extractImageTag misidentifies registry port as tag for private registry images without explicit tags

[mahdirajaee]

Description

The extractImageTag function in apps/dokploy/pages/api/deploy/[refreshToken].ts has a parsing flaw for Docker images hosted on private registries with port numbers but no explicit tag.

For an image like myregistry:5000/myapp (no tag specified):

const tag = dockerImage.split(":").pop();
return tag === dockerImage ? "latest" : tag;

split(":") on myregistry:5000/myapp produces ["myregistry", "5000/myapp"]. .pop() returns "5000/myapp", which is not equal to the original string, so the function returns "5000/myapp" as the tag instead of "latest".

Meanwhile, extractImageName correctly handles port numbers by checking whether the substring after the last colon is a port via a regex. extractImageTag has no equivalent logic.

Impact

Webhook-triggered auto-deployments for Docker images on private registries (e.g., registry.internal:5000/app) will fail tag matching. The configured tag is parsed as "5000/app" instead of "latest", causing webhook payloads with real tags to be rejected with "Application Image Tag doesn't match".

Fix

Apply the same lastIndexOf + port-number-detection logic from extractImageName to extractImageTag, returning "latest" when the only colon is part of a registry port.

[dosubot]

Great bug report! I can confirm this issue exists. Looking at the code:

The buggy extractImageTag:

const tag = dockerImage.split(":").pop();
return tag === dockerImage ? "latest" : tag;

The correct extractImageName uses:

const afterColon = dockerImage.substring(lastColonIndex + 1);
const isPortNumber = /^\d{1,5}$/.test(afterColon);
if (isPortNumber) {
    return dockerImage; // Don't split on port
}

Your suggested fix is correct—extractImageTag should adopt the same lastIndexOf + port-detection logic:

export function extractImageTag(dockerImage: string | null) {
    if (!dockerImage || typeof dockerImage !== "string") {
        return null;
    }

    const lastColonIndex = dockerImage.lastIndexOf(":");
    if (lastColonIndex === -1) {
        return "latest";
    }

    const afterColon = dockerImage.substring(lastColonIndex + 1);
    const isPortNumber = /^\d{1,5}$/.test(afterColon);

    if (isPortNumber) {
        return "latest";
    }

    return afterColon;
}

I'd also note that the existing tests cover images with explicit tags (myregistryhost:5000/fedora/httpd:version1.0), but there's no test for the edge case you've identified (myregistryhost:5000/fedora/httpd without a tag). Adding that test case would help prevent regression.

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}

   

[mahdirajaee]

Thanks for confirming. The suggested fix with lastIndexOf + port detection looks right to me. I can open a PR for this with the missing test case if the team is open to it.