- @if ($outputs)
- @php
- $displayLines = collect(explode("\n", $outputs))->filter(fn($line) => trim($line) !== '');
- $lineOccurrences = [];
- @endphp
-
!$showTimeStamps,
- ])>
-
- @if ($showTimeStamps)
- Time
- @endif
- Type
- Message
-
-
- No matches found.
-
- @foreach ($displayLines as $line)
- @php
- $lineFingerprint = md5($line);
- $lineOccurrence = $lineOccurrences[$lineFingerprint] ?? 0;
- $lineOccurrences[$lineFingerprint] = $lineOccurrence + 1;
-
- // Parse timestamp from log line (ISO 8601 format: 2025-12-04T11:48:39.136764033Z)
- $timestamp = '';
- $logContent = $line;
- if (preg_match('/^(\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2})(?:\.(\d+))?Z?\s(.*)$/', $line, $matches)) {
- $logContent = $matches[3];
-
- // Convert UTC Docker timestamp to server timezone for display
- $carbonTs = \Carbon\Carbon::parse($matches[1], 'UTC');
- $serverTz = getServerTimezone($server);
- try {
- $carbonTs->setTimezone($serverTz);
- } catch (\Exception) {
- // keep UTC
- }
- $timestamp = $carbonTs->format('Y-M-d H:i:s');
- }
- @endphp
- @php($lineKey = $lineFingerprint.'-'.$lineOccurrence)
-
- @if ($timestamp && $showTimeStamps)
-
{{ $timestamp }}
- @endif
-
{{ $logContent }}
+
+
+ Loading logs
+
+
+
+
+
+
+
No logs yet
+
Logs will appear here when the container produces output.
+
+
+ {{-- Alpine renders only the visible rows. Livewire must not morph them. --}}
+
+
+ Time
+ Type
+ Message
+
+
- @else
-
-
-
Loading logs
+
+ No matches found.
-
-
-
-
-
-
No logs yet
-
Logs will appear here when the container produces output.
-
-
- @endif
+
diff --git a/tests/Feature/GetLogsCommandInjectionTest.php b/tests/Feature/GetLogsCommandInjectionTest.php
index f7aac5fcb4..c2ff1eb50b 100644
--- a/tests/Feature/GetLogsCommandInjectionTest.php
+++ b/tests/Feature/GetLogsCommandInjectionTest.php
@@ -11,7 +11,6 @@ use App\Models\Team;
use App\Models\User;
use App\Support\ValidationPatterns;
use Illuminate\Foundation\Testing\RefreshDatabase;
-use Illuminate\Process\FakeProcessResult;
use Illuminate\Support\Facades\Process;
use Livewire\Attributes\Locked;
use Livewire\Livewire;
@@ -92,9 +91,10 @@ describe('GetLogs Livewire action validation', function () {
->assertSee('All')
->assertSeeHtml('title="Show all logs"')
->call('showAllLogs')
- ->assertSet('numberOfLines', -1);
+ ->assertSet('numberOfLines', -1)
+ ->assertReturned('all logs');
- Process::assertRan(fn ($process) => str_contains($process->command, 'docker logs -n all'));
+ Process::assertRan(fn ($process) => str_contains($process->command, 'docker logs -n all -t test-container'));
});
test('getLogs marks ANSI-colored output truncated based on raw bytes', function () {
@@ -108,23 +108,15 @@ describe('GetLogs Livewire action validation', function () {
expect(strlen($output))->toBe(GetLogs::MAX_DISPLAY_SIZE_BYTES + 1);
- Process::shouldReceive('timeout')->once()->andReturnSelf();
- Process::shouldReceive('run')->andReturnUsing(function (string $command, ?callable $callback = null) use ($output): FakeProcessResult {
- if ($callback) {
- $callback('out', $output);
- }
-
- return new FakeProcessResult(command: $command);
- });
+ Process::fake(['*' => Process::result(output: $output)]);
$component = new GetLogs;
$component->server = $server;
$component->resource = $this->application;
$component->container = 'test-container';
$component->showTimeStamps = false;
- $component->getLogs(true);
- expect($component->outputs)
+ expect($component->getLogs())
->toContain('[... Output truncated at 5MB limit ...]')
->not->toContain("\e[31m");
});
@@ -145,7 +137,7 @@ describe('GetLogs Livewire action validation', function () {
'container' => 'container;malicious-command',
])
->call('getLogs')
- ->assertSet('outputs', 'Invalid container name.');
+ ->assertReturned('Invalid container name.');
});
test('getLogs rejects unauthorized server access', function () {
@@ -158,7 +150,7 @@ describe('GetLogs Livewire action validation', function () {
'container' => 'test-container',
])
->call('getLogs')
- ->assertSet('outputs', 'Unauthorized.');
+ ->assertReturned('Unauthorized.');
});
test('downloadAllLogs returns empty for invalid container name', function () {
@@ -192,17 +184,117 @@ describe('GetLogs Livewire action validation', function () {
});
});
-describe('GetLogs stream polling', function () {
- test('streaming logs polls when log panel is not collapsible', function () {
+describe('GetLogs browser-rendered output', function () {
+ beforeEach(function () {
+ $this->server->settings->fill([
+ 'is_reachable' => true,
+ 'is_usable' => true,
+ 'force_disabled' => false,
+ ])->save();
+ $this->functionalServer = Server::with('settings')->findOrFail($this->server->id);
+ });
+
+ test('getLogs returns timestamped output without storing it in component state', function () {
+ Process::fake(['*' => Process::result(output: "2026-09-28T10:00:02Z second\n2026-09-28T10:00:01Z first")]);
+
+ $component = Livewire::test(GetLogs::class, [
+ 'server' => $this->functionalServer,
+ 'resource' => $this->application,
+ 'container' => 'test-container',
+ ])
+ ->set('showTimeStamps', false)
+ ->call('getLogs')
+ ->assertReturned("2026-09-28T10:00:01Z first\n2026-09-28T10:00:02Z second");
+
+ expect($component->instance())->not->toHaveProperty('outputs');
+ Process::assertRan(fn ($process) => str_contains($process->command, 'docker logs -n 100 -t test-container'));
+ });
+
+ test('getLogs only requests new lines when streaming from a timestamp', function () {
+ Process::fake(['*' => Process::result(output: '2026-09-28T10:00:03Z new')]);
+
Livewire::test(GetLogs::class, [
- 'server' => $this->server,
+ 'server' => $this->functionalServer,
+ 'resource' => $this->application,
+ 'container' => 'test-container',
+ ])
+ ->call('getLogs', '2026-09-28T10:00:02.123456789Z')
+ ->assertReturned('2026-09-28T10:00:03Z new');
+
+ Process::assertRan(fn ($process) => str_contains($process->command, 'docker logs --since 2026-09-28T10:00:02.123456789Z -t test-container'));
+ });
+
+ test('getLogs prefixes the streaming command with sudo for non-root servers', function () {
+ $this->functionalServer->update(['user' => 'ubuntu']);
+ Process::fake(['*' => Process::result(output: '')]);
+
+ Livewire::test(GetLogs::class, [
+ 'server' => $this->functionalServer->fresh(['settings']),
+ 'resource' => $this->application,
+ 'container' => 'test-container',
+ ])->call('getLogs', '2026-09-28T10:00:02Z');
+
+ Process::assertRan(fn ($process) => str_contains($process->command, '(sudo docker logs --since 2026-09-28T10:00:02Z -t test-container) 2>&1 | head -c'));
+ });
+
+ test('getLogs ignores a since value that is not a docker timestamp', function (string $since) {
+ Process::fake(['*' => Process::result(output: 'logs')]);
+
+ Livewire::test(GetLogs::class, [
+ 'server' => $this->functionalServer,
+ 'resource' => $this->application,
+ 'container' => 'test-container',
+ ])->call('getLogs', $since);
+
+ Process::assertRan(fn ($process) => str_contains($process->command, 'docker logs -n 100 -t test-container')
+ && ! str_contains($process->command, '--since'));
+ })->with([
+ 'command substitution' => ['2026-09-28T10:00:02Z$(id)'],
+ 'shell separator' => ['2026-09-28T10:00:02Z; id'],
+ 'relative duration' => ['10m'],
+ ]);
+
+ test('copyLogs keeps line order and omits timestamps when timestamps are hidden', function () {
+ Process::fake(['*' => Process::result(output: "zeta\nalpha")]);
+
+ Livewire::test(GetLogs::class, [
+ 'server' => $this->functionalServer,
+ 'resource' => $this->application,
+ 'container' => 'test-container',
+ ])
+ ->set('showTimeStamps', false)
+ ->call('copyLogs')
+ ->assertReturned("zeta\nalpha");
+
+ Process::assertRan(fn ($process) => str_contains($process->command, 'docker logs -n 100 test-container'));
+ });
+
+ test('copyLogs returns empty for unauthorized server', function () {
+ $otherServer = Server::factory()->create(['team_id' => Team::factory()->create()->id]);
+
+ Livewire::test(GetLogs::class, [
+ 'server' => $otherServer,
+ 'resource' => $this->application,
+ 'container' => 'test-container',
+ ])
+ ->call('copyLogs')
+ ->assertReturned('');
+ });
+
+ test('streaming does not render log lines or poll through Livewire', function () {
+ Process::fake(['*' => Process::result(output: '2026-09-28T10:00:01Z secret-looking line')]);
+
+ Livewire::test(GetLogs::class, [
+ 'server' => $this->functionalServer,
'resource' => $this->application,
'container' => 'coolify-sentinel',
'collapsible' => false,
])
- ->assertDontSeeHtml('wire:poll.2000ms="getLogs(true)"')
->call('toggleStreamLogs')
- ->assertSeeHtml('wire:poll.2000ms="getLogs(true)"');
+ ->assertSet('streamLogs', true)
+ ->call('getLogs')
+ ->assertDontSeeHtml('wire:poll')
+ ->assertDontSee('secret-looking line');
});
});
diff --git a/tests/Feature/StableNestedLivewireKeysTest.php b/tests/Feature/StableNestedLivewireKeysTest.php
index 56a21bf659..a90afd6bef 100644
--- a/tests/Feature/StableNestedLivewireKeysTest.php
+++ b/tests/Feature/StableNestedLivewireKeysTest.php
@@ -46,12 +46,15 @@ it('keys nested Livewire status components rendered inside navigation loops', fu
->toContain(':key="\'application-server-status-\'.$application->uuid"');
});
-it('keys rolling log lines by content occurrence instead of list position', function () {
- $logs = file_get_contents(resource_path('views/livewire/project/shared/get-logs.blade.php'));
+it('keys virtual log rows by stable line identity instead of list position', function () {
+ $view = file_get_contents(resource_path('views/livewire/project/shared/get-logs.blade.php'));
+ $script = file_get_contents(resource_path('js/runtime-logs.js'));
- expect($logs)
- ->toContain('$lineOccurrences = [];')
- ->toContain('$lineFingerprint = md5($line);')
- ->toContain('wire:key="log-{{ $lineFingerprint }}-{{ $lineOccurrence }}"')
- ->not->toContain("'line-' . \$index");
+ expect($view)
+ ->toContain(':key="row.key"')
+ ->not->toContain(':key="row.index"');
+
+ expect($script)
+ ->toContain('getItemKey: (index) => filtered[index]?.id ?? index')
+ ->toContain('id: nextId()');
});
diff --git a/tests/Unit/LogViewerXssSecurityTest.php b/tests/Unit/LogViewerXssSecurityTest.php
index e3230c1fdd..3067f24cd1 100644
--- a/tests/Unit/LogViewerXssSecurityTest.php
+++ b/tests/Unit/LogViewerXssSecurityTest.php
@@ -46,19 +46,27 @@ describe('Log Viewer XSS Prevention', function () {
});
it('uses text nodes for search highlighting instead of injected html', function () {
- $views = [
- __DIR__.'/../../resources/views/livewire/project/application/deployment/show.blade.php',
- __DIR__.'/../../resources/views/livewire/project/shared/get-logs.blade.php',
- ];
+ $deploymentView = file_get_contents(__DIR__.'/../../resources/views/livewire/project/application/deployment/show.blade.php');
- foreach ($views as $view) {
- $contents = file_get_contents($view);
+ expect($deploymentView)
+ ->toContain('document.createTextNode')
+ ->toContain('mark.textContent')
+ ->not->toContain('innerHTML')
+ ->not->toContain('x-html');
+ });
- expect($contents)
- ->toContain('document.createTextNode')
- ->toContain('mark.textContent')
- ->not->toContain('innerHTML')
- ->not->toContain('x-html');
- }
+ it('renders runtime log text and highlight segments with x-text only', function () {
+ $runtimeView = file_get_contents(__DIR__.'/../../resources/views/livewire/project/shared/get-logs.blade.php');
+ $runtimeScript = file_get_contents(__DIR__.'/../../resources/js/runtime-logs.js');
+
+ expect($runtimeView)
+ ->toContain('x-text="segment.text"')
+ ->toContain('x-text="formatLogDetails(row.line.text)"')
+ ->not->toContain('innerHTML')
+ ->not->toContain('x-html');
+
+ expect($runtimeScript)
+ ->not->toContain('innerHTML')
+ ->not->toContain('insertAdjacentHTML');
});
});
diff --git a/tests/v4/Browser/RuntimeLogsVirtualizationTest.php b/tests/v4/Browser/RuntimeLogsVirtualizationTest.php
new file mode 100644
index 0000000000..8b849859e2
--- /dev/null
+++ b/tests/v4/Browser/RuntimeLogsVirtualizationTest.php
@@ -0,0 +1,126 @@
+set('app.maintenance.store', 'array');
+ $this->stack = seedBrowserResourceStack();
+
+ // 50,000 timestamped lines, the maximum the viewer accepts.
+ $this->bigLog = implode("\n", array_map(
+ fn (int $i) => sprintf('2026-09-28T10:%02d:%02d.%09dZ log line %05d', intdiv($i, 3600) % 60, intdiv($i, 60) % 60, $i, $i),
+ range(1, 50000),
+ ));
+
+ Process::fake(function (PendingProcess $process) {
+ if (str_contains($process->command, '--since')) {
+ return Process::result(output: '2026-09-28T23:59:59Z streamed line after since');
+ }
+ if (str_contains($process->command, 'docker logs')) {
+ return Process::result(output: $this->bigLog);
+ }
+
+ return Process::result();
+ });
+});
+
+it('renders 50,000 runtime log lines with only the visible rows in the DOM', function () {
+ $page = visit('/login')
+ ->fill('email', 'test@example.com')
+ ->fill('password', 'password')
+ ->click('Login')
+ ->assertSee('Dashboard')
+ ->navigate("/server/{$this->stack['server']->uuid}/sentinel/logs");
+
+ $page->assertSee('log line 00001');
+
+ expect($page->script('document.querySelectorAll("[data-log-line]").length'))->toBeLessThan(100);
+
+ // Scroll to the end: the last line is rendered, the first line is not.
+ $page->script('(() => { const el = document.getElementById("logsContainer"); el.scrollTop = el.scrollHeight; })()');
+ $page->wait(0.5)
+ ->assertSee('log line 50000')
+ ->assertDontSee('log line 00001');
+
+ expect($page->script('document.querySelectorAll("[data-log-line]").length'))->toBeLessThan(100);
+
+ $page->screenshot(filename: 'runtime-logs-virtualized-end');
+});
+
+it('searches all loaded lines and highlights matches', function () {
+ $page = visit('/login')
+ ->fill('email', 'test@example.com')
+ ->fill('password', 'password')
+ ->click('Login')
+ ->assertSee('Dashboard')
+ ->navigate("/server/{$this->stack['server']->uuid}/sentinel/logs");
+
+ $page->assertSee('log line 00001')
+ ->type('input[aria-label="Find in logs"]', 'line 4999')
+ ->wait(0.6)
+ ->assertSee('log line 49990')
+ ->assertDontSee('log line 00001');
+
+ expect($page->script('document.querySelectorAll(".log-highlight").length'))->toBe(10)
+ ->and($page->script('document.querySelector(".log-highlight").textContent'))->toBe('line 4999');
+
+ // Row details still open inside the virtual list.
+ $page->click('log line 49990')
+ ->wait(0.3);
+
+ expect($page->script('document.querySelectorAll(".runtime-log-detail").length'))->toBe(1)
+ ->and($page->script('document.querySelector(".runtime-log-detail").textContent'))->toBe('log line 49990');
+
+ $page->screenshot(filename: 'runtime-logs-virtualized-search');
+});
+
+it('moves ctrl+f to the log search and lets a second ctrl+f reach the browser', function () {
+ $page = visit('/login')
+ ->fill('email', 'test@example.com')
+ ->fill('password', 'password')
+ ->click('Login')
+ ->assertSee('Dashboard')
+ ->navigate("/server/{$this->stack['server']->uuid}/sentinel/logs");
+
+ $page->assertSee('log line 00001')
+ ->assertSee('Ctrl+F')
+ ->script('document.activeElement.blur()');
+
+ $page->keys('body', 'Control+f');
+
+ expect($page->script('document.activeElement.getAttribute("aria-label")'))->toBe('Find in logs');
+
+ // In the search field, Ctrl+F is not intercepted, so the browser find can open.
+ expect($page->script('(() => {
+ const event = new KeyboardEvent("keydown", { key: "f", ctrlKey: true, bubbles: true, cancelable: true });
+ document.activeElement.dispatchEvent(event);
+ return event.defaultPrevented;
+ })()'))->toBeFalse();
+
+ $page->screenshot(filename: 'runtime-logs-find-shortcut');
+});
+
+it('streams only new lines and appends them to the loaded log', function () {
+ $page = visit('/login')
+ ->fill('email', 'test@example.com')
+ ->fill('password', 'password')
+ ->click('Login')
+ ->assertSee('Dashboard')
+ ->navigate("/server/{$this->stack['server']->uuid}/sentinel/logs");
+
+ $page->assertSee('log line 00001')
+ ->click('[title="Stream Logs"]')
+ ->wait(3)
+ ->click('[title="Follow Logs"]')
+ ->wait(0.5)
+ ->assertSee('streamed line after since')
+ ->assertSee('log line 50000');
+
+ Process::assertRan(fn ($process) => str_contains($process->command, 'docker logs --since 2026-09-28T10:13:53.000050000Z -t coolify-sentinel'));
+
+ $page->screenshot(filename: 'runtime-logs-virtualized-stream');
+});