chore(deps): update fnsys/dockhand docker tag to v1.0.53

[renovate]

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Update	Change
fnsys/dockhand (source)	patch	v1.0.29 → v1.0.53

---

Release Notes

Finsys/dockhand (fnsys/dockhand)

v1.0.53

Compare Source

What's new in v1.0.53

• 🐛 remove the 1.0.52 PUID change that could alter stack file ownership on upgrade (#​1700, #​1701)

Docker image

docker pull fnsys/dockhand:v1.0.53

Also available as fnsys/dockhand:latest

View on Docker Hub

v1.0.51

Compare Source

What's new in v1.0.51

• ✨ drag to reorder environments (#​1638)
• ✨ drag to reorder tags, and the grid groups follow that order (#​1651)
• 🐛 compose validate no longer reports a volume path built from a variable as undefined (#​1653)
• 🐛 sorting containers by uptime now orders an hour-old container correctly (#​1652)
• 🐛 the vulnerability scan retention schedule saves and reloads correctly
• 🐛 the stack editor no longer re-queries the secret provider while it sits idle (#​1646)
• 🐛 keepass:// and azurekv:// references are recognised in the stack editor
• 🐛 a git stack whose deploy fails is retried on the next sync instead of being marked in sync (#​1660)
• 🐛 the scanner check now finds newer grype and trivy releases, not just a rebuild of the pinned tag (#​1658)
• 🐛 default scanner images bumped to grype v0.119.0 and trivy 0.75.0 (#​1658)
• ✨ containers can be tagged with a dockhand.tags label, with a colour and icon (#​1655)
• ✨ containers optionally show the tags their stack carries (#​1665)
• ✨ drag files onto the file browser to upload them (#​1661, PR#1662, @​Wardrop)
• 🐛 update docker-compose 5.5.1-r2, undici 7.30.0, devalue 5.9.3 and nodemailer 10.0.10 for security fixes

Docker image

docker pull fnsys/dockhand:v1.0.51

Also available as fnsys/dockhand:latest

View on Docker Hub

v1.0.50

Compare Source

What's new in v1.0.50

• ✨ update a container straight from its details view when a newer image is available (#​1588)
• ✨ duplicate a backup schedule to reuse its settings for another destination (#​1578)
• ✨ mark a secret provider as default so new stacks start with it selected (#​1609)
• ✨ optionally skip the login form, and sign out at the identity provider (#​563, #​562, #​1318)
• ✨ dashboard disk usage segments link straight to images, volumes or containers (#​1314)
• ✨ the container file browser opens at the container's working directory (#​1285)
• ✨ mattermost notifications arrive as colour-coded cards, like the discord ones (#​1607)
• ✨ container icons fall back to the image namespace when the name has none (#​1624)
• ✨ tag groups are ordered alphabetically by tag name (#​1625)
• 🐛 oidc sign-in survives a restart and works across multiple replicas (#​1601)
• 🐛 cleaner image scan logs, and the real registry error (#​1486, #​1628, #​1629)
• 🐛 compose validate no longer flags variables a secret provider supplies (#​1621)
• 🐛 updating a container through the API keeps its secondary networks and their aliases
• 🐛 recreating a container no longer reuses its old auto-assigned MAC address (#​1618)
• 🐛 podman's default bridge is no longer shown as an extra network on containers (#​1619)
• 🐛 a scheduled container update clears its pending row, so update all no longer fails on it (#​1632)
• 🐛 image prune no longer times out after 30s when filters are set (#​1630)
• 🐛 exporting an image whose name contains a slash no longer fails (#​1635)
• 🐛 percentage disk warnings are marked as unusable on hosts that report no total (#​1631)
• 🐛 https now starts with certificates that have no subject, like newer let's encrypt ones (#​1622)
• 🐛 dashboard keeps its top containers and recent events after a container event (#​1608)
• 🐛 the secret provider selector is no longer lost on save in the env text view (#​1620)
• 🐛 a git stack .env value can be quoted and refer to another variable (#​1018)
• 🐛 update docker-compose 5.5.1-r1, devalue 5.9.2 and nodemailer 9.1.1 for security fixes

Docker image

docker pull fnsys/dockhand:v1.0.50

Also available as fnsys/dockhand:latest

View on Docker Hub

v1.0.49

Compare Source

What's new in v1.0.49

• 🐛 select-all checkbox shows a partial state, not a full tick, for a partial selection (#​1605)
• 🐛 a long backup no longer crashes the app when its log stream goes quiet (#​1610)
• ✨ tag containers and stacks, then filter and group the grid by tag (#​781, #​870)
• 🐛 removing all of a stack's environment variables no longer leaves stale entries (#​1598)
• 🐛 templates with duplicate names no longer stop the templates page from rendering
• 🐛 the container toolbar no longer clips its buttons on mobile (#​1586)
• 🐛 use webp or png for selfh.st icons that have no svg (#​1596)
• 🐛 don't report a newer version tag that resolves to the image you already run (#​1572)
• 🐛 fix vulnerability scans failing on the containerd image store (#​1569, #​1350)
• 🐛 show CPU and memory for containers on Windows Docker hosts (#​1574)
• 🐛 don't send container died/killed notifications for a container being updated (#​68)
• 🐛 stop, start, restart and remove stacks that use secret providers, e.g. stop-during-backup (#​1579)
• 🐛 check for image updates on a plain-HTTP registry (#​1580)
• 🐛 send you to the login page when your session expires (#​1577)
• 🐛 skip hidden folders like .snapshots when scanning for stacks to adopt (#​1251)
• 🐛 updating a Podman container managed by a systemd Quadlet unit now works (#​1529, #​1559)
• 🐛 option to skip bind mounts when scheduling backups for a whole environment (#​1570)
• 🐛 git stack env vars stay visible in the editor after saving (#​1112)
• ✨ search and filter containers by label (#​1372)
• ✨ editor themes: select from 40 themes with live preview (#​1309)
• ✨ command palette searches stacks and containers across all hosts (#​670)
• ✨ clear a search field with the X button in it (#​1321)
• 🐛 clearing a container's command now reverts it to the image default (#​1489)
• ✨ one-shot container exec API returning stdout, stderr and exit code (#​1380)
• ✨ set and change file ownership in the container file browser (#​224)
• 🐛 cut backup read transactions on S3/B2 by caching the restic index between runs (#​1600)
• 🐛 dashboard no longer flashes zero running containers on a remote host (#​1608)

Docker image

docker pull fnsys/dockhand:v1.0.49

Also available as fnsys/dockhand:latest

View on Docker Hub

v1.0.48

Compare Source

What's new in v1.0.48

• ✨ bulk-delete snapshots, and optionally forget a config's snapshots when you delete it (#​1556)
• ✨ option to choose which stack operations show the full log (#​1558)
• ✨ show the stack icon and name in stack action popups (#​1526)
• 🐛 log in to registries over TLS on remote HTTPS environments (#​1557)
• 🐛 vulnerability scans and alerts show the image tag, not just its digest (#​1528)
• 🐛 resolve secret provider references when restoring a stack from a backup (#​1521)
• 🐛 stop password managers from offering to save stack secret env-var fields (#​1517)
• 🐛 repository stats no longer fail on the backups screen (#​1561)
• 🐛 dashboard image disk usage no longer counts shared layers multiple times (PR#1461, @​omggga)
• ✨ add a docker attach terminal mode (#​1078, PR#1377, @​ivanjx)
• 🐛 stack action buttons show for stopped and freshly created stacks, regression (#​1565)
• 🐛 the update dialog no longer shows an unreleased version as the target (#​1566)
• 🐛 update Go 1.26.8, docker-compose 5.5.0-r5, nodemailer 9.1.0, js-yaml 4.3.2 for security fixes

Docker image

docker pull fnsys/dockhand:v1.0.48

Also available as fnsys/dockhand:latest

View on Docker Hub

v1.0.47

Compare Source

What's new in v1.0.47

• ✨ live compose output during deploys, plus a per-stack deploy history tab (#​506, #​1292, #​1540, PR#1499, @​strausmann)
• 🐛 back up stacks whose folder is bind-mounted over the data volume (#​1533)
• 🐛 backup restore preview now works for view-only roles (#​1534)
• ✨ warn before saving a stack whose compose file location won't survive a container recreate (#​1524)
• 🐛 OpenAPI spec accuracy fixes (#​1531, #​1530, PR#1532, @​strausmann)
• 🐛 "always redeploy" git stacks now force-recreate so config changes take effect (#​1523)
• 🐛 resolve secret references (op://, keepass://, ...) pasted with surrounding quotes (#​1521)
• 🐛 deleting a secret provider now warns which stacks it unbinds (#​1522)
• 🐛 deploy a 1:1-mounted local stack by file so its compose path label is preserved (#​1514)
• 🐛 store the compose path when a stack is created via the API without one (#​1515)
• 🐛 Microsoft Teams (via Workflows) accepts the new Power Automate webhook URL format (#​1512)
• 🐛 container shell sessions each keep their own live terminal when you switch between them (#​1516)
• 🐛 sort container uptimes under a minute correctly instead of tying them (PR#1395, @​wrlee)
• 🐛 load the web manifest through a Cloudflare tunnel by sending credentials (PR#1513, @​Macleykun)
• 🐛 copy the restic password over plain HTTP (#​1488)
• 🐛 scope stack backup snapshots to their own environment (#​1546)
• 🐛 theme defaults in General settings now save and display correctly when auth is on (#​1547)
• ✨ warn when a host's kernel has cgroup memory accounting disabled (#​1549)
• 🐛 self-update no longer fails at the updater step on baseline (old x86_64) images (#​1500)

Docker image

docker pull fnsys/dockhand:v1.0.47

Also available as fnsys/dockhand:latest

View on Docker Hub

v1.0.46

Compare Source

What's new in v1.0.46

• ✨ restart a stack in depends_on order, keeping the same containers (#​1480)
• ✨ allow secret-less git webhooks via the ALLOW_WEBHOOKS_WITHOUT_SECRET env var
• ✨ optional STACKS_DIR flat layout for local stacks (#​514, #​778, PR#1482, @​xd003)
• 🐛 faster incremental backups when multiple stacks share one repository (#​1494)
• 🐛 "disable build cache" no longer errors on deploy (#​1479, PR#1020, @​He-Is-HaZaRdOuS)
• 🐛 test connection on a saved environment without re-entering the token (#​1483)
• 🐛 populate environment variables again finds the repo's .env file (#​1495)
• 🐛 POST /api/stacks honors the target environment in the body (#​1491)
• 🐛 large image scans no longer fail when the scanner log rotates (#​1496)
• 🐛 Compose Validate no longer false-flags a valid env_file (#​1497)
• 🐛 cache app icons in one request so the containers and stacks pages load faster
• 🐛 upgrade svelte to 5.56.10 (#​1476, PR#1477, @​ThanatosDi)
• 🐛 refresh the bundled docker-compose (5.5.0-r2)
• 🐛 stricter per-environment access and permission checks across the API
• 🐛 redact secret values from compose command output and restrict backup restore targets
• 🐛 local-path backup destinations now reject a host path that isn't a Dockhand bind mount (#​1506)
• 🐛 escape $ in env values when generating a compose file from a container (#​1507)
• 🐛 clearer git permission errors that match the credential type (token vs SSH key) (#​1509)

Docker image

docker pull fnsys/dockhand:v1.0.46

Also available as fnsys/dockhand:latest

View on Docker Hub

v1.0.45

Compare Source

⚠️This is important security upgrade with a number of API hardenings.

What's new in v1.0.45

• 🐛 security hardening across the API
• ✨ KeePassXC as a secret provider - pull secrets from a .kdbx via keepassxc-cli, bulk or inline refs (#​1460)
• ✨ compose generated from a container now captures network config and resource limits (#​1464)
• ✨ compose validate flags a service with no healthcheck and a defined-but-unused named volume
• ✨ optional Webhook column on the stacks list with a git stack's webhook id and copy-URL button (#​845)
• ✨ sort by Disk I/O and Net I/O - the header cycles read/write and down/up (#​1111)
• ✨ option to disable the session timeout (#​1302)
• 🐛 pausing or resuming a backup schedule no longer clears the retention policy (#​1462)
• 🐛 emergency script to relocate stack paths after moving DATA_DIR (#​651, #​904)
• 🐛 git stacks can now set a custom icon (#​1473)

Docker image

docker pull fnsys/dockhand:v1.0.45

Also available as fnsys/dockhand:latest

View on Docker Hub

v1.0.44

Compare Source

What's new in v1.0.44

• ✨ generate a compose file from any container - save as new or append to existing stack (#​489)
• ✨ MQTT notification channel - publish events to a broker (#​280)
• ✨ TLS backup repositories with a private CA and optional mutual TLS (#​1451)
• ✨ custom stack and container icons, plus automatic container icons (#​31)
• ✨ Azure Key Vault as a secret provider (bulk pull or inline azurekv:// references)
• ✨ Proton Pass inline references accept vault and item names, not just ids (pass://vault/item/field) (#​1449)
• ✨ branch selector on git stack, with per-stack branch override (#​649, PR#1343, @​brx19)
• ✨ click the update icon in the image column to update a container (#​1435)
• ✨ Pushover notifications can target specific devices (#​1411)
• ✨ keep specific images from being pruned with a dockhand.prune=false label (#​1391)
• 🐛 Infisical secret references now resolve to their value instead of the raw reference (#​1447)
• 🐛 the version-update dialog no longer duplicates the old tag when the running image is digest-pinned (#​1437)
• 🐛 a compose stack with a restarting container now shows a Stop action instead of Start (#​1438)
• 🐛 optimize 1Password API calls on deploy (#​1436)
• 🐛 direct-remote staging pulls the alpine helper image instead of failing when it's missing (#​1442)
• 🐛 Proton Pass secrets now resolve on headless hosts with no system keyring (#​1440)
• 🐛 fix switching an Infisical provider back to a static token (#​1448)
• 🐛 fix backpressure in Docker streaming responses (PR#1445, @​StefanSa)
• 🐛 sort IPv6 subnets and addresses numerically instead of randomly (#​1453)

Docker image

docker pull fnsys/dockhand:v1.0.44

Also available as fnsys/dockhand:latest

View on Docker Hub

v1.0.43

Compare Source

What's new in v1.0.43

• 🐛 registry auth survives an http to https token realm redirect behind a TLS proxy (#​1428)
• 🐛 security: update Go to 1.25.13 (8 HIGH stdlib CVEs) and update docker-compose to 5.5.0
• ✨ Compose validate - a preflight linter & validator for compose files
• ✨ Bitwarden Secrets Manager as a secret provider via an operator-installed bws client (PR#1416, @​StefanSa)
• ✨ Proton Pass as a secret provider via an operator-installed pass-cli client
• ✨ Infisical: Universal Auth (Machine Identity) as well as a static token (#​1398, @​strausmann)
• ✨ detect newer version tags for pinned images and show them as a badge with release notes (#​1176)
• ✨ OpenAPI spec at /api/docs with a Scalar viewer, opt-in via FEAT_API_DOCS (#​814, PR#1342, @​strausmann)
• ✨ Zabbix notification channel via the history.push API (PR#1419, @​snesterkov)
• 🐛 concurrent git syncs sharing an SSH credential no longer fail on a missing temp key (#​1413, PR#1143, @​HoroTW)
• 🐛 backup notifications show a real title and message instead of "undefined" (#​1414)
• 🐛 git stacks accept a compose/env path with a leading slash (#​1355)
• 🐛 container update notifications now fire properly (#​1424)
• 🐛 Infisical: the project ID is optional when using a service token - it's taken from the token (#​1398)
• 🐛 API: adopting a stack rejects a compose path not on Dockhand's filesystem (#​1375)
• 🐛 API: validating a stack's env vars no longer drops the environment id (#​1423)
• 🐛 editing a secret provider no longer wipes its stored token (#​1432)

Docker image

docker pull fnsys/dockhand:v1.0.43

Also available as fnsys/dockhand:latest

View on Docker Hub

v1.0.42

Compare Source

What's new in v1.0.42

• ✨ optional indentation guides in the compose/YAML editor (#​1410)
• ✨ support caddy-docker-proxy labels (#​1390)
• 🐛 updating a compose file over the API now saves it, not just deploys it (#​1383)
• 🐛 reopening the MFA setup screen while MFA is enabled no longer wipes the secret and backup codes (#​1399)
• ✨ upload a Docker image .tar through the UI (docker load) for air-gapped hosts (#​88, #​1389)
• 🐛 stack deploys no longer leak Dockhand's own DOCKER_HOST into services (#​1393)
• ✨ stack secrets from external providers (1Password, HashiCorp Vault, Infisical and Doppler) (PR#1360, @​wintech147, @​GooRoo)
• 🐛 container update no longer fails on Podman when CPU limits are set (#​1381)
• 🐛 container update no longer fails on Podman for containers using userns_mode: keep-id (#​1409)
• 🐛 stack deploy now respects DOCKER_CONFIG when pulling private images (#​1376)
• 🐛 start, stop or restart on Hawser updates its files on the remote host, not only on redeploy (#​1240)
• 🐛 grouped container logs now show one merged timeline sorted by time (#​1406)
• 🐛 multi-arch images no longer show false "update available" (#​1367)

Docker image

docker pull fnsys/dockhand:v1.0.42

Also available as fnsys/dockhand:latest

View on Docker Hub

v1.0.41

Compare Source

What's new in v1.0.41

• ✨ configurable default homepage (#​1354)
• ✨ direct remote environments - remote stacks dir configurable, for putting the whole stack onto the remote
• ✨ S3 backup destinations take an AWS region with a region quick-pick
• ✨ registry browser shows tag size and date for self-hosted registries, loaded on expand (#​876)
• 🐛 activity log times now honor the configured timezone (#​1183)
• 🐛 container updates respect the new image's command/entrypoint (#​1371)
• 🐛 deleting a stack shows which folders will be removed, with a choice to keep/delete folders (#​675)
• 🐛 fixed an LDAP filter parsing issue that could break group-based role assignment with some AD DNs
• 🐛 child containers using network_mode: service/container reconnect when their parent is updated (#​570)
• 🐛 dashboard pending-update count now matches the containers list (#​1006)
• 🐛 more room between settings/editor content and the scrollbar (#​1171)
• 🐛 GitLab and Harbor registries no longer report a misleading auth error when browsing (#​873)
• 🐛 backup volume picker shows every bind mount when two containers share a container path (#​1373)
• 🐛 Google Cloud backup destinations now use a service-account JSON key
• 🐛 backup and restore helper containers no longer emit a "container died" notification when they finish
• 🐛 snapshots from another Dockhand instance sharing the repo now appear as restorable orphans (#​1351)
• 🐛 a stack restored to new locations always keeps its compose file and stays internal (#​1351)
• 🐛 improved restic repository operations log (prune, check, repair index etc.)
• 🐛 Azure Blob destinations no longer fail with 'invalid format' on init
• 🐛 backup destinations now have separate extra backup and restore flags (#​1349)

Docker image

docker pull fnsys/dockhand:v1.0.41

Also available as fnsys/dockhand:latest

View on Docker Hub

v1.0.40

Compare Source

What's new in v1.0.40

• 🐛 git stack stop/down/remove now resolve panel environment variables (#​1313, PR#1339, @​strausmann)
• 🐛 the header clock falls back to the default TZ instead of UTC when the environment has none (#​1340)
• 🐛 deleting a git stack no longer clears a same-named stack's variables on other environments (#​1335)
• 🐛 Pangolin public URLs now default to https, honoring the ssl label (#​1331)
• 🐛 disconnected environments can be deleted without timeout (#​1319, PR#1320, @​Solaris-star)
• ✨ Git stack source badge shows the deployed short commit hash, and git url, branch in tooltip (PR#1325, @​brx19)
• 🐛 container and stack modals are centered with consistent margins, no longer shifting with the sidebar (#​1308)
• 🐛 git stack webhooks now require a configured secret
• 🐛 local-path backup repos now work on a co-located socket-proxy env, and fail loudly on a remote host (#​1316)
• 🐛 restoring a stack from a backup no longer drops its database-backed secret env vars (#​1329)
• 🐛 restoring a stack now recreates it as a internal stack in the stacks dir, not from a tmp path
• 🐛 local-path backups are readable when Dockhand runs with a non-root PUID
• 🐛 bump docker-compose to 5.3.1-r3 (CVE-2026-56852, GHSA-hrxh-6v49-42gf, GHSA-jpjm-c3r5-q96r)
• 🐛 self-update check works on socket-proxy setups (#​1203)

Docker image

docker pull fnsys/dockhand:v1.0.40

Also available as fnsys/dockhand:latest

View on Docker Hub

v1.0.39

Compare Source

What's new in v1.0.39

• 🐛 regression: stacks with relative bind mounts deployment fails (#​1310)
• 🐛 redeploying a stack with pull now clears the dashboard pending-update badge for containers it updated (#​1311)
• 🐛 stack backups no longer fail on deeply nested files whose path exceeds 100 bytes

Docker image

docker pull fnsys/dockhand:v1.0.39

Also available as fnsys/dockhand:latest

View on Docker Hub

v1.0.38

Compare Source

What's new in v1.0.38

• ✨ container/stacks backups (beta), gated with FEAT_BACKUPS_ENABLED
• ✨ view a Git stack's compose YAML and dependency graph read-only by clicking its name (PR#1294, @​nenad)
• 🐛 deploy on a plain internal stack no longer 500s when the request has no body (#​1271)
• 🐛 wider Activity event details modal (#​1277)
• 🐛 container updates refresh image-provided env vars and labels, overrides are kept (#​1226, #​1256)
• 🐛 private repos with a token credential and no username now authenticate (#​1273)
• 🐛 dashboard CPU history no longer spikes past 100% on busy/churny hosts (#​1279)
• 🐛 failed updates (e.g. Docker Hub limits) show a 'check failed' instead of silently reporting no update (#​1255)
• 🐛 git stacks reject uppercase names upfront instead of leaving an orphaned clone (#​1284)
• 🐛 scan all images now covers untagged digest-pinned images instead of skipping them (#​1286)
• 🐛 registry containers stuck on a moved tag are no longer misread as "local" and skipped from updates (#​1288)
• 🐛 bump docker-compose 5.2.0-r0 -> 5.3.1-r1 (CVE-2026-42505)
• 🐛 bump Go 1.25.11 -> 1.25.12 (patches 4 stdlib CVEs)
• 🐛 volume prune now removes named unused volumes, keeping scanner caches (#​1289)
• ✨ DNS_RESULT_ORDER=verbatim enables IPv6 fallback for outbound requests on IPv4-broken hosts (#​1293)
• 🐛 OIDC/network errors now show the underlying cause instead of a bare "fetch failed" (#​1293)
• 🐛 ntfy webhook with a trailing slash on the topic no longer fails with a 404 (#​1300)
• 🐛 stack deploy and git sync notifications now actually fire on real deploys (#​1295)

Docker image

docker pull fnsys/dockhand:v1.0.38

Also available as fnsys/dockhand:latest

View on Docker Hub

v1.0.37

Compare Source

What's new in v1.0.37

• ✨ Prometheus metrics at /metrics for env state and internals, gated by EXPORT_METRICS (#​339)
• ✨ export scan results as SARIF 2.1.0, manual export and API for DefectDojo/Dependency-Track/GitHub (#​415)
• ✨ bump bundled docker-compose to 5.2.0-r0 to clear known CVEs
• ✨ Vulnerabilities dashboard: aggregated CVE findings (#​1038)
• ✨ update container images directly from the Stack view (#​1073)
• ✨ stacks list shows an update indicator for stacks with image updates (#​504)
• 🐛 copying an image to another registry keeps its tag instead of defaulting to latest (#​1243)
• 🐛 more-than-current image re-scans the current image so a stale cached scan doesn't block (#​1022)
• ✨ application logs now include the log level (INFO/WARN/ERROR) in the prefix (#​1166)
• ✨ option to suppress the "What's New" popup (#​1235)
• 🐛 ntfy notifications now forward the email query parameter so ntfy can send email (#​1231)
• ✨ default scanner images bumped to grype v0.115.0 and trivy 0.71.2 (#​1241)
• 🐛 the "Latest" update-check result now stays visible and doesn't revert (#​1019)
• ✨ a stack with container label dockhand.adopt=false excluded from adoption (#​998)
• 🐛 dashboard daemon info shows the real host hostname, not Dockhand's container id (#​1265)
• ✨ file editor prompts to save/discard unsaved changes before closing (#​1264)
• 🐛 GET /api/containers/check-updates now lists pending updates (POST still triggers a check) (#​1266)
• ✨ sidebar menu customizable (order and visibility of items) (#​1252)
• 🐛 activity and audit date filters respect the configured timezone instead of UTC (#​1269)
• ✨ git deploy progress shows the changed files before the deploy starts (#​1260)

Docker image

docker pull fnsys/dockhand:v1.0.37

Also available as fnsys/dockhand:latest

View on Docker Hub

v1.0.36

Compare Source

What's new in v1.0.36

• ✨ sidebar shows an amber update indicator when a newer Dockhand image is available (#​1146)
• 🐛 Tag image modal too narrow for images identified only by SHA (#​1205)
• 🐛 self-hosted ntfy: accept raw tk_... access tokens in ?auth= (#​1209)
• 🐛 dashboard: a single failed DB stats query no longer poisons the whole environment tile (#​1210)
• 🐛 UI dates and times now honor the configured default timezone instead of the browser's timezone (#​1183)
• 🐛 add missing reset-mfa.sh emergency script referenced by the manual (#​1214)
• 🐛 registry browser: copy between registries no longer duplicates the host (#​1220)
• ⚡ published image carries standard OCI annotations (source, url, title, description, vendor, licenses) (#​1217)
• ✨ scanner: configurable network mode and DNS servers for vulnerability scans (#​1219)
• ✨ template tiles now show a Project link that opens the upstream project page (#​1211)
• ⚡ cron picker: hour shows just HH (was HH:00), minute granularity bumped from 15 to 5 (#​1198)
• ✨ grid buttons: configurable size and optional semantic colors (#​1072)
• 🐛 copy buttons (git deploy logs, API tokens) now work over plain HTTP (#​1222)
• 🐛 Podman pod-infra containers no longer trigger update-check warnings (#​1221)
• 🐛 terminal exec works even when the browser sends a cookie with stray % characters (#​1224)

Docker image

docker pull fnsys/dockhand:v1.0.36

Also available as fnsys/dockhand:latest

View on Docker Hub

v1.0.35

Compare Source

What's new in v1.0.35

• ✨ image prune skips Dockhand's scanner images (grype, trivy), configurable (#​625)
• 🐛 "No archive" download format selection not persisted (#​1180)
• 🐛 regression: vulnerability scans on direct-TCP envs (#​1195)
• 🐛 Pangolin labels — recognise the real public-resources / private-resources namespaces (#​2)
• 🐛 healthcheck uses HTTPS probe when HTTPS_MODE=on (#​1191)
• 🐛 shell detection improved for containers with non-standard PATH or shell locations (#​1189)

Docker image

docker pull fnsys/dockhand:v1.0.35

Also available as fnsys/dockhand:latest

View on Docker Hub

v1.0.34

Compare Source

What's new in v1.0.34

[!Important]
This release closes GHSA-f6q3-chhc-4hxm

• ✨ raw file download — no tar wrapping (#​1180)
• 🐛 update modal stuck after closing mid-pull (#​1094)
• 🐛 vulnerability scans on Podman hosts (direct TCP and Hawser) (#​1076)
• 🐛 crash-looping containers now appear in the logs page list (#​227)
• ✨ filter containers by "Update available" (#​1063)
• ✨ show hostname / IP of the selected environment in the top header (#​962)
• ✨ internal auth and validation hardening and dependency bumps
• ✨ Traefik and Pangolin integration — surface proxy URLs on container and stack panels (#​2)
• ✨ release-notes link next to images with updates available (#​538)
• ✨ lifecycle action buttons in the container details modal (#​461)
• ✨ template library — browse and deploy compose templates from configurable sources (#​48)
• 🐛 file browser fails on containers with ls in /usr/sbin (#​1185)

Docker image

docker pull fnsys/dockhand:v1.0.34

Also available as fnsys/dockhand:latest

View on Docker Hub

v1.0.33

Compare Source

What's new in v1.0.33

• ✨ in-place container property updates without restart — restart policy, CPU/memory limits (#​1153)
• ✨ clickable stack badge in container and volume inspect modals (#​1121)
• ✨ clickable stack badge in volumes list row (#​1122)
• ✨ volumes list shows driver_opts type (NFS, CIFS, etc.) with sort and filter (#​1123)
• ✨ Bark iOS notifications (#​1095, PR#1097, @​undirectlookable)
• ✨ Signal notifications via signal-cli-rest-api (#​1099)
• ✨ Apprise passthrough — forward to a self-hosted caronc/apprise-api server (#​1099)
• 🐛 env editor flagged Docker/Compose built-ins as MISSING (#​141)
• 🐛 YAML editor indentation was inconsistent when pressing Enter (#​1156)
• ✨ dockhand.update=false, dockhand.hidden=true and localhost/* images skip registry polling (#​1083)
• 🐛 registry authentication for image pulls (#​1105)
• ✨ native HTTPS listener, off by default (#​1102)
• 🐛 environments stuck "Failed" after VPN/Tailscale tunnel drops until agent restart (#​1160)
• 🐛 health_status events flooding container_events table (#​1165)
• 🐛 git stack sync removes files deleted from the repo (hash-verified) (#​966, #​1162)
• ✨ upload TLS/mTLS certificate files in environment editor (#​125)
• ✨ syntax highlighting for shell, Dockerfile, TOML, INI/conf and .env files in the file browser viewer (#​1055)
• ✨ Animated icons now configurable (#​1169)
• 🐛 stack deploys ignored the env's configured socket path (#​1172)
• 🐛 environment names with characters that break path resolution (e.g. *) are now rejected (#​1179)

Docker image

docker pull fnsys/dockhand:v1.0.33

Also available as fnsys/dockhand:latest

View on Docker Hub

v1.0.32

Compare Source

What's new in v1.0.32

• ✨ container details tweaks: process count, label filter, copy all labels (#​812)
• ✨ log improvements (#​1130)
• 🐛 cleared Resources fields not persisted on container edit (#​1119)
• 🐛 long container names overflowed in activity event details dialog (#​1129)
• 🐛 git stack recreate and start operations ignored Dockhand-stored env vars (#​1132)
• 🐛 dashboard stopped count reset to 0 after refresh for gracefully stopped containers (#​1133)
• 🐛 auto-update preserves runtime -e env and -l label overrides (#​1135)
• 🐛 git stack volume binds resolved to wrong host path when compose was in a subdirectory (#​1139)
• 🐛 git stacks: subdir compose files now find their adjacent env files (#​1136)
• ✨ env editor doesn't flag Docker/Compose built-in variables as unused (#​141)
• ✨ container network mode: share another container's network namespace (#​161)

Docker image

docker pull fnsys/dockhand:v1.0.32

Also available as fnsys/dockhand:latest

View on Docker Hub

v1.0.31

Compare Source

What's new in v1.0.31

• 🐛 502 Bad Gateway behind nginx-based reverse proxies — SvelteKit 2.51+ bloated the Link response header, pinned to 2.50.0 (#​1114)

Docker image

docker pull fnsys/dockhand:v1.0.31

Also available as fnsys/dockhand:latest

View on Docker Hub

v1.0.30

Compare Source

What's new in v1.0.30

• ✨ time range filter for log viewer — filter logs by From/To date and time (#​1068)
• ✨ configurable tail line count in log viewer — choose from 100 to all lines (#​1066)
• ✨ toggleable line numbers in log viewer (#​1067)
• ✨ "some unused" image filter — show images with both used and unused tags for selective cleanup ([#​621](https://redirect.github.com/Finsys/d

[!IMPORTANT]
✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (in timezone Europe/Bratislava)

• Branch creation
  • "after 6am and before 10am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Trivy misconfiguration findings (HIGH + CRITICAL)

✅ No HIGH or CRITICAL misconfigurations detected.

[github-actions]

CVE delta

Net change

Severity	Added	Removed	Net
Critical	0	0	0
High	1	0	+1
Medium	2	0	+2
Low	0	0	0

Changed images: 1 of 3

Per-image detail

fnsys-dockhand-v1.0.53

• Added: C:0 H:1 M:2 L:0
• Removed: C:0 H:0 M:0 L:0
  • [NEW]:
    • CVE-2026-78669 (HIGH) — docker-compose
    • CVE-2026-78663 (MEDIUM) — docker-compose
    • CVE-2026-97032 (MEDIUM) — docker-compose

[wn-mira-org]

Mira PR Walkthrough

Updates the Dockhand Docker image tag from v1.0.29 to v1.0.47 in its Compose configuration. This brings in upstream security hardening, deployment and backup improvements, and numerous bug fixes; the repository change is limited to a one-line dependency update.

Confidence: 4/5   ◉◉◉◉○   Safe pending validation

• The configuration change is narrow, but the intervening releases introduce stricter API permissions and webhook-secret requirements, so existing integrations and basic deployment behavior should be smoke-tested before merging.

1 file reviewed

---

Comment @wn-mira-org help to get the list of available commands and usage tips.