fix: allow docker compose command chaining

[ews-pgasser]

What is this PR about?

This PR updates the sanitizeCommand logic to safely allow && chaining in custom compose deployment commands. Currently, the strict blocklist on & prevents users from executing standard multi-step deployments (such as compose pull && docker compose down && docker compose up -d --build). This is critical for stacks that require full teardowns to clear in-memory caches (e.g., Redis) or sync volume mounts during image updates. The updated logic blocks single & (backgrounding) and strictly enforces that any chained command must securely start with docker compose or docker-compose , maintaining security while unblocking legitimate DevOps workflows.

Checklist

Before submitting this PR, please make sure that:

• You created a dedicated branch based on the canary branch.
• You have read the suggestions in the CONTRIBUTING.md file https://github.com/Dokploy/dokploy/blob/canary/CONTRIBUTING.md#pull-request
• You have tested this PR in your local instance. If you have not tested it yet, please do so before submitting. This helps avoid wasting maintainers' time reviewing code that has not been verified by you.

Issues related (if applicable)

closes #4992

Screenshots (if applicable)

Greptile Summary

This PR permits guarded && chaining in custom Docker Compose deployment commands while continuing to reject unsafe shell metacharacters and non-Compose chain segments.

• Adds validation for paired ampersands and Compose-only chained commands.
• Adds focused acceptance and rejection tests for the new command grammar.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

_{Reviews (3): Last reviewed commit: "chore: add tests" | Re-trigger Greptile}

Context used:

• Knowledge Base — Compose Deployment Flow

[ews-pgasser]

@Siumauricio @narcisonunez please check this PR, we urgently need the docker compose command chaining feature back and there is no possibility to downgrade versions too.

[narcisonunez]

@ews-pgasser

Add tests (compose-command-injection.test.ts)
Run Biome check

[ews-pgasser]

@ews-pgasser

Add tests (compose-command-injection.test.ts) Run Biome check

✅ done, both succeded properly @narcisonunez

---

Biome Check (node_modules/.bin/biome check packages/server/src/utils/builders/compose.ts apps/dokploy/__test__/compose/compose-command-injection.test.ts)

Checked 2 files in 8ms. No fixes applied.

---

Tests (pnpm vitest run --config __test__/vitest.config.ts __test__/compose/compose-command-injection.test.ts)

 ✓ __test__/compose/compose-command-injection.test.ts (13 tests) 43ms
   ✓ compose createCommand injection (13)
     ✓ escapes composePath (docker-compose) 15ms
     ✓ escapes composePath (stack deploy) 10ms
     ✓ escapes appName 10ms
     ✓ rejects a custom command containing shell control characters 2ms
     ✓ allows a legitimate custom command 0ms
     ✓ keeps a legitimate composePath intact 2ms
     ✓ allows chained docker compose commands with '&&' 0ms
     ✓ allows chaining with the legacy 'docker-compose' spelling 0ms
     ✓ rejects a single '&' used for backgrounding 0ms
     ✓ rejects a malformed '&&&' chain 0ms
     ✓ rejects chained segments that are not docker compose invocations 0ms
     ✓ rejects an attempted injection smuggled inside a chained segment 0ms
     ✓ rejects a chain that only pretends to start with docker compose later in the string 0ms
 Test Files  1 passed (1)
      Tests  13 passed (13)
   Start at  11:57:57
   Duration  3.45s (transform 991ms, setup 56ms, import 3.22s, tests 43ms, environment 0ms)