[Bug]: Environment variables exposed in deployment debug logs

[Gavin-Hofer]

Issue

The UI for project environment variables strongly suggests that they should be teated as secrets, and makes no mention of them only being redacted from the logs if locked. I saw this same behavior with "Use Docker Build Secrets" checked.

coolify/resources/views/livewire/project/shared/environment-variable/all.blade.php

Line 15 in 5b850ba

<div>Environment variables (secrets) for this resource. </div>

Looking at the deployment debug logs, I found these lines, followed by all of the environment variables in plain text (the contents of that .env file):

2025-Nov-15 06:29:22.989297
Creating .env file with runtime variables for build phase.
2025-Nov-15 06:29:23.717754
[CMD]: docker exec o404owo8g4k40gk4k4ccc4c0 bash -c 'cat /artifacts/o404owo8g4k40gk4k4ccc4c0/.env'

This command is here:

coolify/app/Jobs/ApplicationDeploymentJob.php

Line 1329 in 5b850ba

$this->execute_remote_command(

Digging into execute_remote_command -> $this->executeCommandWithProcess -> $this->redact_sensitive_info, I can see that it's only redacting $lockedVars from the command and output on $new_log_entry.

I couldn't find anything in either the UI or the docs that indicate that only locked environment variables are treated as secrets and redacted in the deployment logs. The v3 docs explicitly stated that environment variables and secrets are the same thing.

Steps to Reproduce

1. Create a repository with a Dockerfile and a docker-compose.yaml file that uses some environment variables. I only saw this command get executed for the app service below, not the db (postgres server), so I think it's important that it builds during the deployment. It shouldn't matter what application code you have in app as long as it builds.

services:
  app:
    build:
      context: .
      dockerfile: Dockerfile
    ports:
      - "3000:3000"
    environment:
      - NODE_ENV=production
      - POSTGRES_USER=${POSTGRES_USER}
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
      - POSTGRES_DB=${POSTGRES_DB}
      - POSTGRES_HOST=db
      - POSTGRES_PORT=5432
    depends_on:
      db:
        condition: service_healthy
    restart: unless-stopped
    networks:
      - docker-network

  db:
    image: postgres:18.1-alpine3.22
    environment:
      - POSTGRES_USER=${POSTGRES_USER}
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
      - POSTGRES_DB=${POSTGRES_DB}
    volumes:
      - postgres_data:/var/lib/postgresql/data
    ports:
      - "5432:5432"
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U $$POSTGRES_USER -d $$POSTGRES_DB"]
      interval: 10s
      timeout: 5s
      retries: 5
    restart: unless-stopped
    networks:
      - docker-network

volumes:
  postgres_data:
    driver: local

networks:
  docker-network:
    driver: bridge

2. Create a project on coolify, with a resouce linked to your repostory, and use "Docker Compose" as the build pack.
3. Go to the environment variables tab in Configuration and add your environment variables. Make sure "Available at runtime" is checked and don't lock them. (note I did also see it print out the build-time environment variables in the debug logs)
4. Deploy the application
5. Hit "Show Debug Logs"
6. Look for a line like: [CMD]: docker exec <container-id> bash -c 'cat /artifacts/build-time.env'

• Right after this all of the build-time environment variables appear in plaintext

6. Look for a line like [CMD]: docker exec <container-id> bash -c 'cat /artifacts/<container-id>/.env'

• Right after this all of the runtime environment variables appear in plaintext

7. Go back and lock one or more environment variables, and redeploy. Now they should be replaced by <REDACTED> in the build debug log.

Coolify Version

v4.0.0-beta.442

Are you using Coolify Cloud?

No (self-hosted)

Operating System and Version (self-hosted)

Ubuntu 25.04 (ami-08451de661ab8fec8)

Solution Ideas

• Update the copy on this page to make a clear distinction between secrets (locked variables) and non-secrets (unlocked variables):
  

  coolify/resources/views/livewire/project/shared/environment-variable/all.blade.php

  Line 15 in 5b850ba

  <div>Environment variables (secrets) for this resource. </div>

• Or, update ExecuteRemoteCommand->redact_sensitive_info to redact all environment variables.

[ShadowArcanist]

@andrasbacsai tldr: working as expected (based on our convo on 10/30/25), just need to improve the tooltip or callout

[peaklabs-dev]

That is not entirely correct. While locked variables are redacted from deployment logs, the UI and more - which is the use case for them as nobody can read them after creation, all other ENVs are also never shown in deployment or debug logs unless you echo them or do something else during the build process, which is not recommended.

"Secrets" is still the correct word, as environment variables especially with Docker build secrets are used as secrets.

However there was some leftover code that should only be run in development that runs cat /artifacts/<container-id>/.env 2 times during deployment, which we should not do in prod as it will show all ENVs in the logs. I fixed that via: 23b5a3e