Dokku proxy exposure is an application-auth question
Dokku deploys applications through a host-level workflow and routes requests through a proxy. A scan can find an application page without revealing the Dokku control plane. The exposed service may be the application itself, a status route, an administrative endpoint or a proxy default.
Title evidence without an app fingerprint
On 2026-11-07 UTC, page-one count-only ZoomEye probes with sub_type=all returned zero for app="Dokku" and 1,478 for title="Dokku". The title query is ordinary contains matching, so the count should be reviewed for ownership and context. It is not a direct count of Dokku servers.
The management and deployment path is usually separate from the public web application. SSH access to the host, repository credentials and CI tokens belong in the control-plane inventory even when the public page looks harmless.
Check every route
Dokku's proxy documentation notes that the proxy can be configured per app and that an app remains reachable on a high port when its domains are disabled. That behavior is useful for internal services, but it also means an operator should not assume that removing a domain removes network reachability.
For each routed app, record the domains, exposed ports, upstream service, TLS termination and authentication method. If the app has no built-in login, place an identity-aware proxy or network policy in front of it. Do not rely on an obscure hostname as the access control.
Review the proxy's access logs and the application's own logs together. A request can reach a backend even when the outer page shows an error or a maintenance response. Confirm which component returned the final status and which identity reached the upstream.
Separate control from data
The Dokku host and the deployed app have different security decisions. Rotate deployment keys, restrict SSH access and review the CI principal's ability to deploy or change configuration. On the application side, test anonymous access, a normal user and an administrator. Check direct high-port access when domains are disabled.
Use the scan result to find candidate hosts, then validate them against DNS and ownership records. The important evidence is the route, the authentication check and the service behind it.
Top comments (0)