v4.0.0-beta.435

app/Http/Controllers/Api/ApplicationsController.php

@@ -1512,9 +1512,32 @@ private function create_application(Request $request, $type)
             if ($return instanceof \Illuminate\Http\JsonResponse) {
                 return $return;
             }
-            if (! $request->docker_registry_image_tag) {
-                $request->offsetSet('docker_registry_image_tag', 'latest');
+            // Process docker image name and tag for SHA256 digests
+            $dockerImageName = $request->docker_registry_image_name;
+            $dockerImageTag = $request->docker_registry_image_tag;
+
+            // Strip 'sha256:' prefix if user provided it in the tag
+            if ($dockerImageTag) {
+                $dockerImageTag = preg_replace('/^sha256:/i', '', trim($dockerImageTag));
+            }
+
+            // Remove @sha256 from image name if user added it
+            if ($dockerImageName) {
+                $dockerImageName = preg_replace('/@sha256$/i', '', trim($dockerImageName));
+            }
+
+            // Check if tag is a valid SHA256 hash (64 hex characters)
+            $isSha256Hash = $dockerImageTag && preg_match('/^[a-f0-9]{64}$/i', $dockerImageTag);
+
+            // Append @sha256 to image name if using digest and not already present
+            if ($isSha256Hash && ! str_ends_with($dockerImageName, '@sha256')) {
+                $dockerImageName .= '@sha256';
             }
+
+            // Set processed values back to request
+            $request->offsetSet('docker_registry_image_name', $dockerImageName);
+            $request->offsetSet('docker_registry_image_tag', $dockerImageTag ?: 'latest');
+
             $application = new Application;
             removeUnnecessaryFieldsFromRequest($request);
 

app/Livewire/DeploymentsIndicator.php

@@ -16,7 +16,8 @@ public function deployments()
     {
         $servers = Server::ownedByCurrentTeam()->get();
 
-        return ApplicationDeploymentQueue::whereIn('status', ['in_progress', 'queued'])
+        return ApplicationDeploymentQueue::with(['application.environment.project'])
+            ->whereIn('status', ['in_progress', 'queued'])
             ->whereIn('server_id', $servers->pluck('id'))
             ->orderBy('id')
             ->get([

app/Livewire/Project/New/DockerImage.php

@@ -12,7 +12,11 @@
 
 class DockerImage extends Component
 {
-    public string $dockerImage = '';
+    public string $imageName = '';
+
+    public string $imageTag = '';
+
+    public string $imageSha256 = '';
 
     public array $parameters;
 
@@ -26,12 +30,41 @@ public function mount()
 
     public function submit()
     {
+        // Strip 'sha256:' prefix if user pasted it
+        if ($this->imageSha256) {
+            $this->imageSha256 = preg_replace('/^sha256:/i', '', trim($this->imageSha256));
+        }
+
+        // Remove @sha256 from image name if user added it
+        if ($this->imageName) {
+            $this->imageName = preg_replace('/@sha256$/i', '', trim($this->imageName));
+        }
+
         $this->validate([
-            'dockerImage' => 'required',
+            'imageName' => ['required', 'string'],
+            'imageTag' => ['nullable', 'string', 'regex:/^[a-z0-9][a-z0-9._-]*$/i'],
+            'imageSha256' => ['nullable', 'string', 'regex:/^[a-f0-9]{64}$/i'],
         ]);
 
+        // Validate that either tag or sha256 is provided, but not both
+        if ($this->imageTag && $this->imageSha256) {
+            $this->addError('imageTag', 'Provide either a tag or SHA256 digest, not both.');
+            $this->addError('imageSha256', 'Provide either a tag or SHA256 digest, not both.');
+
+            return;
+        }
+
+        // Build the full Docker image string
+        if ($this->imageSha256) {
+            $dockerImage = $this->imageName.'@sha256:'.$this->imageSha256;
+        } elseif ($this->imageTag) {
+            $dockerImage = $this->imageName.':'.$this->imageTag;
+        } else {
+            $dockerImage = $this->imageName.':latest';
+        }
+
         $parser = new DockerImageParser;
-        $parser->parse($this->dockerImage);
+        $parser->parse($dockerImage);
 
         $destination_uuid = $this->query['destination'];
         $destination = StandaloneDocker::where('uuid', $destination_uuid)->first();
@@ -45,14 +78,24 @@ public function submit()
 
         $project = Project::where('uuid', $this->parameters['project_uuid'])->first();
         $environment = $project->load(['environments'])->environments->where('uuid', $this->parameters['environment_uuid'])->first();
+
+        // Determine the image tag based on whether it's a hash or regular tag
+        $imageTag = $parser->isImageHash() ? 'sha256-'.$parser->getTag() : $parser->getTag();
+
+        // Append @sha256 to image name if using digest and not already present
+        $imageName = $parser->getFullImageNameWithoutTag();
+        if ($parser->isImageHash() && ! str_ends_with($imageName, '@sha256')) {
+            $imageName .= '@sha256';
+        }
+
         $application = Application::create([
             'name' => 'docker-image-'.new Cuid2,
             'repository_project_id' => 0,
             'git_repository' => 'coollabsio/coolify',
             'git_branch' => 'main',
             'build_pack' => 'dockerimage',
             'ports_exposes' => 80,
-            'docker_registry_image_name' => $parser->getFullImageNameWithoutTag(),
+            'docker_registry_image_name' => $imageName,
             'docker_registry_image_tag' => $parser->getTag(),
             'environment_id' => $environment->id,
             'destination_id' => $destination->id,

app/Livewire/Project/Service/FileStorage.php

@@ -34,6 +34,8 @@ class FileStorage extends Component
 
     public bool $permanently_delete = true;
 
+    public bool $isReadOnly = false;
+
     protected $rules = [
         'fileStorage.is_directory' => 'required',
         'fileStorage.fs_path' => 'required',
@@ -52,6 +54,8 @@ public function mount()
             $this->workdir = null;
             $this->fs_path = $this->fileStorage->fs_path;
         }
+
+        $this->isReadOnly = $this->fileStorage->isReadOnlyVolume();
     }
 
     public function convertToDirectory()

app/Livewire/Project/Shared/Storages/Show.php

@@ -37,6 +37,11 @@ class Show extends Component
         'host_path' => 'host',
     ];
 
+    public function mount()
+    {
+        $this->isReadOnly = $this->storage->isReadOnlyVolume();
+    }
+
     public function submit()
     {
         $this->authorize('update', $this->resource);

app/Models/Application.php

@@ -739,9 +739,9 @@ public function environment_variables()
         return $this->morphMany(EnvironmentVariable::class, 'resourceable')
             ->where('is_preview', false)
             ->orderByRaw("
-                CASE 
-                    WHEN LOWER(key) LIKE 'service_%' THEN 1
-                    WHEN is_required = true AND (value IS NULL OR value = '') THEN 2
+                CASE
+                    WHEN is_required = true THEN 1
+                    WHEN LOWER(key) LIKE 'service_%' THEN 2
                     ELSE 3
                 END,
                 LOWER(key) ASC
@@ -767,9 +767,9 @@ public function environment_variables_preview()
         return $this->morphMany(EnvironmentVariable::class, 'resourceable')
             ->where('is_preview', true)
             ->orderByRaw("
-                CASE 
-                    WHEN LOWER(key) LIKE 'service_%' THEN 1
-                    WHEN is_required = true AND (value IS NULL OR value = '') THEN 2
+                CASE
+                    WHEN is_required = true THEN 1
+                    WHEN LOWER(key) LIKE 'service_%' THEN 2
                     ELSE 3
                 END,
                 LOWER(key) ASC

app/Models/ApplicationDeploymentQueue.php

@@ -41,11 +41,9 @@ class ApplicationDeploymentQueue extends Model
 {
     protected $guarded = [];
 
-    public function application(): Attribute
+    public function application()
     {
-        return Attribute::make(
-            get: fn () => Application::find($this->application_id),
-        );
+        return $this->belongsTo(Application::class);
     }
 
     public function server(): Attribute

app/Models/LocalFileVolume.php

@@ -5,6 +5,7 @@
 use App\Events\FileStorageChanged;
 use Illuminate\Database\Eloquent\Casts\Attribute;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
+use Symfony\Component\Yaml\Yaml;
 
 class LocalFileVolume extends BaseModel
 {
@@ -192,4 +193,61 @@ public function scopeWherePlainMountPath($query, $path)
     {
         return $query->get()->where('plain_mount_path', $path);
     }
+
+    // Check if this volume is read-only by parsing the docker-compose content
+    public function isReadOnlyVolume(): bool
+    {
+        try {
+            // Only check for services
+            $service = $this->service;
+            if (! $service || ! method_exists($service, 'service')) {
+                return false;
+            }
+
+            $actualService = $service->service;
+            if (! $actualService || ! $actualService->docker_compose_raw) {
+                return false;
+            }
+
+            // Parse the docker-compose content
+            $compose = Yaml::parse($actualService->docker_compose_raw);
+            if (! isset($compose['services'])) {
+                return false;
+            }
+
+            // Find the service that this volume belongs to
+            $serviceName = $service->name;
+            if (! isset($compose['services'][$serviceName]['volumes'])) {
+                return false;
+            }
+
+            $volumes = $compose['services'][$serviceName]['volumes'];
+
+            // Check each volume to find a match
+            foreach ($volumes as $volume) {
+                // Volume can be string like "host:container:ro" or "host:container"
+                if (is_string($volume)) {
+                    $parts = explode(':', $volume);
+
+                    // Check if this volume matches our fs_path and mount_path
+                    if (count($parts) >= 2) {
+                        $hostPath = $parts[0];
+                        $containerPath = $parts[1];
+                        $options = $parts[2] ?? null;
+
+                        // Match based on fs_path and mount_path
+                        if ($hostPath === $this->fs_path && $containerPath === $this->mount_path) {
+                            return $options === 'ro';
+                        }
+                    }
+                }
+            }
+
+            return false;
+        } catch (\Throwable $e) {
+            ray($e->getMessage(), 'Error checking read-only volume');
+
+            return false;
+        }
+    }
 }

app/Models/LocalPersistentVolume.php

@@ -4,6 +4,7 @@
 
 use Illuminate\Database\Eloquent\Casts\Attribute;
 use Illuminate\Database\Eloquent\Model;
+use Symfony\Component\Yaml\Yaml;
 
 class LocalPersistentVolume extends Model
 {
@@ -48,4 +49,69 @@ protected function hostPath(): Attribute
             }
         );
     }
+
+    // Check if this volume is read-only by parsing the docker-compose content
+    public function isReadOnlyVolume(): bool
+    {
+        try {
+            // Get the resource (can be application, service, or database)
+            $resource = $this->resource;
+            if (! $resource) {
+                return false;
+            }
+
+            // Only check for services
+            if (! method_exists($resource, 'service')) {
+                return false;
+            }
+
+            $actualService = $resource->service;
+            if (! $actualService || ! $actualService->docker_compose_raw) {
+                return false;
+            }
+
+            // Parse the docker-compose content
+            $compose = Yaml::parse($actualService->docker_compose_raw);
+            if (! isset($compose['services'])) {
+                return false;
+            }
+
+            // Find the service that this volume belongs to
+            $serviceName = $resource->name;
+            if (! isset($compose['services'][$serviceName]['volumes'])) {
+                return false;
+            }
+
+            $volumes = $compose['services'][$serviceName]['volumes'];
+
+            // Check each volume to find a match
+            foreach ($volumes as $volume) {
+                // Volume can be string like "host:container:ro" or "host:container"
+                if (is_string($volume)) {
+                    $parts = explode(':', $volume);
+
+                    // Check if this volume matches our mount_path
+                    if (count($parts) >= 2) {
+                        $containerPath = $parts[1];
+                        $options = $parts[2] ?? null;
+
+                        // Match based on mount_path
+                        // Remove leading slash from mount_path if present for comparison
+                        $mountPath = str($this->mount_path)->ltrim('/')->toString();
+                        $containerPathClean = str($containerPath)->ltrim('/')->toString();
+
+                        if ($mountPath === $containerPathClean || $this->mount_path === $containerPath) {
+                            return $options === 'ro';
+                        }
+                    }
+                }
+            }
+
+            return false;
+        } catch (\Throwable $e) {
+            ray($e->getMessage(), 'Error checking read-only persistent volume');
+
+            return false;
+        }
+    }
 }

app/Models/Service.php

@@ -547,6 +547,21 @@ public function extraFields()
                     }
                     $fields->put('Grafana', $data->toArray());
                     break;
+                case $image->contains('elasticsearch'):
+                    $data = collect([]);
+                    $elastic_password = $this->environment_variables()->where('key', 'SERVICE_PASSWORD_ELASTICSEARCH')->first();
+                    if ($elastic_password) {
+                        $data = $data->merge([
+                            'Password (default user: elastic)' => [
+                                'key' => data_get($elastic_password, 'key'),
+                                'value' => data_get($elastic_password, 'value'),
+                                'rules' => 'required',
+                                'isPassword' => true,
+                            ],
+                        ]);
+                    }
+                    $fields->put('Elasticsearch', $data->toArray());
+                    break;
                 case $image->contains('directus'):
                     $data = collect([]);
                     $admin_email = $this->environment_variables()->where('key', 'ADMIN_EMAIL')->first();
@@ -1231,9 +1246,9 @@ public function environment_variables()
     {
         return $this->morphMany(EnvironmentVariable::class, 'resourceable')
             ->orderByRaw("
-                CASE 
-                    WHEN LOWER(key) LIKE 'service_%' THEN 1
-                    WHEN is_required = true AND (value IS NULL OR value = '') THEN 2
+                CASE
+                    WHEN is_required = true THEN 1
+                    WHEN LOWER(key) LIKE 'service_%' THEN 2
                     ELSE 3
                 END,
                 LOWER(key) ASC