Book a demo
Book a demo
Login
NewImprovedFixedSecurity

v2.9.0

Run Any App Alongside Docker on One Nginx Server — Plus More Powerful OneClick Apps

This is a big one. An xCloud Nginx server now runs everything it already hosted — WordPress and WooCommerce, PHP and Laravel, Node.js and other SSR apps, and static sites — right alongside Docker workloads on the same server. You are no longer picking between a “web” server and a separate Docker stack. OneClick V2 then expands that further, and this release also brings new site-management Public API endpoints, personal email preferences, and a wide security pass.

🔥 New Features

🆕 Any App — and Docker — on the Same Nginx Server

Docker is now part of the regular Nginx stack. Enable it while creating a new Nginx server, install it later from the server settings, or let xCloud install it automatically when you deploy a one-click Docker app. The separate Docker + Nginx stack is no longer needed for new servers.

One Nginx server can now host:

  • WordPress and WooCommerce sites
  • PHP applications, including Laravel and other frameworks
  • Node.js and other SSR applications
  • Static sites
  • Docker applications and supporting services such as PostgreSQL

For example, if your PHP application needs PostgreSQL, run it as a Docker workload on the same server instead of creating a Docker server just for the database.

WordPress performance recommendation. Docker containers share CPU, memory, disk and network with your sites, so a resource-heavy container can slow WordPress down. For important, high-traffic or performance-sensitive WordPress and WooCommerce sites, keep Docker workloads on a separate server.

Learn more: Docker hosting on xCloud.

🆕 OneClick V2 for Multi-Endpoint Applications

OneClick Apps were built around one application with one web domain. OneClick V2 supports applications that need more, and keeps everything about how an app is reached in one place:

  • Multiple web domains — add and manage extra domains from the new Domains page.
  • Public TCP & UDP endpoints — apps reached by address, port and protocol now show their endpoint details in xCloud.
  • Credentials on the Site Overview — access details are shown right after installation.
  • Updates & configuration — install app updates, edit environment variables, and edit the Docker Compose file when your team role allows it (a wrong change there can stop the app).
  • Singleton safety — apps meant for a single install are protected against accidental duplicates.
  • API — discover an app’s endpoints and pass extra domains at install time; later changes are made from the dashboard.

Browse the catalog: One-Click Apps.

🆕 Expanded Site Management in the Public API

The Public API adds 16 endpoints for site cloning, clone progress, retrying a failed clone, staging creation, domain changes, Go Live and DNS checks — plus controls for PHP version, PHP-FPM, OPcache, WordPress cron and search-engine indexing. They use the same permission-aware background workflows as the dashboard; for async actions, poll the returned operation state.

🆕 Personal Email Preferences

Manage optional emails from Profile → Notifications: a global switch, per-notification controls, site- or server-specific mutes, signed unsubscribe links and one-click unsubscribe headers. Mandatory service emails stay on, and nothing changes until you update your preferences.

Please note

  • The combined Docker workflow is for Nginx servers. OpenLiteSpeed is not included.
  • Existing Docker + Nginx servers keep working — no conversion, rebuild or migration needed.
  • Before adding Docker to a server that already hosts busy sites, check CPU, memory and storage headroom and make sure a recent backup exists.

✨ Improvements

  • Persistent OpenLiteSpeed tuning — OLS sites keep their saved LSAPI tuning when the config is regenerated; site values override server defaults.
  • More consistent dashboard — layout and spacing refinements across modals, banners, the server overview, caching and the xSpeed card, with better mobile alignment and clearer failed-scan status.
  • More reliable staging for large sites — staging pull/push uses a size-aware time limit, and database imports strip production DEFINER clauses to avoid permission failures.

🐛 Bug Fixes

A round of fixes across OneClick, WordPress, backups, PHP and the dashboard:

  • OneClick setup — preserves version metadata, keeps security headers on error responses, allows larger response headers, and accepts valid Compose/script variables during catalog validation.
  • WordPress Fail2Ban on OpenLiteSpeed — first-time admin logins are no longer rejected on Cloudflare-proxied OLS sites.
  • Database identity — two sites on one server can no longer collide on the same database name or user (intentional shared/remote databases still work).
  • Updates Manager filters — server and site filters persist when rows expand or grouped Activate/Deactivate runs.
  • Patchstack findings — resolved issues clear, duplicates are removed, severity totals stay accurate, and Ignore works again.
  • PHP-FPM version changes — custom pool tuning is kept when a site switches PHP versions.
  • Backups without a database — file backups complete without a spurious database step when a site has none.
  • Failed site deletion — a Retry action is back on the progress page and reuses the original deletion choices.
  • PHP 8.5 OPcache — detected correctly, with the dashboard toggle restored.
  • WordPress bulk operations — result callbacks are retry-safe and reconcile asynchronously, reducing lock contention.
  • Docker Compose domain changes — the Compose project is preserved and SSL/Nginx finish after a primary-domain change.
  • Adminer & File Manager after web-root changes — site tools follow the new document root (no more 404 on nested roots like public/ or dist/).
  • Site Security Pro navigation — Manage opens the current site’s Patchstack page instead of a global add-on page.

🔏 Security

This release also ships a broad security pass — hardening and fixes across access control, injection and third-party integrations.

Access control & isolation

  • Support now needs your SSH consent before reading env files, wp-config, OneClick credentials or similar secrets.
  • Support-role accounts can no longer run custom commands through role access alone.
  • Site-limited admins no longer receive unrelated server, provider, team-member, payment or access-code data.
  • Site isolation is reapplied when a restore recreates a site directory; Rescue Site repairs sites restored before this change.
  • Temporary root SSH access for clone, migration and restore jobs is revoked when the job ends, with a scheduled retry for any misses.
  • Free-plan server limits are enforced consistently across provider calls, concurrent creation, plan selection and archived-server restore.

Injection & input

  • A new Fail2Ban jail limits repeated SQL-injection probes on Nginx and OLS (it does not replace application-level protection).
  • Go Live and domain-update checks can no longer treat a submitted previous-domain value as part of a server command.
  • Database passwords with shell-sensitive characters are preserved, and crafted credentials or table prefixes can’t be run as commands.
  • Support-thread messages and white-label legal pages (Terms, Privacy) are sanitized of scripts, unsafe links and active embeds.

Credentials & third-party

  • The web terminal pins each server’s SSH host key and blocks mismatches before sending credentials.
  • The terminal WebSocket bridge was updated, with a 1 MiB message cap and large pastes split into smaller frames.
  • Google Drive and pCloud OAuth use opaque, one-time server-side state to prevent cross-team linking or replay.
  • Authenticated pCloud requests go only to approved US and EU API hosts.
  • cPanel migration history is scoped to the selected server, team and method, returning only the fields the interface needs.
  • White-label pages no longer expose reseller payments, banking details, payment-provider identifiers or internal IDs.