FixedSecurity

v2.9.8.6

Environment Changes Reach Your Dockerfile Sites, and Ended Migrations Forget Your Root Password

When you change an environment variable on a Git site that uses its own Dockerfile, the running container now gets it after a deploy. A server migration that fails or is canceled no longer keeps your old server’s root password. This release also fixes billing, PageSpeed reports, Cloudflare domains and MariaDB installs.

🧑‍💻 For Developers: Public API and MCP

  • Search servers by IP. GET /api/v1/servers?search= now matches the server’s IP as well as its name, as documented. A full IP matches exactly, and anything else matches part of the IP. MCP server search gets the same fix.
  • Environment changes on Dockerfile sites. Changes sent with PUT /api/v1/sites/{uuid}/deploy-config now reach the container on the next deploy. Its response has a new kept_secret_keys list. It names the stored secrets a recipe site kept, never their values, and it is empty for every other site.

🔒 Security

  • Ended server migrations no longer keep your root password. xCloud now deletes the source server’s root password when a migration fails or is canceled, once no site is still migrating. Before, only a finished migration deleted it. A daily cleanup also removes leftover passwords from ended migrations and from migrations idle for over 7 days.

🐞 Bug Fixes

  • Git and Docker
    • Environment changes now reach the running container of a Git site deployed from its own Dockerfile. Before, the value was saved but the container never saw it, even after Deploy Now.
  • Billing
    • Deleting a server no longer cancels an invoice or bill that was already paid or refunded. Its billing still stops, and money that was never collected is still canceled.
    • A partly refunded invoice no longer counts as unpaid, so it can’t lock your account and isn’t charged again.
  • PageSpeed Insights
    • View Details now shows the scan’s real result when its desktop run failed or is still running, not a score of 0.
    • View Details now opens the device you clicked, so a row in the Mobile tab opens on mobile.
  • Cloudflare
    • Editing a site’s Additional Domains no longer turns off its Cloudflare setting or moves the site off Cloudflare.
  • Servers
    • Server setup no longer stops at the MariaDB install step when Google storage refuses your server’s IPv6 address. If only IPv4 works, xCloud installs over IPv4 and that server’s system updates keep using IPv4.
    • The MariaDB security patch uses the same IPv4 fallback.

Please note

  • Older Dockerfile sites need one step. If your Git site was created from its own Dockerfile before this release, save its environment variables once, then click Deploy Now. After that, your changes reach the container. Sites that use their own Docker Compose file are not part of this fix.
  • Retrying a migration. After a server migration fails or is canceled, a retry asks you to type the source server’s SSH Password again.