Self-Hosted Deployment Platform Security

Coolify Security Testing: Default Credentials, Docker API Exposure, SSH Key Management, and Container Escape

📅 July 3, 2026 ⏱ 14 min read 🏷 Coolify, Self-Hosted PaaS Security, Docker Socket Security, SSH Key Management, Container Security

Coolify is an increasingly popular open-source self-hosted deployment platform (a Heroku/Vercel alternative) built on Laravel, used by developers and small teams to deploy applications, databases, and services from Git repositories or Docker images. Its security profile has high-severity characteristics that warrant careful assessment: Coolify runs as root and mounts the Docker socket (/var/run/docker.sock) to manage container lifecycles — any compromise of the Coolify web interface grants Docker daemon access equivalent to root on the host system; Coolify manages SSH private keys to connect to remote deployment servers — these keys are stored in Coolify's database and a compromise of the database yields persistent SSH access to every managed server; Coolify's wildcard subdomain configuration (e.g., *.apps.company.com) automatically assigns subdomains to deployments — dangling CNAME records or misconfigured wildcard DNS can enable subdomain takeover for expired deployments; Coolify's application environment variable storage keeps secrets including database passwords, API keys, and SMTP credentials in the Coolify database accessible to admin users; and open user registration in Coolify instances gives any registered user the ability to create servers, databases, and application deployments consuming organizational infrastructure. This guide covers systematic Coolify security assessment.

Coolify Discovery and Registration Status
Docker Socket Exposure via Interface Compromise
SSH Key Management Risks
Environment Variable and Secret Storage
Coolify Security Hardening

Coolify Discovery and Registration Status

# Coolify serves a Vue/React SPA — check for registration page accessibility
COOLIFY_URL="https://coolify.example.com"

# Check if registration is open (any user can create an account)
REG_STATUS=$(curl -s -o /dev/null -w "%{http_code}" \
  "${COOLIFY_URL}/register" 2>/dev/null)
echo "Registration page: HTTP ${REG_STATUS}"
# 200 = open registration; anyone can create accounts

# Check if Coolify has an unauthenticated API
curl -s "${COOLIFY_URL}/api/v1/healthcheck" 2>/dev/null
# Should return version info — verify what's accessible without auth

# Enumerate Coolify API endpoints without authentication
for ENDPOINT in "settings" "servers" "projects" "teams" "resources"; do
  CODE=$(curl -s -o /dev/null -w "%{http_code}" \
    "${COOLIFY_URL}/api/v1/${ENDPOINT}" 2>/dev/null)
  echo "/api/v1/${ENDPOINT}: HTTP ${CODE}"
done

Docker Socket Exposure via Interface Compromise

# Coolify mounts /var/run/docker.sock into its container
# If the Coolify container is compromised, Docker socket access = host root

# Verify Docker socket is mounted (from inside compromised Coolify container context)
# docker inspect coolify | grep -i docker.sock

# From outside: if Docker daemon API is exposed on port 2375 or 2376 (misconfiguration)
# Test for exposed Docker API (should NOT be internet-accessible)
for PORT in 2375 2376; do
  CODE=$(curl -s -o /dev/null -w "%{http_code}" \
    "http://coolify.example.com:${PORT}/v1.41/info" 2>/dev/null)
  if [ "$CODE" == "200" ]; then
    echo "CRITICAL: Docker API exposed on port ${PORT} — full container/host control"
    curl -s "http://coolify.example.com:${PORT}/v1.41/info" 2>/dev/null | \
      python3 -c "
import json,sys
d = json.load(sys.stdin)
print(f\"Docker version: {d.get('ServerVersion','?')}\")
print(f\"Containers: {d.get('Containers','?')} total\")
print(f\"Host kernel: {d.get('KernelVersion','?')}\")
" 2>/dev/null
  fi
done

# Via Coolify admin — demonstrate Docker socket access risk:
# Admin users can deploy containers, exec into running containers,
# and view all running workloads including other users' applications
# Privileged container escape example (from pentesting documentation):
# docker run -v /:/host --rm -it alpine chroot /host sh

Coolify Security Hardening

Coolify Security Hardening Checklist:

Restrict Coolify to trusted network access — use a reverse proxy with IP allowlisting or require VPN access to reach the Coolify interface; the Docker socket mount means any Coolify admin account represents a path to host-level compromise
Disable public registration — unless Coolify is intentionally multi-tenant, disable user registration so only invited team members can create accounts; configure Coolify to use SSO with your identity provider instead of open registration
Protect SSH key storage — Coolify's SSH private keys for managed servers should use passphrase-protected keys where possible; regularly audit which keys are stored in Coolify and rotate them if the Coolify instance is ever suspected of compromise
Audit environment variables regularly — review all application environment variables stored in Coolify for sensitive secrets; consider using an external secret manager (Vault, AWS Secrets Manager) for production secrets rather than storing them in Coolify's database
Use least-privilege deployment accounts — the SSH keys used by Coolify for remote server management should connect as a limited deployment user, not root; configure sudo rules that grant only the necessary Docker commands rather than full root access
Enable Coolify multi-factor authentication — Coolify supports 2FA for user accounts; require MFA for all users especially team owners and administrators given the high-privilege nature of Coolify access
Monitor wildcard subdomain DNS — audit your wildcard DNS configuration regularly; ensure that DNS records for Coolify-managed subdomains are removed promptly when deployments are deleted to prevent subdomain takeover

Security Test	Method	Risk
Open registration allowing unauthorized users to create accounts	GET /register — accessible registration page allows any internet user to create a Coolify account and deploy resources	High
Docker API exposed on host network	curl http://coolify-host:2375/v1.41/info — unauthenticated Docker API access = full container and host control	Critical
Docker socket mounted in Coolify container	Admin interface compromise → Docker socket access → privileged container spawn → host root access	Critical
SSH private keys for managed servers in database	Database dump or admin API access yields SSH private keys for all Coolify-managed servers — lateral movement to all managed infrastructure	Critical
Application environment variables accessible to admins	Admin can view all application environment variables including database passwords, API keys, and SMTP credentials stored in Coolify	High
Wildcard subdomain dangling DNS entries	Deleted deployments may leave DNS records pointing to Coolify — new deployment claiming that subdomain enables takeover	Medium

Automate Coolify Security Testing

Ironimo tests Coolify deployments for open registration allowing unauthorized users to create accounts and deploy resources, Docker API exposed on host network ports enabling unauthenticated container and host control, Docker socket mount in Coolify container enabling host-level code execution from web interface compromise, SSH private keys for managed remote servers stored in database accessible to admin users, application environment variable storage exposing production secrets to Coolify administrators, and wildcard DNS configurations creating subdomain takeover opportunities for deleted deployments.

Start free scan

Table of Contents

Coolify Discovery and Registration Status

Docker Socket Exposure via Interface Compromise

Coolify Security Hardening

Automate Coolify Security Testing