Merge branch 'master' into cn

* master: (546 commits) chore(deps): bump gunicorn in /tests/apps/dockerfile-release chore(deps): bump github.com/traefik/traefik/v2 chore(deps): bump gunicorn from 26.0.0 to 26.1.0 in /tests/apps/multi chore(deps): bump gunicorn in /tests/apps/python-flask chore(deps): bump pygments from 2.20.0 to 2.21.0 in /docs/_build chore: bump herokuish to 0.11.16 chore: bump go modules chore(deps): bump golang.org/x/crypto in /plugins/common chore(deps): bump sqlparse in /tests/apps/dockerfile-release chore(deps): bump helm.sh/helm/v3 in /plugins/scheduler-k3s chore(deps): bump golang in /tests/apps/zombies-dockerfile-no-tini chore(deps): bump golang in /tests/apps/go-fail-postdeploy chore(deps): bump golang in /tests/apps/go-fail-predeploy chore(deps): bump golang from 1.26.5 to 1.26.6 in /tests/apps/gogrpc chore(deps): bump golang in /tests/apps/zombies-dockerfile-tini chore(deps): bump google.golang.org/protobuf in /tests/apps/gogrpc fix: retire cron containers past their active deadline Release 0.38.27 fix: report traefik dns-provider env vars as global keys fix: do not require a local image for k3s deploys ... # Conflicts: # common.mk # contrib/dependencies.json
Merge pull request #8954 from dokku/dependabot/pip/tests/apps/dockerfile-release/gunicorn-26.1.0
2026-08-22 17:40:33 +08:00 · 2026-08-21 16:18:10 -04:00 · 2026-08-21 16:18:02 -04:00 · 2026-08-21 16:17:49 -04:00 · 2026-08-21 16:17:42 -04:00 · 2026-08-21 13:55:25 +00:00
575 changed files with 28843 additions and 5487 deletions
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -330,6 +330,11 @@ updates:
    open-pull-requests-limit: 10
    labels:
      - "type: dependencies"
+    ignore:
+      - dependency-name: "*"
+        update-types:
+          - "version-update:semver-minor"
+          - "version-update:semver-patch"
  - package-ecosystem: "docker"
    directory: "/"
    schedule:
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -24,7 +24,7 @@ jobs:
      skip: ${{ steps.check-commit.outputs.skip }}

    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
        with:
          ref: ${{ github.event.pull_request.head.sha }}

@@ -53,7 +53,7 @@ jobs:
    timeout-minutes: 45

    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7

      - name: set up qemu
        uses: docker/setup-qemu-action@v4
@@ -87,7 +87,7 @@ jobs:
    timeout-minutes: 20

    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7

      - name: build-image
        uses: ./.github/actions/build-image
@@ -101,7 +101,7 @@ jobs:
    timeout-minutes: 20

    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7

      - name: build-image
        uses: ./.github/actions/build-image
@@ -117,7 +117,7 @@ jobs:
      matrix: ${{fromJson(needs.build.outputs.matrix)}}

    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7

      - name: download packages
        uses: actions/download-artifact@v8
@@ -156,7 +156,7 @@ jobs:
      fail-fast: false

    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7

      - name: download packages
        uses: actions/download-artifact@v8
@@ -190,7 +190,7 @@ jobs:
      GITHUB_NODE_INDEX: ${{ matrix.index }}

    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7

      - name: download packages
        uses: actions/download-artifact@v8
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -42,7 +42,7 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7

      # workaround for https://github.com/github/codeql/issues/14235
      - name: Remove go.work file
--- a/.github/workflows/dependency-updates.yml
+++ b/.github/workflows/dependency-updates.yml
@@ -19,7 +19,7 @@ jobs:
      matrix: ${{ steps.matrix.outputs.matrix }}
    steps:
      - name: Clone
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7

      - name: Build dependency matrix
        id: matrix
@@ -48,7 +48,7 @@ jobs:
      cancel-in-progress: false
    steps:
      - name: Clone
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7

      - name: Resolve latest release
        id: latest
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -16,12 +16,12 @@ jobs:
    runs-on: ubuntu-24.04
    steps:
      - name: Cloning repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: "Setup python 3.10"
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v7
        with:
          python-version: '3.10'

--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -20,7 +20,7 @@ jobs:
    runs-on: ubuntu-24.04
    steps:
      - name: Clone
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
      - name: Run hadolint
        uses: hadolint/hadolint-action@2332a7b74a6de0dda2e2221d575162eba76ba5e5
        # v3.0.0 => 4b5806eb9c6bee4954fc0e0cc3ad6175fc9782c1
@@ -30,9 +30,9 @@ jobs:
    runs-on: ubuntu-24.04
    steps:
      - name: Clone
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
      - name: Setup node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
        with:
          node-version: '20'
          cache: 'npm'
@@ -48,7 +48,7 @@ jobs:
    if: github.event.pull_request.user.login != 'dependabot[bot]'
    steps:
      - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
      - name: Setup packer
        uses: hashicorp/setup-packer@main
        with:
@@ -67,7 +67,7 @@ jobs:
    runs-on: ubuntu-24.04
    steps:
      - name: Clone
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
      - name: Run shellcheck
        uses: ludeeus/action-shellcheck@00cae500b08a931fb5698e11e79bfbd38e612a38
        # 1.1.0 => 94e0aab03ca135d11a35e5bfc14e6746dc56e7e9
@@ -77,7 +77,7 @@ jobs:
    runs-on: ubuntu-24.04
    steps:
      - name: Clone
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
      - name: Run shfmt
        uses: luizm/action-sh-checker@883217215b11c1fabbf00eb1a9a041f62d74c744
        # v0.5.0 => edd0e45ecff35b05f162052b50df50976c1b74fc
@@ -91,7 +91,7 @@ jobs:
    runs-on: ubuntu-24.04
    steps:
      - name: Clone
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
      - name: Run yamllint
        uses: ibiqlik/action-yamllint@2576378a8e339169678f9939646ee3ee325e845c
        # v3.1.1 => 2576378a8e339169678f9939646ee3ee325e845c
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -25,7 +25,7 @@ jobs:
    outputs:
      version: ${{ steps.version.outputs.version }}
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
        with:
          fetch-depth: 0

@@ -84,7 +84,7 @@ jobs:
    needs: release
    steps:
      - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7

      - name: Setup packer
        uses: hashicorp/setup-packer@main
@@ -120,7 +120,7 @@ jobs:
    needs: release
    steps:
      - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
      - name: Bump Azure Template
        env:
          BOT_GITHUB_USERNAME: ${{ secrets.HOMEBREW_GITHUB_USERNAME }}
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,5 +1,490 @@
 # History

+## 0.38.27
+
+Install/update via the bootstrap script:
+
+```shell
+wget -NP . https://dokku.com/install/v0.38.27/bootstrap.sh
+sudo DOKKU_TAG=v0.38.27 bash bootstrap.sh
+```
+
+### Bug Fixes
+
+- #8933: @josegonzalez Do not require a local image for k3s deploys
+- #8930: @josegonzalez Do not import an already-migrated ENV file
+- #8919: @josegonzalez Regenerate vector config on app lifecycle changes
+- #8917: @josegonzalez Apply app-label-alias to shipped events
+
+### New Features
+
+- #8934: @josegonzalez Report traefik dns-provider env vars as global keys
+- #8920: @josegonzalez Add storage directory mode and removal flags
+- #8914: @josegonzalez Add vector-cron-sink for scheduled cron task output
+
+### Tests
+
+- #8931: @dependabot[bot] chore(deps): bump djangorestframework from 3.17.2 to 3.18.0 in /tests/apps/dockerfile-release
+- #8927: @dependabot[bot] chore(deps): bump djangorestframework from 3.17.1 to 3.17.2 in /tests/apps/dockerfile-release
+- #8923: @dependabot[bot] chore(deps): bump python from 3.15.0b4-bookworm to 3.15.0rc1-bookworm in /tests/apps/dockerfile-release
+
+### Dependencies
+
+- #8926: @dependabot[bot] chore(deps): bump github.com/gliderlabs/sigil from 0.12.0 to 0.12.1 in /plugins/nginx-vhosts
+- #8925: @dependabot[bot] chore(deps): bump packaging from 26.2 to 26.3 in /docs/_build
+- #8921: @dokku-bot chore: bump pack to 0.40.9
+- #8924: @dependabot[bot] chore(deps): bump soupsieve from 2.9.1 to 2.9.2 in /docs/_build
+- #8922: @dependabot[bot] chore(deps): bump python from 3.15.0b4-alpine to 3.15.0rc1-alpine in /docs/_build
+- #8915: @dokku-bot chore: bump herokuish to 0.11.15
+
+## 0.38.26
+
+Install/update via the bootstrap script:
+
+```shell
+wget -NP . https://dokku.com/install/v0.38.26/bootstrap.sh
+sudo DOKKU_TAG=v0.38.26 bash bootstrap.sh
+```
+
+### Bug Fixes
+
+- #8906: @josegonzalez Match docker options by shell word when removing
+
+### New Features
+
+- #8911: @josegonzalez Route wildcard domains through traefik on k3s
+- #8909: @josegonzalez Support manually managed cert issuers on k3s
+- #8903: @josegonzalez Support kernel sysctls on the k3s scheduler
+- #8856: @youdie006 Add pre-parsed port_mappings to ports:report json
+
+### Refactors
+
+- #8863: @josegonzalez Move host-crontab generation into cron plugin
+
+### Documentation
+
+- #8908: @josegonzalez Document --global on scheduler-k3s report and set
+- #8858: @bakatz Added instructions for restoring backups on different CPU architectures.
+
+### Tests
+
+- #8893: @dependabot[bot] chore(deps): bump django from 5.2.16 to 5.2.17 in /tests/apps/dockerfile-release
+- #8891: @dependabot[bot] chore(deps-dev): bump heroku/heroku-buildpack-php from 293 to 294 in /tests/apps/php
+- #8877: @dependabot[bot] chore(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.0 in /tests/apps/gogrpc
+- #8874: @dependabot[bot] chore(deps): bump sass from 1.101.7 to 1.102.0 in /tests/apps/multi
+- #8870: @dependabot[bot] chore(deps): bump sass from 1.101.6 to 1.101.7 in /tests/apps/multi
+- #8866: @dependabot[bot] chore(deps): bump sass from 1.101.3 to 1.101.6 in /tests/apps/multi
+- #8860: @dependabot[bot] chore(deps): bump setuptools from 78.1.1 to 83.0.0 in /tests/apps/dockerfile-release
+- #8859: @dependabot[bot] chore(deps): bump immutable from 5.1.5 to 5.1.9 in /tests/apps/multi
+- #8855: @dependabot[bot] chore(deps): bump sass from 1.101.0 to 1.101.3 in /tests/apps/multi
+- #8857: @dependabot[bot] chore(deps): bump body-parser from 2.2.1 to 2.3.0 in /tests/apps/checks-root
+- #8853: @dependabot[bot] chore(deps): bump python from 3.15.0b3-bookworm to 3.15.0b4-bookworm in /tests/apps/dockerfile-release
+
+### Dependencies
+
+- #8905: @dependabot[bot] chore(deps): bump oras.land/oras-go/v2 from 2.6.1 to 2.6.2 in /plugins/scheduler-k3s
+- #8869: @dependabot[bot] chore(deps): bump github.com/mattn/go-isatty from 0.0.23 to 0.0.24 in /plugins/app-json
+- #8887: @dependabot[bot] chore(deps): bump github.com/kedacore/keda/v2 from 2.20.1 to 2.20.2 in /plugins/scheduler-k3s
+- #8883: @dokku-bot chore: bump docker-container-healthchecker to 0.16.0
+- #8886: @dependabot[bot] chore(deps): update markdown requirement from <3.11,>=3.10.2 to >=3.10.3,<3.11 in /docs/_build
+- #8892: @dependabot[bot] chore(deps): bump traefik from v3.7.9 to v3.7.10 in /plugins/traefik-vhosts
+- #8885: @dokku-bot chore: bump dokku-update to 0.10.0
+- #8884: @dokku-bot chore: bump procfile-util to 0.20.8
+- #8882: @dokku-bot chore: bump docker-image-labeler to 0.10.0
+- #8888: @dependabot[bot] chore(deps): bump github.com/traefik/traefik/v2 from 2.11.53 to 2.11.54 in /plugins/scheduler-k3s
+- #8900: @dokku-bot chore: bump gliderlabs-sigil to 0.12.1
+- #8899: @dokku-bot chore: bump herokuish to 0.11.14
+- #8898: @dokku-bot chore: bump netrc to 0.11.1
+- #8897: @dokku-bot chore: bump dokku-event-listener to 0.20.1
+- #8896: @dokku-bot chore: bump sshcommand to 0.20.2
+- #8895: @dokku-bot chore: bump lambda-builder to 0.9.4
+- #8894: @dokku-bot chore: bump plugn to 0.17.1
+- #8876: @dependabot[bot] chore(deps): bump github.com/cert-manager/cert-manager from 1.21.0 to 1.21.1 in /plugins/scheduler-k3s
+- #8873: @dependabot[bot] chore(deps): bump traefik from v3.7.8 to v3.7.9 in /plugins/traefik-vhosts
+- #8872: @dependabot[bot] chore(deps): bump github.com/traefik/traefik/v2 from 2.11.52 to 2.11.53 in /plugins/scheduler-k3s
+- #8871: @dependabot[bot] chore(deps): bump k8s.io/kubernetes from 1.36.2 to 1.36.3 in /plugins/scheduler-k3s
+- #8868: @dependabot[bot] chore(deps): bump k8s.io/kubectl from 0.36.2 to 0.36.3 in /plugins/scheduler-k3s
+- #8867: @dependabot[bot] chore(deps): bump k8s.io/client-go from 0.36.2 to 0.36.3 in /plugins/scheduler-k3s
+- #8865: @dependabot[bot] chore(deps): bump github.com/fluxcd/pkg/kustomize from 1.38.0 to 1.39.0 in /plugins/scheduler-k3s
+- #8864: @dependabot[bot] chore(deps): bump soupsieve from 2.9 to 2.9.1 in /docs/_build
+- #8854: @dependabot[bot] chore(deps): bump python from 3.15.0b3-alpine to 3.15.0b4-alpine in /docs/_build
+- #8852: @dependabot[bot] chore(deps): bump soupsieve from 2.8.4 to 2.9 in /docs/_build
+- #8851: @dependabot[bot] chore(deps): bump mkdocs-material from 9.7.6 to 9.7.7 in /docs/_build
+- #8850: @dependabot[bot] chore(deps): bump actions/setup-python from 6 to 7
+
+### Other
+
+- #8907: @josegonzalez fix: migrate env files before reading deprecated vars
+- #8881: @josegonzalez Ignore minor and patch updates for github actions
+
+## 0.38.25
+
+Install/update via the bootstrap script:
+
+```shell
+wget -NP . https://dokku.com/install/v0.38.25/bootstrap.sh
+sudo DOKKU_TAG=v0.38.25 bash bootstrap.sh
+```
+
+### Security
+
+- #8848: @josegonzalez Prevent command injection via docker options eval
+
+### New Features
+
+- #8849: @josegonzalez Support per-app letsencrypt emails on k3s
+
+## 0.38.24
+
+Install/update via the bootstrap script:
+
+```shell
+wget -NP . https://dokku.com/install/v0.38.24/bootstrap.sh
+sudo DOKKU_TAG=v0.38.24 bash bootstrap.sh
+```
+
+### Documentation
+
+- #8836: @josegonzalez Link herokuish buildpack references to buildpack management page
+
+### Tests
+
+- #8841: @dependabot[bot] chore(deps): bump ruby from 4.0.5 to 4.0.6 in /tests/apps/dockerfile-entrypoint
+- #8843: @dependabot[bot] chore(deps): bump google.golang.org/grpc from 1.82.0 to 1.82.1 in /tests/apps/gogrpc
+
+### Dependencies
+
+- #8845: @dependabot[bot] chore(deps): bump github.com/mattn/go-isatty from 0.0.22 to 0.0.23 in /plugins/app-json
+- #8844: @dependabot[bot] chore(deps): bump github.com/melbahja/goph from 1.5.1 to 1.5.2 in /plugins/common
+- #8842: @dependabot[bot] chore(deps): bump timberio/vector from 0.56.0-debian to 0.57.0-debian in /plugins/logs
+- #8838: @dokku-bot chore: bump pack to 0.40.8
+- #8846: @dependabot[bot] chore(deps): bump traefik from v3.7.7 to v3.7.8 in /plugins/traefik-vhosts
+- #8839: @dependabot[bot] chore(deps): bump actions/setup-node from 6 to 7
+- #8834: @dokku-bot chore: bump dokku-event-listener to 0.20.0
+
+## 0.38.23
+
+Install/update via the bootstrap script:
+
+```shell
+wget -NP . https://dokku.com/install/v0.38.23/bootstrap.sh
+sudo DOKKU_TAG=v0.38.23 bash bootstrap.sh
+```
+
+### Bug Fixes
+
+- #8833: @josegonzalez Parse cert CN and subject on OpenSSL 3.x
+
+### Tests
+
+- #8825: @dependabot[bot] chore(deps): bump golang from 1.26.4 to 1.26.5 in /tests/apps/zombies-dockerfile-no-tini
+- #8823: @dependabot[bot] chore(deps): bump golang from 1.26.4 to 1.26.5 in /tests/apps/zombies-dockerfile-tini
+- #8820: @dependabot[bot] chore(deps-dev): bump heroku/heroku-buildpack-php from 292 to 293 in /tests/apps/php
+- #8821: @dependabot[bot] chore(deps): bump golang from 1.26.4 to 1.26.5 in /tests/apps/go-fail-predeploy
+- #8822: @dependabot[bot] chore(deps): bump golang from 1.26.4 to 1.26.5 in /tests/apps/gogrpc
+- #8824: @dependabot[bot] chore(deps): bump golang from 1.26.4 to 1.26.5 in /tests/apps/go-fail-postdeploy
+
+### Dependencies
+
+- #8831: @dependabot[bot] chore(deps): bump helm.sh/helm/v3 from 3.21.2 to 3.21.3 in /plugins/scheduler-k3s
+- #8830: @dependabot[bot] chore(deps): bump github.com/fluxcd/pkg/kustomize from 1.37.0 to 1.38.0 in /plugins/scheduler-k3s
+- #8826: @dependabot[bot] chore(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 in /plugins/common
+- #8827: @dependabot[bot] chore(deps): bump github.com/cert-manager/cert-manager from 1.20.3 to 1.21.0 in /plugins/scheduler-k3s
+- #8828: @dependabot[bot] chore(deps): bump traefik from v3.7.6 to v3.7.7 in /plugins/traefik-vhosts
+- #8829: @dependabot[bot] chore(deps): bump github.com/go-openapi/jsonpointer from 0.24.0 to 1.0.0 in /plugins/scheduler-k3s
+
+## 0.38.22
+
+Install/update via the bootstrap script:
+
+```shell
+wget -NP . https://dokku.com/install/v0.38.22/bootstrap.sh
+sudo DOKKU_TAG=v0.38.22 bash bootstrap.sh
+```
+
+### New Features
+
+- #8805: @RichardDorian Allow custom values for chown
+- #8810: @josegonzalez Expose whether a network was created by dokku
+- #8807: @josegonzalez Allow replacing buildpack list atomically
+- #8808: @josegonzalez Expose docker-options as structured lists in JSON report
+- #8806: @josegonzalez Expose scheduler-k3s autoscaling-auth state for read-back
+- #8801: @josegonzalez Add --format json support to plugin:list
+
+### Refactors
+
+- #8804: @josegonzalez Port bash :report subcommands to golang
+
+### Documentation
+
+- #8809: @josegonzalez Document nginx validate-config load_module override
+
+### Tests
+
+- #8803: @dependabot[bot] chore(deps): bump django from 5.2.15 to 5.2.16 in /tests/apps/dockerfile-release
+
+### Dependencies
+
+- #8816: @dependabot[bot] chore(deps): bump golang.org/x/sync from 0.21.0 to 0.22.0 in /plugins/common
+- #8818: @dependabot[bot] chore(deps): bump github.com/traefik/traefik/v2 from 2.11.51 to 2.11.52 in /plugins/scheduler-k3s
+- #8817: @dependabot[bot] chore(deps): bump golang.org/x/sync from 0.21.0 to 0.22.0 in /plugins/scheduler-docker-local
+- #8819: @dependabot[bot] chore(deps): bump golang.org/x/sync from 0.21.0 to 0.22.0 in /plugins/scheduler-k3s
+
+## 0.38.21
+
+Install/update via the bootstrap script:
+
+```shell
+wget -NP . https://dokku.com/install/v0.38.21/bootstrap.sh
+sudo DOKKU_TAG=v0.38.21 bash bootstrap.sh
+```
+
+### New Features
+
+- #8795: @josegonzalez Add --format json support to apps:list
+
+### Tests
+
+- #8788: @dependabot[bot] chore(deps): bump google.golang.org/grpc from 1.81.1 to 1.82.0 in /tests/apps/gogrpc
+- #8787: @dependabot[bot] chore(deps): bump golang.org/x/net from 0.51.0 to 0.55.0 in /tests/apps/gogrpc
+
+### Dependencies
+
+- #8781: @dependabot[bot] chore(deps): bump lucaslorentz/caddy-docker-proxy from 2.12 to 2.13 in /plugins/caddy-vhosts
+- #8794: @dependabot[bot] chore(deps): bump github.com/fluxcd/pkg/kustomize from 1.36.0 to 1.37.0 in /plugins/scheduler-k3s
+- #8789: @dependabot[bot] chore(deps): bump pymdown-extensions from 11.0 to 11.0.1 in /docs/_build
+- #8782: @dependabot[bot] chore(deps): bump github.com/go-openapi/jsonpointer from 0.23.2 to 0.24.0 in /plugins/scheduler-k3s
+- #8785: @dependabot[bot] chore(deps): bump traefik from v3.7.5 to v3.7.6 in /plugins/traefik-vhosts
+- #8786: @dependabot[bot] chore(deps): bump github.com/fluxcd/pkg/kustomize from 1.31.0 to 1.36.0 in /plugins/scheduler-k3s
+- #8783: @dependabot[bot] chore(deps): bump github.com/traefik/traefik/v2 from 2.11.50 to 2.11.51 in /plugins/scheduler-k3s
+- #8780: @dependabot[bot] chore(deps): bump github.com/cert-manager/cert-manager from 1.20.2 to 1.20.3 in /plugins/scheduler-k3s
+- #8779: @dependabot[bot] chore(deps): bump github.com/go-openapi/jsonpointer from 0.23.1 to 0.23.2 in /plugins/scheduler-k3s
+
+### Other
+
+- #8796: @josegonzalez Add --format json support to ps:scale
+
+## 0.38.20
+
+Install/update via the bootstrap script:
+
+```shell
+wget -NP . https://dokku.com/install/v0.38.20/bootstrap.sh
+sudo DOKKU_TAG=v0.38.20 bash bootstrap.sh
+```
+
+### Tests
+
+- #8773: @dependabot[bot] chore(deps): bump python from 3.15.0b2-bookworm to 3.15.0b3-bookworm in /tests/apps/dockerfile-release
+- #8756: @dependabot[bot] chore(deps): bump sass from 1.100.0 to 1.101.0 in /tests/apps/multi
+- #8753: @dependabot[bot] chore(deps-dev): bump heroku/heroku-buildpack-php from 291 to 292 in /tests/apps/php
+
+### Dependencies
+
+- #8766: @dependabot[bot] chore(deps): bump helm.sh/helm/v3 from 3.21.1 to 3.21.2 in /plugins/scheduler-k3s
+- #8777: @dependabot[bot] chore(deps): bump github.com/onsi/gomega from 1.41.0 to 1.42.1 in /plugins/common
+- #8778: @dependabot[bot] chore(deps): bump byjg/easy-haproxy from 6.1.0 to 6.1.1 in /plugins/haproxy-vhosts
+- #8748: @dependabot[bot] chore(deps): bump golang.org/x/crypto from 0.52.0 to 0.53.0 in /plugins/common
+- #8745: @dependabot[bot] chore(deps): bump golang.org/x/sync from 0.20.0 to 0.21.0 in /plugins/common
+- #8774: @dependabot[bot] chore(deps): bump python from 3.15.0b2-alpine to 3.15.0b3-alpine in /docs/_build
+- #8769: @dependabot[bot] chore(deps): bump pymdown-extensions from 10.21.3 to 11.0 in /docs/_build
+- #8775: @dependabot[bot] chore(deps): bump click from 8.4.1 to 8.4.2 in /docs/_build
+- #8776: @dependabot[bot] chore(deps): bump byjg/easy-haproxy from 6.0.1 to 6.1.0 in /plugins/haproxy-vhosts
+- #8772: @dependabot[bot] chore(deps): bump github.com/onsi/gomega from 1.42.0 to 1.42.1 in /plugins/buildpacks
+- #8770: @dokku-bot chore: bump pack to 0.40.7
+- #8767: @dependabot[bot] chore(deps): bump github.com/containerd/containerd from 1.7.32 to 1.7.33 in /plugins/scheduler-k3s
+- #8765: @dependabot[bot] chore(deps): bump github.com/onsi/gomega from 1.41.0 to 1.42.0 in /plugins/scheduler-k3s
+- #8764: @dependabot[bot] chore(deps): bump actions/checkout from 6 to 7
+- #8762: @dependabot[bot] chore(deps): bump k8s.io/kubernetes from 1.36.1 to 1.36.2 in /plugins/scheduler-k3s
+- #8758: @dependabot[bot] chore(deps): bump github.com/onsi/gomega from 1.41.0 to 1.42.0 in /plugins/buildpacks
+- #8760: @dependabot[bot] chore(deps): bump k8s.io/apimachinery from 0.36.1 to 0.36.2 in /plugins/scheduler-k3s
+- #8757: @dependabot[bot] chore(deps): bump helm.sh/helm/v3 from 3.21.0 to 3.21.1 in /plugins/scheduler-k3s
+- #8755: @dependabot[bot] chore(deps): bump traefik from v3.7.4 to v3.7.5 in /plugins/traefik-vhosts
+- #8754: @dependabot[bot] chore(deps): bump github.com/traefik/traefik/v2 from 2.11.49 to 2.11.50 in /plugins/scheduler-k3s
+- #8749: @dependabot[bot] chore(deps): bump github.com/traefik/traefik/v2 from 2.11.47 to 2.11.49 in /plugins/scheduler-k3s
+- #8743: @dependabot[bot] chore(deps): bump beautifulsoup4 from 4.14.3 to 4.15.0 in /docs/_build
+- #8744: @dependabot[bot] chore(deps): bump traefik from v3.7.3 to v3.7.4 in /plugins/traefik-vhosts
+- #8747: @dependabot[bot] chore(deps): bump golang.org/x/sync from 0.20.0 to 0.21.0 in /plugins/scheduler-k3s
+- #8746: @dependabot[bot] chore(deps): bump golang.org/x/sync from 0.20.0 to 0.21.0 in /plugins/scheduler-docker-local
+
+## 0.38.19
+
+Install/update via the bootstrap script:
+
+```shell
+wget -NP . https://dokku.com/install/v0.38.19/bootstrap.sh
+sudo DOKKU_TAG=v0.38.19 bash bootstrap.sh
+```
+
+## 0.38.18
+
+Install/update via the bootstrap script:
+
+```shell
+wget -NP . https://dokku.com/install/v0.38.18/bootstrap.sh
+sudo DOKKU_TAG=v0.38.18 bash bootstrap.sh
+```
+
+### Tests
+
+- #8734: @dependabot[bot] chore(deps): bump golang from 1.26.3 to 1.26.4 in /tests/apps/gogrpc
+- #8731: @dependabot[bot] chore(deps): bump golang from 1.26.3 to 1.26.4 in /tests/apps/go-fail-predeploy
+- #8733: @dependabot[bot] chore(deps): bump golang from 1.26.3 to 1.26.4 in /tests/apps/zombies-dockerfile-tini
+- #8735: @dependabot[bot] chore(deps): bump golang from 1.26.3 to 1.26.4 in /tests/apps/go-fail-postdeploy
+- #8736: @dependabot[bot] chore(deps): bump golang from 1.26.3 to 1.26.4 in /tests/apps/zombies-dockerfile-no-tini
+- #8738: @dependabot[bot] chore(deps): bump python from 3.15.0b1-bookworm to 3.15.0b2-bookworm in /tests/apps/dockerfile-release
+- #8730: @dependabot[bot] chore(deps): bump django from 5.2.14 to 5.2.15 in /tests/apps/dockerfile-release
+
+### Dependencies
+
+- #8727: @dependabot[bot] chore(deps): bump github.com/melbahja/goph from 1.5.0 to 1.5.1 in /plugins/common
+- #8739: @dependabot[bot] chore(deps): bump github.com/traefik/traefik/v2 from 2.11.46 to 2.11.47 in /plugins/scheduler-k3s
+- #8737: @dependabot[bot] chore(deps): bump dokku/openresty-docker-proxy from 0.12.0 to 0.12.1 in /plugins/openresty-vhosts
+- #8732: @dependabot[bot] chore(deps): bump python from 3.15.0b1-alpine to 3.15.0b2-alpine in /docs/_build
+- #8740: @dependabot[bot] chore(deps): bump timberio/vector from 0.55.0-debian to 0.56.0-debian in /plugins/logs
+- #8741: @dependabot[bot] chore(deps): bump traefik from v3.7.1 to v3.7.3 in /plugins/traefik-vhosts
+
+## 0.38.17
+
+Install/update via the bootstrap script:
+
+```shell
+wget -NP . https://dokku.com/install/v0.38.17/bootstrap.sh
+sudo DOKKU_TAG=v0.38.17 bash bootstrap.sh
+```
+
+### New Features
+
+- #8729: @josegonzalez Add scheduler-k3s:preview subcommand to allow previewing helm chart changes
+
+### Dependencies
+
+- #8728: @dependabot[bot] chore(deps): bump dokku/openresty-docker-proxy from 0.11.0 to 0.12.0 in /plugins/openresty-vhosts
+
+## 0.38.16
+
+Install/update via the bootstrap script:
+
+```shell
+wget -NP . https://dokku.com/install/v0.38.16/bootstrap.sh
+sudo DOKKU_TAG=v0.38.16 bash bootstrap.sh
+```
+
+### Bug Fixes
+
+- #8723: @josegonzalez Match control-plane nodes by their modern label
+- #8724: @josegonzalez Stop truncating existing files in common.TouchFile
+
+## 0.38.15
+
+Install/update via the bootstrap script:
+
+```shell
+wget -NP . https://dokku.com/install/v0.38.15/bootstrap.sh
+sudo DOKKU_TAG=v0.38.15 bash bootstrap.sh
+```
+
+### Bug Fixes
+
+- #8718: @josegonzalez Persist scheduler-k3s chart overrides as JSON maps
+
+### Other
+
+- #8720: @josegonzalez Persist scheduler-k3s annotations and labels as JSON maps
+
+## 0.38.14
+
+Install/update via the bootstrap script:
+
+```shell
+wget -NP . https://dokku.com/install/v0.38.14/bootstrap.sh
+sudo DOKKU_TAG=v0.38.14 bash bootstrap.sh
+```
+
+### New Features
+
+- #8716: @josegonzalez Add scheduler-k3s annotations:report and labels:report
+- #8715: @josegonzalez Add scheduler-k3s:charts:set and :charts:report
+
+## 0.38.13
+
+Install/update via the bootstrap script:
+
+```shell
+wget -NP . https://dokku.com/install/v0.38.13/bootstrap.sh
+sudo DOKKU_TAG=v0.38.13 bash bootstrap.sh
+```
+
+### Bug Fixes
+
+- #8713: @josegonzalez Make storage:mount upsert the existing attachment
+
+### New Features
+
+- #8714: @josegonzalez Expose per-attachment fields in storage:report
+- #8712: @josegonzalez Expose attachment readonly and volume_options in storage:list json
+- #8711: @josegonzalez Add --volume-options flag to storage:mount
+
+## 0.38.12
+
+Install/update via the bootstrap script:
+
+```shell
+wget -NP . https://dokku.com/install/v0.38.12/bootstrap.sh
+sudo DOKKU_TAG=v0.38.12 bash bootstrap.sh
+```
+
+### Bug Fixes
+
+- #8706: @josegonzalez Align apps:set/apps:report with what dokku actually reads
+
+## 0.38.11
+
+Install/update via the bootstrap script:
+
+```shell
+wget -NP . https://dokku.com/install/v0.38.11/bootstrap.sh
+sudo DOKKU_TAG=v0.38.11 bash bootstrap.sh
+```
+
+### Bug Fixes
+
+- #8704: @josegonzalez Pass storage entry basename to chown-storage-dir
+
+## 0.38.10
+
+Install/update via the bootstrap script:
+
+```shell
+wget -NP . https://dokku.com/install/v0.38.10/bootstrap.sh
+sudo DOKKU_TAG=v0.38.10 bash bootstrap.sh
+```
+
+### New Features
+
+- #8702: @josegonzalez Prompt for confirmation on storage:destroy
+
+### Tests
+
+- #8698: @dependabot[bot] chore(deps-dev): bump org.apache.maven.plugins:maven-dependency-plugin from 3.10.0 to 3.11.0 in /tests/apps/java
+
+## 0.38.9
+
+Install/update via the bootstrap script:
+
+```shell
+wget -NP . https://dokku.com/install/v0.38.9/bootstrap.sh
+sudo DOKKU_TAG=v0.38.9 bash bootstrap.sh
+```
+
+### New Features
+
+- #8697: @josegonzalez Split openresty report into raw/computed/global
+
+### Refactors
+
+- #8696: @josegonzalez Treat empty ps restart-policy as an unset
+
 ## 0.38.8

 Install/update via the bootstrap script:
--- a/5
+++ b/5
@@ -11,7 +11,7 @@ PROCFILE_UTIL_URL ?= $(shell jq -r --arg name procfile-util  --arg arch $(TARGET
 SIGIL_URL ?= $(shell jq -r --arg name gliderlabs-sigil  --arg arch $(TARGETARCH) '.predependencies[] | select(.name == $$name) | .urls[$$arch]' contrib/dependencies.json)
 SSHCOMMAND_URL ?= $(shell jq -r --arg name sshcommand  --arg arch $(TARGETARCH) '.dependencies[] | select(.name == $$name) | .urls[$$arch]' contrib/dependencies.json)
 STACK_URL ?= https://github.com/gliderlabs/herokuish.git
-PREBUILT_STACK_URL ?= gliderlabs/herokuish:latest-24
+PREBUILT_STACK_URL ?= ccr.ccs.tencentyun.com/miaogai/herokuish:latest-24
 DOKKU_LIB_ROOT ?= /var/lib/dokku
 PLUGINS_PATH ?= ${DOKKU_LIB_ROOT}/plugins
 CORE_PLUGINS_PATH ?= ${DOKKU_LIB_ROOT}/core-plugins
@@ -190,7 +190,8 @@ docker:
 	grep -i -E "^docker" /etc/group || groupadd docker
 	usermod -aG docker dokku
 ifndef CI
-	wget -nv -O - https://get.docker.com/ | sh
+	sudo apt install docker.io
+	#wget --no-check-certificate -nv -O - https://get.docker.com/ | sh
 ifdef DOCKER_VERSION
 	apt-get -qq -y --no-install-recommends install docker-engine=${DOCKER_VERSION} || (apt-cache madison docker-engine ; exit 1)
 endif
--- a/README.md
+++ b/README.md
@@ -85,8 +85,8 @@ Otherwise, you will need to import the keypair manually after installation using
 To install the latest stable release, run the following commands as a user who has access to `sudo`:

 ```shell
-wget -NP . https://dokku.com/install/v0.38.8/bootstrap.sh
-sudo DOKKU_TAG=v0.38.8 bash bootstrap.sh
+wget -NP . https://dokku.com/install/v0.38.27/bootstrap.sh
+sudo DOKKU_TAG=v0.38.27 bash bootstrap.sh
 ```

 You can then proceed to configure your server domain (via `dokku domains:set-global`) and user access (via `dokku ssh-keys:add`) to complete the installation.
--- a/common.mk
+++ b/common.mk
@@ -1,7 +1,7 @@
 GO_ARGS ?=
 GO_PLUGIN_MAKE_TARGET ?= build
 GO_REPO_ROOT := /go/src/github.com/dokku/dokku
-BUILD_IMAGE := golang:1.26.2
+BUILD_IMAGE := hub.diyla.com/golang:1.26.2
 GO_BUILD_CACHE ?= /tmp/dokku-go-build-cache
 GO_MOD_CACHE   ?= /tmp/dokku-go-mod-mod
 GO_ROOT_MOUNT  ?= $$PWD/../..:$(GO_REPO_ROOT)
@@ -19,6 +19,7 @@ build-in-docker: clean
 		-v $(GO_MOD_CACHE):/go/pkg/mod \
 		-e PLUGIN_NAME=$(PLUGIN_NAME) \
 		-e GO111MODULE=on \
+		-e GOPROXY=https://goproxy.cn,direct \
 		-w $(GO_REPO_ROOT)/plugins/$(PLUGIN_NAME) \
 		$(BUILD_IMAGE) \
 		bash -c "GO_ARGS='$(GO_ARGS)' CGO_ENABLED=0 GOOS=linux GOARCH=$(GOARCH) GOWORK=off make -j4 $(GO_PLUGIN_MAKE_TARGET)" || exit $$?
--- a/contrib/dependencies.json
+++ b/contrib/dependencies.json
@@ -2,102 +2,102 @@
  "dependencies": [
    {
      "name": "docker-container-healthchecker",
-      "version": "0.15.2",
+      "version": "0.16.0",
      "urls": {
-        "amd64": "https://github.com/dokku/docker-container-healthchecker/releases/download/v0.15.2/docker-container-healthchecker-linux-amd64",
-        "arm64": "https://github.com/dokku/docker-container-healthchecker/releases/download/v0.15.2/docker-container-healthchecker-linux-arm64"
+        "amd64": "https://hub.diyla.com/https://github.com/dokku/docker-container-healthchecker/releases/download/v0.16.0/docker-container-healthchecker-linux-amd64",
+        "arm64": "https://hub.diyla.com/https://github.com/dokku/docker-container-healthchecker/releases/download/v0.16.0/docker-container-healthchecker-linux-arm64"
      }
    },
    {
      "name": "docker-image-labeler",
-      "version": "0.9.0",
+      "version": "0.10.0",
      "urls": {
-        "amd64": "https://github.com/dokku/docker-image-labeler/releases/download/v0.9.0/docker-image-labeler-linux-amd64",
-        "arm64": "https://github.com/dokku/docker-image-labeler/releases/download/v0.9.0/docker-image-labeler-linux-arm64"
+        "amd64": "https://hub.diyla.com/https://github.com/dokku/docker-image-labeler/releases/download/v0.10.0/docker-image-labeler-linux-amd64",
+        "arm64": "https://hub.diyla.com/https://github.com/dokku/docker-image-labeler/releases/download/v0.10.0/docker-image-labeler-linux-arm64"
      }
    },
    {
      "name": "lambda-builder",
-      "version": "0.9.3",
+      "version": "0.9.4",
      "urls": {
-        "amd64": "https://github.com/dokku/lambda-builder/releases/download/v0.9.3/lambda-builder-linux-amd64",
-        "arm64": "https://github.com/dokku/lambda-builder/releases/download/v0.9.3/lambda-builder-linux-arm64"
+        "amd64": "https://hub.diyla.com/https://github.com/dokku/lambda-builder/releases/download/v0.9.4/lambda-builder-linux-amd64",
+        "arm64": "https://hub.diyla.com/https://github.com/dokku/lambda-builder/releases/download/v0.9.4/lambda-builder-linux-arm64"
      }
    },
    {
      "name": "netrc",
-      "version": "0.11.0",
+      "version": "0.11.1",
      "urls": {
-        "amd64": "https://github.com/dokku/netrc/releases/download/v0.11.0/netrc-linux-amd64",
-        "arm64": "https://github.com/dokku/netrc/releases/download/v0.11.0/netrc-linux-arm64"
+        "amd64": "https://hub.diyla.com/https://github.com/dokku/netrc/releases/download/v0.11.1/netrc-linux-amd64",
+        "arm64": "https://hub.diyla.com/https://github.com/dokku/netrc/releases/download/v0.11.1/netrc-linux-arm64"
      }
    },
    {
      "name": "pack",
-      "version": "0.40.6",
+      "version": "0.40.9",
      "urls": {
-        "amd64": "https://github.com/buildpacks/pack/releases/download/v0.40.6/pack-v0.40.6-linux.tgz",
-        "arm64": "https://github.com/buildpacks/pack/releases/download/v0.40.6/pack-v0.40.6-linux-arm64.tgz"
+        "amd64": "https://hub.diyla.com/https://github.com/buildpacks/pack/releases/download/v0.40.9/pack-v0.40.9-linux.tgz",
+        "arm64": "https://hub.diyla.com/https://github.com/buildpacks/pack/releases/download/v0.40.9/pack-v0.40.9-linux-arm64.tgz"
      }
    },
    {
      "name": "procfile-util",
-      "version": "0.20.7",
+      "version": "0.20.8",
      "urls": {
-        "amd64": "https://github.com/dokku/procfile-util/releases/download/v0.20.7/procfile-util-linux-amd64",
-        "arm64": "https://github.com/dokku/procfile-util/releases/download/v0.20.7/procfile-util-linux-arm64"
+        "amd64": "https://hub.diyla.com/https://github.com/dokku/procfile-util/releases/download/v0.20.8/procfile-util-linux-amd64",
+        "arm64": "https://hub.diyla.com/https://github.com/dokku/procfile-util/releases/download/v0.20.8/procfile-util-linux-arm64"
      }
    },
    {
      "name": "sshcommand",
-      "version": "0.20.1",
+      "version": "0.20.2",
      "urls": {
-        "amd64": "https://github.com/dokku/sshcommand/releases/download/v0.20.1/sshcommand",
-        "arm64": "https://github.com/dokku/sshcommand/releases/download/v0.20.1/sshcommand"
+        "amd64": "https://hub.diyla.com/https://github.com/dokku/sshcommand/releases/download/v0.20.2/sshcommand",
+        "arm64": "https://hub.diyla.com/https://github.com/dokku/sshcommand/releases/download/v0.20.2/sshcommand"
      }
    }
  ],
  "predependencies": [
    {
      "name": "gliderlabs-sigil",
-      "version": "0.12.0",
+      "version": "0.12.1",
      "urls": {
-        "amd64": "https://github.com/gliderlabs/sigil/releases/download/v0.12.0/sigil-linux-amd64",
-        "arm64": "https://github.com/gliderlabs/sigil/releases/download/v0.12.0/sigil-linux-arm64"
+        "amd64": "https://hub.diyla.com/https://github.com/gliderlabs/sigil/releases/download/v0.12.1/sigil-linux-amd64",
+        "arm64": "https://hub.diyla.com/https://github.com/gliderlabs/sigil/releases/download/v0.12.1/sigil-linux-arm64"
      }
    },
    {
      "name": "plugn",
-      "version": "0.17.0",
+      "version": "0.17.1",
      "urls": {
-        "amd64": "https://github.com/dokku/plugn/releases/download/v0.17.0/plugn-linux-amd64",
-        "arm64": "https://github.com/dokku/plugn/releases/download/v0.17.0/plugn-linux-arm64"
+        "amd64": "https://hub.diyla.com/https://github.com/dokku/plugn/releases/download/v0.17.1/plugn-linux-amd64",
+        "arm64": "https://hub.diyla.com/https://github.com/dokku/plugn/releases/download/v0.17.1/plugn-linux-arm64"
      }
    }
  ],
  "recommendations": [
    {
      "name": "dokku-event-listener",
-      "version": "0.19.1",
+      "version": "0.20.1",
      "urls": {
-        "amd64": "https://github.com/dokku/dokku-event-listener/releases/download/v0.19.1/dokku-event-listener-linux-amd64",
-        "arm64": "https://github.com/dokku/dokku-event-listener/releases/download/v0.19.1/dokku-event-listener-linux-arm64"
+        "amd64": "https://hub.diyla.com/https://github.com/dokku/dokku-event-listener/releases/download/v0.20.1/dokku-event-listener-linux-amd64",
+        "arm64": "https://hub.diyla.com/https://github.com/dokku/dokku-event-listener/releases/download/v0.20.1/dokku-event-listener-linux-arm64"
      }
    },
    {
      "name": "dokku-update",
-      "version": "0.9.8",
+      "version": "0.10.0",
      "urls": {
-        "amd64": "https://github.com/dokku/dokku-update/releases/download/v0.9.8/dokku-update",
-        "arm64": "https://github.com/dokku/dokku-update/releases/download/v0.9.8/dokku-update"
+        "amd64": "https://hub.diyla.com/https://github.com/dokku/dokku-update/releases/download/v0.10.0/dokku-update",
+        "arm64": "https://hub.diyla.com/https://github.com/dokku/dokku-update/releases/download/v0.10.0/dokku-update"
      }
    },
    {
      "name": "herokuish",
-      "version": "0.11.13",
+      "version": "0.11.16",
      "urls": {
-        "amd64": "https://github.com/gliderlabs/herokuish/releases/download/v0.11.13/herokuish_0.11.13_linux_x86_64.tgz",
-        "arm64": "https://github.com/gliderlabs/herokuish/releases/download/v0.11.13/herokuish_0.11.13_linux_x86_64.tgz"
+        "amd64": "https://hub.diyla.com/https://github.com/gliderlabs/herokuish/releases/download/v0.11.16/herokuish_0.11.16_linux_x86_64.tgz",
+        "arm64": "https://hub.diyla.com/https://github.com/gliderlabs/herokuish/releases/download/v0.11.16/herokuish_0.11.16_linux_x86_64.tgz"
      }
    }
  ]
--- a/debian/control
+++ b/debian/control
@@ -1,5 +1,5 @@
 Package: dokku
-Version: 0.38.8
+Version: 0.38.27
 Section: web
 Priority: optional
 Architecture: amd64
--- a/docs/_build/Dockerfile
+++ b/docs/_build/Dockerfile
@@ -1,4 +1,4 @@
-FROM python:3.15.0b1-alpine
+FROM python:3.15.0rc1-alpine

 WORKDIR /usr/src/app

--- a/docs/_build/requirements.txt
+++ b/docs/_build/requirements.txt
@@ -1,23 +1,23 @@
-beautifulsoup4==4.14.3
-click==8.4.1
+beautifulsoup4==4.15.0
+click==8.4.2
 ghp-import==2.1.0
 importlib-metadata==9.0.0
 Jinja2==3.1.6
-Markdown>=3.10.2,<3.11
+Markdown>=3.10.3,<3.11
 MarkupSafe==3.0.3
 mergedeep==1.3.4
 mkdocs==1.6.1
 mkdocs-exclude==1.0.2
-mkdocs-material==9.7.6
+mkdocs-material==9.7.7
 mkdocs-material-extensions==1.3.1
-packaging==26.2
-Pygments==2.20.0
-pymdown-extensions==10.21.3
+packaging==26.3
+Pygments==2.21.0
+pymdown-extensions==11.0.1
 pyparsing==3.3.2
 python-dateutil==2.9.0.post0
 PyYAML==6.0.3
 pyyaml_env_tag==1.1
 six==1.17.0
-soupsieve==2.8.4
+soupsieve==2.9.2
 watchdog==6.0.0
 zipp==4.1.0
--- a/docs/advanced-usage/backup-recovery.md
+++ b/docs/advanced-usage/backup-recovery.md
@@ -96,6 +96,14 @@ System administrators are highly encouraged to store persistent data in app-spec

 See the [persistent storage documentation](/docs/advanced-usage/persistent-storage.md) for more information on how to attach persistent storage to your app.

+### Restoring on a machine with a different CPU Architecture
+
+When restoring a backup on a machine that has a different CPU architecture, you will need to clear out the `~/.basher`  as it's not portable across different CPU architectures. Do so with the following command immediately after restoring your dokku configs:
+
+```shell
+rm -rf /home/dokku/.basher
+```
+
 ## Recovering app code

 In case of an emergency when your git repo and backups are completely lost, you can recover the last pushed copy from your remote Dokku server (assuming you still have the ssh key).
--- a/docs/advanced-usage/docker-options.md
+++ b/docs/advanced-usage/docker-options.md
@@ -38,6 +38,16 @@ More information on supported Docker options can be found [here](https://docs.do

 Container options configured via the `docker-options` plugin are not used to modify the process a container runs. Container options are the `[OPTIONS]` portion of the following, where `[CONTAINER_COMMAND]` and `[ARG]` are the process and the arguments passed to it that are launched in the created container: `docker run [OPTIONS] [CONTAINER_COMMAND] [ARG...]`. Please see the documentation for [customizing the run command](/docs/deployment/builders/dockerfiles.md#customizing-the-run-command) or use a [Procfile](/docs/deployment/builders/dockerfiles.md#procfiles-and-multiple-processes) to modify the command used by a Dockerfile-based container.

+#### Scheduler support
+
+Docker options are written in Docker's own vocabulary and are passed verbatim to `docker run` by the `docker-local` scheduler. Other schedulers translate only the subset that has an equivalent in their own runtime, and ignore the rest.
+
+The `k3s` scheduler translates `--cap-add`, `--cap-drop`, `--privileged`, and `--sysctl` into their Kubernetes equivalents. See the [k3s scheduler documentation](/docs/deployment/schedulers/k3s.md) for details, including the restriction that only namespaced sysctls can be set on a pod.
+
+```shell
+dokku docker-options:add node-js-app deploy "--sysctl net.ipv4.ip_unprivileged_port_start=1024"
+```
+
 #### Mounting volumes and host directories

 Docker supports volume and host directory mounting via the `-v` or `--volume` flags. In order to simplify usage, Dokku provides a `storage` plugin as an abstraction to interact with persistent storage. In most cases, the Dokku project recommends using the persistent storage plugin over directly manipulating docker options at different phases. See the [persistent storage documentation](/docs/advanced-usage/persistent-storage.md) for more information on how to attach persistent storage to your app.
@@ -64,7 +74,21 @@ Multiple docker options can also be specified in a single call. Each `--flag [va
 dokku docker-options:add node-js-app deploy "--ulimit nofile=12" "--shm-size 256m"
 ```

-A misplaced `--process PROC` (i.e. one specified after the app name instead of before it) is honored as a subcommand flag rather than stored as a docker option, so the example above and the equivalent process-scoped form below behave identically:
+Option values are stored and passed to the container verbatim. Quoting only controls how a value is split into words - no shell expansion is performed, so `$(...)`, backticks, `$VAR`, and globs are treated literally rather than being interpreted by the shell. This is what lets values such as a Traefik router rule be applied as-is:
+
+```shell
+dokku docker-options:add node-js-app deploy '--label "traefik.http.routers.web.rule=Host(`node-js-app.example.com`) && PathPrefix(`/api`)"'
+```
+
+> [!WARNING]
+> Options added before 0.38.25 were expanded by the shell when a container was created. Any such option that relied on shell expansion - `$(...)`, backticks, or `$VAR` - is treated as a literal string after upgrading and must be re-added with the value already resolved:
+>
+> ```shell
+> dokku docker-options:remove node-js-app deploy "--group-add \$(getent group docker | cut -d: -f3)"
+> dokku docker-options:add node-js-app deploy "--group-add $(getent group docker | cut -d: -f3)"
+> ```
+
+A misplaced `--process PROC` (i.e. one specified after the app name instead of before it) is honored as a subcommand flag rather than stored as a docker option, so the two invocations below behave identically:

 ```shell
 dokku docker-options:add --process web node-js-app deploy "--ulimit nofile=12" "--shm-size 256m"
@@ -91,6 +115,13 @@ Multiple docker options can also be removed in a single call, mirroring the spli
 dokku docker-options:remove node-js-app deploy "--ulimit nofile=12" "--shm-size 256m"
 ```

+A stored option is matched by shell word rather than by exact string, so the value only has to be equivalent to the stored one, not byte-identical. Quoting an option one way removes an option that was stored quoted another way:
+
+```shell
+dokku docker-options:add node-js-app deploy "--label 'com.example.owner=platform team'"
+dokku docker-options:remove node-js-app deploy '--label "com.example.owner=platform team"'
+```
+
 #### Clear all Docker options for an app

 Docker options can be removed for a specific app using the `docker-options:clear` command.
@@ -179,6 +210,25 @@ A machine-readable JSON view is available via `--format json`:
 dokku docker-options:report node-js-app --format json
 ```

+The JSON report includes the existing string keys (`build`, `deploy`, `run`, and `deploy.<process>` when configured) plus parallel `-list` keys for the same shorthand keys. Each `-list` value is a JSON array with one element per option as originally stored via `docker-options:add`, which allows export tooling to round-trip options that contain spaces without splitting the legacy space-joined strings. Empty phases emit an empty array (`[]`). The deprecated `docker-options-*` prefixed keys are unchanged and do not gain `-list` companions.
+
+```json
+{
+  "build": "",
+  "build-list": [],
+  "deploy": "-v /logs:/logs --memory=512m",
+  "deploy-list": ["-v /logs:/logs", "--memory=512m"],
+  "run": "",
+  "run-list": [],
+  "deploy.web": "-p 8080:5000",
+  "deploy.web-list": ["-p 8080:5000"],
+  "docker-options-build": "",
+  "docker-options-deploy": "-v /logs:/logs --memory=512m",
+  "docker-options-run": "",
+  "docker-options-deploy.web": "-p 8080:5000"
+}
+```
+
 ### Process-Specific Options

 > [!IMPORTANT]
@@ -243,3 +293,5 @@ The following properties are recorded internally by the docker-options plugin an
 | `migrated-build` | per-app | Per-app marker recording that the app's legacy `DOCKER_OPTIONS_BUILD` file was drained into the `_default_.build` property list. Only set when the legacy file contained non-empty content | `plugins/docker-options/functions.go` writes `"true"` after the per-phase drain |
 | `migrated-deploy` | per-app | Per-app marker recording that the app's legacy `DOCKER_OPTIONS_DEPLOY` file was drained into the `_default_.deploy` property list. Only set when the legacy file contained non-empty content | `plugins/docker-options/functions.go` writes `"true"` after the per-phase drain |
 | `migrated-run` | per-app | Per-app marker recording that the app's legacy `DOCKER_OPTIONS_RUN` file was drained into the `_default_.run` property list. Only set when the legacy file contained non-empty content | `plugins/docker-options/functions.go` writes `"true"` after the per-phase drain |
+| `migrated-traefik-backticks` | global | Global sentinel recording that stored Traefik labels whose backticks carried a stray backslash have been repaired | `plugins/docker-options/functions.go` writes `"true"` once the install-time repair runs |
+| `migrated-canonical-options` | global | Global sentinel recording that stored options have been rewritten into the canonical form, quoting values whose shell metacharacters were left bare by an older legacy-file drain and splitting entries that carried several flags | `plugins/docker-options/functions.go` writes `"true"` once the install-time rewrite runs |
--- a/docs/advanced-usage/persistent-storage.md
+++ b/docs/advanced-usage/persistent-storage.md
@@ -6,18 +6,22 @@
 The preferred method to attach persistent storage to a Dokku-managed container is the Dokku storage plugin.

 ```
+storage:annotations:report [<name>] [<flag>]           # Display annotations for one or more storage entries
+storage:annotations:set <name> <key> [<value>]         # Set or clear a single annotation on a storage entry
 storage:create <name> [<path>] [flags]                 # Register a named storage entry
-storage:destroy <name>                                 # Remove a named storage entry (must be unmounted from every app first)
+storage:destroy <name> [--force] [--destroy-host-dir]  # Remove a named storage entry (must be unmounted from every app first)
 storage:ensure-directory [--chown option] <directory>  # [DEPRECATED] use storage:create instead
 storage:exec <name> [-- <cmd>...]                      # Run a command (or shell) in a temporary container that mounts the entry
 storage:info <name> [--format text|json]               # Show details for one storage entry
+storage:labels:report [<name>] [<flag>]                # Display labels for one or more storage entries
+storage:labels:set <name> <key> [<value>]              # Set or clear a single label on a storage entry
 storage:list <app> [--format text|json]                # List bind mounts for an app's container(s) (legacy host:container view)
 storage:list-entries [--scheduler s] [--format text|json]  # List registered storage entries
 storage:mount <app> <name> --container-dir <path> [flags]  # Mount a named entry into an app
 storage:mount <app> <host-dir:container-dir>           # [LEGACY] colon-form mount, docker-local only
 storage:report [<app>] [<flag>]                        # Display a storage report for one or more apps
 storage:report --global                                # Display a cluster-wide entry inventory
-storage:set <name> [flags]                             # Update a storage entry in place
+storage:set <name> <property> [<value>]                # Update a storage entry in place
 storage:unmount <app> <name> [--container-dir <path>]  # Remove an attachment
 storage:wait <name>                                    # Block until a k3s entry's PVC is bound
 ```
@@ -57,9 +61,23 @@ dokku storage:list node-js-app --format json
 ```
 [
  {
+    "entry_name": "node-js-app",
    "host_path": "/var/lib/dokku/data/storage/node-js-app",
+    "container_path": "/app/storage"
+  }
+]
+```
+
+Each entry mirrors the underlying attachment. `readonly` (boolean) and `volume_options` (string) reflect `Attachment.Readonly` and `Attachment.VolumeOptions` directly and are only present when set, so external tooling can drift-detect attachments against the raw attachment fields. For example, a mount created with `--volume-options noexec,nosuid --volume-readonly` renders as:
+
+```
+[
+  {
+    "entry_name": "node-js-data",
+    "host_path": "/var/lib/dokku/data/storage/node-js-data",
    "container_path": "/app/storage",
-    "volume_options": ""
+    "readonly": true,
+    "volume_options": "noexec,nosuid"
  }
 ]
 ```
@@ -92,12 +110,130 @@ By default, permissions are set for usage with Herokuish buildpacks. These permi
 - `--chown root`: Use `0:0` as the folder permissions.
    - This is used for containers that run their processes as root, as is typical for most Dockerfile or Docker image deploys.
 - `--chown false`: Skips the `chown` call.
+- `--chown <uid>`: Use `<uid>:<uid>` as the folder permissions, where `<uid>` is a custom numeric user/group id.
+    - This is used for containers that run their processes as a uid/gid that doesn't correspond to any of the above named options.

 Users deploying via Dockerfile will want to specify `--chown false` and manually `chown` the created directory if the user and/or group id  of the runnning process in the deployed container do not correspond to any of the above options.

+The `--chown` flag - whether on `storage:create` or `storage:ensure-directory` - only manages the default `/var/lib/dokku/data/storage/<name>` location. If a custom `<path>` is passed to `storage:create`, the chown call is refused and the operator must chown the path themselves.
+
 > [!WARNING]
 > Failing to set the correct directory ownership may result in issues in persisting files written to the mounted storage directory.

+### Setting directory permissions
+
+> [!IMPORTANT]
+> New as of 0.38.27
+
+Where `--chown` states who owns the host directory, `--mode` states its permission bits. It takes a 3 or 4 digit octal mode, and is a `--mode` flag on `storage:create` and a `mode` property on `storage:set`:
+
+```shell
+dokku storage:create node-js-data --mode 0777
+```
+
+```shell
+dokku storage:set node-js-data mode 0770
+```
+
+Omitting the value clears the mode, leaving the directory's permissions alone on subsequent runs:
+
+```shell
+dokku storage:set node-js-data mode
+```
+
+Without a mode, a newly created directory keeps the `0755` default and a pre-existing directory keeps whatever permissions it already had. The value is stored on the entry and re-applied every time `storage:create` or `storage:set` runs against it, so a declarative caller converges the directory by re-running the same command rather than reaching for `chmod` over SSH. The mode is shown by `storage:info`:
+
+```shell
+dokku storage:info node-js-data
+```
+
+```
+-----> Storage entry node-js-data
+       Scheduler:        docker-local
+       Host path:        /var/lib/dokku/data/storage/node-js-data
+       Mode:             0777
+```
+
+The mode is applied to the directory itself and does not recurse into its contents. Like `--chown`, it is docker-local only and only manages the default `/var/lib/dokku/data/storage/<name>` location - it is refused for k3s entries and for entries created with a custom `<path>`. That refusal also covers migrated `legacy-*` entries, whose host paths come from the original colon-form mount rather than the default location.
+
+### Updating a storage entry
+
+> [!IMPORTANT]
+> The property form is new as of 0.38.27. Prior versions used flags, which still work but emit a deprecation warning.
+
+An existing entry is edited with `storage:set`, which takes a property and a value. Omitting the value unsets the property, restoring whatever the entry defaults to:
+
+```shell
+dokku storage:set node-js-data chown herokuish
+dokku storage:set node-js-data chown
+```
+
+The following properties can be set:
+
+| Property | Description | Unsetting it means |
+|---|---|---|
+| `chown` | Ownership preset or numeric uid for the host directory | no chown is performed |
+| `mode` | Octal permissions for the host directory | permissions are left alone |
+| `namespace` | Namespace holding the PVC (k3s) | the `default` namespace |
+| `reclaim-policy` | Whether the underlying volume survives `storage:destroy` | `Retain` |
+| `size` | PVC size (k3s) | rejected, since k3s entries require a size |
+| `access-mode` | PVC access mode (k3s) | rejected, see below |
+| `storage-class-name` | PVC storage class (k3s) | rejected, see below |
+
+`access-mode` and `storage-class-name` cannot be changed on an entry that already exists, because Kubernetes cannot apply either to a bound PVC. Both a different value and an empty one are refused, since clearing is equally a change:
+
+```shell
+dokku storage:set node-js-data access-mode ReadWriteMany
+```
+
+```
+ !     storage:set cannot change access-mode in place; recreate the entry
+```
+
+Setting `chown` or `mode` on a docker-local entry applies the change to the host directory immediately. Every other property is a metadata write, and k3s entries re-apply their helm release so the cluster picks the change up.
+
+The older flag form - `dokku storage:set node-js-data --mode 0770` - continues to work and warns. It gained unset semantics too, so `--mode ""` clears the mode the same way omitting the positional value does.
+
+### Annotations and labels
+
+> [!IMPORTANT]
+> New as of 0.38.27
+
+Annotations and labels are attached to a storage entry one key at a time, matching the [scheduler-k3s equivalents](/docs/deployment/schedulers/k3s.md#setting-annotations). On k3s they propagate to both the PersistentVolumeClaim and the PersistentVolume, so backup tools like Velero and Longhorn can find the volume.
+
+```shell
+dokku storage:annotations:set node-js-data backup.velero.io/backup-volumes node-js-data
+dokku storage:labels:set node-js-data app.kubernetes.io/part-of billing
+```
+
+Keys may contain `/`, as the Kubernetes-style keys above do, and are stored verbatim. To clear a single key, omit the value. Other keys are left untouched, so a declarative caller does not need to re-send the whole set on every call:
+
+```shell
+dokku storage:annotations:set node-js-data backup.velero.io/backup-volumes
+```
+
+Configured annotations and labels can be inspected with the matching report commands. Without an entry name they cover every registered entry:
+
+```shell
+dokku storage:annotations:report
+dokku storage:annotations:report node-js-data
+dokku storage:labels:report node-js-data
+```
+
+```
+=====> node-js-data annotations information
+       Annotation backup.velero.io/backup-volumes: node-js-data
+```
+
+JSON output emits the keys flat, and a single value can be read directly with a flag of the form `--storage-annotations.<key>` (or `--storage-labels.<key>`), which requires an entry name:
+
+```shell
+dokku storage:annotations:report node-js-data --format json
+dokku storage:annotations:report node-js-data --storage-annotations.backup.velero.io/backup-volumes
+```
+
+`storage:create` still accepts repeatable `--annotation key=value` and `--label key=value` flags for setting the initial set at creation time. The same flags on `storage:set` are deprecated in favor of these commands, because they replace the entire map rather than a single key.
+
 ### Mounting storage into apps

 Dokku supports mounting both explicit host paths as well as docker volumes via the `storage:mount` command. This takes two arguments, an app name and a `host-path:container-path` or `docker-volume:container-path` combination.
@@ -116,6 +252,17 @@ In the first example, Dokku will then mount the shared contents of `/var/lib/dok

 > If the `/storage` path within the container had pre-existing content, the container files will be over-written. This may be an issue for users that create assets at build time but then mount a directory at the same place during runtime. Files are not merged.

+For named storage entries, additional Docker mount options can be passed via `--volume-options`. The value is a comma-separated mount-options string stored verbatim on the attachment and rendered into the `-v` flag at deploy time. This is useful for SELinux labels (`Z`, `z`) or hardening flags (`noexec,nosuid`):
+
+```shell
+dokku storage:create node-js-data
+dokku storage:mount node-js-app node-js-data --container-dir /app/storage --volume-options Z
+```
+
+When combined with `--volume-readonly`, the rendered options become `ro,<volume-options>` - for example, `--volume-options noexec,nosuid --volume-readonly` renders as `:ro,noexec,nosuid`.
+
+Re-running `storage:mount` against a named entry with the same `--container-dir` and `--process-type` updates the existing attachment's mount-time attributes (`--phase`, `--volume-subpath`, `--volume-readonly`, `--volume-chown`, `--volume-options`) in place rather than appending a duplicate. This is the idempotent equivalent of `storage:set` for entries, and lets declarative tooling change a mount-time attribute without an unmount-then-remount dance that would briefly drop the volume from `storage:report`. Mount-time fields are rewritten wholesale, not merged - omitting a flag on a re-mount clears any previously-set value. The legacy `host:container[:opts]` form still rejects duplicates with `Mount path already exists.`.
+
 Once persistent storage is mounted, the app requires a restart. See the [process scaling documentation](/docs/processes/process-management.md) for more information.

 ```shell
@@ -140,6 +287,65 @@ Once persistent storage is unmounted, the app requires a restart. See the [proce
 dokku ps:restart app-name
 ```

+### Destroying storage entries
+
+A named storage entry can be removed with the `storage:destroy` command. The entry must first be unmounted from every app that mounts it.
+
+```shell
+dokku storage:destroy rdmtest-entry
+```
+
+As the command is destructive - removing the registry entry and, depending on the scheduler and reclaim policy, the underlying volume - it will default to asking for confirmation before executing the removal.
+
+```
+ !     WARNING: Potentially Destructive Action
+ !     This command will destroy storage entry rdmtest-entry.
+ !     To proceed, type "rdmtest-entry"
+> rdmtest-entry
+-----> Storage entry rdmtest-entry destroyed
+```
+
+The confirmation may be avoided by providing the `--force` flag, which is useful for non-interactive or automated callers:
+
+```shell
+dokku storage:destroy rdmtest-entry --force
+```
+
+The global `--force` flag is also supported:
+
+```shell
+dokku --force storage:destroy rdmtest-entry
+```
+
+#### Removing the host directory
+
+> [!IMPORTANT]
+> New as of 0.38.27
+
+By default a docker-local entry's host directory survives `storage:destroy` - the entry is deregistered but the data stays on disk. The `--destroy-host-dir` flag removes the directory and everything in it:
+
+```shell
+dokku storage:destroy node-js-data --destroy-host-dir
+```
+
+```
+ !     Storage entry node-js-data is backed by /var/lib/dokku/data/storage/node-js-data, which will be removed along with its contents.
+ !     WARNING: Potentially Destructive Action
+ !     This command will destroy storage entry node-js-data.
+ !     To proceed, type "node-js-data"
+```
+
+The removal is recursive, so it succeeds whether or not the directory is empty. It is only permitted for entries at the default `/var/lib/dokku/data/storage/<name>` location; an entry created with a custom `<path>` is refused, and the operator removes the path themselves.
+
+The same removal can be declared ahead of time with `--reclaim-policy`, which behaves for a docker-local host directory the way it behaves for a k3s PersistentVolume. An entry created with `Delete` has its host directory removed on `storage:destroy` without any extra flag, while `Retain` - the default when unset - keeps it:
+
+```shell
+dokku storage:create node-js-data --reclaim-policy Delete
+dokku storage:destroy node-js-data --force
+```
+
+`--destroy-host-dir` is docker-local only. On a k3s entry the underlying volume is already governed by the reclaim policy recorded on the entry, so passing the flag is an error.
+
 ### Displaying storage reports for an app

 > [!IMPORTANT]
@@ -185,6 +391,60 @@ You can pass flags which will output only the value of the specific information
 dokku storage:report node-js-app --storage-deploy-mounts
 ```

+In addition to the aggregated `Storage build/deploy/run mounts:` lines, the report emits one flat dotted key per attachment field, indexed from `1`. The key shape is `--storage-attachment.<index>.<field>` for each of `entry-name`, `host-path`, `container-path`, `phases`, `process-type`, `subpath`, `readonly`, `volume-options`, and `volume-chown`. Fields render as empty strings when unset, and attachments are ordered by lex-sort of the index (so `10` sorts before `2`):
+
+```shell
+dokku storage:create node-js-data
+dokku storage:mount node-js-app node-js-data --container-dir /app/storage --volume-options Z --volume-chown herokuish --volume-subpath uploads
+dokku storage:report node-js-app
+```
+
+```
+=====> node-js-app storage information
+       Storage attachment 1 container path:  /app/storage
+       Storage attachment 1 entry name:      node-js-data
+       Storage attachment 1 host path:       /var/lib/dokku/data/storage/node-js-data
+       Storage attachment 1 phases:          deploy,run
+       Storage attachment 1 process type:    _default_
+       Storage attachment 1 readonly:        false
+       Storage attachment 1 subpath:         uploads
+       Storage attachment 1 volume chown:    herokuish
+       Storage attachment 1 volume options:  Z
+       Storage build mounts:
+       Storage deploy mounts: -v /var/lib/dokku/data/storage/node-js-data:/app/storage:Z
+       Storage run mounts:  -v /var/lib/dokku/data/storage/node-js-data:/app/storage:Z
+```
+
+The same keys are exposed in JSON output, both in the stripped (`attachment.1.volume-options`) and legacy (`storage-attachment.1.volume-options`) forms:
+
+```shell
+dokku storage:report node-js-app --format json | jq '. | with_entries(select(.key | startswith("attachment.")))'
+```
+
+```json
+{
+  "attachment.1.container-path": "/app/storage",
+  "attachment.1.entry-name": "node-js-data",
+  "attachment.1.host-path": "/var/lib/dokku/data/storage/node-js-data",
+  "attachment.1.phases": "deploy,run",
+  "attachment.1.process-type": "_default_",
+  "attachment.1.readonly": "false",
+  "attachment.1.subpath": "uploads",
+  "attachment.1.volume-chown": "herokuish",
+  "attachment.1.volume-options": "Z"
+}
+```
+
+A single attachment field can be fetched directly via the info-flag form:
+
+```shell
+dokku storage:report node-js-app --storage-attachment.1.volume-options
+```
+
+```
+Z
+```
+
 ## Use Cases

 ### Sharing storage across deploys
--- a/docs/advanced-usage/plugin-management.md
+++ b/docs/advanced-usage/plugin-management.md
@@ -9,7 +9,7 @@ plugin:enable <name>                     # Enable a previously disabled plugin
 plugin:install [--core|git-url] [--committish branch|commit|tag] [--name custom-plugin-name] [--skip-install-trigger] # Optionally download git-url (and pin to the specified branch/commit/tag) & run install trigger for active plugins (or only core ones)
 plugin:installed <name>                  # Checks if a plugin is installed
 plugin:install-dependencies [--core]     # Run install-dependencies trigger for active plugins (or only core ones)
-plugin:list                              # Print active plugins
+plugin:list [--format stdout|json]       # Print active plugins
 plugin:trigger <args...>.                # Trigger an arbitrary plugin hook
 plugin:uninstall <name>                  # Uninstall a plugin (third-party only)
 plugin:update [name [branch|commit|tag]] # Optionally update named plugin from git (and pin to the specified branch/commit/tag) & run update trigger for active plugins
@@ -36,37 +36,70 @@ dokku plugin:list

 ```
 plugn: dev
-  00_dokku-standard    0.38.8 enabled    dokku core standard plugin
-  20_events            0.38.8 enabled    dokku core events logging plugin
-  app-json             0.38.8 enabled    dokku core app-json plugin
-  apps                 0.38.8 enabled    dokku core apps plugin
-  build-env            0.38.8 enabled    dokku core build-env plugin
-  buildpacks           0.38.8 enabled    dokku core buildpacks plugin
-  certs                0.38.8 enabled    dokku core certificate management plugin
-  checks               0.38.8 enabled    dokku core checks plugin
-  common               0.38.8 enabled    dokku core common plugin
-  config               0.38.8 enabled    dokku core config plugin
-  docker-options       0.38.8 enabled    dokku core docker-options plugin
-  domains              0.38.8 enabled    dokku core domains plugin
-  enter                0.38.8 enabled    dokku core enter plugin
-  git                  0.38.8 enabled    dokku core git plugin
-  logs                 0.38.8 enabled    dokku core logs plugin
-  network              0.38.8 enabled    dokku core network plugin
-  nginx-vhosts         0.38.8 enabled    dokku core nginx-vhosts plugin
-  plugin               0.38.8 enabled    dokku core plugin plugin
-  proxy                0.38.8 enabled    dokku core proxy plugin
-  ps                   0.38.8 enabled    dokku core ps plugin
-  repo                 0.38.8 enabled    dokku core repo plugin
-  resource             0.38.8 enabled    dokku core resource plugin
-  scheduler-docker-local 0.38.8 enabled    dokku core scheduler-docker-local plugin
-  shell                0.38.8 enabled    dokku core shell plugin
-  ssh-keys             0.38.8 enabled    dokku core ssh-keys plugin
-  storage              0.38.8 enabled    dokku core storage plugin
-  tags                 0.38.8 enabled    dokku core tags plugin
-  tar                  0.38.8 enabled    dokku core tar plugin
-  trace                0.38.8 enabled    dokku core trace plugin
+  00_dokku-standard    0.38.27 enabled    dokku core standard plugin
+  20_events            0.38.27 enabled    dokku core events logging plugin
+  app-json             0.38.27 enabled    dokku core app-json plugin
+  apps                 0.38.27 enabled    dokku core apps plugin
+  build-env            0.38.27 enabled    dokku core build-env plugin
+  buildpacks           0.38.27 enabled    dokku core buildpacks plugin
+  certs                0.38.27 enabled    dokku core certificate management plugin
+  checks               0.38.27 enabled    dokku core checks plugin
+  common               0.38.27 enabled    dokku core common plugin
+  config               0.38.27 enabled    dokku core config plugin
+  docker-options       0.38.27 enabled    dokku core docker-options plugin
+  domains              0.38.27 enabled    dokku core domains plugin
+  enter                0.38.27 enabled    dokku core enter plugin
+  git                  0.38.27 enabled    dokku core git plugin
+  logs                 0.38.27 enabled    dokku core logs plugin
+  network              0.38.27 enabled    dokku core network plugin
+  nginx-vhosts         0.38.27 enabled    dokku core nginx-vhosts plugin
+  plugin               0.38.27 enabled    dokku core plugin plugin
+  proxy                0.38.27 enabled    dokku core proxy plugin
+  ps                   0.38.27 enabled    dokku core ps plugin
+  repo                 0.38.27 enabled    dokku core repo plugin
+  resource             0.38.27 enabled    dokku core resource plugin
+  scheduler-docker-local 0.38.27 enabled    dokku core scheduler-docker-local plugin
+  shell                0.38.27 enabled    dokku core shell plugin
+  ssh-keys             0.38.27 enabled    dokku core ssh-keys plugin
+  storage              0.38.27 enabled    dokku core storage plugin
+  tags                 0.38.27 enabled    dokku core tags plugin
+  tar                  0.38.27 enabled    dokku core tar plugin
+  trace                0.38.27 enabled    dokku core trace plugin
 ```

+The list can also be emitted as JSON via the `--format json` flag. In addition to the name, version, enabled state, and description shown in the default output, the JSON output includes whether a plugin is a core plugin and - for git-based third-party plugins - the install source (the git remote URL, the currently checked-out commit, and the followed branch). This is useful for tooling that reconstructs a server's set of installed plugins:
+
+```shell
+dokku plugin:list --format json
+```
+
+```json
+[
+  {
+    "name": "apps",
+    "version": "0.38.27",
+    "enabled": true,
+    "core": true,
+    "description": "dokku core apps plugin",
+    "source_url": "",
+    "committish": "",
+    "branch": ""
+  },
+  {
+    "name": "postgres",
+    "version": "1.42.0",
+    "enabled": true,
+    "core": false,
+    "description": "dokku postgres service plugin",
+    "source_url": "https://github.com/dokku/dokku-postgres.git",
+    "committish": "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0",
+    "branch": "master"
+  }
+]
+```
+
+The `source_url`, `committish`, and `branch` fields are only populated for plugins installed from a git repository. They are empty for core plugins as well as for plugins installed from a tarball or a local `file://` path. When a plugin is pinned to a specific commit or tag (a detached checkout), the `branch` field is empty while `committish` still reports the exact commit.
+
 > [!WARNING]
 > All plugin commands other than `plugin:list` and `plugin:help` require sudo access and must be run directly from the Dokku server.

--- a/docs/appendices/0.38.0-migration-guide.md
+++ b/docs/appendices/0.38.0-migration-guide.md
@@ -15,7 +15,7 @@
    }
    ```

- The path on disk to both the global `ENV` file and app `ENV` files have been moved. Users should reference environment variables via the provided plugin triggers rather than directly sourcing the ENV files. Existing ENV files are left untouched and will be removed on the subsequent Dokku install.
+- The path on disk to both the global `ENV` file and app `ENV` files have been moved. Users should reference environment variables via the provided plugin triggers rather than directly sourcing the ENV files. Existing ENV files are merged into the new location and removed once they have been drained. **Changed in 0.38.26:** removal previously happened on the subsequent Dokku install for app ENV files, and never happened at all for the global ENV file. **Changed in 0.38.27:** an ENV file found at the old path after its migration has been recorded is never merged into the new location, because the new location holds every change made since. Such a file is removed when its values agree with the current config, and otherwise moved aside to `ENV.migrated` with the keys it disagrees on named in a warning, so its values can still be applied by hand with `dokku config:set`. That copy is left for review and should be deleted afterwards: Dokku no longer reads it, and it holds everything it was not allowed to import - including keys that were unset on purpose, which for a revoked secret means a copy lingering on disk.
 - During a fresh apt install, the upstream nginx default vhost files (`/etc/nginx/sites-enabled/default`, `/etc/nginx/sites-available/default`, and `/etc/nginx/conf.d/default.conf`) are renamed to `${path}.dokku-disabled` (not deleted) to avoid a `duplicate default server for 0.0.0.0:80` error. Operators with local customizations can recover them by inspecting the `.dokku-disabled` siblings. Upgrade-in-place installs do not touch any existing nginx files.
 - Fresh apt installs now ship a catch-all default site at `/etc/nginx/conf.d/00-default-vhost.conf` that rejects requests with unknown Host headers using `ssl_reject_handshake on` (HTTPS) and `return 444` (HTTP). This replaces the manual workaround previously documented in the nginx docs. The behavior can be opted out at install time via the `dokku/install_default_site` debconf prompt. On nginx older than 1.19.4 (e.g., Debian Bullseye's nginx 1.18.0), the postinst installs an HTTP-only variant of the catch-all that omits the SSL listener and `ssl_reject_handshake`, since that directive is unsupported on those versions. See the [Default site documentation](/docs/networking/proxies/nginx.md#default-site).
 - The `docker-local` scheduler now sends `SIGTERM` to old containers immediately after a successful deploy, rather than waiting `wait-to-retire` seconds before signaling. This matches Heroku's graceful-shutdown contract and lets applications begin draining in-flight work as soon as proxy traffic switches. The `wait-to-retire` grace period and `stop-timeout-seconds` hard-stop continue to apply as before. See the [zero downtime deploys documentation](/docs/deployment/zero-downtime-deploys.md#wait-to-retire) for more details.
@@ -23,9 +23,13 @@
 - All `:report` subcommands now accept the `--global` flag, which scopes the report to globally-configured properties. The flag composes with `--format json`, so a JSON report of global properties can be obtained via, for example, `dokku scheduler:report --global --format json`. Previously, combining `--global` with `--format json` was rejected with an "info flag" error, and `--global` on its own was treated as an unknown flag.
 - Every `:report` key of the form `<plugin>-global-<property>` now returns the raw stored global value (empty when the property has never been set) instead of the resolved value with the built-in default substituted in. A new `<plugin>-computed-<property>` key has been added wherever a default existed and returns the effective value (per-app value, falling back to the global value, then to the built-in default). This affects `app-json`, `builder-dockerfile`, `builder-herokuish`, `builder-lambda`, `builder-nixpacks`, `builder-pack`, `builder-railpack`, `caddy`, `checks`, `git`, `haproxy`, `logs`, `network`, `nginx`, `openresty`, `proxy`, `registry`, `scheduler`, `scheduler-k3s` and `traefik`. External tooling that read `<plugin>-global-<property>` and depended on the default value should switch to `<plugin>-computed-<property>`. The bare `<plugin>-<property>` keys for caddy/haproxy/traefik/openresty global-only properties (`caddy-image`, `haproxy-log-level`, `traefik-api-enabled`, `openresty-image`, `openresty-letsencrypt-email`, `openresty-letsencrypt-server`, `openresty-allowed-letsencrypt-domains-func-base64`, etc.) have also been replaced by the `global-` and `computed-` pair.
 - The `ps` and `cron` plugins now follow the same `<plugin>-global-<property>` / `<plugin>-computed-<property>` convention. The `ps:report` keys `stop-timeout-seconds`, `global-stop-timeout-seconds`, and `computed-stop-timeout-seconds` have been renamed to `ps-stop-timeout-seconds`, `ps-global-stop-timeout-seconds`, and `ps-computed-stop-timeout-seconds`. The `cron:report` keys `cron-mailfrom` and `cron-mailto` have been renamed to `cron-global-mailfrom` and `cron-global-mailto`, and new `cron-computed-mailfrom` and `cron-computed-mailto` keys have been added. The corresponding user-facing `--<flag>` arguments to `ps:report` and `cron:report` were renamed alongside the JSON keys; no aliases are kept. Additionally, both `ps:report --global` and `cron:report --global` now emit the `<plugin>-computed-<property>` keys for every settable global property with a default (`ps-computed-procfile-path`, `ps-computed-stop-timeout-seconds`, `cron-computed-maintenance`, `cron-computed-mailfrom`, `cron-computed-mailto`), matching the shape used by the other plugins.
- A second round of `:report` additions surfaces every remaining settable-but-unreported property under the same raw/global/computed convention so external tooling can verify drift via `:report --format json` without falling back to a generic bash task. The `ps` plugin gains `--ps-dockerfile-start-cmd` and `--ps-computed-dockerfile-start-cmd`, `--ps-start-cmd` and `--ps-computed-start-cmd`, and the `--ps-skip-deploy` / `--ps-global-skip-deploy` / `--ps-computed-skip-deploy` triple (default `false`). The `builder` plugin gains the `--builder-skip-cleanup` triple (default `false`). The `scheduler` plugin gains the `--scheduler-shell` triple. The `proxy` plugin gains the `--proxy-proxy-port` and `--proxy-proxy-ssl-port` triples and exposes the raw `disabled` property as `--proxy-disabled` / `--proxy-computed-disabled`, alongside the existing inverted `--proxy-enabled`. The `openresty` plugin gains `--openresty-global-log-level` and `--openresty-computed-log-level` (default `ERROR`). The `nginx` plugin gains the `--nginx-nginx-service-command` triple. The `scheduler-k3s` plugin gains `--scheduler-k3s-global-token`, but the value is masked as `*******` in default stdout output; the raw value is returned only when the report is requested via `--format json` or when this flag is queried explicitly by name. The traefik `dns-provider-<env_var>` keys now follow the same explicit-query rule - previously they were unmasked only for `--format json`, but a query like `dokku traefik:report --traefik-dns-provider-cf_api_key` now returns the actual value instead of `*******`.
+- A second round of `:report` additions surfaces every remaining settable-but-unreported property under the same raw/global/computed convention so external tooling can verify drift via `:report --format json` without falling back to a generic bash task. The `ps` plugin gains `--ps-dockerfile-start-cmd` and `--ps-computed-dockerfile-start-cmd`, `--ps-start-cmd` and `--ps-computed-start-cmd`, and the `--ps-skip-deploy` / `--ps-global-skip-deploy` / `--ps-computed-skip-deploy` triple (default `false`). The `builder` plugin gains the `--builder-skip-cleanup` triple (default `false`). The `scheduler` plugin gains the `--scheduler-shell` triple. The `proxy` plugin gains the `--proxy-proxy-port` and `--proxy-proxy-ssl-port` triples and exposes the raw `disabled` property as `--proxy-disabled` / `--proxy-computed-disabled`, alongside the existing inverted `--proxy-enabled`. The `openresty` plugin gains `--openresty-global-log-level` and `--openresty-computed-log-level` (default `ERROR`). The `nginx` plugin gains the `--nginx-nginx-service-command` triple. The `scheduler-k3s` plugin gains `--scheduler-k3s-global-token`, but the value is masked as `*******` in default stdout output; the raw value is returned only when the report is requested via `--format json` or when this flag is queried explicitly by name. The traefik `dns-provider-<env_var>` keys are reported as `--traefik-global-dns-provider-<env_var>` and follow the same masking and explicit-query rules, as does the traefik `basic-auth-password` property, whose `--traefik-global-basic-auth-password` and `--traefik-computed-basic-auth-password` keys are masked in default stdout output.
 - All Go-implemented plugins (`app-json`, `apps`, `builder`, `buildpacks`, `builds`, `cron`, `docker-options`, `logs`, `network`, `ports`, `proxy`, `ps`, `registry`, `resource`, `scheduler`, `scheduler-k3s`, `storage`) now emit JSON keys from `:report --format json` without the `<plugin>-` head segment, matching the shape bash plugins have always emitted. For example, `dokku ps:report myapp --format json` now contains `stop-timeout-seconds`, `global-stop-timeout-seconds`, and `computed-stop-timeout-seconds` keys. The CLI flag names (`--ps-stop-timeout-seconds`, etc.) are unchanged, and `:set` semantics are unchanged. For backwards compatibility during the 0.38.x patch series, the old `<plugin>-<property>` JSON keys are emitted side-by-side with the new keys, so external scripts reading either shape continue to work. The legacy keys will be dropped in a future major release. External JSON consumers should migrate to the new key shape.
 - The `scheduler-k3s` plugin now manages env config and the dokku-generated image pull Secret as their own helm releases with stable names (`config-{app}` and `pull-secret-{app}`) rather than bundling them into the app helm chart with a per-deploy timestamp suffix (`env-{app}.{ts}` / `ims-{app}.{ts}`). This fixes two bugs: a helm rollback of the app chart no longer deletes Secrets that older ReplicaSets still reference, and the Deployment's `imagePullSecrets` list no longer accumulates references to nonexistent Secrets across deploys. The next deploy of an app switches the Deployment's `envFrom` and `imagePullSecrets` references to the stable names and prunes any leaked entries; existing live Deployments do not need to be patched manually. App rename now also uninstalls the old `tls-{app}`, `config-{app}`, and `pull-secret-{app}` releases under the previous app name; the new name's releases are recreated on the next deploy or certs sync.
+- **New in 0.38.25:** Values supplied through docker options, `dokku run`'s `-e`/`--env` flag, and `--ttl-seconds` are no longer evaluated by the shell when assembling a container's arguments; they are now tokenized and passed through verbatim. This closes a command-injection vector where a `$(...)` or backtick expression in one of these values executed on the host as the `dokku` user during build, deploy, or run. As a result, shell metacharacters such as `$(...)`, backticks, `$VAR`, and globs in these values are treated literally instead of being expanded, and `--ttl-seconds` must now be a plain integer. Existing Traefik docker-options labels (those whose label key begins with `traefik.`) whose backticks were stored with a stray backslash are repaired automatically the first time `dokku` runs after the upgrade, so they become valid on the next deploy.
+- **New in 0.38.26:** Docker options drained out of the pre-0.38.0 `DOCKER_OPTIONS_<PHASE>` files were copied verbatim rather than being re-serialized the way `docker-options:add` stores them, so `docker-options:remove` compared the canonical string it builds against a value that could never match it and exited successfully without removing anything. Removal now matches stored options by shell word instead of by exact string, so those entries can be removed with the value as originally written. Stored options are also rewritten into the canonical form the first time `dokku` runs after the upgrade: values whose shell metacharacters were left unquoted are quoted, and an entry that carried several flags on one line becomes one entry per flag, which additionally fixes `ps:report` reading a restart policy off such a line and the `k3s` scheduler translating only the first of several `--cap-add`/`--sysctl` flags. Options added through `docker-options:add` are already canonical and are left untouched.
+- **New in 0.38.26:** Deprecated `DOKKU_*` config variables belonging to plugins whose install step runs before the `config` plugin's were not migrated to their plugin property on the upgrade run. Install steps fire in alphabetical order, so `apps`, `builder`, and `checks` read an app's environment before the `config` plugin had relocated the `ENV` file, found nothing, and moved nothing - without reporting anything. `dokku config:show` kept listing the variable while the plugin behaved as though it were unset, which for `DOKKU_CHECKS_SKIPPED` meant a process type silently regained a health check it was meant to skip. The relocation is now performed before any deprecated variable is read, regardless of install order. Affected installs recover on their next `dokku plugin:install --core`, which the upgrade already runs; the variables listed below can also be re-applied by hand using their replacement command.
+- **New in 0.38.27:** The 0.38.26 upgrade merged the leftover pre-0.38.0 `ENV` file back over the current config. Releases 0.38.0 through 0.38.25 recorded the migration and left that file on disk on purpose, and 0.38.26 read it as a hand-edit, so the environment as it stood at the 0.38.x upgrade won over every `dokku config:set` and `dokku config:unset` made since - including reinstating variables and secrets that had been deliberately unset. Nothing appeared broken, because running containers keep the environment they were created with; the rewound values would have reached containers on the next deploy. The 0.38.26 run consumed the leftover file, so this cannot happen a second time, but it also cannot be undone automatically. To check an app that was upgraded to 0.38.26 and has a container still running from before that upgrade, compare each key in `dokku config:show <app>` against `docker exec <container> printenv <key>` - `GIT_REV` is expected to differ after a deploy, anything else that differs was rewound. Repair with `dokku config:set --no-restart <app> KEY=VALUE` for values that regressed and `dokku config:unset --no-restart <app> KEY` for variables that came back.
 - The storage plugin now treats persistent volumes as named, scheduler-aware first-class resources via `storage:create`, `storage:mount`, `storage:set`, and `storage:destroy`. The legacy `storage:mount <app> <host>:<container>` colon form continues to work on docker-local apps but is deprecated; on k3s apps it is rejected. Existing colon-form mounts are migrated automatically the first time the new storage plugin runs (during the install trigger) - they appear as `legacy-<hash>` entries in `storage:list-entries`. The migration is idempotent and tied to a per-app flag file at `$DOKKU_LIB_ROOT/config/storage/.migrated/<app>`; deleting that file forces a re-scan on the next install. The `storage:ensure-directory` command keeps working but now emits a deprecation warning - prefer `storage:create <name> [<path>]` (the path defaults to the same `$DOKKU_LIB_ROOT/data/storage/<name>` location). Storage entry names must now be DNS-1123 labels of 45 characters or less so they can be used verbatim as Helm release and Kubernetes resource names; underscores and uppercase characters that the older `ensure-directory` validator accepted are rejected for new names. The migration synthesizer always uses lowercase hex hashes so existing data is never locked out.

 ### TLS handshake behavior change
--- a/docs/appendices/file-formats/nginx-conf-sigil.md
+++ b/docs/appendices/file-formats/nginx-conf-sigil.md
@@ -8,6 +8,43 @@ A custom `nginx.conf.sigil` is pre-validated at the start of every deploy, immed

 Pre-validation is skipped when the proxy type is not `nginx` or when `disable-custom-config` is set to `true` for the app.

+### Custom nginx modules
+
+Pre-validation runs `nginx -t` against a minimal wrapper config that does _not_ include the top-level `load_module` directives from the global `/etc/nginx/nginx.conf`. A `nginx.conf.sigil` that uses a directive provided by a dynamically loaded module - such as `image_filter`, provided by the [ngx_http_image_filter_module](https://nginx.org/en/docs/http/ngx_http_image_filter_module.html) - therefore fails pre-validation with an `unknown directive` error, even though `nginx -t` succeeds against the real server config where the module is loaded.
+
+The `load_module` directive cannot be added to the app's `nginx.conf.sigil` to work around this, as that file is included inside the `http { }` block while `load_module` is only valid in nginx's top-level main context.
+
+To make pre-validation aware of a module, override the wrapper template used for validation. The [`nginx-app-template-source`](/docs/development/plugin-triggers.md#nginx-app-template-source) trigger returns the path to the `sigil` template used to generate a given nginx configuration file, and its `validate-config` template type controls the pre-validation wrapper. Create a [custom plugin](/docs/development/plugin-creation.md) that implements the trigger and returns a `validate.conf.sigil` that adds the required `load_module` line at the top of the wrapper.
+
+The trigger file (named `nginx-app-template-source` and marked executable):
+
+```shell
+#!/usr/bin/env bash
+
+set -eo pipefail
+[[ $DOKKU_TRACE ]] && set -x
+
+APP="$1"
+TEMPLATE_TYPE="$2"
+if [[ "$TEMPLATE_TYPE" == "validate-config" ]]; then
+  echo "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/validate.conf.sigil"
+fi
+```
+
+The custom `validate.conf.sigil`, which is the [default wrapper](https://github.com/dokku/dokku/blob/master/plugins/nginx-vhosts/templates/validate.conf.sigil) with the required `load_module` line added at the top. Use the same `load_module` line that the host's global `/etc/nginx/nginx.conf` uses:
+
+```
+load_module modules/ngx_http_image_filter_module.so;
+events { worker_connections 768; }
+http {
+  access_log off;
+  error_log /dev/null;
+  include {{ $.NGINX_CONF }};
+}
+```
+
+The same override also governs the standalone `dokku nginx:validate-config` command, which renders the `validate-config` template as well.
+
 ## HTTP/2

 nginx 1.25.1 deprecated the `http2` parameter on the `listen` directive in favor of a standalone `http2 on;` directive. Custom `nginx.conf.sigil` templates that hardcode `listen ... ssl http2;` will produce `nginx: [warn] the "listen ... http2" directive is deprecated` warnings when run against nginx 1.25.1 or newer.
--- a/docs/assets/favicons/browserconfig.xml
+++ b/docs/assets/favicons/browserconfig.xml
@@ -2,10 +2,10 @@
 <browserconfig>
  <msapplication>
    <tile>
-      <square70x70logo src="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.8/docs/assets/favicons/mstile-70x70.png"/>
-      <square150x150logo src="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.8/docs/assets/favicons/mstile-150x150.png"/>
-      <square310x310logo src="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.8/docs/assets/favicons/mstile-310x310.png"/>
-      <wide310x150logo src="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.8/docs/assets/favicons/mstile-310x150.png"/>
+      <square70x70logo src="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.27/docs/assets/favicons/mstile-70x70.png"/>
+      <square150x150logo src="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.27/docs/assets/favicons/mstile-150x150.png"/>
+      <square310x310logo src="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.27/docs/assets/favicons/mstile-310x310.png"/>
+      <wide310x150logo src="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.27/docs/assets/favicons/mstile-310x150.png"/>
      <TileColor>#da532c</TileColor>
    </tile>
  </msapplication>
--- a/docs/assets/favicons/manifest.json
+++ b/docs/assets/favicons/manifest.json
@@ -2,37 +2,37 @@
    "name": "Dokku",
    "icons": [
        {
-            "src": "https:\/\/cdn.jsdelivr.net\/dokku\/dokku@v0.38.8\/docs\/assets\/favicons\/android-chrome-36x36.png",
+            "src": "https:\/\/cdn.jsdelivr.net\/dokku\/dokku@v0.38.27\/docs\/assets\/favicons\/android-chrome-36x36.png",
            "sizes": "36x36",
            "type": "image\/png",
            "density": "0.75"
        },
        {
-            "src": "https:\/\/cdn.jsdelivr.net\/dokku\/dokku@v0.38.8\/docs\/assets\/favicons\/android-chrome-48x48.png",
+            "src": "https:\/\/cdn.jsdelivr.net\/dokku\/dokku@v0.38.27\/docs\/assets\/favicons\/android-chrome-48x48.png",
            "sizes": "48x48",
            "type": "image\/png",
            "density": "1.0"
        },
        {
-            "src": "https:\/\/cdn.jsdelivr.net\/dokku\/dokku@v0.38.8\/docs\/assets\/favicons\/android-chrome-72x72.png",
+            "src": "https:\/\/cdn.jsdelivr.net\/dokku\/dokku@v0.38.27\/docs\/assets\/favicons\/android-chrome-72x72.png",
            "sizes": "72x72",
            "type": "image\/png",
            "density": "1.5"
        },
        {
-            "src": "https:\/\/cdn.jsdelivr.net\/dokku\/dokku@v0.38.8\/docs\/assets\/favicons\/android-chrome-96x96.png",
+            "src": "https:\/\/cdn.jsdelivr.net\/dokku\/dokku@v0.38.27\/docs\/assets\/favicons\/android-chrome-96x96.png",
            "sizes": "96x96",
            "type": "image\/png",
            "density": "2.0"
        },
        {
-            "src": "https:\/\/cdn.jsdelivr.net\/dokku\/dokku@v0.38.8\/docs\/assets\/favicons\/android-chrome-144x144.png",
+            "src": "https:\/\/cdn.jsdelivr.net\/dokku\/dokku@v0.38.27\/docs\/assets\/favicons\/android-chrome-144x144.png",
            "sizes": "144x144",
            "type": "image\/png",
            "density": "3.0"
        },
        {
-            "src": "https:\/\/cdn.jsdelivr.net\/dokku\/dokku@v0.38.8\/docs\/assets\/favicons\/android-chrome-192x192.png",
+            "src": "https:\/\/cdn.jsdelivr.net\/dokku\/dokku@v0.38.27\/docs\/assets\/favicons\/android-chrome-192x192.png",
            "sizes": "192x192",
            "type": "image\/png",
            "density": "4.0"
--- a/docs/assets/style.css
+++ b/docs/assets/style.css
@@ -25,9 +25,9 @@

  /* Avatar section darkmode fade */
  --avatar-before-gradient: rgba(0, 0, 0, 0) linear-gradient(90deg, white 2.52%, rgba(255, 255, 255, 0) 100%) repeat scroll 0% 0%;
-  --avatar-darkmode-before-gradient: rgba(0, 0, 0, 0) linear-gradient(90deg, #0.38.8 2.52%, rgba(255, 255, 255, 0) 100%) repeat scroll 0% 0%;
+  --avatar-darkmode-before-gradient: rgba(0, 0, 0, 0) linear-gradient(90deg, #0.38.27 2.52%, rgba(255, 255, 255, 0) 100%) repeat scroll 0% 0%;
  --avatar-after-gradient: rgba(0, 0, 0, 0) linear-gradient(270deg, white 2.52%, rgba(255, 255, 255, 0) 100%) repeat scroll 0% 0%;
-  --avatar-darkmode-after-gradient: rgba(0, 0, 0, 0) linear-gradient(270deg, #0.38.8 2.52%, rgba(255, 255, 255, 0) 100%) repeat scroll 0% 0%;
+  --avatar-darkmode-after-gradient: rgba(0, 0, 0, 0) linear-gradient(270deg, #0.38.27 2.52%, rgba(255, 255, 255, 0) 100%) repeat scroll 0% 0%;
 }

 body {
@@ -1191,15 +1191,15 @@ ul.fas li .fa-large:before {

  .getting-started::after {
    background: linear-gradient(0deg, rgba(52, 52, 87, 0.2) -40.97%, rgba(0, 0, 0, 0) 103.19%),
-      #0.38.8;
+      #0.38.27;
  }

  .tab-content {
-    background: #0.38.8;
+    background: #0.38.27;
  }

  .nav-tabs {
-    background: #0.38.8;
+    background: #0.38.27;
  }

  .powered-by_brands {
--- a/docs/assets/versions.json
+++ b/docs/assets/versions.json
@@ -35,6 +35,6 @@
    "0.35.20",
    "0.36.11",
    "0.37.10",
-    "0.38.8"
+    "0.38.27"
  ]
 }
--- a/docs/configuration/environment-variables.md
+++ b/docs/configuration/environment-variables.md
@@ -151,4 +151,4 @@ The following property is recorded internally by the config plugin and is not ex

 | Property | Description | Source |
 |---|---|---|
-| `env-migrated` | Migration sentinel that records the per-app or global `DOKKU_*` env-var → property migration completed for 0.38.0 | `plugins/config/triggers.go` writes `"true"` after the upgrade-time pass |
+| `env-migrated` | Migration sentinel that records that the per-app or global `ENV` file has been drained out of its pre-0.38.0 location into the config path. The drain happens once: a file found at the old path once this is recorded is never imported, since the config path holds every change made since. Such a file is removed when it agrees with the current config, and otherwise moved aside to `ENV.migrated` with the keys it disagrees on named in a warning. The preserved copy is left for review and should be deleted afterwards, since it holds keys that were unset on purpose | `plugins/config/migrate.go` writes `"true"` once the file has been drained |
--- a/docs/deployment/application-management.md
+++ b/docs/deployment/application-management.md
@@ -8,7 +8,7 @@ apps:clone <old-app> <new-app>                 # Clones an app
 apps:create <app>                              # Create a new app
 apps:destroy <app>                             # Permanently destroy an app
 apps:exists <app>                              # Checks if an app exists
-apps:list                                      # List your apps
+apps:list [--format stdout|json]               # List your apps
 apps:lock <app>                                # Locks an app for deployment
 apps:locked <app>                              # Checks if an app is locked for deployment
 apps:rename <old-app> <new-app>                # Rename an app
@@ -47,6 +47,18 @@ node-js-app
 python-app
 ```

+You can also retrieve the list of apps as a JSON array by using the `--format json` flag, which is useful for programmatic consumption:
+
+```shell
+dokku apps:list --format json
+```
+
+```json
+["node-js-app","python-app"]
+```
+
+When no apps exist, the JSON output is an empty array (`[]`).
+
 ### Checking if an application exists

 For CI/CD pipelines, it may be useful to see if an application exists before creating a "review" application for a specific branch. You can do so via the `apps:exists` command:
@@ -315,6 +327,15 @@ dokku apps:report node-js-app --app-dir

 ## Properties

+### Settable properties
+
+> [!NOTE]
+> The `Report flags` column lists the CLI argument names accepted by `apps:report`. The JSON keys emitted by `apps:report --format json` are the same names with the leading `--app-` stripped (e.g. `global-disable-autocreation`). Legacy keys with the `app-` prefix (e.g. `app-global-disable-autocreation`) are also emitted during the 0.38.x deprecation window and will be removed in a future major release.
+
+| Property | Scope | Default | Report flags | Description |
+|---|---|---|---|---|
+| `disable-autocreation` | global only | `false` | `--app-global-disable-autocreation` | When `true`, pushes to a remote for an app that does not yet exist are rejected instead of auto-creating the app |
+
 ### Read-only flags

 The following flags surface in `apps:report` but are not managed by `apps:set`:
--- a/docs/deployment/builders/buildpack-management.md
+++ b/docs/deployment/builders/buildpack-management.md
@@ -10,6 +10,7 @@ buildpacks:list <app>                                   # List all buildpacks fo
 buildpacks:remove <app> <buildpack>                     # Remove a buildpack set on the app
 buildpacks:report [<app>] [<flag>]                      # Displays a buildpack report for one or more apps
 buildpacks:set [--index 1] <app> <buildpack>            # Set new app buildpack at a given position defaulting to the first buildpack if no index is specified
+buildpacks:set --replace <app> <buildpack> [<buildpack> ...] # Replace the entire ordered buildpack list with the specified buildpacks
 ```

 ## Usage
@@ -86,6 +87,25 @@ If the index specified is larger than the number of buildpacks currently configu
 dokku buildpacks:set --index 99 node-js-app https://github.com/heroku/heroku-buildpack-ruby.git
 ```

+### Replacing the entire buildpack list
+
+To replace the complete ordered buildpack list in a single command, use the `--replace` flag. This is useful for tooling that needs to apply a full buildpack list atomically instead of running `buildpacks:clear` followed by multiple `buildpacks:add` calls.
+
+```shell
+dokku buildpacks:set --replace node-js-app https://github.com/heroku/heroku-buildpack-ruby.git https://github.com/heroku/heroku-buildpack-nodejs.git
+```
+
+The buildpacks are executed in the order they are specified, and the previous list is discarded. If any specified buildpack is invalid, the existing list is left unchanged.
+
+A single buildpack may also be specified to replace the entire list with just that buildpack:
+
+```shell
+dokku buildpacks:set --replace node-js-app https://github.com/heroku/heroku-buildpack-ruby.git
+```
+
+> [!NOTE]
+> The `--replace` flag cannot be combined with the `--index` flag. To remove all buildpacks, use the `buildpacks:clear` command instead of `--replace` with no buildpacks.
+
 ### Removing a buildpack

 > At least one of a buildpack or index must be specified
--- a/docs/deployment/builders/herokuish-buildpacks.md
+++ b/docs/deployment/builders/herokuish-buildpacks.md
@@ -185,32 +185,32 @@ See the [Procfile documentation](/docs/processes/process-management.md#procfile)

 ### Listing Buildpacks in Use

-See the [buildpack management documentation](/docs/processes/process-management.md#listing-buildpacks-in-use) for more information on how to list buildpacks in use.
+See the [buildpack management documentation](/docs/deployment/builders/buildpack-management.md#listing-buildpacks-in-use) for more information on how to list buildpacks in use.

 ### Adding custom buildpacks

-See the [buildpack management documentation](/docs/processes/process-management.md#adding-custom-buildpacks) for more information on how to add custom buildpacks.
+See the [buildpack management documentation](/docs/deployment/builders/buildpack-management.md#adding-custom-buildpacks) for more information on how to add custom buildpacks.

 ### Overwriting a buildpack position

-See the [buildpack management documentation](/docs/processes/process-management.md#overwriting-a-buildpack-position) for more information on how to overwrite a buildpack position.
+See the [buildpack management documentation](/docs/deployment/builders/buildpack-management.md#overwriting-a-buildpack-position) for more information on how to overwrite a buildpack position.

 ### Removing a buildpack

-See the [buildpack management documentation](/docs/processes/process-management.md#removing-a-buildpack) for more information on how to remove a buildpack.
+See the [buildpack management documentation](/docs/deployment/builders/buildpack-management.md#removing-a-buildpack) for more information on how to remove a buildpack.

 ### Clearing all buildpacks

-See the [buildpack management documentation](/docs/processes/process-management.md#clearing-all-buildpacks) for more information on how to clear all buildpacks.
+See the [buildpack management documentation](/docs/deployment/builders/buildpack-management.md#clearing-all-buildpacks) for more information on how to clear all buildpacks.

 ### Using a specific buildpack version

-See the [buildpack management documentation](/docs/processes/process-management.md#using-a-specific-buildpack-version) for more information on how to using a specific buildpack version
+See the [buildpack management documentation](/docs/deployment/builders/buildpack-management.md#using-a-specific-buildpack-version) for more information on how to using a specific buildpack version


 ### Displaying buildpack reports for an app

-See the [buildpack management documentation](/docs/processes/process-management.md#displaying-buildpack-reports-for-an-app) for more information on how to display buildpack reports for an app.
+See the [buildpack management documentation](/docs/deployment/builders/buildpack-management.md#displaying-buildpack-reports-for-an-app) for more information on how to display buildpack reports for an app.

 ## Properties

--- a/docs/deployment/logs.md
+++ b/docs/deployment/logs.md
@@ -124,6 +124,21 @@ The `/etc/vector` mount includes the `vector.json` configuration file, but also

 The final volume mount - `/var/log/dokku/apps` - may be used for users that wish to ship logs to a file on disk that may be later logrotated. This directory is owned by the `dokku` user and group, with permissions set to `0755`. At this time, log-rotation is not configured for this directory.

+Operators using a `file` sink are encouraged to configure rotation themselves, as Dokku will not truncate these files. A minimal `/etc/logrotate.d/dokku-app-logs` might look like:
+
+```
+/var/log/dokku/apps/*/*.log {
+  daily
+  rotate 14
+  compress
+  missingok
+  notifempty
+  copytruncate
+}
+```
+
+`copytruncate` is used because Vector holds the file open between writes.
+
 #### Stopping the Vector container

 Vector may be stopped via the `logs:vector-stop` command.
@@ -241,6 +256,8 @@ As with app-specific sink settings, the global value may also be cleared by sett
 dokku logs:set --global vector-sink
 ```

+The generated vector configuration is also rewritten whenever an app is renamed, cloned or destroyed. A renamed app keeps shipping to its sink under the new name, a cloned app gets a source of its own for the sink it inherited, and a destroyed app's source and sink are removed rather than left pointing at an endpoint that was decommissioned with the app.
+
 ##### Log Sink DSN Format

 The DSN form of a sink is as follows:
@@ -282,28 +299,85 @@ This will transform the value to it's encoded form when configuring Vector sinks

 Please read the [sink documentation](https://vector.dev/docs/reference/configuration/sinks/) for your sink of choice to configure the sink as desired.

-##### Configuring the app label
+#### Configuring a cron task log sink

-Logs shipped by vector include the label `com.dokku.app-name`, which is an alias for the app name. This can be changed via the `app-label-alias` logs property with the `logs:set` command. Specifying a new alias will reload any running vector container.
+Scheduled cron tasks run in one-off containers that carry the app's usual labels, so their output is already collected by the `vector-sink` configured for the app or globally. To send that output somewhere separate, set a `vector-cron-sink`.

 ```shell
-# setting the sink value in quotes is encouraged to avoid
-# issues with ampersand encoding in shell commands
-dokku logs:set node-js-app app-label-alias "app-name"
+dokku logs:set node-js-app vector-cron-sink "console://?encoding[codec]=text"
 ```

+As with `vector-sink`, the value may be cleared by setting an empty value, and may also be set globally:
+
+```shell
+dokku logs:set --global vector-cron-sink "console://?encoding[codec]=text"
+```
+
+Setting a cron sink **moves** cron task output rather than copying it. Vector routes each log line to exactly one of the two sinks:
+
+| Configuration | Where cron output goes | Where all other output goes |
+|---|---|---|
+| `vector-sink` only | `vector-sink` | `vector-sink` |
+| `vector-cron-sink` only | `vector-cron-sink` | nowhere |
+| both | `vector-cron-sink` | `vector-sink` |
+
+If an app is already shipping to a metered service via `vector-sink`, adding a cron sink will stop cron output from arriving there.
+
+Events on the cron branch have two extra fields added to them, so that they can be used in sink options that support templating:
+
+- `dokku_app`: the name of the app the task belongs to
+- `dokku_cron_id`: the cron task ID, as shown by `dokku cron:list`
+
+> [!WARNING]
+> Cron task containers are removed as soon as the task exits. Vector attaches to a container after it starts, so output from tasks that finish almost immediately - a bare `echo`, for instance - may be missed. Log shipping should not be relied on as the sole record that a task ran; use an external check for that.
+
+##### Writing cron output to a file on disk
+
+The `file` sink writes to a path within the vector container. The `/var/log/dokku/apps` directory is mounted into that container from the host at the same path, so it is the correct destination for output that should survive on the host.
+
+```shell
+dokku logs:set node-js-app vector-cron-sink "file://?path=/var/log/dokku/apps/node-js-app/cron.log&encoding[codec]=text"
+```
+
+Because `path` supports templating, `dokku_cron_id` can be used to give each task its own file:
+
+```shell
+dokku logs:set node-js-app vector-cron-sink "file://?path=/var/log/dokku/apps/node-js-app/cron-{{ dokku_cron_id }}.log&encoding[codec]=text"
+```
+
+Quoting the value is required, both for the `&` separators and for the spaces inside the template.
+
+> [!WARNING]
+> Vector drops any event whose templated `path` references a field it cannot resolve. Only `dokku_app` and `dokku_cron_id` are guaranteed to exist on cron events - referencing anything else risks silently discarding log lines.
+
+Vector creates missing parent directories, and buffers writes before flushing. Set `idle_timeout_secs` to shorten that delay for infrequent tasks:
+
+```shell
+dokku logs:set node-js-app vector-cron-sink "file://?path=/var/log/dokku/apps/node-js-app/cron.log&encoding[codec]=text&idle_timeout_secs=5"
+```
+
+##### Configuring the app label
+
+Dokku labels every app container with `com.dokku.app-name`, and events shipped by vector carry that label as the field `label."com.dokku.app-name"`. Some sinks cannot use a field named that way - Loki label names, for instance, may only contain letters, digits and underscores - so the field can be renamed on the way to the sink via the `app-label-alias` logs property. Specifying a new alias will reload any running vector container.
+
+```shell
+dokku logs:set node-js-app app-label-alias "app_name"
+```
+
+Events for `node-js-app` then carry `label.app_name` and no longer carry `label."com.dokku.app-name"`.
+
 An alias may be removed by setting an empty value, which will also reload the running vector container.

 ```shell
 dokku logs:set node-js-app app-label-alias
 ```

-Only one alias may be specified on a per-app basis at a given time.
+Only one alias may be specified on a per-app basis at a given time. Valid values start with a letter or number and may otherwise contain letters, numbers, underscores, periods and hyphens.

 App label aliases can also be specified globally by specifying the `--global` flag to `logs:set` with no app name specified:

 ```shell
-dokku logs:set --global app-label-alias "app-name"
+dokku logs:set --global app-label-alias "app_name"
 ```

 As with app-specific label alias settings, the global value may also be cleared by setting no value.
@@ -312,6 +386,10 @@ As with app-specific label alias settings, the global value may also be cleared
 dokku logs:set --global app-label-alias
 ```

+An app-specific value takes precedence over the global one, and is applied to that app's events whether they are shipped by the app's own `vector-sink` or by the global one.
+
+The alias only changes the shipped event. Containers are always discovered by the `com.dokku.app-name` label, so changing this property never affects which logs are collected, and a change takes effect on the next vector reload without redeploying the app. Cron events are unaffected in another respect too: `dokku_app` is read from the container label before the rename, so it holds the app name regardless of the configured alias.
+
 ## Properties

 ### Settable properties
@@ -321,8 +399,9 @@ dokku logs:set --global app-label-alias

 | Property | Scope | Default | Report flags | Description |
 |---|---|---|---|---|
-| `app-label-alias` | app + global | `com.dokku.app-name` | `--logs-app-label-alias`, `--logs-global-app-label-alias`, `--logs-computed-app-label-alias` | Docker label key whose value is used to identify the app when shipping logs |
+| `app-label-alias` | app + global | `com.dokku.app-name` | `--logs-app-label-alias`, `--logs-global-app-label-alias`, `--logs-computed-app-label-alias` | Field name the app name is shipped under, renamed from `com.dokku.app-name` on the event |
 | `max-size` | app + global | `10m` | `--logs-max-size`, `--logs-global-max-size`, `--logs-computed-max-size` | Maximum size of an individual log file before rotation |
 | `vector-image` | global only | _parsed from `plugins/logs/Dockerfile`_ | `--logs-global-vector-image`, `--logs-computed-vector-image` | Docker image used to run the vector log-shipper container |
 | `vector-networks` | global only | none | `--logs-global-vector-networks`, `--logs-computed-vector-networks` | Comma-separated list of docker networks the vector container is attached to |
+| `vector-cron-sink` | app + global | none | `--logs-vector-cron-sink`, `--logs-global-vector-cron-sink`, `--logs-computed-vector-cron-sink` | DSN-style sink configuration for scheduled cron task output; when set, cron output is routed here instead of to `vector-sink` |
 | `vector-sink` | app + global | none | `--logs-vector-sink`, `--logs-global-vector-sink`, `--logs-computed-vector-sink` | DSN-style sink configuration for vector (e.g. `console://` or `loki://...`) |
--- a/docs/deployment/schedulers/k3s.md
+++ b/docs/deployment/schedulers/k3s.md
@@ -4,22 +4,29 @@
 > New as of 0.33.0

 ```
-scheduler-k3s:annotations:set <app|--global> <property> (<value>) [--process-type PROCESS_TYPE] <--resource-type RESOURCE_TYPE>, Set or clear an annotation for a given app/process-type/resource-type combination
-scheduler-k3s:autoscaling-auth:set <app|--global> <trigger> [<--metadata key=value>...], Set or clear a scheduler-k3s autoscaling keda trigger authentication resource for an app
-scheduler-k3s:autoscaling-auth:report <app|--global> [--format stdout|json] [--include-metadata] # Displays a scheduler-k3s autoscaling auth report for an app
-scheduler-k3s:cluster:add [ssh://user@host:port]    # Adds a server node to a Dokku-managed cluster
-scheduler-k3s:cluster:list                          # Lists all nodes in a Dokku-managed cluster
-scheduler-k3s:cluster:remove [node-id]              # Removes client node to a Dokku-managed cluster
-scheduler-k3s:ensure-charts                         # Ensures the k3s charts are installed
-scheduler-k3s:initialize                            # Initializes a cluster
+scheduler-k3s:annotations:set <app|--global> <property> (<value>) [--process-type PROCESS_TYPE] <--resource-type RESOURCE_TYPE> # Set or clear an annotation for a given app/process-type/resource-type combination
+scheduler-k3s:annotations:report [<app>|--global] [--format stdout|json] [--process-type PROCESS_TYPE] [--resource-type RESOURCE_TYPE] # Displays a scheduler-k3s annotations report for one or more apps
+scheduler-k3s:autoscaling-auth:set <app|--global> <trigger> [<--metadata key=value>...] # Set or clear a scheduler-k3s autoscaling keda trigger authentication resource for an app
+scheduler-k3s:autoscaling-auth:report [<app>|--global] [--format stdout|json] [--include-metadata] # Displays a scheduler-k3s autoscaling auth report for one or more apps
+scheduler-k3s:charts:report [<chart>] [--format stdout|json] # Displays a scheduler-k3s chart override report
+scheduler-k3s:charts:set <chart-name.property> (<value>) # Set or clear a chart-specific helm value
+scheduler-k3s:cluster:add [--profile PROFILE] [--role ROLE] [--insecure-allow-unknown-hosts] [--server-ip SERVER_IP] [--taint-scheduling] [--kubelet-args KUBELET_ARGS] <ssh://user@host:port> # Adds a server node to a Dokku-managed cluster
+scheduler-k3s:cluster:list [--format json|stdout] # Lists all nodes in a Dokku-managed cluster
+scheduler-k3s:cluster:remove [node-id] # Removes client node to a Dokku-managed cluster
+scheduler-k3s:ensure-charts # Ensures the k3s charts are installed
+scheduler-k3s:initialize [--server-ip SERVER_IP] [--taint-scheduling] [--kubelet-args KUBELET_ARGS] # Initializes a cluster
 scheduler-k3s:labels:set <app|--global> <property> (<value>) [--process-type PROCESS_TYPE] <--resource-type RESOURCE_TYPE> # Set or clear a label for a given app/process-type/resource-type combination
-scheduler-k3s:profiles:add <profile> [--role ROLE] [--insecure-allow-unknown-hosts] [--taint-scheduling] [--kubelet-args KUBELET_ARGS] Adds a node profile to the k3s cluster
-scheduler-k3s:profiles:list [--format json|stdout]  # Lists all node profiles in the k3s cluster
-scheduler-k3s:profiles:remove <profile>             # Removes a node profile from the k3s cluster
-scheduler-k3s:report [<app>] [<flag>]               # Displays a scheduler-k3s report for one or more apps
-scheduler-k3s:set [<app>|--global] <key> (<value>)  # Set or clear a scheduler-k3s property for an app or the scheduler
-scheduler-k3s:show-kubeconfig                       # Displays the kubeconfig for remote usage
-scheduler-k3s:uninstall                             # Uninstalls k3s from the Dokku server
+scheduler-k3s:labels:report [<app>|--global] [--format stdout|json] [--process-type PROCESS_TYPE] [--resource-type RESOURCE_TYPE] # Displays a scheduler-k3s labels report for one or more apps
+scheduler-k3s:node-sysctls:set <sysctl> (<value>) [--global|--profile PROFILE] # Set or clear a node-level kernel sysctl for unprofiled nodes or a single node profile
+scheduler-k3s:node-sysctls:report [--format stdout|json] # Displays the node-level kernel sysctls applied to each scope
+scheduler-k3s:preview <app> [--context N] [--show-secrets] [--show-secrets-decoded] # Displays a diff between the current and next deployment for an app
+scheduler-k3s:profiles:add <profile> [--role ROLE] [--insecure-allow-unknown-hosts] [--taint-scheduling] [--kubelet-args KUBELET_ARGS] # Adds a node profile to the k3s cluster
+scheduler-k3s:profiles:list [--format json|stdout] # Lists all node profiles in the k3s cluster
+scheduler-k3s:profiles:remove <profile> # Removes a node profile from the k3s cluster
+scheduler-k3s:report [<app>|--global] [--format stdout|json] [<flag>] # Displays a scheduler-k3s report for one or more apps
+scheduler-k3s:set <app|--global> <property> (<value>) # Set or clear a scheduler-k3s property for an app or globally
+scheduler-k3s:show-kubeconfig # Displays the kubeconfig for remote usage
+scheduler-k3s:uninstall # Uninstalls k3s from the Dokku server
 ```

 > [!NOTE]
@@ -73,6 +80,20 @@ Dokku can also use Traefik on cluster initialization via the [Traefik's CRDs](ht
 dokku scheduler-k3s:initialize --ingress-class traefik
 ```

+Kubelet flags for the initial server node can be supplied by passing `--kubelet-args` with a comma-separated `key=value` list. This is the only way to configure the kubelet on the node created by `scheduler-k3s:initialize`, as that node never passes through `scheduler-k3s:cluster:add`.
+
+```shell
+dokku scheduler-k3s:initialize \
+  --kubelet-args allowed-unsafe-sysctls=net.ipv6.conf.all.disable_ipv6
+```
+
+Multiple kubelet arguments can be specified in the same call by separating them with commas.
+
+```shell
+dokku scheduler-k3s:initialize \
+  --kubelet-args allowed-unsafe-sysctls=net.ipv6.conf.all.disable_ipv6,max-pods=150
+```
+
 ### Adding nodes to the cluster

 > [!WARNING]
@@ -195,6 +216,21 @@ dokku scheduler-k3s:profiles:remove edge-workers

 Removal only deletes the stored definition; nodes that already joined the cluster keep their existing configuration.

+#### The node profile label
+
+When a node joins via `scheduler-k3s:cluster:add --profile <name>`, Dokku labels it with `dokku.com/node-profile=<name>`. This makes a profile selectable after the fact, whether via `kubectl`, a `nodeSelector`, or a node affinity rule.
+
+```shell
+kubectl get nodes -L dokku.com/node-profile
+```
+
+Nodes added without `--profile` are not labeled, as an empty label value would be indistinguishable from a profile literally named the empty string.
+
+Two limits are worth knowing before relying on this label:
+
+- The server node never carries it. That node is created by `scheduler-k3s:initialize` and never passes through `scheduler-k3s:cluster:add`, so no profile is ever associated with it.
+- Nodes that joined before this label existed are not backfilled. Use `kubectl label node <node> dokku.com/node-profile=<name>` to set it on an existing node.
+
 ### Changing deployment settings

 The k3s plugin provides a number of settings that can be used to managed deployments on a per-app basis. The following table outlines ones not covered elsewhere:
@@ -232,6 +268,74 @@ The global default value may be set by passing an empty value for the option.
 dokku scheduler-k3s:set --global deploy-timeout
 ```

+### Restarting apps
+
+A `ps:restart` re-renders the app's Helm chart from its current configuration and upgrades the release, which is how configuration changes are picked up. Pods cycle because each Deployment's pod template carries an `app.kubernetes.io/version` annotation that changes on restart.
+
+A single process type may be targeted, in which case only that process type's pods are replaced. The rest of the release is still upgraded so configuration converges everywhere, but the untargeted Deployments keep their existing annotation and are left running:
+
+```shell
+dokku ps:restart node-js-app web
+```
+
+The app image does not need to be present on the Dokku host. Kubernetes pulls it from the registry, so a host that has reaped its local copy - as the `registry` plugin does on its own once an app has been deployed a number of times - can still restart, scale, and run one-off commands against the app. The builder type and working directory needed to render the chart are read back from the app's current Helm release when the image is unavailable locally.
+
+There is one exception. An `app.json` with a `scripts.dokku.postdeploy` task runs that task in a container on the Dokku host rather than in the cluster, and so does require the image locally. Apps without a postdeploy task are unaffected.
+
+### Displaying the scheduler report
+
+Configured properties can be inspected with the `scheduler-k3s:report` command. Without arguments, it iterates every app. Passing an app name scopes the report to that app, while `--global` reports the scheduler-wide properties on their own:
+
+```shell
+dokku scheduler-k3s:report
+dokku scheduler-k3s:report node-js-app
+dokku scheduler-k3s:report --global
+```
+
+The output can be emitted as JSON for programmatic consumption:
+
+```shell
+dokku scheduler-k3s:report --global --format json
+```
+
+A single value can also be read directly by passing its report flag, as listed in the [settable properties](#settable-properties) table:
+
+```shell
+dokku scheduler-k3s:report node-js-app --scheduler-k3s-computed-deploy-timeout
+```
+
+### Previewing deployment changes
+
+Before triggering a deploy, the `scheduler-k3s:preview` command can be used to display a unified diff between the manifests currently stored in the live Helm release for an app and the manifests that the next deploy would roll out:
+
+```shell
+dokku scheduler-k3s:preview node-js-app
+```
+
+A clean redeploy with no property changes produces no output. After modifying a property that affects the main app chart (for example `dokku resource:limit --memory 256m node-js-app`), the command shows the unified diff for each changed resource. For an app that has never been deployed, the entire proposed manifest is rendered as added lines.
+
+By default each change is shown with 3 lines of surrounding context, git-diff style. The `--context` flag overrides this; pass `-1` to render the full resource around every change:
+
+```shell
+dokku scheduler-k3s:preview node-js-app --context 0
+dokku scheduler-k3s:preview node-js-app --context -1
+```
+
+By default any `kind: Secret` resources have their `data` values redacted so secret bytes never appear in terminal scrollback or CI logs. Two flags adjust this behavior:
+
+```shell
+dokku scheduler-k3s:preview node-js-app --show-secrets
+dokku scheduler-k3s:preview node-js-app --show-secrets-decoded
+```
+
+`--show-secrets` keeps the raw base64-encoded values, and `--show-secrets-decoded` renders them base64-decoded. In current dokku, the only Secret objects in the main app chart come from KEDA autoscaling auth resources configured via [`scheduler-k3s:autoscaling-auth:set`](#workload-autoscaling-authentication); for apps without autoscaling auth, these flags are no-ops.
+
+> [!IMPORTANT]
+> The preview only covers the main app helm release (the release named after the app). Dokku installs three auxiliary helm releases per app for config-var storage, image-pull credentials, and TLS certificates, and changes to those releases do **not** appear in this preview. In particular, a `dokku config:set` change followed by `scheduler-k3s:preview` will show no diff because the new config-var value lives in the separate `config-<app>` helm release.
+
+> [!NOTE]
+> Helm renders the proposed manifest using a client-side dry-run. The `lookup` template function returns empty values in this mode, so charts overridden via `scheduler-k3s:charts:set` that depend on `lookup` may render differently here than at actual deploy time. Dokku's bundled chart templates do not use `lookup`.
+
 ### Exposing services on the network

 Dokku will automatically expose the `web` process as a Kubernetes Service, with all others being treated as background processes. In some cases, it may be useful to have other processes exposed as Kubernetes Service objects so as to segregate internal http endpoints from public http endpoints. This can be done by modifying the `app.json` Formation entry for your process type.
@@ -253,6 +357,20 @@ In the above example, the `internal-web` process is exposed as a service. The `P
 > [!NOTE]
 > It is not possible to modify the port mapping, nor is it possible to assign domains or SSL to a non-web process.

+### Wildcard domains
+
+Both the `nginx` and `traefik` ingress classes route wildcard domains. Add the wildcard as a domain on the app:
+
+```shell
+dokku domains:add node-js-app '*.node-js-app.com'
+```
+
+A wildcard matches exactly one label, matching DNS itself, so `*.node-js-app.com` covers `api.node-js-app.com` but not `node-js-app.com` or `api.staging.node-js-app.com`. Add the apex as a separate domain if it should also be served.
+
+An exact domain always takes precedence over a wildcard, including across apps. If one app serves `*.node-js-app.com` and another serves `api.node-js-app.com`, requests for `api.node-js-app.com` are routed to the second app.
+
+Only the leading label may be wildcarded. A domain such as `api.*.node-js-app.com` is treated as a literal hostname and will not match anything.
+
 ### SSL Certificates

 #### Enabling letsencrypt integration
@@ -269,6 +387,30 @@ dokku scheduler-k3s:set --global letsencrypt-email-stag automated@dokku.sh

 After enabling and rebuilding, all apps with an `http:80` port mapping will have a corresponding `https:443` added and ssl will be automatically enabled. All http requests will then be redirected to https.

+#### Customizing the letsencrypt email per app
+
+The `letsencrypt-email-prod` and `letsencrypt-email-stag` properties can also be set per app, overriding the global value for that app. This is useful when different apps should register their certificates under different contact emails.
+
+```shell
+dokku scheduler-k3s:set node-js-app letsencrypt-email-prod team@node-js-app.com
+```
+
+The value resolves in two steps: the app's `letsencrypt-server` selects which server (`prod` or `staging`) is used, and the matching `letsencrypt-email-<server>` property is then resolved as the app-level value, falling back to the global value. Because the two emails are per-server, an app-level `letsencrypt-email-stag` only takes effect once the app's `letsencrypt-server` is set to `staging`.
+
+When an app sets its own email for the selected server, Dokku renders a namespaced cert-manager `Issuer` into the app's own release using that email instead of pointing the app at the shared global `ClusterIssuer`. Apps without an app-level email continue to use the shared `ClusterIssuer` with the global email.
+
+The default value may be set by passing an empty value for the option, which falls the app back to the global value:
+
+```shell
+dokku scheduler-k3s:set node-js-app letsencrypt-email-prod
+```
+
+The computed value in effect for an app can be inspected via the report command:
+
+```shell
+dokku scheduler-k3s:report node-js-app --scheduler-k3s-computed-letsencrypt-email-prod
+```
+
 #### Customizing the letsencrypt server

 The letsencrypt integration is set to the production letsencrypt server by default. This can be changed on an app-level by setting the `letsencrypt-server` property with the `scheduler-k3s:set` command
@@ -295,7 +437,7 @@ The default value may be set by passing an empty value for the option.
 dokku scheduler-k3s:set --global letsencrypt-server staging
 ```

-Letsencrypt can be completely disabled for a given app by setting the `letsencrypt-server` to `false`
+Automatic certificate issuance can be completely disabled for a given app by setting the `letsencrypt-server` to `false`. This is the single off switch for the app, and also disables a [manually managed issuer](#using-a-manually-managed-cert-manager-issuer).

 ```shell
 dokku scheduler-k3s:set node-js-app letsencrypt-server false
@@ -307,6 +449,72 @@ The server can also be disabled globally, and then conditionally enabled on a pe
 dokku scheduler-k3s:set --global letsencrypt-server false
 ```

+Values are validated when the property is set, so a typo fails immediately rather than breaking the next deploy. The valid values are `prod`, `production`, `stag`, `staging`, and `false`.
+
+#### Using a manually managed cert-manager issuer
+
+Dokku's built-in letsencrypt integration uses an `http01` solver, which cannot issue wildcard certificates and cannot satisfy providers that require `dns01`. For those cases, create a cert-manager `Issuer` or `ClusterIssuer` yourself and point an app at it with the `cert-issuer-name` property.
+
+```shell
+dokku scheduler-k3s:set node-js-app cert-issuer-name acme-dns
+```
+
+Dokku does not create, modify, or delete the issuer - it only references it from the app's generated `Certificate`. Any cert-manager issuer works, including non-ACME ones such as `selfSigned`, `ca`, or `vault`.
+
+The issuer kind defaults to `ClusterIssuer`. To reference a namespaced `Issuer`, set the `cert-issuer-kind` property:
+
+```shell
+dokku scheduler-k3s:set node-js-app cert-issuer-kind Issuer
+```
+
+> [!WARNING]
+> A namespaced `Issuer` must exist in the same namespace as the app, as configured by the `namespace` property. cert-manager cannot reference an `Issuer` across namespaces.
+
+Unlike the letsencrypt integration, no email property is required - setting `cert-issuer-name` is itself what enables https for the app. Certificates are requested for every domain attached to the app.
+
+Both properties can also be set globally, which enables https for every app that has domains, no imported certificate, and no `letsencrypt-server false`:
+
+```shell
+dokku scheduler-k3s:set --global cert-issuer-name acme-dns
+```
+
+Certificate sources are resolved in the following order:
+
+1. A certificate imported via the `certs` plugin.
+2. `letsencrypt-server` set to `false`, which disables issuance entirely.
+3. `cert-issuer-name`, resolved app-first and then globally.
+4. The built-in letsencrypt integration.
+
+Because an empty app-level property falls back to the global value, an app cannot return to the built-in letsencrypt integration by unsetting `cert-issuer-name` while a global value is configured. Set the app's `cert-issuer-name` to the reserved value `false` instead:
+
+```shell
+dokku scheduler-k3s:set node-js-app cert-issuer-name false
+```
+
+As a consequence, an issuer literally named `false` cannot be referenced.
+
+The default value may be set by passing an empty value for the option, which falls the app back to the global value:
+
+```shell
+dokku scheduler-k3s:set node-js-app cert-issuer-name
+```
+
+If the named issuer does not exist in the cluster, Dokku emits a warning before the build starts. The warning never blocks a deploy, since the issuer may be managed independently and applied later. When a certificate fails to issue, inspect it directly:
+
+```shell
+kubectl describe certificate node-js-app-web -n default
+```
+
+##### Wildcard certificates
+
+A `dns01` issuer can issue wildcard certificates. Add the wildcard as a domain on the app, and it will be included in the generated `Certificate`:
+
+```shell
+dokku domains:add node-js-app '*.node-js-app.com'
+```
+
+See [wildcard domains](#wildcard-domains) for how a wildcard is matched against incoming requests.
+
 #### Using imported SSL certificates

 SSL certificates imported via the `certs` plugin can be used with the k3s scheduler. When a certificate is imported, it is automatically synced to Kubernetes as a TLS secret and will be used for the app's ingress configuration.
@@ -321,9 +529,9 @@ When a certificate is imported:

 - A Kubernetes TLS secret named `tls-<app-name>` is created in the app's namespace
 - The ingress configuration is updated to use the imported certificate
- Automatic Let's Encrypt certificate generation is disabled for the app
+- Automatic certificate generation is disabled for the app

-Imported certificates take precedence over Let's Encrypt certificates. If you have both an imported certificate and Let's Encrypt configured, the imported certificate will be used.
+Imported certificates take precedence over both Let's Encrypt and a [manually managed issuer](#using-a-manually-managed-cert-manager-issuer). If you have an imported certificate alongside either of those, the imported certificate will be used.

 To remove an imported certificate:

@@ -372,6 +580,8 @@ The following resource types are supported:
 - `traefik_ingressroute`
 - `traefik_middleware`

+Annotation keys may contain `/` (e.g. Kubernetes-style keys such as `prometheus.io/scrape`) and values may span multiple lines; both are preserved verbatim.
+
 A `ps:restart` is required after setting annotations in order to have them apply to running resources.

 #### Removing an annotation
@@ -385,6 +595,35 @@ dokku scheduler-k3s:annotations:set node-js-app annotation.key --resource-type d

 A `ps:restart` is required after removing annotations in order to remove them from running resources.

+#### Displaying annotations
+
+Configured annotations can be inspected with the `scheduler-k3s:annotations:report` command. Without arguments, it iterates every app and prints all annotations. Passing an app name (or `--global`) scopes the report:
+
+```shell
+dokku scheduler-k3s:annotations:report
+dokku scheduler-k3s:annotations:report node-js-app
+dokku scheduler-k3s:annotations:report --global
+```
+
+`--process-type` and `--resource-type` flags narrow the output to a specific scope, matching the flags accepted by `scheduler-k3s:annotations:set`:
+
+```shell
+dokku scheduler-k3s:annotations:report node-js-app --resource-type deployment
+dokku scheduler-k3s:annotations:report node-js-app --process-type web --resource-type deployment
+```
+
+JSON output emits flat keys of the form `{process_type}.{resource_type}.{annotation_key}`. The literal `--global` process type is rendered as `global` to keep keys free of leading dashes:
+
+```shell
+dokku scheduler-k3s:annotations:report node-js-app --format json
+```
+
+A single value can also be read directly with a flag of the form `--scheduler-k3s-annotations.{process_type}.{resource_type}.{annotation_key}`:
+
+```shell
+dokku scheduler-k3s:annotations:report node-js-app --scheduler-k3s-annotations.global.deployment.annotation.key
+```
+
 #### Setting Labels

 Dokku injects certain labels into each created resource by default, but it may be necessary to inject others for tighter integration with third-party tools. The `scheduler-k3s:labels:set` command can be used to perform this task. The command takes an app name and a required `--resource-type` flag.
@@ -413,6 +652,8 @@ The following resource types are supported:
 - `traefik_ingressroute`
 - `traefik_middleware`

+Label keys may contain `/` (e.g. Kubernetes-style keys such as `app.kubernetes.io/part-of`) and values may span multiple lines; both are preserved verbatim.
+
 A `ps:restart` is required after setting labels in order to have them apply to running resources.

 #### Removing a label
@@ -426,6 +667,20 @@ dokku scheduler-k3s:labels:set node-js-app label.key --resource-type deployment

 A `ps:restart` is required after removing labels in order to remove them from running resources.

+#### Displaying labels
+
+Configured labels can be inspected with the `scheduler-k3s:labels:report` command. The surface mirrors `scheduler-k3s:annotations:report`:
+
+```shell
+dokku scheduler-k3s:labels:report
+dokku scheduler-k3s:labels:report node-js-app
+dokku scheduler-k3s:labels:report --global
+dokku scheduler-k3s:labels:report node-js-app --resource-type deployment
+dokku scheduler-k3s:labels:report node-js-app --process-type web --resource-type deployment
+dokku scheduler-k3s:labels:report node-js-app --format json
+dokku scheduler-k3s:labels:report node-js-app --scheduler-k3s-labels.global.deployment.label.key
+```
+
 ### Autoscaling

 #### Workload Autoscaling
@@ -564,15 +819,17 @@ dokku scheduler-k3s:autoscaling-auth:set $APP $TRIGGER_TYPE

 ##### Displaying an Authentication Resource report

-To see a list of authentication resources managed by Dokku, run the `scheduler-k3s:autoscaling-auth:report` command.
+To see a list of authentication resources managed by Dokku, run the `scheduler-k3s:autoscaling-auth:report` command. Without arguments, the report iterates every app; passing an app name (or `--global`) scopes the report:

 ```shell
+dokku scheduler-k3s:autoscaling-auth:report
 dokku scheduler-k3s:autoscaling-auth:report node-js-app
+dokku scheduler-k3s:autoscaling-auth:report --global
 ```

 ```
-====> $APP autoscaling-auth report
-      datadog: configured
+====> node-js-app autoscaling-auth information
+      Datadog:                       configured
 ```

 By default, the report will not display configured metadata - making it safe to include in Dokku report output. To include metadata and their values, add the `--include-metadata` flag:
@@ -582,13 +839,93 @@ dokku scheduler-k3s:autoscaling-auth:report node-js-app --include-metadata
 ```

 ```
-====> node-js-app autoscaling-auth report
+====> node-js-app autoscaling-auth information
      Datadog:                       configured
      Datadog apiKey:                1234567890
      Datadog appKey:                asdfghjkl
      Datadog datadogSite:           us5.datadoghq.com
 ```

+JSON output emits flat keys of the form `{trigger}.{metadata_key}` and includes the actual metadata values so export tools can reconstruct the configured state:
+
+```shell
+dokku scheduler-k3s:autoscaling-auth:report node-js-app --format json
+```
+
+A single configured metadata key can also be queried with a flag of the form `--scheduler-k3s-autoscaling-auth.{trigger}.{metadata_key}`. The returned value is masked in the same way as stdout output; use `--format json` to read the actual value:
+
+```shell
+dokku scheduler-k3s:autoscaling-auth:report node-js-app --scheduler-k3s-autoscaling-auth.datadog.apiKey
+```
+
+### Setting kernel sysctls
+
+Kernel sysctls fall into two categories, and which one a sysctl belongs to determines how it must be set.
+
+The kernel maintains a per-namespace copy of `net.*` (network namespace) as well as `kernel.shm*`, `kernel.msg*`, `kernel.sem`, and `fs.mqueue.*` (IPC namespace). These can be set on a single app's pods. Every other sysctl - including all of `vm.*`, and therefore `vm.max_map_count` - holds a single value shared by the entire machine, so it cannot be scoped to a pod and must be applied to the node itself.
+
+#### Namespaced sysctls
+
+Namespaced sysctls are set with the `docker-options` plugin, and are translated into the pod's `securityContext.sysctls`. A `ps:restart` is required to apply them.
+
+```shell
+dokku docker-options:add node-js-app deploy "--sysctl net.ipv4.ip_unprivileged_port_start=1024"
+```
+
+Passing a non-namespaced sysctl this way fails the deploy rather than silently dropping the value, since it provably cannot take effect within a pod. Note this differs from the `docker-local` scheduler, where such an option is passed straight through to `docker run`.
+
+Kubernetes further splits namespaced sysctls into a *safe* list that any pod may set, and everything else. A sysctl outside the safe list - `net.core.somaxconn`, for example - is rejected at pod admission unless the node's kubelet was started with a matching `allowed-unsafe-sysctls` value, which can be supplied at cluster initialization or when joining a node.
+
+```shell
+dokku scheduler-k3s:initialize --kubelet-args allowed-unsafe-sysctls=net.core.somaxconn
+```
+
+Dokku does not enforce the safe list itself, as its membership changes between Kubernetes releases. Only the namespaced/non-namespaced distinction, which is a property of the kernel, is validated.
+
+#### Non-namespaced sysctls
+
+Non-namespaced sysctls are a property of the node, not of any app, and are managed with the `node-sysctls:set` command. Dokku applies them via a privileged DaemonSet, so they reach every node without being told which nodes exist, cover nodes joined later, and are reapplied after a node reboots.
+
+```shell
+dokku scheduler-k3s:node-sysctls:set --global vm.max_map_count 262144
+```
+
+Omitting the value clears it.
+
+```shell
+dokku scheduler-k3s:node-sysctls:set --global vm.max_map_count
+```
+
+Clearing a sysctl stops Dokku managing it, but does not restore whatever the node had before. The last value written stays in place until that node reboots, which is how `sysctl -w` behaves everywhere else.
+
+Sysctls can also be scoped to a [node profile](#node-profiles) with `--profile`, which applies them only to nodes joined with that profile.
+
+```shell
+dokku scheduler-k3s:node-sysctls:set --profile edge-workers vm.max_map_count 524288
+```
+
+A profile scope inherits everything set globally and overrides it on conflict, so each node is covered by exactly one DaemonSet and no two ever write the same value. Note that the server node created by `scheduler-k3s:initialize` never carries a profile label, so only globally-scoped sysctls reach it.
+
+Use `node-sysctls:report` to see the resolved set for every scope.
+
+```shell
+dokku scheduler-k3s:node-sysctls:report
+```
+
+```shell
+dokku scheduler-k3s:node-sysctls:report --format json
+```
+
+The DaemonSet pulls `busybox` and `registry.k8s.io/pause` by default. On an air-gapped cluster or one behind a registry mirror, point them elsewhere:
+
+```shell
+dokku scheduler-k3s:set --global node-sysctls-image registry.internal/busybox:1.36
+```
+
+```shell
+dokku scheduler-k3s:set --global node-sysctls-pause-image registry.internal/pause:3.9
+```
+
 ### Integrating Kustomize

 Dokku supports integration with [Kustomize](https://kustomize.io/) to further customize the generated helm charts for app deployments. For example, a `config/kustomize/kustomization.yaml` file with the following contents will override the scale for each process deployed to `3`:
@@ -658,21 +995,34 @@ The default value for the `kube-context` is an empty string, and will result in

 ### Customizing Helm Chart Properties

-Dokku includes a number of helm charts by default with settings that are optimized for Dokku. That said, it may be useful to further customize the charts for a given environment. Users can customize which charts are installed by setting properties prefixed with `chart.$CHART_NAME.` with the `--global` flag.
+Dokku includes a number of helm charts by default with settings that are optimized for Dokku. That said, it may be useful to further customize the charts for a given environment. Chart overrides are managed via the `scheduler-k3s:charts:set` command, which takes a `<chart-name>.<property>` argument and a value. Chart overrides are always global because helm charts are not managed on a per-app basis.

 ```shell
-dokku scheduler-k3s:set --global chart.cert-manager.version 1.13.3
+dokku scheduler-k3s:charts:set cert-manager.version 1.13.3
 ```

 > [!NOTE]
 > Properties follow dot-notation, and are expanded according to Helm's internal logic. See the [Helm documentation](https://helm.sh/docs/helm/helm_install/#helm-install) for `helm install` for further details.

-To unset a chart property, omit the value from the `scheduler-k3s:set` call:
+Property names may contain `/` (e.g. for Kubernetes-style annotation keys such as `service.annotations.prometheus.io/scrape`) and values may span multiple lines; both are preserved verbatim.
+
+To unset a chart property, omit the value from the `scheduler-k3s:charts:set` call:

 ```shell
-dokku scheduler-k3s:set --global chart.cert-manager.version
+dokku scheduler-k3s:charts:set cert-manager.version
 ```

+Configured chart overrides can be inspected with the `scheduler-k3s:charts:report` command. Without an argument, it lists every chart known to Dokku along with any configured overrides; passing a chart name scopes the report to that chart:
+
+```shell
+dokku scheduler-k3s:charts:report
+dokku scheduler-k3s:charts:report cert-manager
+dokku scheduler-k3s:charts:report --format json
+```
+
+> [!NOTE]
+> The legacy form `dokku scheduler-k3s:set --global chart.<chart>.<property> <value>` continues to work but is deprecated and will be removed in a future major release. Migrate to `scheduler-k3s:charts:set` instead.
+
 A `scheduler-k3s:ensure-charts` command with the `--force` flag is required after changing any chart properties in order to have them apply. This will install all charts, not just the ones that have changed.

 ```shell
@@ -702,7 +1052,7 @@ dokku storage:wait demo-data
 git push dokku master
 ```

-For a hostPath-backed PV (no StorageClass), pass `<path>` as the second positional argument and omit `--storage-class-name`. The plugin renders both the PV and the PVC into the entry's helm release. The `--reclaim-policy` flag (`Retain` or `Delete`) controls whether the underlying PV survives `storage:destroy`. Annotations and labels on `storage:create` / `storage:set` propagate to both the PVC and the PV so backup tools (Velero, Longhorn snapshots) can find them.
+For a hostPath-backed PV (no StorageClass), pass `<path>` as the second positional argument and omit `--storage-class-name`. The plugin renders both the PV and the PVC into the entry's helm release. The `--reclaim-policy` flag (`Retain` or `Delete`) controls whether the underlying PV survives `storage:destroy`. Annotations and labels set via `storage:annotations:set` and `storage:labels:set` propagate to both the PVC and the PV so backup tools (Velero, Longhorn snapshots) can find them.

 The legacy `storage:mount <app> <host>:<container>` colon form is rejected on k3s apps; create a named entry instead. See [Persistent Storage](/docs/advanced-usage/persistent-storage.md) for the full command reference.

@@ -730,6 +1080,7 @@ This plugin implements various functionality through `plugn` triggers to integra
        - `--cap-add`
        - `--cap-drop`
        - `--privileged`
+        - `--sysctl` (namespaced sysctls only, see [Setting kernel sysctls](#setting-kernel-sysctls))
 - `cron`
 - `enter`
 - `deploy`
@@ -742,6 +1093,8 @@ This plugin implements various functionality through `plugn` triggers to integra
    - Properties set by the `nginx` plugin will be respected, either by turning them into annotations or creating a custom server/location snippet that the `ingress-nginx` project can use. A `ps:restart` after changing any nginx properties is required in order to have them apply.
    - The `nginx:access-logs` and `nginx:error-logs` commands will fetch logs from one running `ingress-nginx` pod.
    - The `nginx:show-config` command will retrieve any `server` blocks associated with a domain attached to the app from one running `ingress-nginx` pod.
+- `ps:restart`
+    - Supports targeting a single process type, see [Restarting apps](#restarting-apps)
 - `ps:stop`
 - `run`
    - The `scheduler-post-run` trigger is not always triggered
@@ -776,6 +1129,24 @@ dokku scheduler-k3s:ensure-charts --charts vector

 Please see the [vector logs documentation](/docs/deployment/logs.md#configuring-a-log-sink) for more information on specifying vector sinks.

+#### Shipping cron task logs
+
+The global `vector-cron-sink` property is also respected. When set, logs from cron task pods are routed to that sink instead of the sink configured for everything else, matching the behavior described in the [cron task log sink documentation](/docs/deployment/logs.md#configuring-a-cron-task-log-sink).
+
+```shell
+dokku logs:set --global vector-cron-sink "console://?encoding[codec]=text"
+dokku scheduler-k3s:ensure-charts --charts vector
+```
+
+As with `vector-sink`, only the global property is respected - a per-app `vector-cron-sink` has no effect on the `k3s` scheduler.
+
+Cron events carry the same `dokku_app` and `dokku_cron_id` fields as they do on the `docker-local` scheduler, so sink configuration referencing them is portable between the two.
+
+Two differences are worth noting:
+
+- Templated values must be base64 encoded. Sink values containing `{{ }}` are interpreted by Helm at chart install time rather than by Vector, so the `base64enc:` form documented under [log sink DSN format](/docs/deployment/logs.md#log-sink-dsn-format) is required.
+- The `file` sink is not useful here. Vector runs as a DaemonSet agent, so a file path resolves to whichever node the agent is running on rather than to durable shared storage. Use a network sink and reference `dokku_cron_id` as a field instead of as a path component.
+
 ### Supported Resource Management Properties

 The `k3s` scheduler supports a minimal list of resource _limits_ and _reservations_:
@@ -797,18 +1168,22 @@ If unspecified for any task, the default reservation will be `.1` CPU and `128Mi

 | Property | Scope | Default | Report flags | Description |
 |---|---|---|---|---|
+| `cert-issuer-kind` | app + global | `ClusterIssuer` | `--scheduler-k3s-cert-issuer-kind`, `--scheduler-k3s-global-cert-issuer-kind`, `--scheduler-k3s-computed-cert-issuer-kind` | Kind of the manually managed cert-manager issuer referenced by `cert-issuer-name`, either `Issuer` or `ClusterIssuer` |
+| `cert-issuer-name` | app + global | none | `--scheduler-k3s-cert-issuer-name`, `--scheduler-k3s-global-cert-issuer-name`, `--scheduler-k3s-computed-cert-issuer-name` | Name of a manually managed cert-manager issuer to request certificates from, taking precedence over the letsencrypt integration. Set to `false` to opt an app out of a global value |
 | `deploy-timeout` | app + global | `300s` | `--scheduler-k3s-deploy-timeout`, `--scheduler-k3s-global-deploy-timeout`, `--scheduler-k3s-computed-deploy-timeout` | Timeout for a single helm install/upgrade cycle |
 | `image-pull-secrets` | app + global | none | `--scheduler-k3s-image-pull-secrets`, `--scheduler-k3s-global-image-pull-secrets`, `--scheduler-k3s-computed-image-pull-secrets` | Comma-separated list of Kubernetes secret names used to pull private images |
 | `ingress-class` | global only | `nginx` | `--scheduler-k3s-global-ingress-class`, `--scheduler-k3s-computed-ingress-class` | IngressClass name used for app ingresses (e.g. `nginx`, `traefik`) |
 | `kube-context` | global only | none | `--scheduler-k3s-global-kube-context`, `--scheduler-k3s-computed-kube-context` | Kube context name used by helm and kubectl invocations |
 | `kubeconfig-path` | global only | `/etc/rancher/k3s/k3s.yaml` | `--scheduler-k3s-global-kubeconfig-path`, `--scheduler-k3s-computed-kubeconfig-path` | Filesystem path to the kubeconfig used to talk to the cluster |
 | `kustomize-root-path` | app + global | `config/kustomize` | `--scheduler-k3s-kustomize-root-path`, `--scheduler-k3s-global-kustomize-root-path`, `--scheduler-k3s-computed-kustomize-root-path` | Path within the app to a kustomize root applied after the helm install |
-| `letsencrypt-email-prod` | global only | none | `--scheduler-k3s-global-letsencrypt-email-prod`, `--scheduler-k3s-computed-letsencrypt-email-prod` | Contact email for the production cert-manager ClusterIssuer |
-| `letsencrypt-email-stag` | global only | none | `--scheduler-k3s-global-letsencrypt-email-stag`, `--scheduler-k3s-computed-letsencrypt-email-stag` | Contact email for the staging cert-manager ClusterIssuer |
-| `letsencrypt-server` | app + global | `prod` | `--scheduler-k3s-letsencrypt-server`, `--scheduler-k3s-global-letsencrypt-server`, `--scheduler-k3s-computed-letsencrypt-server` | ACME directory (`prod` or `staging`) used for app certificates |
+| `letsencrypt-email-prod` | app + global | none | `--scheduler-k3s-letsencrypt-email-prod`, `--scheduler-k3s-global-letsencrypt-email-prod`, `--scheduler-k3s-computed-letsencrypt-email-prod` | Contact email for production certificates. App-level values render a per-app namespaced Issuer; otherwise the shared production ClusterIssuer is used |
+| `letsencrypt-email-stag` | app + global | none | `--scheduler-k3s-letsencrypt-email-stag`, `--scheduler-k3s-global-letsencrypt-email-stag`, `--scheduler-k3s-computed-letsencrypt-email-stag` | Contact email for staging certificates. App-level values render a per-app namespaced Issuer; otherwise the shared staging ClusterIssuer is used |
+| `letsencrypt-server` | app + global | `prod` | `--scheduler-k3s-letsencrypt-server`, `--scheduler-k3s-global-letsencrypt-server`, `--scheduler-k3s-computed-letsencrypt-server` | ACME directory (`prod` or `staging`) used for app certificates, or `false` to disable all automatic certificate issuance |
 | `namespace` | app + global | `default` | `--scheduler-k3s-namespace`, `--scheduler-k3s-global-namespace`, `--scheduler-k3s-computed-namespace` | Kubernetes namespace into which the app's resources are installed |
 | `network-interface` | global only | `eth0` | `--scheduler-k3s-global-network-interface`, `--scheduler-k3s-computed-network-interface` | Host network interface used by k3s |
+| `node-sysctls-image` | global only | `busybox:1.36` | `--scheduler-k3s-global-node-sysctls-image` | Image used to apply node-level sysctls, override for air-gapped clusters |
+| `node-sysctls-pause-image` | global only | `registry.k8s.io/pause:3.9` | `--scheduler-k3s-global-node-sysctls-pause-image` | Image keeping the node sysctls daemonset pods running |
 | `rollback-on-failure` | app + global | `false` | `--scheduler-k3s-rollback-on-failure`, `--scheduler-k3s-global-rollback-on-failure`, `--scheduler-k3s-computed-rollback-on-failure` | When `true`, helm rolls back the release if a deploy fails |
 | `shm-size` | app + global | none | `--scheduler-k3s-shm-size`, `--scheduler-k3s-global-shm-size`, `--scheduler-k3s-computed-shm-size` | `/dev/shm` size override applied to app containers |
 | `token` | global only | none | `--scheduler-k3s-global-token` (masked as `*******` in default stdout output; the raw value is returned when queried via `--format json` or when this flag is requested explicitly) | Cluster join token used by `scheduler-k3s:cluster-add` |
-| `chart.<chart-name>.<property>` | global only | none | `--scheduler-k3s-global-chart.<chart-name>.<property>` (dynamic per chart/property) | Override a value injected into the helm chart named `<chart-name>` (one row per chart/property pair) |
+| `chart.<chart-name>.<property>` | global only | none | `--scheduler-k3s-global-chart.<chart-name>.<property>` (dynamic per chart/property) | Override a value injected into the helm chart named `<chart-name>` (one row per chart/property pair). Manage these via the dedicated `scheduler-k3s:charts:set` / `scheduler-k3s:charts:report` commands; the `scheduler-k3s:set`/`scheduler-k3s:report` form is deprecated. |
--- a/docs/deployment/schedulers/scheduler-management.md
+++ b/docs/deployment/schedulers/scheduler-management.md
@@ -122,7 +122,7 @@ At this time, the following dokku commands are used to implement a complete sche
 - `apps:clone`: handles app cloning
    - triggers: post-app-clone-setup
 - `cron`: generates cron tasks for the app
-    - triggers: scheduler-cron-write
+    - triggers: scheduler-uses-host-cron, scheduler-cron-write
 - `deploy`: deploys app proceses and checks the status of a deploy
    - triggers: scheduler-app-status, scheduler-deploy, scheduler-is-deployed, scheduler-logs-failed
 - `enter`: enters a running container
--- a/docs/development/plugin-triggers.md
+++ b/docs/development/plugin-triggers.md
@@ -581,6 +581,21 @@ set -eo pipefail; [[ $DOKKU_TRACE ]] && set -x
 # TODO
 ```

+### `config-migrate-env`
+
+- Description: Drains the pre-0.38 `$DOKKU_ROOT/ENV` and `$DOKKU_ROOT/<app>/ENV` files into the config property path, removing each file once it has been drained. A file found at the old path after its migration has been recorded is never imported: the config path holds every change made since, so the file is removed when it agrees with the current config and otherwise moved aside to `ENV.migrated`. Idempotent, and safe to call from an install trigger that runs before the config plugin's own.
+- Invoked by: `common` when migrating deprecated config vars to plugin properties, checks plugin
+- Arguments: none
+- Example:
+
+```shell
+#!/usr/bin/env bash
+
+set -eo pipefail; [[ $DOKKU_TRACE ]] && set -x
+
+plugn trigger config-migrate-env
+```
+
 ### `config-set`

 - Description: Sets one or more config values for an app without restarting (when --no-restart flag is specified)
@@ -1340,6 +1355,8 @@ esac

 The default templates are viewable here: [plugins/nginx-vhosts/templates/](https://github.com/dokku/dokku/tree/master/plugins/nginx-vhosts/templates)

+Overriding the `validate-config` template is the supported way to make deploy-time pre-validation aware of directives from nginx modules that the host loads via `load_module` in its global config. As implementing this trigger requires a [custom plugin](/docs/development/plugin-creation.md), see [Custom nginx modules](/docs/appendices/file-formats/nginx-conf-sigil.md#custom-nginx-modules) for a complete example.
+
 ### `nginx-dokku-template-source`

 - Description: Return the path to a `sigil` template that should be used to generate the `dokku.conf` nginx configuration file.
@@ -2525,8 +2542,8 @@ DOKKU_SCHEDULER="$1"; APP="$2";
 > The scheduler plugin trigger apis are under development and may change
 > between minor releases until the 1.0 release.

- Description: Force triggers writing out cron tasks. Arguments are optional.
- Invoked by: `ps:start`, `ps:stop`, `cron:set`
+- Description: Force triggers writing out cron tasks. Arguments are optional. The `cron` plugin implements this for host-crontab schedulers (regenerating the whole `dokku` user crontab when the scheduler uses host cron or when no scheduler is given); self-managed schedulers such as `k3s` implement it to update their own cron backend.
+- Invoked by: `ps:start`, `ps:stop`, `cron:set`, `apps:destroy`
 - Arguments: `$DOKKU_SCHEDULER $APP`
 - Example:

@@ -2545,16 +2562,16 @@ source "$PLUGIN_CORE_AVAILABLE_PATH/common/functions"
 > The scheduler plugin trigger apis are under development and may change
 > between minor releases until the 1.0 release.

- Description: Allows you to run scheduler commands when an app is deployed
+- Description: Allows you to run scheduler commands when an app is deployed. `$PROCESS_TYPE` is empty for a normal deploy and set when a single process type is targeted, as by `dokku ps:restart <app> <process-type>`, in which case only that process type should be redeployed.
 - Invoked by: `dokku deploy`
- Arguments: `$DOKKU_SCHEDULER $APP $IMAGE_TAG`
+- Arguments: `$DOKKU_SCHEDULER $APP $IMAGE_TAG $PROCESS_TYPE`
 - Example:

 ```shell
 #!/usr/bin/env bash

 set -eo pipefail; [[ $DOKKU_TRACE ]] && set -x
-DOKKU_SCHEDULER="$1"; APP="$2"; IMAGE_TAG="$3";
+DOKKU_SCHEDULER="$1"; APP="$2"; IMAGE_TAG="$3"; PROCESS_TYPE="$4";

 # TODO
 ```
@@ -2886,8 +2903,8 @@ DOKKU_SCHEDULER="$1"; APP="$2"; CONTAINER="$3"; TAIL="$4"; PRETTY_PRINT="$5"; NU
 > The scheduler plugin trigger apis are under development and may change
 > between minor releases until the 1.0 release.

- Description: Allows you to retire containers started by the `run` command
- Invoked by: `dokku run:retire`
+- Description: Allows you to retire containers started by the `run` and `cron:run` commands that have exceeded their active deadline
+- Invoked by: `dokku run:retire`, `dokku ps:retire`
 - Arguments: `$DOKKU_SCHEDULER $APP`
 - Example:

@@ -2987,6 +3004,30 @@ DOKKU_SCHEDULER="$1"; APP="$2"; REMOVE_CONTAINERS="$3";
 - Arguments: `$SCHEDULER $ENTRY_NAME $IMAGE [-- $cmd...]`
 - Flags: `--interactive` (stdin is open), `--tty` (stdin is a terminal), `--as-user <uid>` (override `entry.Chown`).

+### `scheduler-uses-host-cron`
+
+> [!WARNING]
+> The scheduler plugin trigger apis are under development and may change
+> between minor releases until the 1.0 release.
+
+- Description: Reports whether the scheduler writes `app.json` cron tasks to the host `dokku` user crontab. Schedulers that use the host crontab (`docker-local`) echo `true`; schedulers that manage their own cron backend (`k3s`, which creates in-cluster CronJobs) echo `false`. The cron plugin reads this to decide which apps to include when regenerating the host crontab; a scheduler that does not implement the trigger is treated as `false`.
+- Invoked by: `cron`
+- Arguments: `$DOKKU_SCHEDULER`
+- Example:
+
+```shell
+#!/usr/bin/env bash
+
+set -eo pipefail; [[ $DOKKU_TRACE ]] && set -x
+DOKKU_SCHEDULER="$1";
+
+if [[ "$DOKKU_SCHEDULER" != "custom-scheduler" ]]; then
+  return
+fi
+
+echo "true"
+```
+
 ### `traefik-template-source`

 - Description: Retrieves an alternative template for the traefik compose config
--- a/docs/development/release-process.md
+++ b/docs/development/release-process.md
@@ -29,7 +29,7 @@ The workflow looks like this:
 ```shell
 # having dokku-arch in ../dokku-arch
 vagrant up build-arch
-# wait for "==> build-arch: ==> Finished making: dokku 0.38.8-2 (Mon Feb 22 23:20:37 CET 2016)"
+# wait for "==> build-arch: ==> Finished making: dokku 0.38.27-2 (Mon Feb 22 23:20:37 CET 2016)"
 cd ../dokku-arch
 git add PKGBUILD .SRCINFO
 git commit -m 'Update to dokku 0.9.9'
--- a/docs/getting-started/install/docker.md
+++ b/docs/getting-started/install/docker.md
@@ -3,7 +3,7 @@
 Pull the dokku/dokku image:

 ```shell
-docker pull dokku/dokku:0.38.8
+docker pull dokku/dokku:0.38.27
 ```

 Next, run the image.
@@ -19,7 +19,7 @@ docker container run -d \
  --publish 8443:443 \
  --volume /var/lib/dokku:/mnt/dokku \
  --volume /var/run/docker.sock:/var/run/docker.sock \
-  dokku/dokku:0.38.8
+  dokku/dokku:0.38.27
 ```

 Alternatively, you can use `docker-compose.yml`:
@@ -27,7 +27,7 @@ Alternatively, you can use `docker-compose.yml`:
 ```yaml
 services:
  dokku:
-    image: dokku/dokku:0.38.8
+    image: dokku/dokku:0.38.27
    container_name: dokku
    network_mode: bridge
    ports:
@@ -67,7 +67,7 @@ Compose dependents can gate on the healthcheck via `depends_on` with `condition:
 ```yaml
 services:
  dokku:
-    image: dokku/dokku:0.38.8
+    image: dokku/dokku:0.38.27
    # ...
  bootstrap:
    image: alpine:3.20
@@ -114,7 +114,7 @@ redis: https://github.com/dokku/dokku-redis.git
 The alternative is to build a custom docker image via a custom Dockerfile. This Dockerfile can run any `plugin:install` command, though the `install` trigger must be skipped via the `--skip-install-trigger`. The version installed at that time will be the one that persists. Below is an example Dockerfile showing this method.

 ```Dockerfile
-FROM dokku/dokku:0.38.8
+FROM dokku/dokku:0.38.27
 RUN dokku plugin:install https://github.com/dokku/dokku-postgres.git --skip-install-trigger
 RUN dokku plugin:install https://github.com/dokku/dokku-redis.git --skip-install-trigger
 ```
--- a/docs/getting-started/installation/index.md
+++ b/docs/getting-started/installation/index.md
@@ -31,8 +31,8 @@ To install the latest stable version of Dokku, you can run the following shell c

 ```shell
 # for debian systems, installs Dokku via apt-get
-wget -NP . https://dokku.com/install/v0.38.8/bootstrap.sh
-sudo DOKKU_TAG=v0.38.8 bash bootstrap.sh
+wget -NP . https://dokku.com/install/v0.38.27/bootstrap.sh
+sudo DOKKU_TAG=v0.38.27 bash bootstrap.sh
 ```

 The installation process takes about 5-10 minutes, depending upon internet connection speed.
--- a/docs/home.html
+++ b/docs/home.html
@@ -10,26 +10,26 @@
    <meta name="author" content="">
    <title>Dokku - The smallest PaaS implementation you've ever seen</title>

-    <link rel="apple-touch-icon" sizes="57x57" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.8/docs/assets/favicons/apple-touch-icon-57x57.png">
-    <link rel="apple-touch-icon" sizes="60x60" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.8/docs/assets/favicons/apple-touch-icon-60x60.png">
-    <link rel="apple-touch-icon" sizes="72x72" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.8/docs/assets/favicons/apple-touch-icon-72x72.png">
-    <link rel="apple-touch-icon" sizes="76x76" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.8/docs/assets/favicons/apple-touch-icon-76x76.png">
-    <link rel="apple-touch-icon" sizes="114x114" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.8/docs/assets/favicons/apple-touch-icon-114x114.png">
-    <link rel="apple-touch-icon" sizes="120x120" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.8/docs/assets/favicons/apple-touch-icon-120x120.png">
-    <link rel="apple-touch-icon" sizes="144x144" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.8/docs/assets/favicons/apple-touch-icon-144x144.png">
-    <link rel="apple-touch-icon" sizes="152x152" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.8/docs/assets/favicons/apple-touch-icon-152x152.png">
-    <link rel="apple-touch-icon" sizes="180x180" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.8/docs/assets/favicons/apple-touch-icon-180x180.png">
-    <link rel="icon" type="image/png" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.8/docs/assets/favicons/favicon-32x32.png" sizes="32x32">
-    <link rel="icon" type="image/png" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.8/docs/assets/favicons/android-chrome-192x192.png" sizes="192x192">
-    <link rel="icon" type="image/png" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.8/docs/assets/favicons/favicon-96x96.png" sizes="96x96">
-    <link rel="icon" type="image/png" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.8/docs/assets/favicons/favicon-16x16.png" sizes="16x16">
-    <link rel="manifest" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.8/docs/assets/favicons/manifest.json">
-    <link rel="shortcut icon" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.8/docs/assets/favicons/favicon.ico">
+    <link rel="apple-touch-icon" sizes="57x57" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.27/docs/assets/favicons/apple-touch-icon-57x57.png">
+    <link rel="apple-touch-icon" sizes="60x60" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.27/docs/assets/favicons/apple-touch-icon-60x60.png">
+    <link rel="apple-touch-icon" sizes="72x72" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.27/docs/assets/favicons/apple-touch-icon-72x72.png">
+    <link rel="apple-touch-icon" sizes="76x76" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.27/docs/assets/favicons/apple-touch-icon-76x76.png">
+    <link rel="apple-touch-icon" sizes="114x114" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.27/docs/assets/favicons/apple-touch-icon-114x114.png">
+    <link rel="apple-touch-icon" sizes="120x120" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.27/docs/assets/favicons/apple-touch-icon-120x120.png">
+    <link rel="apple-touch-icon" sizes="144x144" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.27/docs/assets/favicons/apple-touch-icon-144x144.png">
+    <link rel="apple-touch-icon" sizes="152x152" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.27/docs/assets/favicons/apple-touch-icon-152x152.png">
+    <link rel="apple-touch-icon" sizes="180x180" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.27/docs/assets/favicons/apple-touch-icon-180x180.png">
+    <link rel="icon" type="image/png" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.27/docs/assets/favicons/favicon-32x32.png" sizes="32x32">
+    <link rel="icon" type="image/png" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.27/docs/assets/favicons/android-chrome-192x192.png" sizes="192x192">
+    <link rel="icon" type="image/png" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.27/docs/assets/favicons/favicon-96x96.png" sizes="96x96">
+    <link rel="icon" type="image/png" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.27/docs/assets/favicons/favicon-16x16.png" sizes="16x16">
+    <link rel="manifest" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.27/docs/assets/favicons/manifest.json">
+    <link rel="shortcut icon" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.27/docs/assets/favicons/favicon.ico">
    <meta name="apple-mobile-web-app-title" content="Dokku">
    <meta name="application-name" content="Dokku">
    <meta name="msapplication-TileColor" content="#da532c">
-    <meta name="msapplication-TileImage" content="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.8/docs/assets/favicons/mstile-144x144.png">
-    <meta name="msapplication-config" content="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.8/docs/assets/favicons/browserconfig.xml">
+    <meta name="msapplication-TileImage" content="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.27/docs/assets/favicons/mstile-144x144.png">
+    <meta name="msapplication-config" content="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.27/docs/assets/favicons/browserconfig.xml">
    <meta name="theme-color" content="#ffffff">

    <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.2.0-beta1/dist/css/bootstrap.min.css" rel="stylesheet" integrity="sha384-0evHe/X+R7YkIZDRvuzKMRqM+OrBnVFBL6DOitfPri4tjfHxaWutUpFmBp4vmVor" crossorigin="anonymous">
@@ -38,7 +38,7 @@
    <link rel="preconnect" href="https://fonts.googleapis.com">
    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
    <link href="https://fonts.googleapis.com/css2?family=Lato:wght@400;700;900&display=swap" rel="stylesheet">
-    <link href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.8/docs/assets/style.css" rel="stylesheet">
+    <link href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.27/docs/assets/style.css" rel="stylesheet">
    <!-- <link href="./assets/style.css" rel="stylesheet"> -->
 </head>

@@ -98,7 +98,7 @@
        <main class="container px-4 px-lg-5">
            <div class="row">
                <div class="col-lg-7">
-                    <a class="badge-link" href="https://github.com/dokku/dokku/releases"><span class="badge py-2 d-flex fit-content"><div class="circle align-self-center me-2"></div>Latest release <span id="releaseVersion" class="ms-1">v0.38.8</span></span></a>
+                    <a class="badge-link" href="https://github.com/dokku/dokku/releases"><span class="badge py-2 d-flex fit-content"><div class="circle align-self-center me-2"></div>Latest release <span id="releaseVersion" class="ms-1">v0.38.27</span></span></a>
                    <h1 class="text-white hero-heading mt-5">An open source PAAS alternative to Heroku.</h1>
                    <h4 class="text-white mt-5">Dokku helps you build and manage the lifecycle of applications from building to scaling.</h4>
                    <div class="d-flex mt-5">
@@ -125,7 +125,7 @@
                            </p>
                            <p class="line">
                                <span class="prompt">$</span>
-                                <span class="command">sudo DOKKU_TAG=v0.38.8 bash bootstrap.sh</span>
+                                <span class="command">sudo DOKKU_TAG=v0.38.27 bash bootstrap.sh</span>
                            </p>
                            <br>

--- a/docs/networking/network.md
+++ b/docs/networking/network.md
@@ -8,7 +8,7 @@ network:create <network>                    # Creates an attachable docker netwo
 network:destroy <network>                   # Destroys a docker network
 network:exists <network>                    # Checks if a docker network exists
 network:info <network> [--format text|json] # Outputs information about a docker network
-network:list [--format text|json]           # Lists all docker networks
+network:list [--format text|json] [--dokku-managed] # Lists all docker networks
 network:report [<app>] [<flag>]             # Displays a network report for one or more apps
 network:rebuild <app>                       # Rebuilds network settings for an app
 network:rebuildall                          # Rebuild network settings for all apps
@@ -59,13 +59,26 @@ dokku network:list --format json

 ```
 [
-    {"CreatedAt":"2024-02-25T01:55:24.275184461Z","Driver":"bridge","ID":"d18df2d21433","Internal":false,"IPv6":false,"Labels":{},"Name":"bridge","Scope":"local"},
-    {"CreatedAt":"2024-02-25T01:55:24.275184461Z","Driver":"bridge","ID":"f50fa882e7de","Internal":false,"IPv6":false,"Labels":{},"Name":"test-network","Scope":"local"},
-    {"CreatedAt":"2024-02-25T01:55:24.275184461Z","Driver":"host","ID":"ab6a59291443","Internal":false,"IPv6":false,"Labels":{},"Name":"host","Scope":"local"},
-    {"CreatedAt":"2024-02-25T01:55:24.275184461Z","Driver":"null","ID":"e2506bc8b7d7","Internal":false,"IPv6":false,"Labels":{},"Name":"none","Scope":"local"}
+    {"CreatedAt":"2024-02-25T01:55:24.275184461Z","DokkuManaged":false,"Driver":"bridge","ID":"d18df2d21433","Internal":false,"IPv6":false,"Labels":{},"Name":"bridge","Scope":"local"},
+    {"CreatedAt":"2024-02-25T01:55:24.275184461Z","DokkuManaged":true,"Driver":"bridge","ID":"f50fa882e7de","Internal":false,"IPv6":false,"Labels":{"com.dokku.network-name":"test-network"},"Name":"test-network","Scope":"local"},
+    {"CreatedAt":"2024-02-25T01:55:24.275184461Z","DokkuManaged":false,"Driver":"host","ID":"ab6a59291443","Internal":false,"IPv6":false,"Labels":{},"Name":"host","Scope":"local"},
+    {"CreatedAt":"2024-02-25T01:55:24.275184461Z","DokkuManaged":false,"Driver":"null","ID":"e2506bc8b7d7","Internal":false,"IPv6":false,"Labels":{},"Name":"none","Scope":"local"}
 ]
 ```

+The `DokkuManaged` field is `true` for networks created by `network:create` and `false` for Docker built-in networks (such as `bridge`, `host`, and `none`) or networks created outside of Dokku (such as compose `*_default` networks). This can be used by automation to determine which networks Dokku is responsible for.
+
+The `network:list` command also takes a `--dokku-managed` flag, which restricts the output to only those networks created by Dokku. It can be combined with the `--format` flag:
+
+```shell
+dokku network:list --dokku-managed
+```
+
+```
+=====> Networks
+test-network
+```
+
 ### Creating a network

 > [!IMPORTANT]
@@ -142,10 +155,11 @@ dokku network:info bridge

 ```
 =====> bridge network information
-       ID:       d18df2d21433
-       Name:     bridge
-       Driver:   bridge
-       Scope:    local
+       ID:             d18df2d21433
+       Name:           bridge
+       Driver:         bridge
+       Scope:          local
+       Dokku managed:  false
 ```

 The `network:info` command also takes a `--format` flag, with the valid options including `text` (default) and `json`. The `json` output format can be used for automation purposes:
@@ -155,7 +169,7 @@ dokku network:info bridge --format json
 ```

 ```
-{"CreatedAt":"2024-02-25T01:55:24.275184461Z","Driver":"bridge","ID":"d18df2d21433","Internal":false,"IPv6":false,"Labels":{},"Name":"bridge","Scope":"local"}
+{"CreatedAt":"2024-02-25T01:55:24.275184461Z","DokkuManaged":false,"Driver":"bridge","ID":"d18df2d21433","Internal":false,"IPv6":false,"Labels":{},"Name":"bridge","Scope":"local"}
 ```

 ### Routing an app to a known ip:port combination
--- a/docs/networking/port-management.md
+++ b/docs/networking/port-management.md
@@ -221,8 +221,61 @@ You can pass flags which will output only the value of the specific information
 dokku ports:report node-js-app --ports-map
 ```

+Use `--ports-map-json` or `--ports-map-detected-json` to get the same data as a JSON array of objects. Each object has the following fields:
+
+- `scheme`: the port scheme (e.g. `http`, `https`, `udp`)
+- `host_port`: the host/listener port
+- `container_port`: the container port
+
+```shell
+dokku ports:report node-js-app --ports-map-json
+```
+
+```json
+[
+  {
+    "scheme": "http",
+    "host_port": 80,
+    "container_port": 5000
+  },
+  {
+    "scheme": "https",
+    "host_port": 443,
+    "container_port": 5000
+  }
+]
+```
+
+The JSON output can be processed with tools such as `jq`:
+
+```shell
+dokku ports:report node-js-app --ports-map-json | jq '.[].host_port'
+```
+
+```
+80
+443
+```
+
+```shell
+dokku ports:report node-js-app --ports-map-detected-json | jq '.[0].container_port'
+```
+
+```
+5000
+```
+
 ## Properties

+### Configured flags
+
+The following flags surface configured port mappings managed by `ports:set` / `ports:add` / `ports:remove` / `ports:clear`:
+
+| Flag | Description |
+|---|---|
+| `--ports-map` | Configured port mappings as space-separated `scheme:host-port:container-port` values |
+| `--ports-map-json` | Configured port mappings as a JSON array of `{scheme, host_port, container_port}` objects |
+
 ### Read-only flags

 The following flags surface in `ports:report` but are not managed by `ports:set` - they are derived from the deploy:
@@ -230,3 +283,4 @@ The following flags surface in `ports:report` but are not managed by `ports:set`
 | Flag | Description |
 |---|---|
 | `--ports-map-detected` | Port mapping inferred from `EXPOSE` directives or the running container |
+| `--ports-map-detected-json` | Detected port mappings as a JSON array of `{scheme, host_port, container_port}` objects |
--- a/docs/networking/proxies/nginx.md
+++ b/docs/networking/proxies/nginx.md
@@ -121,6 +121,8 @@ dokku nginx:show-config node-js-app

 App-supplied `nginx.conf.sigil` files are pre-validated automatically at the start of every deploy, immediately after the template is extracted from the source tree and before the build phase runs. The template is rendered with sigil and run through `nginx -t` against a minimal wrapper config; if validation fails, the deploy is aborted before any build work begins. To bypass this behavior, set `disable-custom-config` to `true` (see "Disabling custom nginx config" below).

+The wrapper config used for validation does not include the top-level `load_module` directives from the global nginx config, so a `nginx.conf.sigil` that relies on a directive from a dynamically loaded module will fail this validation even when `nginx -t` passes against the real server config. See [Custom nginx modules](/docs/appendices/file-formats/nginx-conf-sigil.md#custom-nginx-modules) for how to supply a custom validation wrapper via the `nginx-app-template-source` trigger's `validate-config` template type.
+
 It may also be desired to validate an nginx config outside of the deployment process. To do so, run the `nginx:validate-config` command. With no arguments, this will validate all app nginx configs, one at a time. A minimal wrapper nginx config is generated for each app's nginx config, upon which `nginx -t` will be run.

 ```shell
--- a/docs/networking/proxies/openresty.md
+++ b/docs/networking/proxies/openresty.md
@@ -284,41 +284,43 @@ dokku openresty:report node-js-app --openresty-computed-letsencrypt-email

 ### Settable properties

-Five properties (`image`, `log-level`, `letsencrypt-email`, `letsencrypt-server`, `allowed-letsencrypt-domains-func-base64`) are global only. The rest are app only - they cannot be set with `--global`.
+Five properties (`image`, `log-level`, `letsencrypt-email`, `letsencrypt-server`, `allowed-letsencrypt-domains-func-base64`) are global only. The rest may be set per-app or globally with `--global`; a global value applies to any app that has no per-app value, otherwise the built-in default is used.

-Global-only properties expose two report flags: `--openresty-global-<property>` returns the raw stored value (empty when the property has never been set), while `--openresty-computed-<property>` returns the effective value (the global value if set, otherwise the built-in default). The per-app `hsts` property additionally has a bare `--openresty-hsts` flag for the raw per-app value.
+Global-only properties expose two report flags: `--openresty-global-<property>` returns the raw stored value (empty when the property has never been set), while `--openresty-computed-<property>` returns the effective value (the global value if set, otherwise the built-in default).
+
+App-or-global properties expose three report flags: `--openresty-<property>` returns the raw per-app value (empty when unset), `--openresty-global-<property>` returns the raw global value (empty when unset), and `--openresty-computed-<property>` returns the effective value, resolving the per-app value first, then the global value, then the built-in default.

 | Property | Scope | Default | Report flags | Description |
 |---|---|---|---|---|
-| `access-log-format` | app only | none | `--openresty-access-log-format` | Custom nginx `log_format` directive used for the access log |
-| `access-log-path` | app only | _`/var/log/nginx/{app}-access.log`_ | `--openresty-access-log-path` | Path inside the openresty container where access logs are written |
+| `access-log-format` | app or global | none | `--openresty-access-log-format`, `--openresty-global-access-log-format`, `--openresty-computed-access-log-format` | Custom nginx `log_format` directive used for the access log |
+| `access-log-path` | app or global | _`/var/log/nginx/{app}-access.log`_ | `--openresty-access-log-path`, `--openresty-global-access-log-path`, `--openresty-computed-access-log-path` | Path inside the openresty container where access logs are written |
 | `allowed-letsencrypt-domains-func-base64` | global only | _allow-all stub_ | `--openresty-global-allowed-letsencrypt-domains-func-base64`, `--openresty-computed-allowed-letsencrypt-domains-func-base64` | Base64-encoded Lua function deciding which domains may request a letsencrypt certificate |
-| `bind-address-ipv4` | app only | none | `--openresty-bind-address-ipv4` | IPv4 address the openresty server block binds to |
-| `bind-address-ipv6` | app only | `::` | `--openresty-bind-address-ipv6` | IPv6 address the openresty server block binds to |
-| `client-body-timeout` | app only | `60s` | `--openresty-client-body-timeout` | Time allowed to read the request body from the client |
-| `client-header-timeout` | app only | `60s` | `--openresty-client-header-timeout` | Time allowed to read the request header from the client |
-| `client-max-body-size` | app only | `1m` | `--openresty-client-max-body-size` | Maximum allowed request body size |
-| `error-log-path` | app only | _`/var/log/nginx/{app}-error.log`_ | `--openresty-error-log-path` | Path inside the openresty container where error logs are written |
-| `hsts` | app only | `true` | `--openresty-hsts`, `--openresty-global-hsts`, `--openresty-computed-hsts` | When `true`, emits a `Strict-Transport-Security` header on HTTPS responses |
-| `hsts-include-subdomains` | app only | `true` | `--openresty-hsts-include-subdomains` | Adds the `includeSubDomains` directive to the HSTS header |
-| `hsts-max-age` | app only | `15724800` | `--openresty-hsts-max-age` | `max-age` value (seconds) in the HSTS header |
-| `hsts-preload` | app only | `false` | `--openresty-hsts-preload` | Adds the `preload` directive to the HSTS header |
+| `bind-address-ipv4` | app or global | none | `--openresty-bind-address-ipv4`, `--openresty-global-bind-address-ipv4`, `--openresty-computed-bind-address-ipv4` | IPv4 address the openresty server block binds to |
+| `bind-address-ipv6` | app or global | `::` | `--openresty-bind-address-ipv6`, `--openresty-global-bind-address-ipv6`, `--openresty-computed-bind-address-ipv6` | IPv6 address the openresty server block binds to |
+| `client-body-timeout` | app or global | `60s` | `--openresty-client-body-timeout`, `--openresty-global-client-body-timeout`, `--openresty-computed-client-body-timeout` | Time allowed to read the request body from the client |
+| `client-header-timeout` | app or global | `60s` | `--openresty-client-header-timeout`, `--openresty-global-client-header-timeout`, `--openresty-computed-client-header-timeout` | Time allowed to read the request header from the client |
+| `client-max-body-size` | app or global | `1m` | `--openresty-client-max-body-size`, `--openresty-global-client-max-body-size`, `--openresty-computed-client-max-body-size` | Maximum allowed request body size |
+| `error-log-path` | app or global | _`/var/log/nginx/{app}-error.log`_ | `--openresty-error-log-path`, `--openresty-global-error-log-path`, `--openresty-computed-error-log-path` | Path inside the openresty container where error logs are written |
+| `hsts` | app or global | `true` | `--openresty-hsts`, `--openresty-global-hsts`, `--openresty-computed-hsts` | When `true`, emits a `Strict-Transport-Security` header on HTTPS responses |
+| `hsts-include-subdomains` | app or global | `true` | `--openresty-hsts-include-subdomains`, `--openresty-global-hsts-include-subdomains`, `--openresty-computed-hsts-include-subdomains` | Adds the `includeSubDomains` directive to the HSTS header |
+| `hsts-max-age` | app or global | `15724800` | `--openresty-hsts-max-age`, `--openresty-global-hsts-max-age`, `--openresty-computed-hsts-max-age` | `max-age` value (seconds) in the HSTS header |
+| `hsts-preload` | app or global | `false` | `--openresty-hsts-preload`, `--openresty-global-hsts-preload`, `--openresty-computed-hsts-preload` | Adds the `preload` directive to the HSTS header |
 | `image` | global only | _parsed from `plugins/openresty-vhosts/Dockerfile`_ | `--openresty-global-image`, `--openresty-computed-image` | Docker image used to run the openresty container |
-| `keepalive-timeout` | app only | `75s` | `--openresty-keepalive-timeout` | Time an idle keep-alive connection stays open |
+| `keepalive-timeout` | app or global | `75s` | `--openresty-keepalive-timeout`, `--openresty-global-keepalive-timeout`, `--openresty-computed-keepalive-timeout` | Time an idle keep-alive connection stays open |
 | `letsencrypt-email` | global only | none | `--openresty-global-letsencrypt-email`, `--openresty-computed-letsencrypt-email` | Contact email enabling letsencrypt; empty disables https issuance |
 | `letsencrypt-server` | global only | `https://acme-v02.api.letsencrypt.org/directory` | `--openresty-global-letsencrypt-server`, `--openresty-computed-letsencrypt-server` | ACME directory used when requesting certificates |
-| `lingering-timeout` | app only | `5s` | `--openresty-lingering-timeout` | Time openresty waits for more client data when closing a connection |
+| `lingering-timeout` | app or global | `5s` | `--openresty-lingering-timeout`, `--openresty-global-lingering-timeout`, `--openresty-computed-lingering-timeout` | Time openresty waits for more client data when closing a connection |
 | `log-level` | global only | `ERROR` | `--openresty-global-log-level`, `--openresty-computed-log-level` | Openresty log level |
-| `proxy-buffer-size` | app only | _system pagesize_ | `--openresty-proxy-buffer-size` | Buffer size for reading the first part of the upstream response |
-| `proxy-buffering` | app only | `on` | `--openresty-proxy-buffering` | Whether openresty buffers upstream responses (`on` or `off`) |
-| `proxy-buffers` | app only | _`8 {pagesize}`_ | `--openresty-proxy-buffers` | Number and size of buffers used for an upstream response |
-| `proxy-busy-buffers-size` | app only | _`2 * pagesize`_ | `--openresty-proxy-busy-buffers-size` | Maximum buffer size that can be busy sending a response to the client |
-| `proxy-connect-timeout` | app only | `60s` | `--openresty-proxy-connect-timeout` | Time to establish a connection to the upstream |
-| `proxy-read-timeout` | app only | `60s` | `--openresty-proxy-read-timeout` | Time to read a response from the upstream |
-| `proxy-send-timeout` | app only | `60s` | `--openresty-proxy-send-timeout` | Time to transmit a request to the upstream |
-| `send-timeout` | app only | `60s` | `--openresty-send-timeout` | Time between two successive write operations to the client |
-| `underscore-in-headers` | app only | `off` | `--openresty-underscore-in-headers` | Whether to allow underscores in client request header field names |
-| `x-forwarded-for-value` | app only | `$remote_addr` | `--openresty-x-forwarded-for-value` | Value used for the `X-Forwarded-For` header |
-| `x-forwarded-port-value` | app only | `$server_port` | `--openresty-x-forwarded-port-value` | Value used for the `X-Forwarded-Port` header |
-| `x-forwarded-proto-value` | app only | `$scheme` | `--openresty-x-forwarded-proto-value` | Value used for the `X-Forwarded-Proto` header |
-| `x-forwarded-ssl` | app only | none | `--openresty-x-forwarded-ssl` | Value used for the `X-Forwarded-Ssl` header (e.g. `on`/`off`) |
+| `proxy-buffer-size` | app or global | _system pagesize_ | `--openresty-proxy-buffer-size`, `--openresty-global-proxy-buffer-size`, `--openresty-computed-proxy-buffer-size` | Buffer size for reading the first part of the upstream response |
+| `proxy-buffering` | app or global | `on` | `--openresty-proxy-buffering`, `--openresty-global-proxy-buffering`, `--openresty-computed-proxy-buffering` | Whether openresty buffers upstream responses (`on` or `off`) |
+| `proxy-buffers` | app or global | _`8 {pagesize}`_ | `--openresty-proxy-buffers`, `--openresty-global-proxy-buffers`, `--openresty-computed-proxy-buffers` | Number and size of buffers used for an upstream response |
+| `proxy-busy-buffers-size` | app or global | _`2 * pagesize`_ | `--openresty-proxy-busy-buffers-size`, `--openresty-global-proxy-busy-buffers-size`, `--openresty-computed-proxy-busy-buffers-size` | Maximum buffer size that can be busy sending a response to the client |
+| `proxy-connect-timeout` | app or global | `60s` | `--openresty-proxy-connect-timeout`, `--openresty-global-proxy-connect-timeout`, `--openresty-computed-proxy-connect-timeout` | Time to establish a connection to the upstream |
+| `proxy-read-timeout` | app or global | `60s` | `--openresty-proxy-read-timeout`, `--openresty-global-proxy-read-timeout`, `--openresty-computed-proxy-read-timeout` | Time to read a response from the upstream |
+| `proxy-send-timeout` | app or global | `60s` | `--openresty-proxy-send-timeout`, `--openresty-global-proxy-send-timeout`, `--openresty-computed-proxy-send-timeout` | Time to transmit a request to the upstream |
+| `send-timeout` | app or global | `60s` | `--openresty-send-timeout`, `--openresty-global-send-timeout`, `--openresty-computed-send-timeout` | Time between two successive write operations to the client |
+| `underscore-in-headers` | app or global | `off` | `--openresty-underscore-in-headers`, `--openresty-global-underscore-in-headers`, `--openresty-computed-underscore-in-headers` | Whether to allow underscores in client request header field names |
+| `x-forwarded-for-value` | app or global | `$remote_addr` | `--openresty-x-forwarded-for-value`, `--openresty-global-x-forwarded-for-value`, `--openresty-computed-x-forwarded-for-value` | Value used for the `X-Forwarded-For` header |
+| `x-forwarded-port-value` | app or global | `$server_port` | `--openresty-x-forwarded-port-value`, `--openresty-global-x-forwarded-port-value`, `--openresty-computed-x-forwarded-port-value` | Value used for the `X-Forwarded-Port` header |
+| `x-forwarded-proto-value` | app or global | `$scheme` | `--openresty-x-forwarded-proto-value`, `--openresty-global-x-forwarded-proto-value`, `--openresty-computed-x-forwarded-proto-value` | Value used for the `X-Forwarded-Proto` header |
+| `x-forwarded-ssl` | app or global | none | `--openresty-x-forwarded-ssl`, `--openresty-global-x-forwarded-ssl`, `--openresty-computed-x-forwarded-ssl` | Value used for the `X-Forwarded-Ssl` header (e.g. `on`/`off`) |
--- a/docs/networking/proxies/traefik.md
+++ b/docs/networking/proxies/traefik.md
@@ -260,6 +260,16 @@ dokku traefik:set --global dns-provider-cf_api_key your-api-key

 The `dns-provider-` prefix will be stripped and the variable name will be uppercased when passed to the Traefik container. For example, `dns-provider-cf_api_email` becomes `CF_API_EMAIL`.

+Each configured variable is surfaced by `traefik:report` as `--traefik-global-dns-provider-<env_var>`. As these values are provider credentials, they are masked as `*******` in the default report output, including the aggregate `dokku report`. The raw value is returned when the flag is requested explicitly or when the report is rendered as json:
+
+```shell
+dokku traefik:report --global --traefik-global-dns-provider-cf_api_email
+```
+
+```shell
+dokku traefik:report --global --format json | jq -r '."global-dns-provider-cf_api_email"'
+```
+
 After configuring, the Traefik container will need to be restarted and apps will need to be rebuilt.

 Refer to the [Traefik DNS Challenge documentation](https://doc.traefik.io/traefik/https/acme/#dnschallenge) for the list of supported DNS providers and their required environment variables.
@@ -403,12 +413,12 @@ All traefik properties are global only. Set with `traefik:set --global <property
 | `api-entry-point` | global only | none | `--traefik-global-api-entry-point`, `--traefik-computed-api-entry-point` | Name of the entry point used by the Traefik API |
 | `api-entry-point-address` | global only | none | `--traefik-global-api-entry-point-address`, `--traefik-computed-api-entry-point-address` | Address (`host:port`) the Traefik API listens on |
 | `api-vhost` | global only | `traefik.dokku.me` | `--traefik-global-api-vhost`, `--traefik-computed-api-vhost` | Virtual host that routes to the Traefik API |
-| `basic-auth-password` | global only | none | `--traefik-global-basic-auth-password`, `--traefik-computed-basic-auth-password` | Password for basic auth in front of the API/dashboard |
+| `basic-auth-password` | global only | none | `--traefik-global-basic-auth-password`, `--traefik-computed-basic-auth-password` (masked as `*******` in the default stdout report; the raw value is returned when queried via `--format json` or when one of these flags is requested explicitly) | Password for basic auth in front of the API/dashboard |
 | `basic-auth-username` | global only | none | `--traefik-global-basic-auth-username`, `--traefik-computed-basic-auth-username` | Username for basic auth in front of the API/dashboard |
 | `challenge-mode` | global only | `tls` | `--traefik-global-challenge-mode`, `--traefik-computed-challenge-mode` | ACME challenge method used by Traefik (`tls`, `http`, or `dns`) |
 | `dashboard-enabled` | global only | `false` | `--traefik-global-dashboard-enabled`, `--traefik-computed-dashboard-enabled` | When `true`, enables the Traefik dashboard |
 | `dns-provider` | global only | none | `--traefik-global-dns-provider`, `--traefik-computed-dns-provider` | Lego DNS provider name used when `challenge-mode` is `dns` |
-| `dns-provider-<ENV_VAR>` | global only | none | `--traefik-dns-provider-<env_var>` (masked as `*******` in the default stdout report; the raw value is returned when queried via `--format json` or when this flag is requested explicitly) | Per-provider environment variables passed to the Traefik container; `<ENV_VAR>` is the upstream variable name (e.g. `dns-provider-cloudflare-api-token`) |
+| `dns-provider-<ENV_VAR>` | global only | none | `--traefik-global-dns-provider-<env_var>` (masked as `*******` in the default stdout report; the raw value is returned when queried via `--format json` or when this flag is requested explicitly) | Per-provider environment variables passed to the Traefik container; `<ENV_VAR>` is the upstream variable name (e.g. `dns-provider-cloudflare-api-token`) |
 | `http-entry-point` | global only | `http` | `--traefik-global-http-entry-point`, `--traefik-computed-http-entry-point` | Entry point name handling plaintext HTTP traffic |
 | `https-entry-point` | global only | `https` | `--traefik-global-https-entry-point`, `--traefik-computed-https-entry-point` | Entry point name handling TLS-terminated HTTPS traffic |
 | `image` | global only | _parsed from `plugins/traefik-vhosts/Dockerfile`_ | `--traefik-global-image`, `--traefik-computed-image` | Docker image used to run the Traefik container |
--- a/docs/processes/process-management.md
+++ b/docs/processes/process-management.md
@@ -4,15 +4,15 @@
 > New as of 0.3.14, Enhanced in 0.7.0

 ```
-ps:inspect <app>                                                  # Displays a sanitized version of docker inspect for an app
-ps:rebuild [--parallel count] [--all|<app>]                       # Rebuilds an app from source
-ps:report [<app>] [<flag>]                                        # Displays a process report for one or more apps
-ps:restart [--parallel count] [--all|<app>]  [<process-name>]     # Restart an app
-ps:restore [<app>]                                                # Start previously running apps e.g. after reboot
-ps:scale [--skip-deploy] <app> <proc>=<count> [<proc>=<count>...] # Get/Set how many instances of a given process to run
-ps:set <app> <key> <value>                                        # Set or clear a ps property for an app
-ps:start [--parallel count] [--all|<app>]                         # Start an app
-ps:stop [--parallel count] [--all|<app>]                          # Stop an app
+ps:inspect <app>                                                          # Displays a sanitized version of docker inspect for an app
+ps:rebuild [--parallel count] [--all|<app>]                               # Rebuilds an app from source
+ps:report [<app>] [<flag>]                                                # Displays a process report for one or more apps
+ps:restart [--parallel count] [--all|<app>]  [<process-name>]             # Restart an app
+ps:restore [<app>]                                                        # Start previously running apps e.g. after reboot
+ps:scale [--skip-deploy] [--format stdout|json] <app> [<proc>=<count>...] # Get/Set how many instances of a given process to run
+ps:set <app> <key> <value>                                                # Set or clear a ps property for an app
+ps:start [--parallel count] [--all|<app>]                                 # Start an app
+ps:stop [--parallel count] [--all|<app>]                                  # Stop an app
 ```

 ## Usage
@@ -107,6 +107,18 @@ proctype: qty
 web:  1
 ```

+The formation can also be retrieved as JSON by using the `--format json` flag, which is useful for programmatic consumption. Each entry maps a process type to its desired quantity:
+
+```shell
+dokku ps:scale node-js-app --format json
+```
+
+```json
+[{"process_type":"web","quantity":1},{"process_type":"worker","quantity":4}]
+```
+
+When no scale has been set for the app, the JSON output is an empty array (`[]`).
+
 ### Changing process management settings

 The `ps` plugin provides a number of settings that can be used to managed deployments on a per-app basis. The following table outlines ones not covered elsewhere:
@@ -367,6 +379,20 @@ dokku ps:set node-js-app restart-policy on-failure
 dokku ps:set node-js-app restart-policy on-failure:20
 ```

+The default policy (`on-failure:10`) may be restored by passing an empty value:
+
+```shell
+dokku ps:set node-js-app restart-policy
+```
+
+A global default may also be set, and is used by any app that does not have an app-specific restart policy:
+
+```shell
+dokku ps:set --global restart-policy always
+```
+
+The effective policy applied to an app's containers is resolved as the app-specific value, then the global value, then the built-in `on-failure:10` default. This computed value can be inspected via the `--ps-computed-restart-policy` report flag.
+
 Restart policies have no bearing on server reboot, and Dokku will always attempt to restart your apps at that point unless they were manually stopped.

 Dokku also runs `dokku-event-listener` in the background via the system's init service. This monitors container state, performing the following actions:
@@ -391,8 +417,10 @@ dokku ps:report
       Processes:                     0
       Ps can scale:                  true
       Ps computed procfile path:     Procfile2
+       Ps computed restart policy:    on-failure:10
       Ps global procfile path:       Procfile
-       Ps restart policy:             on-failure:10
+       Ps global restart policy:
+       Ps restart policy:
       Ps procfile path:              Procfile2
       Restore:                       true
       Running:                       false
@@ -401,8 +429,10 @@ dokku ps:report
       Processes:                     0
       Ps can scale:                  true
       Ps computed procfile path:     Procfile
+       Ps computed restart policy:    on-failure:10
       Ps global procfile path:       Procfile
-       Ps restart policy:             on-failure:10
+       Ps global restart policy:
+       Ps restart policy:
       Ps procfile path:
       Restore:                       true
       Running:                       false
@@ -411,8 +441,10 @@ dokku ps:report
       Processes:                     0
       Ps can scale:                  true
       Ps computed procfile path:     Procfile
+       Ps computed restart policy:    on-failure:10
       Ps global procfile path:       Procfile
-       Ps restart policy:             on-failure:10
+       Ps global restart policy:
+       Ps restart policy:
       Ps procfile path:
       Restore:                       true
       Running:                       false
@@ -429,7 +461,9 @@ dokku ps:report node-js-app
       Deployed:                      false
       Processes:                     0
       Ps can scale:                  true
-       Ps restart policy:             on-failure:10
+       Ps computed restart policy:    on-failure:10
+       Ps global restart policy:
+       Ps restart policy:
       Restore:                       true
       Running:                       false
 ```
@@ -475,7 +509,7 @@ dokku ps:set node-js-app restore
 |---|---|---|---|---|
 | `dockerfile-start-cmd` | app only | none | `--ps-dockerfile-start-cmd`, `--ps-computed-dockerfile-start-cmd` | Override `CMD` for Dockerfile-based apps |
 | `procfile-path` | app + global | `Procfile` | `--ps-procfile-path`, `--ps-global-procfile-path`, `--ps-computed-procfile-path` | Path to the app's Procfile, relative to the build root |
-| `restart-policy` | app only | `on-failure:10` | `--ps-restart-policy` | Docker restart policy applied to deployed containers (`no`, `always`, `unless-stopped`, `on-failure[:max-retries]`) |
+| `restart-policy` | app + global | `on-failure:10` | `--ps-restart-policy`, `--ps-global-restart-policy`, `--ps-computed-restart-policy` | Docker restart policy applied to deployed containers (`no`, `always`, `unless-stopped`, `on-failure[:max-retries]`) |
 | `restore` | app only | `true` | `--restore` | When `true`, the app is restarted automatically by `ps:retire` after a host reboot |
 | `skip-deploy` | app + global | `false` | `--ps-skip-deploy`, `--ps-global-skip-deploy`, `--ps-computed-skip-deploy` | When `true`, skips the deploy phase after a successful build |
 | `start-cmd` | app only | none | `--ps-start-cmd`, `--ps-computed-start-cmd` | Override start command for buildpack apps |
--- a/docs/processes/scheduled-cron-tasks.md
+++ b/docs/processes/scheduled-cron-tasks.md
@@ -4,12 +4,12 @@
 > New as of 0.23.0

 ```
-cron:list <app> [--format json|stdout]  # List scheduled cron tasks for an app
-cron:report [<app>] [<flag>]            # Display report about an app
-cron:resume <app> <cron_id>             # Resume a cron task
-cron:run <app> <cron_id> [--detach]     # Run a cron task on the fly
-cron:set [--global|<app>] <key> <value> # Set or clear a cron property for an app
-cron:suspend <app> <cron_id>            # Suspend a cron task
+cron:list <app> [--format json|stdout]                      # List scheduled cron tasks for an app
+cron:report [<app>] [<flag>]                                # Display report about an app
+cron:resume <app> <cron_id>                                 # Resume a cron task
+cron:run <app> <cron_id> [--detach] [--ttl-seconds SECONDS] # Run a cron task on the fly
+cron:set [--global|<app>] <key> <value>                     # Set or clear a cron property for an app
+cron:suspend <app> <cron_id>                                # Suspend a cron task
 ```

 ## Usage
@@ -43,7 +43,7 @@ A cron task takes the following properties:

 Zero or more cron tasks can be specified per app. Cron tasks are validated after the build artifact is created but before the app is deployed, and the cron schedule is updated during the post-deploy phase.

-Cron tasks can run for a maximum of 24 hours via the docker-local scheduler, after which they are reaped from the system.
+Cron tasks can run for a maximum of 24 hours, after which they are reaped from the system. The `docker-local` scheduler reaps expired tasks via the `dokku ps:retire` pass that runs every 5 minutes, so a task may overrun its deadline by up to 5 minutes. The `k3s` scheduler enforces the deadline directly through the job's `activeDeadlineSeconds`.

 See the [app.json location documentation](/docs/advanced-usage/deployment-tasks.md#changing-the-appjson-location) for more information on where to place your `app.json` file.

@@ -57,10 +57,35 @@ When running scheduled cron tasks, there are a few items to be aware of:
    - A `MAILTO` value can be set via the `cron:set` command.
    - A `MAILFROM` value can be set via the `cron:set` command.
 - Each scheduled task is executed within a one-off `run` container, and thus inherit any docker-options specified for `run` containers. Resources are never shared between scheduled tasks.
- Scheduled cron tasks are supported on a per-scheduler basis, and are currently only implemented by the `docker-local` scheduler.
- Tasks for _all_ apps managed by the `docker-local` scheduler are written to a single crontab file owned by the `dokku` user. The `dokku` user's crontab should be considered reserved for this purpose.
+- Scheduled cron tasks are supported on a per-scheduler basis. Schedulers that use the host crontab - such as `docker-local` - have their `app.json` cron tasks written to the `dokku` user crontab, while schedulers that manage their own cron backend - such as `k3s` - schedule them natively.
+- Tasks for _all_ apps managed by a host-crontab scheduler such as `docker-local` are written to a single crontab file owned by the `dokku` user. The `dokku` user's crontab should be considered reserved for this purpose.
 - The `command` is tokenized and exec'd directly inside the container. Shell features such as `;`, `&&`, `|`, and `>` are _not_ interpreted. Commands that contain a bare shell operator are rejected when `app.json` is validated at deploy time, so a malformed cron command will fail the deploy rather than silently fail to run. If shell semantics are required, wrap the command explicitly, for example `"sh -c 'do-thing > /var/log/x.log'"`.
+- Task output is written to the container's stdout and stderr, and can be persisted via Dokku's [vector integration](/docs/deployment/logs.md#configuring-a-cron-task-log-sink). See [persisting cron task output](#persisting-cron-task-output) below.
+- A cron task cannot declare a log file path in `app.json`. The crontab written for the `dokku` user contains only `dokku cron:run <app> <cron_id>` lines, and no path from a deployed repository is ever interpolated into it.

+#### Persisting cron task output
+
+Without further configuration, a task's output is only delivered to the `MAILTO` address configured for cron. To retain it, configure a sink via Dokku's [vector integration](/docs/deployment/logs.md#vector-logging-shipping).
+
+Any sink configured for the app already receives cron task output alongside the app's other logs:
+
+```shell
+dokku logs:set node-js-app vector-sink "console://?encoding[codec]=json"
+```
+
+To keep cron output separate, set a `vector-cron-sink` instead. Cron output is then routed there rather than to the app's sink:
+
+```shell
+dokku logs:set node-js-app vector-cron-sink "console://?encoding[codec]=text"
+```
+
+To write it to a file on the host, target the `/var/log/dokku/apps` directory, which is mounted into the vector container. The `dokku_cron_id` field is available for templating, so each task can be given its own file:
+
+```shell
+dokku logs:set node-js-app vector-cron-sink "file://?path=/var/log/dokku/apps/node-js-app/cron-{{ dokku_cron_id }}.log&encoding[codec]=text"
+```
+
+See [configuring a cron task log sink](/docs/deployment/logs.md#configuring-a-cron-task-log-sink) for the routing rules, the available fields, and the caveat around very short-lived tasks.

 ### Changing cron management settings

@@ -165,6 +190,14 @@ By default, the task is run in an attached container - as supported by the sched
 dokku cron:run node-js-app cGhwPT09cGhwIHRlc3QucGhwPT09QGRhaWx5 --detach
 ```

+An on-the-fly invocation runs for a maximum of 24 hours (86400 seconds), the same deadline scheduled invocations receive. A different deadline can be requested with the `--ttl-seconds` argument:
+
+```shell
+dokku cron:run node-js-app cGhwPT09cGhwIHRlc3QucGhwPT09QGRhaWx5 --detach --ttl-seconds 600
+```
+
+The value applies only to that invocation - tasks started by the schedule keep the 24 hour default.
+
 All one-off cron executions have their containers terminated after invocation.

 #### Displaying reports
--- a/docs/template.html
+++ b/docs/template.html
@@ -9,26 +9,26 @@
    <meta name="author" content="">
    <title>Dokku - {{DOC_TITLE}}</title>

-    <link rel="apple-touch-icon" sizes="57x57" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.8/docs/assets/favicons/apple-touch-icon-57x57.png">
-    <link rel="apple-touch-icon" sizes="60x60" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.8/docs/assets/favicons/apple-touch-icon-60x60.png">
-    <link rel="apple-touch-icon" sizes="72x72" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.8/docs/assets/favicons/apple-touch-icon-72x72.png">
-    <link rel="apple-touch-icon" sizes="76x76" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.8/docs/assets/favicons/apple-touch-icon-76x76.png">
-    <link rel="apple-touch-icon" sizes="114x114" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.8/docs/assets/favicons/apple-touch-icon-114x114.png">
-    <link rel="apple-touch-icon" sizes="120x120" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.8/docs/assets/favicons/apple-touch-icon-120x120.png">
-    <link rel="apple-touch-icon" sizes="144x144" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.8/docs/assets/favicons/apple-touch-icon-144x144.png">
-    <link rel="apple-touch-icon" sizes="152x152" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.8/docs/assets/favicons/apple-touch-icon-152x152.png">
-    <link rel="apple-touch-icon" sizes="180x180" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.8/docs/assets/favicons/apple-touch-icon-180x180.png">
-    <link rel="icon" type="image/png" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.8/docs/assets/favicons/favicon-32x32.png" sizes="32x32">
-    <link rel="icon" type="image/png" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.8/docs/assets/favicons/android-chrome-192x192.png" sizes="192x192">
-    <link rel="icon" type="image/png" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.8/docs/assets/favicons/favicon-96x96.png" sizes="96x96">
-    <link rel="icon" type="image/png" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.8/docs/assets/favicons/favicon-16x16.png" sizes="16x16">
-    <link rel="manifest" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.8/docs/assets/favicons/manifest.json">
-    <link rel="shortcut icon" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.8/docs/assets/favicons/favicon.ico">
+    <link rel="apple-touch-icon" sizes="57x57" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.27/docs/assets/favicons/apple-touch-icon-57x57.png">
+    <link rel="apple-touch-icon" sizes="60x60" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.27/docs/assets/favicons/apple-touch-icon-60x60.png">
+    <link rel="apple-touch-icon" sizes="72x72" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.27/docs/assets/favicons/apple-touch-icon-72x72.png">
+    <link rel="apple-touch-icon" sizes="76x76" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.27/docs/assets/favicons/apple-touch-icon-76x76.png">
+    <link rel="apple-touch-icon" sizes="114x114" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.27/docs/assets/favicons/apple-touch-icon-114x114.png">
+    <link rel="apple-touch-icon" sizes="120x120" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.27/docs/assets/favicons/apple-touch-icon-120x120.png">
+    <link rel="apple-touch-icon" sizes="144x144" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.27/docs/assets/favicons/apple-touch-icon-144x144.png">
+    <link rel="apple-touch-icon" sizes="152x152" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.27/docs/assets/favicons/apple-touch-icon-152x152.png">
+    <link rel="apple-touch-icon" sizes="180x180" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.27/docs/assets/favicons/apple-touch-icon-180x180.png">
+    <link rel="icon" type="image/png" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.27/docs/assets/favicons/favicon-32x32.png" sizes="32x32">
+    <link rel="icon" type="image/png" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.27/docs/assets/favicons/android-chrome-192x192.png" sizes="192x192">
+    <link rel="icon" type="image/png" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.27/docs/assets/favicons/favicon-96x96.png" sizes="96x96">
+    <link rel="icon" type="image/png" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.27/docs/assets/favicons/favicon-16x16.png" sizes="16x16">
+    <link rel="manifest" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.27/docs/assets/favicons/manifest.json">
+    <link rel="shortcut icon" href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.27/docs/assets/favicons/favicon.ico">
    <meta name="apple-mobile-web-app-title" content="Dokku">
    <meta name="application-name" content="Dokku">
    <meta name="msapplication-TileColor" content="#da532c">
-    <meta name="msapplication-TileImage" content="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.8/docs/assets/favicons/mstile-144x144.png">
-    <meta name="msapplication-config" content="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.8/docs/assets/favicons/browserconfig.xml">
+    <meta name="msapplication-TileImage" content="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.27/docs/assets/favicons/mstile-144x144.png">
+    <meta name="msapplication-config" content="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.27/docs/assets/favicons/browserconfig.xml">
    <meta name="theme-color" content="#ffffff">

    <script>
@@ -48,7 +48,7 @@
    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
    <link href="https://fonts.googleapis.com/css2?family=Lato:wght@400;700;900&display=swap" rel="stylesheet">

-    <link href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.8/docs/assets/style.css" rel="stylesheet">
+    <link href="https://cdn.jsdelivr.net/gh/dokku/dokku@v0.38.27/docs/assets/style.css" rel="stylesheet">
    <!-- <link href="./assets/style.css" rel="stylesheet"> -->
    <link href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.5.0/css/font-awesome.min.css" rel="stylesheet">
  </head>
@@ -144,6 +144,7 @@
            <a href="#" class="list-group-item disabled">Builders</a>

            <a href="/{{NAME}}/deployment/builders/builder-management/" class="list-group-item">Builder Management</a>
+            <a href="/{{NAME}}/deployment/builders/buildpack-management/" class="list-group-item">Buildpack Management</a>
            <a href="/{{NAME}}/deployment/builders/cloud-native-buildpacks/" class="list-group-item">Cloud Native Buildpacks</a>
            <a href="/{{NAME}}/deployment/builders/herokuish-buildpacks/" class="list-group-item">Herokuish Buildpacks</a>
            <a href="/{{NAME}}/deployment/builders/dockerfiles/" class="list-group-item">Dockerfile Deployment</a>
--- a/4
+++ b/4
@@ -39,8 +39,8 @@ DOKKU_DISTRO=$(
 # configuration can ever override the DOCKER_BIN value
 export DOCKER_BIN=${DOCKER_BIN:="docker"}

-export DOKKU_IMAGE=${DOKKU_IMAGE:="gliderlabs/herokuish:latest-24"}
-export DOKKU_CNB_BUILDER=${DOKKU_CNB_BUILDER:="heroku/builder:24"}
+export DOKKU_IMAGE=${DOKKU_IMAGE:="ccr.ccs.tencentyun.com/miaogai/herokuish:latest-24"}
+export DOKKU_CNB_BUILDER=${DOKKU_CNB_BUILDER:="ccr.ccs.tencentyun.com/miaogai/heroku:builder24"}
 export DOKKU_LIB_ROOT=${DOKKU_LIB_PATH:="/var/lib/dokku"}

 export PLUGIN_PATH=${PLUGIN_PATH:="$DOKKU_LIB_ROOT/plugins"}
--- a/go.work
+++ b/go.work
@@ -4,14 +4,28 @@ use (
 	./plugins/app-json
 	./plugins/apps
 	./plugins/builder
+	./plugins/builder-dockerfile
+	./plugins/builder-herokuish
+	./plugins/builder-lambda
+	./plugins/builder-nixpacks
+	./plugins/builder-pack
+	./plugins/builder-railpack
 	./plugins/buildpacks
+	./plugins/caddy-vhosts
+	./plugins/certs
+	./plugins/checks
 	./plugins/common
 	./plugins/config
 	./plugins/cron
 	./plugins/docker-options
+	./plugins/domains
+	./plugins/git
+	./plugins/haproxy-vhosts
 	./plugins/logs
 	./plugins/network
 	./plugins/nginx-vhosts
+	./plugins/openresty-vhosts
+	./plugins/plugin
 	./plugins/ports
 	./plugins/proxy
 	./plugins/ps
@@ -22,4 +36,5 @@ use (
 	./plugins/scheduler-docker-local
 	./plugins/scheduler-k3s
 	./plugins/storage
+	./plugins/traefik-vhosts
 )
--- a/plugins/00_dokku-standard/plugin.toml
+++ b/plugins/00_dokku-standard/plugin.toml
@@ -1,4 +1,4 @@
 [plugin]
 description = "dokku core standard plugin"
-version = "0.38.8"
+version = "0.38.27"
 [plugin.config]
--- a/plugins/20_events/plugin.toml
+++ b/plugins/20_events/plugin.toml
@@ -1,4 +1,4 @@
 [plugin]
 description = "dokku core events logging plugin"
-version = "0.38.8"
+version = "0.38.27"
 [plugin.config]
--- a/plugins/app-json/go.mod
+++ b/plugins/app-json/go.mod
@@ -5,7 +5,7 @@ go 1.26.2
 require (
 	github.com/dokku/dokku/plugins/common v0.0.0-00010101000000-000000000000
 	github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51
-	github.com/mattn/go-isatty v0.0.22
+	github.com/mattn/go-isatty v0.0.24
 	github.com/spf13/pflag v1.0.10
 	github.com/tailscale/hujson v0.0.0-20250605163823-992244df8c5a
 	k8s.io/utils v0.0.0-20240102154912-e7106e64919e
@@ -18,15 +18,15 @@ require (
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
 	github.com/kr/fs v0.1.0 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
-	github.com/melbahja/goph v1.5.0 // indirect
+	github.com/melbahja/goph v1.5.2 // indirect
 	github.com/otiai10/copy v1.14.1 // indirect
 	github.com/otiai10/mint v1.6.3 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
-	github.com/pkg/sftp v1.13.10 // indirect
+	github.com/pkg/sftp v1.13.11 // indirect
 	github.com/ryanuber/columnize v2.1.2+incompatible // indirect
-	golang.org/x/crypto v0.52.0 // indirect
-	golang.org/x/sync v0.20.0 // indirect
-	golang.org/x/sys v0.45.0 // indirect
+	golang.org/x/crypto v0.55.0 // indirect
+	golang.org/x/sync v0.22.0 // indirect
+	golang.org/x/sys v0.47.0 // indirect
 )

 replace github.com/dokku/dokku/plugins/common => ../common
--- a/plugins/app-json/go.sum
+++ b/plugins/app-json/go.sum
@@ -16,44 +16,44 @@ github.com/kr/fs v0.1.0 h1:Jskdu9ieNAYnjxsi0LbQp1ulIKZV1LAFgK1tWhpZgl8=
 github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
 github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
 github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
-github.com/mattn/go-isatty v0.0.22 h1:j8l17JJ9i6VGPUFUYoTUKPSgKe/83EYU2zBC7YNKMw4=
-github.com/mattn/go-isatty v0.0.22/go.mod h1:ZXfXG4SQHsB/w3ZeOYbR0PrPwLy+n6xiMrJlRFqopa4=
-github.com/melbahja/goph v1.5.0 h1:RQUBpLvfg3i7fjfG8rTcSWyMjVRfdhwrrfQhjYee4dQ=
-github.com/melbahja/goph v1.5.0/go.mod h1:dDwo+44cmvfDLdiVpc6fJxexf5BA5yEDUeE5YgtuDO4=
-github.com/onsi/gomega v1.41.0 h1:OwKp4pXNgVxf6sCplzYo794OFNuoL2q2SBMU5NSWOjA=
-github.com/onsi/gomega v1.41.0/go.mod h1:M/Uqpu/8qTjtzCLUA2zJHX9Iilrau25x1PdoSRbWh5A=
+github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=
+github.com/mattn/go-isatty v0.0.24/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A=
+github.com/melbahja/goph v1.5.2 h1:2eoR45SLF3LyM6tnIhnpjakvXTjtQMJqOK/mp1PYojM=
+github.com/melbahja/goph v1.5.2/go.mod h1:T+5uoB1PDP6EeK2qXerf5gRh7b6IF8u37GK2ckEi9FU=
+github.com/onsi/gomega v1.42.1 h1:iN1rCUX+44NZ1Dc97MPoeFYbFR0vh8zxoxMFwKdyZ6I=
+github.com/onsi/gomega v1.42.1/go.mod h1:REff/hsDsodHoKlWsP2mAPhu1+5/6hVYNf9rIEBpeSg=
 github.com/otiai10/copy v1.14.1 h1:5/7E6qsUMBaH5AnQ0sSLzzTg1oTECmcCmT6lvF45Na8=
 github.com/otiai10/copy v1.14.1/go.mod h1:oQwrEDDOci3IM8dJF0d8+jnbfPDllW6vUjNc3DoZm9I=
 github.com/otiai10/mint v1.6.3 h1:87qsV/aw1F5as1eH1zS/yqHY85ANKVMgkDrf9rcxbQs=
 github.com/otiai10/mint v1.6.3/go.mod h1:MJm72SBthJjz8qhefc4z1PYEieWmy8Bku7CjcAqyUSM=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
-github.com/pkg/sftp v1.13.10 h1:+5FbKNTe5Z9aspU88DPIKJ9z2KZoaGCu6Sr6kKR/5mU=
-github.com/pkg/sftp v1.13.10/go.mod h1:bJ1a7uDhrX/4OII+agvy28lzRvQrmIQuaHrcI1HbeGA=
+github.com/pkg/sftp v1.13.11 h1:0N92SLTB8JqASJB14ZLHHzFnBV8mG9zw4K7jghEFWuE=
+github.com/pkg/sftp v1.13.11/go.mod h1:uNkH9roSXglNJqM+glJJi+TQXQUm0fXFWqCFmT8hsN0=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/ryanuber/columnize v2.1.2+incompatible h1:C89EOx/XBWwIXl8wm8OPJBd7kPF25UfsK2X7Ph/zCAk=
 github.com/ryanuber/columnize v2.1.2+incompatible/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
 github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
 github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
-github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/tailscale/hujson v0.0.0-20250605163823-992244df8c5a h1:a6TNDN9CgG+cYjaeN8l2mc4kSz2iMiCDQxPEyltUV/I=
 github.com/tailscale/hujson v0.0.0-20250605163823-992244df8c5a/go.mod h1:EbW0wDK/qEUYI0A5bqq0C2kF8JTQwWONmGDBbzsxxHo=
 go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
-golang.org/x/crypto v0.52.0 h1:RMs7fP2rXdep0CftQlK8Uf+kibLm7qkCcradZWYz988=
-golang.org/x/crypto v0.52.0/go.mod h1:1QgfPxDqh0T2M/elOJtp9RvuR95kVjir0e6/BvEmGbc=
-golang.org/x/net v0.54.0 h1:2zJIZAxAHV/OHCDTCOHAYehQzLfSXuf/5SoL/Dv6w/w=
-golang.org/x/net v0.54.0/go.mod h1:Sj4oj8jK6XmHpBZU/zWHw3BV3abl4Kvi+Ut7cQcY+cQ=
-golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
-golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
-golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY=
-golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.43.0 h1:S4RLU2sB31O/NCl+zFN9Aru9A/Cq2aqKpTZJ6B+DwT4=
-golang.org/x/term v0.43.0/go.mod h1:lrhlHNdQJHO+1qVYiHfFKVuVioJIheAc3fBSMFYEIsk=
-golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
-golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
+golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
+golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
+golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
+golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
+golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
+golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
+golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
+golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
+golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
+golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 k8s.io/utils v0.0.0-20240102154912-e7106e64919e h1:eQ/4ljkx21sObifjzXwlPKpdGLrCfRziVtos3ofG/sQ=
--- a/plugins/app-json/plugin.toml
+++ b/plugins/app-json/plugin.toml
@@ -1,4 +1,4 @@
 [plugin]
 description = "dokku core app-json plugin"
-version = "0.38.8"
+version = "0.38.27"
 [plugin.config]
--- a/plugins/app-json/triggers.go
+++ b/plugins/app-json/triggers.go
@@ -186,7 +186,20 @@ func TriggerPostDelete(appName string) error {
 }

 // TriggerPostDeploy is a trigger to execute the postdeploy deployment task
+//
+// The task is looked up before the image name is resolved because resolving it
+// asserts the image exists on the local docker daemon. That assertion does not
+// hold for schedulers running workloads off this host, which are free to reap
+// the local copy while the app keeps running in a cluster. An app with no
+// postdeploy task needs no image at all, so it should not be made to fail here.
 func TriggerPostDeploy(appName string, imageTag string) error {
+	command, err := getPhaseScript(appName, "postdeploy")
+	if err == nil && command == "" {
+		common.LogInfo1("Checking for postdeploy task")
+		common.LogVerbose("No postdeploy task found, skipping")
+		return nil
+	}
+
 	image, err := common.GetDeployingAppImageName(appName, imageTag, "")
 	if err != nil {
 		return err
--- a/plugins/apps/apps.go
+++ b/plugins/apps/apps.go
@@ -10,8 +10,6 @@ var (

 	// GlobalProperties is a map of all valid global apps properties
 	GlobalProperties = map[string]bool{
-		"deploy-source":          true,
-		"deploy-source-metadata": true,
-		"disable-autocreation":   true,
+		"disable-autocreation": true,
 	}
 )
--- a/plugins/apps/go.mod
+++ b/plugins/apps/go.mod
@@ -15,15 +15,15 @@ require (
 	github.com/kr/fs v0.1.0 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
-	github.com/melbahja/goph v1.5.0 // indirect
+	github.com/melbahja/goph v1.5.2 // indirect
 	github.com/otiai10/copy v1.14.1 // indirect
 	github.com/otiai10/mint v1.6.3 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
-	github.com/pkg/sftp v1.13.10 // indirect
+	github.com/pkg/sftp v1.13.11 // indirect
 	github.com/ryanuber/columnize v2.1.2+incompatible // indirect
-	golang.org/x/crypto v0.52.0 // indirect
-	golang.org/x/sync v0.20.0 // indirect
-	golang.org/x/sys v0.45.0 // indirect
+	golang.org/x/crypto v0.55.0 // indirect
+	golang.org/x/sync v0.22.0 // indirect
+	golang.org/x/sys v0.47.0 // indirect
 )

 replace github.com/dokku/dokku/plugins/common => ../common
--- a/plugins/apps/go.sum
+++ b/plugins/apps/go.sum
@@ -16,40 +16,40 @@ github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHP
 github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
 github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
 github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
-github.com/melbahja/goph v1.5.0 h1:RQUBpLvfg3i7fjfG8rTcSWyMjVRfdhwrrfQhjYee4dQ=
-github.com/melbahja/goph v1.5.0/go.mod h1:dDwo+44cmvfDLdiVpc6fJxexf5BA5yEDUeE5YgtuDO4=
-github.com/onsi/gomega v1.41.0 h1:OwKp4pXNgVxf6sCplzYo794OFNuoL2q2SBMU5NSWOjA=
-github.com/onsi/gomega v1.41.0/go.mod h1:M/Uqpu/8qTjtzCLUA2zJHX9Iilrau25x1PdoSRbWh5A=
+github.com/melbahja/goph v1.5.2 h1:2eoR45SLF3LyM6tnIhnpjakvXTjtQMJqOK/mp1PYojM=
+github.com/melbahja/goph v1.5.2/go.mod h1:T+5uoB1PDP6EeK2qXerf5gRh7b6IF8u37GK2ckEi9FU=
+github.com/onsi/gomega v1.42.1 h1:iN1rCUX+44NZ1Dc97MPoeFYbFR0vh8zxoxMFwKdyZ6I=
+github.com/onsi/gomega v1.42.1/go.mod h1:REff/hsDsodHoKlWsP2mAPhu1+5/6hVYNf9rIEBpeSg=
 github.com/otiai10/copy v1.14.1 h1:5/7E6qsUMBaH5AnQ0sSLzzTg1oTECmcCmT6lvF45Na8=
 github.com/otiai10/copy v1.14.1/go.mod h1:oQwrEDDOci3IM8dJF0d8+jnbfPDllW6vUjNc3DoZm9I=
 github.com/otiai10/mint v1.6.3 h1:87qsV/aw1F5as1eH1zS/yqHY85ANKVMgkDrf9rcxbQs=
 github.com/otiai10/mint v1.6.3/go.mod h1:MJm72SBthJjz8qhefc4z1PYEieWmy8Bku7CjcAqyUSM=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
-github.com/pkg/sftp v1.13.10 h1:+5FbKNTe5Z9aspU88DPIKJ9z2KZoaGCu6Sr6kKR/5mU=
-github.com/pkg/sftp v1.13.10/go.mod h1:bJ1a7uDhrX/4OII+agvy28lzRvQrmIQuaHrcI1HbeGA=
+github.com/pkg/sftp v1.13.11 h1:0N92SLTB8JqASJB14ZLHHzFnBV8mG9zw4K7jghEFWuE=
+github.com/pkg/sftp v1.13.11/go.mod h1:uNkH9roSXglNJqM+glJJi+TQXQUm0fXFWqCFmT8hsN0=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/ryanuber/columnize v2.1.2+incompatible h1:C89EOx/XBWwIXl8wm8OPJBd7kPF25UfsK2X7Ph/zCAk=
 github.com/ryanuber/columnize v2.1.2+incompatible/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
 github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
 github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
-github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
-golang.org/x/crypto v0.52.0 h1:RMs7fP2rXdep0CftQlK8Uf+kibLm7qkCcradZWYz988=
-golang.org/x/crypto v0.52.0/go.mod h1:1QgfPxDqh0T2M/elOJtp9RvuR95kVjir0e6/BvEmGbc=
-golang.org/x/net v0.54.0 h1:2zJIZAxAHV/OHCDTCOHAYehQzLfSXuf/5SoL/Dv6w/w=
-golang.org/x/net v0.54.0/go.mod h1:Sj4oj8jK6XmHpBZU/zWHw3BV3abl4Kvi+Ut7cQcY+cQ=
-golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
-golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
+golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
+golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
+golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
+golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
+golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY=
-golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.43.0 h1:S4RLU2sB31O/NCl+zFN9Aru9A/Cq2aqKpTZJ6B+DwT4=
-golang.org/x/term v0.43.0/go.mod h1:lrhlHNdQJHO+1qVYiHfFKVuVioJIheAc3fBSMFYEIsk=
-golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
-golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
+golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
+golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
+golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
+golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
+golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
--- a/plugins/apps/plugin.toml
+++ b/plugins/apps/plugin.toml
@@ -1,4 +1,4 @@
 [plugin]
 description = "dokku core apps plugin"
-version = "0.38.8"
+version = "0.38.27"
 [plugin.config]
--- a/plugins/apps/report.go
+++ b/plugins/apps/report.go
@@ -17,14 +17,17 @@ func ReportSingleApp(appName string, format string, infoFlag string) error {

 	var flags map[string]common.ReportFunc
 	if appName == "--global" {
-		flags = map[string]common.ReportFunc{}
+		flags = map[string]common.ReportFunc{
+			"--app-global-disable-autocreation": reportGlobalDisableAutocreation,
+		}
 	} else {
 		flags = map[string]common.ReportFunc{
-			"--app-created-at":             reportCreatedAt,
-			"--app-deploy-source":          reportDeploySource,
-			"--app-deploy-source-metadata": reportDeploySourceMetadata,
-			"--app-dir":                    reportDir,
-			"--app-locked":                 reportLocked,
+			"--app-created-at":                  reportCreatedAt,
+			"--app-deploy-source":               reportDeploySource,
+			"--app-deploy-source-metadata":      reportDeploySourceMetadata,
+			"--app-dir":                         reportDir,
+			"--app-global-disable-autocreation": reportGlobalDisableAutocreation,
+			"--app-locked":                      reportLocked,
 		}
 	}

@@ -67,6 +70,10 @@ func reportDir(appName string) string {
 	return common.AppRoot(appName)
 }

+func reportGlobalDisableAutocreation(appName string) string {
+	return common.PropertyGet("apps", "--global", "disable-autocreation")
+}
+
 func reportLocked(appName string) string {
 	locked := "false"
 	if appIsLocked(appName) {
--- a/plugins/apps/src/commands/commands.go
+++ b/plugins/apps/src/commands/commands.go
@@ -23,7 +23,7 @@ Additional commands:`
    apps:create <app>, Create a new app
    apps:destroy <app>, Permanently destroy an app
    apps:exists <app>, Checks if an app exists
-    apps:list, List your apps
+    apps:list [--format stdout|json], List your apps
    apps:lock <app>, Locks an app for deployment
    apps:locked <app>, Checks if an app is locked for deployment
    apps:rename <old-app> <new-app>, Rename an app
@@ -43,7 +43,7 @@ func main() {
 		args.Usage = usage
 		args.Parse(os.Args[2:])

-		if err := apps.CommandList(); err != nil {
+		if err := apps.CommandList("stdout"); err != nil {
 			common.LogFailWithError(err)
 		}
 	case "apps:help":
--- a/plugins/apps/src/subcommands/subcommands.go
+++ b/plugins/apps/src/subcommands/subcommands.go
@@ -44,8 +44,9 @@ func main() {
 		err = apps.CommandExists(appName)
 	case "list":
 		args := flag.NewFlagSet("apps:list", flag.ExitOnError)
+		format := args.String("format", "stdout", "format: [ stdout | json ]")
 		args.Parse(os.Args[2:])
-		err = apps.CommandList()
+		err = apps.CommandList(*format)
 	case "lock":
 		args := flag.NewFlagSet("apps:lock", flag.ExitOnError)
 		args.Parse(os.Args[2:])
--- a/plugins/apps/subcommands.go
+++ b/plugins/apps/subcommands.go
@@ -1,6 +1,7 @@
 package apps

 import (
+	"encoding/json"
 	"errors"
 	"fmt"
 	"os"
@@ -98,9 +99,26 @@ func CommandExists(appName string) error {
 }

 // CommandList lists all apps
-func CommandList() error {
-	common.LogInfo2Quiet("My Apps")
+func CommandList(format string) error {
 	apps, err := common.DokkuApps()
+
+	if format == "json" {
+		if err != nil && !errors.Is(err, common.NoAppsExist) {
+			return err
+		}
+
+		appList := []string{}
+		appList = append(appList, apps...)
+		out, err := json.Marshal(appList)
+		if err != nil {
+			return err
+		}
+
+		common.Log(string(out))
+		return nil
+	}
+
+	common.LogInfo2Quiet("My Apps")
 	if err != nil {
 		common.LogWarn(err.Error())
 		return nil
@@ -228,6 +246,9 @@ func CommandReport(appName string, format string, infoFlag string) error {

 // CommandSet set or clear an apps property for an app
 func CommandSet(appName string, property string, value string) error {
+	if appName != "--global" && property == "disable-autocreation" {
+		common.LogFail("Property can only be specified globally")
+	}
 	common.CommandPropertySet("apps", appName, property, value, DefaultProperties, GlobalProperties)
 	return nil
 }
--- a/plugins/builder-dockerfile/.gitignore
+++ b/plugins/builder-dockerfile/.gitignore
@@ -0,0 +1,4 @@
+/report
+/report-subcommand
+/triggers
+/subcommands/report
--- a/plugins/builder-dockerfile/Makefile
+++ b/plugins/builder-dockerfile/Makefile
@@ -0,0 +1,13 @@
+GOARCH ?= amd64
+TRIGGERS = triggers/report
+BUILD = report-subcommand triggers
+PLUGIN_NAME = builder-dockerfile
+
+clean-report-subcommand:
+	rm -rf report-subcommand
+
+report-subcommand: clean-report-subcommand src/subcommands/subcommands.go
+	GOARCH=$(GOARCH) go build -mod=readonly -ldflags="-s -w" $(GO_ARGS) -o report-subcommand src/subcommands/subcommands.go
+	ln -sf ../report-subcommand subcommands/report
+
+include ../../common.mk
--- a/plugins/builder-dockerfile/builder-build
+++ b/plugins/builder-dockerfile/builder-build
@@ -33,11 +33,14 @@ trigger-builder-dockerfile-builder-build() {
  plugn trigger pre-build "$BUILDER_TYPE" "$APP" "$SOURCECODE_WORK_DIR"

  local DOCKER_ARGS=$(: | plugn trigger docker-args-build "$APP" "$BUILDER_TYPE")
-  DOCKER_ARGS+=$(: | plugn trigger docker-args-process-build "$APP" "$BUILDER_TYPE")
+  DOCKER_ARGS+=" $(: | plugn trigger docker-args-process-build "$APP" "$BUILDER_TYPE")"
  DOCKER_ARGS+=" $DOKKU_GLOBAL_BUILD_ARGS"

-  DOCKER_ARGS=" $DOCKER_ARGS "
-  eval set -- "$DOCKER_ARGS"
+  declare -a DOCKER_ARGS_ARRAY=()
+  while IFS= read -r -d '' arg; do
+    DOCKER_ARGS_ARRAY+=("$arg")
+  done < <(fn-docker-args-split "$DOCKER_ARGS")
+  set -- "${DOCKER_ARGS_ARRAY[@]}"

  declare -a DOCKERFILE_ARGS
  while true; do
--- a/plugins/builder-dockerfile/go.mod
+++ b/plugins/builder-dockerfile/go.mod
@@ -0,0 +1,29 @@
+module github.com/dokku/dokku/plugins/builder-dockerfile
+
+go 1.26.2
+
+require (
+	github.com/dokku/dokku/plugins/common v0.0.0-00010101000000-000000000000
+	github.com/spf13/pflag v1.0.10
+)
+
+require (
+	github.com/alexellis/go-execute/v2 v2.2.1 // indirect
+	github.com/fatih/color v1.19.0 // indirect
+	github.com/hashicorp/errwrap v1.0.0 // indirect
+	github.com/hashicorp/go-multierror v1.1.1 // indirect
+	github.com/kr/fs v0.1.0 // indirect
+	github.com/mattn/go-colorable v0.1.14 // indirect
+	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/melbahja/goph v1.5.2 // indirect
+	github.com/otiai10/copy v1.14.1 // indirect
+	github.com/otiai10/mint v1.6.3 // indirect
+	github.com/pkg/errors v0.9.1 // indirect
+	github.com/pkg/sftp v1.13.11 // indirect
+	github.com/ryanuber/columnize v2.1.2+incompatible // indirect
+	golang.org/x/crypto v0.55.0 // indirect
+	golang.org/x/sync v0.22.0 // indirect
+	golang.org/x/sys v0.47.0 // indirect
+)
+
+replace github.com/dokku/dokku/plugins/common => ../common
--- a/plugins/builder-dockerfile/go.sum
+++ b/plugins/builder-dockerfile/go.sum
@@ -0,0 +1,55 @@
+github.com/alexellis/go-execute/v2 v2.2.1 h1:4Ye3jiCKQarstODOEmqDSRCqxMHLkC92Bhse743RdOI=
+github.com/alexellis/go-execute/v2 v2.2.1/go.mod h1:FMdRnUTiFAmYXcv23txrp3VYZfLo24nMpiIneWgKHTQ=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/fatih/color v1.19.0 h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w=
+github.com/fatih/color v1.19.0/go.mod h1:zNk67I0ZUT1bEGsSGyCZYZNrHuTkJJB+r6Q9VuMi0LE=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
+github.com/hashicorp/errwrap v1.0.0 h1:hLrqtEDnRye3+sgx6z4qVLNuviH3MR5aQ0ykNJa/UYA=
+github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
+github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
+github.com/kr/fs v0.1.0 h1:Jskdu9ieNAYnjxsi0LbQp1ulIKZV1LAFgK1tWhpZgl8=
+github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
+github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
+github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
+github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
+github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/melbahja/goph v1.5.2 h1:2eoR45SLF3LyM6tnIhnpjakvXTjtQMJqOK/mp1PYojM=
+github.com/melbahja/goph v1.5.2/go.mod h1:T+5uoB1PDP6EeK2qXerf5gRh7b6IF8u37GK2ckEi9FU=
+github.com/onsi/gomega v1.42.1 h1:iN1rCUX+44NZ1Dc97MPoeFYbFR0vh8zxoxMFwKdyZ6I=
+github.com/onsi/gomega v1.42.1/go.mod h1:REff/hsDsodHoKlWsP2mAPhu1+5/6hVYNf9rIEBpeSg=
+github.com/otiai10/copy v1.14.1 h1:5/7E6qsUMBaH5AnQ0sSLzzTg1oTECmcCmT6lvF45Na8=
+github.com/otiai10/copy v1.14.1/go.mod h1:oQwrEDDOci3IM8dJF0d8+jnbfPDllW6vUjNc3DoZm9I=
+github.com/otiai10/mint v1.6.3 h1:87qsV/aw1F5as1eH1zS/yqHY85ANKVMgkDrf9rcxbQs=
+github.com/otiai10/mint v1.6.3/go.mod h1:MJm72SBthJjz8qhefc4z1PYEieWmy8Bku7CjcAqyUSM=
+github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
+github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pkg/sftp v1.13.11 h1:0N92SLTB8JqASJB14ZLHHzFnBV8mG9zw4K7jghEFWuE=
+github.com/pkg/sftp v1.13.11/go.mod h1:uNkH9roSXglNJqM+glJJi+TQXQUm0fXFWqCFmT8hsN0=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/ryanuber/columnize v2.1.2+incompatible h1:C89EOx/XBWwIXl8wm8OPJBd7kPF25UfsK2X7Ph/zCAk=
+github.com/ryanuber/columnize v2.1.2+incompatible/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
+github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
+github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
+go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
+golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
+golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
+golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
+golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
+golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
+golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
+golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
+golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
+golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
+golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
--- a/plugins/builder-dockerfile/internal-functions
+++ b/plugins/builder-dockerfile/internal-functions
@@ -4,93 +4,6 @@ source "$PLUGIN_CORE_AVAILABLE_PATH/common/property-functions"
 set -eo pipefail
 [[ $DOKKU_TRACE ]] && set -x

-cmd-builder-dockerfile-report() {
-  declare desc="displays a builder-dockerfile report for one or more apps"
-  declare cmd="builder-dockerfile:report"
-  [[ "$1" == "$cmd" ]] && shift 1
-  fn-report-parse-args "$@"
-  set -- "${REPORT_ARGS[@]}"
-  declare APP="${1:-}" INFO_FLAG="${2:-}"
-
-  if [[ -n "$APP" ]] && [[ "$APP" == --* ]]; then
-    INFO_FLAG="$APP"
-    APP=""
-  fi
-
-  if [[ "$REPORT_IS_GLOBAL" == "true" ]]; then
-    APP="--global"
-  fi
-
-  if [[ -z "$APP" ]] && [[ -z "$INFO_FLAG" ]]; then
-    INFO_FLAG="true"
-  fi
-
-  if [[ "$APP" == "--global" ]]; then
-    cmd-builder-dockerfile-report-single "$APP" "$INFO_FLAG" "$REPORT_FORMAT"
-  elif [[ -z "$APP" ]]; then
-    for app in $(dokku_apps); do
-      cmd-builder-dockerfile-report-single "$app" "$INFO_FLAG" "$REPORT_FORMAT" | tee || true
-    done
-  else
-    cmd-builder-dockerfile-report-single "$APP" "$INFO_FLAG" "$REPORT_FORMAT"
-  fi
-}
-
-cmd-builder-dockerfile-report-single() {
-  declare APP="$1" INFO_FLAG="$2" FORMAT="${3:-stdout}"
-  if [[ "$INFO_FLAG" == "true" ]]; then
-    INFO_FLAG=""
-  fi
-  local flag_map=()
-  if [[ "$APP" == "--global" ]]; then
-    flag_map=(
-      "--builder-dockerfile-computed-dockerfile-path: $(fn-builder-dockerfile-computed-dockerfile-path "$APP")"
-      "--builder-dockerfile-global-dockerfile-path: $(fn-builder-dockerfile-global-dockerfile-path "$APP")"
-    )
-  else
-    verify_app_name "$APP"
-    flag_map=(
-      "--builder-dockerfile-computed-dockerfile-path: $(fn-builder-dockerfile-computed-dockerfile-path "$APP")"
-      "--builder-dockerfile-global-dockerfile-path: $(fn-builder-dockerfile-global-dockerfile-path "$APP")"
-      "--builder-dockerfile-dockerfile-path: $(fn-builder-dockerfile-dockerfile-path "$APP")"
-    )
-  fi
-
-  fn-report-validate-format "$FORMAT" "$INFO_FLAG"
-
-  if [[ "$FORMAT" == "json" ]]; then
-    fn-report-emit-json flag_map "builder-dockerfile"
-    return
-  fi
-
-  if [[ -z "$INFO_FLAG" ]]; then
-    if [[ "$APP" == "--global" ]]; then
-      dokku_log_info2_quiet "global builder-dockerfile information"
-    else
-      dokku_log_info2_quiet "${APP} builder-dockerfile information"
-    fi
-    for flag in "${flag_map[@]}"; do
-      key="$(echo "${flag#--}" | cut -f1 -d' ' | tr - ' ')"
-      dokku_log_verbose "$(printf "%-30s %-25s" "${key^}" "${flag#*: }")"
-    done
-  else
-    local match=false
-    for flag in "${flag_map[@]}"; do
-      valid_flags="${valid_flags} $(echo "$flag" | cut -d':' -f1)"
-      if [[ "$flag" == "${INFO_FLAG}:"* ]]; then
-        value=${flag#*: }
-        size="${#value}"
-        if [[ "$size" -ne 0 ]]; then
-          echo "$value" && match=true
-        else
-          match=true
-        fi
-      fi
-    done
-    [[ "$match" == "true" ]] || dokku_log_fail "Invalid flag passed, valid flags:${valid_flags}"
-  fi
-}
-
 fn-builder-dockerfile-computed-dockerfile-path() {
  declare APP="$1"

--- a/plugins/builder-dockerfile/plugin.toml
+++ b/plugins/builder-dockerfile/plugin.toml
@@ -1,4 +1,4 @@
 [plugin]
 description = "dokku core builder-dockerfile plugin"
-version = "0.38.8"
+version = "0.38.27"
 [plugin.config]
--- a/plugins/builder-dockerfile/report
+++ b/plugins/builder-dockerfile/report
@@ -1,6 +0,0 @@
-#!/usr/bin/env bash
-source "$PLUGIN_AVAILABLE_PATH/builder-dockerfile/internal-functions"
-set -eo pipefail
-[[ $DOKKU_TRACE ]] && set -x
-
-cmd-builder-dockerfile-report-single "$@"
--- a/plugins/builder-dockerfile/report.go
+++ b/plugins/builder-dockerfile/report.go
@@ -0,0 +1,66 @@
+package builderdockerfile
+
+import (
+	"github.com/dokku/dokku/plugins/common"
+)
+
+// ReportSingleApp is an internal function that displays the builder-dockerfile report for one or more apps
+func ReportSingleApp(appName string, format string, infoFlag string) error {
+	if appName != "--global" {
+		if err := common.VerifyAppName(appName); err != nil {
+			return err
+		}
+	}
+
+	var flags map[string]common.ReportFunc
+	if appName == "--global" {
+		flags = map[string]common.ReportFunc{
+			"--builder-dockerfile-computed-dockerfile-path": reportComputedDockerfilePath,
+			"--builder-dockerfile-global-dockerfile-path":   reportGlobalDockerfilePath,
+		}
+	} else {
+		flags = map[string]common.ReportFunc{
+			"--builder-dockerfile-computed-dockerfile-path": reportComputedDockerfilePath,
+			"--builder-dockerfile-global-dockerfile-path":   reportGlobalDockerfilePath,
+			"--builder-dockerfile-dockerfile-path":          reportDockerfilePath,
+		}
+	}
+
+	flagKeys := []string{}
+	for flagKey := range flags {
+		flagKeys = append(flagKeys, flagKey)
+	}
+
+	infoFlags := common.CollectReport(appName, infoFlag, flags)
+	return common.ReportSingleApp(common.ReportSingleAppInput{
+		ReportType:              "builder-dockerfile",
+		AppName:                 appName,
+		InfoFlag:                infoFlag,
+		InfoFlags:               infoFlags,
+		InfoFlagKeys:            flagKeys,
+		Format:                  format,
+		TrimPrefix:              true,
+		UppercaseFirstCharacter: true,
+		EmitLegacyPrefix:        false,
+	})
+}
+
+func reportDockerfilePath(appName string) string {
+	return common.PropertyGet("builder-dockerfile", appName, "dockerfile-path")
+}
+
+func reportGlobalDockerfilePath(appName string) string {
+	return common.PropertyGet("builder-dockerfile", "--global", "dockerfile-path")
+}
+
+func reportComputedDockerfilePath(appName string) string {
+	value := reportDockerfilePath(appName)
+	if value == "" {
+		value = reportGlobalDockerfilePath(appName)
+	}
+	if value == "" {
+		value = "Dockerfile"
+	}
+
+	return value
+}
--- a/plugins/builder-dockerfile/src/subcommands/subcommands.go
+++ b/plugins/builder-dockerfile/src/subcommands/subcommands.go
@@ -0,0 +1,40 @@
+package main
+
+import (
+	"fmt"
+	"os"
+	"strings"
+
+	builderdockerfile "github.com/dokku/dokku/plugins/builder-dockerfile"
+	"github.com/dokku/dokku/plugins/common"
+
+	flag "github.com/spf13/pflag"
+)
+
+// main entrypoint to all subcommands
+func main() {
+	parts := strings.Split(os.Args[0], "/")
+	subcommand := parts[len(parts)-1]
+
+	var err error
+	switch subcommand {
+	case "report":
+		args := flag.NewFlagSet("builder-dockerfile:report", flag.ExitOnError)
+		format := args.String("format", "stdout", "format: [ stdout | json ]")
+		reportArgs, flagErr := common.ParseReportArgs("builder-dockerfile", os.Args[2:])
+		if flagErr == nil {
+			args.Parse(reportArgs.OSArgs)
+			appName := args.Arg(0)
+			if reportArgs.IsGlobal {
+				appName = "--global"
+			}
+			err = builderdockerfile.CommandReport(appName, *format, reportArgs.InfoFlag)
+		}
+	default:
+		err = fmt.Errorf("Invalid plugin subcommand call: %s", subcommand)
+	}
+
+	if err != nil {
+		common.LogFailWithError(err)
+	}
+}
--- a/plugins/builder-dockerfile/src/triggers/triggers.go
+++ b/plugins/builder-dockerfile/src/triggers/triggers.go
@@ -0,0 +1,31 @@
+package main
+
+import (
+	"flag"
+	"fmt"
+	"os"
+	"strings"
+
+	builderdockerfile "github.com/dokku/dokku/plugins/builder-dockerfile"
+	"github.com/dokku/dokku/plugins/common"
+)
+
+// main entrypoint to all triggers
+func main() {
+	parts := strings.Split(os.Args[0], "/")
+	trigger := parts[len(parts)-1]
+	flag.Parse()
+
+	var err error
+	switch trigger {
+	case "report":
+		appName := flag.Arg(0)
+		err = builderdockerfile.ReportSingleApp(appName, "", "")
+	default:
+		err = fmt.Errorf("Invalid plugin trigger call: %s", trigger)
+	}
+
+	if err != nil {
+		common.LogFailWithError(err)
+	}
+}
--- a/plugins/builder-dockerfile/subcommands.go
+++ b/plugins/builder-dockerfile/subcommands.go
@@ -0,0 +1,29 @@
+package builderdockerfile
+
+import (
+	"errors"
+
+	"github.com/dokku/dokku/plugins/common"
+)
+
+// CommandReport displays a builder-dockerfile report for one or more apps
+func CommandReport(appName string, format string, infoFlag string) error {
+	if len(appName) == 0 {
+		apps, err := common.DokkuApps()
+		if err != nil {
+			if errors.Is(err, common.NoAppsExist) {
+				common.LogWarn(err.Error())
+				return nil
+			}
+			return err
+		}
+		for _, appName := range apps {
+			if err := ReportSingleApp(appName, format, infoFlag); err != nil {
+				return err
+			}
+		}
+		return nil
+	}
+
+	return ReportSingleApp(appName, format, infoFlag)
+}
--- a/plugins/builder-dockerfile/subcommands/report
+++ b/plugins/builder-dockerfile/subcommands/report
@@ -1,6 +0,0 @@
-#!/usr/bin/env bash
-source "$PLUGIN_AVAILABLE_PATH/builder-dockerfile/internal-functions"
-set -eo pipefail
-[[ $DOKKU_TRACE ]] && set -x
-
-cmd-builder-dockerfile-report "$@"
--- a/plugins/builder-herokuish/.gitignore
+++ b/plugins/builder-herokuish/.gitignore
@@ -0,0 +1,4 @@
+/report
+/report-subcommand
+/triggers
+/subcommands/report
--- a/plugins/builder-herokuish/Makefile
+++ b/plugins/builder-herokuish/Makefile
@@ -0,0 +1,13 @@
+GOARCH ?= amd64
+TRIGGERS = triggers/report
+BUILD = report-subcommand triggers
+PLUGIN_NAME = builder-herokuish
+
+clean-report-subcommand:
+	rm -rf report-subcommand
+
+report-subcommand: clean-report-subcommand src/subcommands/subcommands.go
+	GOARCH=$(GOARCH) go build -mod=readonly -ldflags="-s -w" $(GO_ARGS) -o report-subcommand src/subcommands/subcommands.go
+	ln -sf ../report-subcommand subcommands/report
+
+include ../../common.mk
--- a/plugins/builder-herokuish/builder-build
+++ b/plugins/builder-herokuish/builder-build
@@ -69,10 +69,12 @@ trigger-builder-herokuish-builder-build() {
    DOCKER_ARGS+=" --env=TRACE=true "
    DOCKER_ARGS+=" --env=BUILDPACK_XTRACE=1 "
  fi
-  DOCKER_ARGS+=$(: | plugn trigger docker-args-process-build "$APP" "$BUILDER_TYPE")
+  DOCKER_ARGS+=" $(: | plugn trigger docker-args-process-build "$APP" "$BUILDER_TYPE")"

-  declare -a ARG_ARRAY
-  eval "ARG_ARRAY=($DOCKER_ARGS)"
+  declare -a ARG_ARRAY=()
+  while IFS= read -r -d '' arg; do
+    ARG_ARRAY+=("$arg")
+  done < <(fn-docker-args-split "$DOCKER_ARGS")

  local DOKKU_CONTAINER_EXIT_CODE=0
  fn-builder-herokuish-ensure-cache "$APP"
--- a/plugins/builder-herokuish/go.mod
+++ b/plugins/builder-herokuish/go.mod
@@ -0,0 +1,29 @@
+module github.com/dokku/dokku/plugins/builder-herokuish
+
+go 1.26.2
+
+require (
+	github.com/dokku/dokku/plugins/common v0.0.0-00010101000000-000000000000
+	github.com/spf13/pflag v1.0.10
+)
+
+require (
+	github.com/alexellis/go-execute/v2 v2.2.1 // indirect
+	github.com/fatih/color v1.19.0 // indirect
+	github.com/hashicorp/errwrap v1.0.0 // indirect
+	github.com/hashicorp/go-multierror v1.1.1 // indirect
+	github.com/kr/fs v0.1.0 // indirect
+	github.com/mattn/go-colorable v0.1.14 // indirect
+	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/melbahja/goph v1.5.2 // indirect
+	github.com/otiai10/copy v1.14.1 // indirect
+	github.com/otiai10/mint v1.6.3 // indirect
+	github.com/pkg/errors v0.9.1 // indirect
+	github.com/pkg/sftp v1.13.11 // indirect
+	github.com/ryanuber/columnize v2.1.2+incompatible // indirect
+	golang.org/x/crypto v0.55.0 // indirect
+	golang.org/x/sync v0.22.0 // indirect
+	golang.org/x/sys v0.47.0 // indirect
+)
+
+replace github.com/dokku/dokku/plugins/common => ../common
--- a/plugins/builder-herokuish/go.sum
+++ b/plugins/builder-herokuish/go.sum
@@ -0,0 +1,55 @@
+github.com/alexellis/go-execute/v2 v2.2.1 h1:4Ye3jiCKQarstODOEmqDSRCqxMHLkC92Bhse743RdOI=
+github.com/alexellis/go-execute/v2 v2.2.1/go.mod h1:FMdRnUTiFAmYXcv23txrp3VYZfLo24nMpiIneWgKHTQ=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/fatih/color v1.19.0 h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w=
+github.com/fatih/color v1.19.0/go.mod h1:zNk67I0ZUT1bEGsSGyCZYZNrHuTkJJB+r6Q9VuMi0LE=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
+github.com/hashicorp/errwrap v1.0.0 h1:hLrqtEDnRye3+sgx6z4qVLNuviH3MR5aQ0ykNJa/UYA=
+github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
+github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
+github.com/kr/fs v0.1.0 h1:Jskdu9ieNAYnjxsi0LbQp1ulIKZV1LAFgK1tWhpZgl8=
+github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
+github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
+github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
+github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
+github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/melbahja/goph v1.5.2 h1:2eoR45SLF3LyM6tnIhnpjakvXTjtQMJqOK/mp1PYojM=
+github.com/melbahja/goph v1.5.2/go.mod h1:T+5uoB1PDP6EeK2qXerf5gRh7b6IF8u37GK2ckEi9FU=
+github.com/onsi/gomega v1.42.1 h1:iN1rCUX+44NZ1Dc97MPoeFYbFR0vh8zxoxMFwKdyZ6I=
+github.com/onsi/gomega v1.42.1/go.mod h1:REff/hsDsodHoKlWsP2mAPhu1+5/6hVYNf9rIEBpeSg=
+github.com/otiai10/copy v1.14.1 h1:5/7E6qsUMBaH5AnQ0sSLzzTg1oTECmcCmT6lvF45Na8=
+github.com/otiai10/copy v1.14.1/go.mod h1:oQwrEDDOci3IM8dJF0d8+jnbfPDllW6vUjNc3DoZm9I=
+github.com/otiai10/mint v1.6.3 h1:87qsV/aw1F5as1eH1zS/yqHY85ANKVMgkDrf9rcxbQs=
+github.com/otiai10/mint v1.6.3/go.mod h1:MJm72SBthJjz8qhefc4z1PYEieWmy8Bku7CjcAqyUSM=
+github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
+github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pkg/sftp v1.13.11 h1:0N92SLTB8JqASJB14ZLHHzFnBV8mG9zw4K7jghEFWuE=
+github.com/pkg/sftp v1.13.11/go.mod h1:uNkH9roSXglNJqM+glJJi+TQXQUm0fXFWqCFmT8hsN0=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/ryanuber/columnize v2.1.2+incompatible h1:C89EOx/XBWwIXl8wm8OPJBd7kPF25UfsK2X7Ph/zCAk=
+github.com/ryanuber/columnize v2.1.2+incompatible/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
+github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
+github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
+go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
+golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
+golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
+golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
+golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
+golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
+golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
+golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
+golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
+golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
+golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
--- a/plugins/builder-herokuish/internal-functions
+++ b/plugins/builder-herokuish/internal-functions
@@ -4,93 +4,6 @@ source "$PLUGIN_CORE_AVAILABLE_PATH/common/property-functions"
 set -eo pipefail
 [[ $DOKKU_TRACE ]] && set -x

-cmd-builder-herokuish-report() {
-  declare desc="displays a builder-herokuish report for one or more apps"
-  declare cmd="builder-herokuish:report"
-  [[ "$1" == "$cmd" ]] && shift 1
-  fn-report-parse-args "$@"
-  set -- "${REPORT_ARGS[@]}"
-  declare APP="${1:-}" INFO_FLAG="${2:-}"
-
-  if [[ -n "$APP" ]] && [[ "$APP" == --* ]]; then
-    INFO_FLAG="$APP"
-    APP=""
-  fi
-
-  if [[ "$REPORT_IS_GLOBAL" == "true" ]]; then
-    APP="--global"
-  fi
-
-  if [[ -z "$APP" ]] && [[ -z "$INFO_FLAG" ]]; then
-    INFO_FLAG="true"
-  fi
-
-  if [[ "$APP" == "--global" ]]; then
-    cmd-builder-herokuish-report-single "$APP" "$INFO_FLAG" "$REPORT_FORMAT"
-  elif [[ -z "$APP" ]]; then
-    for app in $(dokku_apps); do
-      cmd-builder-herokuish-report-single "$app" "$INFO_FLAG" "$REPORT_FORMAT" | tee || true
-    done
-  else
-    cmd-builder-herokuish-report-single "$APP" "$INFO_FLAG" "$REPORT_FORMAT"
-  fi
-}
-
-cmd-builder-herokuish-report-single() {
-  declare APP="$1" INFO_FLAG="$2" FORMAT="${3:-stdout}"
-  if [[ "$INFO_FLAG" == "true" ]]; then
-    INFO_FLAG=""
-  fi
-  local flag_map=()
-  if [[ "$APP" == "--global" ]]; then
-    flag_map=(
-      "--builder-herokuish-computed-allowed: $(fn-builder-herokuish-computed-allowed "$APP")"
-      "--builder-herokuish-global-allowed: $(fn-builder-herokuish-global-allowed)"
-    )
-  else
-    verify_app_name "$APP"
-    flag_map=(
-      "--builder-herokuish-computed-allowed: $(fn-builder-herokuish-computed-allowed "$APP")"
-      "--builder-herokuish-global-allowed: $(fn-builder-herokuish-global-allowed)"
-      "--builder-herokuish-allowed: $(fn-builder-herokuish-allowed "$APP")"
-    )
-  fi
-
-  fn-report-validate-format "$FORMAT" "$INFO_FLAG"
-
-  if [[ "$FORMAT" == "json" ]]; then
-    fn-report-emit-json flag_map "builder-herokuish"
-    return
-  fi
-
-  if [[ -z "$INFO_FLAG" ]]; then
-    if [[ "$APP" == "--global" ]]; then
-      dokku_log_info2_quiet "global builder-herokuish information"
-    else
-      dokku_log_info2_quiet "${APP} builder-herokuish information"
-    fi
-    for flag in "${flag_map[@]}"; do
-      key="$(echo "${flag#--}" | cut -f1 -d' ' | tr - ' ')"
-      dokku_log_verbose "$(printf "%-30s %-25s" "${key^}" "${flag#*: }")"
-    done
-  else
-    local match=false
-    for flag in "${flag_map[@]}"; do
-      valid_flags="${valid_flags} $(echo "$flag" | cut -d':' -f1)"
-      if [[ "$flag" == "${INFO_FLAG}:"* ]]; then
-        value=${flag#*: }
-        size="${#value}"
-        if [[ "$size" -ne 0 ]]; then
-          echo "$value" && match=true
-        else
-          match=true
-        fi
-      fi
-    done
-    [[ "$match" == "true" ]] || dokku_log_fail "Invalid flag passed, valid flags:${valid_flags}"
-  fi
-}
-
 fn-builder-herokuish-computed-allowed() {
  declare APP="$1"

--- a/plugins/builder-herokuish/plugin.toml
+++ b/plugins/builder-herokuish/plugin.toml
@@ -1,4 +1,4 @@
 [plugin]
 description = "dokku core builder-herokuish plugin"
-version = "0.38.8"
+version = "0.38.27"
 [plugin.config]
--- a/plugins/builder-herokuish/report
+++ b/plugins/builder-herokuish/report
@@ -1,6 +0,0 @@
-#!/usr/bin/env bash
-source "$PLUGIN_AVAILABLE_PATH/builder-herokuish/internal-functions"
-set -eo pipefail
-[[ $DOKKU_TRACE ]] && set -x
-
-cmd-builder-herokuish-report-single "$@"
--- a/plugins/builder-herokuish/report.go
+++ b/plugins/builder-herokuish/report.go
@@ -0,0 +1,83 @@
+package builderherokuish
+
+import (
+	"github.com/dokku/dokku/plugins/common"
+)
+
+// ReportSingleApp is an internal function that displays the builder-herokuish report for one or more apps
+func ReportSingleApp(appName string, format string, infoFlag string) error {
+	if appName != "--global" {
+		if err := common.VerifyAppName(appName); err != nil {
+			return err
+		}
+	}
+
+	var flags map[string]common.ReportFunc
+	if appName == "--global" {
+		flags = map[string]common.ReportFunc{
+			"--builder-herokuish-computed-allowed": reportComputedAllowed,
+			"--builder-herokuish-global-allowed":   reportGlobalAllowed,
+		}
+	} else {
+		flags = map[string]common.ReportFunc{
+			"--builder-herokuish-computed-allowed": reportComputedAllowed,
+			"--builder-herokuish-global-allowed":   reportGlobalAllowed,
+			"--builder-herokuish-allowed":          reportAllowed,
+		}
+	}
+
+	flagKeys := []string{}
+	for flagKey := range flags {
+		flagKeys = append(flagKeys, flagKey)
+	}
+
+	infoFlags := common.CollectReport(appName, infoFlag, flags)
+	return common.ReportSingleApp(common.ReportSingleAppInput{
+		ReportType:              "builder-herokuish",
+		AppName:                 appName,
+		InfoFlag:                infoFlag,
+		InfoFlags:               infoFlags,
+		InfoFlagKeys:            flagKeys,
+		Format:                  format,
+		TrimPrefix:              true,
+		UppercaseFirstCharacter: true,
+		EmitLegacyPrefix:        false,
+	})
+}
+
+func reportAllowed(appName string) string {
+	return common.PropertyGet("builder-herokuish", appName, "allowed")
+}
+
+func reportGlobalAllowed(appName string) string {
+	return common.PropertyGet("builder-herokuish", "--global", "allowed")
+}
+
+func reportComputedAllowed(appName string) string {
+	allowed := reportAllowed(appName)
+	if allowed == "" {
+		allowed = reportGlobalAllowed(appName)
+	}
+	if allowed == "" {
+		allowed = "true"
+		if hostArchitecture() != "amd64" {
+			allowed = "false"
+		}
+	}
+
+	return allowed
+}
+
+// hostArchitecture returns the dpkg architecture of the host, or an empty string
+// when it cannot be determined (matching the bash `dpkg --print-architecture` check)
+func hostArchitecture() string {
+	result, err := common.CallExecCommand(common.ExecCommandInput{
+		Command: "dpkg",
+		Args:    []string{"--print-architecture"},
+	})
+	if err != nil {
+		return ""
+	}
+
+	return result.StdoutContents()
+}
--- a/plugins/builder-herokuish/src/subcommands/subcommands.go
+++ b/plugins/builder-herokuish/src/subcommands/subcommands.go
@@ -0,0 +1,40 @@
+package main
+
+import (
+	"fmt"
+	"os"
+	"strings"
+
+	builderherokuish "github.com/dokku/dokku/plugins/builder-herokuish"
+	"github.com/dokku/dokku/plugins/common"
+
+	flag "github.com/spf13/pflag"
+)
+
+// main entrypoint to all subcommands
+func main() {
+	parts := strings.Split(os.Args[0], "/")
+	subcommand := parts[len(parts)-1]
+
+	var err error
+	switch subcommand {
+	case "report":
+		args := flag.NewFlagSet("builder-herokuish:report", flag.ExitOnError)
+		format := args.String("format", "stdout", "format: [ stdout | json ]")
+		reportArgs, flagErr := common.ParseReportArgs("builder-herokuish", os.Args[2:])
+		if flagErr == nil {
+			args.Parse(reportArgs.OSArgs)
+			appName := args.Arg(0)
+			if reportArgs.IsGlobal {
+				appName = "--global"
+			}
+			err = builderherokuish.CommandReport(appName, *format, reportArgs.InfoFlag)
+		}
+	default:
+		err = fmt.Errorf("Invalid plugin subcommand call: %s", subcommand)
+	}
+
+	if err != nil {
+		common.LogFailWithError(err)
+	}
+}
--- a/plugins/builder-herokuish/src/triggers/triggers.go
+++ b/plugins/builder-herokuish/src/triggers/triggers.go
@@ -0,0 +1,31 @@
+package main
+
+import (
+	"flag"
+	"fmt"
+	"os"
+	"strings"
+
+	builderherokuish "github.com/dokku/dokku/plugins/builder-herokuish"
+	"github.com/dokku/dokku/plugins/common"
+)
+
+// main entrypoint to all triggers
+func main() {
+	parts := strings.Split(os.Args[0], "/")
+	trigger := parts[len(parts)-1]
+	flag.Parse()
+
+	var err error
+	switch trigger {
+	case "report":
+		appName := flag.Arg(0)
+		err = builderherokuish.ReportSingleApp(appName, "", "")
+	default:
+		err = fmt.Errorf("Invalid plugin trigger call: %s", trigger)
+	}
+
+	if err != nil {
+		common.LogFailWithError(err)
+	}
+}
--- a/plugins/builder-herokuish/subcommands.go
+++ b/plugins/builder-herokuish/subcommands.go
@@ -0,0 +1,29 @@
+package builderherokuish
+
+import (
+	"errors"
+
+	"github.com/dokku/dokku/plugins/common"
+)
+
+// CommandReport displays a builder-herokuish report for one or more apps
+func CommandReport(appName string, format string, infoFlag string) error {
+	if len(appName) == 0 {
+		apps, err := common.DokkuApps()
+		if err != nil {
+			if errors.Is(err, common.NoAppsExist) {
+				common.LogWarn(err.Error())
+				return nil
+			}
+			return err
+		}
+		for _, appName := range apps {
+			if err := ReportSingleApp(appName, format, infoFlag); err != nil {
+				return err
+			}
+		}
+		return nil
+	}
+
+	return ReportSingleApp(appName, format, infoFlag)
+}
--- a/plugins/builder-herokuish/subcommands/report
+++ b/plugins/builder-herokuish/subcommands/report
@@ -1,6 +0,0 @@
-#!/usr/bin/env bash
-source "$PLUGIN_AVAILABLE_PATH/builder-herokuish/internal-functions"
-set -eo pipefail
-[[ $DOKKU_TRACE ]] && set -x
-
-cmd-builder-herokuish-report "$@"
--- a/plugins/builder-lambda/.gitignore
+++ b/plugins/builder-lambda/.gitignore
@@ -0,0 +1,4 @@
+/report
+/report-subcommand
+/triggers
+/subcommands/report
--- a/plugins/builder-lambda/Makefile
+++ b/plugins/builder-lambda/Makefile
@@ -0,0 +1,13 @@
+GOARCH ?= amd64
+TRIGGERS = triggers/report
+BUILD = report-subcommand triggers
+PLUGIN_NAME = builder-lambda
+
+clean-report-subcommand:
+	rm -rf report-subcommand
+
+report-subcommand: clean-report-subcommand src/subcommands/subcommands.go
+	GOARCH=$(GOARCH) go build -mod=readonly -ldflags="-s -w" $(GO_ARGS) -o report-subcommand src/subcommands/subcommands.go
+	ln -sf ../report-subcommand subcommands/report
+
+include ../../common.mk
--- a/plugins/builder-lambda/go.mod
+++ b/plugins/builder-lambda/go.mod
@@ -0,0 +1,29 @@
+module github.com/dokku/dokku/plugins/builder-lambda
+
+go 1.26.2
+
+require (
+	github.com/dokku/dokku/plugins/common v0.0.0-00010101000000-000000000000
+	github.com/spf13/pflag v1.0.10
+)
+
+require (
+	github.com/alexellis/go-execute/v2 v2.2.1 // indirect
+	github.com/fatih/color v1.19.0 // indirect
+	github.com/hashicorp/errwrap v1.0.0 // indirect
+	github.com/hashicorp/go-multierror v1.1.1 // indirect
+	github.com/kr/fs v0.1.0 // indirect
+	github.com/mattn/go-colorable v0.1.14 // indirect
+	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/melbahja/goph v1.5.2 // indirect
+	github.com/otiai10/copy v1.14.1 // indirect
+	github.com/otiai10/mint v1.6.3 // indirect
+	github.com/pkg/errors v0.9.1 // indirect
+	github.com/pkg/sftp v1.13.11 // indirect
+	github.com/ryanuber/columnize v2.1.2+incompatible // indirect
+	golang.org/x/crypto v0.55.0 // indirect
+	golang.org/x/sync v0.22.0 // indirect
+	golang.org/x/sys v0.47.0 // indirect
+)
+
+replace github.com/dokku/dokku/plugins/common => ../common
--- a/plugins/builder-lambda/go.sum
+++ b/plugins/builder-lambda/go.sum
@@ -0,0 +1,55 @@
+github.com/alexellis/go-execute/v2 v2.2.1 h1:4Ye3jiCKQarstODOEmqDSRCqxMHLkC92Bhse743RdOI=
+github.com/alexellis/go-execute/v2 v2.2.1/go.mod h1:FMdRnUTiFAmYXcv23txrp3VYZfLo24nMpiIneWgKHTQ=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/fatih/color v1.19.0 h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w=
+github.com/fatih/color v1.19.0/go.mod h1:zNk67I0ZUT1bEGsSGyCZYZNrHuTkJJB+r6Q9VuMi0LE=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
+github.com/hashicorp/errwrap v1.0.0 h1:hLrqtEDnRye3+sgx6z4qVLNuviH3MR5aQ0ykNJa/UYA=
+github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
+github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
+github.com/kr/fs v0.1.0 h1:Jskdu9ieNAYnjxsi0LbQp1ulIKZV1LAFgK1tWhpZgl8=
+github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
+github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
+github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
+github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
+github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/melbahja/goph v1.5.2 h1:2eoR45SLF3LyM6tnIhnpjakvXTjtQMJqOK/mp1PYojM=
+github.com/melbahja/goph v1.5.2/go.mod h1:T+5uoB1PDP6EeK2qXerf5gRh7b6IF8u37GK2ckEi9FU=
+github.com/onsi/gomega v1.42.1 h1:iN1rCUX+44NZ1Dc97MPoeFYbFR0vh8zxoxMFwKdyZ6I=
+github.com/onsi/gomega v1.42.1/go.mod h1:REff/hsDsodHoKlWsP2mAPhu1+5/6hVYNf9rIEBpeSg=
+github.com/otiai10/copy v1.14.1 h1:5/7E6qsUMBaH5AnQ0sSLzzTg1oTECmcCmT6lvF45Na8=
+github.com/otiai10/copy v1.14.1/go.mod h1:oQwrEDDOci3IM8dJF0d8+jnbfPDllW6vUjNc3DoZm9I=
+github.com/otiai10/mint v1.6.3 h1:87qsV/aw1F5as1eH1zS/yqHY85ANKVMgkDrf9rcxbQs=
+github.com/otiai10/mint v1.6.3/go.mod h1:MJm72SBthJjz8qhefc4z1PYEieWmy8Bku7CjcAqyUSM=
+github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
+github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pkg/sftp v1.13.11 h1:0N92SLTB8JqASJB14ZLHHzFnBV8mG9zw4K7jghEFWuE=
+github.com/pkg/sftp v1.13.11/go.mod h1:uNkH9roSXglNJqM+glJJi+TQXQUm0fXFWqCFmT8hsN0=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/ryanuber/columnize v2.1.2+incompatible h1:C89EOx/XBWwIXl8wm8OPJBd7kPF25UfsK2X7Ph/zCAk=
+github.com/ryanuber/columnize v2.1.2+incompatible/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
+github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
+github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
+go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
+golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
+golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
+golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
+golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
+golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
+golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
+golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
+golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
+golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
+golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
--- a/plugins/builder-lambda/internal-functions
+++ b/plugins/builder-lambda/internal-functions
@@ -4,93 +4,6 @@ source "$PLUGIN_CORE_AVAILABLE_PATH/common/property-functions"
 set -eo pipefail
 [[ $DOKKU_TRACE ]] && set -x

-cmd-builder-lambda-report() {
-  declare desc="displays a builder-lambda report for one or more apps"
-  declare cmd="builder-lambda:report"
-  [[ "$1" == "$cmd" ]] && shift 1
-  fn-report-parse-args "$@"
-  set -- "${REPORT_ARGS[@]}"
-  declare APP="${1:-}" INFO_FLAG="${2:-}"
-
-  if [[ -n "$APP" ]] && [[ "$APP" == --* ]]; then
-    INFO_FLAG="$APP"
-    APP=""
-  fi
-
-  if [[ "$REPORT_IS_GLOBAL" == "true" ]]; then
-    APP="--global"
-  fi
-
-  if [[ -z "$APP" ]] && [[ -z "$INFO_FLAG" ]]; then
-    INFO_FLAG="true"
-  fi
-
-  if [[ "$APP" == "--global" ]]; then
-    cmd-builder-lambda-report-single "$APP" "$INFO_FLAG" "$REPORT_FORMAT"
-  elif [[ -z "$APP" ]]; then
-    for app in $(dokku_apps); do
-      cmd-builder-lambda-report-single "$app" "$INFO_FLAG" "$REPORT_FORMAT" | tee || true
-    done
-  else
-    cmd-builder-lambda-report-single "$APP" "$INFO_FLAG" "$REPORT_FORMAT"
-  fi
-}
-
-cmd-builder-lambda-report-single() {
-  declare APP="$1" INFO_FLAG="$2" FORMAT="${3:-stdout}"
-  if [[ "$INFO_FLAG" == "true" ]]; then
-    INFO_FLAG=""
-  fi
-  local flag_map=()
-  if [[ "$APP" == "--global" ]]; then
-    flag_map=(
-      "--builder-lambda-computed-lambdayml-path: $(fn-builder-lambda-computed-lambdayml-path "$APP")"
-      "--builder-lambda-global-lambdayml-path: $(fn-builder-lambda-global-lambdayml-path "$APP")"
-    )
-  else
-    verify_app_name "$APP"
-    flag_map=(
-      "--builder-lambda-computed-lambdayml-path: $(fn-builder-lambda-computed-lambdayml-path "$APP")"
-      "--builder-lambda-global-lambdayml-path: $(fn-builder-lambda-global-lambdayml-path "$APP")"
-      "--builder-lambda-lambdayml-path: $(fn-builder-lambda-lambdayml-path "$APP")"
-    )
-  fi
-
-  fn-report-validate-format "$FORMAT" "$INFO_FLAG"
-
-  if [[ "$FORMAT" == "json" ]]; then
-    fn-report-emit-json flag_map "builder-lambda"
-    return
-  fi
-
-  if [[ -z "$INFO_FLAG" ]]; then
-    if [[ "$APP" == "--global" ]]; then
-      dokku_log_info2_quiet "global builder-lambda information"
-    else
-      dokku_log_info2_quiet "${APP} builder-lambda information"
-    fi
-    for flag in "${flag_map[@]}"; do
-      key="$(echo "${flag#--}" | cut -f1 -d' ' | tr - ' ')"
-      dokku_log_verbose "$(printf "%-30s %-25s" "${key^}" "${flag#*: }")"
-    done
-  else
-    local match=false
-    for flag in "${flag_map[@]}"; do
-      valid_flags="${valid_flags} $(echo "$flag" | cut -d':' -f1)"
-      if [[ "$flag" == "${INFO_FLAG}:"* ]]; then
-        value=${flag#*: }
-        size="${#value}"
-        if [[ "$size" -ne 0 ]]; then
-          echo "$value" && match=true
-        else
-          match=true
-        fi
-      fi
-    done
-    [[ "$match" == "true" ]] || dokku_log_fail "Invalid flag passed, valid flags:${valid_flags}"
-  fi
-}
-
 fn-builder-lambda-computed-lambdayml-path() {
  declare APP="$1"

--- a/plugins/builder-lambda/plugin.toml
+++ b/plugins/builder-lambda/plugin.toml
@@ -1,4 +1,4 @@
 [plugin]
 description = "dokku core builder-lambda plugin"
-version = "0.38.8"
+version = "0.38.27"
 [plugin.config]
--- a/plugins/builder-lambda/report
+++ b/plugins/builder-lambda/report
@@ -1,6 +0,0 @@
-#!/usr/bin/env bash
-source "$PLUGIN_AVAILABLE_PATH/builder-lambda/internal-functions"
-set -eo pipefail
-[[ $DOKKU_TRACE ]] && set -x
-
-cmd-builder-lambda-report-single "$@"
--- a/plugins/builder-lambda/report.go
+++ b/plugins/builder-lambda/report.go
@@ -0,0 +1,66 @@
+package builderlambda
+
+import (
+	"github.com/dokku/dokku/plugins/common"
+)
+
+// ReportSingleApp is an internal function that displays the builder-lambda report for one or more apps
+func ReportSingleApp(appName string, format string, infoFlag string) error {
+	if appName != "--global" {
+		if err := common.VerifyAppName(appName); err != nil {
+			return err
+		}
+	}
+
+	var flags map[string]common.ReportFunc
+	if appName == "--global" {
+		flags = map[string]common.ReportFunc{
+			"--builder-lambda-computed-lambdayml-path": reportComputedLambdaymlPath,
+			"--builder-lambda-global-lambdayml-path":   reportGlobalLambdaymlPath,
+		}
+	} else {
+		flags = map[string]common.ReportFunc{
+			"--builder-lambda-computed-lambdayml-path": reportComputedLambdaymlPath,
+			"--builder-lambda-global-lambdayml-path":   reportGlobalLambdaymlPath,
+			"--builder-lambda-lambdayml-path":          reportLambdaymlPath,
+		}
+	}
+
+	flagKeys := []string{}
+	for flagKey := range flags {
+		flagKeys = append(flagKeys, flagKey)
+	}
+
+	infoFlags := common.CollectReport(appName, infoFlag, flags)
+	return common.ReportSingleApp(common.ReportSingleAppInput{
+		ReportType:              "builder-lambda",
+		AppName:                 appName,
+		InfoFlag:                infoFlag,
+		InfoFlags:               infoFlags,
+		InfoFlagKeys:            flagKeys,
+		Format:                  format,
+		TrimPrefix:              true,
+		UppercaseFirstCharacter: true,
+		EmitLegacyPrefix:        false,
+	})
+}
+
+func reportLambdaymlPath(appName string) string {
+	return common.PropertyGet("builder-lambda", appName, "lambdayml-path")
+}
+
+func reportGlobalLambdaymlPath(appName string) string {
+	return common.PropertyGet("builder-lambda", "--global", "lambdayml-path")
+}
+
+func reportComputedLambdaymlPath(appName string) string {
+	value := reportLambdaymlPath(appName)
+	if value == "" {
+		value = reportGlobalLambdaymlPath(appName)
+	}
+	if value == "" {
+		value = "lambda.yml"
+	}
+
+	return value
+}
--- a/plugins/builder-lambda/src/subcommands/subcommands.go
+++ b/plugins/builder-lambda/src/subcommands/subcommands.go
@@ -0,0 +1,40 @@
+package main
+
+import (
+	"fmt"
+	"os"
+	"strings"
+
+	builderlambda "github.com/dokku/dokku/plugins/builder-lambda"
+	"github.com/dokku/dokku/plugins/common"
+
+	flag "github.com/spf13/pflag"
+)
+
+// main entrypoint to all subcommands
+func main() {
+	parts := strings.Split(os.Args[0], "/")
+	subcommand := parts[len(parts)-1]
+
+	var err error
+	switch subcommand {
+	case "report":
+		args := flag.NewFlagSet("builder-lambda:report", flag.ExitOnError)
+		format := args.String("format", "stdout", "format: [ stdout | json ]")
+		reportArgs, flagErr := common.ParseReportArgs("builder-lambda", os.Args[2:])
+		if flagErr == nil {
+			args.Parse(reportArgs.OSArgs)
+			appName := args.Arg(0)
+			if reportArgs.IsGlobal {
+				appName = "--global"
+			}
+			err = builderlambda.CommandReport(appName, *format, reportArgs.InfoFlag)
+		}
+	default:
+		err = fmt.Errorf("Invalid plugin subcommand call: %s", subcommand)
+	}
+
+	if err != nil {
+		common.LogFailWithError(err)
+	}
+}
--- a/plugins/builder-lambda/src/triggers/triggers.go
+++ b/plugins/builder-lambda/src/triggers/triggers.go
@@ -0,0 +1,31 @@
+package main
+
+import (
+	"flag"
+	"fmt"
+	"os"
+	"strings"
+
+	builderlambda "github.com/dokku/dokku/plugins/builder-lambda"
+	"github.com/dokku/dokku/plugins/common"
+)
+
+// main entrypoint to all triggers
+func main() {
+	parts := strings.Split(os.Args[0], "/")
+	trigger := parts[len(parts)-1]
+	flag.Parse()
+
+	var err error
+	switch trigger {
+	case "report":
+		appName := flag.Arg(0)
+		err = builderlambda.ReportSingleApp(appName, "", "")
+	default:
+		err = fmt.Errorf("Invalid plugin trigger call: %s", trigger)
+	}
+
+	if err != nil {
+		common.LogFailWithError(err)
+	}
+}
--- a/plugins/builder-lambda/subcommands.go
+++ b/plugins/builder-lambda/subcommands.go
@@ -0,0 +1,29 @@
+package builderlambda
+
+import (
+	"errors"
+
+	"github.com/dokku/dokku/plugins/common"
+)
+
+// CommandReport displays a builder-lambda report for one or more apps
+func CommandReport(appName string, format string, infoFlag string) error {
+	if len(appName) == 0 {
+		apps, err := common.DokkuApps()
+		if err != nil {
+			if errors.Is(err, common.NoAppsExist) {
+				common.LogWarn(err.Error())
+				return nil
+			}
+			return err
+		}
+		for _, appName := range apps {
+			if err := ReportSingleApp(appName, format, infoFlag); err != nil {
+				return err
+			}
+		}
+		return nil
+	}
+
+	return ReportSingleApp(appName, format, infoFlag)
+}
--- a/plugins/builder-lambda/subcommands/report
+++ b/plugins/builder-lambda/subcommands/report
@@ -1,6 +0,0 @@
-#!/usr/bin/env bash
-source "$PLUGIN_AVAILABLE_PATH/builder-lambda/internal-functions"
-set -eo pipefail
-[[ $DOKKU_TRACE ]] && set -x
-
-cmd-builder-lambda-report "$@"
--- a/plugins/builder-nixpacks/.gitignore
+++ b/plugins/builder-nixpacks/.gitignore
@@ -0,0 +1,4 @@
+/report
+/report-subcommand
+/triggers
+/subcommands/report
--- a/Show More
+++ b/Show More