Skip to main content

CommyPanel 0.3.0

This release lets you see and keep what your apps do on the server: a log viewer, persistent volumes with a file browser, a view of containers and networks, and a terminal inside a container. sudo commypanel upgrade now also asks for confirmation and explains what happens before it changes anything.

CommyPanel is still pre-1.0. Please read Before you upgrade first.

What's new​

Logs​

  • Log viewer. A Logs tab shows what the running container printed, newest at the bottom. Search with highlighted matches (Cmd/Ctrl+F while the log is focused, Enter and Shift+Enter to step), follow mode that refreshes every 3 seconds, a choice of 200 to 5,000 lines, and a download.

Persistent volumes​

  • Keep files between deployments. On the app's Volumes tab, Add volume takes a container path (such as /app/data). The dialog explains in plain words what the path means, where /app is, why a Go app needs another folder, and that the folder name on the server is only a label. The files live on the server under /var/lib/commypanel/volumes/<app>/<folder> and are mounted into every container of the app and into its release command. The old and the new container share a volume during a switch. A rollback does not roll back volume data.
  • The Volumes tab lists every volume with a search box, its size, where it is mounted and whether it is locked. Remove asks you to type the path and says what happens: the volume stops being mounted from the next deployment and its files stay on the server as a volume that is not attached. Delete data removes those files once no container uses them. How volumes work opens the longer explanation.
  • Browse a volume on a page of its own, read only: totals for the folder and the whole volume, an icon per file type, a .. row to go up, a text preview and a download of up to 25 MB. Every folder has its own address, so links and the back button work.

Locking​

  • Lock an app or a volume so it cannot be deleted by mistake. A locked app cannot be deleted (and neither can the files of its volumes with it); a locked volume cannot be removed. The delete button stays visible but disabled, with a note saying why, and a lock icon shows beside the name. Locking does not stop deployments or any other change, and anyone who may change the app can unlock it. Both are recorded in the audit log.

Messages​

  • Toast notifications replace the alert strip at the top of the page for messages such as "saved" or "removed". They follow the light, dim and dark themes.

Containers and networks​

  • The Usage tab lists the app's containers with their networks and addresses, published ports and mounted volumes, and what else is on the same networks. Server > Docker shows the same for every container, plus all networks. When a network holds more than one app, both pages say so.

Terminal​

  • A shell in the running container. The Terminal tab opens /bin/sh as the user the app runs as, with the app's environment and volumes. It asks for your password unless you confirmed it recently, is limited to 10 attempts a minute, and opening one is recorded in the audit log (what you type is not). Sessions end after 15 minutes without activity or after 2 hours.

Upgrading​

  • sudo commypanel upgrade now says what it is about to do (the panel is unavailable for a short while, your apps stay online, a failed upgrade goes back to the previous version) and asks Continue? [Y/n]. Use --yes to skip the question in scripts. Without a terminal it goes ahead.
  • After an upgrade the panel's own nginx site is written again, so the terminal also works on the panel's own domain.

Before you upgrade​

  • Keep a backup of /var/lib/commypanel as with any upgrade (the upgrade also backs up the panel databases for you). This version was tried as two release candidates on a real server before it was published.
  • Upgrade with sudo commypanel upgrade. It backs up the databases, migrates, switches over and restarts the services, and starts the previous release again if the new one does not come up healthy.
  • Three new permissions: apps.logs, apps.volumes and apps.terminal. The built-in admin role and the super user get them automatically. Roles you created yourself do not, so grant them on the Roles page where you want them.
  • The migration adds a table (app_volumes) and a locked_at column to apps and volumes. Nothing is locked after the upgrade.
  • The agent now also listens on a terminal socket (/run/commypanel-terminal/terminal.sock, group www-data), and the panel's nginx sites pass /terminal to it. If you put another proxy or a CDN in front of the panel, it has to allow WebSocket connections and long requests on /terminal.
  • Existing apps' nginx sites are not changed by this release.
  • The Persistent volumes card moved from the Settings tab to the Volumes tab; existing volumes are unchanged.

Security notes​

  • Volume files are untrusted. The agent reads them through Go's os.Root and opens plain files only, so a link pointing at the host's files, a named pipe or a path with .. is refused, not followed.
  • The terminal socket serves one thing. It accepts a single-use ticket (random, kept only as a hash, valid 30 seconds, bound to one container and one web address) and nothing else. The panel hands tickets out only after the permission, the password and the rate limit have been checked and the audit entry written.
  • Volume folders are created 0777 inside folders that are 0700 and root-only, because apps run as many different users. Nothing else on the host can reach them, and no other container mounts them.
  • Logs, volume files and terminals can expose secrets, which is why each has its own permission and downloads are audited.

Known limitations​

  • All apps share one Docker network, so containers of different apps can reach each other directly. The panel now says so; separate networks per app are not in this release.
  • Images without a shell (for example distroless images) cannot open a terminal.
  • Removing a volume from an app keeps its files until you delete them in the Volumes tab, and only once a deployment without that volume is running.
  • The terminal, volumes, locking and network views were tried on a real Ubuntu 26.04 server. Debian 13 and Ubuntu 24.04 have not been tried with this release yet; please report anything odd.
  • Not in this release: database servers and database management, API tokens, one-click GitHub connection.

Requirements​

Unchanged: Ubuntu 24.04 or 26.04, or Debian 13 or newer, with systemd; amd64 or arm64; root access; at least 1 GB of RAM.

# Install
curl -fsSL https://github.com/emrecanful/commypanel/releases/latest/download/install.sh | sudo bash

# Upgrade
sudo commypanel upgrade