Odoo 20 on cloudron

[vitetj]

Hi everyone!

I've been working on updating the existing Odoo package for Cloudron, originally developed by @njsubedi.

I'm happy to share my fork, which brings Odoo 20 to Cloudron!

GitHub repository:
https://github.com/vitetj/cloudron-odoo

What's included?

• Odoo 20, based on the official Odoo nightly packages
• Cloudron base image 5.0.0 (Ubuntu 24.04)
• PostgreSQL integration
• Cloudron LDAP authentication
• Email integration (sendmail and recvmail)
• WebSocket support for live chat
• Support for custom Odoo modules
• Automatic module updates when upgrading the package
• Installation through Cloudron Community Apps

Installation

You can install it directly from the Cloudron dashboard:

App Store → Community Apps → Add

Use the following URL:

https://raw.githubusercontent.com/vitetj/cloudron-odoo/main/CloudronVersions.json

Community feedback welcome!

This is a community-maintained package, not an official Cloudron application.

I'd love to hear your feedback, especially regarding installation, compatibility, upgrades, and potential improvements.

Feel free to open issues or contribute directly on GitHub.

Hopefully, this will help bring Odoo one step closer to becoming an officially supported Cloudron application!

Cheers,

[james]

Hello @vitetj
Did you know there is now an official Cloudron Community App Store?
You can publish your app there as well https://ca.cloudron.io/

[vitetj]

@james yes i did
https://ca.cloudron.io/app/odoo

[vitetj]

Odoo (community package) 20.0.2 - security update for the PHP RCEs (CVE-2026-109618 / CVE-2026-109619)

Package: Odoo 20 for Cloudron (com.vitetj.odoo)
Repo: https://github.com/vitetj/cloudron-odoo
Install URL (App Store → Community apps): https://raw.githubusercontent.com/vitetj/cloudron-odoo/main/CloudronVersions.json

What changed

• Base image moved from cloudron/base:5.0.0 to cloudron/base:5.1.0 (still Ubuntu 24.04).
• cloudron/base:5.0.0 bundles PHP 8.3, which is affected by the critical unauthenticated RCEs CVE-2026-109618 / CVE-2026-109619 (CERT-EU advisory 2026-018). Odoo is Python and never used that PHP, but the vulnerable interpreter was still present in the container. cloudron/base:5.1.0 no longer ships PHP at all.
• The Dockerfile now fails the build if a PHP interpreter or any php* package ever reappears in the image.
• No functional change to Odoo itself (still nightly 20.0.20260926).

Upgrading

Existing installs pick up 20.0.2 through the normal update check. The update is a plain image swap: no data migration, Odoo does not run -u all since the Odoo release is unchanged.

Note for other packagers

Any community package still built on cloudron/base:5.0.0 carries PHP 8.3 even if the app does not use PHP. Switching to cloudron/base:5.1.0 (no PHP, Ubuntu 24.04) or 6.0.1 (Ubuntu 26.04) removes it; apps that do need PHP should move to cloudron/php-base:8.5-20261021 or 8.4-20261021.

References:

• https://cert.europa.eu/publications/security-advisories/2026-018/
• https://forum.cloudron.io/topic/15806/new-base-image-5.1.0
• https://github.com/vitetj/cloudron-odoo/pull/1