Repository navigation
fix: do not make /etc/dokploy world-writable in install.sh - #225
Open
Ahmad-b1995 wants to merge 1 commit into
Open
Ahmad-b1995 wants to merge 1 commit into
Ahmad-b1995 wants to merge 1 commit into
Conversation
install.sh runs as root and the Dokploy container also runs as root, so nothing needs /etc/dokploy to be world-writable. At 0777 any local user can rename a root-owned entry such as traefik/ or schedules/ and put their own directory in its place, which Dokploy and Traefik then read and run as root. 0755 keeps root as the sole writer while leaving the directory readable and traversable. Remote installs already take ownership with `chown` rather than widening permissions. The same instruction in the manual-installation docs is lowered to 0755. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What is this PR about?
install.shrunschmod 777 /etc/dokploy, and the manual-installation docs tell users to do the same. That directory is bind-mounted into the Dokploy and Traefik containers and holds their configuration (traefik/), generated app files, scheduled-task scripts (schedules/) and.envfiles.Write permission on a directory is enough to rename the entries inside it, even root-owned ones. So on any multi-user host, an unprivileged local user can move a root-owned subdirectory aside and put their own in its place. Dokploy and Traefik then read that content as their configuration, and the scheduled-task runner executes
schedules/<app>/script.shas root, which turns the world-writable directory into a local privilege escalation to root.The installer and the container both run as root, so nothing needs the directory world-writable. This lowers it to
0755, which keeps root as the sole writer while leaving it readable and traversable. This matches what the remote-server path already does, where ownership is handed to the install user withchownrather than widening permissions.apps/website/public/install.sh:chmod 755instead ofchmod 777.apps/docs/content/docs/core/manual-installation.mdx: the same change in both copy-paste blocks.Issues related (if applicable)
Reported privately to contact@dokploy.com first (2026-09-30), following SECURITY.md. Opening publicly now after no response. Single-user hosts are not affected; shared or multi-user hosts are.
🤖 Generated with Claude Code