Gately v0.6.1 released

October 30, 2026

This release contains a security fix. All users who have Docker management enabled and use read-only accounts or read-only API tokens should upgrade soon. It also resolves #35, #37, #38 and #40, and adds a security policy.

Download v0.6.1 · GitHub Release · Security advisory GHSA-m6h7-mm5r-r53q

Security fix: Docker read-only access exposed container secrets

In v0.6.0.4 and earlier, read-only accounts and API tokens with only the docker:read permission could read container environment variables, Command, Entrypoint and start arguments in plain text through GET /api/docker/containers/{id}, and the process list showed full command lines, so common database passwords and API keys were available to read-only identities. Thanks to Yousef Alturki (@YousefAlturki) for reporting it responsibly.

After the fix:

• when an identity without Docker write permission views a container, environment variables show only their names, and values, Command, Entrypoint, start arguments and command arguments in the process list show as ********; environment variables, Cmd, Entrypoint and build history commands in image details are hidden the same way;
• plain values now come from GET /api/docker/containers/{id}/secrets, which requires docker:write. The edit form loads them automatically for administrators, and fields submitted with the placeholder keep their original values;
• a container name or ID prefix in a request is resolved to the full ID first, so the protection for the container Gately itself runs in can no longer be bypassed with a container name. Editing and upgrade recreation always handle the old container by its full ID, which fixes the cleanup step deleting the new container and rollback failing when called by name. Starting, stopping or deleting the container while it is being recreated returns 409.

After upgrading, check whether read-only API tokens were ever handed to untrusted parties, and rotate the secrets in your containers if needed. See SECURITY.md for how to report vulnerabilities, through GitHub private vulnerability reporting or by email.

Certificate issuance network

Certificates have a new "Network" option (#35): "IPv4 only" or "IPv6 only" makes contacting the CA, calling the DNS provider API and checking that TXT records have taken effect use only that address family. When a host has an IPv6 address but IPv6 does not actually work, the propagation check used to time out while querying the authoritative DNS servers and issuance failed; choosing "IPv4 only" solves it. When going through a proxy such as HTTPS_PROXY, the connection to the proxy itself is not restricted by this option. See SSL Certificates · Issuance network.

Protection for Gately's own container

Upgrade, batch upgrade and edit-and-recreate on the Docker page, as well as running up on or deleting the Compose project Gately belongs to, all stop the old container first. The Gately process exited with it, the recreation never finished and the container was left stopped (#38). These operations are now refused for Gately's own container: the buttons are greyed out with a hint to update on the host, and batch upgrade skips it. When restarting the Compose project Gately belongs to, Gately's own container is restarted last.

Notifications and logs follow the interface language

When the server language is "Follow system", Gately uses the language set by GATELY_LANG or LANG. Docker, fnOS and OpenWrt usually set neither, so notifications fell back to English (#40). They now follow the interface language of the administrator's last login or of the last switch in the top bar; read-only account logins do not change it. The "Source" of a notification is translated when it is a program-generated name, while task names entered by users stay as they are. English logs with prefixes such as [warn] [auth] are no longer half Chinese.

Set default site

When a Web Services listener has no default site configured yet, its card has a new "Set default site" button (#37) to configure directly how requests matching no domain are handled.

Upgrading

• Docker: pull the new image and recreate the container. OpenWrt: install the new .apk / .ipk over the old one, and install luci-app-gately of the same version if you want the LuCI page. fnOS: install the new .fpk manually in the App Center. Other installs can upgrade online in "System settings".