v0.31.0: Service Transfers, Server Security, Logs & Metrics Export, and Backup Downloads

Dokploy v0.31.0 lets you move services between servers, harden each server from one panel, and ship logs and metrics to your own observability stack. It brings together more than 100 merged pull requests since v0.30.6, along with backup downloads, safe Traefik updates, new Compose controls, Enterprise additions, and a large round of security and reliability fixes.

Transfer Services Between Servers

You can now move a service and its data from one server to another without rebuilding it by hand. Until now, changing a service's server meant recreating it on the new host, copying volumes yourself, and reconfiguring domains.

This is useful when a server is running out of resources, when you're retiring old hardware, or when you want to move a workload closer to its users. Pick the service, choose the destination server, and Dokploy handles the move.

Server Security

Every remote server now has a Security section that brings the checks and actions you used to run over SSH into one place:

• Fail2ban: configure it, including the ban action, and see which IPs are banned.
• IP bans: ban or unban addresses directly from the dashboard.
• SSH settings: review and change your SSH configuration, with clear feedback if a change fails.
• Firewall: see UFW status alongside the ports your server exposes.
• Activity and sessions: track failed login attempts and manage active sessions.
• Updates: see pending package updates for the server.

Editing is tied to permissions, so team members without edit access can view a server's security status without changing it.

Logs and Metrics to External Providers

Dokploy can now ship container logs and metrics to the observability tools you already use. Under the hood it runs Vector, so you configure a destination once and your server's data flows there continuously.

The built-in monitoring is still there for a quick look. But if your team already lives in a dedicated logging or metrics platform, you no longer have to bolt on your own agents to get Dokploy data into it.

Backup Downloads and Custom File Names

Database backups now have a file list with download controls. You can browse the backups stored in your destination and download any of them straight from the dashboard, using short-lived presigned URLs, instead of opening your S3 console.

You can also give backup files a custom name. Combined with rotation based on the file's modification time on the server, this makes backups easier to recognize and keeps retention predictable.

Safe Traefik Updates

You can now check which Traefik version a server is running and update it from the dashboard. Dokploy labels the recommended version, and if a recreate is interrupted midway, it restores the previous container so your traffic isn't left without a proxy.

Enterprise

• Custom forgot-password flow: whitelabeled instances can point the forgot-password link to their own flow. The link is also hidden during 2FA.
• Dual-mode branding: upload separate logos for light and dark themes.
• AI in custom roles: the AI module is now part of custom roles, so you control who can read, use, or configure AI features.
• Audit log export: export filtered audit logs as CSV, TSV, or JSON. The date filter now includes the whole end day.

Want these for your team? Contact us about Dokploy Enterprise.

Dokploy Cloud

• Account deletion: you can now delete your Dokploy Cloud account yourself. Dokploy records the process and cleans up your cloud services.

Security Hardening

This release includes a large batch of security fixes. We recommend upgrading as soon as you can.

• Secrets stay out of logs: commands and secrets no longer leak through error messages, S3 credentials are redacted in backup logs, and registry passwords are passed to docker login through stdin.
• Git tokens out of clone URLs: provider tokens are sent through an HTTP header, so submodule URLs and build logs never contain them.
• Organization isolation: service permission checks, backup destinations, and Traefik file endpoints are now scoped to the active organization.
• Terminals and logs bound to their service: a container terminal or log stream only connects to the service it was opened from.
• Path confinement: Traefik files, file mounts, certificates, and patch paths are confined to their own directories. This includes fixes for two reported advisories.
• Hardened HTTP headers: stricter security headers, and X-Powered-By is no longer sent.
• Dependencies: Node.js 24.22.1 and several patched packages flagged by Dependabot.

We've surpassed 600 templates check here: https://templates.dokploy.com/

We want to express our gratitude! We've reached 38k stars on GitHub and over 16 million downloads on DockerHub. Thank you so much for your incredible support!

A special thanks to everyone who contributed to this release – the domain toggle, session management page, Scaleway vault provider, Traefik update, and dozens of fixes in this list came from the community.

https://x.com/getdokploy
https://www.linkedin.com/company/dokploy/

Release notes: https://github.com/Dokploy/dokploy/releases/tag/v0.31.0