Skip to content

chore(deps): update ghcr.io/kimdre/doco-cd docker tag to v0.120.1 - #613

Open
renovate[bot] wants to merge 1 commit into
devfrom
deps/ghcr.io-kimdre-doco-cd-0.x
Open

chore(deps): update ghcr.io/kimdre/doco-cd docker tag to v0.120.1#613
renovate[bot] wants to merge 1 commit into
devfrom
deps/ghcr.io-kimdre-doco-cd-0.x

Conversation

@renovate

@renovate renovate Bot commented Sep 19, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Update Change
ghcr.io/kimdre/doco-cd minor 0.108.0 → 0.120.1

Release Notes

kimdre/doco-cd (ghcr.io/kimdre/doco-cd)

v0.120.1

Compare Source

What's Changed

Fixed a crash that could occur when concurrent webhook deployments fetched updates into the same Git repository mirror. Git reads now use fresh, lock-scoped repository handles, keeping parallel deployments safe and ensuring each deployment reports the revision it actually deployed.

🌟 Improvements
🐛 Bug Fixes

Full Changelog: kimdre/doco-cd@v0.120.0...v0.120.1

v0.120.0

Compare Source

What's Changed

This update improves deployment safety, concurrency, and performance, especially for repositories with multiple auto-discovered stacks.

Git repositories and OCI sources are now prepared as immutable, content-addressed artifacts. Deployments use a dedicated artifact for each revision instead of a shared mutable working tree. This allows independent stacks to deploy concurrently, while deployments for the same stack remain serialized. Older webhook events are also prevented from overwriting newer deployments.

Source preparation and Git checks are more efficient:

  • Repository artifacts are reused when the repository, reference, and compatible git_depth match.
  • Git change detection and ancestry checks are cached across stacks that use the same revisions.
  • Changed files are detected using Git tree comparisons instead of generating full patches.
  • Compose discovery, SOPS decryption, and reload handling are performed atomically.
  • Legacy repository layouts are migrated automatically during startup.

Read-only pre-deployment work, such as source initialization and change detection, is now handled separately from Docker-mutating deployment work. This allows more preparation tasks to run concurrently without consuming deployment slots.

You can find more information in the artifact storage documentation.

New configuration options
Variable Default Purpose
MAX_CONCURRENT_PREDEPLOYMENTS 8 Maximum number of concurrent read-only pre-deployment operations, including initialization and change detection.
ARTIFACT_GC_ENABLED true Enables cleanup of unreferenced Git revision and OCI digest artifacts.
ARTIFACT_GC_RETENTION_RECORDS 2 Number of recent unreferenced artifacts to keep per repository or artifact.
ARTIFACT_GC_RETENTION_TTL 1m Minimum time older unreferenced artifacts are retained before removal.
ARTIFACT_GC_INTERVAL 10m How often artifact cleanup runs. A sweep also runs at startup.

MAX_CONCURRENT_DEPLOYMENTS continues to control the number of deployments that may perform Docker mutations. MAX_CONCURRENT_PREDEPLOYMENTS controls preparation separately and can be adjusted according to available CPU, network, and storage capacity.

Updating considerations
  • Existing legacy repository data is migrated automatically during startup, no action is required. Allow this migration to finish before triggering new deployments.
  • Do not run multiple doco-cd versions against the same data directory during migration.
  • Artifact garbage collection may remove unreferenced source artifacts and decrypted SOPS material once the retention rules allow it. Increase the retention settings or disable ARTIFACT_GC_ENABLED if older artifacts must remain available.
  • In-flight deployments and artifacts still referenced by running stacks are protected from cleanup, but unreferenced artifacts should not be assumed to remain indefinitely.

[!CAUTION]
Services that write inside the cloned repository with relative bind mounts (inside the doco-cd data directory/volume) will lose their data when the service is re-/deployed from a new artifact revision.
Each artifact revision/version is like a clean, new Git worktree: When doco-cd deploys from a new Git commit or OCI artifact version, it first creates a new artifacts/<revision> worktree directory to deploy from.
If you use Pre- / Post-Deployment Scripts to generate configuration or data, it might be recommended to use named volumes or absolute host paths depending on your use case.

✨ Features
  • feat(source): enable safe parallel deployments with immutable artifacts by @​kimdre in #​1886
🌟 Improvements
  • perf(deploy): optimize deployment preparation and auto-discovered stacks by @​kimdre in #​1887
📦 Dependencies
📚 Miscellaneous
  • docs(wiki): restructure pages and add artifact storage documentation by @​kimdre in #​1890

Full Changelog: kimdre/doco-cd@v0.119.0...v0.120.0

v0.119.0

Compare Source

What's Changed

Encryption
  • Fixed a bug in the SOPS decryption logic which caused some files to stay encrypted after a deployment run.
External Secrets
Job Scheduling
  • Services defined in stop_services now stay stopped correctly while the scheduled job is still running.
✨ Features
🌟 Improvements
🐛 Bug Fixes
  • fix(encryption): prevent SOPS secrets from remaining encrypted by @​kimdre in #​1875
📦 Dependencies
📚 Miscellaneous

New Contributors

Full Changelog: kimdre/doco-cd@v0.118.1...v0.119.0

v0.118.1

Compare Source

What's Changed

🌟 Improvements
  • fix(lock): implement cross-process locking to prevent concurrent write races by @​kimdre in #​1862
📦 Dependencies
📚 Miscellaneous

Full Changelog: kimdre/doco-cd@v0.118.0...v0.118.1

v0.118.0

Compare Source

What's Changed

  • When temporarily stopping services during a job run, doco-CD now honors stop_services grace periods correctly, see Stop timeout behavior in the wiki.
  • Mismatching job source URLs (e.g. different URLs for HTTP and SSH cloning) now get resolved correctly.
🌟 Improvements
  • refactor: replace map with set for value tracking in multiple files by @​kimdre in #​1844
  • fix: prevent concurrent-deployment races in Git auto-discovery and secret decryption by @​kimdre in #​1849
  • fix(scheduler): honor stop_services grace periods by @​kimdre in #​1854
🐛 Bug Fixes
  • fix(scheduler): resolve job source URL mismatch when HTTP/SSH hosts differ by @​kimdre in #​1853
📦 Dependencies

Full Changelog: kimdre/doco-cd@v0.117.1...v0.118.0

v0.117.1

Compare Source

What's Changed

🐛 Bug Fixes
  • fix(encryption): keep decrypted files from every bind-mounted directory by @​chan-mai in #​1837
📦 Dependencies

New Contributors

Full Changelog: kimdre/doco-cd@v0.117.0...v0.117.1

v0.117.0

Compare Source

What's Changed

  • Added a new REST API endpoint for force-recreating an entire Docker Compose project or one selected service while preserving the deployed configuration and metadata, similiar to what the docker compose cli flag --force-recreate does.
    Swarm stacks retain the existing restart action, which already forces service task updates through Swarm's ForceUpdate. Docker Swarm has no distinct --force-recreate operation.
  • When you use webhooks and poll configs with inline deployment configurations together, the webhook request can now fall back to a matching inline deployment config in the poll config. See the wiki for more info.
✨ Features
🌟 Improvements
📦 Dependencies
📚 Miscellaneous
  • ci: add image reference to workflow summary after building Docker image by @​kimdre in #​1828

Full Changelog: kimdre/doco-cd@v0.116.0...v0.117.0

v0.116.0

Compare Source

What's Changed

New in this release:

✨ Features
  • feat(openapi): add OpenAPI documentation with Swagger UI by @​kimdre in #​1795
  • feat(git): add support for user-managed SSH known_hosts file by @​kimdre in #​1806
  • feat(profiling): add Go runtime profiling server and configuration options by @​kimdre in #​1813
🌟 Improvements
🐛 Bug Fixes
  • fix(git): handle repository corruption during fetch and repair empty ref files by @​kimdre in #​1796
  • fix(deploy): compare auto-discovery config semantically by @​kimdre in #​1818
📦 Dependencies
📚 Miscellaneous

Full Changelog: kimdre/doco-cd@v0.115.0...v0.116.0-rc.1

v0.115.0

Compare Source

What's Changed

This release mainly contains code cleanup and refactoring.

Two small things have been added:

  1. Queued webhook events waiting for deployment are shown as "Pending - Queued" in the commit status now. When the deployment starts, the status then changes to "Pending - In Progress".
  2. Added a missing timeout check for long-running Swarm deployments, see the timeout deploy config setting in the wiki.
✨ Features
🌟 Improvements
🐛 Bug Fixes
  • Fix OCI deployment path reconstruction for scheduled runs and cert rotation by @​zyojv in #​1790
📦 Dependencies

Full Changelog: kimdre/doco-cd@v0.114.0...v0.115.0-rc.1

v0.114.0

Compare Source

External Secrets

MCP Server

Added a stateless Model Context Protocol server to allow AI applications/LLMs to communicate directly with doco-cd using provided MCP tools.

Doco-CD exposes the MCP server at POST /mcp using streamable HTTP transport. The endpoint uses the HTTP_PORT and follows doco-cd's TLS configuration.

Enable the server with MCP_ENABLED: true and provide an API secret using API_SECRET or API_SECRET_FILE (see REST API Authentication):

services:
  app:
    environment:
      MCP_ENABLED: "true"
      API_SECRET: your-api-key
Authentication

See the wiki about how to set the correct client configuration for authentication against the MCP server.

Deployment Configuration

If you are using Docker Swarm, you can now configure each deployment, whether doco-cd should deploy as a Compose project or a Swarm stack. Use the new swarm.enabled deploment configuration setting for this.

true deploys a Docker Swarm stack. false deploys a Docker Compose project. When omitted, the Docker context determines the mode (like before). An explicit true fails if the context is not a Swarm manager or DOCKER_SWARM_FEATURES=false.

name: netbird
swarm:
  enabled: false

When the value of enabled changes for a doco-cd-managed deployment, doco-cd migrates the project or stack automatically. Its volumes are retained during this migration.

What's Changed

✨ Features
📦 Dependencies
📚 Miscellaneous
  • docs: enhance Infisical documentation on secret references and permissions by @​kimdre in #​1767

New Contributors

Full Changelog: kimdre/doco-cd@v0.113.0...v0.114.0

v0.113.0

Compare Source

This release adds multi-context support and cleans up deprecated code/features.

🚨 Breaking Changes

1. Job execution mode

The one_shot alias for one_off is no longer supported.
Use one_off instead; one_shot values are rejected.

User actions
  • Change one_shot to one_off in job definitions.
2. Auto-discovery labels

Legacy label formats are retired:

  • cd.doco.deployment.auto_discover
  • cd.doco.deployment.auto_discover.delete
  • cd.doco.deployment.auto_discovery.delete

New deployments use cd.doco.deployment.auto_discovery and the JSON configuration label cd.doco.deployment.auto_discovery.config.

Automatic migration

Existing deployments using legacy auto-discovery labels are migrated automatically:

  • Swarm service labels are converted in place without restarting tasks.
  • Legacy delete settings are preserved in the new JSON configuration label.
  • Standalone containers remain discoverable during the transition and receive the
    current labels on their next deployment.
  • No manual relabeling is required for existing auto-discovered deployments.
3. SSH private keys: Dropped support for PKCS#1 ENCRYPTED PRIVATE KEY

Support is removed because it relied on the deprecated Go x509.DecryptPEMBlock() API. Use modern OpenSSH or unencrypted PEM key formats.

User actions
  • Convert password-protected SSH keys to a supported modern format.

New label to deploy new services in created/stopped state.

Docker Compose services are started automatically after they are created or updated. To let an external tool control a service's lifecycle, set the cd.doco.deployment.autostart service label to false.

services:
  on-demand:
    image: example/on-demand:latest
    labels:
      cd.doco.deployment.autostart: "false"

The label defaults to true. When it is false:

  • A service without an existing container is created but not started.
  • A stopped service remains stopped when it is recreated or updated.
  • A running service is restarted normally when it is recreated or updated.
  • A service that remains stopped is excluded from deployment readiness checks.

More info in the wiki: https://doco.cd/latest/Deploy-Settings/#preserve-a-services-running-state

Multi-Context Support

Added multi-context support for Docker contexts to all subsystems of doco-cd:

  • Deployments (already implemented in an earlier release)
  • Reconciliation
  • Job scheduling
  • Certificate rotation (external secrets)
  • REST API
  • Observability/Prometheus metrics (added new context label)

Project, stack, and scheduled-job endpoints now accept one optional context query parameter. If it is omitted or set to default, the endpoint uses the default Docker context. Named contexts must exist in the Docker CLI context store available to doco-cd. More info in the wiki.

These endpoints return the selected external context name in the X-Doco-CD-Context response header. Their JSON response shapes do not change.

What's Changed

🚨 Breaking Changes
  • refactor!: remove deprecated one_shot alias for jobs, deprecated labels, and PKCS#1 SSH support by @​kimdre in #​1757
✨ Features
🌟 Improvements
  • fix(deploy): allow duplicate project names across different Docker contexts by @​kimdre in #​1729
  • fix(deps): replace github.com/google/uuid package with stdlib uuid by @​kimdre in #​1747
  • fix(migration): handle multiple migration errors and continue processing by @​kimdre in #​1758
📦 Dependencies
📚 Miscellaneous

Full Changelog: kimdre/doco-cd@v0.112.0...v0.113.0

v0.112.0

Compare Source

What's Changed

  • Failed Compose Lifecycle Hooks are now detected and handled correctly.
  • Improved performance for webhooks that got triggered by the same commit SHA as HEAD.
  • Renamed compose files should no longer break their scheduled jobs.
  • Service image refs that change on config-only tag bumps are now reported in notifications.
🌟 Improvements
🐛 Bug Fixes
  • fix(compose): enhance fallback logic for stale compose file labels by @​kimdre in #​1738
📦 Dependencies
📚 Miscellaneous

Full Changelog: kimdre/doco-cd@v0.111.0...v0.112.0

v0.111.0

Compare Source

What's Changed

Polling local Repositories

Some stacks cannot be deployed without a running SCM available (e.g. a self-hosted Gitea/Forgejo instance that should be deployed via doco-cd (hence a chicken-and-egg problem), or a stack that is deployed from a local Git repository that is not hosted on any remote SCM). This release adds support for polling local Git repositories to solve this problem.

Mount the directory containing your local Git repo into the doco-cd container, then use a poll config with the url: value being the absolute path to the Git repo inside the container.

More info in the wiki at Polling Local Filesystem Repositories.

Watcher for local Repositories

In addition to interval-based polling, doco-cd watches the local repository's git directory for changes and triggers a deployment check immediately when new commits land, without waiting for the next interval. This is enabled by default; set watch: false to disable it and rely on interval only. Set interval: 0 (with watch left enabled) to rely on the watcher exclusively, with no periodic fallback polling at all.

See the watch poll option in the wiki.

⚠️ Dotenv parsing changed

.env files (env_files) are now parsed with compose-go's dotenv engine (the same one Docker Compose uses) instead of godotenv. Variables set in one env_files entry are now correctly available for ${VAR} substitution in later entries.

Reference docs:

[!WARNING]
No longer supported / behavior changes:

  • Lowercase/mixed-case ${var} references are no longer left as literal text. Previously, godotenv only expanded UPPERCASE variable names and silently ignored ${lowercase_var}/${MixedCase}, keeping the literal string in the value. These are now interpolated like any other variable — if unset, they resolve to an empty string instead of the original literal text.

If any of your .env files intentionally relied on lowercase ${...} placeholders being left untouched, rename them to avoid the $/${} pattern (e.g. escape with \$) or ensure the referenced variable is actually defined.

[!NOTE]
New/added support:

  • Bash-style default and required-value operators now work inside .env files: ${VAR:-default}, ${VAR-default}, ${VAR:+alt}, ${VAR+alt}, ${VAR:?error}, ${VAR?error}.
  • Bare keys (e.g. a line with just SOME_VAR) now inherit the value from the process environment or an earlier env_files entry.
✨ Features
🌟 Improvements
  • feat(git): implement local filesystem watcher for repository changes by @​kimdre in #​1723
  • fix(compose): switch to compose-go dotenv parser for improved variable resolution by @​kimdre in #​1724
📦 Dependencies

Full Changelog: kimdre/doco-cd@v0.110.1...v0.111.0

v0.110.1

Compare Source

What's Changed

Fixed a bug that caused the job API to not return the last_run_at field anymore.

🐛 Bug Fixes
📦 Dependencies

Full Changelog: kimdre/doco-cd@v0.110.0...v0.110.1

v0.110.0

Compare Source

What's Changed

Direct TLS/SSL Support for web server

Set the new environment variables HTTP_TLS_CERT_FILE and HTTP_TLS_KEY_FILE to enable HTTPS for the API and metrics server, and healthcheck.

OpenBao pki/cert rotartion

Added automatic OpenBao certificate rotation, see the wiki for more info.

Examples

Set these env vars for doco-cd to enable and configure the cert rotation watcher:

CERT_ROTATION_ENABLED=true
CERT_ROTATION_THRESHOLD=72h
CERT_ROTATION_CHECK_INTERVAL=1h

Use pki-role:

external_secrets:
  CERT: "pki-role:pki:my-role:app.example.com"
  • pki-role:certs:myapp-role:myapp.example.com -> Issues a new certificate for the common name myapp.example.com using the myapp-role PKI role in the certs secret engine in the root namespace.
  • pki-role:my-namespace:certs:myapp-role:myapp.example.com -> Same as above but in the my-namespace namespace.

pki-role: issues a fresh certificate and matching private key on deploy. When rotation is enabled, doco-cd will watch the deployed cert’s expiry and redeploy the affected service before it expires.

Use CERT for the certificate and CERT_KEY for the private key in your compose file.

See the OpenBao Provider documentation in the PR.

✨ Features
  • feat(external-secrets): implement automatic certificate rotation for deployments by @​kimdre in #​1690
  • feat(api): add HTTPS support with TLS certificate configuration by @​kimdre in #​1704
🌟 Improvements
🐛 Bug Fixes
📦 Dependencies

❗ Important

✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the 🗡️ dependencies Pull requests that update a dependency file label Sep 19, 2026
@renovate
renovate Bot requested a review from wax911 September 19, 2026 18:55
@anitrend

anitrend Bot commented Sep 19, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

OpenCode Dependabot Risk Review

Schema: local-stack.dependabot-risk.v1

Decision: NEUTRAL
Risk: UNKNOWN
Automerge allowed: false
Update type: unknown
Ecosystem: unknown

Summary

OpenCode did not produce a valid risk classification. Manual review required. Reason: No valid JSON object in OpenCode output.

Changed runtime artifacts

No runtime image changes detected.

Runtime impact

Unknown.

Breaking change assessment

Not assessed because the OpenCode output was missing or invalid.

Required checks

Manual follow-up

  • Review the dependency PR manually.
  • Inspect the workflow logs for OpenCode output or parsing failure.

Sources checked

  • PR diff
  • PR metadata

@anitrend

anitrend Bot commented Sep 19, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

OpenCode risk gate: neutral. Manual review required. Risk: unknown. Reason: OpenCode did not produce a valid risk classification. Manual review required. Reason: No valid JSON object in OpenCode output.

@renovate
renovate Bot force-pushed the deps/ghcr.io-kimdre-doco-cd-0.x branch from 747e274 to 8d64401 Compare September 21, 2026 23:32
@renovate renovate Bot changed the title chore(deps): update ghcr.io/kimdre/doco-cd docker tag to v0.119.0 chore(deps): update ghcr.io/kimdre/doco-cd docker tag to v0.120.1 Sep 21, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@wax911 wax911 Awaiting requested review from wax911

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

🗡️ dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants