Dokploy / Dokploy/dokploy

Dokploy displaying registry password in server logs (also sent in emails for build failures)

Open
#4,693 7 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug needs-triage🔍
Dominant language
TypeScript
Stars
37.4k
Forks
3k
Avg merge
1d 3h
Merged PRs (30d)
73

Description

To Reproduce
  1. Configure a registry
  2. Deploy an application with rollback configured
  3. Observe that your registry password is visible in plain text in Dokploy's server logs

See image further below for details.

Current vs. Expected behavior

The password should not be visible in plain text in the server logs.

If email notifications is configured for build failures, the password will also appear in the email.

Provide environment information
Not relevant
Which area(s) are affected? (Select all that apply)

Application

Are you deploying the applications where Dokploy is installed or on a remote server?

Same server where Dokploy is installed

Additional context

Example:

dokploy-leaking-registry-password-in-plain-text

  

As an aside, printing the full commands makes the logs look quite confusing - it looks like there are errors present, when in reality it's just the tail-end of the command itself containing error-handling logic.

Will you send a PR to fix it?

Maybe, need help

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by tracing the registry configuration through the rollback deployment path and the build-failure email notification described in the reproduction steps. Confirm where the registry password enters server logs and failure emails; done means it is no longer exposed in either output while the deployment behavior remains intact.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
backend, devops, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.