Skip to content

feat(container): update image ghcr.io/kimdre/doco-cd (0.109.2 → 0.114.0) - #1892

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/ghcr.io-kimdre-doco-cd-0.x
Open

feat(container): update image ghcr.io/kimdre/doco-cd (0.109.2 → 0.114.0)#1892
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/ghcr.io-kimdre-doco-cd-0.x

Conversation

@renovate

@renovate renovate Bot commented Aug 20, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Update Change
ghcr.io/kimdre/doco-cd minor 0.109.2 → 0.114.0

Release Notes

kimdre/doco-cd (ghcr.io/kimdre/doco-cd)

v0.114.0

Compare Source

External Secrets

MCP Server

Added a stateless Model Context Protocol server to allow AI applications/LLMs to communicate directly with doco-cd using provided MCP tools.

Doco-CD exposes the MCP server at POST /mcp using streamable HTTP transport. The endpoint uses the HTTP_PORT and follows doco-cd's TLS configuration.

Enable the server with MCP_ENABLED: true and provide an API secret using API_SECRET or API_SECRET_FILE (see REST API Authentication):

services:
  app:
    environment:
      MCP_ENABLED: "true"
      API_SECRET: your-api-key
Authentication

See the wiki about how to set the correct client configuration for authentication against the MCP server.

Deployment Configuration

If you are using Docker Swarm, you can now configure each deployment, whether doco-cd should deploy as a Compose project or a Swarm stack. Use the new swarm.enabled deploment configuration setting for this.

true deploys a Docker Swarm stack. false deploys a Docker Compose project. When omitted, the Docker context determines the mode (like before). An explicit true fails if the context is not a Swarm manager or DOCKER_SWARM_FEATURES=false.

name: netbird
swarm:
  enabled: false

When the value of enabled changes for a doco-cd-managed deployment, doco-cd migrates the project or stack automatically. Its volumes are retained during this migration.

What's Changed

✨ Features
📦 Dependencies
📚 Miscellaneous
  • docs: enhance Infisical documentation on secret references and permissions by @​kimdre in #​1767

New Contributors

Full Changelog: kimdre/doco-cd@v0.113.0...v0.114.0

v0.113.0

Compare Source

This release adds multi-context support and cleans up deprecated code/features.

🚨 Breaking Changes

1. Job execution mode

The one_shot alias for one_off is no longer supported.
Use one_off instead; one_shot values are rejected.

User actions
  • Change one_shot to one_off in job definitions.
2. Auto-discovery labels

Legacy label formats are retired:

  • cd.doco.deployment.auto_discover
  • cd.doco.deployment.auto_discover.delete
  • cd.doco.deployment.auto_discovery.delete

New deployments use cd.doco.deployment.auto_discovery and the JSON configuration label cd.doco.deployment.auto_discovery.config.

Automatic migration

Existing deployments using legacy auto-discovery labels are migrated automatically:

  • Swarm service labels are converted in place without restarting tasks.
  • Legacy delete settings are preserved in the new JSON configuration label.
  • Standalone containers remain discoverable during the transition and receive the
    current labels on their next deployment.
  • No manual relabeling is required for existing auto-discovered deployments.
3. SSH private keys: Dropped support for PKCS#1 ENCRYPTED PRIVATE KEY

Support is removed because it relied on the deprecated Go x509.DecryptPEMBlock() API. Use modern OpenSSH or unencrypted PEM key formats.

User actions
  • Convert password-protected SSH keys to a supported modern format.

New label to deploy new services in created/stopped state.

Docker Compose services are started automatically after they are created or updated. To let an external tool control a service's lifecycle, set the cd.doco.deployment.autostart service label to false.

services:
  on-demand:
    image: example/on-demand:latest
    labels:
      cd.doco.deployment.autostart: "false"

The label defaults to true. When it is false:

  • A service without an existing container is created but not started.
  • A stopped service remains stopped when it is recreated or updated.
  • A running service is restarted normally when it is recreated or updated.
  • A service that remains stopped is excluded from deployment readiness checks.

More info in the wiki: https://doco.cd/latest/Deploy-Settings/#preserve-a-services-running-state

Multi-Context Support

Added multi-context support for Docker contexts to all subsystems of doco-cd:

  • Deployments (already implemented in an earlier release)
  • Reconciliation
  • Job scheduling
  • Certificate rotation (external secrets)
  • REST API
  • Observability/Prometheus metrics (added new context label)

Project, stack, and scheduled-job endpoints now accept one optional context query parameter. If it is omitted or set to default, the endpoint uses the default Docker context. Named contexts must exist in the Docker CLI context store available to doco-cd. More info in the wiki.

These endpoints return the selected external context name in the X-Doco-CD-Context response header. Their JSON response shapes do not change.

What's Changed

🚨 Breaking Changes
  • refactor!: remove deprecated one_shot alias for jobs, deprecated labels, and PKCS#1 SSH support by @​kimdre in #​1757
✨ Features
🌟 Improvements
  • fix(deploy): allow duplicate project names across different Docker contexts by @​kimdre in #​1729
  • fix(deps): replace github.com/google/uuid package with stdlib uuid by @​kimdre in #​1747
  • fix(migration): handle multiple migration errors and continue processing by @​kimdre in #​1758
📦 Dependencies
📚 Miscellaneous

Full Changelog: kimdre/doco-cd@v0.112.0...v0.113.0

v0.112.0

Compare Source

What's Changed

  • Failed Compose Lifecycle Hooks are now detected and handled correctly.
  • Improved performance for webhooks that got triggered by the same commit SHA as HEAD.
  • Renamed compose files should no longer break their scheduled jobs.
  • Service image refs that change on config-only tag bumps are now reported in notifications.
🌟 Improvements
🐛 Bug Fixes
  • fix(compose): enhance fallback logic for stale compose file labels by @​kimdre in #​1738
📦 Dependencies
📚 Miscellaneous

Full Changelog: kimdre/doco-cd@v0.111.0...v0.112.0

v0.111.0

Compare Source

What's Changed

Polling local Repositories

Some stacks cannot be deployed without a running SCM available (e.g. a self-hosted Gitea/Forgejo instance that should be deployed via doco-cd (hence a chicken-and-egg problem), or a stack that is deployed from a local Git repository that is not hosted on any remote SCM). This release adds support for polling local Git repositories to solve this problem.

Mount the directory containing your local Git repo into the doco-cd container, then use a poll config with the url: value being the absolute path to the Git repo inside the container.

More info in the wiki at Polling Local Filesystem Repositories.

Watcher for local Repositories

In addition to interval-based polling, doco-cd watches the local repository's git directory for changes and triggers a deployment check immediately when new commits land, without waiting for the next interval. This is enabled by default; set watch: false to disable it and rely on interval only. Set interval: 0 (with watch left enabled) to rely on the watcher exclusively, with no periodic fallback polling at all.

See the watch poll option in the wiki.

⚠️ Dotenv parsing changed

.env files (env_files) are now parsed with compose-go's dotenv engine (the same one Docker Compose uses) instead of godotenv. Variables set in one env_files entry are now correctly available for ${VAR} substitution in later entries.

Reference docs:

[!WARNING]
No longer supported / behavior changes:

  • Lowercase/mixed-case ${var} references are no longer left as literal text. Previously, godotenv only expanded UPPERCASE variable names and silently ignored ${lowercase_var}/${MixedCase}, keeping the literal string in the value. These are now interpolated like any other variable — if unset, they resolve to an empty string instead of the original literal text.

If any of your .env files intentionally relied on lowercase ${...} placeholders being left untouched, rename them to avoid the $/${} pattern (e.g. escape with \$) or ensure the referenced variable is actually defined.

[!NOTE]
New/added support:

  • Bash-style default and required-value operators now work inside .env files: ${VAR:-default}, ${VAR-default}, ${VAR:+alt}, ${VAR+alt}, ${VAR:?error}, ${VAR?error}.
  • Bare keys (e.g. a line with just SOME_VAR) now inherit the value from the process environment or an earlier env_files entry.
✨ Features
🌟 Improvements
  • feat(git): implement local filesystem watcher for repository changes by @​kimdre in #​1723
  • fix(compose): switch to compose-go dotenv parser for improved variable resolution by @​kimdre in #​1724
📦 Dependencies

Full Changelog: kimdre/doco-cd@v0.110.1...v0.111.0

v0.110.1

Compare Source

What's Changed

Fixed a bug that caused the job API to not return the last_run_at field anymore.

🐛 Bug Fixes
📦 Dependencies

Full Changelog: kimdre/doco-cd@v0.110.0...v0.110.1

v0.110.0

Compare Source

What's Changed

Direct TLS/SSL Support for web server

Set the new environment variables HTTP_TLS_CERT_FILE and HTTP_TLS_KEY_FILE to enable HTTPS for the API and metrics server, and healthcheck.

OpenBao pki/cert rotartion

Added automatic OpenBao certificate rotation, see the wiki for more info.

Examples

Set these env vars for doco-cd to enable and configure the cert rotation watcher:

CERT_ROTATION_ENABLED=true
CERT_ROTATION_THRESHOLD=72h
CERT_ROTATION_CHECK_INTERVAL=1h

Use pki-role:

external_secrets:
  CERT: "pki-role:pki:my-role:app.example.com"
  • pki-role:certs:myapp-role:myapp.example.com -> Issues a new certificate for the common name myapp.example.com using the myapp-role PKI role in the certs secret engine in the root namespace.
  • pki-role:my-namespace:certs:myapp-role:myapp.example.com -> Same as above but in the my-namespace namespace.

pki-role: issues a fresh certificate and matching private key on deploy. When rotation is enabled, doco-cd will watch the deployed cert’s expiry and redeploy the affected service before it expires.

Use CERT for the certificate and CERT_KEY for the private key in your compose file.

See the OpenBao Provider documentation in the PR.

✨ Features
  • feat(external-secrets): implement automatic certificate rotation for deployments by @​kimdre in #​1690
  • feat(api): add HTTPS support with TLS certificate configuration by @​kimdre in #​1704
🌟 Improvements
🐛 Bug Fixes
📦 Dependencies
📚 Miscellaneous

Full Changelog: kimdre/doco-cd@v0.109.2...v0.110.0

Configuration

📅 Schedule: (in timezone Europe/Berlin)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot changed the title feat(container): update image ghcr.io/kimdre/doco-cd (0.109.2 → 0.110.0) feat(container): update image ghcr.io/kimdre/doco-cd (0.109.2 → 0.110.1) Aug 21, 2026
@renovate
renovate Bot force-pushed the renovate/ghcr.io-kimdre-doco-cd-0.x branch 2 times, most recently from a6f10d6 to 403e077 Compare August 22, 2026 22:54
@renovate renovate Bot changed the title feat(container): update image ghcr.io/kimdre/doco-cd (0.109.2 → 0.110.1) feat(container): update image ghcr.io/kimdre/doco-cd (0.109.2 → 0.111.0) Aug 22, 2026
@renovate
renovate Bot force-pushed the renovate/ghcr.io-kimdre-doco-cd-0.x branch from 403e077 to 0276ef7 Compare August 25, 2026 17:48
@renovate renovate Bot changed the title feat(container): update image ghcr.io/kimdre/doco-cd (0.109.2 → 0.111.0) feat(container): update image ghcr.io/kimdre/doco-cd (0.109.2 → 0.112.0) Aug 25, 2026
@renovate
renovate Bot force-pushed the renovate/ghcr.io-kimdre-doco-cd-0.x branch from 0276ef7 to 8c531f2 Compare August 28, 2026 13:33
@renovate renovate Bot changed the title feat(container): update image ghcr.io/kimdre/doco-cd (0.109.2 → 0.112.0) feat(container): update image ghcr.io/kimdre/doco-cd (0.109.2 → 0.113.0) Aug 28, 2026
@renovate renovate Bot changed the title feat(container): update image ghcr.io/kimdre/doco-cd (0.109.2 → 0.113.0) feat(container): update image ghcr.io/kimdre/doco-cd (0.109.2 → 0.114.0) Aug 31, 2026
@renovate
renovate Bot force-pushed the renovate/ghcr.io-kimdre-doco-cd-0.x branch from 8c531f2 to c0c9869 Compare August 31, 2026 15:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

area/docker renovate/container type/minor

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants