[Enterprise][Webmail SSO] Roundcube passwordless autologin is broken on Docker-based 1.7.66 upgrades

[Stonemage]

Category: Bug — Enterprise OpenPanel/OpenAdmin, OpenMail/Roundcube SSO and upgrade migration

OpenPanel version affected

OpenPanel Enterprise 1.7.66

OpenCLI upstream commit installed:

55b335bed876350302f693219002618d303365bd

Roundcube 1.6.12, from image digest:

roundcube/roundcubemail@sha256:9b8756f96db0074f1e4726750d65a64fcb3987eb0cbe11b54dbe71aa0d95fcff

Operating system

Rocky Linux 9.7, kernel 5.14.0-611.24.1.el9_7.x86_64, Docker 29.2.1.

Severity

High — the advertised passwordless webmail entry point is completely broken on
an upgraded paid installation, and the failed path handles a Dovecot master
credential. A partial path or installer-only repair would leave either the
feature unusable or the authentication handoff unsafe.

We are a paying OpenPanel Enterprise customer. OpenPanel documents the Webmail
button as an automatic Roundcube login, and the current API documents a
single-use autologin token. On this upgraded 1.7.66 installation, the button
cannot complete that contract.

The direct Roundcube endpoint is healthy and presents its normal
username/password login. The defect is specifically the
OpenPanel/OpenAdmin-to-Roundcube passwordless integration and its
upgrade/reconciliation path.

This is not a duplicate of #942. That issue concerned SMTP sending after an
autologin session on 1.7.8 and was closed as fixed for 1.7.58. The present
report is from the Docker-based 1.7.66 line: the user cannot reach an
authenticated Roundcube inbox, the token bridge is mounted as a directory and
returns 403, and the 1.7.66 image contains a version-2.0 webmail module that
invokes Podman even though the vendor explicitly keeps existing 1.x
installations on Docker.

No customer domains, mailbox addresses, credentials, tokens or message data are
included in this report.

Sanitized production evidence

The following checks were performed read-only. No real autologin token or
credential was published or used in the HTTP probe.

1. Roundcube itself is available

The dedicated HTTPS webmail root returns 200 and renders the normal Roundcube
login form.

The OpenPanel 1.7.66 user image renders the mailbox button as:

/webmail/<mailbox-address>

That is the documented passwordless entry point, not our local prefill
workaround.

2. OpenPanel 1.7.66 contains a Podman-only version-2.0 webmail module

The installed licensed webmail module identifies itself as version 2.0.0,
with build date 2026-07-27, even though the running paid product is OpenPanel
Enterprise 1.7.66.

That module checks and executes the OpenMail containers with podman. The
running OpenPanel container has both DOCKER_HOST and CONTAINER_HOST set to:

unix:///run/podman/podman.sock

That socket does not exist in the container. The 1.7.66 platform correctly
continues to run on Docker and mounts the live Docker socket at
/var/run/docker.sock. Both podman ps and docker ps fail inside the panel
container because the running 1.7.66 container environment directs both clients
to the missing Podman socket.

The licensed version-2.0 handler therefore can report that Roundcube is not
running and return to the Emails page before it creates an autologin token,
even though the Docker-managed openadmin_roundcube and
openadmin_mailserver containers are running.

This is not evidence that the 1.7.66 server should be migrated to Podman. The
vendor's own 2.0 release material says 1.x remains on Docker and that there is
no in-place 1.x-to-2.0 runtime migration. It is evidence that a wrong-generation
module was packaged into the 1.7.66 image while the running 1.7.66 container was
also given a Podman-targeting environment.

This report describes that installed behavior without reproducing or
redistributing the licensed module source.

3. The token bridge is a directory, not a PHP file

The live OpenMail Compose file mounts:

./roundcube-plugins/autologin.php:/var/www/html/public_html/autologin.php:ro

Both sides of that mount are currently directories:

source: directory, root:root, mode 0755
destination: directory, root:root, mode 0755

The directory is empty. Roundcube therefore has no executable
public_html/autologin.php bridge.

4. The public failure is deterministic

A request using a dummy token that only matches the documented token shape
produces this redirect chain:

HTTPS /autologin.php?token=<valid-shaped-dummy>
  -> 301 http://<webmail-host>/autologin.php/?token=<dummy>
  -> 308 https://<webmail-host>/autologin.php/?token=<dummy>
  -> 403 Apache

The first redirect appends / because Apache sees autologin.php as a
directory. The intermediate redirect also attempts an HTTP downgrade before
the edge proxy forces HTTPS again.

5. The other auth components are present

• The Dovecot master user configured for the feature exists.
• Roundcube loads the autologon and dovecot_impersonate plugins.
• The local autologon override is mounted as a real file and its host and
  container hashes match.
• A username-prefill fallback still works, but it requires the mailbox password
  and is not the passwordless feature OpenPanel documents.

This isolates the failure to the panel runtime handoff, bridge deployment and
upgrade reconciliation rather than general IMAP or Roundcube availability.

Public source evidence and upgrade root cause

1. The product documentation promises autologin

The current Webmail documentation says the Webmail link automatically logs the
mailbox into Roundcube:

OpenPanel/website/docs/panel/emails/webmail.md

Lines 5 to 10 in 57f4b69

	# Webmail
	Click the **Webmail** link next to an email address to autologin to Roundcube webmail. It opens in a new browser tab.
	:::info
	If the webmail service is not running, you'll see a notice asking you to contact your administrator, and you'll be redirected back to the Emails page.

The API documentation describes a single-use token and an
autologin.php?token=... URL:

OpenPanel/website/docs/panel/999_api.md

Lines 2066 to 2093 in 57f4b69

	## Webmail
	### Get webmail info
	```bash
	GET /api/webmail
	```
	```json
	{"is_running": true, "webmail_url": "https://webmail.example.com/"}
	```
	### Generate auto-login token
	Creates a single-use token for automatic Roundcube login.
	```bash
	POST /api/webmail/user@example.com
	```
	```json
	{
	"email": "user@example.com",
	"token": "abc123...",
	"autologin_url": "https://webmail.example.com/autologin.php?token=abc123...",
	"webmail_url": "https://webmail.example.com/"
	}
	```

The 1.7.58 changelog explicitly introduced OpenPanel and OpenAdmin webmail
autologin and claimed the earlier SMTP issue was fixed:

OpenPanel/website/docs/changelog/1.7.58.md

Lines 1 to 19 in 57f4b69

	Released on May 17, 2026
	- Openadmin test: sync_existing_zones_to_slave(slave_ip, master_ip)
	### 💅 Polish
	- Added auto-login to webmail from *OpenPanel > Emails* and *OpenAdmin > Emails* pages.
	- Added option for admins to set custom path (partition) on *OpenAdmin > Emails > Settings* for mailbox storage.
	- OpenAdmin > Process Manager now uses `SIGKILL` instead of `SIGTERM` to kill pid.
	- ElasticSearch and OpenSearch data now persists on service restart.
	- [Use ZeroSSL as fallback when Let's Encrypt fails #940](https://github.com/stefanpejcic/OpenPanel/issues/940)
	- [Increased cpu/ram defaults for services](https://github.com/stefanpejcic/openpanel-configuration/commit/6ccc97ae42639abbe939b42a6f46ada6a29b996f).
	- Webmail is removed from OpenPanel Dashboard page, search results and menu items.
	- Added option for admins to set which services autostart for users.
	- `opencli docker` command no longer uses lazydocker.
	### 🐛 Bug Fixes
	- [On mobile: plan Edit - Save Burton not visible #951](https://github.com/stefanpejcic/OpenPanel/issues/951)
	- [Email files NOT counted in DU for the user #941](https://github.com/stefanpejcic/OpenPanel/issues/941)
	- [SMTP error when sedning emails from webmail via openpanel autologon #942](https://github.com/stefanpejcic/OpenPanel/issues/942)

2. The 1.7.58 updater can create the directory state

The updater adds the Roundcube bind mount for
./roundcube-plugins/autologin.php but does not first create or download that
file. It then recreates Roundcube:

OpenPanel/version/1.7.58/UPDATE.sh

Lines 112 to 130 in 57f4b69

	# ADD CUSTOM PLUGINS TO ALLOW AUTOLOGIN TO WEBMAIL AND IMPERSONATION
	if [ ! -d "/usr/local/mail/openmail/roundcube-plugins" ]; then
	mkdir -p /usr/local/mail/openmail/roundcube-plugins
	fi
	wget -q -O "/usr/local/mail/openmail/roundcube-plugins/dovecot_impersonate/dovecot_impersonate.php" https://raw.githubusercontent.com/stefanpejcic/OpenMail/refs/heads/main/roundcube-plugins/dovecot_impersonate/dovecot_impersonate.php
	# ADD VOLUMES FOR ROUNDCUBE AND MAILSERVER
	if [ -f "/usr/local/mail/openmail/compose.yml" ]; then
	COMPOSE="/usr/local/mail/openmail/compose.yml"
	MISSING_ACCOUNTS=true
	MISSING_UTILS=true
	MISSING_IMPERSONATE=true
	MISSING_AUTOLOGIN=true
	grep -qF -- './openpanel/accounts.sh:/usr/local/bin/helpers/accounts.sh:ro' "$COMPOSE" && MISSING_ACCOUNTS=false
	grep -qF -- './openpanel/utils.sh:/usr/local/bin/helpers/utils.sh:ro' "$COMPOSE" && MISSING_UTILS=false
	grep -qF -- './roundcube-plugins/dovecot_impersonate:/var/www/html/plugins/dovecot_impersonate:ro' "$COMPOSE" && MISSING_IMPERSONATE=false
	grep -qF -- './roundcube-plugins/autologin.php:/var/www/html/public_html/autologin.php:ro' "$COMPOSE" && MISSING_AUTOLOGIN=false

OpenPanel/version/1.7.58/UPDATE.sh

Lines 179 to 225 in 57f4b69

	# --- roundcube volumes ---
	if $MISSING_IMPERSONATE || $MISSING_AUTOLOGIN; then
	RC_LINE=$(grep -n '^\s\{2\}roundcube:' "$COMPOSE" | cut -d: -f1)
	RC_NEXT_SERVICE_LINE=$(awk "NR > $RC_LINE && /^ [a-z]/ { print NR; exit }" "$COMPOSE")
	RC_VOLUMES_LINE=$(awk "NR > $RC_LINE && NR < ${RC_NEXT_SERVICE_LINE:-9999} && /^\s*volumes:/ { print NR; exit }" "$COMPOSE")
	if [ -z "$RC_VOLUMES_LINE" ]; then
	echo "ERROR: Could not find volumes: section under roundcube service" >&2
	exit 1
	fi
	RC_VOLUMES_END_LINE=$(awk "NR > $RC_VOLUMES_LINE && /^\s{4}[a-z_]/ { print NR; exit }" "$COMPOSE")
	[ -z "$RC_VOLUMES_END_LINE" ] && RC_VOLUMES_END_LINE="${RC_NEXT_SERVICE_LINE:-9999}"
	RC_LAST_VOLUME_LINE=$(awk "NR > $RC_VOLUMES_LINE && NR < $RC_VOLUMES_END_LINE && /^\s*- / { last=NR } END { print last+0 }" "$COMPOSE")
	if [ "$RC_LAST_VOLUME_LINE" -eq 0 ]; then
	echo "ERROR: Could not find any volume entries under roundcube volumes:" >&2
	exit 1
	fi
	RC_INSERT=""
	$MISSING_IMPERSONATE && RC_INSERT="${RC_INSERT} - ./roundcube-plugins/dovecot_impersonate:/var/www/html/plugins/dovecot_impersonate:ro\n"
	$MISSING_AUTOLOGIN && RC_INSERT="${RC_INSERT} - ./roundcube-plugins/autologin.php:/var/www/html/public_html/autologin.php:ro"
	RC_INSERT="$(printf '%b' "$RC_INSERT")"
	insert_after_line "$COMPOSE" "$RC_LAST_VOLUME_LINE" "$RC_INSERT"
	echo "Added volume mounts to roundcube in $COMPOSE"
	fi
	# --- roundcube ROUNDCUBEMAIL_PLUGINS env var ---
	if $MISSING_IMPERSONATE; then
	PLUGINS_LINE=$(grep -n 'ROUNDCUBEMAIL_PLUGINS=' "$COMPOSE" | cut -d: -f1)
	if [ -n "$PLUGINS_LINE" ]; then
	sed -i "${PLUGINS_LINE}s/ROUNDCUBEMAIL_PLUGINS=\(.*\)/ROUNDCUBEMAIL_PLUGINS=\1,dovecot_impersonate/" "$COMPOSE"
	echo "Added dovecot_impersonate to ROUNDCUBEMAIL_PLUGINS in $COMPOSE"
	else
	echo "WARNING: ROUNDCUBEMAIL_PLUGINS= line not found in $COMPOSE" >&2
	fi
	fi
	if $MISSING_IMPERSONATE || $MISSING_AUTOLOGIN; then
	echo "Restarting roundcube to apply changes.."
	cd /usr/local/mail/openmail && docker --context=default compose down roundcube && docker --context=default compose up -d roundcube
	echo "done"

On an upgraded installation where the source path does not already exist,
Docker creates it as a directory when applying the bind mount. This exactly
matches the installed source and destination state above.

The same 1.7.58 block also downloads the impersonation plugin into a nested
directory without first creating that nested directory. It does not validate
that either expected PHP file exists and is a regular file before restarting
Roundcube.

3. The 1.7.59 repair cannot remove the directory it needs to replace

The next updater was explicitly intended to fix webmail autologin on some
installations. It runs:

rm -f /usr/local/mail/openmail/roundcube-plugins/autologin.php
wget -O /usr/local/mail/openmail/roundcube-plugins/autologin.php ...

OpenPanel/version/1.7.59/UPDATE.sh

Lines 1 to 20 in 57f4b69

	#!/bin/bash
	# fixes bug with autologin to webmail on some installations
	SHOULD_START_AGAIN=false
	if [ -d "/usr/local/mail/openmail" ]; then
	cd /usr/local/mail/openmail || exit 1
	if docker --context=default ps --format '{{.Names}}' | grep -qx "roundcube"; then
	SHOULD_START_AGAIN=true
	timeout 5 docker --context=default compose down roundcube
	fi
	rm -f /usr/local/mail/openmail/roundcube-plugins/autologin.php
	mkdir -p /usr/local/mail/openmail/roundcube-plugins/dovecot_impersonate/
	wget -O "/usr/local/mail/openmail/roundcube-plugins/autologin.php" https://raw.githubusercontent.com/stefanpejcic/OpenMail/refs/heads/main/roundcube-plugins/autologin.php
	wget -O "/usr/local/mail/openmail/roundcube-plugins/dovecot_impersonate/dovecot_impersonate.php" https://raw.githubusercontent.com/stefanpejcic/OpenMail/refs/heads/main/roundcube-plugins/dovecot_impersonate/dovecot_impersonate.php
	if [ "$SHOULD_START_AGAIN" = true ]; then
	timeout 5 docker --context=default compose up -d roundcube
	fi

rm -f does not remove a directory. wget -O cannot replace that directory
with a file. The script has no fail-fast or postcondition check and can bring
Roundcube back up with the same broken directory mount. That is exactly the
state still present after upgrade to 1.7.66.

4. OpenMail requires that mount to be a real file

The current OpenMail Compose file defines the source as a file mount and enables
the impersonation plugin:

https://github.com/stefanpejcic/OpenMail/blob/206b2bcffbc7dfeb7e3ea63d5a8a2f0004febbdb/compose.yml#L39-L55

The mounted bridge validates the opaque token, consumes a short-lived token
payload and posts a master-login credential to local Roundcube:

https://github.com/stefanpejcic/OpenMail/blob/206b2bcffbc7dfeb7e3ea63d5a8a2f0004febbdb/roundcube-plugins/autologin.php#L1-L82

The impersonation plugin then carries the master-login suffix into IMAP, SMTP
and Sieve connections:

https://github.com/stefanpejcic/OpenMail/blob/206b2bcffbc7dfeb7e3ea63d5a8a2f0004febbdb/roundcube-plugins/dovecot_impersonate/dovecot_impersonate.php#L11-L59

This is an end-to-end authentication chain. Installing only one PHP file is not
sufficient proof of repair.

5. Podman starts with 2.0; supported 1.x installations remain on Docker

The official 2.0 changelog is explicit:

• 2.0 is the first Podman-based OpenPanel version;
• Podman replaces Docker in 2.0;
• there is no update path from 1.x to 2.0;
• existing Docker-based 1.x releases remain supported.

OpenPanel/website/docs/changelog/2.0.0.md

Lines 1 to 9 in 57f4b69

	Released on 28.08.2026
	2.0 is the first Podman-based version of OpenPanel and represents a major rewrite:
	- OpenAdmin has been [open sourced](https://github.com/stefanpejcic/openadmin) and rewritten in Go
	- OpenPanel is now [90% open sourced](https://hub.docker.com/r/openpanel/openpanel-podman) - only the core and premium modules remain closed source
	- Podman replaces Docker for container management
	**Note:** As this is a complete rewrite, there is no update path from existing 1.X versions to 2.0. Automating a Docker-to-Podman migration across hundreds of users and servers isn't realistically feasible. Existing 1.X versions based on Docker remain fully supported, and updates are still planned — though no new features will be added to the 1.X line. Plan a clean reinstall to upgrade to 2.x properly. Enterprise users can get hands-on help from our team at info@openpanel.com.

The vendor's Podman transition announcement likewise says only new 2.0
installations move to Podman, while existing installations remain on Docker
with no forced migration:

OpenPanel/website/blog/2026-07-11-podman-switch-openpanel-2.md

Lines 12 to 18 in 57f4b69

	OpenPanel 2.0, scheduled for the end of this year, changes the container engine under the hood: **new installations will run on Podman instead of Docker.**
	<!--truncate-->
	Existing installations are not affected. If you're already running OpenPanel on Docker, you stay on Docker - there is no forced migration. This is purely a change for fresh installs going forward, and it's the single biggest performance change we've shipped since launch.
	The short version: Podman gets rid of the Docker daemon overhead, and that overhead was being paid **per user, on every server, all the time.**

OpenPanel/website/blog/2026-07-11-podman-switch-openpanel-2.md

Lines 127 to 131 in 57f4b69

	## Still in beta
	To be upfront: Podman support in OpenPanel is still in **beta**. It's what new installations will default to once OpenPanel 2.0 ships at the end of the year, but we're actively hardening it against edge cases before then.
	Existing OpenPanel installations keep running on Docker - nothing changes for you, and there's no forced migration path being pushed on current servers. If you want to try Podman ahead of the 2.0 release to kick the tires, or you hit something that doesn't behave the way Docker did, we want to hear about it. That feedback loop is exactly how we get this out of beta.

The supported repair for 1.7.66 must therefore restore a Docker-compatible 1.x
webmail handler and environment. Pointing this production 1.x installation at
Podman would contradict the published product boundary and is not an acceptable
workaround.

6. Current end-to-end tests do not prove upgrade safety

The repository test expects the Webmail button to open an authenticated inbox,
compose and send a message, and verify receive behavior:

OpenPanel/tests/openpanel/tests/emails.spec.ts

Lines 302 to 370 in 57f4b69

	// ─── Webmail autologin ────────────────────────────────────────────────────────
	test('webmail autologin and send/receive', async ({ page }) => {
	test.setTimeout(90_000);
	await page.goto('/emails');
	const webmailBtn = page.locator('a[href*="/webmail/"]').first();
	const hasBtn = await webmailBtn.isVisible().catch(() => false);
	if (!hasBtn) { test.skip(); return; }
	const emailAddress = await webmailBtn.getAttribute('href').then(h => h!.split('/webmail/')[1]);
	expect(emailAddress).toBeTruthy();
	// --- Open webmail popup ---
	const popupPromise = page.waitForEvent('popup');
	await webmailBtn.click();
	const popup = await popupPromise;
	await popup.waitForLoadState('load');
	expect(popup.url()).toBeTruthy();
	// --- Wait for Roundcube inbox to be ready ---
	await popup.waitForSelector('#mailboxlist', { timeout: 20_000 });
	// --- Click compose ---
	await popup.locator('a.compose, button.compose').first().click();
	await popup.waitForSelector('#compose-subject', { timeout: 10_000 });
	// --- Fill To via the visible token widget input ---
	const toInput = popup.locator('.token-input input, #compose-to .token-input, #compose_to .recipient input').first();
	const hasTokenInput = await toInput.isVisible().catch(() => false);
	if (hasTokenInput) {
	await toInput.fill(emailAddress!);
	await popup.keyboard.press('Enter');
	} else {
	// fallback: force into the hidden textarea
	await popup.locator('#_to').scrollIntoViewIfNeeded();
	await popup.locator('#_to').pressSequentially(emailAddress!, { delay: 50 });
	await popup.keyboard.press('Enter');
	}
	// --- Subject ---
	const subject = `Playwright self-send ${Date.now()}`;
	await popup.locator('#compose-subject').fill(subject);
	// --- Body ---
	const bodyText = 'Automated Playwright send/receive test.';
	const tinyFrame = popup.frameLocator('#composebody_ifr');
	const hasHtmlEditor = await tinyFrame.locator('body').isVisible().catch(() => false);
	if (hasHtmlEditor) {
	await tinyFrame.locator('body').fill(bodyText);
	} else {
	await popup.locator('#composebody').fill(bodyText);
	}
	// --- Send ---
	await popup.locator('button.btn-primary.send').click();
	await popup.waitForSelector('#messagestack .confirmation, div.notice.confirmation', {
	timeout: 15_000,
	});
	// --- Sent folder ---
	await popup.locator('#mailboxlist a[rel="sent"], #mailboxlist .sent a').first().click();
	await popup.waitForLoadState('networkidle');
	await expect(popup.locator('#messagelist tbody tr')).toContainText(subject, { timeout: 10_000 });
	// --- Inbox ---
	await popup.locator('#mailboxlist a[rel="inbox"], #mailboxlist .inbox a').first().click();
	await popup.waitForLoadState('networkidle');

That is the correct user-path test. The production state shows that the
Docker-based 1.x upgrade path also needs explicit coverage, including the
missing-file-to-directory failure and release validation that prevents
version-2.0 Podman modules from entering a 1.x image or a 1.x deployment from
being given a Podman-only environment.

Required use cases

UC1 — Existing upgraded Enterprise installation

Given a supported pre-1.7.58 Enterprise installation with OpenMail already
running on Docker, upgrading through 1.7.58, 1.7.59 and a current 1.x release
must remain on Docker and leave a working passwordless Webmail button without
manual file, Compose, socket or container repairs.

UC2 — OpenPanel user launch

A signed-in user may launch only an existing mailbox on a domain owned by that
account. The result must be an authenticated Roundcube inbox, not a login form,
redirect loop, 403, blank page or return to the Emails page.

UC3 — OpenAdmin launch

If OpenAdmin advertises the same feature, an authorized administrator must be
able to launch the intended mailbox through the same supported authentication
contract. Reseller and delegated-administrator boundaries must remain tenant
isolated.

UC4 — Product-line runtime separation

Supported 1.x releases must use the Docker client, Docker environment and Docker
socket for webmail container discovery and token creation. They must not invoke
Podman or require a Podman socket.

OpenPanel 2.x may use its separate Podman implementation on a clean 2.x
installation. Version-specific modules and environment must not be mixed across
those product lines.

An unreachable Docker runtime in 1.x must produce an actionable diagnostic and
must not be reported as “Roundcube is not running” when the Docker container is
actually healthy.

UC5 — Bridge deployment and reconciliation

The source and target of the autologin.php mount must both be regular files.
Installer and updater reconciliation must safely replace the known accidental
empty-directory artifact, validate the downloaded file and fail closed before
restarting Roundcube if any postcondition is false.

Re-running the repair must be idempotent.

UC6 — Token security

The browser receives only a cryptographically strong, opaque, short-lived,
single-use token. It must never receive a mailbox password or Dovecot master
credential.

Token payload files must be created atomically with restrictive permissions,
must not be exposed to unrelated processes, and must be consumed exactly once.
Expired, malformed, missing and replayed tokens must fail without revealing
whether a mailbox or credential exists.

Token-bearing responses must be HTTPS-only and non-cacheable, must not create an
HTTP downgrade, and must prevent token leakage through referrers or ordinary
access-log query strings.

UC7 — Full Roundcube session

After passwordless launch, the target user must be able to:

• list folders and messages over IMAP;
• receive a controlled message;
• compose and send a controlled message with the target mailbox identity;
• save a sent copy;
• use Sieve/ManageSieve where enabled;
• log out and then use normal direct username/password login.

UC8 — Lifecycle and failure behavior

Suspended users, deleted or disabled mailboxes, unowned domains, wrong
mailboxes, expired tokens and stopped mail services must fail closed with
accurate user-facing and administrator diagnostics.

UC9 — Persistence

The complete integration must survive Roundcube recreation, OpenMail restart,
OpenPanel restart, host reboot and a subsequent supported OpenPanel/OpenCLI
update. No customer-maintained bind mount or template override may be required.

Sanitized upgrade reproduction

1. Install a supported Enterprise release immediately before 1.7.58 on Rocky
   Linux 9 or another supported OS.
2. Enable OpenMail/Roundcube and create one controlled account, domain and
   mailbox.
3. Verify direct Roundcube username/password login.
4. Confirm the pre-upgrade
   roundcube-plugins/autologin.php path is absent; do not create it manually.
5. Upgrade through 1.7.58 and 1.7.59 using the supported updater, then update to
   1.7.66 or the candidate fixed release.
6. Inspect the Roundcube Compose mount and run stat on its source and target.
7. Confirm the 1.7.66 panel image contains a 1.x Docker-compatible webmail
   module, does not set either runtime client to a Podman socket, and can list
   the Docker-managed openadmin_roundcube and openadmin_mailserver
   containers.
8. Sign in to OpenPanel as the controlled user and click Webmail beside the
   mailbox.
9. Require the authenticated Roundcube inbox to load without another password.
10. Send a controlled message to the same mailbox and verify Sent and Inbox.
11. Attempt the same token twice and retry after expiry; both attempts must fail
    safely.
12. Test an unowned domain and nonexistent/disabled mailbox; all must fail
    closed.
13. Restart OpenPanel and OpenMail, recreate Roundcube, reboot the host and
    repeat the launch and send/receive tests.
14. Apply the supported updater again and require the reconciliation to remain
    idempotent.

Also run the same functional and security matrix on a clean current 1.x
Enterprise installation. A clean-install pass does not replace the
Docker-based 1.x upgrade-path test. Test the Podman implementation separately
on a clean 2.x installation; do not use a 1.x-to-2.x runtime conversion as the
reproducer or repair.

Expected result

• The documented Webmail button opens the selected mailbox in an authenticated
  Roundcube session without exposing or requesting its password.
• OpenPanel 1.x uses its supported Docker contract end to end; OpenPanel 2.x
  uses its separate Podman contract only on 2.x installations.
• A 1.x release image cannot contain a version-2.0 Podman-only webmail module or
  environment.
• Installer and updater reconciliation are idempotent and repair the known
  directory artifact on existing systems.
• Direct Roundcube login remains available.
• IMAP, SMTP and Sieve use the target mailbox identity correctly.
• Authentication material remains server-side, short-lived, single-use and
  absent from ordinary logs and browser-visible content.

Actual result

• OpenPanel 1.7.66 ships a licensed webmail module that identifies itself as
  version 2.0.0 and invokes Podman inside the vendor-supported Docker-based 1.x
  product line.
• The running 1.7.66 container environment selects a missing Podman socket and
  can report the Docker-managed Roundcube container stopped even while it is
  running.
• The live autologin.php source and destination are empty directories.
• A valid-shaped bridge request follows an HTTP-downgrade redirect and ends at
  Apache 403.
• The 1.7.58 updater can create the directory artifact, and the 1.7.59 repair
  cannot remove it or fail closed.
• The user cannot reach an authenticated Roundcube inbox through the advertised
  passwordless path on the upgraded 1.7.66 installation.

Acceptance criteria for vendor resolution

• A supported in-place repair is provided for existing upgraded customers;
  reinstall is not required.
• OpenPanel 1.7.66 and all supported 1.x builds use Docker for webmail
  container discovery and token creation.
• The 1.x image contains a Docker-compatible 1.x webmail module, not the
  installed version-2.0 Podman module.
• No 1.x webmail path requires or attempts to connect to a Podman socket.
• Version-2.0 Podman modules and environment remain confined to 2.x release
  artifacts and clean 2.x installations.
• Release validation rejects a panel image whose embedded webmail module
  major version/runtime does not match the product line.
• Docker runtime failures in 1.x distinguish an unreachable engine from a
  stopped/missing Roundcube container.
• The autologin mount source and destination are validated as regular files.
• The known empty-directory artifact is repaired safely and idempotently.
• Downloads/install steps use temporary files, validate non-empty PHP and
  syntax, then replace atomically.
• Updater failure is non-zero and Roundcube is not restarted against an
  invalid bridge.
• OpenPanel user launch reaches the correct authenticated mailbox.
• OpenAdmin launch passes where that feature is advertised.
• Unowned domains and unauthorized reseller/admin targets remain isolated.
• Tokens are opaque, unpredictable, short-lived, single-use and replay-safe.
• No mailbox or master credential reaches the browser, URL, HTML or logs.
• Token payload storage is atomic, restrictive and reliably cleaned up.
• The complete redirect chain remains HTTPS and does not expose token values
  through referrers, caches or ordinary query logging.
• Invalid, expired, missing and replayed tokens fail closed without sensitive
  detail.
• IMAP folder/message listing passes after passwordless launch.
• SMTP send, sent-copy and target identity pass.
• Inbound delivery and Inbox visibility pass.
• Sieve/ManageSieve passes where enabled.
• Direct username/password Roundcube login and logout still pass.
• Roundcube recreation, service restart, host reboot and a subsequent update
  all pass.
• Both clean-1.x and pre-1.7.58-to-current-1.x upgrade tests are automated
  on Docker.
• A separate clean-2.x Podman test passes without being used to waive the
  supported 1.x regression.

Requested vendor response

Please confirm:

1. Whether passwordless Roundcube launch from both OpenPanel and OpenAdmin is a
   supported Enterprise feature in 1.7.66.
2. How a version-2.0 Podman webmail module entered the Docker-based 1.7.66
   image, and how the running 1.7.66 container came to receive a Podman-targeting
   environment, despite the documented product-line separation.
3. Which supported 1.x release will restore the Docker-compatible handler and
   include an idempotent repair for the accidental autologin.php directory.
4. What exact supported, reversible remediation existing 1.x Docker customers
   should use in the meantime, without installing Podman or attempting an
   unsupported 1.x-to-2.x migration.
5. Which end-to-end and security tests will gate closure, including upgrade,
   inbox, SMTP send/receive, token replay/expiry, restart and reboot.

We can provide additional sanitized command output from the affected paid
installation if required. We will not publish customer identifiers,
credentials, password hashes, master secrets, real tokens or message content.

[stefanpejcic]

tldr - for support on enterprise please open a support ticket