[Bug]: ENV in volume pathes not working any longer

[lippoliv]

Error Message and Logs

Today I needed to re-deploy an older owncloud instance. There was no change in docker-compose, just a restart pretty much.

It fails:

2025-Nov-06 09:18:49.086698
Oops something is not okay, are you okay? 😢
2025-Nov-06 09:18:49.098196
Invalid Docker volume definition (array syntax): Invalid volume source: contains forbidden character '${' (variable substitution with potential command injection). Shell metacharacters are not allowed for security reasons. Please use safe path names without shell metacharacters.

Steps to Reproduce

1. Create a docker-compose with a volumen path like ${VOLUMES_PATH}/mysql-backup
2. Try to deploy

one full example

services:
  database:
    build:
      context: './mysql'
    restart: always
    environment:
      - BACKUP_HEARTBEAT_URL=${DB_BACKUP_HEARTBEAT_URL}
      - MYSQL_ROOT_PASSWORD=${MYSQL_ROOT_PASSWORD}
    volumes:
      - type: bind
        source: ${VOLUMES_PATH}/mysql
        target: /var/lib/mysql
        # noinspection ComposeUnknownKeys
        is_directory: true
      - type: bind
        source: ${VOLUMES_PATH}/mysql-backup
        target: /backup
        # noinspection ComposeUnknownKeys
        is_directory: true

Example Repository URL

No response

Coolify Version

v4.0.0-beta.441

Are you using Coolify Cloud?

No (self-hosted)

Operating System and Version (self-hosted)

Debian GNU/Linux 12 (bookworm)

Additional Information

Probably #6891 introduced this "bug".

For me it's a serious issue since I now have a 6-server setup running 28 projects that wouldn't be deployable any longer, if I do not find an alternative.

I use ENV vars in volumen pathes because the docker-compose is in a git repo which acts pretty much as a template, so I can run the same service multiple times. Hence I cannot use absolute pathes.

[lippoliv]

I thought I could rollback to 4.0.0-beta.339 or 4.0.0-beta.337, but install is failing (without error message) and the coolify init container crashes with message

🏃‍♂️ Checking for Laravel automations...
🔐 Linking the storage...
🔐 SSL_MODE has set to FULL, setting the web server to work in HTTPS only...

   ERROR  The [public/storage] link already exists.


   INFO  Nothing to migrate.

[06-Nov-2025 11:56:39] NOTICE: fpm is running, pid 99
[06-Nov-2025 11:56:39] NOTICE: ready to handle connections
[06-Nov-2025 11:56:39] NOTICE: systemd monitor interval set to 10000ms

   INFO  Seeding database.

Running in self-hosted mode.
Checking localhost key.
No SSH key found for the Coolify host machine (localhost).
Please generate one and save it in /data/coolify/ssh/keys/id.root@host.docker.internal
Then try to install again.
s6-rc: warning: unable to start service init-seeder: command exited 1
/run/s6/basedir/scripts/rc.init: warning: s6-rc failed to properly bring all the services up! Check your logs (in /run/uncaught-logs/current if you have in-container logging) for more information.
prog: fatal: stopping the container.
[06-Nov-2025 11:56:40] NOTICE: Terminating ...
[06-Nov-2025 11:56:40] NOTICE: exiting, bye-bye!

I researched my borg backups back to APR 30th, that file didn't exist.
So I'm stuck right now, no workaround. Anyone facing the same issue / having an idea what to do?

[KamarulAdha]

@lippoliv

Yup, having an issue with this as well. But for my case, I didn't restart or re-deploy or commit anything into my repo. When I went into the console, it raised this:

Invalid Docker volume definition: Invalid volume target: contains forbidden character ' 

However, all the apps are still running, but unable to push a fix or re-deploy now.

Edit: New project with fresh deployment also doesn't work.

[lippoliv]

@KamarulAdha thanks for sharing. 27 of my apps also are still running, but the one that made me aware of the issue needs to be re-deployed, is off the whole day already.

I'm trying to play around with "normal volumes" and then in "Persistent Storage" set a "Source path" but coolify ignores it (at the moment).

[andrasbacsai]

I will check what I can do about this. It was a security fix that is causing this. Maybe we can loosen it a bit.

[andrasbacsai]

Okay, I fixed the issue, it will be fixed in the next version.