKU_APP_USER`. See the [docker-local scheduler documentation](/docs/deployment/schedulers/docker-local.md#disabling-chown-of-persistent-storage) docs for more information.
+
+## Properties
+
+### Internal properties
+
+The following property is recorded internally by the storage plugin and is not exposed via `storage:report`:
+
+| Property | Scope | Description | Source |
+|---|---|---|---|
+| `legacy-mounts-migrated` | per-app | Per-app marker recording that the app's legacy `-v` docker-options entries were drained into named storage entries plus attachments. Only set when at least one `-v` line was actually migrated; apps that have never had legacy mounts never receive this marker | `plugins/storage/migrate.go` writes `"true"` after a successful drain |

docs/advanced-usage/plugin-management.md

@@ -1,17 +1,18 @@
 # Plugin Management
 
+> [!IMPORTANT]
 > New as of 0.4.0
 
 ```
 plugin:disable <name>                    # Disable an installed plugin (third-party only)
 plugin:enable <name>                     # Enable a previously disabled plugin
-plugin:install [--core|git-url [--committish tag|branch|commit|--name custom-plugin-name]]           # Optionally download git-url (with custom tag/committish) & run install trigger for active plugins (or only core ones)
+plugin:install [--core|git-url] [--committish branch|commit|tag] [--name custom-plugin-name] [--skip-install-trigger] # Optionally download git-url (and pin to the specified branch/commit/tag) & run install trigger for active plugins (or only core ones)
 plugin:installed <name>                  # Checks if a plugin is installed
 plugin:install-dependencies [--core]     # Run install-dependencies trigger for active plugins (or only core ones)
-plugin:list                              # Print active plugins
+plugin:list [--format stdout|json]       # Print active plugins
 plugin:trigger <args...>.                # Trigger an arbitrary plugin hook
 plugin:uninstall <name>                  # Uninstall a plugin (third-party only)
-plugin:update [name [committish]]        # Optionally update named plugin from git (with custom tag/committish) & run update trigger for active plugins
+plugin:update [name [branch|commit|tag]] # Optionally update named plugin from git (and pin to the specified branch/commit/tag) & run update trigger for active plugins
 ```
 
 ```shell
@@ -35,38 +36,72 @@ dokku plugin:list
 
 ```
 plugn: dev
-  00_dokku-standard    0.27.6 enabled    dokku core standard plugin
-  20_events            0.27.6 enabled    dokku core events logging plugin
-  app-json             0.27.6 enabled    dokku core app-json plugin
-  apps                 0.27.6 enabled    dokku core apps plugin
-  build-env            0.27.6 enabled    dokku core build-env plugin
-  buildpacks           0.27.6 enabled    dokku core buildpacks plugin
-  certs                0.27.6 enabled    dokku core certificate management plugin
-  checks               0.27.6 enabled    dokku core checks plugin
-  common               0.27.6 enabled    dokku core common plugin
-  config               0.27.6 enabled    dokku core config plugin
-  docker-options       0.27.6 enabled    dokku core docker-options plugin
-  domains              0.27.6 enabled    dokku core domains plugin
-  enter                0.27.6 enabled    dokku core enter plugin
-  git                  0.27.6 enabled    dokku core git plugin
-  logs                 0.27.6 enabled    dokku core logs plugin
-  network              0.27.6 enabled    dokku core network plugin
-  nginx-vhosts         0.27.6 enabled    dokku core nginx-vhosts plugin
-  plugin               0.27.6 enabled    dokku core plugin plugin
-  proxy                0.27.6 enabled    dokku core proxy plugin
-  ps                   0.27.6 enabled    dokku core ps plugin
-  repo                 0.27.6 enabled    dokku core repo plugin
-  resource             0.27.6 enabled    dokku core resource plugin
-  scheduler-docker-local 0.27.6 enabled    dokku core scheduler-docker-local plugin
-  shell                0.27.6 enabled    dokku core shell plugin
-  ssh-keys             0.27.6 enabled    dokku core ssh-keys plugin
-  storage              0.27.6 enabled    dokku core storage plugin
-  tags                 0.27.6 enabled    dokku core tags plugin
-  tar                  0.27.6 enabled    dokku core tar plugin
-  trace                0.27.6 enabled    dokku core trace plugin
+  00_dokku-standard    0.38.27 enabled    dokku core standard plugin
+  20_events            0.38.27 enabled    dokku core events logging plugin
+  app-json             0.38.27 enabled    dokku core app-json plugin
+  apps                 0.38.27 enabled    dokku core apps plugin
+  build-env            0.38.27 enabled    dokku core build-env plugin
+  buildpacks           0.38.27 enabled    dokku core buildpacks plugin
+  certs                0.38.27 enabled    dokku core certificate management plugin
+  checks               0.38.27 enabled    dokku core checks plugin
+  common               0.38.27 enabled    dokku core common plugin
+  config               0.38.27 enabled    dokku core config plugin
+  docker-options       0.38.27 enabled    dokku core docker-options plugin
+  domains              0.38.27 enabled    dokku core domains plugin
+  enter                0.38.27 enabled    dokku core enter plugin
+  git                  0.38.27 enabled    dokku core git plugin
+  logs                 0.38.27 enabled    dokku core logs plugin
+  network              0.38.27 enabled    dokku core network plugin
+  nginx-vhosts         0.38.27 enabled    dokku core nginx-vhosts plugin
+  plugin               0.38.27 enabled    dokku core plugin plugin
+  proxy                0.38.27 enabled    dokku core proxy plugin
+  ps                   0.38.27 enabled    dokku core ps plugin
+  repo                 0.38.27 enabled    dokku core repo plugin
+  resource             0.38.27 enabled    dokku core resource plugin
+  scheduler-docker-local 0.38.27 enabled    dokku core scheduler-docker-local plugin
+  shell                0.38.27 enabled    dokku core shell plugin
+  ssh-keys             0.38.27 enabled    dokku core ssh-keys plugin
+  storage              0.38.27 enabled    dokku core storage plugin
+  tags                 0.38.27 enabled    dokku core tags plugin
+  tar                  0.38.27 enabled    dokku core tar plugin
+  trace                0.38.27 enabled    dokku core trace plugin
 ```
 
-> Warning: All plugin commands other than `plugin:list` and `plugin:help` require sudo access and must be run directly from the Dokku server.
+The list can also be emitted as JSON via the `--format json` flag. In addition to the name, version, enabled state, and description shown in the default output, the JSON output includes whether a plugin is a core plugin and - for git-based third-party plugins - the install source (the git remote URL, the currently checked-out commit, and the followed branch). This is useful for tooling that reconstructs a server's set of installed plugins:
+
+```shell
+dokku plugin:list --format json
+```
+
+```json
+[
+  {
+    "name": "apps",
+    "version": "0.38.27",
+    "enabled": true,
+    "core": true,
+    "description": "dokku core apps plugin",
+    "source_url": "",
+    "committish": "",
+    "branch": ""
+  },
+  {
+    "name": "postgres",
+    "version": "1.42.0",
+    "enabled": true,
+    "core": false,
+    "description": "dokku postgres service plugin",
+    "source_url": "https://github.com/dokku/dokku-postgres.git",
+    "committish": "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0",
+    "branch": "master"
+  }
+]
+```
+
+The `source_url`, `committish`, and `branch` fields are only populated for plugins installed from a git repository. They are empty for core plugins as well as for plugins installed from a tarball or a local `file://` path. When a plugin is pinned to a specific commit or tag (a detached checkout), the `branch` field is empty while `committish` still reports the exact commit.
+
+> [!WARNING]
+> All plugin commands other than `plugin:list` and `plugin:help` require sudo access and must be run directly from the Dokku server.
 
 ### Checking if a plugin is installed
 
@@ -78,6 +113,9 @@ dokku plugin:installed postgres
 
 ### Installing a plugin
 
+> [!NOTE]
+> Plugins installed in this method within a [docker-based installation](/docs/getting-started/install/docker.md) of Dokku do not persist across installs. Please see the [plugin installation section](/docs/getting-started/install/docker.md#plugin-installation) of the docker-based installation docs for further details.
+
 Installing a plugin is easy as well using the `plugin:install` command. This command will also trigger the `install` pluginhook on all existing plugins.
 
 The most common usage is to install a plugin from a url. This url may be any of the following:
@@ -123,6 +161,12 @@ The `--core` flag may also be indicated as the sole argument, though it is only
 dokku plugin:install --core
 ```
 
+If installing plugins in a Dockerfile, you will want to skip the `install` trigger. This will be run on container boot.
+
+```shell
+dokku plugin:install https://github.com/dokku/smoke-test-plugin.git --name smoke-test-plugin --skip-install-trigger
+```
+
 Finally, all flags may be omitted to trigger the `install` procedures for both core and third-party plugins:
 
 ```shell
@@ -163,6 +207,12 @@ An optional commit SHA-like object may be specified.
 dokku plugin:update postgres 2.0.0
 ```
 
+Any future invocation of `plugin:update` will respect the previously specified SHA-like object. To follow a particular branch again, specify that branch:
+
+```shell
+dokku plugin:update postgres main
+```
+
 ### Uninstalling a plugin
 
 Third party plugins can be uninstalled using the `plugin:uninstall` command:

docs/advanced-usage/registry-management.md

@@ -1,11 +1,13 @@
 # Registry Management
 
+> [!IMPORTANT]
 > New as of 0.25.0
 
 ```
-registry:login [--password-stdin] <server> <username> [<password>] # Login to a docker registry
-registry:report [<app>] [<flag>]                                   # Displays a registry report for one or more apps
-registry:set <app> <key> (<value>)                                 # Set or clear a registry property for an app
+registry:login [--global|--password-stdin] [<app>] <server> <username> [<password>] # Login to a docker registry
+registry:logout [--global] [<app>] <server>                                         # Logout from a docker registry
+registry:report [<app>] [<flag>]                                                    # Displays a registry report for one or more apps
+registry:set <app>|--global <key> (<value>)                                         # Set or clear a registry property for an app
 ```
 
 The registry plugin enables interacting with remote registries, which is useful when either deploying images via `git:from-image` or when interacting with custom schedulers to deploy built image artifacts.
@@ -14,34 +16,75 @@ The registry plugin enables interacting with remote registries, which is useful
 
 ### Logging into a registry
 
-The `registry:login` command can be used to log into a docker registry. The following are examples for logging into various common registries:
+The `registry:login` command can be used to log into a docker registry. Credentials can be stored globally (for all apps) or on a per-app basis.
+
+#### Global login
+
+To log in globally (credentials shared by all apps), use the `--global` flag:
 
 ```shell
 # hub.docker.com
-dokku registry:login docker.io $USERNAME $PASSWORD
+dokku registry:login --global docker.io $USERNAME $PASSWORD
 
 # digitalocean
 # the username and password are both defined as the same api token
-dokku registry:login registry.digitalocean.com $DIGITALOCEAN_API_TOKEN $DIGITALOCEAN_API_TOKEN
+dokku registry:login --global registry.digitalocean.com $DIGITALOCEAN_API_TOKEN $DIGITALOCEAN_API_TOKEN
 
 # github container registry
 # see the following link for information on retrieving a personal access token
 #   https://docs.github.com/en/packages/guides/pushing-and-pulling-docker-images#authenticating-to-github-container-registry
-dokku registry:login ghcr.io $USERNAME $REGISTRY_PAT_TOKEN
+dokku registry:login --global ghcr.io $USERNAME $REGISTRY_PAT_TOKEN
 
 # quay
 # a robot user may be used to login
-dokku registry:login quay.io $USERNAME $PASSWORD
+dokku registry:login --global quay.io $USERNAME $PASSWORD
 ```
 
-For security reasons, the password may also be specified as stdin by specifying the `--password-stdin` flag. This is supported regardless of the registry being logged into.
+> [!NOTE]
+> For backwards compatibility, if the `--global` flag is omitted and only three arguments are provided (server, username, password), the command will behave as a global login but will show a deprecation warning.
+
+#### Per-app login
+
+To log in for a specific app, specify the app name as the first argument:
 
 ```shell
-echo "$PASSWORD" | dokku registry:login --password-stdin docker.io $USERNAME
+# log into docker.io for a specific app
+dokku registry:login node-js-app docker.io $USERNAME $PASSWORD
+
+# log into ghcr.io for a specific app
+dokku registry:login node-js-app ghcr.io $USERNAME $REGISTRY_PAT_TOKEN
+```
+
+Per-app credentials are stored in `/var/lib/dokku/config/registry/$APP/config.json` and are automatically used for docker operations (build, push, pull) for that specific app.
+
+#### Password via stdin
+
+For security reasons, the password may also be specified as stdin by specifying the `--password-stdin` flag. This is supported for both global and per-app logins:
+
+```shell
+# global login via stdin
+echo "$PASSWORD" | dokku registry:login --global --password-stdin docker.io $USERNAME
+
+# per-app login via stdin
+echo "$PASSWORD" | dokku registry:login node-js-app --password-stdin docker.io $USERNAME
 ```
 
 For certain Docker registries - such as Amazon ECR or Google's GCR registries - users may instead wish to use a docker credential helper to automatically authenticate against a server; please see the documentation regarding the credential helper in question for further setup instructions.
 
+### Logging out from a registry
+
+The `registry:logout` command can be used to log out from a docker registry:
+
+```shell
+# global logout
+dokku registry:logout --global docker.io
+
+# per-app logout
+dokku registry:logout node-js-app docker.io
+```
+
+When an app is destroyed, any per-app registry credentials are automatically removed.
+
 ### Setting a remote server
 
 To specify a remote server registry for pushes, set the `server` property via the `registry:set` command. The default value for this property is empty string. Setting the value to `docker.io` or `hub.docker.com` will result in the computed value being empty string (as that is the default, implicit registry), while any non-zero length value will have a `/` appended to it if there is not one already.
@@ -69,22 +112,22 @@ dokku registry:set --global server
 The following are the values that should be used for common remote servers:
 
 - Amazon Elastic Container Registry:
-  - value: `$AWS_ACCOUNT_ID.dkr.ecr.$AWS_REGION.amazonaws.com/`
-  - notes: The `$AWS_ACCOUNT_ID` and `$AWS_REGION` should match the values for your account and region, respectively. Additionally, an IAM profile that allows `push` access to the repository specified by `image-repo` should be attached to your Dokku server.
+    - value: `$AWS_ACCOUNT_ID.dkr.ecr.$AWS_REGION.amazonaws.com/`
+    - notes: The `$AWS_ACCOUNT_ID` and `$AWS_REGION` should match the values for your account and region, respectively. Additionally, an IAM profile that allows `push` access to the repository specified by `image-repo` should be attached to your Dokku server.
 - Azure Container Registry:
-  - value `$REGISTRY_NAME.azurecr.io/`
-  - notes: The `$AKS_REGISTRY_NAME` should match the name of the registry created on your account.
+    - value `$REGISTRY_NAME.azurecr.io/`
+    - notes: The `$AKS_REGISTRY_NAME` should match the name of the registry created on your account.
 - Docker Hub:
-  - value: `docker.io/`
-  - notes: Requires owning the namespace used in the `image-repo` value.
+    - value: `docker.io/`
+    - notes: Requires owning the namespace used in the `image-repo` value.
 - Digitalocean:
-  - value: `registry.digitalocean.com/`
-  - notes: Requires setting the correct `image-repo` value for your registry.
+    - value: `registry.digitalocean.com/`
+    - notes: Requires setting the correct `image-repo` value for your registry.
 - Github Container Registry:
-  - value: `ghcr.io/`
-  - notes: Requires that the authenticated user has access to the namespace used in the `image-repo` value.
+    - value: `ghcr.io/`
+    - notes: Requires that the authenticated user has access to the namespace used in the `image-repo` value.
 - Quay.io:
-  - value: `quay.io/`
+    - value: `quay.io/`
 
 ### Specifying an image repository name
 
@@ -98,7 +141,31 @@ Setting the property value to an empty string will reset the value to the system
 
 ```shell
 # per-app
-dokku registry:set node-js-app push-on-release
+dokku registry:set node-js-app image-repo
+```
+
+### Templating the image repository name
+
+Instead of setting the image repository name on a per-app basis, it can be set via a template with the `image-repo-template` property. The property can be set globally or for a specific app, with the per-app value overriding the global value when both are present:
+
+```shell
+# globally
+dokku registry:set --global image-repo-template "my-awesome-prefix/{{ .AppName }}"
+
+# per-app
+dokku registry:set node-js-app image-repo-template "my-awesome-prefix/{{ .AppName }}-prod"
+```
+
+Dokku uses a Golang template and has access to the `AppName` variable as shown above. The per-app `image-repo` property always takes precedence over the rendered template when both are set.
+
+Setting the property value to an empty string will reset the value to the system default. Resetting the value can be done per app or globally.
+
+```shell
+# per-app
+dokku registry:set node-js-app image-repo-template
+
+# globally
+dokku registry:set --global image-repo-template
 ```
 
 ### Pushing images on build
@@ -124,3 +191,53 @@ dokku registry:set node-js-app push-on-release
 # globally
 dokku registry:set --global push-on-release
 ```
+
+#### Recovering from local image GC
+
+When `push-on-release` is enabled, Dokku treats the remote registry as the canonical store for app images. If a local image disappears - for example because a `docker image prune` cron ran, the host rebooted, or an operator removed it manually - subsequent commands that need the image (`ps:restart`, `ps:scale`, `dokku run`, `domains:add`, `certs:add`, etc.) will pull the missing tag back from the registry automatically. Per-app registry credentials configured via `registry:login` are honored during the pull. This recovery covers the deployed numeric tag pushed by the registry plugin - a missing `latest` tag will be ignored.
+
+### Push extra tags 
+
+To push the image on release with extra tags, set the `push-extra-tags` to a comma-separated list of tags via the `registry:set` command. The default value for this property is empty. Setting the property will result in the image being tagged with extra tags every release.
+
+```shell
+# multiple-tags
+dokku registry:set node-js-app push-extra-tags foo,bar
+```
+The `push-extra-tags` can be set to a single tag too.
+
+```shell
+# single tag
+dokku registry:set node-js-app push-extra-tags foo
+```
+
+This property can be set for a single app or globally via the `--global` flag. When set globally, the app-specific value will always overide the global value. The default global value for this property is `false`.
+
+```shell
+dokku registry:set --global push-extra-tags foo,bar
+```
+
+Setting the property value to an empty string will reset the value to the system default. Resetting the value can be done per app or globally.
+
+```shell
+# per-app
+dokku registry:set node-js-app push-extra-tags
+
+# globally
+dokku registry:set --global push-extra-tags
+```
+
+## Properties
+
+### Settable properties
+
+> [!NOTE]
+> The `Report flags` column lists the CLI argument names accepted by `registry:report`. The JSON keys emitted by `registry:report --format json` are the same names with the leading `--registry-` stripped (e.g. `image-repo`, `global-server`, `computed-push-on-release`). Legacy keys with the `registry-` prefix (e.g. `registry-image-repo`) are also emitted during the 0.38.x deprecation window and will be removed in a future major release.
+
+| Property | Scope | Default | Report flags | Description |
+|---|---|---|---|---|
+| `image-repo` | app only | `dokku/<app>` | `--registry-image-repo`, `--registry-computed-image-repo` | Repository name used when pushing the app's image (overrides the global template) |
+| `image-repo-template` | app + global | none | `--registry-image-repo-template`, `--registry-global-image-repo-template`, `--registry-computed-image-repo-template` | Go template used to compute the per-app image repository when `image-repo` is unset |
+| `push-extra-tags` | app + global | none | `--registry-push-extra-tags`, `--registry-global-push-extra-tags`, `--registry-computed-push-extra-tags` | Comma-separated list of additional tags pushed alongside the deploy tag |
+| `push-on-release` | app + global | `false` | `--registry-push-on-release`, `--registry-global-push-on-release`, `--registry-computed-push-on-release` | When `true`, pushes the image to the registry on every successful build |
+| `server` | app + global | none | `--registry-server`, `--registry-global-server`, `--registry-computed-server` | Registry server host (e.g. `ghcr.io`) used when pushing images |

docs/advanced-usage/repository-management.md

@@ -1,5 +1,6 @@
 # Repository Management
 
+> [!IMPORTANT]
 > New as of 0.6.0
 
 ```

docs/advanced-usage/resource-management.md

@@ -1,5 +1,6 @@
 # Resource Management
 
+> [!IMPORTANT]
 > New as of 0.15.0
 
 ```
@@ -16,7 +17,8 @@ The resource plugin is meant to allow users to limit or reserve resources for a
 
 By default, Dokku allows unlimited resource access to apps deployed on a server. In some cases, it may be desirable to limit this on a per-app or per-process-type basis. The `resource` plugin allows management of both resource "limits" and resource "reservations", where each resource request type has specific meaning to the scheduler in use for a given app.
 
-> Warning: The meaning of a values and it's units are specific to the scheduler in use for a given app. If a value is incorrect for a scheduler, this may result in containers failing to start correctly. If a scheduler does not support a given resource type combination, it will be ignored. All resource commands require an app rebuild or deploy in order to take effect.
+> [!WARNING]
+> The meaning of a values and it's units are specific to the scheduler in use for a given app. If a value is incorrect for a scheduler, this may result in containers failing to start correctly. If a scheduler does not support a given resource type combination, it will be ignored. All resource commands require an app rebuild or deploy in order to take effect.
 
 Valid resource options include:
 
@@ -28,9 +30,9 @@ Valid resource options include:
 - `--network-egress`
 - `--nvidia-gpu`
 
-See the [Supported Resource Management Properties](/docs/advanced-usage/schedulers/docker-local.md#supported-resource-management-properties) section of the docker local scheduler documentation for more information on how each resource limit maps to Docker.
+See the [Supported Resource Management Properties](/docs/deployment/schedulers/docker-local.md#supported-resource-management-properties) section of the docker local scheduler documentation for more information on how each resource limit maps to Docker.
 
-Resource limits and reservations are applied only during the `run` and `deploy` phases of an application, and will not impact the `build` phase of an application.
+Resource reservations are applied only during the `run` and `deploy` phases of an application. Resource limits also apply during the `build` phase when explicitly configured against the `build` process type - see [Build-time Resource Limits](#build-time-resource-limits) below.
 
 ### Resource Limits
 
@@ -118,6 +120,40 @@ dokku resource:limit --process-type web node-js-app
        nvidia-gpu:
 ```
 
+#### Build-time Resource Limits
+
+> [!IMPORTANT]
+> New as of 0.38.0
+
+Resource limits may be applied to the build container by using the special `build` process type. This allows constraining memory and CPU usage during the `build` phase, which is otherwise unconstrained.
+
+```shell
+dokku resource:limit --memory 4g --process-type build node-js-app
+```
+
+```
+=====> Setting resource limits for node-js-app (build)
+       memory: 4g
+```
+
+Build-time limits are applied via the `docker-args-process-build` plugin trigger. They do not inherit from default (`_default_`) limits - only limits explicitly set against the `build` process type are applied at build time. This is intentional: build phases often require more memory than the runtime process, and silently inheriting a small runtime limit would cause confusing OOM failures.
+
+> [!WARNING]
+> Do not use `build` as a runtime process type in your `Procfile`. The `build` name is reserved by the resource plugin to scope limits to the build container, and using it as a Procfile entry will cause those limits to be applied to that runtime container as well.
+
+Supported limits per builder:
+
+| Builder    | `--cpu` | `--memory` | `--memory-swap` | `--nvidia-gpu` |
+|------------|---------|------------|-----------------|----------------|
+| herokuish  | yes     | yes        | yes             | yes            |
+| dockerfile | no      | yes        | yes             | no             |
+| pack       | no      | no         | no              | no             |
+| nixpacks   | no      | no         | no              | no             |
+| railpack   | no      | no         | no              | no             |
+| lambda     | no      | no         | no              | no             |
+
+Resource keys outside the supported set for a builder are silently ignored. Reservations (`resource:reserve`) are never applied at build time - only limits.
+
 #### Clearing Resource Limits
 
 In cases where the values are incorrect - or there is no desire to limit resources - resource limits may be cleared using the `resource:limit-clear` command.