feat(application): customizable env file name for Dockerfile builds - #5073

Reopen of #4508 (which was auto-closed when I temporarily deleted my fork).

What is this PR about?

Adds an optional 'Env file name' setting (default: .env) that lets users write the Dokploy-generated env file to a path that does not conflict with a committed .env. Useful for frameworks like Next.js where writing to .env.local or .env.production.local naturally overrides committed defaults via the framework's precedence chain.

Checklist

Before submitting this PR, please make sure that:

• You created a dedicated branch based on the canary branch.
• You have read the suggestions in the CONTRIBUTING.md file https://github.com/Dokploy/dokploy/blob/canary/CONTRIBUTING.md#pull-request
• You have tested this PR in your local instance. If you have not tested it yet, please do so before submitting. This helps avoid wasting maintainers' time reviewing code that has not been verified by you.

Issues related (if applicable)

closes #4507

Screenshots (if applicable)

Dokploy UI

Test Dockerfile build using a zip dropped in the UI, containing this Dockerfile and a .env

FROM alpine:3.19

WORKDIR /app

COPY . .

RUN echo "=========== BUILD CONTEXT ===========" && \
    ls -la && \
    echo "=========== .env FILES ===========" && \
    for f in .env .env.local; do \
      if [ -f "$f" ]; then \
        echo ""; echo "--- $f ---"; cat "$f"; echo ""; \
      fi; \
    done && \
    echo "=========== END ==========="

CMD echo "=========== RUNTIME ===========" && \
    ls -la && \
    for f in .env .env.local; do \
      if [ -f "$f" ]; then \
        echo ""; echo "--- $f ---"; cat "$f"; echo ""; \
      fi; \
    done && \
    echo "=========== END ===========" && \
    tail -f /dev/null

Build logs with default file name : default .env is overwritten

Build logs with .env.local file name

Runtime logs with .env.local file name

Greptile Summary

The PR adds a configurable generated environment-file path for Dockerfile builds, with a .env default.

• Persists and exposes the setting through the application schema, migration, API, and dashboard form.
• Validates relative path segments and creates missing parent directories before writing the generated file.
• Passes the configured path into Dockerfile build-command generation.

Confidence Score: 3/5

The PR is not yet safe to merge because a nested environment-file path can follow a repository-controlled symlink and expose generated secrets outside the application workspace.

The current validator enforces lexical path safety, but the write path performs no canonical containment check before mkdir -p and shell redirection, leaving the previously reported symlink escape unresolved.

Files Needing Attention: packages/server/src/utils/builders/utils.ts

_{Reviews (6): Last reviewed commit: "feat(application): customizable env file..." | Re-trigger Greptile}

Context used:

• Knowledge Base — Application Deployment Flow