Deprecation Schedule
Features scheduled for removal in upcoming drydock releases, with migration guidance.
This page lists every deprecated feature, the version it will be removed in, and how to migrate. Deprecated features continue to work until their removal version but emit warnings at startup or in the UI.
Removal in v1.6.0
Unversioned API paths (/api/*)
The unversioned /api/* path is a backward-compatible alias for /api/v1/*. Both return identical responses.
| Deprecated since | v1.4.0 |
| Detection | Startup log warning; UI deprecation banner when legacy API paths are detected |
| Migration | Replace /api/ with /api/v1/ in all integrations |
Implicit wildcard CORS origin
When DD_SERVER_CORS_ENABLED=true and DD_SERVER_CORS_ORIGIN is not set, drydock defaults to * (all origins). This implicit wildcard is deprecated.
| Deprecated since | v1.4.0 |
| Detection | Startup log warning when CORS is enabled without an explicit origin |
| Migration | Set DD_SERVER_CORS_ORIGIN to your trusted origin(s), e.g. DD_SERVER_CORS_ORIGIN=https://drydock.example.com |
Legacy WUD_* environment variables
WUD_* prefixed environment variables (from the upstream WUD project) are accepted as fallbacks for their DD_* equivalents.
| Deprecated since | v1.4.0 |
| Detection | Startup console warning; Prometheus counter dd_legacy_input_total{source="env"}; UI deprecation banner |
| Migration | Rename all WUD_* vars to DD_*. Run drydock config migrate --dry-run to preview changes |
Legacy wud.* container labels
wud.* prefixed Docker labels are accepted as fallbacks for their dd.* equivalents (20 labels total including wud.watch, wud.tag.include, wud.tag.exclude, etc.).
| Deprecated since | v1.4.0 |
| Detection | Per-label log warning on container init; Prometheus counter dd_legacy_input_total{source="label"}; UI deprecation banner |
| Migration | Rename all wud.* labels to dd.* in your compose files. Run drydock config migrate --file /path/to/compose.yml |
Legacy template variable aliases
Simple template variables (id, name, watcher, kind, semver, local, remote, link) and batch variable count resolve to single container properties.
| Deprecated since | v1.4.0 |
| Detection | Log warning when ${variable} syntax is used in trigger templates |
| Migration | Replace with container.* equivalents: id → container.id, name → container.name, count → containers.length, etc. See Trigger templates |
PUT /api/settings
The PUT method on /api/settings is a compatibility alias for PATCH. Responses include Deprecation and Sunset HTTP headers.
| Deprecated since | v1.4.0 |
| Detection | Log warning on each PUT request; Deprecation and Sunset response headers |
| Migration | Change PUT /api/settings to PATCH /api/settings |
HTTP OIDC discovery URLs
OIDC providers configured with http:// discovery URLs are deprecated. Identity Providers must support HTTPS.
| Deprecated since | v1.4.0 |
| Detection | Startup log warning; UI deprecation banner |
| Migration | Update your IdP discovery URL to use https://. If your IdP uses a self-signed certificate, set DD_AUTH_OIDC_{name}_INSECURE=true |
Legacy password hash formats
SHA-1, APR1/MD5 (Apache), crypt, and plain text password hashes from v1.3.9 are deprecated.
| Deprecated since | v1.4.0 |
| Detection | Startup log warning; UI deprecation banner |
| Migration | Regenerate your password hash with argon2id. See Basic authentication |
Kafka clientId configuration key
The camelCase clientId key in Kafka trigger configuration is deprecated.
| Deprecated since | v1.4.5 |
| Detection | Startup log warning |
| Migration | Rename clientId to clientid (lowercase) in your Kafka trigger configuration |
DD_WATCHER_*_WATCHDIGEST environment variable
Per-watcher digest watching via environment variable is deprecated.
| Deprecated since | v1.4.0 |
| Detection | Startup log warning |
| Migration | Use the dd.watch.digest=true label on individual containers instead |
DD_WATCHER_*_WATCHATSTART environment variable
This variable is a no-op — watching at startup has been the default since v1.3.
| Deprecated since | v1.4.0 |
| Detection | Startup log warning |
| Migration | Remove the variable from your configuration |
curl in Docker image
The official Docker image previously included curl for custom healthcheck overrides. The built-in HEALTHCHECK now uses a lightweight static binary (/bin/healthcheck).
| Deprecated since | v1.5.0 |
| Detection | Not runtime-detectable (Docker executes healthchecks outside the application) |
| Migration | Remove custom healthcheck: blocks from your drydock compose service — the image handles it automatically. If you need custom intervals, use test: /bin/healthcheck ${DD_SERVER_PORT:-3000}. See Monitoring |
Registry PUBLIC_TOKEN configuration
Token-based authentication for public registries has been replaced by password-based authentication for consistency.
| Deprecated since | v1.4.0 |
| Detection | Startup log warning when fallback to anonymous is triggered |
| Migration | Replace DD_REGISTRY_HUB_PUBLIC_TOKEN with DD_REGISTRY_HUB_PUBLIC_PASSWORD. Replace DD_REGISTRY_DHI_TOKEN with DD_REGISTRY_DHI_PASSWORD |
Removal in v1.7.0
DD_TRIGGER_* environment variable prefix
The DD_TRIGGER_* prefix is being replaced by semantic prefixes that distinguish action triggers from notification triggers.
| Deprecated since | v1.5.0 |
| Detection | Startup log warning; Prometheus counter dd_legacy_input_total; UI deprecation banner |
| Migration | Rename DD_TRIGGER_* to DD_ACTION_* (for Docker/Compose/Command triggers) or DD_NOTIFICATION_* (for Slack/email/Pushover/etc.). Run drydock config migrate --source trigger to auto-rewrite. See Triggers |
dd.trigger.include / dd.trigger.exclude container labels
These labels are being replaced by semantic equivalents.
| Deprecated since | v1.5.0 |
| Detection | Log warning during container initialization |
| Migration | Replace dd.trigger.include with dd.action.include or dd.notification.include. Replace dd.trigger.exclude with dd.action.exclude or dd.notification.exclude |
Detection summary
Drydock provides multiple channels for discovering deprecated feature usage:
| Channel | Covers |
|---|---|
| Startup log warnings | All runtime-detectable deprecations |
| UI deprecation banners | Legacy config, legacy API paths, OIDC HTTP, legacy password hashes |
| Prometheus counters | dd_legacy_input_total{source,key} for env vars, labels, and API paths |
| HTTP response headers | Deprecation and Sunset on PUT /api/settings |
| Migration CLI | drydock config migrate --dry-run previews all env var and label renames |