Coolify 4.4.0

This release adds built in traffic analytics for Traefik and Caddy, experimental support for SQLite as a database, readable container names with a configurable container prefix, third-party secret managers, Cloudflare DNS management, OpenID Connect sign-in, GitHub Actions runners on build servers, and Docker registry logins. It also includes many fixes.

Added

• Traffic analytics for Traefik and Caddy using the new Rust version of sentinel (#11292)
• Sentinel ingests the proxies JSON access logs and stores aggregate rollups only. Raw access logs are rotated on the server.
• Per-server toggle on the new server Analytics page, off by default. Enabling it restarts the proxy and Sentinel. Optional MaxMind license key; GeoIP works without one.
• Views: team dashboard widget, global Analytics page with server and application filters, per-server Analytics page, per-application and per-service Analytics tab.
• Metrics: requests, bandwidth, unique visitors, and p95 latency KPIs with sparklines, requests chart, status-code breakdown, interactive globe with country breakdown, device, path, host, referrer, and browser breakdowns, optional live refresh for the 24h range.
• Settings for top-N, sampling threshold, retention, and GeoIP. Nginx is out of scope.
• Caddy applications and services need a redeploy after the toggle changes so their logging labels are updated. Caddy needs caddy-docker-proxy 2.9 or newer.

• SQLite database (#11992)
• Add SQLite as a standalone database, based on a custom image (peakimages/sqlite).
• Connect a SQLite database to an application or Docker Compose application on the same server in one click. Coolify mounts its data volume, protects connected volumes, and lets you unlink applications.
• Back up and restore SQLite databases, including scheduled backups.

• Container name prefix for generated names (#11704)
• Optional prefix for the generated (rolling update) naming mode, set in the application's container settings or via custom_container_name_prefix in the API. It is slugified, limited to 30 characters, and unique per server. Rolling updates keep working compared to the custom container name (consistent mode) which loses rolling updates.

| | before | after | |---|---|---| | single container app (prefix: shop-api) | k9p2m4x7q1w3e5r6t8y0u2i4-20260908T141530 | shop-api-20260908T141530 | | compose service web (prefix: shop-api) | web-k9p2m4x7q1w3e5r6t8y0u2i4-20260908T141530 | web-shop-api-20260908T141530 |

• Split action buttons (#11409)
• Resource action menus show the primary action as a one-click button with secondary actions in a dropdown. This improves UX as the primary action is now only one click away, rather than two clicks and hidden inside a dropdown menu
• Autofocus on auth forms (#11324)
• Third-party secret managers (#11474)
• Doppler, Infisical, and HashiCorp Vault as secret sources for applications, services, and standalone databases.
• {{vault.KEY}} references are resolved during deployment and database start. Values are never stored in Coolify's database and are redacted from deployment logs.
• Key browsing, bulk import as references, autocomplete, provider validation, and clear deployment errors for missing secrets. Build reuse is skipped when build-time secret references may have changed.
• Team audit log (#11462, #11788)
• Searchable, filterable log of UI, API, MCP, and webhook activity under Team Audit Log, covering resource changes, deployments, backups, proxy controls, membership, token, and integration changes, account security events, and server, application, service, and instance settings.
• Entries show the previous and new value of each changed field under "View changes". Changes are encrypted at rest, and secrets, commands, and configuration content are left out.
• Stores actor, resource, and request context with sensitive metadata redacted. Events are pruned after 90 days.
• Team admins and owners can read events with GET /audit-events in the API.
• Database import API (#11699)
• Import backups into standalone and service databases from an upload, a server path, or S3 storage: POST /databases/{uuid}/imports/uploads, POST /databases/{uuid}/imports, GET /databases/{uuid}/imports/{activity_id}, and the same under /services/{uuid}/databases/{database_uuid}/imports.
• Uploading and starting an import need the write permission. An import from a server path also needs deploy.
• Cloudflare integration tokens (#11359)
• Cloudflare DNS record management (#11699)
• From the application and service Domains pages, Coolify matches hostnames to zones reachable with the team's Cloudflare tokens and creates records pointing at the server.
• Detects records that already point elsewhere and offers a replace action, shows a "Managed by Coolify" badge, and deletes managed records with the domain after confirmation.
• OpenID Connect single sign-on (#10543)
• Sign in and register with any OIDC provider.
• Registration policy per provider: allow or block password registration and user creation, optionally auto-join new users to the Root team.
• Linked SSO identities are shown on the user profile. Provider-managed email addresses cannot be changed in Coolify.
• Microsoft Entra ID: use https://login.microsoftonline.com/<tenant ID>/v2.0 as the issuer URL and add the optional ID token claims email and xms_edov to the app registration. xms_edov counts as a verified email.
• Alpine Linux server support (#6189)
• Add and update alpine based servers with apk.
• Copy environment variable values (#11379)
• Copy resolved values directly from the environment variables page. Shared variables and $SERVICE_* references resolve to their actual value, except references to locked shared variables. Locked variables have no copy button.
• Named volumes (#7591)
• New volume mounts use named Docker volumes instead of host source paths, including on Swarm. New volumes are pre-filled with a resource-based name.
• Existing bind mounts keep their source paths, which are shown read-only.
• Server roles for deployments and builds
• Set a server to Deployments only, Builds only, or Deployments and builds in the server settings or via server_role in the API. The deprecated is_build_server field still works.
• Deployments only servers never build images themselves, and applications on them need a Docker image name.
• Choose per team whether builds fall back to the deployment server when no build server is usable.
• GitHub Actions self-hosted runners (beta) (#12054)
• Builds only servers can run GitHub Actions workflow jobs for an organization GitHub App. Each job gets a new runner container that is removed when the job ends.
• Set labels, parallel runners, CPU and memory limits, the runner image, timeouts, and Docker in jobs (privileged Docker-in-Docker, Sysbox, or none) on the new server GitHub Runners page. The host Docker socket is never mounted.
• Jobs started by pull requests are refused unless you allow them.
• The server role cannot be changed while runners are enabled, and a server can be reserved for runners so it takes no application builds.
• Docker registry logins (#12048)
• The new Registries page and the Registries tab of each server list the registries a server is logged in to and the registries its applications need.
• Log in, update, and log out with presets for Docker Hub, GHCR, GitLab, Google Artifact Registry, Azure ACR, and AWS ECR, or any other registry. Coolify runs docker login on the server and does not store the token.
• API: GET /servers/{uuid}/registries, POST /servers/{uuid}/registries, POST /servers/{uuid}/registries/{registry}/check, and DELETE /servers/{uuid}/registries/{registry}.
• Docker images page (#11689)
• The new server Images page lists every image with its size, age, and the containers that use it, and shows the total and reclaimable disk space. Unused images can be deleted after typing their reference.
• Traefik ACME certificates (#12015)
• View and delete certificates stored in Traefik's acme.json on the new TLS Certificates page in the server's Proxy menu. Deleting does not revoke the certificate, and the server shows that the proxy needs a restart.
• Coolify backs up acme.json before every change and keeps the last 10 backups, which can be restored or deleted on the same page.
• Account deletion (#12088)
• Delete your own account from the profile page. Teams where you are the only member are deleted, you are removed from all other teams, and your API tokens and sessions are revoked.
• Deletion is blocked for the root user, while a team you own alone still has servers, projects, or Git sources, and while a shared team would be left without an admin or owner.
• Preview deployments API
• GET /applications/{uuid}/previews and GET /applications/{uuid}/previews/{pull_request_id} return preview deployments. POST /applications/{uuid}/previews opens or redeploys the preview of a pull request and needs the deploy permission.
• Reopen the live deployment log (#11783)
• Services, databases, and applications show a "Deploying... View log" indicator that reopens the running log. Deploy, Start, or Restart during a running operation reopens the log instead of failing.
• Application settings filter (#11783)
• Filter the application settings sidebar, including sub-pages such as Advanced Proxy.
• Use variables such as ${NETWORK:-coolify} or ${COMPOSE_PROJECT_NAME}_default in Compose network names of applications and services, including a service's networks: list. A network name that is a single variable is added as an editable environment variable.
• Delete a server from its cloud provider (Hetzner, Vultr, or DigitalOcean) through the API with delete_from_provider=true on DELETE /servers/{uuid}. (#12026)
• Give additional users access to the Horizon dashboard with the HORIZON_ALLOWED_EMAILS environment variable (#9354)
• Show pending team invitations on the dashboard.
• Test S3 storages that were marked unusable again every hour, so they become usable on their own once the connection works.
• Generate a random manual webhook secret with one click.
• Show a warning icon on the server Proxy menu when the proxy is not running.
• Link the Healthcheck row in the status summary of applications and databases to the healthcheck page.
• Add a favicon, an Apple touch icon, and a web app manifest.
• Add OAuth settings to auto-join new OAuth users to the root team and to disable password registration while OAuth is on. The login page then shows "Only OAuth registration is enabled."
• Add a shared copy component which is used across resource (#11368)

Changed

• Realtime runs on Laravel Reverb inside the Coolify container, next to the terminal server. The separate coolify-realtime (Soketi) container is no longer used; existing proxy routes and port settings keep working, and a soketi override in docker-compose.custom.yml is still accepted. (#10530, #11935)
• Generated container names use an ISO 8601 timestamp suffix (<uuid>-20260908T141530) instead of HHMMSS plus microseconds (the old suffix is still recognized). (#11702)
• Containers are labelled with coolify.applicationUuid, coolify.serviceUuid, coolify.service.subUuid, and coolify.databaseUuid instead of numeric ID labels. Existing containers keep working and get the new labels on the next deploy or restart.
• Database restores: the import command is read-only, and single-database PostgreSQL restores no longer drop existing objects by default. The new "Replace objects that already exist" option (replace_existing in the API) restores the previous --clean behavior. PostgreSQL archive restores also skip owners and privileges unless "Keep owners and privileges" (keep_owners) is set. (#11699)
• Database restores support PostgreSQL custom and tar archives, MongoDB archives and dump directories, and bz2, xz, and zip files. All-databases MySQL and MariaDB restores can restore users and privileges (restore_mysql_users), and SQLite restores can pick the target file (sqlite_database). The import form shows the exact restore script.
• All OAuth providers are managed from one Settings Authentication page with provider icons and clearer login buttons. (#10543)
• OAuth accounts link to a provider identity, not only to an email. The first OAuth login links the account. To link an existing account, the provider must verify the email, except for accounts without a password that an OAuth login made before this release. New accounts follow the registration settings.
• Each account links to one OAuth provider. If you used two providers with the same email before, use the first one you sign in with after the upgrade.
• If you rename a self-hosted GitLab, Authentik, Clerk, or Zitadel host, or change the Azure tenant, run php artisan oauth:rekey <provider> --from=<old URL or tenant> so linked accounts keep working.
• Authentik 2025.10 and later: to link an existing Coolify account to Authentik, the email scope must return email_verified: true. Add a scope mapping in Authentik under Customization Property Mappings that returns {"email": request.user.email, "email_verified": True}, and use it on the provider instead of the default email mapping.
• OAuth logins ask for the 2FA code if 2FA is on, and SSO users can turn on 2FA without a password.
• Users with a linked OAuth identity confirm destructive actions with the typed confirmation only, without a password.
• The Google "Hosted domain" setting is enforced. * allows any Workspace account.
• Denied OAuth logins show the reason on the login page instead of a generic error.
• Metrics collection settings (collection rate, history retention, push interval) moved from the Sentinel page to the Charts page. The Sentinel custom image is saved with an Apply and restart button instead of autosave. (#11292)